Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-29434

ASAN: use-after-poison and heap-use-after-free in ha_discover_table on dummy INSERT query and removing general_log table

    XMLWordPrintable

    Details

      Description

      SET GLOBAL general_log=ON;
      DROP DATABASE mysql;
      SET GLOBAL log_output='TABLE';
      INSERT INTO dummy;
      

      Leads to:

      10.11.0 fe1f8f2c6b6f3b8e3383168225f9ae7853028947 (Debug)

      ==3867994==ERROR: AddressSanitizer: use-after-poison on address 0x6290000d7769 at pc 0x55b9e26662f3 bp 0x15104b162e90 sp 0x15104b162e80
      

      10.11.0 fe1f8f2c6b6f3b8e3383168225f9ae7853028947 (Debug)

      2022-09-01 16:38:18 0 [Note] /test/UBASAN_MD010922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld: ready for connections.
      Version: '10.11.0-MariaDB-debug'  socket: '/test/UBASAN_MD010922-mariadb-10.11.0-linux-x86_64-dbg/socket.sock'  port: 12676  MariaDB Server
      2022-09-01 16:38:20 4 [ERROR] Failed to write to mysql.general_log: Table 'mysql.general_log' doesn't exist
      =================================================================
      ==3867994==ERROR: AddressSanitizer: use-after-poison on address 0x6290000d7769 at pc 0x55b9e26662f3 bp 0x15104b162e90 sp 0x15104b162e80
      READ of size 1 at 0x6290000d7769 thread T13
          #0 0x55b9e26662f2 in ha_discover_table(THD*, TABLE_SHARE*) /test/10.11_dbg_san/sql/handler.cc:6133
          #1 0x55b9e17528ff in open_table_def(THD*, TABLE_SHARE*, unsigned int) /test/10.11_dbg_san/sql/table.cc:650
          #2 0x55b9e201d314 in tdc_acquire_share(THD*, TABLE_LIST*, unsigned int, TABLE**) /test/10.11_dbg_san/sql/table_cache.cc:836
          #3 0x55b9e09a3c99 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/10.11_dbg_san/sql/sql_base.cc:2028
          #4 0x55b9e09b221e in open_ltable(THD*, TABLE_LIST*, thr_lock_type, unsigned int) /test/10.11_dbg_san/sql/sql_base.cc:5468
          #5 0x55b9e09f85a8 in open_log_table(THD*, TABLE_LIST*, Open_tables_backup*) /test/10.11_dbg_san/sql/sql_base.cc:9556
          #6 0x55b9e348de91 in Log_to_csv_event_handler::log_general(THD*, my_hrtime_t, char const*, unsigned long, unsigned long long, char const*, unsigned long, char const*, unsigned long, charset_info_st const*) /test/10.11_dbg_san/sql/log.cc:862
          #7 0x55b9e349e08e in LOGGER::general_log_write(THD*, enum_server_command, char const*, unsigned long) /test/10.11_dbg_san/sql/log.cc:1510
          #8 0x55b9e349e3ec in LOGGER::general_log_print(THD*, enum_server_command, char const*, __va_list_tag*) /test/10.11_dbg_san/sql/log.cc:1535
          #9 0x55b9e349e662 in general_log_print(THD*, enum_server_command, char const*, ...) /test/10.11_dbg_san/sql/log.cc:7032
          #10 0x55b9e0e45c52 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_dbg_san/sql/sql_parse.cc:2115
          #11 0x55b9e0e51a70 in do_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1407
          #12 0x55b9e18c2b41 in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1418
          #13 0x55b9e18c532c in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1312
          #14 0x15106e08e608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
          #15 0x15106d303132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
       
      0x6290000d7769 is located 1385 bytes inside of 16516-byte region [0x6290000d7200,0x6290000db284)
      allocated by thread T13 here:
          #0 0x55b9e0463258 in malloc (/test/UBASAN_MD010922-mariadb-10.11.0-linux-x86_64-dbg/bin/mariadbd+0x7ee2258)
          #1 0x55b9e5077ad5 in sf_malloc /test/10.11_dbg_san/mysys/safemalloc.c:126
          #2 0x55b9e5045102 in my_malloc /test/10.11_dbg_san/mysys/my_malloc.c:90
          #3 0x55b9e502306d in root_alloc /test/10.11_dbg_san/mysys/my_alloc.c:66
          #4 0x55b9e5023aa4 in reset_root_defaults /test/10.11_dbg_san/mysys/my_alloc.c:243
          #5 0x55b9e0a590bd in THD::init_for_queries() /test/10.11_dbg_san/sql/sql_class.cc:1385
          #6 0x55b9e18be231 in prepare_new_connection_state(THD*) /test/10.11_dbg_san/sql/sql_connect.cc:1240
          #7 0x55b9e18bfd1d in thd_prepare_connection(THD*) /test/10.11_dbg_san/sql/sql_connect.cc:1333
          #8 0x55b9e18c3862 in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1408
          #9 0x55b9e18c532c in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1312
          #10 0x15106e08e608 in start_thread /build/glibc-SzIz7B/glibc-2.31/np
       
      Thread T13 created by T0 here:
          #0 0x55b9e0390295 in __interceptor_pthread_create (/test/UBASAN_MD010922-mariadb-10.11.0-linux-x86_64-dbg/bin/mariadbd+0x7e0f295)
          #1 0x55b9e04b79d3 in create_thread_to_handle_connection(CONNECT*) /test/10.11_dbg_san/sql/mysqld.cc:6018
          #2 0x55b9e04c9d12 in create_new_thread(CONNECT*) /test/10.11_dbg_san/sql/mysqld.cc:6077
          #3 0x55b9e04ca660 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/10.11_dbg_san/sql/mysqld.cc:6139
          #4 0x55b9e04cbaef in handle_connections_sockets() /test/10.11_dbg_san/sql/mysqld.cc:6263
          #5 0x55b9e04d0463 in mysqld_main(int, char**) /test/10.11_dbg_san/sql/mysqld.cc:5913
          #6 0x55b9e04a481a in main /test/10.11_dbg_san/sql/main.cc:34
          #7 0x15106d208082 in __libc_start_main ../csu/libc-start.c:308
       
      SUMMARY: AddressSanitizer: use-after-poison /test/10.11_dbg_san/sql/handler.cc:6133 in ha_discover_table(THD*, TABLE_SHARE*)
      Shadow bytes around the buggy address:
        0x0c5280012e90: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c5280012ea0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c5280012eb0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c5280012ec0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c5280012ed0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
      =>0x0c5280012ee0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7[f7]f7 f7
        0x0c5280012ef0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c5280012f00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c5280012f10: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c5280012f20: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c5280012f30: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      ==3867994==ABORTING
      

      Setup:

      Compiled with GCC >=7.5.0 (I use GCC 9.4.0) and:
          -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
      Set before execution:
          export ASAN_OPTIONS=quarantine_size_mb=512:atexit=1:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1
      

      Bug confirmed present in:
      MariaDB: 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.5.18 (opt), 10.6.10 (dbg), 10.6.10 (opt), 10.7.6 (dbg), 10.7.6 (opt), 10.8.5 (dbg), 10.8.5 (opt), 10.9.2 (opt), 10.9.2 (dbg), 10.10.2 (dbg), 10.10.2 (opt), 10.11.0 (dbg), 10.11.0 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.3.37 (dbg), 10.3.37 (opt)

        Attachments

          Activity

            People

            Assignee:
            sanja Oleksandr Byelkin
            Reporter:
            Roel Roel Van de Paar
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:

                Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.