Server crash ASAN used-after-poison upon 2nd execution of PS with erroneous timestamp conversion

CREATE TABLE t1 (a int, b timestamp);

INSERT INTO t1 VALUES (1,'2000-01-01'),(2,'2001-12-31'); # Optional, fails either way

PREPARE stmt FROM 'UPDATE t1 SET a = 0 WHERE 1 IN (SELECT b FROM t1)';

--error ER_TRUNCATED_WRONG_VALUE

EXECUTE stmt;

--error ER_TRUNCATED_WRONG_VALUE

EXECUTE stmt;

# Cleanup

DROP TABLE t1;

#2  <signal handler called>

#3  0x000056404d484921 in st_select_lex_unit::exclude_level (this=0x7fcb0003beb8) at /data/bld/11.4-rel/sql/sql_lex.cc:3398

#4  0x000056404d622f4e in convert_subq_to_sj (subq_pred=<optimized out>, parent_join=0x7fcb00010e50) at /data/bld/11.4-rel/sql/sql_lex.h:1395

#5  convert_join_subqueries_to_semijoins (join=join@entry=0x7fcb00010e50) at /data/bld/11.4-rel/sql/opt_subselect.cc:1394

#6  0x000056404d52f56d in JOIN::optimize_inner (this=this@entry=0x7fcb00010e50) at /data/bld/11.4-rel/sql/sql_select.cc:2218

#7  0x000056404d530cca in JOIN::optimize (this=this@entry=0x7fcb00010e50) at /data/bld/11.4-rel/sql/sql_select.cc:1966

#8  0x000056404d532eaa in Sql_cmd_dml::execute_inner (this=this@entry=0x7fcb0003b070, thd=thd@entry=0x7fcb00000c68) at /data/bld/11.4-rel/sql/sql_select.cc:33637

#9  0x000056404d59b615 in Sql_cmd_update::execute_inner (this=0x7fcb0003b070, thd=0x7fcb00000c68) at /data/bld/11.4-rel/sql/sql_update.cc:3081

#10 0x000056404d4ea9fd in Sql_cmd_dml::execute (this=0x7fcb0003b070, thd=0x7fcb00000c68) at /data/bld/11.4-rel/sql/sql_select.cc:33586

#11 0x000056404d4afefd in mysql_execute_command (thd=0x7fcb00000c68, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true) at /data/bld/11.4-rel/sql/sql_parse.cc:4392

#12 0x000056404d4d6e9d in Prepared_statement::execute (this=this@entry=0x7fcb001a15d8, expanded_query=expanded_query@entry=0x7fcb12ad4c70, open_cursor=open_cursor@entry=false) at /data/bld/11.4-rel/sql/sql_prepare.cc:5076

#13 0x000056404d4d703e in Prepared_statement::execute_loop (this=this@entry=0x7fcb001a15d8, expanded_query=expanded_query@entry=0x7fcb12ad4c70, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /data/bld/11.4-rel/sql/sql_prepare.cc:4461

#14 0x000056404d4d736b in mysql_sql_stmt_execute (thd=thd@entry=0x7fcb00000c68) at /data/bld/11.4-rel/sql/sql_prepare.cc:3480

#15 0x000056404d4b1f4d in mysql_execute_command (thd=thd@entry=0x7fcb00000c68, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /data/bld/11.4-rel/sql/sql_parse.cc:3959

#16 0x000056404d4b4826 in mysql_parse (thd=0x7fcb00000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /data/bld/11.4-rel/sql/sql_parse.cc:7815

#17 0x000056404d4b7545 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7fcb00000c68, packet=packet@entry=0x7fcb000087e9 "EXECUTE stmt", packet_length=packet_length@entry=12, blocking=blocking@entry=true) at /data/bld/11.4-rel/sql/sql_parse.cc:1992

#18 0x000056404d4b8e64 in do_command (thd=0x7fcb00000c68, blocking=blocking@entry=true) at /data/bld/11.4-rel/sql/sql_parse.cc:1406

#19 0x000056404d5e2867 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x564050ed8ee8, put_in_cache=put_in_cache@entry=true) at /data/bld/11.4-rel/sql/sql_connect.cc:1437

#20 0x000056404d5e2bd5 in handle_one_connection (arg=arg@entry=0x564050ed8ee8) at /data/bld/11.4-rel/sql/sql_connect.cc:1339

#21 0x000056404d971be0 in pfs_spawn_thread (arg=0x564050e92158) at /data/bld/11.4-rel/storage/perfschema/pfs.cc:2201

#22 0x00007fcb181c9044 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#23 0x00007fcb1824961c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

==2637723==ERROR: AddressSanitizer: use-after-poison on address 0x6290000e72b8 at pc 0x5586d5a115c2 bp 0x7f2fcd80b7c0 sp 0x7f2fcd80b7b8

READ of size 8 at 0x6290000e72b8 thread T5

    #0 0x5586d5a115c1 in base_list_iterator::next() /data/bld/11.4-asan/sql/sql_list.h:431

    #1 0x5586d5a36d2a in List_iterator<TABLE_LIST>::operator++(int) /data/bld/11.4-asan/sql/sql_list.h:596

    #2 0x5586d6094040 in st_select_lex::cleanup() /data/bld/11.4-asan/sql/sql_union.cc:2881

    #3 0x5586d691d578 in subselect_single_select_engine::prepare(THD*) /data/bld/11.4-asan/sql/item_subselect.cc:3948

    #4 0x5586d68f726d in Item_subselect::fix_fields(THD*, Item**) /data/bld/11.4-asan/sql/item_subselect.cc:296

    #5 0x5586d691a7ee in Item_in_subselect::fix_fields(THD*, Item**) /data/bld/11.4-asan/sql/item_subselect.cc:3617

    #6 0x5586d5a73a36 in Item::fix_fields_if_needed(THD*, Item**) /data/bld/11.4-asan/sql/item.h:1166

    #7 0x5586d5a73a6c in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /data/bld/11.4-asan/sql/item.h:1175

    #8 0x5586d5b9f91e in Item::fix_fields_if_needed_for_bool(THD*, Item**) /data/bld/11.4-asan/sql/item.h:1179

    #9 0x5586d5b96aad in setup_conds(THD*, TABLE_LIST*, List<TABLE_LIST>&, Item**) /data/bld/11.4-asan/sql/sql_base.cc:8911

    #10 0x5586d5e181f4 in setup_without_group /data/bld/11.4-asan/sql/sql_select.cc:932

    #11 0x5586d5e20044 in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /data/bld/11.4-asan/sql/sql_select.cc:1554

    #12 0x5586d60cd3f5 in Sql_cmd_update::prepare_inner(THD*) /data/bld/11.4-asan/sql/sql_update.cc:3011

    #13 0x5586d5f10115 in Sql_cmd_dml::prepare(THD*) /data/bld/11.4-asan/sql/sql_select.cc:33501

    #14 0x5586d5f103e5 in Sql_cmd_dml::execute(THD*) /data/bld/11.4-asan/sql/sql_select.cc:33554

    #15 0x5586d5d2d30a in mysql_execute_command(THD*, bool) /data/bld/11.4-asan/sql/sql_parse.cc:4392

    #16 0x5586d5dd7d61 in Prepared_statement::execute(String*, bool) /data/bld/11.4-asan/sql/sql_prepare.cc:5076

    #17 0x5586d5dd309a in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/bld/11.4-asan/sql/sql_prepare.cc:4461

    #18 0x5586d5dcc601 in mysql_sql_stmt_execute(THD*) /data/bld/11.4-asan/sql/sql_prepare.cc:3480

    #19 0x5586d5d2a993 in mysql_execute_command(THD*, bool) /data/bld/11.4-asan/sql/sql_parse.cc:3959

    #20 0x5586d5d45498 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/11.4-asan/sql/sql_parse.cc:7815

    #21 0x5586d5d1c8ff in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/11.4-asan/sql/sql_parse.cc:1893

    #22 0x5586d5d19637 in do_command(THD*, bool) /data/bld/11.4-asan/sql/sql_parse.cc:1406

    #23 0x5586d61ee1c8 in do_handle_one_connection(CONNECT*, bool) /data/bld/11.4-asan/sql/sql_connect.cc:1437

    #24 0x5586d61edb89 in handle_one_connection /data/bld/11.4-asan/sql/sql_connect.cc:1339

    #25 0x5586d6e2c569 in pfs_spawn_thread /data/bld/11.4-asan/storage/perfschema/pfs.cc:2201

    #26 0x7f2fd76a8043 in start_thread nptl/pthread_create.c:442

    #27 0x7f2fd772861b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x6290000e72b8 is located 4280 bytes inside of 16400-byte region [0x6290000e6200,0x6290000ea210)

allocated by thread T5 here:

    #0 0x7f2fd82b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x5586d7a1d989 in my_malloc /data/bld/11.4-asan/mysys/my_malloc.c:93

    #2 0x5586d79f900c in root_alloc /data/bld/11.4-asan/mysys/my_alloc.c:66

    #3 0x5586d79fa001 in reset_root_defaults /data/bld/11.4-asan/mysys/my_alloc.c:244

    #4 0x5586d5bd9620 in THD::init_for_queries() /data/bld/11.4-asan/sql/sql_class.cc:1453

    #5 0x5586d61ed46d in prepare_new_connection_state(THD*) /data/bld/11.4-asan/sql/sql_connect.cc:1266

    #6 0x5586d61edc0a in thd_prepare_connection(THD*) /data/bld/11.4-asan/sql/sql_connect.cc:1360

    #7 0x5586d61ee122 in do_handle_one_connection(CONNECT*, bool) /data/bld/11.4-asan/sql/sql_connect.cc:1427

    #8 0x5586d61edb89 in handle_one_connection /data/bld/11.4-asan/sql/sql_connect.cc:1339

    #9 0x5586d6e2c569 in pfs_spawn_thread /data/bld/11.4-asan/storage/perfschema/pfs.cc:2201

    #10 0x7f2fd76a8043 in start_thread nptl/pthread_create.c:442

Thread T5 created by T0 here:

    #0 0x7f2fd8249726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x5586d6e282a4 in my_thread_create /data/bld/11.4-asan/storage/perfschema/my_thread.h:52

    #2 0x5586d6e2c958 in pfs_spawn_thread_v1 /data/bld/11.4-asan/storage/perfschema/pfs.cc:2252

    #3 0x5586d595e989 in inline_mysql_thread_create /data/bld/11.4-asan/include/mysql/psi/mysql_thread.h:1139

    #4 0x5586d5976307 in create_thread_to_handle_connection(CONNECT*) /data/bld/11.4-asan/sql/mysqld.cc:6074

    #5 0x5586d597692c in create_new_thread(CONNECT*) /data/bld/11.4-asan/sql/mysqld.cc:6136

    #6 0x5586d5976c17 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/11.4-asan/sql/mysqld.cc:6198

    #7 0x5586d597789f in handle_connections_sockets() /data/bld/11.4-asan/sql/mysqld.cc:6311

    #8 0x5586d5975b84 in mysqld_main(int, char**) /data/bld/11.4-asan/sql/mysqld.cc:5969

    #9 0x5586d595db38 in main /data/bld/11.4-asan/sql/main.cc:34

    #10 0x7f2fd76461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: use-after-poison /data/bld/11.4-asan/sql/sql_list.h:431 in base_list_iterator::next()

Shadow bytes around the buggy address:

  0x0c5280014e00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280014e10: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280014e20: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280014e30: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280014e40: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

=>0x0c5280014e50: f7 f7 f7 f7 f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280014e60: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280014e70: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280014e80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280014e90: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280014ea0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==2637723==ABORTING

240504 21:46:16 [ERROR] mysqld got signal 6 ;

Sorry, we probably made a mistake, and this is a bug.

Your assistance in bug reporting will enable us to fix this for the next release.

To report this bug, see https://mariadb.com/kb/en/reporting-bugs

We will try our best to scrape up some info that will hopefully help

diagnose the problem, but since we have already crashed, 

something is definitely wrong and this may fail.

Server version: 11.4.2-MariaDB-debug-log source revision: 3fa2caf5537b630cc903c1d2e1ffd6161b9767c6

key_buffer_size=1048576

read_buffer_size=131072

max_used_connections=1

max_threads=153

thread_count=1

It is possible that mysqld could use up to 

key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63966 K  bytes of memory

Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x62c0000c0218

Attempting backtrace. You can use the following information to find out

where mysqld died. If you see no messages after this, something went

terribly wrong...

stack_bottom = 0x7f2fcd80fbd0 thread_stack 0xb00000

sanitizer_common/sanitizer_common_interceptors.inc:4277(__interceptor_backtrace.part.0)[0x7f2fd8251f31]

mysys/stacktrace.c:215(my_print_stacktrace)[0x5586d7a2e8db]

sql/signal_handler.cc:238(handle_fatal_signal)[0x5586d666d0d9]

libc_sigaction.c:0(__restore_rt)[0x7f2fd765afd0]

nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7f2fd76a9d3c]

posix/raise.c:27(__GI_raise)[0x7f2fd765af32]

stdlib/abort.c:81(__GI_abort)[0x7f2fd7645472]

sanitizer_common/sanitizer_posix_libcdep.cpp:137(__sanitizer::Abort())[0x7f2fd82d650f]

sanitizer_common/sanitizer_termination.cpp:59(__sanitizer::Die())[0x7f2fd82e2ba1]

asan/asan_report.cpp:190(__asan::ScopedInErrorReport::~ScopedInErrorReport())[0x7f2fd82c1f5e]

asan/asan_report.cpp:479(__asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool))[0x7f2fd82c14c6]

asan/asan_rtl.cpp:123(__asan_report_load8)[0x7f2fd82c25ac]

sql/sql_list.h:431(base_list_iterator::next())[0x5586d5a115c2]

sql/sql_list.h:596(List_iterator<TABLE_LIST>::operator++(int))[0x5586d5a36d2b]

sql/sql_union.cc:2881(st_select_lex::cleanup())[0x5586d6094041]

sql/item_subselect.cc:3952(subselect_single_select_engine::prepare(THD*))[0x5586d691d579]

sql/item_subselect.cc:296(Item_subselect::fix_fields(THD*, Item**))[0x5586d68f726e]

sql/item_subselect.cc:3617(Item_in_subselect::fix_fields(THD*, Item**))[0x5586d691a7ef]

sql/item.h:1166(Item::fix_fields_if_needed(THD*, Item**))[0x5586d5a73a37]

sql/item.h:1175(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x5586d5a73a6d]

sql/item.h:1180(Item::fix_fields_if_needed_for_bool(THD*, Item**))[0x5586d5b9f91f]

sql/sql_base.cc:8911(setup_conds(THD*, TABLE_LIST*, List<TABLE_LIST>&, Item**))[0x5586d5b96aae]

sql/sql_select.cc:932(setup_without_group(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<TABLE_LIST>&, List<Item>&, List<Item>&, Item**, st_order*, st_order*, List<Window_spec>&, List<Item_window_func>&, bool*))[0x5586d5e181f5]

sql/sql_select.cc:1554(JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x5586d5e20045]

sql/sql_update.cc:3011(Sql_cmd_update::prepare_inner(THD*))[0x5586d60cd3f6]

sql/sql_select.cc:33501(Sql_cmd_dml::prepare(THD*))[0x5586d5f10116]

sql/sql_select.cc:33554(Sql_cmd_dml::execute(THD*))[0x5586d5f103e6]

sql/sql_parse.cc:4392(mysql_execute_command(THD*, bool))[0x5586d5d2d30b]

sql/sql_prepare.cc:5076(Prepared_statement::execute(String*, bool))[0x5586d5dd7d62]

sql/sql_prepare.cc:4461(Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*))[0x5586d5dd309b]

sql/sql_prepare.cc:3481(mysql_sql_stmt_execute(THD*))[0x5586d5dcc602]

sql/sql_parse.cc:3960(mysql_execute_command(THD*, bool))[0x5586d5d2a994]

sql/sql_parse.cc:7815(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x5586d5d45499]

sql/sql_parse.cc:1895(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x5586d5d1c900]

sql/sql_parse.cc:1406(do_command(THD*, bool))[0x5586d5d19638]

sql/sql_connect.cc:1437(do_handle_one_connection(CONNECT*, bool))[0x5586d61ee1c9]

sql/sql_connect.cc:1341(handle_one_connection)[0x5586d61edb8a]

perfschema/pfs.cc:2203(pfs_spawn_thread)[0x5586d6e2c56a]

nptl/pthread_create.c:442(start_thread)[0x7f2fd76a8044]

x86_64/clone3.S:83(clone3)[0x7f2fd772861c]

Trying to get some variables.

Some pointers may be invalid and cause the dump to abort.

Query (0x6290000e62d0): UPDATE t1 SET a = 0 WHERE 1 IN (SELECT b FROM t1)

Connection ID (thread ID): 4

Status: NOT_KILLED

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off,hash_join_cardinality=on,cset_narrowing=off,sargable_casefold=on

The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/ contains

information that should help you find out what is causing the crash.

Writing a core file...

Working directory at /dev/shm/var_auto__H3q/mysqld.1/data

Resource Limits:

Limit                     Soft Limit           Hard Limit           Units     

Max cpu time              unlimited            unlimited            seconds   

Max file size             unlimited            unlimited            bytes     

Max data size             unlimited            unlimited            bytes     

Max stack size            8388608              unlimited            bytes     

Max core file size        unlimited            unlimited            bytes     

Max resident set          unlimited            unlimited            bytes     

Max processes             514730               514730               processes 

Max open files            65536                65536                files     

Max locked memory         16876769280          16876769280          bytes     

Max address space         unlimited            unlimited            bytes     

Max file locks            unlimited            unlimited            locks     

Max pending signals       514730               514730               signals   

Max msgqueue size         819200               819200               bytes     

Max nice priority         0                    0                    

Max realtime priority     0                    0                    

Max realtime timeout      unlimited            unlimited            us        

Core pattern: core

Kernel version: Linux version 6.1.0-13-amd64 (debian-kernel@lists.debian.org) (gcc-12 (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC Debian 6.1.55-1 (2023-09-29)

commit 351a8eecf050886ed3a701ffdf47b5badce72a6b

Author: Alexander Barkov

Date:   Tue Sep 12 11:27:54 2023 +0400

    MDEV-32148 Inefficient WHERE timestamp_column=datetime_const_expr