Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-30305

Error 2000 and server crash or ASAN errors in Protocol::valid_handler / Protocol_text::store_long

    XMLWordPrintable

Details

    • Bug
    • Status: Confirmed (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.3(EOL), 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11
    • 10.5, 10.6, 10.11, 11.4
    • Protocol, Stored routines
    • None

    Description

      --delimiter $
      		 
      CREATE FUNCTION f() RETURNS INT
      		 
      BEGIN
      		 
        SHOW TRIGGERS;
      		 
        RETURN 0;
      		 
      END $
      		 
      --delimiter ;
      		 
      SELECT f();
      		 
       
      		 
      # Cleanup
      		 
      DROP FUNCTION f;

      10.4 f97f6955

      		 
      ==536487==ERROR: AddressSanitizer: heap-use-after-free on address 0x6250001175e0 at pc 0x55eb5dad7ef2 bp 0x7f4f88a83b10 sp 0x7f4f88a83b08
      		 
      READ of size 8 at 0x6250001175e0 thread T5
      		 
          #0 0x55eb5dad7ef1 in Protocol::valid_handler(unsigned int, protocol_send_type_t) const (/mnt8t/bld/10.4-nightly/bin/mysqld+0x1012ef1)
      		 
          #1 0x55eb5dad13ea in Protocol_text::store_long(long long) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/protocol.cc:1203
      		 
          #2 0x55eb5e2e3799 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_type.cc:7108
      		 
          #3 0x55eb5e2fc729 in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const (/mnt8t/bld/10.4-nightly/bin/mysqld+0x1837729)
      		 
          #4 0x55eb5dadd869 in Item::send(Protocol*, st_value*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/item.h:1044
      		 
          #5 0x55eb5dacfe3f in Protocol::send_result_set_row(List<Item>*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/protocol.cc:1038
      		 
          #6 0x55eb5dc737b2 in select_send::send_data(List<Item>&) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_class.cc:3114
      		 
          #7 0x55eb5de56d46 in JOIN::exec_inner() /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_select.cc:4442
      		 
          #8 0x55eb5de55948 in JOIN::exec() /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_select.cc:4356
      		 
          #9 0x55eb5de5999d in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_select.cc:4795
      		 
          #10 0x55eb5de2add3 in handle_select(THD*, LEX*, select_result*, unsigned long) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_select.cc:437
      		 
          #11 0x55eb5dd9d052 in execute_sqlcom_select /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:6452
      		 
          #12 0x55eb5dd8aa22 in mysql_execute_command(THD*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:3966
      		 
          #13 0x55eb5dda605b in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:7984
      		 
          #14 0x55eb5dd7cfc4 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:1857
      		 
          #15 0x55eb5dd79b63 in do_command(THD*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:1378
      		 
          #16 0x55eb5e16851f in do_handle_one_connection(CONNECT*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_connect.cc:1420
      		 
          #17 0x55eb5e167e05 in handle_one_connection /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_connect.cc:1324
      		 
          #18 0x55eb5eda448a in pfs_spawn_thread /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/perfschema/pfs.cc:1869
      		 
          #19 0x7f4f9295bea6 in start_thread nptl/pthread_create.c:477
      		 
          #20 0x7f4f92548aee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfcaee)
      		 
       
      		 
      0x6250001175e0 is located 7392 bytes inside of 8160-byte region [0x625000115900,0x6250001178e0)
      		 
      freed by thread T5 here:
      		 
          #0 0x7f4f92f2eb6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123
      		 
          #1 0x55eb5f8ba314 in my_free /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/mysys/my_malloc.c:222
      		 
          #2 0x55eb5f89769e in free_root /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/mysys/my_alloc.c:430
      		 
          #3 0x55eb5db423db in sp_head::execute(THD*, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sp_head.cc:1447
      		 
          #4 0x55eb5db45efc in sp_head::execute_function(THD*, Item**, unsigned int, Field*, sp_rcontext**, Query_arena*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sp_head.cc:2088
      		 
          #5 0x55eb5e568685 in Item_sp::execute_impl(THD*, Item**, unsigned int) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/item.cc:2838
      		 
          #6 0x55eb5e567c36 in Item_sp::execute(THD*, bool*, Item**, unsigned int) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/item.cc:2753
      		 
          #7 0x55eb5e694330 in Item_func_sp::execute() /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/item_func.cc:6492
      		 
          #8 0x55eb5e6a3eab in Item_func_sp::val_int() /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/item_func.h:3281
      		 
          #9 0x55eb5e2e36ef in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_type.cc:7106
      		 
          #10 0x55eb5e2fc729 in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const (/mnt8t/bld/10.4-nightly/bin/mysqld+0x1837729)
      		 
          #11 0x55eb5dadd869 in Item::send(Protocol*, st_value*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/item.h:1044
      		 
          #12 0x55eb5dacfe3f in Protocol::send_result_set_row(List<Item>*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/protocol.cc:1038
      		 
          #13 0x55eb5dc737b2 in select_send::send_data(List<Item>&) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_class.cc:3114
      		 
          #14 0x55eb5de56d46 in JOIN::exec_inner() /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_select.cc:4442
      		 
          #15 0x55eb5de55948 in JOIN::exec() /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_select.cc:4356
      		 
          #16 0x55eb5de5999d in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_select.cc:4795
      		 
          #17 0x55eb5de2add3 in handle_select(THD*, LEX*, select_result*, unsigned long) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_select.cc:437
      		 
          #18 0x55eb5dd9d052 in execute_sqlcom_select /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:6452
      		 
          #19 0x55eb5dd8aa22 in mysql_execute_command(THD*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:3966
      		 
          #20 0x55eb5dda605b in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:7984
      		 
          #21 0x55eb5dd7cfc4 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:1857
      		 
          #22 0x55eb5dd79b63 in do_command(THD*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:1378
      		 
          #23 0x55eb5e16851f in do_handle_one_connection(CONNECT*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_connect.cc:1420
      		 
          #24 0x55eb5e167e05 in handle_one_connection /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_connect.cc:1324
      		 
          #25 0x55eb5eda448a in pfs_spawn_thread /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/perfschema/pfs.cc:1869
      		 
          #26 0x7f4f9295bea6 in start_thread nptl/pthread_create.c:477
      		 
       
      		 
      previously allocated by thread T5 here:
      		 
          #0 0x7f4f92f2ee8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
      		 
          #1 0x55eb5f8b97a8 in my_malloc /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/mysys/my_malloc.c:101
      		 
          #2 0x55eb5f896516 in alloc_root /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/mysys/my_alloc.c:251
      		 
          #3 0x55eb5df0afd3 in Sql_alloc::operator new[](unsigned long, st_mem_root*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_alloc.h:37
      		 
          #4 0x55eb5deb7ce8 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_select.cc:18629
      		 
          #5 0x55eb5df7f9b3 in create_schema_table(THD*, TABLE_LIST*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_show.cc:8435
      		 
          #6 0x55eb5df826bc in mysql_schema_table(THD*, LEX*, TABLE_LIST*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_show.cc:8667
      		 
          #7 0x55eb5dc038c5 in open_and_process_table /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_base.cc:3789
      		 
          #8 0x55eb5dc070c6 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_base.cc:4390
      		 
          #9 0x55eb5dc0c0dc in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_base.cc:5337
      		 
          #10 0x55eb5db68998 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_base.h:503
      		 
          #11 0x55eb5dd9c5f0 in execute_sqlcom_select /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:6373
      		 
          #12 0x55eb5dd8aa22 in mysql_execute_command(THD*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_parse.cc:3966
      		 
          #13 0x55eb5db50b77 in sp_instr_stmt::exec_core(THD*, unsigned int*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sp_head.cc:3694
      		 
          #14 0x55eb5db4f295 in sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sp_head.cc:3424
      		 
          #15 0x55eb5db50300 in sp_instr_stmt::execute(THD*, unsigned int*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sp_head.cc:3600
      		 
          #16 0x55eb5db41d15 in sp_head::execute(THD*, bool) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sp_head.cc:1365
      		 
          #17 0x55eb5db45efc in sp_head::execute_function(THD*, Item**, unsigned int, Field*, sp_rcontext**, Query_arena*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sp_head.cc:2088
      		 
          #18 0x55eb5e568685 in Item_sp::execute_impl(THD*, Item**, unsigned int) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/item.cc:2838
      		 
          #19 0x55eb5e567c36 in Item_sp::execute(THD*, bool*, Item**, unsigned int) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/item.cc:2753
      		 
          #20 0x55eb5e694330 in Item_func_sp::execute() /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/item_func.cc:6492
      		 
          #21 0x55eb5e6a3eab in Item_func_sp::val_int() /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/item_func.h:3281
      		 
          #22 0x55eb5e2e36ef in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_type.cc:7106
      		 
          #23 0x55eb5e2fc729 in Type_handler_long::Item_send(Item*, Protocol*, st_value*) const (/mnt8t/bld/10.4-nightly/bin/mysqld+0x1837729)
      		 
          #24 0x55eb5dadd869 in Item::send(Protocol*, st_value*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/item.h:1044
      		 
          #25 0x55eb5dacfe3f in Protocol::send_result_set_row(List<Item>*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/protocol.cc:1038
      		 
          #26 0x55eb5dc737b2 in select_send::send_data(List<Item>&) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_class.cc:3114
      		 
          #27 0x55eb5de56d46 in JOIN::exec_inner() /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_select.cc:4442
      		 
          #28 0x55eb5de55948 in JOIN::exec() /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_select.cc:4356
      		 
          #29 0x55eb5de5999d in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/sql_select.cc:4795
      		 
       
      		 
      Thread T5 created by T0 here:
      		 
          #0 0x7f4f92eda2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
      		 
          #1 0x55eb5eda4877 in spawn_thread_v1 /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/storage/perfschema/pfs.cc:1919
      		 
          #2 0x55eb5da8e527 in inline_mysql_thread_create /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/include/mysql/psi/mysql_thread.h:1275
      		 
          #3 0x55eb5daa5b10 in create_thread_to_handle_connection(CONNECT*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/mysqld.cc:6294
      		 
          #4 0x55eb5daa6270 in create_new_thread(CONNECT*) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/mysqld.cc:6364
      		 
          #5 0x55eb5daa6725 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/mysqld.cc:6462
      		 
          #6 0x55eb5daa75bc in handle_connections_sockets() /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/mysqld.cc:6620
      		 
          #7 0x55eb5daa5261 in mysqld_main(int, char**) /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/mysqld.cc:5952
      		 
          #8 0x55eb5da8c794 in main /home/jenkins/workspace/sandbox-elenst/Nightly-Build-CS/src/sql/main.cc:25
      		 
          #9 0x7f4f9246fd09 in __libc_start_main ../csu/libc-start.c:308
      		 
       
      		 
      SUMMARY: AddressSanitizer: heap-use-after-free (/mnt8t/bld/10.4-nightly/bin/mysqld+0x1012ef1) in Protocol::valid_handler(unsigned int, protocol_send_type_t) const
      		 
      Shadow bytes around the buggy address:
      		 
        0x0c4a8001ae60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c4a8001ae70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c4a8001ae80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c4a8001ae90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c4a8001aea0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
      =>0x0c4a8001aeb0: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
      		 
        0x0c4a8001aec0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c4a8001aed0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c4a8001aee0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c4a8001aef0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
        0x0c4a8001af00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      		 
      Shadow byte legend (one shadow byte represents 8 application bytes):
      		 
        Addressable:           00
      		 
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
      		 
        Freed heap region:       fd
      		 
        Stack left redzone:      f1
      		 
        Stack mid redzone:       f2
      		 
        Stack right redzone:     f3
      		 
        Stack after return:      f5
      		 
        Stack use after scope:   f8
      		 
        Global redzone:          f9
      		 
        Global init order:       f6
      		 
        Poisoned by user:        f7
      		 
        Container overflow:      fc
      		 
        Array cookie:            ac
      		 
        Intra object redzone:    bb
      		 
        ASan internal:           fe
      		 
        Left alloca redzone:     ca
      		 
        Right alloca redzone:    cb
      		 
        Shadow gap:              cc

      Reproducible on all existing versions, more reliably with ASAN, although SIGSEGV with a similar stack trace occurs as well.
      On 10.3 there is no Protocol::valid_handler frame.

      When it doesn't crash, SELECT produces error 2000:

      mysqltest: At line 8: query 'SELECT f()' failed: 2000: Unknown MySQL error

      Attachments

        Activity

          People

            shulga Dmitry Shulga
            elenst Elena Stepanova
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.