Memcheck 版本 Reindex 列存表逻辑存在 heap used after free-openGauss-server-AtomGit

已关闭

Memcheck 版本 Reindex 列存表逻辑存在 heap used after free #299

sungwu_admin创建于 2024年9月30日关闭于 2025年5月29日

2024年9月30日创建

【标题描述】: Memcheck 版本 Reindex 列存表逻辑存在 heap used after free
【测试类型：SQL功能】
【测试版本：5.0.0】问题描述: memcheck 版本 reindex 流程中处理列存表时，可能存在 heap used after free 问题

【操作系统和硬件信息】(查询命令: cat /etc/system-release, uname -a):

【测试环境】(单机/1主x备x级联备):

【被测功能】: Alter table 功能，触发 reindex

【测试类型】: 功能测试

【数据库版本】(查询命令: gaussdb -V):

【预置条件】:

【操作步骤】(请填写详细的操作步骤):
创建列存表，在列存表上创建唯一索引，执行 alter table 命令，触发 reindex

【预期输出】: 功能正常

【实际输出】: 检测到 heap use after free

==15405==ERROR: AddressSanitizer: heap-use-after-free on address 0x61600084d688 at pc 0x000000b8994d bp 0x7f99f250ae70 sp 0x7f99f250ae68
READ of size 8 at 0x61600084d688 thread T56082 (worker)
#0 0xb8994c in ReindexRelation(unsigned int, int, int, void*, AdaptMem*, bool, IndexKind, bool) src/common/backend/catalog/index.cpp:5796
#1 0x2fe22ef in ExecRewriteCStoreTable src/gausskernel/optimizer/commands/tablecmds.cpp:31596
#2 0x2ec7e95 in ATRewriteTables src/gausskernel/optimizer/commands/tablecmds.cpp:9659
#3 0x2eb8205 in ATController src/gausskernel/optimizer/commands/tablecmds.cpp:8235
#4 0x2eb754a in AlterTable(unsigned int, int, AlterTableStmt*) src/gausskernel/optimizer/commands/tablecmds.cpp:8000
#5 0x357a194 in ProcessUtilitySlow src/gausskernel/process/tcop/utility.cpp:5789
#6 0x35784e4 in standard_ProcessUtility(processutility_context*, _DestReceiver*, bool, char*, ProcessUtilityContext, bool) src/gausskernel/process/tcop/utility.cpp:5310
#7 0x7f9d6bc04112 in gsaudit_ProcessUtility_hook contrib/security_plugin/gs_policy_plugin.cpp:820
#8 0x35a1696 in pgaudit_ProcessUtility src/gausskernel/process/tcop/auditfuncs.cpp:1420
#9 0x36a1aeb in hypo_utility_hook src/gausskernel/dbmind/kernel/hypopg_index.cpp:176
#10 0x356c26d in ProcessUtility(processutility_context*, _DestReceiver*, bool, char*, ProcessUtilityContext, bool) src/gausskernel/process/tcop/utility.cpp:1737
#11 0x355ec39 in PortalRunUtility src/gausskernel/process/tcop/pquery.cpp:1777
#12 0x355fbca in PortalRunMulti src/gausskernel/process/tcop/pquery.cpp:1966
#13 0x355b0cb in PortalRun(PortalData*, long, bool, _DestReceiver*, _DestReceiver*, char*) src/gausskernel/process/tcop/pquery.cpp:1233
#14 0x352b4ad in exec_execute_message src/gausskernel/process/tcop/postgres.cpp:5532
#15 0x353ed14 in PostgresMain(int, char**, char const*, char const*) src/gausskernel/process/tcop/postgres.cpp:9947
#16 0x336f9ed in BackendRun src/gausskernel/process/postmaster/postmaster.cpp:9311
#17 0x3390777 in int GaussDbThreadMain<(knl_thread_role)1>(knl_thread_arg*) src/gausskernel/process/postmaster/postmaster.cpp:13834
#18 0x338903a in InternalThreadFunc src/gausskernel/process/postmaster/postmaster.cpp:14492
#19 0x52440aa in ThreadStarterFunc src/common/port/gs_thread.cpp:382
#20 0x7f9d77e46ea4 in start_thread (/lib64/libpthread.so.0+0x7ea4)
#21 0x7f9d77b6fb0c in clone (/lib64/libc.so.6+0xfeb0c)

0x61600084d688 is located 264 bytes inside of 576-byte region [0x61600084d580,0x61600084d7c0)

freed by thread T56082 (worker) here:
#0 0xab4818 in __interceptor_free ../../.././libsanitizer/asan/asan_malloc_linux.cc:45
#1 0x1fdb3bc in void MemoryProtectFunctions::gs_memprot_free<(MemType)0>(void*, unsigned long) src/common/backend/utils/mmgr/memprot.cpp:851
#2 0x1ff8280 in void AsanMemoryAllocator::AllocSetFree<true, false, false>(MemoryContextData*, void*) src/common/backend/utils/mmgr/AsanMemoryAllocator.cpp:635
#3 0x1fcb0f2 in pfree(void*) src/common/backend/utils/mmgr/mcxt.cpp:1263
#4 0x1c7c5e4 in RelationDestroyRelation(RelationData*, bool) src/common/backend/utils/cache/relcache.cpp:3635
#5 0x1c7d40d in RelationClearRelation(RelationData*, bool) src/common/backend/utils/cache/relcache.cpp:3745
#6 0x1c7fdea in RelationCacheInvalidate() src/common/backend/utils/cache/relcache.cpp:4064
#7 0x1c3444a in InvalidateSessionSystemCaches() src/common/backend/utils/cache/inval.cpp:783
#8 0x1c34422 in InvalidateSystemCaches() src/common/backend/utils/cache/inval.cpp:776
#9 0x4f4be75 in ReceiveSharedInvalidMessages(void ()(SharedInvalidationMessage), void ()(), bool) src/gausskernel/storage/ipc/sinval.cpp:173
#10 0x1c34f24 in AcceptInvalidationMessages() src/common/backend/utils/cache/inval.cpp:906
#11 0x4f65894 in LockRelationOid(unsigned int, int) src/gausskernel/storage/lmgr/lmgr.cpp:89
#12 0x423a2c1 in relation_open(unsigned int, int, short) src/gausskernel/storage/access/heap/heapam.cpp:1490
#13 0x435ffcb in index_open(unsigned int, int, short) src/gausskernel/storage/access/index/indexam.cpp:168
#14 0xb86ac5 in reindex_index(unsigned int, unsigned int, bool, AdaptMem, bool, void*, bool) src/common/backend/catalog/index.cpp:5450
#15 0xb896f6 in ReindexRelation(unsigned int, int, int, void*, AdaptMem*, bool, IndexKind, bool) src/common/backend/catalog/index.cpp:5792
#16 0x2fe22ef in ExecRewriteCStoreTable src/gausskernel/optimizer/commands/tablecmds.cpp:31596
#17 0x2ec7e95 in ATRewriteTables src/gausskernel/optimizer/commands/tablecmds.cpp:9659
#18 0x2eb8205 in ATController src/gausskernel/optimizer/commands/tablecmds.cpp:8235
#19 0x2eb754a in AlterTable(unsigned int, int, AlterTableStmt*) src/gausskernel/optimizer/commands/tablecmds.cpp:8000
#20 0x357a194 in ProcessUtilitySlow src/gausskernel/process/tcop/utility.cpp:5789
#21 0x35784e4 in standard_ProcessUtility(processutility_context*, _DestReceiver*, bool, char*, ProcessUtilityContext, bool) src/gausskernel/process/tcop/utility.cpp:5310
#22 0x7f9d6bc04112 in gsaudit_ProcessUtility_hook contrib/security_plugin/gs_policy_plugin.cpp:820
#23 0x35a1696 in pgaudit_ProcessUtility src/gausskernel/process/tcop/auditfuncs.cpp:1420
#24 0x36a1aeb in hypo_utility_hook src/gausskernel/dbmind/kernel/hypopg_index.cpp:176
#25 0x356c26d in ProcessUtility(processutility_context*, _DestReceiver*, bool, char*, ProcessUtilityContext, bool) src/gausskernel/process/tcop/utility.cpp:1737
#26 0x355ec39 in PortalRunUtility src/gausskernel/process/tcop/pquery.cpp:1777
#27 0x355fbca in PortalRunMulti src/gausskernel/process/tcop/pquery.cpp:1966
#28 0x355b0cb in PortalRun(PortalData*, long, bool, _DestReceiver*, _DestReceiver*, char*) src/gausskernel/process/tcop/pquery.cpp:1233
#29 0x352b4ad in exec_execute_message src/gausskernel/process/tcop/postgres.cpp:5532

previously allocated by thread T56082 (worker) here:
#0 0xab4b70 in __interceptor_malloc ../../.././libsanitizer/asan/asan_malloc_linux.cc:62
#1 0x1fdb353 in void* MemoryProtectFunctions::gs_memprot_malloc<(MemType)0>(unsigned long, bool) src/common/backend/utils/mmgr/memprot.cpp:832
#2 0x1ff0f59 in DoAllocMemoryInternal(MemoryContextData*, unsigned long, char const*, int, MemoryProtectFuncDef*, bool, bool) src/common/backend/utils/mmgr/AsanMemoryAllocator.cpp:473
#3 0x1ff7b0e in void* AsanMemoryAllocator::AllocSetAlloc<true, false, false>(MemoryContextData*, unsigned long, unsigned long, char const*, int) src/common/backend/utils/mmgr/AsanMemoryAllocator.cpp:555
#4 0x1fc9b1d in MemoryContextAllocZeroDebug(MemoryContextData*, unsigned long, char const*, int) src/common/backend/utils/mmgr/mcxt.cpp:1101
#5 0x1c51572 in AllocateRelationDesc src/common/backend/utils/cache/relcache.cpp:1421
#6 0x1c60382 in RelationBuildDesc(unsigned int, bool, bool) src/common/backend/utils/cache/relcache.cpp:2243
#7 0x1c781f4 in RelationIdGetRelation(unsigned int) src/common/backend/utils/cache/relcache.cpp:3294
#8 0x423a2ce in relation_open(unsigned int, int, short) src/gausskernel/storage/access/heap/heapam.cpp:1494
#9 0x435ffcb in index_open(unsigned int, int, short) src/gausskernel/storage/access/index/indexam.cpp:168
#10 0xb893fc in ReindexRelation(unsigned int, int, int, void*, AdaptMem*, bool, IndexKind, bool) src/common/backend/catalog/index.cpp:5783
#11 0x2fe22ef in ExecRewriteCStoreTable src/gausskernel/optimizer/commands/tablecmds.cpp:31596
#12 0x2ec7e95 in ATRewriteTables src/gausskernel/optimizer/commands/tablecmds.cpp:9659
#13 0x2eb8205 in ATController src/gausskernel/optimizer/commands/tablecmds.cpp:8235
#14 0x2eb754a in AlterTable(unsigned int, int, AlterTableStmt*) src/gausskernel/optimizer/commands/tablecmds.cpp:8000
#15 0x357a194 in ProcessUtilitySlow src/gausskernel/process/tcop/utility.cpp:5789
#16 0x35784e4 in standard_ProcessUtility(processutility_context*, _DestReceiver*, bool, char*, ProcessUtilityContext, bool) src/gausskernel/process/tcop/utility.cpp:5310
#17 0x7f9d6bc04112 in gsaudit_ProcessUtility_hook contrib/security_plugin/gs_policy_plugin.cpp:820
#18 0x35a1696 in pgaudit_ProcessUtility src/gausskernel/process/tcop/auditfuncs.cpp:1420
#19 0x36a1aeb in hypo_utility_hook src/gausskernel/dbmind/kernel/hypopg_index.cpp:176
#20 0x356c26d in ProcessUtility(processutility_context*, _DestReceiver*, bool, char*, ProcessUtilityContext, bool) src/gausskernel/process/tcop/utility.cpp:1737
#21 0x355ec39 in PortalRunUtility src/gausskernel/process/tcop/pquery.cpp:1777
#22 0x355fbca in PortalRunMulti src/gausskernel/process/tcop/pquery.cpp:1966
#23 0x355b0cb in PortalRun(PortalData*, long, bool, _DestReceiver*, _DestReceiver*, char*) src/gausskernel/process/tcop/pquery.cpp:1233
#24 0x352b4ad in exec_execute_message src/gausskernel/process/tcop/postgres.cpp:5532
#25 0x353ed14 in PostgresMain(int, char**, char const*, char const*) src/gausskernel/process/tcop/postgres.cpp:9947
#26 0x336f9ed in BackendRun src/gausskernel/process/postmaster/postmaster.cpp:9311
#27 0x3390777 in int GaussDbThreadMain<(knl_thread_role)1>(knl_thread_arg*) src/gausskernel/process/postmaster/postmaster.cpp:13834
#28 0x338903a in InternalThreadFunc src/gausskernel/process/postmaster/postmaster.cpp:14492
#29 0x52440aa in ThreadStarterFunc src/common/port/gs_thread.cpp:382

输入图片说明

【原因分析】:

这个问题的根因
问题推断过程
还有哪些原因可能造成类似现象
该问题是否有临时规避措施
问题解决方案
预计修复问题时间

【日志信息】(请附上日志文件、截图、coredump信息):

【测试代码】:

sungwu_admin

2024年9月30日创建了缺陷

opengauss_bot成员

2024年9月30日评论：

Hi @sungwu_admin, please use the command /sig xxx to add a SIG label to this issue.
For example: /sig sqlengine or /sig storageengine or /sig om or /sig ai and so on.
You can find more SIG labels from Here.
If you have no idea about that, please contact with @xiangxinyong , @zhang_xubo .

opengauss_bot成员

2024年9月30日评论：

Hey @sungwu_admin, Welcome to openGauss Community.
All of the projects in openGauss Community are maintained by @opengauss_bot.
That means the developers can comment below every pull request or issue to trigger Bot Commands.
Please follow instructions at Here to find the details.