Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-28270

ASAN heap-use-after-free in my_strnncoll_binary / l_find / xid_cache_search

    XMLWordPrintable

    Details

      Description

      Set to minor because only old versions are affected, and the use case is not of practical importance.

      Run with --mysqld=--thread-handling=pool-of-threads.

      --source include/have_innodb.inc
      --source include/have_pool_of_threads.inc
       
      CREATE TABLE t (pk INT PRIMARY KEY) ENGINE=InnoDB;
      SET GLOBAL custom_cache.key_buffer_size = 65536;
       
      --connect (con1,localhost,root,,test)
      XA START 'xid';
      SET STATEMENT MAX_STATEMENT_TIME= 0.000001 FOR CACHE INDEX t IN custom_cache;
      SELECT * FROM t;
      --disconnect con1
       
      --connection default
      --error ER_XAER_NOTA
      XA ROLLBACK 'xid';
       
      # Cleanup
      DROP TABLE t;
      

      10.2 5a8766a9

      ==3621429==ERROR: AddressSanitizer: heap-use-after-free on address 0x62a0000c3360 at pc 0x7f2e615db039 bp 0x7f2e4996f110 sp 0x7f2e4996e8c0
      READ of size 19 at 0x62a0000c3360 thread T31
          #0 0x7f2e615db038 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:839
          #1 0x7f2e615db648 in __interceptor_memcmp ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:871
          #2 0x7f2e615db648 in __interceptor_memcmp ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:866
          #3 0x55ac2eb9fb6b in my_strnncoll_binary /data/src/10.2/strings/ctype-bin.c:85
          #4 0x55ac2eb7784b in l_find /data/src/10.2/mysys/lf_hash.c:136
          #5 0x55ac2eb79614 in l_search /data/src/10.2/mysys/lf_hash.c:289
          #6 0x55ac2eb79614 in lf_hash_search_using_hash_value /data/src/10.2/mysys/lf_hash.c:491
          #7 0x55ac2d5664f2 in xid_cache_search(THD*, xid_t*) /data/src/10.2/sql/sql_class.cc:5562
          #8 0x55ac2d944b14 in trans_xa_rollback(THD*) /data/src/10.2/sql/transaction.cc:1001
          #9 0x55ac2d616ee5 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:5902
          #10 0x55ac2d621d87 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793
          #11 0x55ac2d6281ce in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
          #12 0x55ac2d62c06d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
          #13 0x55ac2d9dd9f0 in threadpool_process_request /data/src/10.2/sql/threadpool_common.cc:375
          #14 0x55ac2d9dd9f0 in tp_callback(TP_connection*) /data/src/10.2/sql/threadpool_common.cc:191
          #15 0x55ac2dafd0ad in worker_main /data/src/10.2/sql/threadpool_generic.cc:1612
          #16 0x55ac2eaa0144 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
          #17 0x7f2e61082ea6 in start_thread nptl/pthread_create.c:477
          #18 0x7f2e60c87dee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfddee)
       
      0x62a0000c3360 is located 12640 bytes inside of 21872-byte region [0x62a0000c0200,0x62a0000c5770)
      freed by thread T33 here:
          #0 0x7f2e615f9b6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123
          #1 0x55ac2d9dd666 in threadpool_remove_connection /data/src/10.2/sql/threadpool_common.cc:301
          #2 0x55ac2d9ddd68 in tp_callback(TP_connection*) /data/src/10.2/sql/threadpool_common.cc:215
          #3 0x55ac2dafd0ad in worker_main /data/src/10.2/sql/threadpool_generic.cc:1612
          #4 0x55ac2eaa0144 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
          #5 0x7f2e61082ea6 in start_thread nptl/pthread_create.c:477
       
      previously allocated by thread T32 here:
          #0 0x7f2e615f9e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
          #1 0x55ac2eb58702 in my_malloc /data/src/10.2/mysys/my_malloc.c:101
          #2 0x55ac2d90e8ee in ilink::operator new(unsigned long) /data/src/10.2/sql/sql_list.h:664
          #3 0x55ac2d90e8ee in CONNECT::create_thd(THD*) /data/src/10.2/sql/sql_connect.cc:1440
          #4 0x55ac2d9ddeec in threadpool_add_connection /data/src/10.2/sql/threadpool_common.cc:233
          #5 0x55ac2d9ddeec in tp_callback(TP_connection*) /data/src/10.2/sql/threadpool_common.cc:183
          #6 0x55ac2dafd0ad in worker_main /data/src/10.2/sql/threadpool_generic.cc:1612
          #7 0x55ac2eaa0144 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
          #8 0x7f2e61082ea6 in start_thread nptl/pthread_create.c:477
       
      Thread T31 created by T30 here:
          #0 0x7f2e615a52a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
          #1 0x55ac2eaa53ca in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
          #2 0x55ac2daf6c5a in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
          #3 0x55ac2daf6c5a in create_worker /data/src/10.2/sql/threadpool_generic.cc:955
          #4 0x55ac2dafd91f in wait_begin(thread_group_t*) /data/src/10.2/sql/threadpool_generic.cc:1351
          #5 0x55ac2ec07d5d in vio_io_wait /data/src/10.2/vio/viosocket.c:940
          #6 0x55ac2ec0814a in vio_socket_io_wait /data/src/10.2/vio/viosocket.c:108
          #7 0x55ac2ec08489 in vio_read /data/src/10.2/vio/viosocket.c:184
          #8 0x55ac2d4334d3 in my_real_read /data/src/10.2/sql/net_serv.cc:905
          #9 0x55ac2d436306 in my_net_read_packet_reallen /data/src/10.2/sql/net_serv.cc:1175
          #10 0x55ac2d43678f in my_net_read_packet /data/src/10.2/sql/net_serv.cc:1159
          #11 0x55ac2d4e3987 in server_mpvio_read_packet /data/src/10.2/sql/sql_acl.cc:13064
          #12 0x55ac2d4b909e in native_password_authenticate /data/src/10.2/sql/sql_acl.cc:13687
          #13 0x55ac2d4b57a1 in do_auth_once /data/src/10.2/sql/sql_acl.cc:13240
          #14 0x55ac2d4fe641 in acl_authenticate(THD*, unsigned int) /data/src/10.2/sql/sql_acl.cc:13338
          #15 0x55ac2d908bce in check_connection /data/src/10.2/sql/sql_connect.cc:1004
          #16 0x55ac2d90c50f in login_connection(THD*) /data/src/10.2/sql/sql_connect.cc:1073
          #17 0x55ac2d90e3b6 in thd_prepare_connection(THD*) /data/src/10.2/sql/sql_connect.cc:1249
          #18 0x55ac2d9de325 in threadpool_add_connection /data/src/10.2/sql/threadpool_common.cc:273
          #19 0x55ac2d9de325 in tp_callback(TP_connection*) /data/src/10.2/sql/threadpool_common.cc:183
          #20 0x55ac2dafd0ad in worker_main /data/src/10.2/sql/threadpool_generic.cc:1612
          #21 0x55ac2eaa0144 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
          #22 0x7f2e61082ea6 in start_thread nptl/pthread_create.c:477
       
      Thread T30 created by T0 here:
          #0 0x7f2e615a52a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
          #1 0x55ac2eaa53ca in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
          #2 0x55ac2daf6c5a in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
          #3 0x55ac2daf6c5a in create_worker /data/src/10.2/sql/threadpool_generic.cc:955
          #4 0x55ac2daf8157 in queue_put /data/src/10.2/sql/threadpool_generic.cc:1189
          #5 0x55ac2daf8157 in TP_pool_generic::add(TP_connection*) /data/src/10.2/sql/threadpool_generic.cc:1394
          #6 0x55ac2d42e24c in create_new_thread /data/src/10.2/sql/mysqld.cc:6645
          #7 0x55ac2d42e24c in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6903
          #8 0x55ac2d43077f in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6194
          #9 0x7f2e60bb0d09 in __libc_start_main ../csu/libc-start.c:308
       
      Thread T33 created by T32 here:
          #0 0x7f2e615a52a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
          #1 0x55ac2eaa53ca in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
          #2 0x55ac2daf6c5a in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
          #3 0x55ac2daf6c5a in create_worker /data/src/10.2/sql/threadpool_generic.cc:955
          #4 0x55ac2dafd91f in wait_begin(thread_group_t*) /data/src/10.2/sql/threadpool_generic.cc:1351
          #5 0x55ac2ec07d5d in vio_io_wait /data/src/10.2/vio/viosocket.c:940
          #6 0x55ac2ec0814a in vio_socket_io_wait /data/src/10.2/vio/viosocket.c:108
          #7 0x55ac2ec08489 in vio_read /data/src/10.2/vio/viosocket.c:184
          #8 0x55ac2d4334d3 in my_real_read /data/src/10.2/sql/net_serv.cc:905
          #9 0x55ac2d436306 in my_net_read_packet_reallen /data/src/10.2/sql/net_serv.cc:1175
          #10 0x55ac2d43678f in my_net_read_packet /data/src/10.2/sql/net_serv.cc:1159
          #11 0x55ac2d4e3987 in server_mpvio_read_packet /data/src/10.2/sql/sql_acl.cc:13064
          #12 0x55ac2d4b909e in native_password_authenticate /data/src/10.2/sql/sql_acl.cc:13687
          #13 0x55ac2d4b57a1 in do_auth_once /data/src/10.2/sql/sql_acl.cc:13240
          #14 0x55ac2d4fe641 in acl_authenticate(THD*, unsigned int) /data/src/10.2/sql/sql_acl.cc:13338
          #15 0x55ac2d908bce in check_connection /data/src/10.2/sql/sql_connect.cc:1004
          #16 0x55ac2d90c50f in login_connection(THD*) /data/src/10.2/sql/sql_connect.cc:1073
          #17 0x55ac2d90e3b6 in thd_prepare_connection(THD*) /data/src/10.2/sql/sql_connect.cc:1249
          #18 0x55ac2d9de325 in threadpool_add_connection /data/src/10.2/sql/threadpool_common.cc:273
          #19 0x55ac2d9de325 in tp_callback(TP_connection*) /data/src/10.2/sql/threadpool_common.cc:183
          #20 0x55ac2dafd0ad in worker_main /data/src/10.2/sql/threadpool_generic.cc:1612
          #21 0x55ac2eaa0144 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
          #22 0x7f2e61082ea6 in start_thread nptl/pthread_create.c:477
       
      Thread T32 created by T0 here:
          #0 0x7f2e615a52a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
          #1 0x55ac2eaa53ca in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
          #2 0x55ac2daf6c5a in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
          #3 0x55ac2daf6c5a in create_worker /data/src/10.2/sql/threadpool_generic.cc:955
          #4 0x55ac2daf8157 in queue_put /data/src/10.2/sql/threadpool_generic.cc:1189
          #5 0x55ac2daf8157 in TP_pool_generic::add(TP_connection*) /data/src/10.2/sql/threadpool_generic.cc:1394
          #6 0x55ac2d42e24c in create_new_thread /data/src/10.2/sql/mysqld.cc:6645
          #7 0x55ac2d42e24c in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6903
          #8 0x55ac2d43077f in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6194
          #9 0x7f2e60bb0d09 in __libc_start_main ../csu/libc-start.c:308
       
      SUMMARY: AddressSanitizer: heap-use-after-free ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:839 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)
      Shadow bytes around the buggy address:
        0x0c5480010610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c5480010620: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c5480010630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c5480010640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c5480010650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c5480010660: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
        0x0c5480010670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c5480010680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c5480010690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c54800106a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c54800106b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      ==3621429==ABORTING
      

      Reproducible on 10.2, 10.3.
      Could not reproduce on 10.4-10.8.

        Attachments

          Activity

            People

            Assignee:
            Unassigned Unassigned
            Reporter:
            elenst Elena Stepanova
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Dates

              Created:
              Updated:

                Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.