[MDEV-35723] UBSAN: applying non-zero offset to null pointer in my_charpos_mb/my_uca_scanner_next_utf8mb4, applying zero offset to null pointer in my_strnncollsp_simple, my_uca_strnncollsp_onelevel_utf8mb4/my_uca_scanner_init_any/my_uca_scanner_next_utf8mb4 on INSERT - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Critical
Resolution: Fixed
Affects Version/s: 10.5, 10.6, 10.11, 11.4, 11.7(EOL), 11.8
Fix Version/s: 10.5.28, 10.6.21, 10.11.11, 11.4.5, 11.7.2, 11.8.1
Component/s: Data types, Storage Engine - InnoDB
Labels:

Description

CREATE  TABLE t (c TEXT(1) NOT NULL, INDEX (c)) ENGINE=InnoDB;

INSERT INTO t SET c='';

Leads to:

CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Optimized, UBASAN, Clang)
/test/11.8_opt_san/strings/ctype-mb.c:259:32: runtime error: applying non-zero offset 2 to null pointer
#0 0x55813b9a1558 in my_charpos_mb /test/11.8_opt_san/strings/ctype-mb.c:259:32
#1 0x55813aee29bc in charset_info_st::charpos(char const, char const, unsigned long) const /test/11.8_opt_san/include/m_ctype.h:855:12
#2 0x55813aee29bc in innobase_get_at_most_n_mbchars(unsigned long, unsigned long, unsigned long, char const*) /test/11.8_opt_san/storage/innobase/handler/ha_innodb.cc:17003:25
#3 0x55813b1d11f8 in row_ins_index_entry_set_vals(ins_node_t const, que_thr_t) /test/11.8_opt_san/storage/innobase/row/row0ins.cc:3513:10
#4 0x55813b1d11f8 in row_ins_index_entry_step(ins_node_t, que_thr_t) /test/11.8_opt_san/storage/innobase/row/row0ins.cc:3563:8
#5 0x55813b1d11f8 in row_ins(ins_node_t, que_thr_t) /test/11.8_opt_san/storage/innobase/row/row0ins.cc:3688:28
#6 0x55813b1d11f8 in row_ins_step(que_thr_t*) /test/11.8_opt_san/storage/innobase/row/row0ins.cc:3817:8
#7 0x55813b21a541 in row_insert_for_mysql(unsigned char const, row_prebuilt_t, ins_mode_t) /test/11.8_opt_san/storage/innobase/row/row0mysql.cc:1290:2
#8 0x55813ae7414f in ha_innobase::write_row(unsigned char const*) /test/11.8_opt_san/storage/innobase/handler/ha_innodb.cc:7757:10
#9 0x558139f23745 in handler::ha_write_row(unsigned char const*) /test/11.8_opt_san/sql/handler.cc:8182:3
#10 0x558138c2c6d2 in write_record(THD, TABLE, st_copy_info, select_result) /test/11.8_opt_san/sql/sql_insert.cc:2321:12
#11 0x558138c1a086 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/11.8_opt_san/sql/sql_insert.cc:1181:14
#12 0x558138de7a2a in mysql_execute_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:4471:10
#13 0x558138da7c92 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.8_opt_san/sql/sql_parse.cc:7901:18
#14 0x558138d9cb9e in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.8_opt_san/sql/sql_parse.cc:1903:7
#15 0x558138daaa6e in do_command(THD*, bool) /test/11.8_opt_san/sql/sql_parse.cc:1416:17
#16 0x55813958be38 in do_handle_one_connection(CONNECT*, bool) /test/11.8_opt_san/sql/sql_connect.cc:1415:11
#17 0x55813958b280 in handle_one_connection /test/11.8_opt_san/sql/sql_connect.cc:1327:5
#18 0x5581386d3b0c in asan_thread_start(void*) asan_interceptors.cpp.o
#19 0x147f7009ca93 in start_thread nptl/pthread_create.c:447:8
#20 0x147f70129c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-nonzero-offset /test/11.8_opt_san/strings/ctype-mb.c:259:32

CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang)
/test/11.8_dbg_san/strings/ctype-mb.c:259:32: runtime error: applying non-zero offset 2 to null pointer
#0 0x55775c1a29e7 in my_charpos_mb /test/11.8_dbg_san/strings/ctype-mb.c:259:32
#1 0x557756a29933 in charset_info_st::charpos(char const, char const, unsigned long) const /test/11.8_dbg_san/include/m_ctype.h:855:12
#2 0x55775a3f6484 in innobase_get_at_most_n_mbchars(unsigned long, unsigned long, unsigned long, char const*) /test/11.8_dbg_san/storage/innobase/handler/ha_innodb.cc:17003:25
#3 0x55775b5b14b8 in dtype_get_at_most_n_mbchars(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, char const*) /test/11.8_dbg_san/storage/innobase/data/data0type.cc:61:10
#4 0x55775ad1fa00 in row_ins_index_entry_set_vals(ins_node_t const, que_thr_t) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3513:10
#5 0x55775ad1b23a in row_ins_index_entry_step(ins_node_t, que_thr_t) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3563:8
#6 0x55775acf7163 in row_ins(ins_node_t, que_thr_t) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3688:28
#7 0x55775acf4fcf in row_ins_step(que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3817:8
#8 0x55775add0dc3 in row_insert_for_mysql(unsigned char const, row_prebuilt_t, ins_mode_t) /test/11.8_dbg_san/storage/innobase/row/row0mysql.cc:1290:2
#9 0x55775a302d84 in ha_innobase::write_row(unsigned char const*) /test/11.8_dbg_san/storage/innobase/handler/ha_innodb.cc:7757:10
#10 0x557758520afa in handler::ha_write_row(unsigned char const*) /test/11.8_dbg_san/sql/handler.cc:8182:3
#11 0x557755ba560a in write_record(THD, TABLE, st_copy_info, select_result) /test/11.8_dbg_san/sql/sql_insert.cc:2321:12
#12 0x557755b6d830 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/11.8_dbg_san/sql/sql_insert.cc:1181:14
#13 0x557755ee1907 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:4471:10
#14 0x557755e77ef9 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
#15 0x557755e58db8 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
#16 0x557755e81e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
#17 0x557756fe4556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
#18 0x557756fe2d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
#19 0x55775502b5fc in asan_thread_start(void*) asan_interceptors.cpp.o
#20 0x14919bc9ca93 in start_thread nptl/pthread_create.c:447:8
#21 0x14919bd29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-nonzero-offset /test/11.8_dbg_san/strings/ctype-mb.c:259:32

CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang)
/test/11.8_dbg_san/strings/ctype-uca.inl:223:4: runtime error: applying zero offset to null pointer
#0 0x55775c23e542 in my_uca_strnncollsp_onelevel_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca.inl:223:4
#1 0x55775c1ebc7f in my_uca_strnncollsp_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca.inl:280:10
#2 0x55775ab7f132 in cmp_data(unsigned long, unsigned long, bool, unsigned char const, unsigned long, unsigned char const, unsigned long) /test/11.8_dbg_san/storage/innobase/rem/rem0cmp.cc:294:12
#3 0x55775ab83124 in cmp_dtuple_rec_with_match_low(dtuple_t const, unsigned char const, dict_index_t const, unsigned short const, unsigned long, unsigned long*) /test/11.8_dbg_san/storage/innobase/rem/rem0cmp.cc:405:9
#4 0x55775acc26a8 in cmp_dtuple_rec(dtuple_t const, unsigned char const, dict_index_t const, unsigned short const) /test/11.8_dbg_san/storage/innobase/include/rem0cmp.h:191:10
#5 0x55775b3964a7 in page_cur_tuple_insert(page_cur_t, dtuple_t const, unsigned short, mem_block_info_t, unsigned long, mtr_t*) /test/11.8_dbg_san/storage/innobase/include/page0cur.inl:183:2
#6 0x55775b38c3a3 in btr_cur_optimistic_insert(unsigned long, btr_cur_t, unsigned short, mem_block_info_t, dtuple_t, unsigned char, big_rec_t, unsigned long, que_thr_t, mtr_t) /test/11.8_dbg_san/storage/innobase/btr/btr0cur.cc:2488:10
#7 0x55775ace79a0 in row_ins_sec_index_entry_low(unsigned long, btr_latch_mode, dict_index_t, mem_block_info_t, mem_block_info_t, dtuple_t, unsigned long, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3152:10
#8 0x55775acf1d87 in row_ins_sec_index_entry(dict_index_t, dtuple_t, que_thr_t*, bool) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3350:8
#9 0x55775ad214e5 in row_ins_index_entry(dict_index_t, dtuple_t, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3407:10
#10 0x55775ad1b8eb in row_ins_index_entry_step(ins_node_t, que_thr_t) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3571:8
#11 0x55775acf7163 in row_ins(ins_node_t, que_thr_t) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3688:28
#12 0x55775acf4fcf in row_ins_step(que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3817:8
#13 0x55775add0dc3 in row_insert_for_mysql(unsigned char const, row_prebuilt_t, ins_mode_t) /test/11.8_dbg_san/storage/innobase/row/row0mysql.cc:1290:2
#14 0x55775a302d84 in ha_innobase::write_row(unsigned char const*) /test/11.8_dbg_san/storage/innobase/handler/ha_innodb.cc:7757:10
#15 0x557758520afa in handler::ha_write_row(unsigned char const*) /test/11.8_dbg_san/sql/handler.cc:8182:3
#16 0x557755ba560a in write_record(THD, TABLE, st_copy_info, select_result) /test/11.8_dbg_san/sql/sql_insert.cc:2321:12
#17 0x557755b6d830 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/11.8_dbg_san/sql/sql_insert.cc:1181:14
#18 0x557755ee1907 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:4471:10
#19 0x557755e77ef9 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
#20 0x557755e58db8 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
#21 0x557755e81e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
#22 0x557756fe4556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
#23 0x557756fe2d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
#24 0x55775502b5fc in asan_thread_start(void*) asan_interceptors.cpp.o
#25 0x14919bc9ca93 in start_thread nptl/pthread_create.c:447:8
#26 0x14919bd29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/11.8_dbg_san/strings/ctype-uca.inl:223:4

CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang)
/test/11.8_dbg_san/strings/ctype-uca.c:32090:22: runtime error: applying zero offset to null pointer
#0 0x55775c217c8e in my_uca_scanner_init_any /test/11.8_dbg_san/strings/ctype-uca.c:32090:22
#1 0x55775c23e629 in my_uca_strnncollsp_onelevel_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca.inl:229:3
#2 0x55775c1ebc7f in my_uca_strnncollsp_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca.inl:280:10
#3 0x55775ab7f132 in cmp_data(unsigned long, unsigned long, bool, unsigned char const, unsigned long, unsigned char const, unsigned long) /test/11.8_dbg_san/storage/innobase/rem/rem0cmp.cc:294:12
#4 0x55775ab83124 in cmp_dtuple_rec_with_match_low(dtuple_t const, unsigned char const, dict_index_t const, unsigned short const, unsigned long, unsigned long*) /test/11.8_dbg_san/storage/innobase/rem/rem0cmp.cc:405:9
#5 0x55775acc26a8 in cmp_dtuple_rec(dtuple_t const, unsigned char const, dict_index_t const, unsigned short const) /test/11.8_dbg_san/storage/innobase/include/rem0cmp.h:191:10
#6 0x55775b3964a7 in page_cur_tuple_insert(page_cur_t, dtuple_t const, unsigned short, mem_block_info_t, unsigned long, mtr_t*) /test/11.8_dbg_san/storage/innobase/include/page0cur.inl:183:2
#7 0x55775b38c3a3 in btr_cur_optimistic_insert(unsigned long, btr_cur_t, unsigned short, mem_block_info_t, dtuple_t, unsigned char, big_rec_t, unsigned long, que_thr_t, mtr_t) /test/11.8_dbg_san/storage/innobase/btr/btr0cur.cc:2488:10
#8 0x55775ace79a0 in row_ins_sec_index_entry_low(unsigned long, btr_latch_mode, dict_index_t, mem_block_info_t, mem_block_info_t, dtuple_t, unsigned long, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3152:10
#9 0x55775acf1d87 in row_ins_sec_index_entry(dict_index_t, dtuple_t, que_thr_t*, bool) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3350:8
#10 0x55775ad214e5 in row_ins_index_entry(dict_index_t, dtuple_t, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3407:10
#11 0x55775ad1b8eb in row_ins_index_entry_step(ins_node_t, que_thr_t) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3571:8
#12 0x55775acf7163 in row_ins(ins_node_t, que_thr_t) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3688:28
#13 0x55775acf4fcf in row_ins_step(que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3817:8
#14 0x55775add0dc3 in row_insert_for_mysql(unsigned char const, row_prebuilt_t, ins_mode_t) /test/11.8_dbg_san/storage/innobase/row/row0mysql.cc:1290:2
#15 0x55775a302d84 in ha_innobase::write_row(unsigned char const*) /test/11.8_dbg_san/storage/innobase/handler/ha_innodb.cc:7757:10
#16 0x557758520afa in handler::ha_write_row(unsigned char const*) /test/11.8_dbg_san/sql/handler.cc:8182:3
#17 0x557755ba560a in write_record(THD, TABLE, st_copy_info, select_result) /test/11.8_dbg_san/sql/sql_insert.cc:2321:12
#18 0x557755b6d830 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/11.8_dbg_san/sql/sql_insert.cc:1181:14
#19 0x557755ee1907 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:4471:10
#20 0x557755e77ef9 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
#21 0x557755e58db8 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
#22 0x557755e81e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
#23 0x557756fe4556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
#24 0x557756fe2d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
#25 0x55775502b5fc in asan_thread_start(void*) asan_interceptors.cpp.o
#26 0x14919bc9ca93 in start_thread nptl/pthread_create.c:447:8
#27 0x14919bd29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/11.8_dbg_san/strings/ctype-uca.c:32090:22

CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang)
/test/11.8_dbg_san/strings/ctype-uca-scanner_next.inl:84:23: runtime error: applying non-zero offset 1 to null pointer
#0 0x55775c23a39c in my_uca_scanner_next_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca-scanner_next.inl:84:23
#1 0x55775c23e653 in my_uca_strnncollsp_onelevel_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca.inl:234:12
#2 0x55775c1ebc7f in my_uca_strnncollsp_utf8mb4 /test/11.8_dbg_san/strings/ctype-uca.inl:280:10
#3 0x55775ab7f132 in cmp_data(unsigned long, unsigned long, bool, unsigned char const, unsigned long, unsigned char const, unsigned long) /test/11.8_dbg_san/storage/innobase/rem/rem0cmp.cc:294:12
#4 0x55775ab83124 in cmp_dtuple_rec_with_match_low(dtuple_t const, unsigned char const, dict_index_t const, unsigned short const, unsigned long, unsigned long*) /test/11.8_dbg_san/storage/innobase/rem/rem0cmp.cc:405:9
#5 0x55775acc26a8 in cmp_dtuple_rec(dtuple_t const, unsigned char const, dict_index_t const, unsigned short const) /test/11.8_dbg_san/storage/innobase/include/rem0cmp.h:191:10
#6 0x55775b3964a7 in page_cur_tuple_insert(page_cur_t, dtuple_t const, unsigned short, mem_block_info_t, unsigned long, mtr_t*) /test/11.8_dbg_san/storage/innobase/include/page0cur.inl:183:2
#7 0x55775b38c3a3 in btr_cur_optimistic_insert(unsigned long, btr_cur_t, unsigned short, mem_block_info_t, dtuple_t, unsigned char, big_rec_t, unsigned long, que_thr_t, mtr_t) /test/11.8_dbg_san/storage/innobase/btr/btr0cur.cc:2488:10
#8 0x55775ace79a0 in row_ins_sec_index_entry_low(unsigned long, btr_latch_mode, dict_index_t, mem_block_info_t, mem_block_info_t, dtuple_t, unsigned long, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3152:10
#9 0x55775acf1d87 in row_ins_sec_index_entry(dict_index_t, dtuple_t, que_thr_t*, bool) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3350:8
#10 0x55775ad214e5 in row_ins_index_entry(dict_index_t, dtuple_t, que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3407:10
#11 0x55775ad1b8eb in row_ins_index_entry_step(ins_node_t, que_thr_t) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3571:8
#12 0x55775acf7163 in row_ins(ins_node_t, que_thr_t) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3688:28
#13 0x55775acf4fcf in row_ins_step(que_thr_t*) /test/11.8_dbg_san/storage/innobase/row/row0ins.cc:3817:8
#14 0x55775add0dc3 in row_insert_for_mysql(unsigned char const, row_prebuilt_t, ins_mode_t) /test/11.8_dbg_san/storage/innobase/row/row0mysql.cc:1290:2
#15 0x55775a302d84 in ha_innobase::write_row(unsigned char const*) /test/11.8_dbg_san/storage/innobase/handler/ha_innodb.cc:7757:10
#16 0x557758520afa in handler::ha_write_row(unsigned char const*) /test/11.8_dbg_san/sql/handler.cc:8182:3
#17 0x557755ba560a in write_record(THD, TABLE, st_copy_info, select_result) /test/11.8_dbg_san/sql/sql_insert.cc:2321:12
#18 0x557755b6d830 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/11.8_dbg_san/sql/sql_insert.cc:1181:14
#19 0x557755ee1907 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:4471:10
#20 0x557755e77ef9 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
#21 0x557755e58db8 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
#22 0x557755e81e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
#23 0x557756fe4556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
#24 0x557756fe2d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
#25 0x55775502b5fc in asan_thread_start(void*) asan_interceptors.cpp.o
#26 0x14919bc9ca93 in start_thread nptl/pthread_create.c:447:8
#27 0x14919bd29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-nonzero-offset /test/11.8_dbg_san/strings/ctype-uca-scanner_next.inl:84:23

CS 10.11.11 c391fb1ff122adbfb9a7f98d3239aa08311918d6 (Debug, UBASAN, Clang)
/test/10.11_dbg_san/strings/ctype-simple.c:180:10: runtime error: applying zero offset to null pointer
#0 0x560aa9f581ac in my_strnncollsp_simple /test/10.11_dbg_san/strings/ctype-simple.c:180:10
#1 0x560aa892b3c2 in cmp_data(unsigned long, unsigned long, bool, unsigned char const, unsigned long, unsigned char const, unsigned long) /test/10.11_dbg_san/storage/innobase/rem/rem0cmp.cc:294:12
#2 0x560aa892f45e in cmp_dtuple_rec_with_match_low(dtuple_t const, unsigned char const, dict_index_t const, unsigned short const, unsigned long, unsigned long*) /test/10.11_dbg_san/storage/innobase/rem/rem0cmp.cc:405:9
#3 0x560aa84ef0b8 in cmp_dtuple_rec(dtuple_t const, unsigned char const, dict_index_t const, unsigned short const) /test/10.11_dbg_san/storage/innobase/include/rem0cmp.h:191:10
#4 0x560aa914d937 in page_cur_tuple_insert(page_cur_t, dtuple_t const, unsigned short, mem_block_info_t, unsigned long, mtr_t*) /test/10.11_dbg_san/storage/innobase/include/page0cur.inl:188:2
#5 0x560aa9142f63 in btr_cur_optimistic_insert(unsigned long, btr_cur_t, unsigned short, mem_block_info_t, dtuple_t, unsigned char, big_rec_t, unsigned long, que_thr_t, mtr_t) /test/10.11_dbg_san/storage/innobase/btr/btr0cur.cc:2613:10
#6 0x560aa8a92b37 in row_ins_sec_index_entry_low(unsigned long, btr_latch_mode, dict_index_t, mem_block_info_t, mem_block_info_t, dtuple_t, unsigned long, que_thr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3171:10
#7 0x560aa8a9ce17 in row_ins_sec_index_entry(dict_index_t, dtuple_t, que_thr_t*, bool) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3369:8
#8 0x560aa8acc6e5 in row_ins_index_entry(dict_index_t, dtuple_t, que_thr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3431:10
#9 0x560aa8ac67bb in row_ins_index_entry_step(ins_node_t, que_thr_t) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3595:8
#10 0x560aa8aa2091 in row_ins(ins_node_t, que_thr_t) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3720:28
#11 0x560aa8aa033f in row_ins_step(que_thr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3849:8
#12 0x560aa8b7d906 in row_insert_for_mysql(unsigned char const, row_prebuilt_t, ins_mode_t) /test/10.11_dbg_san/storage/innobase/row/row0mysql.cc:1291:2
#13 0x560aa803dd64 in ha_innobase::write_row(unsigned char const*) /test/10.11_dbg_san/storage/innobase/handler/ha_innodb.cc:7835:10
#14 0x560aa62c3459 in handler::ha_write_row(unsigned char const*) /test/10.11_dbg_san/sql/handler.cc:7735:3
#15 0x560aa3b52088 in write_record(THD, TABLE, st_copy_info, select_result) /test/10.11_dbg_san/sql/sql_insert.cc:2300:12
#16 0x560aa3b1ad6e in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.11_dbg_san/sql/sql_insert.cc:1173:14
#17 0x560aa3e7da0b in mysql_execute_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:4624:10
#18 0x560aa3e112d9 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/10.11_dbg_san/sql/sql_parse.cc:8179:18
#19 0x560aa3df24dc in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1907:7
#20 0x560aa3e1b236 in do_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1420:17
#21 0x560aa4f26cc6 in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1386:11
#22 0x560aa4f2548d in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1298:5
#23 0x560aa2fd05cc in asan_thread_start(void*) asan_interceptors.cpp.o
#24 0x1515bbe9ca93 in start_thread nptl/pthread_create.c:447:8
#25 0x1515bbf29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/10.11_dbg_san/strings/ctype-simple.c:180:10

Setup:

Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions:

     # Note: llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools

     sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so

Compiled with: '-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++' and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter'. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter

Bug confirmed present in:
MariaDB: 10.5.28 (dbg), 10.6.21 (dbg), 10.11.11 (dbg), 11.4.5 (dbg), 11.7.1 (dbg), 11.7.1 (opt), 11.8.0 (dbg), 11.8.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.5.28 (opt), 10.6.21 (opt), 10.11.11 (opt), 11.4.5 (opt)

Please note:

11.7+ opt builds also have the issue.
Outcomes differ for different versions (ref 10.11 stack example above). I can provide a detailed list if it will help.

Attachments

Issue Links

is part of

MDEV-25454 Make MariaDB server UBSAN safe

Confirmed

relates to

MDEV-35621 UBSAN: runtime error: applying zero offset to null pointer in my_strnxfrm_utf8mb3_general_ci, my_uca_scanner_init_any and my_uca_scanner_next_utf8mb3 and in _utf8mb4 functions, and null pointer passed as argument 2, which is declared to never be null

Confirmed

MDEV-35872 UBSAN: runtime error: applying zero offset to null pointer on CLI init in ctype-uca.c

Confirmed

MDEV-35864 UBSAN: "applying zero offset to null pointer" when using a Field_set with empty values

Closed

MDEV-35877 applying zero offset to null pointer in my_coll_init_uca()

Open

MDEV-36003 UBSAN: runtime error: applying zero offset to null pointer in my_strnncollsp_utf8mb4_bin on SELECT FROM mysql.user

Confirmed

(1 relates to)

Activity

Ascending order - Click to sort in descending order

Roel Van de Paar added a comment - 2024-12-27 23:01 - edited

A list of all stack/UniqueID's observed accross all versions and build types. Later versions have more issues showing.

UBSAN|applying non-zero offset X to null pointer|strings/ctype-mb.c|my_charpos_mb|charset_info_st::charpos|innobase_get_at_most_n_mbchars|dtype_get_at_most_n_mbchars

UBSAN|applying non-zero offset X to null pointer|strings/ctype-mb.c|my_charpos_mb|charset_info_st::charpos|innobase_get_at_most_n_mbchars|row_ins_index_entry_set_vals

UBSAN|applying non-zero offset X to null pointer|strings/ctype-uca-scanner_next.inl|my_uca_scanner_next_utf8mb4|my_uca_strnncollsp_onelevel_utf8mb4|my_uca_strnncollsp_utf8mb4|cmp_data

UBSAN|applying zero offset to null pointer|strings/ctype-simple.c|my_strnncollsp_simple|cmp_data|cmp_dtuple_rec_with_match_low|cmp_dtuple_rec

UBSAN|applying zero offset to null pointer|strings/ctype-uca.inl|my_uca_strnncollsp_onelevel_utf8mb4|my_uca_strnncollsp_utf8mb4|cmp_data|cmp_dtuple_rec_with_match_low

UBSAN|applying zero offset to null pointer|strings/ctype-uca.c|my_uca_scanner_init_any|my_uca_strnncollsp_onelevel_utf8mb4|my_uca_strnncollsp_utf8mb4|cmp_data

Roel Van de Paar added a comment - 2024-12-28 03:04

bar Increased prio due to the large number of issues observed. Feel free to adjust on your findings.

Roel Van de Paar added a comment - 2024-12-28 03:04 bar Increased prio due to the large number of issues observed. Feel free to adjust on your findings.

Marko Mäkelä added a comment - 2025-01-17 07:44

I debugged this a little in 10.6 a6ab0e6c0be218761e4dadf8959c7f42e5fea762. The null pointer is originally being returned by row_mysql_read_blob_ref(), which is being invoked on a ref buffer with col_len=9 that is filled with NUL bytes. Based on my debugging with data watchpoints, the BLOB pointer was filled with NUL. I found out that Field_blob::store() contains the following.

  if (!length)

    bzero(ptr,Field_blob::pack_length());

    return 0;

We have Field_blob::packlength==1 in this case. The zeroed buffer appears to serve 2 purposes. It both encodes the length and a pointer, which both are 0 or nullptr. The easiest fix seems to be to adjust row_mysql_read_blob_ref() for this, so that it will return a nonnull pointer in this case.

Marko Mäkelä added a comment - 2025-01-17 07:44 I debugged this a little in 10.6 a6ab0e6c0be218761e4dadf8959c7f42e5fea762. The null pointer is originally being returned by row_mysql_read_blob_ref() , which is being invoked on a ref buffer with col_len=9 that is filled with NUL bytes. Based on my debugging with data watchpoints, the BLOB pointer was filled with NUL. I found out that Field_blob::store() contains the following. if (!length) { bzero(ptr,Field_blob::pack_length()); return 0; } We have Field_blob::packlength==1 in this case. The zeroed buffer appears to serve 2 purposes. It both encodes the length and a pointer, which both are 0 or nullptr . The easiest fix seems to be to adjust row_mysql_read_blob_ref() for this, so that it will return a nonnull pointer in this case.

Marko Mäkelä added a comment - 2025-01-17 08:13

On 10.6, I tested the following work-around of ~~MDEV-33158~~, which has not been merged to 10.6 yet, and the following patch.

diff --git a/mysql-test/mariadb-test-run.pl b/mysql-test/mariadb-test-run.pl

index 3cfd2db2e03..83ef6de3d66 100755

--- a/mysql-test/mariadb-test-run.pl

+++ b/mysql-test/mariadb-test-run.pl

@@ -4466,6 +4466,8 @@ sub extract_warning_lines ($$) {

      qr/InnoDB: Could not free any blocks in the buffer pool!/,

      qr/InnoDB: Warning: Writer thread is waiting this semaphore:/,

      qr/InnoDB: innodb_open_files .* should not be greater than/,

+     qr/through pointer to incorrect function type/,

+     qr/[Uu]ndefined-?[Bb]ehavior/,

      qr/Slave: Unknown table 't1' .* 1051/,

      qr/Slave SQL:.*(Internal MariaDB error code: [[:digit:]]+|Query:.*)/,

      qr/slave SQL thread aborted/,

diff --git a/storage/innobase/row/row0mysql.cc b/storage/innobase/row/row0mysql.cc

index bb3b03aef14..db6357e9914 100644

--- a/storage/innobase/row/row0mysql.cc

+++ b/storage/innobase/row/row0mysql.cc

@@ -210,6 +210,13 @@ row_mysql_read_blob_ref(

 	byte*	data;

 	*len = mach_read_from_n_little_endian(ref, col_len - 8);

+	if (!*len) {

+		/* Field_blob::store() if (!length) would encode both

+		the length and the pointer in the same area. An empty

+		string must be a valid (nonnull) pointer in the

+		collation functions that cmp_data() may invoke. */

+		return ref;

+	}

 	memcpy(&data, ref + col_len - 8, sizeof data);

There are over 400 test failures for unrelated stuff for the following invocation.

./mtr --parallel=60 --big-test --force --max-test-fail=0

I’ll repeat the same on 10.5 soon, using clang-19 instead of clang-16, which I used for this 10.6 test run.

Marko Mäkelä added a comment - 2025-01-17 08:13 On 10.6, I tested the following work-around of MDEV-33158 , which has not been merged to 10.6 yet, and the following patch. diff --git a/mysql-test/mariadb-test-run.pl b/mysql-test/mariadb-test-run.pl index 3cfd2db2e03..83ef6de3d66 100755 --- a/mysql-test/mariadb-test-run.pl +++ b/mysql-test/mariadb-test-run.pl @@ -4466,6 +4466,8 @@ sub extract_warning_lines ($$) { qr/InnoDB: Could not free any blocks in the buffer pool!/, qr/InnoDB: Warning: Writer thread is waiting this semaphore:/, qr/InnoDB: innodb_open_files .* should not be greater than/, + qr/through pointer to incorrect function type/, + qr/[Uu]ndefined-?[Bb]ehavior/, qr/Slave: Unknown table 't1' .* 1051/, qr/Slave SQL:.*(Internal MariaDB error code: [[:digit:]]+|Query:.*)/, qr/slave SQL thread aborted/, diff --git a/storage/innobase/row/row0mysql.cc b/storage/innobase/row/row0mysql.cc index bb3b03aef14..db6357e9914 100644 --- a/storage/innobase/row/row0mysql.cc +++ b/storage/innobase/row/row0mysql.cc @@ -210,6 +210,13 @@ row_mysql_read_blob_ref( byte* data; *len = mach_read_from_n_little_endian(ref, col_len - 8); + if (!*len) { + /* Field_blob::store() if (!length) would encode both + the length and the pointer in the same area. An empty + string must be a valid (nonnull) pointer in the + collation functions that cmp_data() may invoke. */ + return ref; + } memcpy(&data, ref + col_len - 8, sizeof data); There are over 400 test failures for unrelated stuff for the following invocation. ./mtr --parallel=60 --big-test --force --max-test-fail=0 I’ll repeat the same on 10.5 soon, using clang-19 instead of clang-16, which I used for this 10.6 test run.

Marko Mäkelä added a comment - 2025-01-17 10:12

On 10.5 without any additional suppression, I only got a few test failures for clang-19 and WITH_UBSAN=ON. Two are related to changed stack usage, and two to changed timing.

10.5 df602ff7fa5ed9424a1d7ebaba67b665e2f6d1f6 with the patch
Failing test(s): innodb.innodb_sys_semaphore_waits sys_vars.innodb_fatal_semaphore_wait_threshold main.lotofstack main.execution_constants

However, my clang-19 build failed to flag the error for some reason. When I compile the 10.5 with clang-16, the error will be caught, and the patch will fix it. Without any additional suppression, I get almost 400 failures in other tests. Here is my script for invoking cmake:

#!/bin/bash

set -ex

test ! -e .git

test ! -e .bashrc

: ${CLANG=16}

exec cmake -DCMAKE_{C_COMPILER=clang,CXX_COMPILER=clang++}-"$CLANG" -DCMAKE_C{,XX}_FLAGS='-O2 -march=native -mtune=native -Wno-unused-command-line-argument -fno-limit-debug-info -fdebug-macro' -DCMAKE_{EXE,MODULE,SHARED}_LINKER_FLAGS:STRING=-fuse-ld=lld-$CLANG -Wl,--threads=all -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DWITH_DBUG_TRACE=OFF -DCONC_WITH_{UNITTEST,SSL}=OFF -DWITH_EMBEDDED_SERVER=OFF -DWITH_UNIT_TESTS=OFF -DCMAKE_BUILD_TYPE=Debug -DPLUGIN_{ARCHIVE,TOKUDB,MROONGA,OQGRAPH,ROCKSDB,CONNECT,SPIDER}=NO -DWITH_SAFEMALLOC=OFF -DWITH_ZLIB=system -G Ninja "$@"

I invoked it with the arguments -DWITH_UBSAN=ON /path/to/source.

Marko Mäkelä added a comment - 2025-01-17 10:12 On 10.5 without any additional suppression, I only got a few test failures for clang-19 and WITH_UBSAN=ON . Two are related to changed stack usage, and two to changed timing. 10.5 df602ff7fa5ed9424a1d7ebaba67b665e2f6d1f6 with the patch Failing test(s): innodb.innodb_sys_semaphore_waits sys_vars.innodb_fatal_semaphore_wait_threshold main.lotofstack main.execution_constants However, my clang-19 build failed to flag the error for some reason. When I compile the 10.5 with clang-16, the error will be caught, and the patch will fix it. Without any additional suppression, I get almost 400 failures in other tests. Here is my script for invoking cmake : #!/bin/bash set -ex test ! -e .git test ! -e .bashrc : ${CLANG=16} exec cmake -DCMAKE_{C_COMPILER=clang,CXX_COMPILER=clang++}- "$CLANG" -DCMAKE_C{,XX}_FLAGS= '-O2 -march=native -mtune=native -Wno-unused-command-line-argument -fno-limit-debug-info -fdebug-macro' -DCMAKE_{EXE,MODULE,SHARED}_LINKER_FLAGS:STRING=-fuse-ld=lld-$CLANG -Wl,--threads=all -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DWITH_DBUG_TRACE=OFF -DCONC_WITH_{UNITTEST,SSL}=OFF -DWITH_EMBEDDED_SERVER=OFF -DWITH_UNIT_TESTS=OFF -DCMAKE_BUILD_TYPE=Debug -DPLUGIN_{ARCHIVE,TOKUDB,MROONGA,OQGRAPH,ROCKSDB,CONNECT,SPIDER}=NO -DWITH_SAFEMALLOC=OFF -DWITH_ZLIB=system -G Ninja "$@" I invoked it with the arguments -DWITH_UBSAN=ON /path/to/source .

Marko Mäkelä added a comment - 2025-01-17 10:33

I added the test to the end of innodb.innodb. That test would emit 3 other errors with clang-16 for code outside InnoDB:

10.5 df602ff7fa5ed9424a1d7ebaba67b665e2f6d1f6
innodb.innodb [ fail ] Found warnings/errors in server log file!
Test ended at 2025-01-17 12:17:58
line
/mariadb/10.5/sql/sql_statistics.h:479:35: runtime error: -nan is outside the range of representable values of type 'unsigned long long'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /mariadb/10.5/sql/sql_statistics.h:479:35 in
/mariadb/10.5/strings/ctype-uca.c:33538:43: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /mariadb/10.5/strings/ctype-uca.c:33538:43 in
/mariadb/10.5/strings/ctype-uca.c:33670:43: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /mariadb/10.5/strings/ctype-uca.c:33670:43 in

With the following, I got nice stack traces for each of these:

./mtr --rr innodb.innodb

rr replay

break __ubsan::ScopedReport::~ScopedReport()

continue

backtrace

continue

backtrace

continue

backtrace

Marko Mäkelä added a comment - 2025-01-17 10:33 I added the test to the end of innodb.innodb . That test would emit 3 other errors with clang-16 for code outside InnoDB: 10.5 df602ff7fa5ed9424a1d7ebaba67b665e2f6d1f6 innodb.innodb [ fail ] Found warnings/errors in server log file! Test ended at 2025-01-17 12:17:58 line /mariadb/10.5/sql/sql_statistics.h:479:35: runtime error: -nan is outside the range of representable values of type 'unsigned long long' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /mariadb/10.5/sql/sql_statistics.h:479:35 in /mariadb/10.5/strings/ctype-uca.c:33538:43: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /mariadb/10.5/strings/ctype-uca.c:33538:43 in /mariadb/10.5/strings/ctype-uca.c:33670:43: runtime error: applying zero offset to null pointer SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /mariadb/10.5/strings/ctype-uca.c:33670:43 in With the following, I got nice stack traces for each of these: ./mtr --rr innodb.innodb rr replay break __ubsan::ScopedReport::~ScopedReport() continue backtrace continue backtrace continue backtrace

Marko Mäkelä added a comment - 2025-01-17 12:53

I filed MDEV-35877 for the errors in ctype-uca.c. The other error might be MDEV-35721.

Marko Mäkelä added a comment - 2025-01-17 12:53 I filed MDEV-35877 for the errors in ctype-uca.c . The other error might be MDEV-35721 .

Roel Van de Paar added a comment - 2025-01-17 20:28

Thank you marko and bar for working on these!

FWIW, to obtain UBSAN backtraces during runtime, I use print_stacktrace=1 in UBSAN_OPTIONS, though the in-gdb/in-rr traces may be better than the in-run ones. I often have to recall setting it in the shell before running MTR, as our sever and CLI scripts set it automatically on each run. Seeing the two-line errors without stack reminds me doing so.

Or, the full list of options used:

export ASAN_OPTIONS=suppressions=${HOME}/mariadb-qa/ASAN.filter:quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1

export UBSAN_OPTIONS=suppressions=${HOME}//mariadb-qa/UBSAN.filter:print_stacktrace=1:report_error_type=1

export TSAN_OPTIONS=suppress_equal_stacks=1:suppress_equal_addresses=1:history_size=7:verbosity=1

export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0

Roel Van de Paar added a comment - 2025-01-17 20:28 Thank you marko and bar for working on these! FWIW, to obtain UBSAN backtraces during runtime, I use print_stacktrace=1 in UBSAN_OPTIONS , though the in-gdb/in-rr traces may be better than the in-run ones. I often have to recall setting it in the shell before running MTR, as our sever and CLI scripts set it automatically on each run. Seeing the two-line errors without stack reminds me doing so. Or, the full list of options used: export ASAN_OPTIONS=suppressions=${HOME}/mariadb-qa/ASAN.filter:quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1 export UBSAN_OPTIONS=suppressions=${HOME}//mariadb-qa/UBSAN.filter:print_stacktrace=1:report_error_type=1 export TSAN_OPTIONS=suppress_equal_stacks=1:suppress_equal_addresses=1:history_size=7:verbosity=1 export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0

People

Assignee:: Marko Mäkelä

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Created:: 2024-12-27 22:46

Updated:: 2025-02-02 21:47

Resolved:: 2025-01-17 11:30

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server