Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-17936

Server crashes in Field::is_null upon 2nd execution of PS

    Details

      Description

      Note: INSERTs are not necessary for the failure, they are only here to make the test case non-degenerate.

      --source include/have_innodb.inc
       
      CREATE TABLE t1 (a INT) ENGINE=InnoDB;
      INSERT INTO t1 VALUES (1),(2);
      CREATE TABLE t2 (b INT) ENGINE=InnoDB;
      INSERT INTO t1 VALUES (3),(4);
       
      PREPARE stmt FROM "SELECT * FROM t1 WHERE 1 >= ANY (SELECT b FROM t2 GROUP BY b HAVING b >= 2) AND a IS NULL";
      EXECUTE stmt;
      EXECUTE stmt;
       
      # Cleanup
      DEALLOCATE PREPARE stmt;
      DROP TABLE t1, t2;
      

      10.2 5ec9b88e1

      #3  <signal handler called>
      #4  0x000055b4815e9e90 in Field::is_null (this=0x7f9db8038ba8, row_offset=0) at /data/src/10.2/sql/field.h:1130
      #5  0x000055b48194502e in Item_field::val_int_result (this=0x7f9db8090388) at /data/src/10.2/sql/item.cc:2853
      #6  0x000055b481958537 in Item_cache_int::cache_value (this=0x7f9db8013648) at /data/src/10.2/sql/item.cc:9573
      #7  0x000055b481961202 in Item_cache::has_value (this=0x7f9db8013648) at /data/src/10.2/sql/item.h:5539
      #8  0x000055b481958739 in Item_cache_int::val_int (this=0x7f9db8013648) at /data/src/10.2/sql/item.cc:9610
      #9  0x000055b4819f013d in Item_singlerow_subselect::val_int (this=0x7f9db80132c8) at /data/src/10.2/sql/item_subselect.cc:1328
      #10 0x000055b4819689d7 in Arg_comparator::compare_int_signed (this=0x7f9db8013580) at /data/src/10.2/sql/item_cmpfunc.cc:948
      #11 0x000055b48197c100 in Arg_comparator::compare (this=0x7f9db8013580) at /data/src/10.2/sql/item_cmpfunc.h:87
      #12 0x000055b48196b1ad in Item_func_le::val_int (this=0x7f9db80134c0) at /data/src/10.2/sql/item_cmpfunc.cc:1828
      #13 0x000055b48196a657 in Item_in_optimizer::val_int (this=0x7f9db80919a0) at /data/src/10.2/sql/item_cmpfunc.cc:1574
      #14 0x000055b481966850 in Item_func_nop_all::val_int (this=0x7f9db8091188) at /data/src/10.2/sql/item_cmpfunc.cc:367
      #15 0x000055b481974975 in Item_cond::eval_not_null_tables (this=0x7f9db80125c0, opt_arg=0x0) at /data/src/10.2/sql/item_cmpfunc.cc:4681
      #16 0x000055b48164e1d9 in Item_func_or_sum::walk (this=0x7f9db80125c0, processor=&virtual table offset 936, walk_subquery=false, arg=0x0) at /data/src/10.2/sql/item.h:4223
      #17 0x000055b481974c7f in Item_cond::walk (this=0x7f9db80125c0, processor=&virtual table offset 936, walk_subquery=false, arg=0x0) at /data/src/10.2/sql/item_cmpfunc.cc:4753
      #18 0x000055b4816a143a in st_select_lex::update_used_tables (this=0x7f9db808e0e0) at /data/src/10.2/sql/sql_lex.cc:4249
      #19 0x000055b4816f1ce8 in JOIN::optimize_inner (this=0x7f9db80127e0) at /data/src/10.2/sql/sql_select.cc:1232
      #20 0x000055b4816f169d in JOIN::optimize (this=0x7f9db80127e0) at /data/src/10.2/sql/sql_select.cc:1115
      #21 0x000055b4816fab8a in mysql_select (thd=0x7f9db8000b00, tables=0x7f9db808f198, wild_num=0, fields=..., conds=0x7f9db80125c0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2416184064, result=0x7f9db8091558, unit=0x7f9db808d9a8, select_lex=0x7f9db808e0e0) at /data/src/10.2/sql/sql_select.cc:3802
      #22 0x000055b4816eee51 in handle_select (thd=0x7f9db8000b00, lex=0x7f9db808d8e0, result=0x7f9db8091558, setup_tables_done_option=0) at /data/src/10.2/sql/sql_select.cc:376
      #23 0x000055b4816ba2e2 in execute_sqlcom_select (thd=0x7f9db8000b00, all_tables=0x7f9db808f198) at /data/src/10.2/sql/sql_parse.cc:6479
      #24 0x000055b4816b0262 in mysql_execute_command (thd=0x7f9db8000b00) at /data/src/10.2/sql/sql_parse.cc:3485
      #25 0x000055b4816dbd28 in Prepared_statement::execute (this=0x7f9db808c2e0, expanded_query=0x7f9dfc5f1560, open_cursor=false) at /data/src/10.2/sql/sql_prepare.cc:4799
      #26 0x000055b4816da083 in Prepared_statement::execute_loop (this=0x7f9db808c2e0, expanded_query=0x7f9dfc5f1560, open_cursor=false, packet=0x0, packet_end=0x0) at /data/src/10.2/sql/sql_prepare.cc:4228
      #27 0x000055b4816d7d36 in mysql_sql_stmt_execute (thd=0x7f9db8000b00) at /data/src/10.2/sql/sql_prepare.cc:3336
      #28 0x000055b4816b02a7 in mysql_execute_command (thd=0x7f9db8000b00) at /data/src/10.2/sql/sql_parse.cc:3501
      #29 0x000055b4816be1bd in mysql_parse (thd=0x7f9db8000b00, rawbuf=0x7f9db8012448 "EXECUTE stmt", length=12, parser_state=0x7f9dfc5f2200, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:8013
      #30 0x000055b4816abaf5 in dispatch_command (command=COM_QUERY, thd=0x7f9db8000b00, packet=0x7f9db8095ec1 "EXECUTE stmt", packet_length=12, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1824
      #31 0x000055b4816aa458 in do_command (thd=0x7f9db8000b00) at /data/src/10.2/sql/sql_parse.cc:1378
      #32 0x000055b4817fcbc9 in do_handle_one_connection (connect=0x55b484989e20) at /data/src/10.2/sql/sql_connect.cc:1335
      #33 0x000055b4817fc956 in handle_one_connection (arg=0x55b484989e20) at /data/src/10.2/sql/sql_connect.cc:1241
      #34 0x000055b481c225ee in pfs_spawn_thread (arg=0x55b4848d52d0) at /data/src/10.2/storage/perfschema/pfs.cc:1862
      #35 0x00007f9e12cc1494 in start_thread (arg=0x7f9dfc5f3700) at pthread_create.c:333
      #36 0x00007f9e112c293f in clone () from /lib/x86_64-linux-gnu/libc.so.6
      

      10.2 ASAN 5ec9b88e1

      ==15184==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190000f5618 at pc 0x55b5408503b7 bp 0x7f0b6b828d50 sp 0x7f0b6b828d48
      READ of size 8 at 0x6190000f5618 thread T27
          #0 0x55b5408503b6 in Field::is_null(long long) const /data/src/10.2/sql/field.h:1130
          #1 0x55b5410507cc in Item_field::val_int_result() /data/src/10.2/sql/item.cc:2853
          #2 0x55b541084ca1 in Item_cache_int::cache_value() /data/src/10.2/sql/item.cc:9573
          #3 0x55b54109a204 in Item_cache::has_value() /data/src/10.2/sql/item.h:5539
          #4 0x55b5410851b1 in Item_cache_int::val_int() /data/src/10.2/sql/item.cc:9610
          #5 0x55b5411e03d4 in Item_singlerow_subselect::val_int() /data/src/10.2/sql/item_subselect.cc:1328
          #6 0x55b5410acf6a in Arg_comparator::compare_int_signed() /data/src/10.2/sql/item_cmpfunc.cc:948
          #7 0x55b5410e5a38 in Arg_comparator::compare() /data/src/10.2/sql/item_cmpfunc.h:87
          #8 0x55b5410b5fdd in Item_func_le::val_int() /data/src/10.2/sql/item_cmpfunc.cc:1828
          #9 0x55b5410b3ca5 in Item_in_optimizer::val_int() /data/src/10.2/sql/item_cmpfunc.cc:1574
          #10 0x55b5410a5172 in Item_func_nop_all::val_int() /data/src/10.2/sql/item_cmpfunc.cc:367
          #11 0x55b5410d213d in Item_cond::eval_not_null_tables(void*) /data/src/10.2/sql/item_cmpfunc.cc:4681
          #12 0x55b54092d4b9 in Item_func_or_sum::walk(bool (Item::*)(void*), bool, void*) /data/src/10.2/sql/item.h:4223
          #13 0x55b5410d29ce in Item_cond::walk(bool (Item::*)(void*), bool, void*) /data/src/10.2/sql/item_cmpfunc.cc:4753
          #14 0x55b5409f9774 in st_select_lex::update_used_tables() /data/src/10.2/sql/sql_lex.cc:4249
          #15 0x55b540ab2956 in JOIN::optimize_inner() /data/src/10.2/sql/sql_select.cc:1232
          #16 0x55b540ab15ca in JOIN::optimize() /data/src/10.2/sql/sql_select.cc:1115
          #17 0x55b540acb0bb in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3802
          #18 0x55b540aaa2d4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:376
          #19 0x55b540a2ceed in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6479
          #20 0x55b540a19bd2 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3485
          #21 0x55b540a7f0c4 in Prepared_statement::execute(String*, bool) /data/src/10.2/sql/sql_prepare.cc:4799
          #22 0x55b540a7aa3f in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.2/sql/sql_prepare.cc:4228
          #23 0x55b540a7566b in mysql_sql_stmt_execute(THD*) /data/src/10.2/sql/sql_prepare.cc:3336
          #24 0x55b540a19c17 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3501
          #25 0x55b540a35bd7 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8013
          #26 0x55b540a105c1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1824
          #27 0x55b540a0d665 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1378
          #28 0x55b540d5283a in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
          #29 0x55b540d5224f in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
          #30 0x55b54176ce1b in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
          #31 0x7f0b7c000493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
          #32 0x7f0b7a60193e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
       
      0x6190000f5618 is located 152 bytes inside of 1100-byte region [0x6190000f5580,0x6190000f59cc)
      freed by thread T27 here:
          #0 0x7f0b7c26a527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
          #1 0x55b54208e3f1 in free_memory /data/src/10.2/mysys/safemalloc.c:279
          #2 0x55b54208d9f7 in sf_free /data/src/10.2/mysys/safemalloc.c:197
          #3 0x55b54205cc86 in my_free /data/src/10.2/mysys/my_malloc.c:217
          #4 0x55b54203e2fc in free_root /data/src/10.2/mysys/my_alloc.c:399
          #5 0x55b540b2893f in free_tmp_table(THD*, TABLE*) /data/src/10.2/sql/sql_select.cc:18091
          #6 0x55b540b03f43 in JOIN::cleanup(bool) /data/src/10.2/sql/sql_select.cc:12283
          #7 0x55b540b033b9 in JOIN::join_free() /data/src/10.2/sql/sql_select.cc:12176
          #8 0x55b540b2a5c5 in do_select /data/src/10.2/sql/sql_select.cc:18352
          #9 0x55b540aca22c in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3621
          #10 0x55b540ac7ec1 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3416
          #11 0x55b5411f97bb in subselect_single_select_engine::exec() /data/src/10.2/sql/item_subselect.cc:3894
          #12 0x55b5411db133 in Item_subselect::exec() /data/src/10.2/sql/item_subselect.cc:722
          #13 0x55b5411dc2b7 in Item_in_subselect::exec() /data/src/10.2/sql/item_subselect.cc:902
          #14 0x55b5411e41d8 in Item_in_subselect::val_bool() /data/src/10.2/sql/item_subselect.cc:1766
          #15 0x55b5408534a7 in Item::val_bool_result() /data/src/10.2/sql/item.h:1201
          #16 0x55b5410b4649 in Item_in_optimizer::val_int() /data/src/10.2/sql/item_cmpfunc.cc:1656
          #17 0x55b5410a5172 in Item_func_nop_all::val_int() /data/src/10.2/sql/item_cmpfunc.cc:367
          #18 0x55b5410d15ac in Item_cond::fix_fields(THD*, Item**) /data/src/10.2/sql/item_cmpfunc.cc:4619
          #19 0x55b5409248cc in setup_conds(THD*, TABLE_LIST*, List<TABLE_LIST>&, Item**) /data/src/10.2/sql/sql_base.cc:7905
          #20 0x55b540aabfa4 in setup_without_group /data/src/10.2/sql/sql_select.cc:640
          #21 0x55b540aadfc3 in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /data/src/10.2/sql/sql_select.cc:825
          #22 0x55b540acb08f in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3794
          #23 0x55b540aaa2d4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:376
          #24 0x55b540a2ceed in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6479
          #25 0x55b540a19bd2 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3485
          #26 0x55b540a7f0c4 in Prepared_statement::execute(String*, bool) /data/src/10.2/sql/sql_prepare.cc:4799
          #27 0x55b540a7aa3f in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.2/sql/sql_prepare.cc:4228
          #28 0x55b540a7566b in mysql_sql_stmt_execute(THD*) /data/src/10.2/sql/sql_prepare.cc:3336
          #29 0x55b540a19c17 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3501
       
      previously allocated by thread T27 here:
          #0 0x7f0b7c26a73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
          #1 0x55b54208d167 in sf_malloc /data/src/10.2/mysys/safemalloc.c:118
          #2 0x55b54205c3be in my_malloc /data/src/10.2/mysys/my_malloc.c:101
          #3 0x55b54203d261 in alloc_root /data/src/10.2/mysys/my_alloc.c:242
          #4 0x55b54203ec32 in memdup_root /data/src/10.2/mysys/my_alloc.c:461
          #5 0x55b540f8870b in Field::make_new_field(st_mem_root*, TABLE*, bool) /data/src/10.2/sql/field.cc:2275
          #6 0x55b540b18a67 in create_tmp_field_from_field(THD*, Field*, char const*, TABLE*, Item_field*) /data/src/10.2/sql/sql_select.cc:16167
          #7 0x55b540b1a5f6 in create_tmp_field(THD*, TABLE*, Item*, Item::Type, Item***, Field**, Field**, bool, bool, bool, bool) /data/src/10.2/sql/sql_select.cc:16428
          #8 0x55b540b1da19 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, char const*, bool, bool) /data/src/10.2/sql/sql_select.cc:16884
          #9 0x55b540ac3a23 in JOIN::create_postjoin_aggr_table(st_join_table*, List<Item>*, st_order*, bool, bool, bool) /data/src/10.2/sql/sql_select.cc:2957
          #10 0x55b540abfdd7 in JOIN::make_aggr_tables_info() /data/src/10.2/sql/sql_select.cc:2559
          #11 0x55b540abc40b in JOIN::optimize_inner() /data/src/10.2/sql/sql_select.cc:2230
          #12 0x55b540ab15ca in JOIN::optimize() /data/src/10.2/sql/sql_select.cc:1115
          #13 0x55b5411f8681 in subselect_single_select_engine::exec() /data/src/10.2/sql/item_subselect.cc:3811
          #14 0x55b5411db133 in Item_subselect::exec() /data/src/10.2/sql/item_subselect.cc:722
          #15 0x55b5411dc2b7 in Item_in_subselect::exec() /data/src/10.2/sql/item_subselect.cc:902
          #16 0x55b5411e41d8 in Item_in_subselect::val_bool() /data/src/10.2/sql/item_subselect.cc:1766
          #17 0x55b5408534a7 in Item::val_bool_result() /data/src/10.2/sql/item.h:1201
          #18 0x55b5410b4649 in Item_in_optimizer::val_int() /data/src/10.2/sql/item_cmpfunc.cc:1656
          #19 0x55b5410a5172 in Item_func_nop_all::val_int() /data/src/10.2/sql/item_cmpfunc.cc:367
          #20 0x55b5410d15ac in Item_cond::fix_fields(THD*, Item**) /data/src/10.2/sql/item_cmpfunc.cc:4619
          #21 0x55b5409248cc in setup_conds(THD*, TABLE_LIST*, List<TABLE_LIST>&, Item**) /data/src/10.2/sql/sql_base.cc:7905
          #22 0x55b540aabfa4 in setup_without_group /data/src/10.2/sql/sql_select.cc:640
          #23 0x55b540aadfc3 in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /data/src/10.2/sql/sql_select.cc:825
          #24 0x55b540acb08f in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3794
          #25 0x55b540aaa2d4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:376
          #26 0x55b540a2ceed in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6479
          #27 0x55b540a19bd2 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3485
          #28 0x55b540a7f0c4 in Prepared_statement::execute(String*, bool) /data/src/10.2/sql/sql_prepare.cc:4799
          #29 0x55b540a7aa3f in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.2/sql/sql_prepare.cc:4228
       
      Thread T27 created by T0 here:
          #0 0x7f0b7c239bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
          #1 0x55b54176d3e3 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1912
          #2 0x55b54080a5de in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1239
          #3 0x55b54081f57b in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6466
          #4 0x55b54081fc80 in create_new_thread /data/src/10.2/sql/mysqld.cc:6536
          #5 0x55b540820c97 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6811
          #6 0x55b54081ead0 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6085
          #7 0x55b54080897f in main /data/src/10.2/sql/main.cc:25
          #8 0x7f0b7a5392b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
       
      SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.2/sql/field.h:1130 Field::is_null(long long) const
      Shadow bytes around the buggy address:
        0x0c3280016a70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3280016a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3280016a90: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3280016aa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3280016ab0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c3280016ac0: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3280016ad0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3280016ae0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3280016af0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3280016b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3280016b10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Contiguous container OOB:fc
        ASan internal:           fe
      ==15184==ABORTING
      

      Not reproducible on 10.1.

        Attachments

          Activity

            People

            • Assignee:
              sanja Oleksandr Byelkin
              Reporter:
              elenst Elena Stepanova
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated: