Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-30957

AddressSanitizer: use-after-poison in Item_change_list::rollback_item_tree_changes #2

    XMLWordPrintable

Details

    • Bug
    • Status: Confirmed (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL), 11.2(EOL), 11.3(EOL), 11.4
    • 10.5, 10.6, 10.11, 11.4
    • Prepared Statements

    Description

      A patch for MDEV-17869 is already in the trees. It fixed the failure on the test case described there, but not this one.

      CREATE TABLE t1 (a INT);
      INSERT INTO t1 VALUES (1),(2);
      CREATE TABLE t2 (b INT, c INT, d CHAR(3)) ENGINE=MyISAM;
       
      EXECUTE IMMEDIATE "SELECT * FROM t1 LEFT JOIN t2 ON (t2.c = t1.a) HAVING t2.d = 'h' AND t1.a = 10 OR t2.b < 8";
       
      # Cleanup
      DROP TABLE t1, t2;
      

      10.4 ff3d4395

      ==2851481==ERROR: AddressSanitizer: use-after-poison on address 0x62b000066308 at pc 0x559d50052199 bp 0x7fad6d540340 sp 0x7fad6d540338
      WRITE of size 8 at 0x62b000066308 thread T5
          #0 0x559d50052198 in Item_change_list::rollback_item_tree_changes() /data/src/10.4/sql/sql_class.cc:3001
          #1 0x559d501d350a in Prepared_statement::cleanup_stmt() /data/src/10.4/sql/sql_prepare.cc:4103
          #2 0x559d501dae1b in Prepared_statement::execute(String*, bool) /data/src/10.4/sql/sql_prepare.cc:5052
          #3 0x559d501d60bc in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.4/sql/sql_prepare.cc:4493
          #4 0x559d501dbb42 in Prepared_statement::execute_immediate(char const*, unsigned int) /data/src/10.4/sql/sql_prepare.cc:5148
          #5 0x559d501ccf62 in mysql_sql_stmt_execute_immediate(THD*) /data/src/10.4/sql/sql_prepare.cc:3012
          #6 0x559d5016c659 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3972
          #7 0x559d50188103 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7986
          #8 0x559d5015e7c8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857
          #9 0x559d5015b350 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378
          #10 0x559d5055067f in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420
          #11 0x559d5054ff96 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
          #12 0x559d511a0089 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
          #13 0x7fad752a7fd3 in start_thread nptl/pthread_create.c:442
          #14 0x7fad7532866b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
       
      0x62b000066308 is located 16648 bytes inside of 24608-byte region [0x62b000062200,0x62b000068220)
      allocated by thread T5 here:
          #0 0x7fad758b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
          #1 0x559d51ce4b97 in my_malloc /data/src/10.4/mysys/my_malloc.c:101
          #2 0x559d51cc0d33 in reset_root_defaults /data/src/10.4/mysys/my_alloc.c:152
          #3 0x559d50045afc in THD::init_for_queries() /data/src/10.4/sql/sql_class.cc:1383
          #4 0x559d5054f8b2 in prepare_new_connection_state(THD*) /data/src/10.4/sql/sql_connect.cc:1254
          #5 0x559d5054ffdc in thd_prepare_connection(THD*) /data/src/10.4/sql/sql_connect.cc:1339
          #6 0x559d505505de in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1410
          #7 0x559d5054ff96 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
          #8 0x559d511a0089 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
          #9 0x7fad752a7fd3 in start_thread nptl/pthread_create.c:442
       
      Thread T5 created by T0 here:
          #0 0x7fad75849726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
          #1 0x559d511a0476 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919
          #2 0x559d4fe69ef8 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1275
          #3 0x559d4fe81572 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6284
          #4 0x559d4fe81cbd in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6354
          #5 0x559d4fe8218b in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6452
          #6 0x559d4fe83037 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6610
          #7 0x559d4fe80cd5 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5942
          #8 0x559d4fe68088 in main /data/src/10.4/sql/main.cc:25
          #9 0x7fad75246189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
       
      SUMMARY: AddressSanitizer: use-after-poison /data/src/10.4/sql/sql_class.cc:3001 in Item_change_list::rollback_item_tree_changes()
      Shadow bytes around the buggy address:
        0x0c5680004c10: f7 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c5680004c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c5680004c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c5680004c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c5680004c50: 00 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 f7
      =>0x0c5680004c60: f7[f7]f7 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c5680004c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c5680004c80: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00
        0x0c5680004c90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 00
        0x0c5680004ca0: 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00
        0x0c5680004cb0: 00 00 00 00 00 00 00 00 00 00 00 00 f7 f7 f7 f7
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==2851481==ABORTING
      

      Attachments

        Issue Links

          Activity

            People

              shulga Dmitry Shulga
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.