[MDEV-24683] ASAN heap-use-after-free in Binary_string::copy / table_uvar_by_thread::materialize - Jira

XML

Word

Printable

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.5, 10.6, 10.11, 11.0(EOL), 11.1(EOL), 11.2(EOL), 11.3(EOL), 11.4
Fix Version/s: 10.5, 10.6, 10.11, 11.4
Component/s: Performance Schema
Labels:
None

Description

The test concurrently sets a variable in one thread and reads performance_schema.user_variables_by_thread in another.

--source include/have_perfschema.inc

--connect (con1,localhost,root,,)

--delimiter $

--send

  LOOP

    SET @switch = @@optimizer_switch ;

  END LOOP $

--delimiter ;

--connection default

--let $run= 1000

while ($run)

  SELECT * FROM performance_schema.user_variables_by_thread;

  --dec $run

10.5 5adcb2e7 ASAN
==1450202==ERROR: AddressSanitizer: heap-use-after-free on address 0x61900011bd08 at pc 0x7f4ded13d480 bp 0x7f4de35ea740 sp 0x7f4de35e9ee8
READ of size 801 at 0x61900011bd08 thread T5
#0 0x7f4ded13d47f (/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f)
#1 0x55bb44287127 in Binary_string::copy(char const*, unsigned long) /data/src/10.5/sql/sql_string.cc:261
#2 0x55bb43d32399 in String::copy(char const, unsigned long, charset_info_st const) /data/src/10.5/sql/sql_string.h:833
#3 0x55bb449b3b20 in user_var_entry::val_str(bool, String, unsigned int) const /data/src/10.5/sql/item_func.cc:5020
#4 0x55bb4526e2a3 in User_variables::materialize(PFS_thread, THD) /data/src/10.5/storage/perfschema/table_uvar_by_thread.cc:116
#5 0x55bb4526ebe2 in table_uvar_by_thread::materialize(PFS_thread*) /data/src/10.5/storage/perfschema/table_uvar_by_thread.cc:251
#6 0x55bb4526e7d6 in table_uvar_by_thread::rnd_next() /data/src/10.5/storage/perfschema/table_uvar_by_thread.cc:194
#7 0x55bb45161c37 in ha_perfschema::rnd_next(unsigned char*) /data/src/10.5/storage/perfschema/ha_perfschema.cc:359
#8 0x55bb4483f27b in handler::ha_rnd_next(unsigned char*) /data/src/10.5/sql/handler.cc:3066
#9 0x55bb44c9a1ed in rr_sequential(READ_RECORD*) /data/src/10.5/sql/records.cc:519
#10 0x55bb43e6c021 in READ_RECORD::read_record() /data/src/10.5/sql/records.h:80
#11 0x55bb4417cdf1 in join_init_read_record(st_join_table*) /data/src/10.5/sql/sql_select.cc:21572
#12 0x55bb441760d6 in sub_select(JOIN, st_join_table, bool) /data/src/10.5/sql/sql_select.cc:20624
#13 0x55bb441743b9 in do_select /data/src/10.5/sql/sql_select.cc:20161
#14 0x55bb44101182 in JOIN::exec_inner() /data/src/10.5/sql/sql_select.cc:4462
#15 0x55bb440fe76d in JOIN::exec() /data/src/10.5/sql/sql_select.cc:4242
#16 0x55bb441026e7 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.5/sql/sql_select.cc:4658
#17 0x55bb440d446b in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:417
#18 0x55bb4403da67 in execute_sqlcom_select /data/src/10.5/sql/sql_parse.cc:6281
#19 0x55bb4402c968 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:3977
#20 0x55bb44048d61 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8062
#21 0x55bb4401f05a in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1889
#22 0x55bb4401b983 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1370
#23 0x55bb4445dbe9 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1410
#24 0x55bb4445d54d in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312
#25 0x55bb45168efe in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201
#26 0x7f4deccc1608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
#27 0x7f4dec897292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x61900011bd08 is located 136 bytes inside of 948-byte region [0x61900011bc80,0x61900011c034)
freed by thread T6 here:
#0 0x7f4ded1af7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
#1 0x55bb45e085e9 in free_memory /data/src/10.5/mysys/safemalloc.c:279
#2 0x55bb45e07b65 in sf_realloc /data/src/10.5/mysys/safemalloc.c:187
#3 0x55bb45dd515c in my_realloc /data/src/10.5/mysys/my_malloc.c:149
#4 0x55bb449b2ae2 in update_hash(user_var_entry, bool, void, unsigned long, Item_result, charset_info_st const*, bool) /data/src/10.5/sql/item_func.cc:4884
#5 0x55bb449b314a in Item_func_set_user_var::update_hash(void, unsigned long, Item_result, charset_info_st const, bool) /data/src/10.5/sql/item_func.cc:4935
#6 0x55bb449b52dc in Item_func_set_user_var::update() /data/src/10.5/sql/item_func.cc:5191
#7 0x55bb43d7ac78 in set_var_user::update(THD*) /data/src/10.5/sql/set_var.cc:924
#8 0x55bb43d79be6 in sql_set_variables(THD, List<set_var_base>, bool) /data/src/10.5/sql/set_var.cc:746
#9 0x55bb44034aca in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:5067
#10 0x55bb43dd92b5 in sp_instr_stmt::exec_core(THD, unsigned int) /data/src/10.5/sql/sp_head.cc:3768
#11 0x55bb43dd7921 in sp_lex_keeper::reset_lex_and_exec_core(THD, unsigned int, bool, sp_instr*) /data/src/10.5/sql/sp_head.cc:3495
#12 0x55bb43dd8a1a in sp_instr_stmt::execute(THD, unsigned int) /data/src/10.5/sql/sp_head.cc:3674
#13 0x55bb43dc992f in sp_head::execute(THD*, bool) /data/src/10.5/sql/sp_head.cc:1437
#14 0x55bb43dd00d5 in sp_head::execute_procedure(THD, List<Item>) /data/src/10.5/sql/sp_head.cc:2449
#15 0x55bb44026266 in do_execute_sp /data/src/10.5/sql/sql_parse.cc:3087
#16 0x55bb44039611 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:5748
#17 0x55bb44048d61 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8062
#18 0x55bb4401f05a in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1889
#19 0x55bb4401b983 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1370
#20 0x55bb4445dbe9 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1410
#21 0x55bb4445d54d in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312
#22 0x55bb45168efe in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201
#23 0x7f4deccc1608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477

previously allocated by thread T6 here:
#0 0x7f4ded1afbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x55bb45e07559 in sf_malloc /data/src/10.5/mysys/safemalloc.c:118
#2 0x55bb45e07aec in sf_realloc /data/src/10.5/mysys/safemalloc.c:182
#3 0x55bb45dd515c in my_realloc /data/src/10.5/mysys/my_malloc.c:149
#4 0x55bb449b2ae2 in update_hash(user_var_entry, bool, void, unsigned long, Item_result, charset_info_st const*, bool) /data/src/10.5/sql/item_func.cc:4884
#5 0x55bb449b314a in Item_func_set_user_var::update_hash(void, unsigned long, Item_result, charset_info_st const, bool) /data/src/10.5/sql/item_func.cc:4935
#6 0x55bb449b52dc in Item_func_set_user_var::update() /data/src/10.5/sql/item_func.cc:5191
#7 0x55bb43d7ac78 in set_var_user::update(THD*) /data/src/10.5/sql/set_var.cc:924
#8 0x55bb43d79be6 in sql_set_variables(THD, List<set_var_base>, bool) /data/src/10.5/sql/set_var.cc:746
#9 0x55bb44034aca in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:5067
#10 0x55bb43dd92b5 in sp_instr_stmt::exec_core(THD, unsigned int) /data/src/10.5/sql/sp_head.cc:3768
#11 0x55bb43dd7921 in sp_lex_keeper::reset_lex_and_exec_core(THD, unsigned int, bool, sp_instr*) /data/src/10.5/sql/sp_head.cc:3495
#12 0x55bb43dd8a1a in sp_instr_stmt::execute(THD, unsigned int) /data/src/10.5/sql/sp_head.cc:3674
#13 0x55bb43dc992f in sp_head::execute(THD*, bool) /data/src/10.5/sql/sp_head.cc:1437
#14 0x55bb43dd00d5 in sp_head::execute_procedure(THD, List<Item>) /data/src/10.5/sql/sp_head.cc:2449
#15 0x55bb44026266 in do_execute_sp /data/src/10.5/sql/sql_parse.cc:3087
#16 0x55bb44039611 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:5748
#17 0x55bb44048d61 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8062
#18 0x55bb4401f05a in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1889
#19 0x55bb4401b983 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1370
#20 0x55bb4445dbe9 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1410
#21 0x55bb4445d54d in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312
#22 0x55bb45168efe in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201
#23 0x7f4deccc1608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477

Thread T5 created by T0 here:
#0 0x7f4ded0dc805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
#1 0x55bb45163ea2 in my_thread_create /data/src/10.5/storage/perfschema/my_thread.h:38
#2 0x55bb451692f1 in pfs_spawn_thread_v1 /data/src/10.5/storage/perfschema/pfs.cc:2252
#3 0x55bb43d0f4fe in inline_mysql_thread_create /data/src/10.5/include/mysql/psi/mysql_thread.h:1323
#4 0x55bb43d254e0 in create_thread_to_handle_connection(CONNECT*) /data/src/10.5/sql/mysqld.cc:6023
#5 0x55bb43d25b5f in create_new_thread(CONNECT*) /data/src/10.5/sql/mysqld.cc:6082
#6 0x55bb43d25ebc in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.5/sql/mysqld.cc:6147
#7 0x55bb43d26adb in handle_connections_sockets() /data/src/10.5/sql/mysqld.cc:6274
#8 0x55bb43d24ced in mysqld_main(int, char**) /data/src/10.5/sql/mysqld.cc:5669
#9 0x55bb43d0dd9c in main /data/src/10.5/sql/main.cc:25
#10 0x7f4dec79c0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

Thread T6 created by T0 here:
#0 0x7f4ded0dc805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
#1 0x55bb45163ea2 in my_thread_create /data/src/10.5/storage/perfschema/my_thread.h:38
#2 0x55bb451692f1 in pfs_spawn_thread_v1 /data/src/10.5/storage/perfschema/pfs.cc:2252
#3 0x55bb43d0f4fe in inline_mysql_thread_create /data/src/10.5/include/mysql/psi/mysql_thread.h:1323
#4 0x55bb43d254e0 in create_thread_to_handle_connection(CONNECT*) /data/src/10.5/sql/mysqld.cc:6023
#5 0x55bb43d25b5f in create_new_thread(CONNECT*) /data/src/10.5/sql/mysqld.cc:6082
#6 0x55bb43d25ebc in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.5/sql/mysqld.cc:6147
#7 0x55bb43d26adb in handle_connections_sockets() /data/src/10.5/sql/mysqld.cc:6274
#8 0x55bb43d24ced in mysqld_main(int, char**) /data/src/10.5/sql/mysqld.cc:5669
#9 0x55bb43d0dd9c in main /data/src/10.5/sql/main.cc:25
#10 0x7f4dec79c0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free (/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f)
Shadow bytes around the buggy address:
0x0c328001b750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c328001b760: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
0x0c328001b770: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c328001b780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c328001b790: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c328001b7a0: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c328001b7b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c328001b7c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c328001b7d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c328001b7e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c328001b7f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1450202==ABORTING
210125 23:51:28 [ERROR] mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.

To report this bug, see https://mariadb.com/kb/en/reporting-bugs

We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.

Server version: 10.5.9-MariaDB-debug-log
key_buffer_size=1048576
read_buffer_size=131072
max_used_connections=2
max_threads=153
thread_count=3
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63743 K bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x62b000069288
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7f4de35ed950 thread_stack 0x5fc00
??:0(__interceptor_tcgetattr)[0x7f4ded10ed30]
mysys/stacktrace.c:212(my_print_stacktrace)[0x55bb45de4fbd]
sql/signal_handler.cc:211(handle_fatal_signal)[0x55bb44825902]
sigaction.c:0(__restore_rt)[0x7f4decccd3c0]
??:0(gsignal)[0x7f4dec7bb18b]
??:0(abort)[0x7f4dec79a859]
??:0(__sanitizer_set_report_fd)[0x7f4ded1cd6a2]
??:0(__sanitizer_get_module_and_offset_for_pc)[0x7f4ded1d824c]
??:0(__sanitizer_ptr_cmp)[0x7f4ded1b98ec]
??:0(__asan_on_error)[0x7f4ded1b9363]
??:0(__interceptor_getdelim)[0x7f4ded13d49f]
sql/sql_string.cc:262(Binary_string::copy(char const*, unsigned long))[0x55bb44287128]
sql/sql_string.h:834(String::copy(char const, unsigned long, charset_info_st const))[0x55bb43d3239a]
sql/item_func.cc:5020(user_var_entry::val_str(bool, String, unsigned int) const)[0x55bb449b3b21]
perfschema/table_uvar_by_thread.cc:116(User_variables::materialize(PFS_thread, THD))[0x55bb4526e2a4]
perfschema/table_uvar_by_thread.cc:252(table_uvar_by_thread::materialize(PFS_thread*))[0x55bb4526ebe3]
perfschema/table_uvar_by_thread.cc:194(table_uvar_by_thread::rnd_next())[0x55bb4526e7d7]
perfschema/ha_perfschema.cc:359(ha_perfschema::rnd_next(unsigned char*))[0x55bb45161c38]
sql/handler.cc:3066(handler::ha_rnd_next(unsigned char*))[0x55bb4483f27c]
sql/records.cc:519(rr_sequential(READ_RECORD*))[0x55bb44c9a1ee]
sql/records.h:80(READ_RECORD::read_record())[0x55bb43e6c022]
sql/sql_select.cc:21572(join_init_read_record(st_join_table*))[0x55bb4417cdf2]
sql/sql_select.cc:20624(sub_select(JOIN, st_join_table, bool))[0x55bb441760d7]
sql/sql_select.cc:20161(do_select(JOIN, Procedure))[0x55bb441743ba]
sql/sql_select.cc:4462(JOIN::exec_inner())[0x55bb44101183]
sql/sql_select.cc:4243(JOIN::exec())[0x55bb440fe76e]
sql/sql_select.cc:4660(mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex))[0x55bb441026e8]
sql/sql_select.cc:417(handle_select(THD, LEX, select_result*, unsigned long))[0x55bb440d446c]
sql/sql_parse.cc:6281(execute_sqlcom_select(THD, TABLE_LIST))[0x55bb4403da68]
sql/sql_parse.cc:3977(mysql_execute_command(THD*))[0x55bb4402c969]
sql/sql_parse.cc:8062(mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool))[0x55bb44048d62]
sql/sql_parse.cc:1892(dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool))[0x55bb4401f05b]
sql/sql_parse.cc:1370(do_command(THD*))[0x55bb4401b984]
sql/sql_connect.cc:1410(do_handle_one_connection(CONNECT*, bool))[0x55bb4445dbea]
sql/sql_connect.cc:1314(handle_one_connection)[0x55bb4445d54e]
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x55bb45168eff]
nptl/pthread_create.c:478(start_thread)[0x7f4deccc1609]
??:0(clone)[0x7f4dec897293]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x62b0000382a8): SELECT * FROM performance_schema.user_variables_by_thread

Connection ID (thread ID): 4
Status: NOT_KILLED

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off

The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains
information that should help you find out what is causing the crash.
Writing a core file...
Working directory at /dev/shm/var_auto_hcq4/mysqld.1/data
Resource Limits:
Limit Soft Limit Hard Limit Units
Max cpu time unlimited unlimited seconds
Max file size unlimited unlimited bytes
Max data size unlimited unlimited bytes
Max stack size 8388608 unlimited bytes
Max core file size 0 0 bytes
Max resident set unlimited unlimited bytes
Max processes 385883 385883 processes
Max open files 1024 1024 files
Max locked memory 67108864 67108864 bytes
Max address space unlimited unlimited bytes
Max file locks unlimited unlimited locks
Max pending signals 385883 385883 signals
Max msgqueue size 819200 819200 bytes
Max nice priority 0 0
Max realtime priority 0 0
Max realtime timeout unlimited unlimited us
Core pattern: \|/usr/share/apport/apport %p %s %c %d %P %E

The compound statement is unimportant, it is there just to achieve concurrency in the MTR test.

For me 1000 rounds configured in the test is more than enough, the test always fails; but it can vary on different machiens and builds. Try to increase the value if it doesn't fail right away, it goes very fast anyway.

No obvious problem on a non-ASAN build.

Attachments

Issue Links

relates to

MDEV-23665 Assertion `length <= 64' failed in PFS_variable_name_row::make_row and Assertion `length <= NAME_CHAR_LEN' failed on performance_schema related SELECT

Open

Activity

People

Assignee:: Sergei Golubchik

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2021-01-25 21:58

Updated:: 4 hours ago

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.