Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-17616

ASAN heap-use-after-free in subselect_engine::calc_const_tables on 2nd execution of PS

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Confirmed (View Workflow)
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 5.5, 10.0, 10.1, 10.2
    • Fix Version/s: 5.5, 10.0, 10.1, 10.2
    • Component/s: None
    • Labels:
      None

      Description

      CREATE TABLE t1 (a INT);
      INSERT INTO t1 VALUES (3),(8);
       
      CREATE TABLE t2 (b INT);
      INSERT INTO t2 VALUES (2),(1);
       
      prepare stmt from "SELECT a FROM t1
      WHERE 9 IN ( SELECT MIN( a ) FROM t1 )  AND 1<>1 
      HAVING a <> ( SELECT COUNT(*) FROM t2 ) 
      ORDER BY a;";
      execute stmt;
      execute stmt;
      

       10.2 af9649c722810eb1754953eb406a84ec876ce693
      Version: '10.2.19-MariaDB-debug-log' 
      =================================================================
      ==4378==ERROR: AddressSanitizer: heap-use-after-free on address 0x622000039c1d at pc 0x55a599d3fe81 bp 0x7fc6107bae50 sp 0x7fc6107bae40
      READ of size 1 at 0x622000039c1d thread T27
          #0 0x55a599d3fe80 in subselect_engine::calc_const_tables(List<TABLE_LIST>&) /git/10.2/sql/item_subselect.cc:4376
          #1 0x55a599d3ffd3 in subselect_single_select_engine::upper_select_const_tables() /git/10.2/sql/item_subselect.cc:4385
          #2 0x55a599d20274 in Item_subselect::update_used_tables() /git/10.2/sql/item_subselect.cc:950
          #3 0x55a5994ba9e5 in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join(Item*) /git/10.2/sql/item.h:4043
          #4 0x55a5994baa61 in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join(unsigned int, Item**) /git/10.2/sql/item.h:4055
          #5 0x55a5994be166 in Item_func::update_used_tables() /git/10.2/sql/item_func.h:144
          #6 0x55a5995811e8 in st_select_lex::update_used_tables() /git/10.2/sql/sql_lex.cc:4253
          #7 0x55a599634e04 in JOIN::optimize_inner() /git/10.2/sql/sql_select.cc:1232
          #8 0x55a599633aa0 in JOIN::optimize() /git/10.2/sql/sql_select.cc:1115
          #9 0x55a59964cd76 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /git/10.2/sql/sql_select.cc:3790
          #10 0x55a59962c938 in handle_select(THD*, LEX*, select_result*, unsigned long) /git/10.2/sql/sql_select.cc:376
          #11 0x55a5995b36f3 in execute_sqlcom_select /git/10.2/sql/sql_parse.cc:6477
          #12 0x55a5995a0703 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3484
          #13 0x55a599602b49 in Prepared_statement::execute(String*, bool) /git/10.2/sql/sql_prepare.cc:4787
          #14 0x55a5995fe511 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /git/10.2/sql/sql_prepare.cc:4216
          #15 0x55a5995f918b in mysql_sql_stmt_execute(THD*) /git/10.2/sql/sql_prepare.cc:3324
          #16 0x55a5995a0748 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3500
          #17 0x55a5995bbe58 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.2/sql/sql_parse.cc:8011
          #18 0x55a5995973a7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.2/sql/sql_parse.cc:1824
          #19 0x55a59959455b in do_command(THD*) /git/10.2/sql/sql_parse.cc:1378
          #20 0x55a5998b9aa1 in do_handle_one_connection(CONNECT*) /git/10.2/sql/sql_connect.cc:1335
          #21 0x55a5998b94a9 in handle_one_connection /git/10.2/sql/sql_connect.cc:1241
          #22 0x55a59aa5e8ff in pfs_spawn_thread /git/10.2/storage/perfschema/pfs.cc:1862
          #23 0x7fc627da66b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
          #24 0x7fc62723b41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)
       
      0x622000039c1d is located 2845 bytes inside of 5028-byte region [0x622000039100,0x62200003a4a4)
      freed by thread T27 here:
          #0 0x7fc62921f2ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
          #1 0x55a59ab7aaca in free_memory /git/10.2/mysys/safemalloc.c:279
          #2 0x55a59ab7a154 in sf_free /git/10.2/mysys/safemalloc.c:197
          #3 0x55a59ab4ac4d in my_free /git/10.2/mysys/my_malloc.c:217
          #4 0x55a59ab2cfd3 in free_root /git/10.2/mysys/my_alloc.c:393
          #5 0x55a5996a804f in free_tmp_table(THD*, TABLE*) /git/10.2/sql/sql_select.cc:18079
          #6 0x55a599d44e88 in subselect_hash_sj_engine::cleanup() /git/10.2/sql/item_subselect.cc:5220
          #7 0x55a599d1a434 in Item_subselect::cleanup() /git/10.2/sql/item_subselect.cc:155
          #8 0x55a599d1ab37 in Item_in_subselect::cleanup() /git/10.2/sql/item_subselect.cc:196
          #9 0x55a599592e94 in cleanup_items(Item*) /git/10.2/sql/sql_parse.cc:1135
          #10 0x55a5995fc572 in Prepared_statement::cleanup_stmt() /git/10.2/sql/sql_prepare.cc:3851
          #11 0x55a599602e1f in Prepared_statement::execute(String*, bool) /git/10.2/sql/sql_prepare.cc:4815
          #12 0x55a5995fe511 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /git/10.2/sql/sql_prepare.cc:4216
          #13 0x55a5995f918b in mysql_sql_stmt_execute(THD*) /git/10.2/sql/sql_prepare.cc:3324
          #14 0x55a5995a0748 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3500
          #15 0x55a5995bbe58 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.2/sql/sql_parse.cc:8011
          #16 0x55a5995973a7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.2/sql/sql_parse.cc:1824
          #17 0x55a59959455b in do_command(THD*) /git/10.2/sql/sql_parse.cc:1378
          #18 0x55a5998b9aa1 in do_handle_one_connection(CONNECT*) /git/10.2/sql/sql_connect.cc:1335
          #19 0x55a5998b94a9 in handle_one_connection /git/10.2/sql/sql_connect.cc:1241
          #20 0x55a59aa5e8ff in pfs_spawn_thread /git/10.2/storage/perfschema/pfs.cc:1862
          #21 0x7fc627da66b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
       
      previously allocated by thread T27 here:
          #0 0x7fc62921f602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
          #1 0x55a59ab79b25 in sf_malloc /git/10.2/mysys/safemalloc.c:118
          #2 0x55a59ab4a40f in my_malloc /git/10.2/mysys/my_malloc.c:101
          #3 0x55a59ab2c1a0 in alloc_root /git/10.2/mysys/my_alloc.c:242
          #4 0x55a59ab2c869 in multi_alloc_root /git/10.2/mysys/my_alloc.c:310
          #5 0x55a59969c489 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, char const*, bool, bool) /git/10.2/sql/sql_select.cc:16683
          #6 0x55a5995030d5 in select_materialize_with_stats::create_result_table(THD*, List<Item>*, bool, unsigned long long, char const*, bool, bool, bool) /git/10.2/sql/sql_class.cc:3827
          #7 0x55a599d42b67 in subselect_hash_sj_engine::init(List<Item>*, unsigned int) /git/10.2/sql/item_subselect.cc:4983
          #8 0x55a599d38535 in Item_in_subselect::setup_mat_engine() /git/10.2/sql/item_subselect.cc:3404
          #9 0x55a599986102 in JOIN::choose_subquery_plan(unsigned long long) /git/10.2/sql/opt_subselect.cc:5912
          #10 0x55a59965418b in make_join_statistics /git/10.2/sql/sql_select.cc:4580
          #11 0x55a599638251 in JOIN::optimize_inner() /git/10.2/sql/sql_select.cc:1580
          #12 0x55a599633aa0 in JOIN::optimize() /git/10.2/sql/sql_select.cc:1115
          #13 0x55a599d1efd2 in Item_in_subselect::optimize(double*, double*) /git/10.2/sql/item_subselect.cc:760
          #14 0x55a599984068 in setup_jtbm_semi_joins(JOIN*, List<TABLE_LIST>*, Item**) /git/10.2/sql/opt_subselect.cc:5551
          #15 0x55a599635e29 in JOIN::optimize_inner() /git/10.2/sql/sql_select.cc:1345
          #16 0x55a599633aa0 in JOIN::optimize() /git/10.2/sql/sql_select.cc:1115
          #17 0x55a59964cd76 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /git/10.2/sql/sql_select.cc:3790
          #18 0x55a59962c938 in handle_select(THD*, LEX*, select_result*, unsigned long) /git/10.2/sql/sql_select.cc:376
          #19 0x55a5995b36f3 in execute_sqlcom_select /git/10.2/sql/sql_parse.cc:6477
          #20 0x55a5995a0703 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3484
          #21 0x55a599602b49 in Prepared_statement::execute(String*, bool) /git/10.2/sql/sql_prepare.cc:4787
          #22 0x55a5995fe511 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /git/10.2/sql/sql_prepare.cc:4216
          #23 0x55a5995f918b in mysql_sql_stmt_execute(THD*) /git/10.2/sql/sql_prepare.cc:3324
          #24 0x55a5995a0748 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3500
          #25 0x55a5995bbe58 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.2/sql/sql_parse.cc:8011
          #26 0x55a5995973a7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.2/sql/sql_parse.cc:1824
          #27 0x55a59959455b in do_command(THD*) /git/10.2/sql/sql_parse.cc:1378
          #28 0x55a5998b9aa1 in do_handle_one_connection(CONNECT*) /git/10.2/sql/sql_connect.cc:1335
          #29 0x55a5998b94a9 in handle_one_connection /git/10.2/sql/sql_connect.cc:1241
       
      Thread T27 created by T0 here:
          #0 0x7fc6291bd253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
          #1 0x55a59aa5ecec in spawn_thread_v1 /git/10.2/storage/perfschema/pfs.cc:1912
          #2 0x55a5993a3e46 in inline_mysql_thread_create /git/10.2/include/mysql/psi/mysql_thread.h:1239
          #3 0x55a5993b806c in create_thread_to_handle_connection(CONNECT*) /git/10.2/sql/mysqld.cc:6454
          #4 0x55a5993b876c in create_new_thread /git/10.2/sql/mysqld.cc:6524
          #5 0x55a5993b97af in handle_connections_sockets() /git/10.2/sql/mysqld.cc:6799
          #6 0x55a5993b75bc in mysqld_main(int, char**) /git/10.2/sql/mysqld.cc:6073
          #7 0x55a5993a27df in main /git/10.2/sql/main.cc:25
          #8 0x7fc62715482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
       
      SUMMARY: AddressSanitizer: heap-use-after-free /git/10.2/sql/item_subselect.cc:4376 subselect_engine::calc_const_tables(List<TABLE_LIST>&)
      Shadow bytes around the buggy address:
        0x0c447ffff330: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c447ffff340: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c447ffff350: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c447ffff360: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c447ffff370: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c447ffff380: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c447ffff390: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c447ffff3a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c447ffff3b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c447ffff3c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c447ffff3d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
      ==4378==ABORTING
      ----------SERVER LOG END-------------
      

       5.5 b68d8a05d326bed43aefa73d717c0307278ca6bb
      Version: '5.5.63-MariaDB-debug'  socket: '/git/5.5/mysql-test/var/tmp/mysqld.1.sock'  port: 16000  Source distribution
      =================================================================
      ==4146==ERROR: AddressSanitizer: heap-use-after-free on address 0x621000062195 at pc 0x000000bdc805 bp 0x7f1d7d987b00 sp 0x7f1d7d987af0
      READ of size 1 at 0x621000062195 thread T15
          #0 0xbdc804 in subselect_engine::calc_const_tables(List<TABLE_LIST>&) /git/5.5/sql/item_subselect.cc:3783
          #1 0xbdc8a8 in subselect_single_select_engine::upper_select_const_tables() /git/5.5/sql/item_subselect.cc:3792
          #2 0xbc1c0d in Item_subselect::update_used_tables() /git/5.5/sql/item_subselect.cc:885
          #3 0xb2e737 in Item_func::update_used_tables() /git/5.5/sql/item_func.cc:448
          #4 0x66723f in st_select_lex::update_used_tables() /git/5.5/sql/sql_lex.cc:3925
          #5 0x75cb89 in JOIN::optimize() /git/5.5/sql/sql_select.cc:1020
          #6 0x76a8d7 in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /git/5.5/sql/sql_select.cc:3119
          #7 0x76b149 in handle_select(THD*, LEX*, select_result*, unsigned long) /git/5.5/sql/sql_select.cc:323
          #8 0x66d464 in execute_sqlcom_select /git/5.5/sql/sql_parse.cc:4678
          #9 0x6831a6 in mysql_execute_command(THD*) /git/5.5/sql/sql_parse.cc:2224
          #10 0x6c2f22 in Prepared_statement::execute(String*, bool) /git/5.5/sql/sql_prepare.cc:3933
          #11 0x6c380a in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /git/5.5/sql/sql_prepare.cc:3591
          #12 0x6c4520 in mysql_sql_stmt_execute(THD*) /git/5.5/sql/sql_prepare.cc:2740
          #13 0x6831ca in mysql_execute_command(THD*) /git/5.5/sql/sql_parse.cc:2234
          #14 0x694e8a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /git/5.5/sql/sql_parse.cc:5923
          #15 0x698287 in dispatch_command(enum_server_command, THD*, char*, unsigned int) /git/5.5/sql/sql_parse.cc:1066
          #16 0x69c365 in do_command(THD*) /git/5.5/sql/sql_parse.cc:793
          #17 0x8ce523 in do_handle_one_connection(THD*) /git/5.5/sql/sql_connect.cc:1268
          #18 0x8ce79c in handle_one_connection /git/5.5/sql/sql_connect.cc:1184
          #19 0x143c257 in pfs_spawn_thread /git/5.5/storage/perfschema/pfs.cc:1015
          #20 0x7f1d8beed6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
          #21 0x7f1d8b39441c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)
       
      0x621000062195 is located 2197 bytes inside of 4108-byte region [0x621000061900,0x62100006290c)
      freed by thread T15 here:
          #0 0x7f1d8c5d52ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
          #1 0x15033da in free_memory /git/5.5/mysys/safemalloc.c:205
       
      previously allocated by thread T15 here:
          #0 0x7f1d8c5d5602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
          #1 0x15034d2 in sf_malloc /git/5.5/mysys/safemalloc.c:105
       
      Thread T15 created by T0 here:
          #0 0x7f1d8c573253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
          #1 0x143f821 in spawn_thread_v1 /git/5.5/storage/perfschema/pfs.cc:1038
       
      SUMMARY: AddressSanitizer: heap-use-after-free /git/5.5/sql/item_subselect.cc:3783 subselect_engine::calc_const_tables(List<TABLE_LIST>&)
      Shadow bytes around the buggy address:
        0x0c42800043e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c42800043f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4280004400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4280004410: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4280004420: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c4280004430: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4280004440: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4280004450: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4280004460: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4280004470: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4280004480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
      ==4146==ABORTING
      ----------SERVER LOG END-------------
      

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              sanja Oleksandr Byelkin
              Reporter:
              alice Alice Sherepa
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated: