[MDEV-29520] ASAN heap-use-after-poison in row_merge_spatial_rows() - Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.3(EOL), 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL)
Fix Version/s: 10.3.37, 10.4.27, 10.5.18, 10.6.11, 10.7.7, 10.8.6, 10.9.4, 10.10.2
Component/s: GIS, Storage Engine - InnoDB
Labels:
None

Description

There are two open bugs with similar stack traces, MDEV-27224 and MDEV-27223, but those are about virtual columns / unique blobs. This one isn't, and 10.3 is affected as well.

--source include/have_innodb.inc

CREATE TABLE t (a VARCHAR(8192), b POINT NOT NULL, PRIMARY KEY(a(8)), SPATIAL(b)) ENGINE=InnoDB;

INSERT INTO t VALUES (REPEAT('MariaDB Corporation Ab ',351),POINT(0,0));

ALTER TABLE t FORCE;

# Cleanup

DROP TABLE t;

10.3 43745b7e
==4075358==ERROR: AddressSanitizer: use-after-poison on address 0x6310000a09b0 at pc 0x00000071bc17 bp 0x7fef59f4d4b0 sp 0x7fef59f4cc78
READ of size 8 at 0x6310000a09b0 thread T27
#0 0x71bc16 in __asan_memcpy (/mnt8t/bld/10.3-asan-nightly/bin/mysqld+0x71bc16)
#1 0x20a2211 in void rec_convert_dtuple_to_rec_comp<false>(unsigned char, dict_index_t const, dfield_t const*, unsigned long, rec_comp_status_t, bool) /data/src/10.3/storage/innobase/rem/rem0rec.cc:1597:4
#2 0x209a2ea in rec_convert_dtuple_to_rec_new(unsigned char, dict_index_t const, dtuple_t const*) /data/src/10.3/storage/innobase/rem/rem0rec.cc:1633:2
#3 0x2099d7b in rec_convert_dtuple_to_rec(unsigned char, dict_index_t const, dtuple_t const*, unsigned long) /data/src/10.3/storage/innobase/rem/rem0rec.cc:1662:9
#4 0x248c0a7 in page_cur_tuple_insert(page_cur_t, dtuple_t const, dict_index_t, unsigned short, mem_block_info_t, unsigned long, mtr_t) /data/src/10.3/storage/innobase/include/page0cur.inl:277:8
#5 0x2488aa1 in btr_cur_optimistic_insert(unsigned long, btr_cur_t, unsigned short, mem_block_info_t, dtuple_t, unsigned char, big_rec_t, unsigned long, que_thr_t, mtr_t) /data/src/10.3/storage/innobase/btr/btr0cur.cc:3473:10
#6 0x21673b8 in index_tuple_info_t::insert(unsigned long, mem_block_info_t, btr_pcur_t, mtr_t*) /data/src/10.3/storage/innobase/row/row0merge.cc:186:12
#7 0x2155ab6 in row_merge_spatial_rows(unsigned long, index_tuple_info_t*, unsigned long, mem_block_info_t, mem_block_info_t, btr_pcur_t, mtr_t*) /data/src/10.3/storage/innobase/row/row0merge.cc:1595:23
#8 0x2140474 in row_merge_read_clustered_index(trx_t, TABLE, dict_table_t const, dict_table_t, bool, dict_index_t*, dict_index_t, fts_psort_t, merge_file_t, unsigned long const, unsigned long, dtuple_t const, dict_add_v_col_t const, unsigned long const, unsigned long, ib_sequence_t&, unsigned char, bool, pfs_os_file_t, ut_stage_alter_t, double, unsigned char, TABLE*, bool) /data/src/10.3/storage/innobase/row/row0merge.cc:1952:10
#9 0x213a5c2 in row_merge_build_indexes(trx_t, dict_table_t, dict_table_t, bool, dict_index_t, unsigned long const, unsigned long, TABLE, dtuple_t const, unsigned long const, unsigned long, ib_sequence_t&, bool, ut_stage_alter_t, dict_add_v_col_t const, TABLE, bool) /data/src/10.3/storage/innobase/row/row0merge.cc:4735:10
#10 0x1dfab6e in ha_innobase::inplace_alter_table(TABLE, Alter_inplace_info) /data/src/10.3/storage/innobase/handler/handler0alter.cc:7209:10
#11 0xeb40e0 in handler::ha_inplace_alter_table(TABLE, Alter_inplace_info) /data/src/10.3/sql/handler.h:4147:11
#12 0xe96a38 in mysql_inplace_alter_table(THD, TABLE_LIST, TABLE, TABLE, Alter_inplace_info, MDL_request, Alter_table_ctx*) /data/src/10.3/sql/sql_table.cc:7773:21
#13 0xe83bf4 in mysql_alter_table(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, HA_CREATE_INFO, TABLE_LIST, Alter_info, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:10111:16
#14 0x109a120 in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:512:11
#15 0xb6aed0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6076:26
#16 0xb43016 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7871:18
#17 0xb33b9c in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
#18 0xb3ce9c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
#19 0x10830e6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
#20 0x10827b3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
#21 0x2e99251 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
#22 0x7fef706e8ea6 in start_thread nptl/pthread_create.c:477:8
#23 0x7fef705f3dee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x6310000a09b0 is located 432 bytes inside of 65664-byte region [0x6310000a0800,0x6310000b0880)
allocated by thread T27 here:
#0 0x71c7bd in malloc (/mnt8t/bld/10.3-asan-nightly/bin/mysqld+0x71c7bd)
#1 0x1f9c6e0 in mem_heap_create_block_func(mem_block_info_t, unsigned long, char const, unsigned int, unsigned long) /data/src/10.3/storage/innobase/mem/mem0mem.cc:277:37
#2 0x2126ca1 in mem_heap_create_func(unsigned long, char const*, unsigned int, unsigned long) /data/src/10.3/storage/innobase/include/mem0mem.inl:375:10
#3 0x213fe56 in row_merge_read_clustered_index(trx_t, TABLE, dict_table_t const, dict_table_t, bool, dict_index_t*, dict_index_t, fts_psort_t, merge_file_t, unsigned long const, unsigned long, dtuple_t const, dict_add_v_col_t const, unsigned long const, unsigned long, ib_sequence_t&, unsigned char, bool, pfs_os_file_t, ut_stage_alter_t, double, unsigned char, TABLE*, bool) /data/src/10.3/storage/innobase/row/row0merge.cc:1892:13
#4 0x213a5c2 in row_merge_build_indexes(trx_t, dict_table_t, dict_table_t, bool, dict_index_t, unsigned long const, unsigned long, TABLE, dtuple_t const, unsigned long const, unsigned long, ib_sequence_t&, bool, ut_stage_alter_t, dict_add_v_col_t const, TABLE, bool) /data/src/10.3/storage/innobase/row/row0merge.cc:4735:10
#5 0x1dfab6e in ha_innobase::inplace_alter_table(TABLE, Alter_inplace_info) /data/src/10.3/storage/innobase/handler/handler0alter.cc:7209:10
#6 0xeb40e0 in handler::ha_inplace_alter_table(TABLE, Alter_inplace_info) /data/src/10.3/sql/handler.h:4147:11
#7 0xe96a38 in mysql_inplace_alter_table(THD, TABLE_LIST, TABLE, TABLE, Alter_inplace_info, MDL_request, Alter_table_ctx*) /data/src/10.3/sql/sql_table.cc:7773:21
#8 0xe83bf4 in mysql_alter_table(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, HA_CREATE_INFO, TABLE_LIST, Alter_info, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:10111:16
#9 0x109a120 in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:512:11
#10 0xb6aed0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6076:26
#11 0xb43016 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7871:18
#12 0xb33b9c in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
#13 0xb3ce9c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
#14 0x10830e6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
#15 0x10827b3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
#16 0x2e99251 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
#17 0x7fef706e8ea6 in start_thread nptl/pthread_create.c:477:8

Thread T27 created by T0 here:
#0 0x7071ea in pthread_create (/mnt8t/bld/10.3-asan-nightly/bin/mysqld+0x7071ea)
#1 0x2e9f4f9 in spawn_thread_v1(unsigned int, unsigned long, pthread_attr_t const, void* ()(void), void*) /data/src/10.3/storage/perfschema/pfs.cc:1919:15
#2 0x757a1a in inline_mysql_thread_create(unsigned int, unsigned long, pthread_attr_t const, void* ()(void), void*) /data/src/10.3/include/mysql/psi/mysql_thread.h:1275:11
#3 0x769453 in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6668:15
#4 0x76ac4a in create_new_thread(CONNECT*) /data/src/10.3/sql/mysqld.cc:6738:3
#5 0x7689cd in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6996:9
#6 0x75b3de in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6290:3
#7 0x74ed61 in main /data/src/10.3/sql/main.cc:25:10
#8 0x7fef7051cd09 in __libc_start_main csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: use-after-poison (/mnt8t/bld/10.3-asan-nightly/bin/mysqld+0x71bc16) in __asan_memcpy
Shadow bytes around the buggy address:
0x0c628000c0e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c628000c0f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c628000c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c628000c110: f7 00 00 00 00 00 07 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c628000c120: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x0c628000c130: f7 f7 f7 f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c628000c140: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c628000c150: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c628000c160: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c628000c170: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c628000c180: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==4075358==ABORTING

Attachments

Issue Links

relates to

MDEV-29856 ASAN heap-use-after-poison in row_merge_spatial_rows() with PRIMARY KEY on column prefix

Closed

MDEV-27223 ASAN heap-use-after-free in my_strnncollsp_simple upon LOAD DATA with virtual unique blob

Confirmed

MDEV-27224 ASAN heap-use-after-free in rec_convert_dtuple_to_rec_comp upon LOAD DATA with foreign keys and STORED unique blobs

Open

Activity

People

Assignee:: Marko Mäkelä

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2022-09-12 18:34

Updated:: 2022-10-22 21:24

Resolved:: 2022-09-13 06:57

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.