| Bug #33142 | access after free() for blob replication and online alter table | ||
|---|---|---|---|
| Submitted: | 11 Dec 2007 15:01 | Modified: | 15 Dec 2007 10:39 |
| Reporter: | Kristian Nielsen | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Cluster: Replication | Severity: | S2 (Serious) |
| Version: | mysql-5.1-new-ndb latest bk | OS: | Linux |
| Assigned to: | Kristian Nielsen | CPU Architecture: | Any |
[11 Dec 2007 15:04]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/39717 ChangeSet@1.2689, 2007-12-11 16:04:33+01:00, tomas@whalegate.ndb.mysql.com +1 -0 bug#33142: access after free() for blob replication and online alter table
[14 Dec 2007 17:08]
Bugs System
Pushed into 5.1.23-rc
[14 Dec 2007 17:09]
Bugs System
Pushed into 6.0.5-alpha
[15 Dec 2007 10:39]
Jon Stephens
Thank you for your bug report. This issue has been committed to our source repository of that product and will be incorporated into the next release.
If necessary, you can access the source repository and build the latest available version, including the bug fix. More information about accessing the source trees is available at
http://dev.mysql.com/doc/en/installing-source.html
Documented in the 5.1.23 and 6.0.5 changelogs as follows:
Memory was mistakenly freed for NdbBlob
objects when adding an index while replicating the
cluster, which could cause mysqld to crash.
Description: A recently introduced testcase in mysql-5.1-new-ndb exposes a bug (but the bug was there before the test case) The bug is seen as a valgrind warning: VALGRIND: 'Invalid read of size 8' COUNT: 2 FUNCTION: NdbDictionary::Column::getColumnNo() FILES: master.err master1.err TESTS: rpl_ndb.rpl_ndb_extraColMaster STACK: at 0x979370: NdbDictionary::Column::getColumnNo() const (NdbDictionary.cpp:250) by 0x7E0DAE: ndb_unpack_record(st_table*, NdbValue*, st_bitmap*, unsigned char*) (ha_ndbcluster.cc:3460) by 0x802E57: ndb_binlog_thread_handle_data_event(Ndb*, NdbEventOperation*, ndb_binlog_index_row&, injector::transaction&) (ha_ndbcluster_binlog.cc:3363) by 0x80B658: ndb_binlog_thread_func (ha_ndbcluster_binlog.cc:4153) by 0x4B2A192: start_thread (in /lib64/libpthread-2.4.so) by 0x51A145C: clone (in /lib64/libc-2.4.so) Address 0x91601B8 is 0 bytes inside a block of size 136 free'd at 0x4A2066B: free (vg_replace_malloc.c:233) by 0x988274: NdbTableImpl::~NdbTableImpl() (NdbDictionaryImpl.cpp:431) by 0x973492: NdbEventOperationImpl::receive_event() (NdbEventOperationImpl.cpp:796) by 0x97472F: NdbEventBuffer::nextEvent() (NdbEventOperationImpl.cpp:1229) by 0x80AFED: ndb_binlog_thread_func (ha_ndbcluster_binlog.cc:3995) by 0x4B2A192: start_thread (in /lib64/libpthread-2.4.so) by 0x51A145C: clone (in /lib64/libc-2.4.so) The problem is the same as in BUG#18106, but for NdbBlob objects instead of NdbRecAttr objects. For replication of online alter table, the code will free() the old table object, causing later accesses to the NdbColumnImpl object in blob handles to access invalid memory, potentially causing strange behaviour or crash. How to repeat: mysql-test-run.pl rpl_ndb_extraColMaster --valgrind Suggested fix: Tomas will commit a patch that loops over all blob handles and replaces the NdbColumnImpl pointers.