Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-26595

ASAN use-after-poison my_strnxfrm_simple_internal / Histogram_json_hb::range_selectivity with CHAR column

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: N/A
    • Fix Version/s: 10.7.0
    • Component/s: Optimizer
    • Labels:
      None

      Description

      CREATE TABLE t1 (f CHAR(8));
      INSERT INTO t1 VALUES ('foo'),('bar');
       
      SET histogram_type = JSON_HB;
      ANALYZE TABLE t1 PERSISTENT FOR ALL;
       
      SELECT * FROM t1 WHERE f > 'qux';
       
      # Cleanup
      DROP TABLE t1;
      

      preview-10.7-MDEV-21130-json-histograms 8fc778f3e9

      ==1594792==ERROR: AddressSanitizer: use-after-poison on address 0x621000099d6a at pc 0x558c12a41349 bp 0x7f81eef786c0 sp 0x7f81eef786b0
      READ of size 1 at 0x621000099d6a thread T13
          #0 0x558c12a41348 in my_strnxfrm_simple_internal /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/strings/ctype-simple.c:87
          #1 0x558c12a41cc8 in my_strnxfrm_simple /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/strings/ctype-simple.c:105
          #2 0x558c11876b0b in charset_info_st::strnxfrm(unsigned char*, unsigned long, unsigned char const*, unsigned long) const /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/include/m_ctype.h:809
          #3 0x558c11876b0b in pos_in_interval_for_string(charset_info_st const*, unsigned char const*, unsigned int, unsigned char const*, unsigned int, unsigned char const*, unsigned int) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/field.cc:1207
          #4 0x558c115bc8d3 in position_in_interval /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/opt_histogram_json.cc:243
          #5 0x558c115bd6e9 in Histogram_json_hb::range_selectivity(Field*, st_key_range*, st_key_range*) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/opt_histogram_json.cc:327
          #6 0x558c1136173e in get_column_range_cardinality(Field*, st_key_range*, st_key_range*, unsigned int) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_statistics.cc:3883
          #7 0x558c10e20a50 in records_in_column_ranges /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/opt_range.cc:3273
          #8 0x558c10e20a50 in calculate_cond_selectivity_for_table(THD*, TABLE*, Item**) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/opt_range.cc:3536
          #9 0x558c112c8930 in make_join_statistics /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_select.cc:5783
          #10 0x558c112c8930 in JOIN::optimize_inner() /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_select.cc:2453
          #11 0x558c112ca0cc in JOIN::optimize() /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_select.cc:1809
          #12 0x558c112ca32a in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_select.cc:4977
          #13 0x558c112cbfa7 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_select.cc:545
          #14 0x558c1110a373 in execute_sqlcom_select /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_parse.cc:6256
          #15 0x558c1113a364 in mysql_execute_command(THD*, bool) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_parse.cc:3946
          #16 0x558c110f8e83 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_parse.cc:8030
          #17 0x558c111251d7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_parse.cc:1896
          #18 0x558c1112b636 in do_command(THD*, bool) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_parse.cc:1404
          #19 0x558c115199bb in do_handle_one_connection(CONNECT*, bool) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_connect.cc:1418
          #20 0x558c1151a224 in handle_one_connection /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_connect.cc:1312
          #21 0x558c1200e1bf in pfs_spawn_thread /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/storage/perfschema/pfs.cc:2201
          #22 0x7f81fec23608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
          #23 0x7f81fe7f6292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
       
      0x621000099d6a is located 106 bytes inside of 4112-byte region [0x621000099d00,0x62100009ad10)
      allocated by thread T13 here:
          #0 0x7f81ff30cbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
          #1 0x558c129de91c in my_malloc /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/mysys/my_malloc.c:90
          #2 0x558c129cadff in alloc_root /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/mysys/my_alloc.c:332
          #3 0x558c10e1f497 in create_key_parts_for_pseudo_indexes /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/opt_range.cc:3137
          #4 0x558c10e1f497 in calculate_cond_selectivity_for_table(THD*, TABLE*, Item**) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/opt_range.cc:3484
          #5 0x558c112c8930 in make_join_statistics /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_select.cc:5783
          #6 0x558c112c8930 in JOIN::optimize_inner() /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_select.cc:2453
          #7 0x558c112ca0cc in JOIN::optimize() /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_select.cc:1809
          #8 0x558c112ca32a in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_select.cc:4977
          #9 0x558c112cbfa7 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_select.cc:545
          #10 0x558c1110a373 in execute_sqlcom_select /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_parse.cc:6256
          #11 0x558c1113a364 in mysql_execute_command(THD*, bool) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_parse.cc:3946
          #12 0x558c110f8e83 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_parse.cc:8030
          #13 0x558c111251d7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_parse.cc:1896
          #14 0x558c1112b636 in do_command(THD*, bool) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_parse.cc:1404
          #15 0x558c115199bb in do_handle_one_connection(CONNECT*, bool) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_connect.cc:1418
          #16 0x558c1151a224 in handle_one_connection /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/sql_connect.cc:1312
          #17 0x558c1200e1bf in pfs_spawn_thread /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/storage/perfschema/pfs.cc:2201
          #18 0x7f81fec23608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
       
      Thread T13 created by T0 here:
          #0 0x7f81ff239805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
          #1 0x558c1200e45d in my_thread_create /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/storage/perfschema/my_thread.h:48
          #2 0x558c1200e45d in pfs_spawn_thread_v1 /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/storage/perfschema/pfs.cc:2252
          #3 0x558c10dd8570 in inline_mysql_thread_create /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/include/mysql/psi/mysql_thread.h:1139
          #4 0x558c10dd8570 in create_thread_to_handle_connection(CONNECT*) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/mysqld.cc:5934
          #5 0x558c10de47aa in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/mysqld.cc:6055
          #6 0x558c10de537f in handle_connections_sockets() /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/mysqld.cc:6179
          #7 0x558c10de8a88 in mysqld_main(int, char**) /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/sql/mysqld.cc:5829
          #8 0x7f81fe6fb0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
       
      SUMMARY: AddressSanitizer: use-after-poison /data/src/preview-10.7-MDEV-21130-json-histograms-rel-asan/strings/ctype-simple.c:87 in my_strnxfrm_simple_internal
      Shadow bytes around the buggy address:
        0x0c428000b350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c428000b360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c428000b370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c428000b380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c428000b390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      =>0x0c428000b3a0: 00 00 00 00 00 00 f7 00 00 00 00 f7 00[02]f7 00
        0x0c428000b3b0: 02 f7 00 f7 00 02 f7 00 00 00 00 00 00 00 00 00
        0x0c428000b3c0: 00 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c428000b3d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c428000b3e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c428000b3f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      ==1594792==ABORTING
      210911 23:50:13 [ERROR] mysqld got signal 6 ;
      This could be because you hit a bug. It is also possible that this binary
      or one of the libraries it was linked against is corrupt, improperly built,
      or misconfigured. This error can also be caused by malfunctioning hardware.
       
      To report this bug, see https://mariadb.com/kb/en/reporting-bugs
       
      We will try our best to scrape up some info that will hopefully help
      diagnose the problem, but since we have already crashed, 
      something is definitely wrong and this may fail.
       
      Server version: 10.7.0-MariaDB-log
      key_buffer_size=1048576
      read_buffer_size=131072
      max_used_connections=1
      max_threads=153
      thread_count=1
      It is possible that mysqld could use up to 
      key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63732 K  bytes of memory
      Hope that's ok; if not, decrease some variables in the equation.
       
      Thread pointer: 0x62b0000d9218
      Attempting backtrace. You can use the following information to find out
      where mysqld died. If you see no messages after this, something went
      terribly wrong...
      stack_bottom = 0x7f81eef7d8d0 thread_stack 0x5fc00
      ??:0(__interceptor_tcgetattr)[0x7f81ff26bd30]
      mysys/stacktrace.c:213(my_print_stacktrace)[0x558c129e7756]
      sql/signal_handler.cc:222(handle_fatal_signal)[0x558c118d8bd4]
      sigaction.c:0(__restore_rt)[0x7f81fec2f3c0]
      ??:0(gsignal)[0x7f81fe71a18b]
      ??:0(abort)[0x7f81fe6f9859]
      ??:0(__sanitizer_set_report_fd)[0x7f81ff32a6a2]
      ??:0(__sanitizer_get_module_and_offset_for_pc)[0x7f81ff33524c]
      ??:0(__sanitizer_ptr_cmp)[0x7f81ff3168ec]
      ??:0(__asan_on_error)[0x7f81ff316363]
      ??:0(__asan_report_load1)[0x7f81ff316e4b]
      strings/ctype-simple.c:93(my_strnxfrm_simple_internal)[0x558c12a41349]
      strings/ctype-simple.c:107(my_strnxfrm_simple)[0x558c12a41cc9]
      include/m_ctype.h:809(charset_info_st::strnxfrm(unsigned char*, unsigned long, unsigned char const*, unsigned long) const)[0x558c11876b0c]
      sql/opt_histogram_json.cc:243(position_in_interval(Field*, unsigned char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&))[0x558c115bc8d4]
      sql/opt_histogram_json.cc:330(Histogram_json_hb::range_selectivity(Field*, st_key_range*, st_key_range*))[0x558c115bd6ea]
      sql/sql_statistics.cc:3883(get_column_range_cardinality(Field*, st_key_range*, st_key_range*, unsigned int))[0x558c1136173f]
      sql/opt_range.cc:3274(calculate_cond_selectivity_for_table(THD*, TABLE*, Item**))[0x558c10e20a51]
      sql/sql_select.cc:5783(JOIN::optimize_inner())[0x558c112c8931]
      sql/sql_select.cc:1811(JOIN::optimize())[0x558c112ca0cd]
      sql/sql_select.cc:4977(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x558c112ca32b]
      sql/sql_select.cc:545(handle_select(THD*, LEX*, select_result*, unsigned long))[0x558c112cbfa8]
      sql/sql_parse.cc:6256(execute_sqlcom_select(THD*, TABLE_LIST*))[0x558c1110a374]
      sql/sql_parse.cc:3946(mysql_execute_command(THD*, bool))[0x558c1113a365]
      sql/sql_parse.cc:8047(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x558c110f8e84]
      sql/sql_parse.cc:1898(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x558c111251d8]
      sql/sql_parse.cc:1406(do_command(THD*, bool))[0x558c1112b637]
      sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x558c115199bc]
      sql/sql_connect.cc:1312(handle_one_connection)[0x558c1151a225]
      perfschema/pfs.cc:2204(pfs_spawn_thread)[0x558c1200e1c0]
      nptl/pthread_create.c:478(start_thread)[0x7f81fec23609]
      ??:0(clone)[0x7f81fe7f6293]
       
      Trying to get some variables.
      Some pointers may be invalid and cause the dump to abort.
      Query (0x6290000b9238): SELECT * FROM t1 WHERE f > 'qux'
       
      Connection ID (thread ID): 4
      Status: NOT_KILLED
       
      Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off
       
      The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains
      information that should help you find out what is causing the crash.
      Writing a core file...
      Working directory at /dev/shm/var_auto_14yN/mysqld.1/data
      Resource Limits:
      Limit                     Soft Limit           Hard Limit           Units     
      Max cpu time              unlimited            unlimited            seconds   
      Max file size             unlimited            unlimited            bytes     
      Max data size             unlimited            unlimited            bytes     
      Max stack size            8388608              unlimited            bytes     
      Max core file size        unlimited            unlimited            bytes     
      Max resident set          unlimited            unlimited            bytes     
      Max processes             385736               385736               processes 
      Max open files            1024                 1024                 files     
      Max locked memory         67108864             67108864             bytes     
      Max address space         unlimited            unlimited            bytes     
      Max file locks            unlimited            unlimited            locks     
      Max pending signals       385736               385736               signals   
      Max msgqueue size         819200               819200               bytes     
      Max nice priority         0                    0                    
      Max realtime priority     0                    0                    
      Max realtime timeout      unlimited            unlimited            us        
      Core pattern: |/usr/share/apport/apport %p %s %c %d %P %E
      

      Reproducible with at least MyISAM and InnoDB.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              psergei Sergei Petrunia
              Reporter:
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Git Integration