Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-21413

ASAN heap-use-after-free in ha_maria::info

    XMLWordPrintable

    Details

      Description

      --source include/have_innodb.inc
       
      CREATE TABLE t1 (a INT) ENGINE=InnoDB;
      INSERT INTO t1 VALUES (1),(2);
      CREATE TABLE t2 (b INT) ENGINE=Aria;
      CREATE TABLE t3 (c INT) ENGINE=Aria;
      INSERT INTO t3 VALUES (1),(2);
      EXPLAIN SELECT * FROM t1, t2, t3;
      SHOW TABLE STATUS;
       
      # Cleanup
      DROP TABLE t1, t2, t3;
      

      10.3 ASAN 02e30069

      ==1693==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000046c30 at pc 0x56522524fe86 bp 0x7ff758352fc0 sp 0x7ff758352fb8
      READ of size 4 at 0x611000046c30 thread T27
          #0 0x56522524fe85 in ha_maria::info(unsigned int) /data/src/10.3/storage/maria/ha_maria.cc:2453
          #1 0x565223fa0374 in get_schema_tables_record /data/src/10.3/sql/sql_show.cc:5556
          #2 0x565223f98778 in fill_schema_table_by_open /data/src/10.3/sql/sql_show.cc:4657
          #3 0x565223f9bee6 in get_all_tables(THD*, TABLE_LIST*, Item*) /data/src/10.3/sql/sql_show.cc:5260
          #4 0x565223fcec10 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.3/sql/sql_show.cc:8873
          #5 0x565223ebf846 in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4061
          #6 0x565223ebdb4f in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3892
          #7 0x565223ec102e in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4297
          #8 0x565223e9b065 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:370
          #9 0x565223e1cda4 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6294
          #10 0x565223e0c5a9 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3821
          #11 0x565223e25de0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7818
          #12 0x565223e00acc in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1856
          #13 0x565223dfd9ab in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1401
          #14 0x565224173ae4 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
          #15 0x5652241734ab in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #16 0x5652255dd1f3 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
          #17 0x7ff76ff374a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
          #18 0x7ff76e06bd0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)
       
      0x611000046c30 is located 176 bytes inside of 252-byte region [0x611000046b80,0x611000046c7c)
      freed by thread T27 here:
          #0 0x7ff77020ea10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)
          #1 0x56522570de9a in free_memory /data/src/10.3/mysys/safemalloc.c:279
          #2 0x56522570d583 in sf_free /data/src/10.3/mysys/safemalloc.c:197
          #3 0x5652256df715 in my_free /data/src/10.3/mysys/my_malloc.c:223
          #4 0x56522521c593 in _ma_trnman_end_trans_hook /data/src/10.3/storage/maria/ma_state.c:551
          #5 0x56522525c050 in trnman_end_trn /data/src/10.3/storage/maria/trnman.c:474
          #6 0x5652252d6e2c in ma_commit /data/src/10.3/storage/maria/ma_commit.c:39
          #7 0x565225252c86 in ha_maria::implicit_commit(THD*, bool) /data/src/10.3/storage/maria/ha_maria.cc:2854
          #8 0x565223e1b383 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6110
          #9 0x565223e25de0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7818
          #10 0x565223e00acc in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1856
          #11 0x565223dfd9ab in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1401
          #12 0x565224173ae4 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
          #13 0x5652241734ab in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #14 0x5652255dd1f3 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
          #15 0x7ff76ff374a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
       
      previously allocated by thread T27 here:
          #0 0x7ff77020ed28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
          #1 0x56522570cf9b in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
          #2 0x5652256dee24 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
          #3 0x5652252194c7 in _ma_setup_live_state /data/src/10.3/storage/maria/ma_state.c:81
          #4 0x565225252f83 in ha_maria::implicit_commit(THD*, bool) /data/src/10.3/storage/maria/ha_maria.cc:2893
          #5 0x565224503ee8 in ha_commit_trans(THD*, bool) /data/src/10.3/sql/handler.cc:1387
          #6 0x5652241a2f89 in trans_commit_stmt(THD*) /data/src/10.3/sql/transaction.cc:505
          #7 0x565223e1b353 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6106
          #8 0x565223e25de0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7818
          #9 0x565223e00acc in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1856
          #10 0x565223dfd9ab in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1401
          #11 0x565224173ae4 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
          #12 0x5652241734ab in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #13 0x5652255dd1f3 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
          #14 0x7ff76ff374a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
       
      Thread T27 created by T0 here:
          #0 0x7ff77017df59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
          #1 0x5652255dd62f in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
          #2 0x565223b6ab50 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
          #3 0x565223b7fe5c in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6600
          #4 0x565223b8053f in create_new_thread /data/src/10.3/sql/mysqld.cc:6670
          #5 0x565223b81557 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6945
          #6 0x565223b7f32c in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6222
          #7 0x565223b6926f in main /data/src/10.3/sql/main.cc:25
          #8 0x7ff76dfa32e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
       
      SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/maria/ha_maria.cc:2453 in ha_maria::info(unsigned int)
      Shadow bytes around the buggy address:
        0x0c2280000d30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa
        0x0c2280000d40: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
        0x0c2280000d50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c2280000d60: 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fa
        0x0c2280000d70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c2280000d80: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd
        0x0c2280000d90: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
        0x0c2280000da0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c2280000db0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
        0x0c2280000dc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c2280000dd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==1693==ABORTING
      

      Couldn't reproduce on 10.2 and 10.4.
      No obvious problem on a non-ASAN build.
      A similar failure happens on 10.1, but it could be because some Aria bugs were only fixed in 10.2+:

      10.1 ASAN 359d91aa

      ==1954==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100001f4c0 at pc 0x55cef415a3ec bp 0x7f5f21902710 sp 0x7f5f21902708
      READ of size 8 at 0x61100001f4c0 thread T23
          #0 0x55cef415a3eb in maria_status /data/src/10.1/storage/maria/ma_info.c:45
          #1 0x55cef417c2a3 in ha_maria::info(unsigned int) /data/src/10.1/storage/maria/ha_maria.cc:2497
          #2 0x55cef417d94f in ha_maria::update_create_info(HA_CREATE_INFO*) /data/src/10.1/storage/maria/ha_maria.cc:2998
          #3 0x55cef3947101 in get_schema_tables_record /data/src/10.1/sql/sql_show.cc:5191
          #4 0x55cef3927f7b in fill_schema_table_by_open /data/src/10.1/sql/sql_show.cc:4325
          #5 0x55cef3967150 in get_all_tables(THD*, TABLE_LIST*, Item*) /data/src/10.1/sql/sql_show.cc:4924
          #6 0x55cef396b765 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.1/sql/sql_show.cc:8280
          #7 0x55cef3910b0c in JOIN::exec_inner() /data/src/10.1/sql/sql_select.cc:2716
          #8 0x55cef3918831 in JOIN::exec() /data/src/10.1/sql/sql_select.cc:2564
          #9 0x55cef390b5dc in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.1/sql/sql_select.cc:3501
          #10 0x55cef390dbc9 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.1/sql/sql_select.cc:377
          #11 0x55cef37dd161 in execute_sqlcom_select /data/src/10.1/sql/sql_parse.cc:5691
          #12 0x55cef37f8974 in mysql_execute_command(THD*) /data/src/10.1/sql/sql_parse.cc:3038
          #13 0x55cef380f41b in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.1/sql/sql_parse.cc:7209
          #14 0x55cef3816753 in dispatch_command(enum_server_command, THD*, char*, unsigned int) /data/src/10.1/sql/sql_parse.cc:1499
          #15 0x55cef381b8fa in do_command(THD*) /data/src/10.1/sql/sql_parse.cc:1131
          #16 0x55cef3ac0862 in do_handle_one_connection(THD*) /data/src/10.1/sql/sql_connect.cc:1331
          #17 0x55cef3ac0e1a in handle_one_connection /data/src/10.1/sql/sql_connect.cc:1242
          #18 0x55cef442643a in pfs_spawn_thread /data/src/10.1/storage/perfschema/pfs.cc:1861
          #19 0x7f5f36ebb4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
          #20 0x7f5f356c9d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)
       
      0x61100001f4c0 is located 128 bytes inside of 252-byte region [0x61100001f440,0x61100001f53c)
      freed by thread T23 here:
          #0 0x7f5f37192a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)
          #1 0x55cef4ad0708 in free_memory /data/src/10.1/mysys/safemalloc.c:276
       
      previously allocated by thread T23 here:
          #0 0x7f5f37192d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
          #1 0x55cef4ad08ac in sf_malloc /data/src/10.1/mysys/safemalloc.c:115
          #2 0x55cef4c2da52  (/data/bld/10.1-asan-nightly/bin/mysqld+0x1dcfa52)
       
      Thread T23 created by T0 here:
          #0 0x7f5f37101f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
          #1 0x55cef4431dbe in spawn_thread_v1 /data/src/10.1/storage/perfschema/pfs.cc:1911
       
      SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.1/storage/maria/ma_info.c:45 in maria_status
      Shadow bytes around the buggy address:
        0x0c227fffbe40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c227fffbe50: 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fa
        0x0c227fffbe60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c227fffbe70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa
        0x0c227fffbe80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
      =>0x0c227fffbe90: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd
        0x0c227fffbea0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
        0x0c227fffbeb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c227fffbec0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c227fffbed0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
        0x0c227fffbee0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==1954==ABORTING
      

        Attachments

          Activity

            People

            Assignee:
            vlad.lesin Vladislav Lesin
            Reporter:
            elenst Elena Stepanova
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Dates

              Created:
              Updated: