[MDEV-30957] AddressSanitizer: use-after-poison in Item_change_list::rollback_item_tree_changes #2 - Jira

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL), 11.2(EOL), 11.3(EOL), 11.4
Fix Version/s: 10.5, 10.6, 10.11, 11.4
Component/s: Prepared Statements
Labels:
- ASAN

Description

A patch for ~~MDEV-17869~~ is already in the trees. It fixed the failure on the test case described there, but not this one.

CREATE TABLE t1 (a INT);

INSERT INTO t1 VALUES (1),(2);

CREATE TABLE t2 (b INT, c INT, d CHAR(3)) ENGINE=MyISAM;

EXECUTE IMMEDIATE "SELECT * FROM t1 LEFT JOIN t2 ON (t2.c = t1.a) HAVING t2.d = 'h' AND t1.a = 10 OR t2.b < 8";

# Cleanup

DROP TABLE t1, t2;

10.4 ff3d4395
==2851481==ERROR: AddressSanitizer: use-after-poison on address 0x62b000066308 at pc 0x559d50052199 bp 0x7fad6d540340 sp 0x7fad6d540338
WRITE of size 8 at 0x62b000066308 thread T5
#0 0x559d50052198 in Item_change_list::rollback_item_tree_changes() /data/src/10.4/sql/sql_class.cc:3001
#1 0x559d501d350a in Prepared_statement::cleanup_stmt() /data/src/10.4/sql/sql_prepare.cc:4103
#2 0x559d501dae1b in Prepared_statement::execute(String*, bool) /data/src/10.4/sql/sql_prepare.cc:5052
#3 0x559d501d60bc in Prepared_statement::execute_loop(String, bool, unsigned char, unsigned char*) /data/src/10.4/sql/sql_prepare.cc:4493
#4 0x559d501dbb42 in Prepared_statement::execute_immediate(char const*, unsigned int) /data/src/10.4/sql/sql_prepare.cc:5148
#5 0x559d501ccf62 in mysql_sql_stmt_execute_immediate(THD*) /data/src/10.4/sql/sql_prepare.cc:3012
#6 0x559d5016c659 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3972
#7 0x559d50188103 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7986
#8 0x559d5015e7c8 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857
#9 0x559d5015b350 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378
#10 0x559d5055067f in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420
#11 0x559d5054ff96 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
#12 0x559d511a0089 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
#13 0x7fad752a7fd3 in start_thread nptl/pthread_create.c:442
#14 0x7fad7532866b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x62b000066308 is located 16648 bytes inside of 24608-byte region [0x62b000062200,0x62b000068220)
allocated by thread T5 here:
#0 0x7fad758b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x559d51ce4b97 in my_malloc /data/src/10.4/mysys/my_malloc.c:101
#2 0x559d51cc0d33 in reset_root_defaults /data/src/10.4/mysys/my_alloc.c:152
#3 0x559d50045afc in THD::init_for_queries() /data/src/10.4/sql/sql_class.cc:1383
#4 0x559d5054f8b2 in prepare_new_connection_state(THD*) /data/src/10.4/sql/sql_connect.cc:1254
#5 0x559d5054ffdc in thd_prepare_connection(THD*) /data/src/10.4/sql/sql_connect.cc:1339
#6 0x559d505505de in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1410
#7 0x559d5054ff96 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
#8 0x559d511a0089 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
#9 0x7fad752a7fd3 in start_thread nptl/pthread_create.c:442

Thread T5 created by T0 here:
#0 0x7fad75849726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
#1 0x559d511a0476 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919
#2 0x559d4fe69ef8 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1275
#3 0x559d4fe81572 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6284
#4 0x559d4fe81cbd in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6354
#5 0x559d4fe8218b in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6452
#6 0x559d4fe83037 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6610
#7 0x559d4fe80cd5 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5942
#8 0x559d4fe68088 in main /data/src/10.4/sql/main.cc:25
#9 0x7fad75246189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: use-after-poison /data/src/10.4/sql/sql_class.cc:3001 in Item_change_list::rollback_item_tree_changes()
Shadow bytes around the buggy address:
0x0c5680004c10: f7 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00
0x0c5680004c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c5680004c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c5680004c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c5680004c50: 00 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 f7
=>0x0c5680004c60: f7[f7]f7 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c5680004c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c5680004c80: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00
0x0c5680004c90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 00
0x0c5680004ca0: 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00
0x0c5680004cb0: 00 00 00 00 00 00 00 00 00 00 00 00 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2851481==ABORTING

Attachments

Issue Links

relates to

MDEV-17869 AddressSanitizer: use-after-poison in Item_change_list::rollback_item_tree_changes

Closed

Activity

Alice Sherepa added a comment - 2023-09-27 14:34 - edited

also with prepare+execute, not only execute immediate, also with sp
if t1 is InnoDB table - then - not reproducible.

CREATE TABLE t1 ( c int) engine=myisam;

INSERT INTO t1 values (1);

CREATE TABLE t2 ( i int);

INSERT INTO t2 values (1),(2),(3),(4);

prepare stmt from "SELECT * FROM t1,t2 HAVING t1.c = 'p' AND t2.i >= 9 OR t1.c < 'l' ;";

execute stmt;

drop table t1,t2;

Version: '11.2.2-MariaDB-debug-log'

=================================================================

==4009886==ERROR: AddressSanitizer: use-after-poison on address 0x6290001095d0 at pc 0x556d62469c56 bp 0x7f1b4ffbd4f0 sp 0x7f1b4ffbd4e0

WRITE of size 8 at 0x6290001095d0 thread T24

    #0 0x556d62469c55 in Item_change_list::rollback_item_tree_changes() /11.2/src/sql/sql_class.cc:3025

    #1 0x556d6265401c in Prepared_statement::cleanup_stmt(bool) /11.2/src/sql/sql_prepare.cc:4016

    #2 0x556d6265c83f in Prepared_statement::execute(String*, bool) /11.2/src/sql/sql_prepare.cc:5059

    #3 0x556d62657282 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /11.2/src/sql/sql_prepare.cc:4433

    #4 0x556d62650449 in mysql_sql_stmt_execute(THD*) /11.2/src/sql/sql_prepare.cc:3470

    #5 0x556d625acc97 in mysql_execute_command(THD*, bool) /11.2/src/sql/sql_parse.cc:3971

    #6 0x556d625c6e7e in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.2/src/sql/sql_parse.cc:7810

    #7 0x556d6259f225 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.2/src/sql/sql_parse.cc:1893

    #8 0x556d6259bf6f in do_command(THD*, bool) /11.2/src/sql/sql_parse.cc:1406

    #9 0x556d62a7abb0 in do_handle_one_connection(CONNECT*, bool) /11.2/src/sql/sql_connect.cc:1445

    #10 0x556d62a7a50d in handle_one_connection /11.2/src/sql/sql_connect.cc:1347

    #11 0x556d636e88ef in pfs_spawn_thread /11.2/src/storage/perfschema/pfs.cc:2201

    #12 0x7f1b65975608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477

    #13 0x7f1b65546132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

0x6290001095d0 is located 976 bytes inside of 16516-byte region [0x629000109200,0x62900010d284)

allocated by thread T24 here:

    #0 0x7f1b65f02808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144

    #1 0x556d64329bab in sf_malloc /11.2/src/mysys/safemalloc.c:126

    #2 0x556d642f6dfc in my_malloc /11.2/src/mysys/my_malloc.c:89

    #3 0x556d642d17ad in root_alloc /11.2/src/mysys/my_alloc.c:71

    #4 0x556d642d27cb in reset_root_defaults /11.2/src/mysys/my_alloc.c:250

    #5 0x556d6245ce22 in THD::init_for_queries() /11.2/src/sql/sql_class.cc:1391

    #6 0x556d62a79dc0 in prepare_new_connection_state(THD*) /11.2/src/sql/sql_connect.cc:1274

    #7 0x556d62a7a58c in thd_prepare_connection(THD*) /11.2/src/sql/sql_connect.cc:1368

    #8 0x556d62a7aad6 in do_handle_one_connection(CONNECT*, bool) /11.2/src/sql/sql_connect.cc:1435

    #9 0x556d62a7a50d in handle_one_connection /11.2/src/sql/sql_connect.cc:1347

    #10 0x556d636e88ef in pfs_spawn_thread /11.2/src/storage/perfschema/pfs.cc:2201

    #11 0x7f1b65975608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477

Thread T24 created by T0 here:

    #0 0x7f1b65e2f815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208

    #1 0x556d636e44cc in my_thread_create /11.2/src/storage/perfschema/my_thread.h:52

    #2 0x556d636e8ce2 in pfs_spawn_thread_v1 /11.2/src/storage/perfschema/pfs.cc:2252

    #3 0x556d621dc019 in inline_mysql_thread_create /11.2/src/include/mysql/psi/mysql_thread.h:1139

    #4 0x556d621f4aa5 in create_thread_to_handle_connection(CONNECT*) /11.2/src/sql/mysqld.cc:6169

    #5 0x556d621f5135 in create_new_thread(CONNECT*) /11.2/src/sql/mysqld.cc:6231

    #6 0x556d621f54a2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /11.2/src/sql/mysqld.cc:6293

    #7 0x556d621f5e98 in handle_connections_sockets() /11.2/src/sql/mysqld.cc:6417

    #8 0x556d621f42b2 in mysqld_main(int, char**) /11.2/src/sql/mysqld.cc:6064

    #9 0x556d621db0cc in main /11.2/src/sql/main.cc:34

    #10 0x7f1b6544b082 in __libc_start_main ../csu/libc-start.c:308

=================================================================

==608676==ERROR: AddressSanitizer: use-after-poison on address 0x6250001b98c0 at pc 0x559394d27600 bp 0x7ff31133cdd0 sp 0x7ff31133cdc0

WRITE of size 8 at 0x6250001b98c0 thread T12

    #0 0x559394d275ff in Item_change_list::rollback_item_tree_changes() /11.3/src/sql/sql_class.cc:3087

    #1 0x5593955396a2 in sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*, bool) /11.3/src/sql/sp_instr.cc:350

    #2 0x55939553a473 in sp_lex_keeper::validate_lex_and_exec_core(THD*, unsigned int*, bool, sp_lex_instr*) /11.3/src/sql/sp_instr.cc:475

    #3 0x55939553cad0 in sp_instr_stmt::execute(THD*, unsigned int*) /11.3/src/sql/sp_instr.cc:862

    #4 0x559394bf7c47 in sp_head::execute(THD*, bool) /11.3/src/sql/sp_head.cc:1284

    #5 0x559394bfdeac in sp_head::execute_procedure(THD*, List<Item>*) /11.3/src/sql/sp_head.cc:2300

    #6 0x559394e6a137 in do_execute_sp /11.3/src/sql/sql_parse.cc:3050

    #7 0x559394e6bdcd in Sql_cmd_call::execute(THD*) /11.3/src/sql/sql_parse.cc:3273

    #8 0x559394e7e3ea in mysql_execute_command(THD*, bool) /11.3/src/sql/sql_parse.cc:5803

    #9 0x559394e8bc78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.3/src/sql/sql_parse.cc:7815

    #10 0x559394e63052 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.3/src/sql/sql_parse.cc:1893

    #11 0x559394e5fd97 in do_command(THD*, bool) /11.3/src/sql/sql_parse.cc:1406

    #12 0x5593953442f5 in do_handle_one_connection(CONNECT*, bool) /11.3/src/sql/sql_connect.cc:1437

    #13 0x559395343c52 in handle_one_connection /11.3/src/sql/sql_connect.cc:1339

    #14 0x559395fb754f in pfs_spawn_thread /11.3/src/storage/perfschema/pfs.cc:2201

    #15 0x7ff3222e9608 in start_thread /build/glibc-wuryBv/glibc-2.31/nptl/pthread_create.c:477

    #16 0x7ff321eba352 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f352)

0x6250001b98c0 is located 6080 bytes inside of 8324-byte region [0x6250001b8100,0x6250001ba184)

allocated by thread T12 here:

    #0 0x7ff322877808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144

    #1 0x559396c009ff in sf_malloc /11.3/src/mysys/safemalloc.c:126

    #2 0x559396bcddf1 in my_malloc /11.3/src/mysys/my_malloc.c:93

    #3 0x559396ba880a in root_alloc /11.3/src/mysys/my_alloc.c:66

    #4 0x559396baa19d in alloc_root /11.3/src/mysys/my_alloc.c:332

    #5 0x559394e9d8cc in Query_arena::memdup_w_gap(void const*, unsigned long, unsigned long) const /11.3/src/sql/sql_class.h:1279

    #6 0x559394e68294 in alloc_query(THD*, char const*, unsigned long) /11.3/src/sql/sql_parse.cc:2741

    #7 0x55939553c9a0 in sp_instr_stmt::execute(THD*, unsigned int*) /11.3/src/sql/sp_instr.cc:849

    #8 0x559394bf7c47 in sp_head::execute(THD*, bool) /11.3/src/sql/sp_head.cc:1284

    #9 0x559394bfdeac in sp_head::execute_procedure(THD*, List<Item>*) /11.3/src/sql/sp_head.cc:2300

    #10 0x559394e6a137 in do_execute_sp /11.3/src/sql/sql_parse.cc:3050

    #11 0x559394e6bdcd in Sql_cmd_call::execute(THD*) /11.3/src/sql/sql_parse.cc:3273

    #12 0x559394e7e3ea in mysql_execute_command(THD*, bool) /11.3/src/sql/sql_parse.cc:5803

    #13 0x559394e8bc78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.3/src/sql/sql_parse.cc:7815

    #14 0x559394e63052 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.3/src/sql/sql_parse.cc:1893

    #15 0x559394e5fd97 in do_command(THD*, bool) /11.3/src/sql/sql_parse.cc:1406

    #16 0x5593953442f5 in do_handle_one_connection(CONNECT*, bool) /11.3/src/sql/sql_connect.cc:1437

    #17 0x559395343c52 in handle_one_connection /11.3/src/sql/sql_connect.cc:1339

    #18 0x559395fb754f in pfs_spawn_thread /11.3/src/storage/perfschema/pfs.cc:2201

    #19 0x7ff3222e9608 in start_thread /build/glibc-wuryBv/glibc-2.31/nptl/pthread_create.c:477

Thread T12 created by T0 here:

    #0 0x7ff3227a4815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208

    #1 0x559395fb312c in my_thread_create /11.3/src/storage/perfschema/my_thread.h:52

    #2 0x559395fb7942 in pfs_spawn_thread_v1 /11.3/src/storage/perfschema/pfs.cc:2252

    #3 0x559394a93169 in inline_mysql_thread_create /11.3/src/include/mysql/psi/mysql_thread.h:1139

    #4 0x559394aabb45 in create_thread_to_handle_connection(CONNECT*) /11.3/src/sql/mysqld.cc:6166

    #5 0x559394aac1d5 in create_new_thread(CONNECT*) /11.3/src/sql/mysqld.cc:6228

    #6 0x559394aac542 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /11.3/src/sql/mysqld.cc:6290

    #7 0x559394aacf38 in handle_connections_sockets() /11.3/src/sql/mysqld.cc:6414

    #8 0x559394aab352 in mysqld_main(int, char**) /11.3/src/sql/mysqld.cc:6061

    #9 0x559394a9221c in main /11.3/src/sql/main.cc:34

    #10 0x7ff321dbf082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: use-after-poison /11.3/src/sql/sql_class.cc:3087 in Item_change_list::rollback_item_tree_changes()

Shadow bytes around the buggy address:

  0x0c4a8002f2c0: 00 00 00 00 00 00 00 00 00 f7 00 00 f7 00 00 00

  0x0c4a8002f2d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a8002f2e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a8002f2f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a8002f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x0c4a8002f310: 00 00 00 f7 00 00 f7 f7[f7]f7 00 00 00 00 00 00

  0x0c4a8002f320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a8002f330: 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00

  0x0c4a8002f340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a8002f350: f7 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00

  0x0c4a8002f360: 00 00 00 00 00 00 00 00 00 00 00 00 f7 f7 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==608676==ABORTING

Alice Sherepa added a comment - 2023-09-27 14:34 - edited also with prepare+execute, not only execute immediate, also with sp if t1 is InnoDB table - then - not reproducible. CREATE TABLE t1 ( c int ) engine=myisam; INSERT INTO t1 values (1); CREATE TABLE t2 ( i int ); INSERT INTO t2 values (1),(2),(3),(4); prepare stmt from "SELECT * FROM t1,t2 HAVING t1.c = 'p' AND t2.i >= 9 OR t1.c < 'l' ;" ; execute stmt; drop table t1,t2; Version: '11.2.2-MariaDB-debug-log' ================================================================= ==4009886==ERROR: AddressSanitizer: use-after-poison on address 0x6290001095d0 at pc 0x556d62469c56 bp 0x7f1b4ffbd4f0 sp 0x7f1b4ffbd4e0 WRITE of size 8 at 0x6290001095d0 thread T24 #0 0x556d62469c55 in Item_change_list::rollback_item_tree_changes() /11.2/src/sql/sql_class.cc:3025 #1 0x556d6265401c in Prepared_statement::cleanup_stmt(bool) /11.2/src/sql/sql_prepare.cc:4016 #2 0x556d6265c83f in Prepared_statement::execute(String*, bool) /11.2/src/sql/sql_prepare.cc:5059 #3 0x556d62657282 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /11.2/src/sql/sql_prepare.cc:4433 #4 0x556d62650449 in mysql_sql_stmt_execute(THD*) /11.2/src/sql/sql_prepare.cc:3470 #5 0x556d625acc97 in mysql_execute_command(THD*, bool) /11.2/src/sql/sql_parse.cc:3971 #6 0x556d625c6e7e in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.2/src/sql/sql_parse.cc:7810 #7 0x556d6259f225 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.2/src/sql/sql_parse.cc:1893 #8 0x556d6259bf6f in do_command(THD*, bool) /11.2/src/sql/sql_parse.cc:1406 #9 0x556d62a7abb0 in do_handle_one_connection(CONNECT*, bool) /11.2/src/sql/sql_connect.cc:1445 #10 0x556d62a7a50d in handle_one_connection /11.2/src/sql/sql_connect.cc:1347 #11 0x556d636e88ef in pfs_spawn_thread /11.2/src/storage/perfschema/pfs.cc:2201 #12 0x7f1b65975608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477 #13 0x7f1b65546132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132) 0x6290001095d0 is located 976 bytes inside of 16516-byte region [0x629000109200,0x62900010d284) allocated by thread T24 here: #0 0x7f1b65f02808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144 #1 0x556d64329bab in sf_malloc /11.2/src/mysys/safemalloc.c:126 #2 0x556d642f6dfc in my_malloc /11.2/src/mysys/my_malloc.c:89 #3 0x556d642d17ad in root_alloc /11.2/src/mysys/my_alloc.c:71 #4 0x556d642d27cb in reset_root_defaults /11.2/src/mysys/my_alloc.c:250 #5 0x556d6245ce22 in THD::init_for_queries() /11.2/src/sql/sql_class.cc:1391 #6 0x556d62a79dc0 in prepare_new_connection_state(THD*) /11.2/src/sql/sql_connect.cc:1274 #7 0x556d62a7a58c in thd_prepare_connection(THD*) /11.2/src/sql/sql_connect.cc:1368 #8 0x556d62a7aad6 in do_handle_one_connection(CONNECT*, bool) /11.2/src/sql/sql_connect.cc:1435 #9 0x556d62a7a50d in handle_one_connection /11.2/src/sql/sql_connect.cc:1347 #10 0x556d636e88ef in pfs_spawn_thread /11.2/src/storage/perfschema/pfs.cc:2201 #11 0x7f1b65975608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477 Thread T24 created by T0 here: #0 0x7f1b65e2f815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208 #1 0x556d636e44cc in my_thread_create /11.2/src/storage/perfschema/my_thread.h:52 #2 0x556d636e8ce2 in pfs_spawn_thread_v1 /11.2/src/storage/perfschema/pfs.cc:2252 #3 0x556d621dc019 in inline_mysql_thread_create /11.2/src/include/mysql/psi/mysql_thread.h:1139 #4 0x556d621f4aa5 in create_thread_to_handle_connection(CONNECT*) /11.2/src/sql/mysqld.cc:6169 #5 0x556d621f5135 in create_new_thread(CONNECT*) /11.2/src/sql/mysqld.cc:6231 #6 0x556d621f54a2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /11.2/src/sql/mysqld.cc:6293 #7 0x556d621f5e98 in handle_connections_sockets() /11.2/src/sql/mysqld.cc:6417 #8 0x556d621f42b2 in mysqld_main(int, char**) /11.2/src/sql/mysqld.cc:6064 #9 0x556d621db0cc in main /11.2/src/sql/main.cc:34 #10 0x7f1b6544b082 in __libc_start_main ../csu/libc-start.c:308 ================================================================= ==608676==ERROR: AddressSanitizer: use-after-poison on address 0x6250001b98c0 at pc 0x559394d27600 bp 0x7ff31133cdd0 sp 0x7ff31133cdc0 WRITE of size 8 at 0x6250001b98c0 thread T12 #0 0x559394d275ff in Item_change_list::rollback_item_tree_changes() /11.3/src/sql/sql_class.cc:3087 #1 0x5593955396a2 in sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*, bool) /11.3/src/sql/sp_instr.cc:350 #2 0x55939553a473 in sp_lex_keeper::validate_lex_and_exec_core(THD*, unsigned int*, bool, sp_lex_instr*) /11.3/src/sql/sp_instr.cc:475 #3 0x55939553cad0 in sp_instr_stmt::execute(THD*, unsigned int*) /11.3/src/sql/sp_instr.cc:862 #4 0x559394bf7c47 in sp_head::execute(THD*, bool) /11.3/src/sql/sp_head.cc:1284 #5 0x559394bfdeac in sp_head::execute_procedure(THD*, List<Item>*) /11.3/src/sql/sp_head.cc:2300 #6 0x559394e6a137 in do_execute_sp /11.3/src/sql/sql_parse.cc:3050 #7 0x559394e6bdcd in Sql_cmd_call::execute(THD*) /11.3/src/sql/sql_parse.cc:3273 #8 0x559394e7e3ea in mysql_execute_command(THD*, bool) /11.3/src/sql/sql_parse.cc:5803 #9 0x559394e8bc78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.3/src/sql/sql_parse.cc:7815 #10 0x559394e63052 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.3/src/sql/sql_parse.cc:1893 #11 0x559394e5fd97 in do_command(THD*, bool) /11.3/src/sql/sql_parse.cc:1406 #12 0x5593953442f5 in do_handle_one_connection(CONNECT*, bool) /11.3/src/sql/sql_connect.cc:1437 #13 0x559395343c52 in handle_one_connection /11.3/src/sql/sql_connect.cc:1339 #14 0x559395fb754f in pfs_spawn_thread /11.3/src/storage/perfschema/pfs.cc:2201 #15 0x7ff3222e9608 in start_thread /build/glibc-wuryBv/glibc-2.31/nptl/pthread_create.c:477 #16 0x7ff321eba352 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f352) 0x6250001b98c0 is located 6080 bytes inside of 8324-byte region [0x6250001b8100,0x6250001ba184) allocated by thread T12 here: #0 0x7ff322877808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144 #1 0x559396c009ff in sf_malloc /11.3/src/mysys/safemalloc.c:126 #2 0x559396bcddf1 in my_malloc /11.3/src/mysys/my_malloc.c:93 #3 0x559396ba880a in root_alloc /11.3/src/mysys/my_alloc.c:66 #4 0x559396baa19d in alloc_root /11.3/src/mysys/my_alloc.c:332 #5 0x559394e9d8cc in Query_arena::memdup_w_gap(void const*, unsigned long, unsigned long) const /11.3/src/sql/sql_class.h:1279 #6 0x559394e68294 in alloc_query(THD*, char const*, unsigned long) /11.3/src/sql/sql_parse.cc:2741 #7 0x55939553c9a0 in sp_instr_stmt::execute(THD*, unsigned int*) /11.3/src/sql/sp_instr.cc:849 #8 0x559394bf7c47 in sp_head::execute(THD*, bool) /11.3/src/sql/sp_head.cc:1284 #9 0x559394bfdeac in sp_head::execute_procedure(THD*, List<Item>*) /11.3/src/sql/sp_head.cc:2300 #10 0x559394e6a137 in do_execute_sp /11.3/src/sql/sql_parse.cc:3050 #11 0x559394e6bdcd in Sql_cmd_call::execute(THD*) /11.3/src/sql/sql_parse.cc:3273 #12 0x559394e7e3ea in mysql_execute_command(THD*, bool) /11.3/src/sql/sql_parse.cc:5803 #13 0x559394e8bc78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.3/src/sql/sql_parse.cc:7815 #14 0x559394e63052 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.3/src/sql/sql_parse.cc:1893 #15 0x559394e5fd97 in do_command(THD*, bool) /11.3/src/sql/sql_parse.cc:1406 #16 0x5593953442f5 in do_handle_one_connection(CONNECT*, bool) /11.3/src/sql/sql_connect.cc:1437 #17 0x559395343c52 in handle_one_connection /11.3/src/sql/sql_connect.cc:1339 #18 0x559395fb754f in pfs_spawn_thread /11.3/src/storage/perfschema/pfs.cc:2201 #19 0x7ff3222e9608 in start_thread /build/glibc-wuryBv/glibc-2.31/nptl/pthread_create.c:477 Thread T12 created by T0 here: #0 0x7ff3227a4815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208 #1 0x559395fb312c in my_thread_create /11.3/src/storage/perfschema/my_thread.h:52 #2 0x559395fb7942 in pfs_spawn_thread_v1 /11.3/src/storage/perfschema/pfs.cc:2252 #3 0x559394a93169 in inline_mysql_thread_create /11.3/src/include/mysql/psi/mysql_thread.h:1139 #4 0x559394aabb45 in create_thread_to_handle_connection(CONNECT*) /11.3/src/sql/mysqld.cc:6166 #5 0x559394aac1d5 in create_new_thread(CONNECT*) /11.3/src/sql/mysqld.cc:6228 #6 0x559394aac542 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /11.3/src/sql/mysqld.cc:6290 #7 0x559394aacf38 in handle_connections_sockets() /11.3/src/sql/mysqld.cc:6414 #8 0x559394aab352 in mysqld_main(int, char**) /11.3/src/sql/mysqld.cc:6061 #9 0x559394a9221c in main /11.3/src/sql/main.cc:34 #10 0x7ff321dbf082 in __libc_start_main ../csu/libc-start.c:308 SUMMARY: AddressSanitizer: use-after-poison /11.3/src/sql/sql_class.cc:3087 in Item_change_list::rollback_item_tree_changes() Shadow bytes around the buggy address: 0x0c4a8002f2c0: 00 00 00 00 00 00 00 00 00 f7 00 00 f7 00 00 00 0x0c4a8002f2d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a8002f2e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a8002f2f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a8002f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c4a8002f310: 00 00 00 f7 00 00 f7 f7[f7]f7 00 00 00 00 00 00 0x0c4a8002f320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a8002f330: 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 0x0c4a8002f340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a8002f350: f7 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 0x0c4a8002f360: 00 00 00 00 00 00 00 00 00 00 00 00 f7 f7 f7 f7 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==608676==ABORTING

MariaDB Server

AddressSanitizer: use-after-poison in Item_change_list::rollback_item_tree_changes #2

Details

Description

Attachments

Issue Links

Activity

People

Dates

Git Integration