[MDEV-32373] ASAN errors in ha_connect::GetStringOption upon information schema query - Jira

XML

Word

Printable

Details

Type: Bug
Status: Open (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.4(EOL), 10.5, 10.6, 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL), 11.2
Fix Version/s: 10.5, 10.6, 10.11, 11.2
Component/s: Storage Engine - Connect
Labels:
None

Description

--source include/have_innodb.inc

--source include/have_partition.inc

INSTALL SONAME 'ha_connect';

CREATE TABLE t (a INT) ENGINE=InnoDB PARTITION BY HASH (a);

CREATE TABLE t_tbl (a INT) engine=Connect table_type=TBL table_list='t';

SELECT * from INFORMATION_SCHEMA.PARTITIONS;

# Cleanup

DROP TABLE t_tbl, t;

UNINSTALL SONAME 'ha_connect';

10.4 9b5275b8
==1008700==ERROR: AddressSanitizer: use-after-poison on address 0x6190000dd6c8 at pc 0x7f8e5c104b87 bp 0x7f8e5c842ab0 sp 0x7f8e5c842aa8
READ of size 8 at 0x6190000dd6c8 thread T27
#0 0x7f8e5c104b86 in GetStringTableOption(_global, ha_table_option_struct, char const, char const) /data/src/10.4/storage/connect/ha_connect.cc:1291
#1 0x7f8e5c106020 in ha_connect::GetStringOption(char const, char const) /data/src/10.4/storage/connect/ha_connect.cc:1445
#2 0x7f8e5c1ede59 in RELDEF::GetStringCatInfo(_global, char const, char const*) /data/src/10.4/storage/connect/reldef.cpp:267
#3 0x7f8e5c1ee754 in TABDEF::Define(_global, CATALOG, char const, char const, char const*) /data/src/10.4/storage/connect/reldef.cpp:362
#4 0x7f8e5c140503 in MYCAT::MakeTableDesc(_global, XTAB, char const*) /data/src/10.4/storage/connect/mycat.cc:527
#5 0x7f8e5c13fe89 in MYCAT::GetTableDesc(_global, XTAB, char const, RELDEF*) /data/src/10.4/storage/connect/mycat.cc:431
#6 0x7f8e5c140971 in MYCAT::GetTable(_global, XTAB, MODE, char const*) /data/src/10.4/storage/connect/mycat.cc:549
#7 0x7f8e5c2782fb in TDBPRX::GetSubTable(_global, XTAB, bool) /data/src/10.4/storage/connect/tabutil.cpp:440
#8 0x7f8e5c2720f0 in TDBTBL::InitTableList(_global*) /data/src/10.4/storage/connect/tabtbl.cpp:256
#9 0x7f8e5c272af6 in TDBTBL::Cardinality(_global*) /data/src/10.4/storage/connect/tabtbl.cpp:360
#10 0x7f8e5c1393b0 in CntInfo(_global, TDB, _xinfo*) /data/src/10.4/storage/connect/connect.cc:172
#11 0x7f8e5c11cb70 in ha_connect::info(unsigned int) /data/src/10.4/storage/connect/ha_connect.cc:4402
#12 0x55b231606d0b in handler::get_dynamic_partition_info(PARTITION_STATS*, unsigned int) /data/src/10.4/sql/handler.cc:5032
#13 0x55b23102ffaa in store_schema_partitions_record /data/src/10.4/sql/sql_show.cc:7456
#14 0x55b231035a29 in get_schema_partitions_record /data/src/10.4/sql/sql_show.cc:7797
#15 0x55b23100bfbf in fill_schema_table_by_open /data/src/10.4/sql/sql_show.cc:4737
#16 0x55b23100ff3b in get_all_tables(THD, TABLE_LIST, Item*) /data/src/10.4/sql/sql_show.cc:5389
#17 0x55b231045ce2 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.4/sql/sql_show.cc:9102
#18 0x55b230f11f1d in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4562
#19 0x55b230f0fde5 in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4387
#20 0x55b230f13e77 in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.4/sql/sql_select.cc:4826
#21 0x55b230ee49f8 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:442
#22 0x55b230e53f20 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6475
#23 0x55b230e41435 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3978
#24 0x55b230e5d170 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012
#25 0x55b230e333ff in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857
#26 0x55b230e2ff6e in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378
#27 0x55b23122f875 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420
#28 0x55b23122f18c in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
#29 0x55b231ea098f in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
#30 0x7f8e714a7fd3 in start_thread nptl/pthread_create.c:442
#31 0x7f8e715285bb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x6190000dd6c8 is located 584 bytes inside of 992-byte region [0x6190000dd480,0x6190000dd860)
allocated by thread T27 here:
#0 0x7f8e71ab89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x55b2329ea452 in my_malloc /data/src/10.4/mysys/my_malloc.c:101
#2 0x55b2329c6e78 in alloc_root /data/src/10.4/mysys/my_alloc.c:258
#3 0x55b2329c8649 in memdup_root /data/src/10.4/mysys/my_alloc.c:501
#4 0x55b2311482ae in TABLE_SHARE::init_from_binary_frm_image(THD, bool, unsigned char const, unsigned long) /data/src/10.4/sql/table.cc:1662
#5 0x55b2311408b2 in open_table_def(THD, TABLE_SHARE, unsigned int) /data/src/10.4/sql/table.cc:704
#6 0x7f8e5c274d35 in GetTableShare(_global, THD, char const, char const, bool&) /data/src/10.4/storage/connect/tabutil.cpp:98
#7 0x7f8e5c277efe in TDBPRX::GetSubTable(_global, XTAB, bool) /data/src/10.4/storage/connect/tabutil.cpp:421
#8 0x7f8e5c2720f0 in TDBTBL::InitTableList(_global*) /data/src/10.4/storage/connect/tabtbl.cpp:256
#9 0x7f8e5c272af6 in TDBTBL::Cardinality(_global*) /data/src/10.4/storage/connect/tabtbl.cpp:360
#10 0x7f8e5c1393b0 in CntInfo(_global, TDB, _xinfo*) /data/src/10.4/storage/connect/connect.cc:172
#11 0x7f8e5c11cb70 in ha_connect::info(unsigned int) /data/src/10.4/storage/connect/ha_connect.cc:4402
#12 0x55b231606d0b in handler::get_dynamic_partition_info(PARTITION_STATS*, unsigned int) /data/src/10.4/sql/handler.cc:5032
#13 0x55b23102ffaa in store_schema_partitions_record /data/src/10.4/sql/sql_show.cc:7456
#14 0x55b231035a29 in get_schema_partitions_record /data/src/10.4/sql/sql_show.cc:7797
#15 0x55b23100bfbf in fill_schema_table_by_open /data/src/10.4/sql/sql_show.cc:4737
#16 0x55b23100ff3b in get_all_tables(THD, TABLE_LIST, Item*) /data/src/10.4/sql/sql_show.cc:5389
#17 0x55b231045ce2 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.4/sql/sql_show.cc:9102
#18 0x55b230f11f1d in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4562
#19 0x55b230f0fde5 in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4387
#20 0x55b230f13e77 in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.4/sql/sql_select.cc:4826
#21 0x55b230ee49f8 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:442
#22 0x55b230e53f20 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6475
#23 0x55b230e41435 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3978
#24 0x55b230e5d170 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012
#25 0x55b230e333ff in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857
#26 0x55b230e2ff6e in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378
#27 0x55b23122f875 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420
#28 0x55b23122f18c in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
#29 0x55b231ea098f in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869

Thread T27 created by T0 here:
#0 0x7f8e71a49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
#1 0x55b231ea0d7c in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919
#2 0x55b230b3af89 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1275
#3 0x55b230b526b6 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6289
#4 0x55b230b52e01 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6359
#5 0x55b230b532cf in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6457
#6 0x55b230b5417b in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6615
#7 0x55b230b51e19 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5947
#8 0x55b230b390b8 in main /data/src/10.4/sql/main.cc:25
#9 0x7f8e71446189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: use-after-poison /data/src/10.4/storage/connect/ha_connect.cc:1291 in GetStringTableOption(_global, ha_table_option_struct, char const, char const)
Shadow bytes around the buggy address:
0x0c3280013a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3280013a90: 00 00 00 00 f7 00 00 f7 01 f7 02 f7 00 00 00 01
0x0c3280013aa0: f7 05 f7 01 f7 00 00 00 00 00 00 00 00 00 00 f7
0x0c3280013ab0: 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3280013ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 00
=>0x0c3280013ad0: 00 00 00 f7 04 f7 f7 f7 f7[f7]f7 f7 f7 f7 f7 f7
0x0c3280013ae0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c3280013af0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c3280013b00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 fa fa fa fa
0x0c3280013b10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3280013b20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1008700==ABORTING

Attachments

Activity

People

Assignee:: Andrew Hutchings

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2023-10-07 22:43

Updated:: 2024-09-10 15:27

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.