Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-35533

UBSAN: runtime error: call to function sort_keys(st_key*, st_key*) through pointer to incorrect function type

Details

    Description

      export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1
      rm -Rf data tmp 
      mkdir tmp 
      ./scripts/mariadb-install-db --no-defaults --force --auth-root-authentication-method=normal --basedir=${PWD} --tmpdir=${PWD}/tmp --datadir=${PWD}/data
      

      Leads to:

      CS 10.6.21 2255be03952e0be7db764613956c5c66a6c1ab75 (Debug, UBASAN)

      /test/10.6_dbg_san/mysys/mf_qsort.c:131:35: runtime error: call to function sort_keys(st_key*, st_key*) through pointer to incorrect function type 'int (*)(const void *, const void *)'
      /test/10.6_dbg_san/sql/sql_table.cc:1979: note: sort_keys(st_key*, st_key*) defined here
          #0 0x5644b28daa82 in my_qsort /test/10.6_dbg_san/mysys/mf_qsort.c:131:35
          #1 0x5644ad299354 in mysql_prepare_create_table(THD*, HA_CREATE_INFO*, Alter_info*, unsigned int*, handler*, st_key**, unsigned int*, int) /test/10.6_dbg_san/sql/sql_table.cc:3553:5
          #2 0x5644ad2cc537 in mysql_create_frm_image(THD*, HA_CREATE_INFO*, Alter_info*, int, st_key**, unsigned int*, st_mysql_const_unsigned_lex_string*) /test/10.6_dbg_san/sql/sql_table.cc:4175:7
          #3 0x5644ad2d6615 in create_table_impl(THD*, st_ddl_log_state*, st_ddl_log_state*, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, DDL_options_st, HA_CREATE_INFO*, Alter_info*, int, bool*, st_key**, unsigned int*, st_mysql_const_unsigned_lex_string*) /test/10.6_dbg_san/sql/sql_table.cc:4494:11
          #4 0x5644ad2cf2b0 in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /test/10.6_dbg_san/sql/sql_table.cc:4617:8
          #5 0x5644ad2dccf8 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /test/10.6_dbg_san/sql/sql_table.cc:4839:7
          #6 0x5644ad3c1e72 in Sql_cmd_create_table_like::execute(THD*) /test/10.6_dbg_san/sql/sql_table.cc:12328:12
          #7 0x5644aca0133c in mysql_execute_command(THD*, bool) /test/10.6_dbg_san/sql/sql_parse.cc:6152:26
          #8 0x5644ac953ed9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6_dbg_san/sql/sql_parse.cc:8194:18
          #9 0x5644ac950a15 in bootstrap(st_mysql_file*) /test/10.6_dbg_san/sql/sql_parse.cc:1094:5
          #10 0x5644abe09328 in mysqld_main(int, char**) /test/10.6_dbg_san/sql/mysqld.cc:5888:26
          #11 0x5644abdf3863 in main /test/10.6_dbg_san/sql/main.cc:34:10
          #12 0x14e50d62a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
          #13 0x14e50d62a28a in __libc_start_main csu/../csu/libc-start.c:360:3
          #14 0x5644abd18034 in _start (/test/UBASAN_MD271124-mariadb-10.6.21-linux-x86_64-dbg/bin/mariadbd+0x3eb8034) (BuildId: 3cd87cd3953ac9cf3a930328b34dbd55d44c8146)
       
      SUMMARY: UndefinedBehaviorSanitizer: function-type-mismatch /test/10.6_dbg_san/mysys/mf_qsort.c:131:35 
      

      And

      CS 10.6.21 2255be03952e0be7db764613956c5c66a6c1ab75 (Debug, UBASAN)

      SUMMARY: UndefinedBehaviorSanitizer: function-type-mismatch /test/11.8_dbg_san/storage/innobase/log/log0sync.cc:388:5 
      /test/11.8_dbg_san/mysys/mf_qsort.c:131:35: runtime error: call to function sort_key_cmp through pointer to incorrect function type 'int (*)(const void *, const void *, const void *)'
      /test/11.8_dbg_san/storage/maria/ma_check.c:5655: note: sort_key_cmp defined here
          #0 0x55f15ec8b199 in my_qsort2 /test/11.8_dbg_san/mysys/mf_qsort.c:131:35
          #1 0x55f15caa0233 in write_index /test/11.8_dbg_san/storage/maria/ma_sort.c:857:3
          #2 0x55f15ca9db28 in _ma_create_index_by_sort /test/11.8_dbg_san/storage/maria/ma_sort.c:262:9
          #3 0x55f15ca5ce27 in maria_repair_by_sort /test/11.8_dbg_san/storage/maria/ma_check.c:4025:9
          #4 0x55f15c641123 in ha_maria::repair(THD*, st_handler_check_param*, bool) /test/11.8_dbg_san/storage/maria/ha_maria.cc:1706:16
          #5 0x55f15c64f4aa in ha_maria::enable_indexes(Bitmap<64u>, bool) /test/11.8_dbg_san/storage/maria/ha_maria.cc:2075:18
          #6 0x55f15c657f31 in ha_maria::end_bulk_insert() /test/11.8_dbg_san/storage/maria/ha_maria.cc:2342:17
          #7 0x55f15b1b2a4f in handler::ha_end_bulk_insert() /test/11.8_dbg_san/sql/handler.cc:5471:3
          #8 0x55f1588f0729 in select_insert::prepare_eof() /test/11.8_dbg_san/sql/sql_insert.cc:4378:18
          #9 0x55f1588fb70c in select_insert::send_eof() /test/11.8_dbg_san/sql/sql_insert.cc:4497:9
          #10 0x55f1590b2d0d in do_select(JOIN*, Procedure*) /test/11.8_dbg_san/sql/sql_select.cc:23659:9
          #11 0x55f1590a6c69 in JOIN::exec_inner() /test/11.8_dbg_san/sql/sql_select.cc:5037:50
          #12 0x55f15909f35a in JOIN::exec() /test/11.8_dbg_san/sql/sql_select.cc:4820:8
          #13 0x55f158f3d869 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_dbg_san/sql/sql_select.cc:5353:21
          #14 0x55f158f38f27 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_dbg_san/sql/sql_select.cc:633:10
          #15 0x55f158bde361 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:4663:16
          #16 0x55f158b6acf9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
          #17 0x55f158b676df in bootstrap(st_mysql_file*) /test/11.8_dbg_san/sql/sql_parse.cc:1091:5
          #18 0x55f157d783d5 in mysqld_main(int, char**) /test/11.8_dbg_san/sql/mysqld.cc:6104:26
          #19 0x55f157d624d3 in main /test/11.8_dbg_san/sql/main.cc:34:10
          #20 0x148db022a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
          #21 0x148db022a28a in __libc_start_main csu/../csu/libc-start.c:360:3
          #22 0x55f157c86ca4 in _start (/test/UBASAN_MD271124-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd+0x420dca4) (BuildId: f27fe1c9ec9e330ed9e1f77c95234779a142f25c)
      

      Observed using UBSAN with Clang and LLMV 18.1.3:

      sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools  # llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18
      sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so
      ...
      export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1
      

      Related helpful comment on 'function-type-mismatch' errors here.

      Attachments

        Issue Links

          Activity

            This bug looks fixed in 10.6 post the merge of MDEV-34348, tested at revision 507323abe6d0cf61abb608b87b25fb5f6141aff2 (Debug, UBASAN, Clang/LLVM 18.1.3). The filter (required for testing; bugs version validation) will be removed once the patch is fully upmerged to all versions up to 11.8.

            Roel Roel Van de Paar added a comment - This bug looks fixed in 10.6 post the merge of MDEV-34348 , tested at revision 507323abe6d0cf61abb608b87b25fb5f6141aff2 (Debug, UBASAN, Clang/LLVM 18.1.3). The filter (required for testing; bugs version validation) will be removed once the patch is fully upmerged to all versions up to 11.8.

            I believe that this report is a duplicate of MDEV-34348. These errors should be caught at compilation time by clang. You were testing a revision that is several commits behind the merge of MDEV-34348.

            marko Marko Mäkelä added a comment - I believe that this report is a duplicate of MDEV-34348 . These errors should be caught at compilation time by clang. You were testing a revision that is several commits behind the merge of MDEV-34348 .

            This issue requires a global UBSAN supression filter on function:my_qsort (which also filters the my_qsort2 stack) and thus significantly affects testing as all other bugs which use this function anywhere in their stack will be masked.

            Roel Roel Van de Paar added a comment - This issue requires a global UBSAN supression filter on function:my_qsort (which also filters the my_qsort2 stack) and thus significantly affects testing as all other bugs which use this function anywhere in their stack will be masked.

            People

              Unassigned Unassigned
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.