Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36003

UBSAN: runtime error: applying zero offset to null pointer in my_strnncollsp_utf8mb4_bin on SELECT FROM mysql.user

Details

    Description

      Some similiarties to MDEV-35723 and possibly MDEV-35717.
      However, this issue still reproduces in 10.5 from a few days ago (rev 7eded23be6597b4c485e8cad1538f2ae14541f91).
      marko FYI in case you know what the fix is for this one also given the similarity.

      CREATE USER user@localhost;
      SELECT authentication_string <> '' FROM mysql.user;
      

      Leads to:

      CS 10.5.28 7eded23be6597b4c485e8cad1538f2ae14541f91 (Optimized, UBASAN, Clang)

      /test/10.5_opt_san/strings/strcoll.inl:252:25: runtime error: applying zero offset to null pointer
          #0 0x560a500deac0 in my_strnncollsp_utf8mb4_bin /test/10.5_opt_san/strings/strcoll.inl:252:25
          #1 0x560a4e93ae66 in Arg_comparator::compare() /test/10.5_opt_san/sql/item_cmpfunc.h:117:33
          #2 0x560a4e93ae66 in Item_func_ne::val_int() /test/10.5_opt_san/sql/item_cmpfunc.cc:1845:18
          #3 0x560a4e3c3044 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /test/10.5_opt_san/sql/sql_type.cc:7596:22
          #4 0x560a4d752693 in Protocol::send_result_set_row(List<Item>*) /test/10.5_opt_san/sql/protocol.cc:1086:15
          #5 0x560a4d9b2440 in select_send::send_data(List<Item>&) /test/10.5_opt_san/sql/sql_class.cc:3173:17
          #6 0x560a4dce6e9d in end_send(JOIN*, st_join_table*, bool) /test/10.5_opt_san/sql/sql_select.cc:22522:11
          #7 0x560a4dd83cb5 in evaluate_join_record(JOIN*, st_join_table*, int) /test/10.5_opt_san/sql/sql_select.cc:21540:11
          #8 0x560a4dd8078f in sub_select(JOIN*, st_join_table*, bool) /test/10.5_opt_san/sql/sql_select.cc:21310:9
          #9 0x560a4dcffa56 in do_select(JOIN*, Procedure*) /test/10.5_opt_san/sql/sql_select.cc:20827:14
          #10 0x560a4dcfcc75 in JOIN::exec_inner() /test/10.5_opt_san/sql/sql_select.cc:4664:50
          #11 0x560a4dcf9b8d in JOIN::exec() /test/10.5_opt_san/sql/sql_select.cc:4444:3
          #12 0x560a4dc7ceb4 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.5_opt_san/sql/sql_select.cc:4921:9
          #13 0x560a4dc7bcb0 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.5_opt_san/sql/sql_select.cc:449:10
          #14 0x560a4dbbb15d in execute_sqlcom_select(THD*, TABLE_LIST*) /test/10.5_opt_san/sql/sql_parse.cc:6452:12
          #15 0x560a4db98645 in mysql_execute_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:4043:12
          #16 0x560a4db79436 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:8252:18
          #17 0x560a4db6e08e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_opt_san/sql/sql_parse.cc:1891:7
          #18 0x560a4db7b430 in do_command(THD*) /test/10.5_opt_san/sql/sql_parse.cc:1375:17
          #19 0x560a4e149607 in do_handle_one_connection(CONNECT*, bool) /test/10.5_opt_san/sql/sql_connect.cc:1386:11
          #20 0x560a4e148e5a in handle_one_connection /test/10.5_opt_san/sql/sql_connect.cc:1298:5
          #21 0x560a4d6d471c in asan_thread_start(void*) asan_interceptors.cpp.o
          #22 0x1540a849ca93 in start_thread nptl/pthread_create.c:447:8
          #23 0x1540a8529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/10.5_opt_san/strings/strcoll.inl:252:25 
      

      CS 11.8.0 cacaaebf01939d387645fb850ceeec5392496171 (Debug, UBASAN, Clang)

      /test/11.8_dbg_san/strings/strcoll.inl:324:25: runtime error: applying zero offset to null pointer
          #0 0x557227dc2331 in my_strnncollsp_utf8mb4_bin /test/11.8_dbg_san/strings/strcoll.inl:324:25
          #1 0x5572264995a4 in Arg_comparator::compare() /test/11.8_dbg_san/sql/item_cmpfunc.h:114:33
          #2 0x5572264995a4 in Item_func_ne::val_bool() /test/11.8_dbg_san/sql/item_cmpfunc.cc:1915:18
          #3 0x557224fb3cd5 in Item_bool_func::val_int() /test/11.8_dbg_san/sql/item_cmpfunc.h:245:12
          #4 0x557225e91024 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /test/11.8_dbg_san/sql/sql_type.cc:7697:22
          #5 0x557224ff1878 in Protocol::send_result_set_row(List<Item>*) /test/11.8_dbg_san/sql/protocol.cc:1353:15
          #6 0x5572252668c3 in select_send::send_data(List<Item>&) /test/11.8_dbg_san/sql/sql_class.cc:3282:17
          #7 0x557225651bb6 in end_send(JOIN*, st_join_table*, bool) /test/11.8_dbg_san/sql/sql_select.cc:25440:9
          #8 0x5572257099bf in evaluate_join_record(JOIN*, st_join_table*, int) /test/11.8_dbg_san/sql/sql_select.cc:24342:11
          #9 0x5572255dc3bf in sub_select(JOIN*, st_join_table*, bool) /test/11.8_dbg_san/sql/sql_select.cc:24109:9
          #10 0x55722566c79c in do_select(JOIN*, Procedure*) /test/11.8_dbg_san/sql/sql_select.cc:23620:14
          #11 0x5572256690f1 in JOIN::exec_inner() /test/11.8_dbg_san/sql/sql_select.cc:5040:50
          #12 0x557225666a12 in JOIN::exec() /test/11.8_dbg_san/sql/sql_select.cc:4823:8
          #13 0x5572255e0634 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_dbg_san/sql/sql_select.cc:5356:21
          #14 0x5572255def12 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_dbg_san/sql/sql_select.cc:633:10
          #15 0x5572254b4167 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.8_dbg_san/sql/sql_parse.cc:6191:12
          #16 0x55722549fd39 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:3980:12
          #17 0x55722546f588 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7915:18
          #18 0x55722546364b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
          #19 0x557225471fad in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
          #20 0x557225b3576c in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
          #21 0x557225b35027 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
          #22 0x557224e74b5c in asan_thread_start(void*) asan_interceptors.cpp.o
          #23 0x14a2fd69ca93 in start_thread nptl/pthread_create.c:447:8
          #24 0x14a2fd729c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/11.8_dbg_san/strings/strcoll.inl:324:25 
      

      CS 11.8.0 cacaaebf01939d387645fb850ceeec5392496171 (Optimized, UBASAN, Clang)

      /test/11.8_dbg_san/strings/strcoll.inl:324:25: runtime error: applying zero offset to null pointer
          #0 0x563e47c6b331 in my_strnncollsp_utf8mb4_bin /test/11.8_dbg_san/strings/strcoll.inl:324:25
          #1 0x563e463425a4 in Arg_comparator::compare() /test/11.8_dbg_san/sql/item_cmpfunc.h:114:33
          #2 0x563e463425a4 in Item_func_ne::val_bool() /test/11.8_dbg_san/sql/item_cmpfunc.cc:1915:18
          #3 0x563e44e5ccd5 in Item_bool_func::val_int() /test/11.8_dbg_san/sql/item_cmpfunc.h:245:12
          #4 0x563e45d3a024 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /test/11.8_dbg_san/sql/sql_type.cc:7697:22
          #5 0x563e44e9a878 in Protocol::send_result_set_row(List<Item>*) /test/11.8_dbg_san/sql/protocol.cc:1353:15
          #6 0x563e4510f8c3 in select_send::send_data(List<Item>&) /test/11.8_dbg_san/sql/sql_class.cc:3282:17
          #7 0x563e454fabb6 in end_send(JOIN*, st_join_table*, bool) /test/11.8_dbg_san/sql/sql_select.cc:25440:9
          #8 0x563e455b29bf in evaluate_join_record(JOIN*, st_join_table*, int) /test/11.8_dbg_san/sql/sql_select.cc:24342:11
          #9 0x563e454853bf in sub_select(JOIN*, st_join_table*, bool) /test/11.8_dbg_san/sql/sql_select.cc:24109:9
          #10 0x563e4551579c in do_select(JOIN*, Procedure*) /test/11.8_dbg_san/sql/sql_select.cc:23620:14
          #11 0x563e455120f1 in JOIN::exec_inner() /test/11.8_dbg_san/sql/sql_select.cc:5040:50
          #12 0x563e4550fa12 in JOIN::exec() /test/11.8_dbg_san/sql/sql_select.cc:4823:8
          #13 0x563e45489634 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_dbg_san/sql/sql_select.cc:5356:21
          #14 0x563e45487f12 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_dbg_san/sql/sql_select.cc:633:10
          #15 0x563e4535d167 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/11.8_dbg_san/sql/sql_parse.cc:6191:12
          #16 0x563e45348d39 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:3980:12
          #17 0x563e45318588 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7915:18
          #18 0x563e4530c64b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
          #19 0x563e4531afad in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
          #20 0x563e459de76c in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
          #21 0x563e459de027 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
          #22 0x563e44d1db5c in asan_thread_start(void*) asan_interceptors.cpp.o
          #23 0x145e3189ca93 in start_thread nptl/pthread_create.c:447:8
          #24 0x145e31929c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset /test/11.8_dbg_san/strings/strcoll.inl:324:25 
      

      Setup:

      Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions:
           # Note: llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18
           sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools
           sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so
      Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:
          -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
      Set before execution:
          export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter
          export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1
      

      Bug confirmed present in:
      MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.7.2 (dbg), 11.7.2 (opt), 11.8.0 (dbg), 11.8.0 (opt)

      Attachments

        Issue Links

          Activity

            People

              bar Alexander Barkov
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.