Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-22886

ASAN use-after-poison in my_convert with table value constructor

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Open (View Workflow)
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 10.3, 10.4, 10.5
    • Fix Version/s: 10.3, 10.4, 10.5
    • Component/s: Optimizer
    • Labels:
      None

      Description

      The original test case from MDEV-21995 still fails, now with ASAN errors. It doesn't fail in the MTR regression suite, because the statement is not identical there. The MTR test contains VALUES(IGNORE}, without spaces, and it works as expected (fails with an SQL error), but VALUES( IGNORE ) with spaces within brackets fails as below.

      VALUES ( IGNORE );
      

      10.3 ASAN non-debug 81a08c54

      ==7593==ERROR: AddressSanitizer: use-after-poison on address 0x62b000000431 at pc 0x55e883600c1a bp 0x7f35ee66a4e0 sp 0x7f35ee66a4d8
      READ of size 4 at 0x62b000000431 thread T5
          #0 0x55e883600c19 in my_convert /data/src/10.3/strings/ctype.c:1109
          #1 0x55e8824e5ec8 in copy_and_convert(char*, unsigned long, charset_info_st const*, char const*, unsigned long, charset_info_st const*, unsigned int*) /data/src/10.3/sql/sql_string.h:44
          #2 0x55e8824e5ec8 in sql_strmake_with_convert(THD*, char const*, unsigned long, charset_info_st const*, unsigned long, charset_info_st const*, unsigned long*) /data/src/10.3/sql/thr_malloc.cc:92
          #3 0x55e88282f1ff in Item::set_name(THD*, char const*, unsigned long, charset_info_st const*) /data/src/10.3/sql/item.cc:1268
          #4 0x55e8826fa329 in MYSQLparse(THD*) /data/src/10.3/sql/sql_yacc.yy:13668
          #5 0x55e8822cc03c in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /data/src/10.3/sql/sql_parse.cc:10095
          #6 0x55e8822e32af in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7771
          #7 0x55e8822e77ba in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1856
          #8 0x55e8822eb82c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1401
          #9 0x55e88254524f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
          #10 0x55e88254567a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #11 0x55e8834ca5e3 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
          #12 0x7f35fa3a94a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
          #13 0x7f35f84ddd0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)
       
      0x62b000000431 is located 561 bytes inside of 24608-byte region [0x62b000000200,0x62b000006220)
      allocated by thread T5 here:
          #0 0x7f35fa680d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
          #1 0x55e883580e4c in my_malloc /data/src/10.3/mysys/my_malloc.c:101
       
      Thread T5 created by T0 here:
          #0 0x7f35fa5eff59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
          #1 0x55e8834d2862 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
       
      SUMMARY: AddressSanitizer: use-after-poison /data/src/10.3/strings/ctype.c:1109 in my_convert
      Shadow bytes around the buggy address:
        0x0c567fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c567fff8040: 00 00 00 00 f7 00 00 f7 00 00 05 f7 00 05 f7 00
        0x0c567fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c567fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 05 f7
        0x0c567fff8070: 01 f7 00 02 f7 00 00 00 00 00 00 00 00 00 00 00
      =>0x0c567fff8080: 00 00 00 f7 00 00[02]f7 00 00 f7 00 00 00 f7 00
        0x0c567fff8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7
        0x0c567fff80a0: 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c567fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c567fff80c0: 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c567fff80d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==7593==ABORTING
      

      10.5 debug asan 114a8436

      ==7889==ERROR: AddressSanitizer: use-after-poison on address 0x62b00005b4ca at pc 0x55d3e55c4d53 bp 0x7f53625f0390 sp 0x7f53625f0388
      READ of size 1 at 0x62b00005b4ca thread T5
          #0 0x55d3e55c4d52 in my_mb_wc_latin1 /data/src/10.5/strings/ctype-latin1.c:372
          #1 0x55d3e5623c4f in my_convert_using_func /data/src/10.5/strings/ctype.c:1154
          #2 0x55d3e56241fd in my_convert /data/src/10.5/strings/ctype.c:1262
          #3 0x55d3e384e10d in copy_and_convert(char*, unsigned long, charset_info_st const*, char const*, unsigned long, charset_info_st const*, unsigned int*) /data/src/10.5/sql/sql_string.h:51
          #4 0x55d3e3deaaee in sql_strmake_with_convert(THD*, char const*, unsigned long, charset_info_st const*, unsigned long, charset_info_st const*, unsigned long*) /data/src/10.5/sql/thr_malloc.cc:91
          #5 0x55d3e4271f0b in Item::set_name(THD*, char const*, unsigned long, charset_info_st const*) /data/src/10.5/sql/item.cc:1170
          #6 0x55d3e40be19c in MYSQLparse(THD*) /data/src/10.5/sql/sql_yacc.yy:13043
          #7 0x55d3e3afd0db in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /data/src/10.5/sql/sql_parse.cc:10298
          #8 0x55d3e3aefc80 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:7945
          #9 0x55d3e3aca9f8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1875
          #10 0x55d3e3ac787b in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1356
          #11 0x55d3e3e83594 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1411
          #12 0x55d3e3e83003 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1313
          #13 0x55d3e4a6b558 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201
          #14 0x7f536ce3b4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
          #15 0x7f536af6fd0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)
       
      0x62b00005b4ca is located 714 bytes inside of 24740-byte region [0x62b00005b200,0x62b0000612a4)
      allocated by thread T5 here:
          #0 0x7f536d112d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
          #1 0x55d3e556ecd4 in sf_malloc /data/src/10.5/mysys/safemalloc.c:118
          #2 0x55d3e553fe84 in my_malloc /data/src/10.5/mysys/my_malloc.c:88
          #3 0x55d3e551f441 in reset_root_defaults /data/src/10.5/mysys/my_alloc.c:147
          #4 0x55d3e39bf39f in THD::init_for_queries() /data/src/10.5/sql/sql_class.cc:1401
          #5 0x55d3e3e8297c in prepare_new_connection_state(THD*) /data/src/10.5/sql/sql_connect.cc:1240
          #6 0x55d3e3e8307e in thd_prepare_connection(THD*) /data/src/10.5/sql/sql_connect.cc:1334
          #7 0x55d3e3e8354a in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1401
          #8 0x55d3e3e83003 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1313
          #9 0x55d3e4a6b558 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201
          #10 0x7f536ce3b4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
       
      Thread T5 created by T0 here:
          #0 0x7f536d081f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
          #1 0x55d3e4a6661a in my_thread_create /data/src/10.5/storage/perfschema/my_thread.h:34
          #2 0x55d3e4a6b947 in pfs_spawn_thread_v1 /data/src/10.5/storage/perfschema/pfs.cc:2252
          #3 0x55d3e3810757 in inline_mysql_thread_create /data/src/10.5/include/mysql/psi/mysql_thread.h:1321
          #4 0x55d3e3823489 in create_thread_to_handle_connection(CONNECT*) /data/src/10.5/sql/mysqld.cc:5951
          #5 0x55d3e38239fe in create_new_thread(CONNECT*) /data/src/10.5/sql/mysqld.cc:6010
          #6 0x55d3e3823bbb in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.5/sql/mysqld.cc:6075
          #7 0x55d3e382459e in handle_connections_sockets() /data/src/10.5/sql/mysqld.cc:6202
          #8 0x55d3e3822def in mysqld_main(int, char**) /data/src/10.5/sql/mysqld.cc:5620
          #9 0x55d3e380ef4f in main /data/src/10.5/sql/main.cc:25
          #10 0x7f536aea72e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
       
      SUMMARY: AddressSanitizer: use-after-poison /data/src/10.5/strings/ctype-latin1.c:372 in my_mb_wc_latin1
      Shadow bytes around the buggy address:
        0x0c5680003640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c5680003650: 00 00 00 00 f7 00 00 05 f7 00 05 f7 00 00 00 00
        0x0c5680003660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c5680003670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 05
        0x0c5680003680: f7 01 f7 01 f7 00 02 f7 00 00 00 00 00 00 00 00
      =>0x0c5680003690: 00 00 00 00 00 00 f7 00 00[02]f7 00 00 00 00 00
        0x0c56800036a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c56800036b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c56800036c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c56800036d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c56800036e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==7889==ABORTING
      200614  0:00:41 [ERROR] mysqld got signal 6 ;
      This could be because you hit a bug. It is also possible that this binary
      or one of the libraries it was linked against is corrupt, improperly built,
      or misconfigured. This error can also be caused by malfunctioning hardware.
       
      To report this bug, see https://mariadb.com/kb/en/reporting-bugs
       
      We will try our best to scrape up some info that will hopefully help
      diagnose the problem, but since we have already crashed, 
      something is definitely wrong and this may fail.
       
      Server version: 10.5.4-MariaDB-debug-log
      key_buffer_size=1048576
      read_buffer_size=131072
      max_used_connections=1
      max_threads=153
      thread_count=2
      It is possible that mysqld could use up to 
      key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63682 K  bytes of memory
      Hope that's ok; if not, decrease some variables in the equation.
       
      Thread pointer: 0x62b000062288
      Attempting backtrace. You can use the following information to find out
      where mysqld died. If you see no messages after this, something went
      terribly wrong...
      stack_bottom = 0x7f53625f39a0 thread_stack 0x5fc00
      ??:0(backtrace)[0x7f536d09e681]
      mysys/stacktrace.c:306(my_print_stacktrace)[0x55d3e554ec04]
      sql/signal_handler.cc:211(handle_fatal_signal)[0x55d3e421ba08]
      ??:0(__restore_rt)[0x7f536ce450e0]
      linux/raise.c:51(__GI_raise)[0x7f536aeb9fff]
      stdlib/abort.c:91(__GI_abort)[0x7f536aebb42a]
      ??:0(__sanitizer_cov_trace_switch)[0x7f536d12c329]
      ??:0(__asan_print_accumulated_stats)[0x7f536d1219ab]
      ??:0(__asan_unpoison_intra_object_redzone)[0x7f536d11bb57]
      ??:0(__asan_report_load1)[0x7f536d11c1e8]
      strings/ctype-latin1.c:372(my_mb_wc_latin1)[0x55d3e55c4d53]
      strings/ctype.c:1154(my_convert_using_func)[0x55d3e5623c50]
      strings/ctype.c:1262(my_convert)[0x55d3e56241fe]
      sql/sql_string.h:51(copy_and_convert(char*, unsigned long, charset_info_st const*, char const*, unsigned long, charset_info_st const*, unsigned int*))[0x55d3e384e10e]
      sql/thr_malloc.cc:91(sql_strmake_with_convert(THD*, char const*, unsigned long, charset_info_st const*, unsigned long, charset_info_st const*, unsigned long*))[0x55d3e3deaaef]
      sql/item.cc:1170(Item::set_name(THD*, char const*, unsigned long, charset_info_st const*))[0x55d3e4271f0c]
      sql/sql_yacc.cc:43228(MYSQLparse(THD*))[0x55d3e40be19d]
      sql/sql_parse.cc:10298(parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool))[0x55d3e3afd0dc]
      sql/sql_parse.cc:7945(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55d3e3aefc81]
      sql/sql_parse.cc:1877(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55d3e3aca9f9]
      sql/sql_parse.cc:1356(do_command(THD*))[0x55d3e3ac787c]
      sql/sql_connect.cc:1411(do_handle_one_connection(CONNECT*, bool))[0x55d3e3e83595]
      sql/sql_connect.cc:1315(handle_one_connection)[0x55d3e3e83004]
      perfschema/pfs.cc:2203(pfs_spawn_thread)[0x55d3e4a6b559]
      nptl/pthread_create.c:456(start_thread)[0x7f536ce3b4a4]
      x86_64/clone.S:99(clone)[0x7f536af6fd0f]
       
      Trying to get some variables.
      Some pointers may be invalid and cause the dump to abort.
      Query (0x62b00005b440): VALUES ( IGNORE )
      Connection ID (thread ID): 4
      Status: NOT_KILLED
       
      Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off
       
      The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
      information that should help you find out what is causing the crash.
      Writing a core file...
      Working directory at /dev/shm/var_auto_ZABP/mysqld.1/data
      Resource Limits:
      Limit                     Soft Limit           Hard Limit           Units     
      Max cpu time              unlimited            unlimited            seconds   
      Max file size             unlimited            unlimited            bytes     
      Max data size             unlimited            unlimited            bytes     
      Max stack size            8388608              unlimited            bytes     
      Max core file size        0                    0                    bytes     
      Max resident set          unlimited            unlimited            bytes     
      Max processes             128123               128123               processes 
      Max open files            1024                 1024                 files     
      Max locked memory         65536                65536                bytes     
      Max address space         unlimited            unlimited            bytes     
      Max file locks            unlimited            unlimited            locks     
      Max pending signals       128123               128123               signals   
      Max msgqueue size         819200               819200               bytes     
      Max nice priority         0                    0                    
      Max realtime priority     0                    0                    
      Max realtime timeout      unlimited            unlimited            us        
      Core pattern: core
      

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              bar Alexander Barkov
              Reporter:
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:

                  Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.