Skip to content

MDEV-33170: ASAN errors upon CONVERT TABLE TO PARTITION with query cache#5120

Open
grooverdan wants to merge 1 commit into
MariaDB:10.11from
grooverdan:MDEV-33170
Open

MDEV-33170: ASAN errors upon CONVERT TABLE TO PARTITION with query cache#5120
grooverdan wants to merge 1 commit into
MariaDB:10.11from
grooverdan:MDEV-33170

Conversation

@grooverdan
Copy link
Copy Markdown
Member

With a fast altering partition mechanism, the table cache of the the moved partition is invalided in alter_partition_convert_in.

Let's invalidate the query cache of these table involved in the query early.

This prevents a use after free that was previous there when the query_cache_invalidate was at the end of the function and the references to tables where closed and frred.

With a fast altering partition mechanism, the table cache of the
the moved partition is invalided in alter_partition_convert_in.

Let's invalidate the query cache of these table involved in the query
early.

This prevents a use after free that was previous there when the
query_cache_invalidate was at the end of the function and the
references to tables where closed and frred.
@grooverdan grooverdan requested a review from sanja-byelkin May 25, 2026 05:21
@grooverdan grooverdan added the MariaDB Foundation Pull requests created by MariaDB Foundation label May 25, 2026
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request addresses MDEV-33170, which caused ASAN errors during 'CONVERT TABLE TO PARTITION' operations when the query cache was active. The changes include a new regression test and a relocation of the query cache invalidation logic. However, feedback indicates that removing the invalidation from the common exit point 'fast_end_partition' introduces regressions for other partition operations like ADD, DROP, and REORGANIZE. It is recommended to move the invalidation to the beginning of 'fast_alter_partition_table' to ensure all operations are covered and to nullify table pointers to prevent potential Use-After-Free issues.

Comment thread sql/sql_partition.cc

thd->proc_info="end";

query_cache_invalidate3(thd, table_list, 0);
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Removing query_cache_invalidate3 from fast_end_partition introduces a regression for other fast partition operations (e.g., ADD PARTITION, DROP PARTITION, REORGANIZE PARTITION). Since fast_end_partition is the common exit point for all fast partition alterations, these operations will no longer invalidate the query cache, leading to stale results. To fix the Use-After-Free while maintaining correctness, the invalidation should be moved to a common point at the beginning of fast_alter_partition_table to ensure all operations are covered and the cache is invalidated before any tables are closed or freed.

Comment thread sql/sql_partition.cc
check_table_data(lpt))
goto err;

query_cache_invalidate3(thd, table_list, 0);
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

While moving the invalidation here fixes the Use-After-Free for the CONVERT_IN case, it is incomplete as it doesn't cover other operations previously handled by fast_end_partition. Furthermore, to prevent potential Use-After-Free issues in subsequent invalidation calls (such as the one at the end of mysql_alter_table), any TABLE pointers in table_list that are closed or freed during the operation should be explicitly set to NULL.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

MariaDB Foundation Pull requests created by MariaDB Foundation

Development

Successfully merging this pull request may close these issues.

2 participants