Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-28129

MariaDB UAF issue at lex_end_nops(LEX*)

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 10.9.0, 10.7(EOL), 10.8(EOL)
    • 10.7.4, 10.8.3, 10.9.1
    • Parser
    • None
    • Linux jie-2 5.4.143-1-pve #1 SMP PVE 5.4.143-1 (Tue, 28 Sep 2021 09:10:37 +0200) x86_64 x86_64 x86_64 GNU/Linux

    Description

      PoC:

      create or replace trigger A before insert on B
      for each row select table_rows from information_schema.tables
      where table_name = 'C' into @#;
      

      report (with ASAN enabled):

      =================================================================
      ==12446==ERROR: AddressSanitizer: heap-use-after-free on address 0x6250000862e8 at pc 0x000000b9e5a4 bp 0x7f17b124ce90 sp 0x7f17b124ce88
      WRITE of size 8 at 0x6250000862e8 thread T15
          #0 0xb9e5a3 in lex_end_nops(LEX*) /root/mariadb/sql/sql_lex.cc:1372:14
          #1 0xb9e5a3 in lex_end(LEX*) /root/mariadb/sql/sql_lex.cc:1340:3
          #2 0xb03989 in THD::end_statement() /root/mariadb/sql/sql_class.cc:3908:3
          #3 0xc4a897 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /root/mariadb/sql/sql_parse.cc:8049:10
          #4 0xc41ba9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /root/mariadb/sql/sql_parse.cc:1894:7
          #5 0xc4b74b in do_command(THD*, bool) /root/mariadb/sql/sql_parse.cc:1402:17
          #6 0x111f9f2 in do_handle_one_connection(CONNECT*, bool) /root/mariadb/sql/sql_connect.cc:1418:11
          #7 0x111f248 in handle_one_connection /root/mariadb/sql/sql_connect.cc:1312:5
          #8 0x1f3f9dd in pfs_spawn_thread /root/mariadb/storage/perfschema/pfs.cc:2201:3
          #9 0x7f17d6fdc608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477:8
          #10 0x7f17d6cf2162 in clone /build/glibc-sMfBJT/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
       
      0x6250000862e8 is located 6632 bytes inside of 8208-byte region [0x625000084900,0x625000086910)
      freed by thread T15 here:
          #0 0x80f732 in free (/usr/local/mysql/bin/mariadbd+0x80f732)
          #1 0x2a598bf in root_free /root/mariadb/mysys/my_alloc.c:78:5
          #2 0x2a598bf in free_root /root/mariadb/mysys/my_alloc.c:501:7
          #3 0x9a1258 in sp_head::destroy(sp_head*) /root/mariadb/sql/sp_head.cc:521:5
          #4 0xb9e41e in lex_end_nops(LEX*) /root/mariadb/sql/sql_lex.cc:1371:3
          #5 0xb9e41e in lex_end(LEX*) /root/mariadb/sql/sql_lex.cc:1340:3
          #6 0xb03989 in THD::end_statement() /root/mariadb/sql/sql_class.cc:3908:3
          #7 0xc4a897 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /root/mariadb/sql/sql_parse.cc:8049:10
          #8 0xc41ba9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /root/mariadb/sql/sql_parse.cc:1894:7
          #9 0xc4b74b in do_command(THD*, bool) /root/mariadb/sql/sql_parse.cc:1402:17
          #10 0x111f9f2 in do_handle_one_connection(CONNECT*, bool) /root/mariadb/sql/sql_connect.cc:1418:11
          #11 0x111f248 in handle_one_connection /root/mariadb/sql/sql_connect.cc:1312:5
          #12 0x1f3f9dd in pfs_spawn_thread /root/mariadb/storage/perfschema/pfs.cc:2201:3
          #13 0x7f17d6fdc608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477:8
       
      previously allocated by thread T15 here:
          #0 0x80f99d in malloc (/usr/local/mysql/bin/mariadbd+0x80f99d)
          #1 0x2a76878 in my_malloc /root/mariadb/mysys/my_malloc.c:90:29
          #2 0x2a5887f in root_alloc /root/mariadb/mysys/my_alloc.c:66:10
          #3 0x2a5887f in alloc_root /root/mariadb/mysys/my_alloc.c:332:29
          #4 0x9b45f6 in Sql_alloc::operator new(unsigned long, st_mem_root*) /root/mariadb/sql/sql_alloc.h:37:12
          #5 0x9b45f6 in sp_head::reset_lex(THD*) /root/mariadb/sql/sp_head.cc:2619:25
          #6 0x1424874 in MYSQLparse(THD*) /root/mariadb/sql/sql_yacc.yy:3675:26
          #7 0xc808a0 in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /root/mariadb/sql/sql_parse.cc:10379:46
          #8 0xc4a263 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /root/mariadb/sql/sql_parse.cc:7979:15
          #9 0xc41ba9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /root/mariadb/sql/sql_parse.cc:1894:7
          #10 0xc4b74b in do_command(THD*, bool) /root/mariadb/sql/sql_parse.cc:1402:17
          #11 0x111f9f2 in do_handle_one_connection(CONNECT*, bool) /root/mariadb/sql/sql_connect.cc:1418:11
          #12 0x111f248 in handle_one_connection /root/mariadb/sql/sql_connect.cc:1312:5
          #13 0x1f3f9dd in pfs_spawn_thread /root/mariadb/storage/perfschema/pfs.cc:2201:3
          #14 0x7f17d6fdc608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477:8
       
      Thread T15 created by T0 here:
          #0 0x7f9cfc in pthread_create (/usr/local/mysql/bin/mariadbd+0x7f9cfc)
          #1 0x1f3fd39 in my_thread_create(unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /root/mariadb/storage/perfschema/my_thread.h:52:10
          #2 0x1f3fd39 in pfs_spawn_thread_v1 /root/mariadb/storage/perfschema/pfs.cc:2252:15
          #3 0x85cef4 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /root/mariadb/include/mysql/psi/mysql_thread.h:1139:11
          #4 0x85cef4 in create_thread_to_handle_connection(CONNECT*) /root/mariadb/sql/mysqld.cc:5975:19
          #5 0x85e72a in create_new_thread(CONNECT*) /root/mariadb/sql/mysqld.cc:6034:3
          #6 0x85e72a in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /root/mariadb/sql/mysqld.cc:6096:5
          #7 0x85a34c in handle_connections_sockets() /root/mariadb/sql/mysqld.cc:6220:9
          #8 0x84e9ef in mysqld_main(int, char**) /root/mariadb/sql/mysqld.cc:5870:3
          #9 0x7f17d6bf70b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
       
      SUMMARY: AddressSanitizer: heap-use-after-free /root/mariadb/sql/sql_lex.cc:1372:14 in lex_end_nops(LEX*)
      Shadow bytes around the buggy address:
        0x0c4a80008c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4a80008c10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4a80008c20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4a80008c30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4a80008c40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c4a80008c50: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd
        0x0c4a80008c60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4a80008c70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4a80008c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4a80008c90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c4a80008ca0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      ==12446==ABORTING
      

      Attachments

        Issue Links

          Activity

            alice Alice Sherepa added a comment -

            Thank you!
            I reproduced as described on 10.7-10.8, no faailure on 10.2-10.6

            10.7 bf8dc0be9e4bc26a57223ea

            mysqld: /10.7/src/sql/sp_head.cc:878: virtual sp_head::~sp_head(): Assertion `m_thd == __null' failed.
            220322 12:08:03 [ERROR] mysqld got signal 6 ;
             
            Server version: 10.7.4-MariaDB-debug-log
             
            /lib/x86_64-linux-gnu/libc.so.6(+0x22729)[0x7f0b190d6729]
            ??:0(__assert_fail)[0x7f0b190e8006]
            sql/sp_head.cc:880(sp_head::~sp_head())[0x55b4a7e31c9f]
            sql/sp_head.cc:907(sp_head::~sp_head())[0x55b4a7e320c8]
            sql/sp_head.cc:521(sp_head::destroy(sp_head*))[0x55b4a7e2db0a]
            sql/sql_lex.cc:1372(lex_end_nops(LEX*))[0x55b4a801afa7]
            sql/sql_lex.cc:1342(lex_end(LEX*))[0x55b4a801ab65]
            sql/sql_class.cc:3909(THD::end_statement())[0x55b4a7f716a2]
            sql/sql_parse.cc:8050(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55b4a80c301f]
            sql/sql_parse.cc:1896(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x55b4a8098e66]
            sql/sql_parse.cc:1402(do_command(THD*, bool))[0x55b4a8095b8a]
            sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x55b4a8537b07]
            sql/sql_connect.cc:1314(handle_one_connection)[0x55b4a8537393]
            perfschema/pfs.cc:2203(pfs_spawn_thread)[0x55b4a91e1dfc]
            nptl/pthread_create.c:478(start_thread)[0x7f0b19602609]
            ??:0(clone)[0x7f0b191d3163]
             
            Query (0x6290001db2a8): create or replace trigger A before insert on B
            for each row select table_rows from information_schema.tables
            where table_name = 'C' into @
            

            create procedure sp() select 1 into @;
            

            10.7 bf8dc0be9e4bc26a57223ea

            mariadbd: /10.7/src/sql/sp_head.cc:878: virtual sp_head::~sp_head(): Assertion `m_thd == __null' failed.
            220322 12:11:40 [ERROR] mysqld got signal 6 ;
             
            Server version: 10.7.4-MariaDB-debug-log
             
            sql/sp_head.cc:880(sp_head::~sp_head())[0x5616c05b3c9f]
            sql/sp_head.cc:907(sp_head::~sp_head())[0x5616c05b40c8]
            sql/sp_head.cc:521(sp_head::destroy(sp_head*))[0x5616c05afb0a]
            sql/sql_lex.cc:1372(lex_end_nops(LEX*))[0x5616c079cfa7]
            sql/sql_lex.cc:1342(lex_end(LEX*))[0x5616c079cb65]
            sql/sql_class.cc:3909(THD::end_statement())[0x5616c06f36a2]
            sql/sql_parse.cc:8050(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x5616c084501f]
            sql/sql_parse.cc:1896(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x5616c081ae66]
            sql/sql_parse.cc:1402(do_command(THD*, bool))[0x5616c0817b8a]
            sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x5616c0cb9b07]
            sql/sql_connect.cc:1314(handle_one_connection)[0x5616c0cb9393]
            perfschema/pfs.cc:2203(pfs_spawn_thread)[0x5616c1963dfc]
            nptl/pthread_create.c:478(start_thread)[0x7f47fb7be609]
            ??:0(clone)[0x7f47fb38f163]
             
            Query (0x6290001092a8): create procedure sp() select 1 into @
            

            alice Alice Sherepa added a comment - Thank you! I reproduced as described on 10.7-10.8, no faailure on 10.2-10.6 10.7 bf8dc0be9e4bc26a57223ea mysqld: /10.7/src/sql/sp_head.cc:878: virtual sp_head::~sp_head(): Assertion `m_thd == __null' failed. 220322 12:08:03 [ERROR] mysqld got signal 6 ;   Server version: 10.7.4-MariaDB-debug-log   /lib/x86_64-linux-gnu/libc.so.6(+0x22729)[0x7f0b190d6729] ??:0(__assert_fail)[0x7f0b190e8006] sql/sp_head.cc:880(sp_head::~sp_head())[0x55b4a7e31c9f] sql/sp_head.cc:907(sp_head::~sp_head())[0x55b4a7e320c8] sql/sp_head.cc:521(sp_head::destroy(sp_head*))[0x55b4a7e2db0a] sql/sql_lex.cc:1372(lex_end_nops(LEX*))[0x55b4a801afa7] sql/sql_lex.cc:1342(lex_end(LEX*))[0x55b4a801ab65] sql/sql_class.cc:3909(THD::end_statement())[0x55b4a7f716a2] sql/sql_parse.cc:8050(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55b4a80c301f] sql/sql_parse.cc:1896(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x55b4a8098e66] sql/sql_parse.cc:1402(do_command(THD*, bool))[0x55b4a8095b8a] sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x55b4a8537b07] sql/sql_connect.cc:1314(handle_one_connection)[0x55b4a8537393] perfschema/pfs.cc:2203(pfs_spawn_thread)[0x55b4a91e1dfc] nptl/pthread_create.c:478(start_thread)[0x7f0b19602609] ??:0(clone)[0x7f0b191d3163]   Query (0x6290001db2a8): create or replace trigger A before insert on B for each row select table_rows from information_schema.tables where table_name = 'C' into @ create procedure sp() select 1 into @; 10.7 bf8dc0be9e4bc26a57223ea mariadbd: /10.7/src/sql/sp_head.cc:878: virtual sp_head::~sp_head(): Assertion `m_thd == __null' failed. 220322 12:11:40 [ERROR] mysqld got signal 6 ;   Server version: 10.7.4-MariaDB-debug-log   sql/sp_head.cc:880(sp_head::~sp_head())[0x5616c05b3c9f] sql/sp_head.cc:907(sp_head::~sp_head())[0x5616c05b40c8] sql/sp_head.cc:521(sp_head::destroy(sp_head*))[0x5616c05afb0a] sql/sql_lex.cc:1372(lex_end_nops(LEX*))[0x5616c079cfa7] sql/sql_lex.cc:1342(lex_end(LEX*))[0x5616c079cb65] sql/sql_class.cc:3909(THD::end_statement())[0x5616c06f36a2] sql/sql_parse.cc:8050(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x5616c084501f] sql/sql_parse.cc:1896(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x5616c081ae66] sql/sql_parse.cc:1402(do_command(THD*, bool))[0x5616c0817b8a] sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x5616c0cb9b07] sql/sql_connect.cc:1314(handle_one_connection)[0x5616c0cb9393] perfschema/pfs.cc:2203(pfs_spawn_thread)[0x5616c1963dfc] nptl/pthread_create.c:478(start_thread)[0x7f47fb7be609] ??:0(clone)[0x7f47fb38f163]   Query (0x6290001092a8): create procedure sp() select 1 into @

            Ok to push

            sanja Oleksandr Byelkin added a comment - Ok to push

            People

              shulga Dmitry Shulga
              fuboat Jingzhou Fu
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.