[MDEV-20290] Server crash in st_select_lex::cleanup or Assertion `sl->join == 0' failed in reinit_stmt_before_use - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Critical
Resolution: Duplicate
Affects Version/s: 10.4(EOL), 10.5
Fix Version/s: 10.4.13, 10.5.4
Component/s: Server, Stored routines
Labels:
None

Description

CREATE TABLE t1 (a VARCHAR(20) NULL, c VARCHAR(20) NULL);

DELIMITER $$;

CREATE TRIGGER t1_BEFORE_INSERT BEFORE INSERT ON t1 FOR EACH ROW

BEGIN

    IF NEW.a in (select a from t1) OR NEW.a in (select c from t1 )

    THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = 'a or c';

END IF;

END$$

DELIMITER ;$$

INSERT INTO t1 VALUES ('Francia', 'Croazia');

INSERT INTO t1 VALUES ('Germania', 'Albania');

drop trigger t1_BEFORE_INSERT;

drop table t1;

10.4 13f36fffeaecf316435fc497b0

#3 <signal handler called>
#4 0x00007f3ad5a58428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#5 0x00007f3ad5a5a02a in __GI_abort () at abort.c:89
#6 0x00007f3ad5a50bd7 in __assert_fail_base (fmt=<optimized out>, assertion=assertion@entry=0x55f50f088d56 "sl->join == 0", file=file@entry=0x55f50f088688 "/10.4/sql/sql_prepare.cc", line=line@entry=2998, function=function@entry=0x55f50f089aa0 <reinit_stmt_before_use(THD, LEX)::__PRETTY_FUNCTION__> "void reinit_stmt_before_use(THD, LEX)") at assert.c:92
#7 0x00007f3ad5a50c82 in __GI___assert_fail (assertion=0x55f50f088d56 "sl->join == 0", file=0x55f50f088688 "/10.4/sql/sql_prepare.cc", line=2998, function=0x55f50f089aa0 <reinit_stmt_before_use(THD, LEX)::__PRETTY_FUNCTION__> "void reinit_stmt_before_use(THD, LEX)") at assert.c:101
#8 0x000055f50e499a2f in reinit_stmt_before_use (thd=0x7f3a7c000b00, lex=0x7f3a7c14c7c8) at /10.4/sql/sql_prepare.cc:2998
#9 0x000055f50e38b021 in sp_lex_keeper::reset_lex_and_exec_core (this=0x7f3a7c150768, thd=0x7f3a7c000b00, nextp=0x7f3ac9fa3734, open_tables=true, instr=0x7f3a7c150710) at /10.4/sql/sp_head.cc:3308
#10 0x000055f50e38cf0d in sp_instr_jump_if_not::execute (this=0x7f3a7c150710, thd=0x7f3a7c000b00, nextp=0x7f3ac9fa3734) at /10.4/sql/sp_head.cc:3926
#11 0x000055f50e3855fe in sp_head::execute (this=0x7f3a7c13eff8, thd=0x7f3a7c000b00, merge_da_on_success=false) at /10.4/sql/sp_head.cc:1346
#12 0x000055f50e386703 in sp_head::execute_trigger (this=0x7f3a7c13eff8, thd=0x7f3a7c000b00, db_name=0x7f3a7c040a88, table_name=0x7f3a7c040a98, grant_info=0x7f3a7c13ea70) at /10.4/sql/sp_head.cc:1755
#13 0x000055f50e56a2c4 in Table_triggers_list::process_triggers (this=0x7f3a7c13eb98, thd=0x7f3a7c000b00, event=TRG_EVENT_INSERT, time_type=TRG_ACTION_BEFORE, old_row_is_record1=true) at /10.4/sql/sql_trigger.cc:2202
#14 0x000055f50e3e2916 in fill_record_n_invoke_before_triggers (thd=0x7f3a7c000b00, table=0x7f3a7c139480, ptr=0x7f3a7c00bd90, values=..., ignore_errors=false, event=TRG_EVENT_INSERT) at /10.4/sql/sql_base.cc:8826
#15 0x000055f50e428cc5 in mysql_insert (thd=0x7f3a7c000b00, table_list=0x7f3a7c013230, fields=..., values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR, ignore=false) at /10.4/sql/sql_insert.cc:1018
#16 0x000055f50e473e58 in mysql_execute_command (thd=0x7f3a7c000b00) at /10.4/sql/sql_parse.cc:4528
#17 0x000055f50e47fd4a in mysql_parse (thd=0x7f3a7c000b00, rawbuf=0x7f3a7c013128 "INSERT INTO t1 VALUES ('Germania', 'Albania')", length=45, parser_state=0x7f3ac9fa4ff0, is_com_multi=false, is_next_command=false) at /10.4/sql/sql_parse.cc:7908
#18 0x000055f50e46bfb8 in dispatch_command (command=COM_QUERY, thd=0x7f3a7c000b00, packet=0x7f3a7c19de41 "INSERT INTO t1 VALUES ('Germania', 'Albania')", packet_length=45, is_com_multi=false, is_next_command=false) at /10.4/sql/sql_parse.cc:1843
#19 0x000055f50e46a6d2 in do_command (thd=0x7f3a7c000b00) at /10.4/sql/sql_parse.cc:1360
#20 0x000055f50e5e5076 in do_handle_one_connection (connect=0x55f511a5a040) at /10.4/sql/sql_connect.cc:1404
#21 0x000055f50e5e4d9f in handle_one_connection (arg=0x55f511a5a040) at /10.4/sql/sql_connect.cc:1306
#22 0x000055f50ef10cdf in pfs_spawn_thread (arg=0x55f5119d87d0) at /10.4/storage/perfschema/pfs.cc:1862
#23 0x00007f3ad68996ba in start_thread (arg=0x7f3ac9fa6700) at pthread_create.c:333
#24 0x00007f3ad5b2a41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Attachments

Issue Links

is duplicated by

MDEV-21315 Server 10.4 sporadically crashes when issuing simple INSERT commands

Closed

MDEV-23056 server crash on select with where clause that calls a function doing a subquery

Closed

MDEV-23094 Multiple calls to a Stored Procedure from another Stored Procedure crashes server

Closed

relates to

MDEV-20284 Some pointers may be invalid and cause the dump to abort.

Closed

MDEV-20803 IF NOT EXISTS AND NOT EXISTS crash DB server

Closed

MDEV-20858 Function crash server

Closed

MDEV-21199 Segfault

Closed

(2 relates to)

Activity

Ascending order - Click to sort in descending order

Elena Stepanova added a comment - 2019-10-12 18:24 - edited

Non-debug build doesn't crash with the provided test case, but see ~~MDEV-20803~~ for the release variation.

However, even a non-debug build with ASAN fails with the test case provided in the description:

10.3 9afbb106 non-debug -DWITH_ASAN=YES
==5812==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500017c970 at pc 0x560859d9f96d bp 0x7f24a5412030 sp 0x7f24a5412028
READ of size 8 at 0x62500017c970 thread T5
#0 0x560859d9f96c in JOIN::destroy() /data/src/10.4/sql/sql_select.cc:4407
#1 0x560859ebcac2 in st_select_lex::cleanup() /data/src/10.4/sql/sql_union.cc:2058
#2 0x56085a46c830 in subselect_single_select_engine::prepare(THD*) /data/src/10.4/sql/item_subselect.cc:3711
#3 0x56085a46b1fc in Item_subselect::fix_fields(THD, Item*) /data/src/10.4/sql/item_subselect.cc:283
#4 0x56085a46bf79 in Item_in_subselect::fix_fields(THD, Item*) /data/src/10.4/sql/item_subselect.cc:3382
#5 0x56085a3174c0 in Item::fix_fields_if_needed(THD, Item*) /data/src/10.4/sql/item.h:956
#6 0x56085a3174c0 in Item_in_optimizer::fix_fields(THD, Item*) /data/src/10.4/sql/item_cmpfunc.cc:1372
#7 0x56085a30e2fc in Item::fix_fields_if_needed(THD, Item*) /data/src/10.4/sql/item.h:956
#8 0x56085a30e2fc in Item::fix_fields_if_needed_for_scalar(THD, Item*) /data/src/10.4/sql/item.h:960
#9 0x56085a30e2fc in Item::fix_fields_if_needed_for_bool(THD, Item*) /data/src/10.4/sql/item.h:964
#10 0x56085a30e2fc in Item_cond::fix_fields(THD, Item*) /data/src/10.4/sql/item_cmpfunc.cc:4845
#11 0x560859b4b7bd in Item::fix_fields_if_needed(THD, Item*) /data/src/10.4/sql/item.h:956
#12 0x560859b4b7bd in THD::sp_fix_func_item(Item**) /data/src/10.4/sql/sp_head.cc:356
#13 0x560859b4b83c in THD::sp_prepare_func_item(Item**, unsigned int) /data/src/10.4/sql/sp_head.cc:342
#14 0x560859b4b8bc in sp_instr_jump_if_not::exec_core(THD, unsigned int) /data/src/10.4/sql/sp_head.cc:3956
#15 0x560859b5c912 in sp_lex_keeper::reset_lex_and_exec_core(THD, unsigned int, bool, sp_instr*) /data/src/10.4/sql/sp_head.cc:3398
#16 0x560859b509ff in sp_head::execute(THD*, bool) /data/src/10.4/sql/sp_head.cc:1346
#17 0x560859b528c5 in sp_head::execute_trigger(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, st_grant_info) /data/src/10.4/sql/sp_head.cc:1818
#18 0x560859ea7bbc in Table_triggers_list::process_triggers(THD*, trg_event_type, trg_action_time_type, bool) /data/src/10.4/sql/sql_trigger.cc:2214
#19 0x560859be3b13 in fill_record_n_invoke_before_triggers(THD, TABLE, Field**, List<Item>&, bool, trg_event_type) /data/src/10.4/sql/sql_base.cc:8804
#20 0x560859c65b92 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.4/sql/sql_insert.cc:1018
#21 0x560859cf666d in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4524
#22 0x560859d06678 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7912
#23 0x560859d0bf14 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1841
#24 0x560859d0fe17 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1359
#25 0x560859f7dbd7 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412
#26 0x560859f7ddfa in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316
#27 0x56085af7f4a3 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
#28 0x7f24afa6c4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
#29 0x7f24adfb3d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)

0x62500017c970 is located 2160 bytes inside of 8160-byte region [0x62500017c100,0x62500017e0e0)
freed by thread T5 here:
#0 0x7f24afd43a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)
#1 0x56085b0258f4 in free_root /data/src/10.4/mysys/my_alloc.c:420

previously allocated by thread T5 here:
#0 0x7f24afd43d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
#1 0x56085b03751c in my_malloc /data/src/10.4/mysys/my_malloc.c:101

Thread T5 created by T0 here:
#0 0x7f24afcb2f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
#1 0x56085af87722 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql/sql_select.cc:4407 in JOIN::destroy()
Shadow bytes around the buggy address:
0x0c4a800278d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800278e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800278f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a80027900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a80027910: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c4a80027920: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
0x0c4a80027930: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a80027940: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a80027950: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a80027960: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a80027970: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==5812==ABORTING

Elena Stepanova added a comment - 2019-10-12 18:24 - edited Non-debug build doesn't crash with the provided test case, but see MDEV-20803 for the release variation . However, even a non-debug build with ASAN fails with the test case provided in the description: 10.3 9afbb106 non-debug -DWITH_ASAN=YES ==5812==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500017c970 at pc 0x560859d9f96d bp 0x7f24a5412030 sp 0x7f24a5412028 READ of size 8 at 0x62500017c970 thread T5 #0 0x560859d9f96c in JOIN::destroy() /data/src/10.4/sql/sql_select.cc:4407 #1 0x560859ebcac2 in st_select_lex::cleanup() /data/src/10.4/sql/sql_union.cc:2058 #2 0x56085a46c830 in subselect_single_select_engine::prepare(THD*) /data/src/10.4/sql/item_subselect.cc:3711 #3 0x56085a46b1fc in Item_subselect::fix_fields(THD*, Item**) /data/src/10.4/sql/item_subselect.cc:283 #4 0x56085a46bf79 in Item_in_subselect::fix_fields(THD*, Item**) /data/src/10.4/sql/item_subselect.cc:3382 #5 0x56085a3174c0 in Item::fix_fields_if_needed(THD*, Item**) /data/src/10.4/sql/item.h:956 #6 0x56085a3174c0 in Item_in_optimizer::fix_fields(THD*, Item**) /data/src/10.4/sql/item_cmpfunc.cc:1372 #7 0x56085a30e2fc in Item::fix_fields_if_needed(THD*, Item**) /data/src/10.4/sql/item.h:956 #8 0x56085a30e2fc in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /data/src/10.4/sql/item.h:960 #9 0x56085a30e2fc in Item::fix_fields_if_needed_for_bool(THD*, Item**) /data/src/10.4/sql/item.h:964 #10 0x56085a30e2fc in Item_cond::fix_fields(THD*, Item**) /data/src/10.4/sql/item_cmpfunc.cc:4845 #11 0x560859b4b7bd in Item::fix_fields_if_needed(THD*, Item**) /data/src/10.4/sql/item.h:956 #12 0x560859b4b7bd in THD::sp_fix_func_item(Item**) /data/src/10.4/sql/sp_head.cc:356 #13 0x560859b4b83c in THD::sp_prepare_func_item(Item**, unsigned int) /data/src/10.4/sql/sp_head.cc:342 #14 0x560859b4b8bc in sp_instr_jump_if_not::exec_core(THD*, unsigned int*) /data/src/10.4/sql/sp_head.cc:3956 #15 0x560859b5c912 in sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*) /data/src/10.4/sql/sp_head.cc:3398 #16 0x560859b509ff in sp_head::execute(THD*, bool) /data/src/10.4/sql/sp_head.cc:1346 #17 0x560859b528c5 in sp_head::execute_trigger(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, st_grant_info*) /data/src/10.4/sql/sp_head.cc:1818 #18 0x560859ea7bbc in Table_triggers_list::process_triggers(THD*, trg_event_type, trg_action_time_type, bool) /data/src/10.4/sql/sql_trigger.cc:2214 #19 0x560859be3b13 in fill_record_n_invoke_before_triggers(THD*, TABLE*, Field**, List<Item>&, bool, trg_event_type) /data/src/10.4/sql/sql_base.cc:8804 #20 0x560859c65b92 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.4/sql/sql_insert.cc:1018 #21 0x560859cf666d in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4524 #22 0x560859d06678 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7912 #23 0x560859d0bf14 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1841 #24 0x560859d0fe17 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1359 #25 0x560859f7dbd7 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412 #26 0x560859f7ddfa in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316 #27 0x56085af7f4a3 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862 #28 0x7f24afa6c4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3) #29 0x7f24adfb3d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e) 0x62500017c970 is located 2160 bytes inside of 8160-byte region [0x62500017c100,0x62500017e0e0) freed by thread T5 here: #0 0x7f24afd43a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10) #1 0x56085b0258f4 in free_root /data/src/10.4/mysys/my_alloc.c:420 previously allocated by thread T5 here: #0 0x7f24afd43d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28) #1 0x56085b03751c in my_malloc /data/src/10.4/mysys/my_malloc.c:101 Thread T5 created by T0 here: #0 0x7f24afcb2f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59) #1 0x56085af87722 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912 SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql/sql_select.cc:4407 in JOIN::destroy() Shadow bytes around the buggy address: 0x0c4a800278d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4a800278e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4a800278f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4a80027900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4a80027910: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c4a80027920: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd 0x0c4a80027930: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4a80027940: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4a80027950: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4a80027960: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4a80027970: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==5812==ABORTING

Elena Stepanova added a comment - 2019-10-28 17:11

See also ~~MDEV-20858~~ with yet another test case from real life.

I'm raising the priority since external reports keep coming.

Elena Stepanova added a comment - 2019-10-28 17:11 See also MDEV-20858 with yet another test case from real life. I'm raising the priority since external reports keep coming.

Oleksandr Byelkin added a comment - 2019-12-02 17:14 - edited

there is no call of JOIN::destroy because there is no call of st_select_lex::cleanup

Oleksandr Byelkin added a comment - 2019-12-02 17:14 - edited there is no call of JOIN::destroy because there is no call of st_select_lex::cleanup

Alice Sherepa added a comment - 2020-06-30 13:26

After fixing it, please check also ~~MDEV-23056~~ to be fixed

Alice Sherepa added a comment - 2020-06-30 13:26 After fixing it, please check also MDEV-23056 to be fixed

Oleksandr Byelkin added a comment - 2020-10-08 09:27

Duplicate of ~~MDEV-23094~~

Oleksandr Byelkin added a comment - 2020-10-08 09:27 Duplicate of MDEV-23094

MariaDB Server

Server crash in st_select_lex::cleanup or Assertion `sl->join == 0' failed in reinit_stmt_before_use

Details

Description

Attachments

Issue Links

Activity

People

Dates

Git Integration