Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-16905

ASAN heap-use-after-free in __interceptor_strnlen / ... / TABLE::verify_constraints upon INSERT into temporary table with CHECK constraint

    Details

      Description

      Note: MDEV-16903 is closed now, but the problem described here still exists, so I don't consider it to be a duplicate anymore.

      CREATE TEMPORARY TABLE t1 (a INT DEFAULT 0, CHECK (a > 0));
      ALTER TABLE t1 DROP CONSTRAINT IF EXISTS non_existing_constraint;
      INSERT INTO t1 () VALUES ();
      

      10.3 ASAN 3570ea918

      ==3627==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b00005d981 at pc 0x7fefcf4695fa bp 0x7fefc2c521d0 sp 0x7fefc2c521a8
      READ of size 20 at 0x61b00005d981 thread T5
          #0 0x7fefcf4695f9 in __interceptor_strnlen (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x2a5f9)
          #1 0x55a75a2e5284 in process_str_arg /data/src/10.3/strings/my_vsnprintf.c:205
          #2 0x55a75a2e965d in my_vsnprintf_ex /data/src/10.3/strings/my_vsnprintf.c:626
          #3 0x55a75a1db7f8 in my_error /data/src/10.3/mysys/my_error.c:121
          #4 0x55a758ca466b in TABLE::verify_constraints(bool) /data/src/10.3/sql/table.cc:5260
          #5 0x55a758ca3f02 in TABLE_LIST::view_check_option(THD*, bool) /data/src/10.3/sql/table.cc:5220
          #6 0x55a75895a7b0 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:1040
          #7 0x55a7589f4600 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4726
          #8 0x55a758a0a35e in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8088
          #9 0x55a7589e45f5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850
          #10 0x55a7589e167d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395
          #11 0x55a758d50669 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
          #12 0x55a758d50075 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #13 0x55a759867de9 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
          #14 0x7fefcf229493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
          #15 0x7fefcd60f93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
       
      0x61b00005d994 is located 0 bytes to the right of 1556-byte region [0x61b00005d380,0x61b00005d994)
      freed by thread T5 here:
          #0 0x7fefcf493527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
          #1 0x55a75a222a64 in free_memory /data/src/10.3/mysys/safemalloc.c:279
          #2 0x55a75a22206a in sf_free /data/src/10.3/mysys/safemalloc.c:197
          #3 0x55a75a1f2a7c in my_free /data/src/10.3/mysys/my_malloc.c:222
          #4 0x55a758f0a041 in THD::free_tmp_table_share(TMP_TABLE_SHARE*, bool) /data/src/10.3/sql/temporary_tables.cc:1460
          #5 0x55a758f05784 in THD::drop_temporary_table(TABLE*, bool*, bool) /data/src/10.3/sql/temporary_tables.cc:646
          #6 0x55a758c17b48 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9887
          #7 0x55a758d5f50c in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:495
          #8 0x55a7589ff4c9 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6284
          #9 0x55a758a0a35e in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8088
          #10 0x55a7589e45f5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850
          #11 0x55a7589e167d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395
          #12 0x55a758d50669 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
          #13 0x55a758d50075 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #14 0x55a759867de9 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
          #15 0x7fefcf229493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
       
      previously allocated by thread T5 here:
          #0 0x7fefcf49373f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
          #1 0x55a75a2217da in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
          #2 0x55a75a1f216f in my_malloc /data/src/10.3/mysys/my_malloc.c:101
          #3 0x55a758f07020 in THD::create_temporary_table(handlerton*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*) /data/src/10.3/sql/temporary_tables.cc:940
          #4 0x55a758f02966 in THD::create_and_open_tmp_table(handlerton*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, bool, bool) /data/src/10.3/sql/temporary_tables.cc:76
          #5 0x55a758bf9e40 in create_table_impl /data/src/10.3/sql/sql_table.cc:4984
          #6 0x55a758bfa7e3 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /data/src/10.3/sql/sql_table.cc:5095
          #7 0x55a758bfb243 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /data/src/10.3/sql/sql_table.cc:5188
          #8 0x55a7589f1e3a in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4279
          #9 0x55a758a0a35e in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8088
          #10 0x55a7589e45f5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850
          #11 0x55a7589e167d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395
          #12 0x55a758d50669 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
          #13 0x55a758d50075 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #14 0x55a759867de9 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
          #15 0x7fefcf229493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
       
      Thread T5 created by T0 here:
          #0 0x7fefcf462bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
          #1 0x55a7598683b1 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
          #2 0x55a75874e208 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
          #3 0x55a75876431c in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6563
          #4 0x55a758764a21 in create_new_thread /data/src/10.3/sql/mysqld.cc:6633
          #5 0x55a758765a38 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6908
          #6 0x55a7587637d9 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6185
          #7 0x55a75874c28f in main /data/src/10.3/sql/main.cc:25
          #8 0x7fefcd5472b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
       
      SUMMARY: AddressSanitizer: heap-use-after-free ??:0 __interceptor_strnlen
      Shadow bytes around the buggy address:
        0x0c3680003ae0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3680003af0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3680003b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3680003b10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3680003b20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c3680003b30:[fd]fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3680003b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3680003b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3680003b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3680003b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3680003b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Contiguous container OOB:fc
        ASan internal:           fe
      ==3627==ABORTING
      

      Reproducible with at least InnoDB and MyISAM.
      On non-ASAN builds problems are less obvious, but for example the following has been seen:

      mysqltest: At line 3: query 'INSERT INTO t1 () VALUES ()' failed: 4025: CONSTRAINT `CONSTRAINT_1` failed for `test`.``
      

      (Note the missing table name).

      Here is another test case, from a comment to MDEV-16903, it's also still failing:

      CREATE TEMPORARY TABLE t1 (
        id INT NOT NULL AUTO_INCREMENT,
        f INT NOT NULL DEFAULT 0,
        PRIMARY KEY (id)
      );
      INSERT INTO t1 () VALUES ();
      ALTER IGNORE TABLE t1 ADD CONSTRAINT CHECK (f > 0);
      INSERT INTO t1 () VALUES ();
      

      10.2 37ffdb44ef9

      ==3275==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b00005e759 at pc 0x7f4872cd45fa bp 0x7f486661ebc0 sp 0x7f486661eb98
      READ of size 20 at 0x61b00005e759 thread T5
          #0 0x7f4872cd45f9 in __interceptor_strnlen (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x2a5f9)
          #1 0x55e7c991a36e in process_str_arg /data/src/10.2/strings/my_vsnprintf.c:205
          #2 0x55e7c991e747 in my_vsnprintf_ex /data/src/10.2/strings/my_vsnprintf.c:626
          #3 0x55e7c981045f in my_error /data/src/10.2/mysys/my_error.c:121
          #4 0x55e7c847f860 in TABLE::verify_constraints(bool) /data/src/10.2/sql/table.cc:5181
          #5 0x55e7c847f1cc in TABLE_LIST::view_check_option(THD*, bool) /data/src/10.2/sql/table.cc:5143
          #6 0x55e7c8184dd2 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.2/sql/sql_insert.cc:1034
          #7 0x55e7c81e75aa in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4438
          #8 0x55e7c81fe9eb in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8015
          #9 0x55e7c81d93d8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1826
          #10 0x55e7c81d646d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1379
          #11 0x55e7c851c88c in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
          #12 0x55e7c851c2a1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
          #13 0x55e7c8f37511 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
          #14 0x7f4872a94493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
          #15 0x7f4870e7a93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
       
      0x61b00005e76c is located 0 bytes to the right of 1516-byte region [0x61b00005e180,0x61b00005e76c)
      freed by thread T5 here:
          #0 0x7f4872cfe527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
          #1 0x55e7c9858a13 in free_memory /data/src/10.2/mysys/safemalloc.c:279
          #2 0x55e7c9858019 in sf_free /data/src/10.2/mysys/safemalloc.c:197
          #3 0x55e7c98272a8 in my_free /data/src/10.2/mysys/my_malloc.c:217
          #4 0x55e7c8690781 in THD::free_tmp_table_share(TMP_TABLE_SHARE*, bool) /data/src/10.2/sql/temporary_tables.cc:1432
          #5 0x55e7c868c2ab in THD::drop_temporary_table(TABLE*, bool*, bool) /data/src/10.2/sql/temporary_tables.cc:637
          #6 0x55e7c8400797 in mysql_alter_table(THD*, char*, char*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.2/sql/sql_table.cc:9615
          #7 0x55e7c852ad16 in Sql_cmd_alter_table::execute(THD*) /data/src/10.2/sql/sql_alter.cc:329
          #8 0x55e7c81f3eb5 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:6228
          #9 0x55e7c81fe9eb in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8015
          #10 0x55e7c81d93d8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1826
          #11 0x55e7c81d646d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1379
          #12 0x55e7c851c88c in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
          #13 0x55e7c851c2a1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
          #14 0x55e7c8f37511 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
          #15 0x7f4872a94493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
       
      previously allocated by thread T5 here:
          #0 0x7f4872cfe73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
          #1 0x55e7c9857789 in sf_malloc /data/src/10.2/mysys/safemalloc.c:118
          #2 0x55e7c98269e0 in my_malloc /data/src/10.2/mysys/my_malloc.c:101
          #3 0x55e7c868d95c in THD::create_temporary_table(handlerton*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*) /data/src/10.2/sql/temporary_tables.cc:931
          #4 0x55e7c868993d in THD::create_and_open_tmp_table(handlerton*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, bool) /data/src/10.2/sql/temporary_tables.cc:74
          #5 0x55e7c83e3336 in create_table_impl /data/src/10.2/sql/sql_table.cc:4915
          #6 0x55e7c83e3c1d in mysql_create_table_no_lock(THD*, char const*, char const*, Table_specification_st*, Alter_info*, bool*, int) /data/src/10.2/sql/sql_table.cc:5019
          #7 0x55e7c83e444c in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /data/src/10.2/sql/sql_table.cc:5082
          #8 0x55e7c81e4dbc in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3991
          #9 0x55e7c81fe9eb in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8015
          #10 0x55e7c81d93d8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1826
          #11 0x55e7c81d646d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1379
          #12 0x55e7c851c88c in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
          #13 0x55e7c851c2a1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
          #14 0x55e7c8f37511 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
          #15 0x7f4872a94493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
       
      Thread T5 created by T0 here:
          #0 0x7f4872ccdbba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
          #1 0x55e7c8f37ad9 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1912
          #2 0x55e7c7fd2c8e in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1239
          #3 0x55e7c7fe7c2b in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6466
          #4 0x55e7c7fe8330 in create_new_thread /data/src/10.2/sql/mysqld.cc:6536
          #5 0x55e7c7fe9347 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6811
          #6 0x55e7c7fe7180 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6085
          #7 0x55e7c7fd102f in main /data/src/10.2/sql/main.cc:25
          #8 0x7f4870db22b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
       
      SUMMARY: AddressSanitizer: heap-use-after-free ??:0 __interceptor_strnlen
      Shadow bytes around the buggy address:
        0x0c3680003c90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3680003ca0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3680003cb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3680003cc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3680003cd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c3680003ce0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fa fa
        0x0c3680003cf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3680003d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3680003d10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3680003d20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3680003d30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Contiguous container OOB:fc
        ASan internal:           fe
      ==3275==ABORTING
      

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                serg Sergei Golubchik
                Reporter:
                elenst Elena Stepanova
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: