Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-22695

Server crashes in heap_rnext upon DELETE from a HEAP table

    XMLWordPrintable

    Details

      Description

      CREATE TABLE t1 (a VARCHAR(128), b VARCHAR(32), KEY(a) USING BTREE, KEY(b) USING BTREE) ENGINE=HEAP;
      INSERT INTO t1 VALUES ('foo',NULL),('m','b'),(6,'j'),('bar','qux'),(NULL,NULL);
      DELETE FROM t1 WHERE a <=> 'm' OR b <=> NULL;
       
      # Cleanup
      DROP TABLE t1;
      

      10.1 debug cb9c49a9

      #3  <signal handler called>
      #4  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:325
      #5  0x000056475c1759c9 in heap_rnext (info=0x7f0a4489d970, record=0x7f0a4489c588 "\374\001moo") at /data/src/10.1/storage/heap/hp_rnext.c:127
      #6  0x000056475c17000c in ha_heap::index_next (this=0x7f0a44a77808, buf=0x7f0a4489c588 "\374\001moo") at /data/src/10.1/storage/heap/ha_heap.cc:317
      #7  0x000056475bfd95e1 in handler::index_next_same (this=0x7f0a44a77808, buf=0x7f0a4489c588 "\374\001moo", key=0x7f0a44a77350 "\001", keylen=35) at /data/src/10.1/sql/handler.cc:4547
      #8  0x000056475bfd6183 in handler::ha_index_next_same (this=0x7f0a44a77808, buf=0x7f0a4489c588 "\374\001moo", key=0x7f0a44a77350 "\001", keylen=35) at /data/src/10.1/sql/handler.cc:2799
      #9  0x000056475bfdb996 in handler::read_range_next (this=0x7f0a44a77808) at /data/src/10.1/sql/handler.cc:5431
      #10 0x000056475bf126cf in handler::multi_range_read_next (this=0x7f0a44a77808, range_info=0x7f0a4f183188) at /data/src/10.1/sql/multi_range_read.cc:257
      #11 0x000056475c10346e in QUICK_RANGE_SELECT::get_next (this=0x7f0a4499f280) at /data/src/10.1/sql/opt_range.cc:11293
      #12 0x000056475c102dfd in QUICK_ROR_UNION_SELECT::get_next (this=0x7f0a44a73100) at /data/src/10.1/sql/opt_range.cc:11160
      #13 0x000056475c113537 in rr_quick (info=0x7f0a4f1833d0) at /data/src/10.1/sql/records.cc:350
      #14 0x000056475c12abc4 in mysql_delete (thd=0x7f0a467cb070, table_list=0x7f0a448f6190, conds=0x7f0a448f6d70, order_list=0x7f0a467cf528, limit=18446744073709551613, options=0, result=0x0) at /data/src/10.1/sql/sql_delete.cc:570
      #15 0x000056475bd94c45 in mysql_execute_command (thd=0x7f0a467cb070) at /data/src/10.1/sql/sql_parse.cc:3869
      #16 0x000056475bd9f15c in mysql_parse (thd=0x7f0a467cb070, rawbuf=0x7f0a448f6088 "DELETE FROM t1 WHERE a <=> 'm' OR b <=> NULL", length=44, parser_state=0x7f0a4f1845f0) at /data/src/10.1/sql/sql_parse.cc:7208
      #17 0x000056475bd8e332 in dispatch_command (command=COM_QUERY, thd=0x7f0a467cb070, packet=0x7f0a487ee071 "DELETE FROM t1 WHERE a <=> 'm' OR b <=> NULL", packet_length=44) at /data/src/10.1/sql/sql_parse.cc:1499
      #18 0x000056475bd8d217 in do_command (thd=0x7f0a467cb070) at /data/src/10.1/sql/sql_parse.cc:1131
      #19 0x000056475beca4e1 in do_handle_one_connection (thd_arg=0x7f0a467cb070) at /data/src/10.1/sql/sql_connect.cc:1331
      #20 0x000056475beca212 in handle_one_connection (arg=0x7f0a467cb070) at /data/src/10.1/sql/sql_connect.cc:1242
      #21 0x000056475c2e7e3a in pfs_spawn_thread (arg=0x7f0a4cc39c70) at /data/src/10.1/storage/perfschema/pfs.cc:1868
      #22 0x00007f0a4ee074a4 in start_thread (arg=0x7f0a4f185700) at pthread_create.c:456
      #23 0x00007f0a4d615d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97
      

      Release build doesn't crash on my machine, but both debug and non-debug builds with ASAN throw heap-use-after-free errors:

      10.1 cb9c49a9 non-debug with ASAN

      ==20111==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000003b60 at pc 0x55ed6a9b254f bp 0x7f93f5e898d0 sp 0x7f93f5e898c8
      READ of size 8 at 0x604000003b60 thread T6
          #0 0x55ed6a9b254e in tree_search_next /data/src/10.1/mysys/tree.c:474
          #1 0x55ed6a1c1ea4 in heap_rnext /data/src/10.1/storage/heap/hp_rnext.c:56
          #2 0x55ed6a1b6d6a in ha_heap::index_next(unsigned char*) /data/src/10.1/storage/heap/ha_heap.cc:317
          #3 0x55ed69df2710 in handler::index_next_same(unsigned char*, unsigned char const*, unsigned int) /data/src/10.1/sql/handler.cc:4547
          #4 0x55ed69e01052 in handler::ha_index_next_same(unsigned char*, unsigned char const*, unsigned int) /data/src/10.1/sql/handler.cc:2799
          #5 0x55ed69e0b4a5 in handler::read_range_next() /data/src/10.1/sql/handler.cc:5431
          #6 0x55ed69c987fa in handler::multi_range_read_next(void**) /data/src/10.1/sql/multi_range_read.cc:257
          #7 0x55ed6a097bce in QUICK_RANGE_SELECT::get_next() /data/src/10.1/sql/opt_range.cc:11293
          #8 0x55ed6a09c772 in QUICK_ROR_UNION_SELECT::get_next() /data/src/10.1/sql/opt_range.cc:11160
          #9 0x55ed6a0e7397 in rr_quick /data/src/10.1/sql/records.cc:350
          #10 0x55ed6a11af7d in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /data/src/10.1/sql/sql_delete.cc:570
          #11 0x55ed699ac147 in mysql_execute_command(THD*) /data/src/10.1/sql/sql_parse.cc:3869
          #12 0x55ed699b8359 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.1/sql/sql_parse.cc:7208
          #13 0x55ed699be884 in dispatch_command(enum_server_command, THD*, char*, unsigned int) /data/src/10.1/sql/sql_parse.cc:1499
          #14 0x55ed699c36ac in do_command(THD*) /data/src/10.1/sql/sql_parse.cc:1131
          #15 0x55ed69c1824a in do_handle_one_connection(THD*) /data/src/10.1/sql/sql_connect.cc:1331
          #16 0x55ed69c187d0 in handle_one_connection /data/src/10.1/sql/sql_connect.cc:1242
          #17 0x55ed6a4344d7 in pfs_spawn_thread /data/src/10.1/storage/perfschema/pfs.cc:1868
          #18 0x7f94016bd4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
          #19 0x7f93ffecbd0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)
       
      0x604000003b60 is located 16 bytes inside of 48-byte region [0x604000003b50,0x604000003b80)
      freed by thread T6 here:
          #0 0x7f9401994a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)
          #1 0x55ed6a9991da in my_free /data/src/10.1/mysys/my_malloc.c:218
       
      previously allocated by thread T6 here:
          #0 0x7f9401994d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
          #1 0x55ed6a998ff8 in my_malloc /data/src/10.1/mysys/my_malloc.c:101
       
      Thread T6 created by T0 here:
          #0 0x7f9401903f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
          #1 0x55ed6a43e9e6 in spawn_thread_v1 /data/src/10.1/storage/perfschema/pfs.cc:1918
       
      SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.1/mysys/tree.c:474 in tree_search_next
      Shadow bytes around the buggy address:
        0x0c087fff8710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c087fff8720: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
        0x0c087fff8730: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
        0x0c087fff8740: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
        0x0c087fff8750: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
      =>0x0c087fff8760: fa fa 00 00 00 00 00 00 fa fa fd fd[fd]fd fd fd
        0x0c087fff8770: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00
        0x0c087fff8780: fa fa 00 00 00 00 00 00 fa fa fd fd fd fd fd fd
        0x0c087fff8790: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 fa
        0x0c087fff87a0: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 fa
        0x0c087fff87b0: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==20111==ABORTING
      

      All of 5.5-10.5 are affected, debug- and non-debug builds as described above.

        Attachments

          Activity

            People

            Assignee:
            sanja Oleksandr Byelkin
            Reporter:
            elenst Elena Stepanova
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Dates

              Created:
              Updated:

                Git Integration