Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-18734

ASAN heap-use-after-free upon sorting by blob column from partitioned table

    XMLWordPrintable

Details

    Description

      ASAN heap-use-after-free in my_strnxfrm_simple_internal upon update on versioned partitioned table.

      --source include/have_partition.inc
       
      CREATE TABLE t1 ( 
        pk INT AUTO_INCREMENT,
        b TINYTEXT DEFAULT '',
        i INT,
        v TEXT AS (b) VIRTUAL,
        PRIMARY KEY(pk)
      ) WITH SYSTEM VERSIONING PARTITION BY system_time LIMIT 100 ( PARTITION p1 HISTORY, PARTITION pn CURRENT );
       
      INSERT INTO t1 (pk) VALUES (NULL),(NULL),(NULL),(NULL);
      UPDATE t1 SET b = 'foo' WHERE pk = 3;
      REPLACE INTO t1 (pk, b, i) SELECT pk, b, i FROM t1;
      INSERT INTO t1 (pk) VALUES (NULL);
      UPDATE t1 SET i = 10 WHERE pk < 20 ORDER BY v LIMIT 2;
       
      # Cleanup
      DROP TABLE t1;
      

      10.4 09bd2138

      ==6107==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000260f0 at pc 0x560b15b508f0 bp 0x7f656fcd5e10 sp 0x7f656fcd5e08
      READ of size 1 at 0x60c0000260f0 thread T5
          #0 0x560b15b508ef in my_strnxfrm_simple_internal /data/src/10.3/strings/ctype-simple.c:87
          #1 0x560b15b50ace in my_strnxfrm_simple /data/src/10.3/strings/ctype-simple.c:105
          #2 0x560b1497107f in Field_blob::sort_string(unsigned char*, unsigned int) /data/src/10.3/sql/field.cc:8578
          #3 0x560b1490ea56 in Field::make_sort_key(unsigned char*, unsigned int) /data/src/10.3/sql/field.cc:1018
          #4 0x560b149b0377 in make_sortkey /data/src/10.3/sql/filesort.cc:1165
          #5 0x560b149b7a45 in Bounded_queue<unsigned char, unsigned char>::push(unsigned char*) (/data/bld/10.3-asan/bin/mysqld+0x1566a45)
          #6 0x560b149adb9f in find_all_keys /data/src/10.3/sql/filesort.cc:832
          #7 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
          #8 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672
          #9 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
          #10 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
          #11 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
          #12 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
          #13 0x560b1460b861 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
          #14 0x560b1460b26d in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309
          #15 0x560b15140349 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
          #16 0x7f657c2ad493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
          #17 0x7f657a69393e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
       
      0x60c0000260f0 is located 112 bytes inside of 124-byte region [0x60c000026080,0x60c0000260fc)
      freed by thread T5 here:
          #0 0x7f657c517527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
          #1 0x560b15af026f in free_memory /data/src/10.3/mysys/safemalloc.c:279
          #2 0x560b15aef875 in sf_free /data/src/10.3/mysys/safemalloc.c:197
          #3 0x560b15ac02be in my_free /data/src/10.3/mysys/my_malloc.c:223
          #4 0x560b14027585 in String::free() /data/src/10.3/sql/sql_string.h:358
          #5 0x560b1406c285 in String::set(char const*, unsigned long, charset_info_st const*) /data/src/10.3/sql/sql_string.h:278
          #6 0x560b1496e849 in Field_blob::val_str(String*, String*) /data/src/10.3/sql/field.cc:8357
          #7 0x560b1404d01b in Field::val_str(String*) /data/src/10.3/sql/field.h:840
          #8 0x560b149974da in Field_blob::store_field(Field*) /data/src/10.3/sql/field.h:3631
          #9 0x560b149a5967 in field_conv_incompatible /data/src/10.3/sql/field_conv.cc:836
          #10 0x560b149a5a04 in field_conv(Field*, Field*) /data/src/10.3/sql/field_conv.cc:849
          #11 0x560b14a2b6a4 in save_field_in_field /data/src/10.3/sql/item.cc:6708
          #12 0x560b14a2bd00 in Item_field::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6759
          #13 0x560b14571036 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.3/sql/table.cc:7814
          #14 0x560b149cde63 in handler::ha_index_next(unsigned char*) /data/src/10.3/sql/handler.cc:2928
          #15 0x560b149e05db in handler::read_range_next() /data/src/10.3/sql/handler.cc:5702
          #16 0x560b146a996f in handler::multi_range_read_next(void**) /data/src/10.3/sql/multi_range_read.cc:271
          #17 0x560b146aa060 in Mrr_simple_index_reader::get_next(void**) /data/src/10.3/sql/multi_range_read.cc:336
          #18 0x560b146b3182 in DsMrr_impl::dsmrr_next(void**) /data/src/10.3/sql/multi_range_read.cc:1406
          #19 0x560b158b3be3 in ha_myisam::multi_range_read_next(void**) /data/src/10.3/storage/myisam/ha_myisam.cc:2495
          #20 0x560b15a2e543 in ha_partition::handle_ordered_next(unsigned char*, bool) /data/src/10.3/sql/ha_partition.cc:7824
          #21 0x560b15a225fb in ha_partition::multi_range_read_next(void**) /data/src/10.3/sql/ha_partition.cc:6486
          #22 0x560b14d4a2d2 in QUICK_RANGE_SELECT::get_next() /data/src/10.3/sql/opt_range.cc:11470
          #23 0x560b149ad646 in find_all_keys /data/src/10.3/sql/filesort.cc:776
          #24 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
          #25 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672
          #26 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
          #27 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
          #28 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
          #29 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
       
      previously allocated by thread T5 here:
          #0 0x7f657c51773f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
          #1 0x560b15aeefe5 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
          #2 0x560b15abf8e0 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
          #3 0x560b14488f2b in String::realloc_raw(unsigned long) /data/src/10.3/sql/sql_string.cc:101
          #4 0x560b140276ac in String::realloc(unsigned long) /data/src/10.3/sql/sql_string.h:374
          #5 0x560b14489d45 in String::copy() /data/src/10.3/sql/sql_string.cc:212
          #6 0x560b149975e3 in Field_blob::store_field(Field*) /data/src/10.3/sql/field.h:3634
          #7 0x560b149a5967 in field_conv_incompatible /data/src/10.3/sql/field_conv.cc:836
          #8 0x560b149a5a04 in field_conv(Field*, Field*) /data/src/10.3/sql/field_conv.cc:849
          #9 0x560b14a2b6a4 in save_field_in_field /data/src/10.3/sql/item.cc:6708
          #10 0x560b14a2bd00 in Item_field::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6759
          #11 0x560b14571036 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.3/sql/table.cc:7814
          #12 0x560b149cde63 in handler::ha_index_next(unsigned char*) /data/src/10.3/sql/handler.cc:2928
          #13 0x560b149e05db in handler::read_range_next() /data/src/10.3/sql/handler.cc:5702
          #14 0x560b146a996f in handler::multi_range_read_next(void**) /data/src/10.3/sql/multi_range_read.cc:271
          #15 0x560b146aa060 in Mrr_simple_index_reader::get_next(void**) /data/src/10.3/sql/multi_range_read.cc:336
          #16 0x560b146b3182 in DsMrr_impl::dsmrr_next(void**) /data/src/10.3/sql/multi_range_read.cc:1406
          #17 0x560b158b3be3 in ha_myisam::multi_range_read_next(void**) /data/src/10.3/storage/myisam/ha_myisam.cc:2495
          #18 0x560b15a2e543 in ha_partition::handle_ordered_next(unsigned char*, bool) /data/src/10.3/sql/ha_partition.cc:7824
          #19 0x560b15a225fb in ha_partition::multi_range_read_next(void**) /data/src/10.3/sql/ha_partition.cc:6486
          #20 0x560b14d4a2d2 in QUICK_RANGE_SELECT::get_next() /data/src/10.3/sql/opt_range.cc:11470
          #21 0x560b149ad646 in find_all_keys /data/src/10.3/sql/filesort.cc:776
          #22 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
          #23 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672
          #24 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
          #25 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
          #26 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
          #27 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
          #28 0x560b1460b861 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
          #29 0x560b1460b26d in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309
       
      Thread T5 created by T0 here:
          #0 0x7f657c4e6bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
          #1 0x560b15140911 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
          #2 0x560b14002c08 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
          #3 0x560b14018d9a in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6573
          #4 0x560b1401949f in create_new_thread /data/src/10.3/sql/mysqld.cc:6643
          #5 0x560b1401a4b6 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6918
          #6 0x560b14018257 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6195
          #7 0x560b14000c8f in main /data/src/10.3/sql/main.cc:25
          #8 0x7f657a5cb2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
       
      SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/strings/ctype-simple.c:87 my_strnxfrm_simple_internal
      Shadow bytes around the buggy address:
        0x0c187fffcbc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c187fffcbd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c187fffcbe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
        0x0c187fffcbf0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
        0x0c187fffcc00: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
      =>0x0c187fffcc10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
        0x0c187fffcc20: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
        0x0c187fffcc30: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
        0x0c187fffcc40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c187fffcc50: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
        0x0c187fffcc60: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Contiguous container OOB:fc
        ASan internal:           fe
      ==6107==ABORTING
      

      Or with valgrind:

      ==6629== Invalid read of size 1
      ==6629==    at 0x1303139: my_strnxfrm_simple_internal (ctype-simple.c:87)
      ==6629==    by 0x13031FD: my_strnxfrm_simple (ctype-simple.c:105)
      ==6629==    by 0xAAD2FC: Field_blob::sort_string(unsigned char*, unsigned int) (field.cc:8578)
      ==6629==    by 0xA8B34F: Field::make_sort_key(unsigned char*, unsigned int) (field.cc:1018)
      ==6629==    by 0xAC6991: make_sortkey(Sort_param*, unsigned char*, unsigned char*) (filesort.cc:1165)
      ==6629==    by 0xAC98E6: Bounded_queue<unsigned char, unsigned char>::push(unsigned char*) (bounded_queue.h:184)
      ==6629==    by 0xAC5A97: find_all_keys(THD*, Sort_param*, SQL_SELECT*, SORT_INFO*, st_io_cache*, st_io_cache*, Bounded_queue<unsigned char, unsigned char>*, unsigned long long*) (filesort.cc:832)
      ==6629==    by 0xAC3E00: filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) (filesort.cc:278)
      ==6629==    by 0x8C0655: mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) (sql_update.cc:672)
      ==6629==    by 0x7C5FC8: mysql_execute_command(THD*) (sql_parse.cc:4584)
      ==6629==    by 0x7D14E4: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:8095)
      ==6629==    by 0x7BE54C: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1854)
      ==6629==    by 0x7BCF24: do_command(THD*) (sql_parse.cc:1396)
      ==6629==    by 0x92B078: do_handle_one_connection(CONNECT*) (sql_connect.cc:1403)
      ==6629==    by 0x92ADFC: handle_one_connection (sql_connect.cc:1309)
      ==6629==    by 0xDE91AA: pfs_spawn_thread (pfs.cc:1862)
      ==6629==  Address 0xd9c92a8 is 8 bytes inside a block of size 16 free'd
      ==6629==    at 0x4C2CDDB: free (vg_replace_malloc.c:530)
      ==6629==    by 0x12C442D: my_free (my_malloc.c:223)
      ==6629==    by 0x6A7D12: String::free() (sql_string.h:358)
      ==6629==    by 0x6C6A19: String::set(char const*, unsigned long, charset_info_st const*) (sql_string.h:278)
      ==6629==    by 0xAAC726: Field_blob::val_str(String*, String*) (field.cc:8357)
      ==6629==    by 0x6B85C0: Field::val_str(String*) (field.h:840)
      ==6629==    by 0xABCA46: Field_blob::store_field(Field*) (field.h:3631)
      ==6629==    by 0xAC1C5E: field_conv_incompatible(Field*, Field*) (field_conv.cc:836)
      ==6629==    by 0xAC1CBA: field_conv(Field*, Field*) (field_conv.cc:849)
      ==6629==    by 0xAF6C93: save_field_in_field(Field*, bool*, Field*, bool) (item.cc:6708)
      ==6629==    by 0xAF6ED5: Item_field::save_in_field(Field*, bool) (item.cc:6759)
      ==6629==    by 0x8E6B02: TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) (table.cc:7814)
      ==6629==    by 0xAD29B1: handler::ha_index_next(unsigned char*) (handler.cc:2928)
      ==6629==    by 0xAD98B9: handler::read_range_next() (handler.cc:5702)
      ==6629==    by 0x97B559: handler::multi_range_read_next(void**) (multi_range_read.cc:271)
      ==6629==    by 0x97B7F1: Mrr_simple_index_reader::get_next(void**) (multi_range_read.cc:336)
      ==6629==  Block was alloc'd at
      ==6629==    at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
      ==6629==    by 0x12C3CB3: my_malloc (my_malloc.c:101)
      ==6629==    by 0x886C97: String::realloc_raw(unsigned long) (sql_string.cc:101)
      ==6629==    by 0x6A7D66: String::realloc(unsigned long) (sql_string.h:374)
      ==6629==    by 0x8871A3: String::copy() (sql_string.cc:212)
      ==6629==    by 0xABCAB1: Field_blob::store_field(Field*) (field.h:3634)
      ==6629==    by 0xAC1C5E: field_conv_incompatible(Field*, Field*) (field_conv.cc:836)
      ==6629==    by 0xAC1CBA: field_conv(Field*, Field*) (field_conv.cc:849)
      ==6629==    by 0xAF6C93: save_field_in_field(Field*, bool*, Field*, bool) (item.cc:6708)
      ==6629==    by 0xAF6ED5: Item_field::save_in_field(Field*, bool) (item.cc:6759)
      ==6629==    by 0x8E6B02: TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) (table.cc:7814)
      ==6629==    by 0xAD29B1: handler::ha_index_next(unsigned char*) (handler.cc:2928)
      ==6629==    by 0xAD98B9: handler::read_range_next() (handler.cc:5702)
      ==6629==    by 0x97B559: handler::multi_range_read_next(void**) (multi_range_read.cc:271)
      ==6629==    by 0x97B7F1: Mrr_simple_index_reader::get_next(void**) (multi_range_read.cc:336)
      ==6629==    by 0x97E441: DsMrr_impl::dsmrr_next(void**) (multi_range_read.cc:1406)
      

      Not reproducible on 10.4.

      Attachments

        Issue Links

          Activity

            People

              midenok Aleksey Midenkov
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.