Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-18207

ASAN heap-use-after-free in _ma_get_status upon concurrent operations with sequence

    XMLWordPrintable

    Details

      Description

      Note: it always fails for me on 10.3 ASAN build with the configured 100 loops (usually within first few), but it can vary on different machines and builds. Modify $run in the first line if needed.

      --let $run= 100
       
      CREATE SEQUENCE s1 ENGINE=Aria;
       
      while ($run)
      {
        --connection default
        SELECT NEXTVAL(s1) UNION SELECT NEXTVAL(s1);
        LOCK TABLE s1 READ;
       
        --connect (con1,localhost,root,,test)
        --send
          SELECT NEXTVAL(s1) ;
       
        --connect (con2,localhost,root,,test)
        SELECT * FROM s1;
       
        --connect (con3,localhost,root,,test)
        --send
          FLUSH TABLES;
       
        --disconnect con2
        --disconnect con1
        --disconnect con3
       
        --connection default
        UNLOCK TABLES;
       
        --dec $run
      }
       
      DROP SEQUENCE s1;
      

      10.3 d27bea9e9a ASAN

      ==28605==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290001182b0 at pc 0x55fd1c701b9e bp 0x7f88f8fdc500 sp 0x7f88f8fdc4f8
      READ of size 8 at 0x6290001182b0 thread T6
          #0 0x55fd1c701b9d in _ma_get_status /data/src/10.3/storage/maria/ma_state.c:293
          #1 0x55fd1d33debb in wait_for_lock /data/src/10.3/mysys/thr_lock.c:638
          #2 0x55fd1d33fcad in thr_lock /data/src/10.3/mysys/thr_lock.c:1014
          #3 0x55fd1d34163b in thr_multi_lock /data/src/10.3/mysys/thr_lock.c:1295
          #4 0x55fd1c4f1189 in mysql_lock_tables(THD*, st_mysql_lock*, unsigned int) /data/src/10.3/sql/lock.cc:355
          #5 0x55fd1c4f0c75 in mysql_lock_tables(THD*, TABLE**, unsigned int, unsigned int) /data/src/10.3/sql/lock.cc:304
          #6 0x55fd1b9cfbe7 in lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /data/src/10.3/sql/sql_base.cc:5261
          #7 0x55fd1b9ce307 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5005
          #8 0x55fd1b93f488 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:502
          #9 0x55fd1bb28735 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6469
          #10 0x55fd1bb17579 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3769
          #11 0x55fd1bb31fa0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8092
          #12 0x55fd1bb0c078 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1851
          #13 0x55fd1bb09100 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
          #14 0x55fd1be7b364 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
          #15 0x55fd1be7ad70 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #16 0x55fd1c9ad0f7 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
          #17 0x7f8905a91493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
          #18 0x7f8903e7793e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
       
      0x6290001182b0 is located 176 bytes inside of 18396-byte region [0x629000118200,0x62900011c9dc)
      freed by thread T5 here:
          #0 0x7f8905cfb527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
          #1 0x55fd1d359b22 in free_memory /data/src/10.3/mysys/safemalloc.c:279
          #2 0x55fd1d359128 in sf_free /data/src/10.3/mysys/safemalloc.c:197
          #3 0x55fd1d329b22 in my_free /data/src/10.3/mysys/my_malloc.c:222
          #4 0x55fd1c89ed6e in maria_close /data/src/10.3/storage/maria/ma_close.c:269
          #5 0x55fd1c7300d9 in ha_maria::close() /data/src/10.3/storage/maria/ha_maria.cc:1275
          #6 0x55fd1d2b793b in ha_sequence::close() /data/src/10.3/sql/ha_sequence.h:135
          #7 0x55fd1c238160 in handler::ha_close() /data/src/10.3/sql/handler.cc:2751
          #8 0x55fd1bdc2370 in closefrm(TABLE*) /data/src/10.3/sql/table.cc:3580
          #9 0x55fd1c026a4c in intern_close_table /data/src/10.3/sql/table_cache.cc:222
          #10 0x55fd1c026cb2 in tc_remove_table /data/src/10.3/sql/table_cache.cc:260
          #11 0x55fd1c027f8e in tc_release_table(TABLE*) /data/src/10.3/sql/table_cache.cc:474
          #12 0x55fd1b9bb389 in close_thread_table(THD*, TABLE**) /data/src/10.3/sql/sql_base.cc:912
          #13 0x55fd1b9baaa8 in close_thread_tables(THD*) /data/src/10.3/sql/sql_base.cc:854
          #14 0x55fd1b9c195f in Locked_tables_list::unlock_locked_tables(THD*) /data/src/10.3/sql/sql_base.cc:2273
          #15 0x55fd1bb1f6db in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:5168
          #16 0x55fd1bb31fa0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8092
          #17 0x55fd1bb0c078 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1851
          #18 0x55fd1bb09100 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
          #19 0x55fd1be7b364 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
          #20 0x55fd1be7ad70 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #21 0x55fd1c9ad0f7 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
          #22 0x7f8905a91493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
       
      previously allocated by thread T5 here:
          #0 0x7f8905cfb73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
          #1 0x55fd1d358898 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
          #2 0x55fd1d329215 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
          #3 0x55fd1d306e6a in my_multi_malloc /data/src/10.3/mysys/mulalloc.c:51
          #4 0x55fd1c7cd6ad in maria_clone_internal /data/src/10.3/storage/maria/ma_open.c:117
          #5 0x55fd1c7d6b87 in maria_open /data/src/10.3/storage/maria/ma_open.c:1056
          #6 0x55fd1c72f22c in ha_maria::open(char const*, int, unsigned int) /data/src/10.3/storage/maria/ha_maria.cc:1201
          #7 0x55fd1d2b4164 in ha_sequence::open(char const*, int, unsigned int) /data/src/10.3/sql/ha_sequence.cc:84
          #8 0x55fd1c237266 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.3/sql/handler.cc:2685
          #9 0x55fd1bdc14ae in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.3/sql/table.cc:3482
          #10 0x55fd1b9bf946 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:1975
          #11 0x55fd1b9c7022 in open_and_process_table /data/src/10.3/sql/sql_base.cc:3596
          #12 0x55fd1b9c9a03 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4121
          #13 0x55fd1b9ce21b in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4996
          #14 0x55fd1b93f488 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:502
          #15 0x55fd1bb28735 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6469
          #16 0x55fd1bb17579 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3769
          #17 0x55fd1bb31fa0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8092
          #18 0x55fd1bb0c078 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1851
          #19 0x55fd1bb09100 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
          #20 0x55fd1be7b364 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
          #21 0x55fd1be7ad70 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #22 0x55fd1c9ad0f7 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
          #23 0x7f8905a91493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
       
      Thread T6 created by T0 here:
          #0 0x7f8905ccabba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
          #1 0x55fd1c9ad6bf in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
          #2 0x55fd1b873d68 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
          #3 0x55fd1b889efa in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6572
          #4 0x55fd1b88a5ff in create_new_thread /data/src/10.3/sql/mysqld.cc:6642
          #5 0x55fd1b88b616 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6917
          #6 0x55fd1b8893b7 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6194
          #7 0x55fd1b871def in main /data/src/10.3/sql/main.cc:25
          #8 0x7f8903daf2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
       
      Thread T5 created by T0 here:
          #0 0x7f8905ccabba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
          #1 0x55fd1c9ad6bf in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
          #2 0x55fd1b873d68 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
          #3 0x55fd1b889efa in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6572
          #4 0x55fd1b88a5ff in create_new_thread /data/src/10.3/sql/mysqld.cc:6642
          #5 0x55fd1b88b616 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6917
          #6 0x55fd1b8893b7 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6194
          #7 0x55fd1b871def in main /data/src/10.3/sql/main.cc:25
          #8 0x7f8903daf2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
       
      SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/maria/ma_state.c:293 _ma_get_status
      Shadow bytes around the buggy address:
        0x0c528001b000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c528001b010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c528001b020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c528001b030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c528001b040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c528001b050: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd
        0x0c528001b060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c528001b070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c528001b080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c528001b090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c528001b0a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Contiguous container OOB:fc
        ASan internal:           fe
      ==28605==ABORTING
      

      Couldn't reproduce on 10.4, although it doesn't necessarily mean the problem doesn't exist.
      The test case is not applicable to 10.2, cannot check it.
      Didn't get a failure by switching from Aria to MyISAM.

        Attachments

          Activity

            People

            Assignee:
            vlad.lesin Vladislav Lesin
            Reporter:
            elenst Elena Stepanova
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: