[MDEV-16905] ASAN heap-use-after-free in __interceptor_strnlen / ... / TABLE::verify_constraints upon INSERT into temporary table with CHECK constraint - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.2, 10.3, 10.4
Fix Version/s: 10.4.3, 10.2.22, 10.3.13
Component/s: Data Definition - Temporary, Data Manipulation - Insert
Labels:
None

Description

Note: ~~MDEV-16903~~ is closed now, but the problem described here still exists, so I don't consider it to be a duplicate anymore.

CREATE TEMPORARY TABLE t1 (a INT DEFAULT 0, CHECK (a > 0));

ALTER TABLE t1 DROP CONSTRAINT IF EXISTS non_existing_constraint;

INSERT INTO t1 () VALUES ();

10.3 ASAN 3570ea918
==3627==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b00005d981 at pc 0x7fefcf4695fa bp 0x7fefc2c521d0 sp 0x7fefc2c521a8
READ of size 20 at 0x61b00005d981 thread T5
#0 0x7fefcf4695f9 in __interceptor_strnlen (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x2a5f9)
#1 0x55a75a2e5284 in process_str_arg /data/src/10.3/strings/my_vsnprintf.c:205
#2 0x55a75a2e965d in my_vsnprintf_ex /data/src/10.3/strings/my_vsnprintf.c:626
#3 0x55a75a1db7f8 in my_error /data/src/10.3/mysys/my_error.c:121
#4 0x55a758ca466b in TABLE::verify_constraints(bool) /data/src/10.3/sql/table.cc:5260
#5 0x55a758ca3f02 in TABLE_LIST::view_check_option(THD*, bool) /data/src/10.3/sql/table.cc:5220
#6 0x55a75895a7b0 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:1040
#7 0x55a7589f4600 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4726
#8 0x55a758a0a35e in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8088
#9 0x55a7589e45f5 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850
#10 0x55a7589e167d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395
#11 0x55a758d50669 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
#12 0x55a758d50075 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#13 0x55a759867de9 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
#14 0x7fefcf229493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#15 0x7fefcd60f93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x61b00005d994 is located 0 bytes to the right of 1556-byte region [0x61b00005d380,0x61b00005d994)
freed by thread T5 here:
#0 0x7fefcf493527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
#1 0x55a75a222a64 in free_memory /data/src/10.3/mysys/safemalloc.c:279
#2 0x55a75a22206a in sf_free /data/src/10.3/mysys/safemalloc.c:197
#3 0x55a75a1f2a7c in my_free /data/src/10.3/mysys/my_malloc.c:222
#4 0x55a758f0a041 in THD::free_tmp_table_share(TMP_TABLE_SHARE*, bool) /data/src/10.3/sql/temporary_tables.cc:1460
#5 0x55a758f05784 in THD::drop_temporary_table(TABLE, bool, bool) /data/src/10.3/sql/temporary_tables.cc:646
#6 0x55a758c17b48 in mysql_alter_table(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, HA_CREATE_INFO, TABLE_LIST, Alter_info, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9887
#7 0x55a758d5f50c in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:495
#8 0x55a7589ff4c9 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6284
#9 0x55a758a0a35e in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8088
#10 0x55a7589e45f5 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850
#11 0x55a7589e167d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395
#12 0x55a758d50669 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
#13 0x55a758d50075 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#14 0x55a759867de9 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
#15 0x7fefcf229493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

previously allocated by thread T5 here:
#0 0x7fefcf49373f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x55a75a2217da in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
#2 0x55a75a1f216f in my_malloc /data/src/10.3/mysys/my_malloc.c:101
#3 0x55a758f07020 in THD::create_temporary_table(handlerton, st_mysql_const_unsigned_lex_string, char const, char const, char const*) /data/src/10.3/sql/temporary_tables.cc:940
#4 0x55a758f02966 in THD::create_and_open_tmp_table(handlerton, st_mysql_const_unsigned_lex_string, char const, char const, char const*, bool, bool) /data/src/10.3/sql/temporary_tables.cc:76
#5 0x55a758bf9e40 in create_table_impl /data/src/10.3/sql/sql_table.cc:4984
#6 0x55a758bfa7e3 in mysql_create_table_no_lock(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, Table_specification_st, Alter_info, bool, int, TABLE_LIST*) /data/src/10.3/sql/sql_table.cc:5095
#7 0x55a758bfb243 in mysql_create_table(THD, TABLE_LIST, Table_specification_st, Alter_info) /data/src/10.3/sql/sql_table.cc:5188
#8 0x55a7589f1e3a in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4279
#9 0x55a758a0a35e in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8088
#10 0x55a7589e45f5 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850
#11 0x55a7589e167d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395
#12 0x55a758d50669 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
#13 0x55a758d50075 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#14 0x55a759867de9 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
#15 0x7fefcf229493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

Thread T5 created by T0 here:
#0 0x7fefcf462bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
#1 0x55a7598683b1 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
#2 0x55a75874e208 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
#3 0x55a75876431c in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6563
#4 0x55a758764a21 in create_new_thread /data/src/10.3/sql/mysqld.cc:6633
#5 0x55a758765a38 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6908
#6 0x55a7587637d9 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6185
#7 0x55a75874c28f in main /data/src/10.3/sql/main.cc:25
#8 0x7fefcd5472b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-use-after-free ??:0 __interceptor_strnlen
Shadow bytes around the buggy address:
0x0c3680003ae0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3680003af0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3680003b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3680003b10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3680003b20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c3680003b30:[fd]fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3680003b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3680003b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3680003b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3680003b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3680003b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==3627==ABORTING

Reproducible with at least InnoDB and MyISAM.
On non-ASAN builds problems are less obvious, but for example the following has been seen:

mysqltest: At line 3: query 'INSERT INTO t1 () VALUES ()' failed: 4025: CONSTRAINT `CONSTRAINT_1` failed for `test`.``

(Note the missing table name).

Here is another test case, from a comment to ~~MDEV-16903~~, it's also still failing:

CREATE TEMPORARY TABLE t1 (

  id INT NOT NULL AUTO_INCREMENT,

  f INT NOT NULL DEFAULT 0,

  PRIMARY KEY (id)

);

INSERT INTO t1 () VALUES ();

ALTER IGNORE TABLE t1 ADD CONSTRAINT CHECK (f > 0);

INSERT INTO t1 () VALUES ();

10.2 37ffdb44ef9
==3275==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b00005e759 at pc 0x7f4872cd45fa bp 0x7f486661ebc0 sp 0x7f486661eb98
READ of size 20 at 0x61b00005e759 thread T5
#0 0x7f4872cd45f9 in __interceptor_strnlen (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x2a5f9)
#1 0x55e7c991a36e in process_str_arg /data/src/10.2/strings/my_vsnprintf.c:205
#2 0x55e7c991e747 in my_vsnprintf_ex /data/src/10.2/strings/my_vsnprintf.c:626
#3 0x55e7c981045f in my_error /data/src/10.2/mysys/my_error.c:121
#4 0x55e7c847f860 in TABLE::verify_constraints(bool) /data/src/10.2/sql/table.cc:5181
#5 0x55e7c847f1cc in TABLE_LIST::view_check_option(THD*, bool) /data/src/10.2/sql/table.cc:5143
#6 0x55e7c8184dd2 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.2/sql/sql_insert.cc:1034
#7 0x55e7c81e75aa in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4438
#8 0x55e7c81fe9eb in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8015
#9 0x55e7c81d93d8 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1826
#10 0x55e7c81d646d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1379
#11 0x55e7c851c88c in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
#12 0x55e7c851c2a1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
#13 0x55e7c8f37511 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
#14 0x7f4872a94493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#15 0x7f4870e7a93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x61b00005e76c is located 0 bytes to the right of 1516-byte region [0x61b00005e180,0x61b00005e76c)
freed by thread T5 here:
#0 0x7f4872cfe527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
#1 0x55e7c9858a13 in free_memory /data/src/10.2/mysys/safemalloc.c:279
#2 0x55e7c9858019 in sf_free /data/src/10.2/mysys/safemalloc.c:197
#3 0x55e7c98272a8 in my_free /data/src/10.2/mysys/my_malloc.c:217
#4 0x55e7c8690781 in THD::free_tmp_table_share(TMP_TABLE_SHARE*, bool) /data/src/10.2/sql/temporary_tables.cc:1432
#5 0x55e7c868c2ab in THD::drop_temporary_table(TABLE, bool, bool) /data/src/10.2/sql/temporary_tables.cc:637
#6 0x55e7c8400797 in mysql_alter_table(THD, char, char, HA_CREATE_INFO, TABLE_LIST, Alter_info, unsigned int, st_order*, bool) /data/src/10.2/sql/sql_table.cc:9615
#7 0x55e7c852ad16 in Sql_cmd_alter_table::execute(THD*) /data/src/10.2/sql/sql_alter.cc:329
#8 0x55e7c81f3eb5 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:6228
#9 0x55e7c81fe9eb in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8015
#10 0x55e7c81d93d8 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1826
#11 0x55e7c81d646d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1379
#12 0x55e7c851c88c in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
#13 0x55e7c851c2a1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
#14 0x55e7c8f37511 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
#15 0x7f4872a94493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

previously allocated by thread T5 here:
#0 0x7f4872cfe73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x55e7c9857789 in sf_malloc /data/src/10.2/mysys/safemalloc.c:118
#2 0x55e7c98269e0 in my_malloc /data/src/10.2/mysys/my_malloc.c:101
#3 0x55e7c868d95c in THD::create_temporary_table(handlerton, st_mysql_const_unsigned_lex_string, char const, char const, char const*) /data/src/10.2/sql/temporary_tables.cc:931
#4 0x55e7c868993d in THD::create_and_open_tmp_table(handlerton, st_mysql_const_unsigned_lex_string, char const, char const, char const*, bool) /data/src/10.2/sql/temporary_tables.cc:74
#5 0x55e7c83e3336 in create_table_impl /data/src/10.2/sql/sql_table.cc:4915
#6 0x55e7c83e3c1d in mysql_create_table_no_lock(THD, char const, char const, Table_specification_st, Alter_info, bool, int) /data/src/10.2/sql/sql_table.cc:5019
#7 0x55e7c83e444c in mysql_create_table(THD, TABLE_LIST, Table_specification_st, Alter_info) /data/src/10.2/sql/sql_table.cc:5082
#8 0x55e7c81e4dbc in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3991
#9 0x55e7c81fe9eb in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8015
#10 0x55e7c81d93d8 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1826
#11 0x55e7c81d646d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1379
#12 0x55e7c851c88c in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
#13 0x55e7c851c2a1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
#14 0x55e7c8f37511 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
#15 0x7f4872a94493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

Thread T5 created by T0 here:
#0 0x7f4872ccdbba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
#1 0x55e7c8f37ad9 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1912
#2 0x55e7c7fd2c8e in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1239
#3 0x55e7c7fe7c2b in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6466
#4 0x55e7c7fe8330 in create_new_thread /data/src/10.2/sql/mysqld.cc:6536
#5 0x55e7c7fe9347 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6811
#6 0x55e7c7fe7180 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6085
#7 0x55e7c7fd102f in main /data/src/10.2/sql/main.cc:25
#8 0x7f4870db22b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-use-after-free ??:0 __interceptor_strnlen
Shadow bytes around the buggy address:
0x0c3680003c90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3680003ca0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3680003cb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3680003cc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3680003cd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c3680003ce0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fa fa
0x0c3680003cf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3680003d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3680003d10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3680003d20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3680003d30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==3275==ABORTING

Attachments

Issue Links

relates to

MDEV-16903 Assertion `!auto_increment_field_not_null' failed in TABLE::init after unsuccessful attempt to add CHECK constraint on temporary table

Closed

ASAN heap-use-after-free in __interceptor_strnlen / ... / TABLE::verify_constraints upon INSERT into temporary table with CHECK constraint

Details

Description

Attachments

Issue Links

Activity

People

Dates

Git Integration