Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-35230

ASAN errors upon reading from joined temptable views with vector type

    XMLWordPrintable

Details

    Description

      CREATE TABLE t (f VECTOR(1));
      INSERT INTO t VALUES (0x30303030),(0x31313131);
      CREATE ALGORITHM=TEMPTABLE VIEW v AS SELECT * FROM t;
      SELECT v1.f FROM v v1 NATURAL JOIN v v2;
       
      # Cleanup
      DROP VIEW v;
      DROP TABLE t;
      

      bb-11.6-MDEV-32887-vector c29016301f7095ccc482fdfec1887f61e5adbed1

      ==185229==ERROR: AddressSanitizer: use-after-poison on address 0x6290001b71d8 at pc 0x563c660e81ef bp 0x7efc356c1de0 sp 0x7efc356c1dd8
      READ of size 1 at 0x6290001b71d8 thread T5
          #0 0x563c660e81ee in my_hash_sort_bin /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/strings/ctype-bin.c:286
          #1 0x563c659c0680 in my_ci_hash_sort /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/include/m_ctype.h:1413
          #2 0x563c659c0680 in hp_hashnr /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/storage/heap/hp_hash.c:273
          #3 0x563c659c0680 in hp_search /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/storage/heap/hp_hash.c:123
          #4 0x563c659c5322 in heap_rkey /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/storage/heap/hp_rkey.c:63
          #5 0x563c65017ee2 in handler::ha_index_read_map(unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/handler.cc:3804
          #6 0x563c648e1338 in join_read_always_key /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:24443
          #7 0x563c6488a612 in sub_select(JOIN*, st_join_table*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:23651
          #8 0x563c6484428d in evaluate_join_record /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:23887
          #9 0x563c6488a62e in sub_select(JOIN*, st_join_table*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:23654
          #10 0x563c64943f59 in do_select /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:23165
          #11 0x563c64943f59 in JOIN::exec_inner() /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:5026
          #12 0x563c64945742 in JOIN::exec() /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:4809
          #13 0x563c6493d85d in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:5342
          #14 0x563c6493f3c6 in handle_select(THD*, LEX*, select_result*, unsigned long long) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:624
          #15 0x563c647514ab in execute_sqlcom_select /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:6151
          #16 0x563c64780c84 in mysql_execute_command(THD*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:3953
          #17 0x563c64786151 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:7873
          #18 0x563c6478e44e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:1892
          #19 0x563c64793658 in do_command(THD*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:1405
          #20 0x563c64bc177e in do_handle_one_connection(CONNECT*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_connect.cc:1448
          #21 0x563c64bc208c in handle_one_connection /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_connect.cc:1350
          #22 0x563c657e7427 in pfs_spawn_thread /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/storage/perfschema/pfs.cc:2198
          #23 0x7efc406a8043 in start_thread nptl/pthread_create.c:442
          #24 0x7efc4072861b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
       
      0x6290001b71d8 is located 16344 bytes inside of 16400-byte region [0x6290001b3200,0x6290001b7210)
      allocated by thread T5 here:
          #0 0x7efc412b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
          #1 0x563c6609e033 in my_malloc /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/mysys/my_malloc.c:93
          #2 0x563c6608a65c in alloc_root /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/mysys/my_alloc.c:333
          #3 0x563c645c558f in Item::operator new(unsigned long, st_mem_root*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/item.h:857
          #4 0x563c645c558f in mark_common_columns /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_base.cc:7483
          #5 0x563c645c558f in store_top_level_join_columns /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_base.cc:7789
          #6 0x563c645e7643 in setup_natural_join_row_types /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_base.cc:7911
          #7 0x563c645e7643 in setup_tables(THD*, Name_resolution_context*, List<TABLE_LIST>*, TABLE_LIST*, List<TABLE_LIST>&, bool, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_base.cc:8423
          #8 0x563c645e81bf in setup_tables_and_check_access(THD*, Name_resolution_context*, List<TABLE_LIST>*, TABLE_LIST*, List<TABLE_LIST>&, bool, privilege_t, privilege_t, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_base.cc:8465
          #9 0x563c648f1b2a in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:1459
          #10 0x563c6493e9c8 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:5317
          #11 0x563c6493f3c6 in handle_select(THD*, LEX*, select_result*, unsigned long long) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_select.cc:624
          #12 0x563c647514ab in execute_sqlcom_select /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:6151
          #13 0x563c64780c84 in mysql_execute_command(THD*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:3953
          #14 0x563c64786151 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:7873
          #15 0x563c6478e44e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:1892
          #16 0x563c64793658 in do_command(THD*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_parse.cc:1405
          #17 0x563c64bc177e in do_handle_one_connection(CONNECT*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_connect.cc:1448
          #18 0x563c64bc208c in handle_one_connection /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/sql_connect.cc:1350
          #19 0x563c657e7427 in pfs_spawn_thread /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/storage/perfschema/pfs.cc:2198
          #20 0x7efc406a8043 in start_thread nptl/pthread_create.c:442
       
      Thread T5 created by T0 here:
          #0 0x7efc41249726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
          #1 0x563c657e769d in my_thread_create /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/storage/perfschema/my_thread.h:38
          #2 0x563c657e769d in pfs_spawn_thread_v1 /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/storage/perfschema/pfs.cc:2249
          #3 0x563c643f6503 in inline_mysql_thread_create /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/include/mysql/psi/mysql_thread.h:1139
          #4 0x563c643f6503 in create_thread_to_handle_connection(CONNECT*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/mysqld.cc:6267
          #5 0x563c64402ee5 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/mysqld.cc:6391
          #6 0x563c64403b37 in handle_connections_sockets() /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/mysqld.cc:6504
          #7 0x563c6440563c in mysqld_main(int, char**) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/sql/mysqld.cc:6162
          #8 0x7efc406461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
       
      SUMMARY: AddressSanitizer: use-after-poison /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-rel-asan/strings/ctype-bin.c:286 in my_hash_sort_bin
      Shadow bytes around the buggy address:
        0x0c528002ede0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c528002edf0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c528002ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c528002ee10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c528002ee20: f7 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 00
      =>0x0c528002ee30: 00 00 f7 00 00 f7 00 00 f7 00 00[f7]00 00 f7 f7
        0x0c528002ee40: f7 f7 fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c528002ee50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c528002ee60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c528002ee70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c528002ee80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==185229==ABORTING
      

      Attachments

        Issue Links

          Activity

            People

              serg Sergei Golubchik
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.