[MDEV-32421] Heap-Use-Sfter-Free at /mariadb-11.3.0/sql/sql_base.cc:881 - Jira

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 11.3.0, 10.4(EOL), 10.5, 10.6, 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL), 11.2(EOL)
Fix Version/s: 10.5, 10.6, 10.11, 11.4
Component/s: Server
Labels:
None
Environment:
Ubuntu 20.04

Description

Run these queries in debug build:

CREATE TABLE x ( x INT ) ;
INSERT INTO x ( x ) VALUES ( 1 ) ;
UPDATE x SET x = 1 WHERE CASE WHEN 1 THEN 1 WHEN 'x' THEN 'x' WHEN 1 THEN 'x' ELSE x = ( SELECT x FROM x WHERE x IN ( SELECT x WHERE x = x OR ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 EXCEPT SELECT x % ( WITH x ( x ) AS ( SELECT 1 EXCEPT SELECT x + 1 FROM x ORDER BY x , x DESC , x , x = ( SELECT x WHERE ( SELECT x AS x WHERE 1 > x ) LIKE - ( SELECT 1 AS x ) ) IS NOT NULL , ( x = 1 AND x = 1 ) DESC ) SELECT 1 FROM x WHERE x != 'x' ) FROM x WHERE x LIKE ( x BETWEEN 1 AND 1 ) GROUP BY x HAVING x > 'x' ) SELECT x ORDER BY 1 ) OR x = 1 ) ) ) END ;

Will trigger heap-use-after-free.
ASAN info:
=================================================================
==92204==ERROR: AddressSanitizer: heap-use-after-free on address 0x61f000016cc8 at pc 0x0000009b7615 bp 0x7fffd1c14160 sp 0x7fffd1c14158
READ of size 8 at 0x61f000016cc8 thread T16
#0 0x9b7614 in close_thread_tables(THD*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:881:20
#1 0xb31c59 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:5815:3
#2 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#3 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#4 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#5 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#6 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#7 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#8 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#9 0x7ffff770f132 in clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x61f000016cc8 is located 72 bytes inside of 3136-byte region [0x61f000016c80,0x61f0000178c0)
freed by thread T16 here:
#0 0x7ca37d in free (/usr/local/mysql/bin/mariadbd+0x7ca37d)
#1 0x22909f4 in root_free /home/wx/mariadb-11.3.0/mysys/my_alloc.c:83:5
#2 0x22909f4 in free_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:509:7
#3 0xc3da3d in free_tmp_table(THD*, TABLE*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:22713:3
#4 0x9b7233 in close_thread_tables(THD*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:882:7
#5 0xb31c59 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:5815:3
#6 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#7 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#8 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#9 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#10 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#11 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#12 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8

previously allocated by thread T16 here:
#0 0x7ca5fd in malloc (/usr/local/mysql/bin/mariadbd+0x7ca5fd)
#1 0x22a6308 in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89:29
#2 0x228fff9 in root_alloc /home/wx/mariadb-11.3.0/mysys/my_alloc.c:71:10
#3 0x228fff9 in alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:339:29
#4 0x229068a in multi_alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:412:24
#5 0xc8ae29 in Create_tmp_table::start(THD*, TMP_TABLE_PARAM*, st_mysql_const_lex_string const*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21053:8
#6 0xc36773 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21919:22
#7 0xde6e5c in select_unit::create_result_table(THD*, List<Item>, bool, unsigned long long, st_mysql_const_lex_string const, bool, bool, bool, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_union.cc:354:17
#8 0xa53691 in mysql_derived_prepare(THD*, LEX*, TABLE_LIST*) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:876:32
#9 0xa57cc1 in mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:200:15
#10 0xe7cf8c in TABLE_LIST::handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/table.cc:9651:9
#11 0xab86cb in LEX::handle_list_of_derived(TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_lex.h:4579:43
#12 0xab86cb in st_select_lex::handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4989:15
#13 0xbf2a77 in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:1439:19
#14 0x15d5c2f in subselect_single_select_engine::prepare(THD*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3943:13
#15 0x15b1a8d in Item_subselect::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:296:22
#16 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#17 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#18 0x9d3358 in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#19 0x9d3358 in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1156:12
#20 0x9d3358 in setup_fields(THD*, Bounds_checked_array<Item*>, List<Item>&, enum_column_usage, List<Item>, List<Item>, bool) /home/wx/mariadb-11.3.0/sql/sql_base.cc:8061:15
#21 0xbf311b in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:1526:7
#22 0xdec229 in st_select_lex_unit::prepare_join(THD*, st_select_lex*, select_result*, unsigned long long, bool) /home/wx/mariadb-11.3.0/sql/sql_union.cc:1103:22
#23 0xde1742 in st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_union.cc:1659:14
#24 0xa52e37 in mysql_derived_prepare(THD*, LEX*, TABLE_LIST*) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:840:19
#25 0xa57cc1 in mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:200:15
#26 0xe7cf8c in TABLE_LIST::handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/table.cc:9651:9
#27 0xab86cb in LEX::handle_list_of_derived(TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_lex.h:4579:43
#28 0xab86cb in st_select_lex::handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4989:15
#29 0xa52ab0 in mysql_derived_prepare(THD*, LEX*, TABLE_LIST*) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:794:21
#30 0xa578e4 in mysql_handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:123:7
#31 0xe1e19e in Multiupdate_prelocking_strategy::handle_end(THD*) /home/wx/mariadb-11.3.0/sql/sql_update.cc:1549:7
#32 0x9c648f in open_tables(THD*, DDL_options_st const&, TABLE_LIST*, unsigned int, unsigned int, Prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:4747:38
#33 0x9cbaf7 in open_tables(THD*, TABLE_LIST*, unsigned int, unsigned int, Prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.h:267:10
#34 0x9cbaf7 in open_tables_for_query(THD*, TABLE_LIST*, unsigned int*, unsigned int, DML_prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:5746:7
#35 0xcc3b6a in Sql_cmd_dml::prepare(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33256:7
#36 0xcc3eba in Sql_cmd_dml::execute(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33318:9

Thread T16 created by T0 here:
#0 0x7b502a in pthread_create (/usr/local/mysql/bin/mariadbd+0x7b502a)
#1 0x1a00edd in my_thread_create(unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52:10
#2 0x1a00edd in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252:15
#3 0x80e649 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139:11
#4 0x80e649 in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150:19
#5 0x80f608 in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212:3
#6 0x80f608 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274:5
#7 0x80caa8 in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398:9
#8 0x8051de in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045:3
#9 0x7ffff7614082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/sql/sql_base.cc:881:20 in close_thread_tables(THD*)
Shadow bytes around the buggy address:
0x0c3e7fffad40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e7fffad50: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
0x0c3e7fffad60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3e7fffad70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3e7fffad80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c3e7fffad90: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd
0x0c3e7fffada0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e7fffadb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e7fffadc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e7fffadd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e7fffade0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==92204==ABORTING

Heap-Use-Sfter-Free at /mariadb-11.3.0/sql/sql_base.cc:881

Details

Description

Attachments

Activity

People

Dates

Git Integration