Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
12.3, 13.1
-
None
Description
Possibly reproducible on other versions if vector grammar/data are replaced with something else, I didn't check.
|
12.3 27dad5cc0c815315fd45623147feaa4f20721b4e |
==2674469==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62000006dc60 at pc 0x55fe299a9a35 bp 0x77d5ab657020 sp 0x77d5ab657018
|
READ of size 8 at 0x62000006dc60 thread T42
|
#0 0x55fe299a9a34 in inline_mysql_rwlock_rdlock /data/bld/12.3-rel-asan/include/mysql/psi/mysql_thread.h:901
|
#1 0x55fe299a9a34 in mi_rprev /data/bld/12.3-rel-asan/storage/myisam/mi_rprev.c:44
|
#2 0x55fe287f8471 in handler::ha_index_last(unsigned char*) /data/bld/12.3-rel-asan/sql/handler.cc:4284
|
#3 0x55fe27b8b7f9 in rr_index_last /data/bld/12.3-rel-asan/sql/records.cc:450
|
#4 0x55fe28214268 in READ_RECORD::read_record() /data/bld/12.3-rel-asan/sql/records.h:77
|
#5 0x55fe28214268 in Sql_cmd_update::update_single_table(THD*) /data/bld/12.3-rel-asan/sql/sql_update.cc:843
|
#6 0x55fe28218afa in Sql_cmd_update::execute_inner(THD*) /data/bld/12.3-rel-asan/sql/sql_update.cc:3266
|
#7 0x55fe28015d87 in Sql_cmd_dml::execute(THD*) /data/bld/12.3-rel-asan/sql/sql_select.cc:34871
|
#8 0x55fe27ea7083 in mysql_execute_command(THD*, bool) /data/bld/12.3-rel-asan/sql/sql_parse.cc:4447
|
#9 0x55fe27eb60b1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/12.3-rel-asan/sql/sql_parse.cc:7945
|
#10 0x55fe27ebd6c8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/12.3-rel-asan/sql/sql_parse.cc:1903
|
#11 0x55fe27ec373e in do_command(THD*, bool) /data/bld/12.3-rel-asan/sql/sql_parse.cc:1437
|
#12 0x55fe2832096c in do_handle_one_connection(CONNECT*, bool) /data/bld/12.3-rel-asan/sql/sql_connect.cc:1514
|
#13 0x55fe28321164 in handle_one_connection /data/bld/12.3-rel-asan/sql/sql_connect.cc:1426
|
#14 0x55fe2912e797 in pfs_spawn_thread /data/bld/12.3-rel-asan/storage/perfschema/pfs.cc:2198
|
#15 0x7fd5e00a71f4 in start_thread nptl/pthread_create.c:442
|
#16 0x7fd5e01278eb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
|
0x62000006dc60 is located 3640 bytes to the right of 3496-byte region [0x62000006c080,0x62000006ce28)
|
allocated by thread T23 here:
|
#0 0x7fd5e06b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
|
#1 0x55fe29a38463 in my_malloc /data/bld/12.3-rel-asan/mysys/my_malloc.c:93
|
#2 0x55fe29a22689 in my_multi_malloc /data/bld/12.3-rel-asan/mysys/mulalloc.c:59
|
#3 0x55fe29995026 in mi_open /data/bld/12.3-rel-asan/storage/myisam/mi_open.c:329
|
#4 0x55fe2992dd5b in ha_myisam::open(char const*, int, unsigned int) /data/bld/12.3-rel-asan/storage/myisam/ha_myisam.cc:813
|
#5 0x55fe287f07aa in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/bld/12.3-rel-asan/sql/handler.cc:3937
|
#6 0x55fe2826d381 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/bld/12.3-rel-asan/sql/table.cc:4711
|
#7 0x55fe27ccf00a in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/bld/12.3-rel-asan/sql/sql_base.cc:2322
|
#8 0x55fe27cecfab in open_and_process_table /data/bld/12.3-rel-asan/sql/sql_base.cc:4297
|
#9 0x55fe27cecfab in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/bld/12.3-rel-asan/sql/sql_base.cc:4780
|
#10 0x55fe27cf0573 in open_tables /data/bld/12.3-rel-asan/sql/sql_base.h:275
|
#11 0x55fe27cf0573 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /data/bld/12.3-rel-asan/sql/sql_base.cc:5868
|
#12 0x55fe27cf0758 in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /data/bld/12.3-rel-asan/sql/sql_base.cc:5919
|
#13 0x55fe2809ac6d in fill_schema_table_by_open /data/bld/12.3-rel-asan/sql/sql_show.cc:4953
|
#14 0x55fe280fed8b in get_all_tables(THD*, TABLE_LIST*, Item*) /data/bld/12.3-rel-asan/sql/sql_show.cc:5726
|
#15 0x55fe28104f0a in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/bld/12.3-rel-asan/sql/sql_show.cc:9905
|
#16 0x55fe280899ba in JOIN::exec_inner() /data/bld/12.3-rel-asan/sql/sql_select.cc:5086
|
#17 0x55fe2808c912 in JOIN::exec() /data/bld/12.3-rel-asan/sql/sql_select.cc:4913
|
#18 0x55fe28085b00 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/12.3-rel-asan/sql/sql_select.cc:5439
|
#19 0x55fe28087656 in handle_select(THD*, LEX*, select_result*, unsigned long long) /data/bld/12.3-rel-asan/sql/sql_select.cc:636
|
#20 0x55fe27e801c0 in execute_sqlcom_select /data/bld/12.3-rel-asan/sql/sql_parse.cc:6219
|
#21 0x55fe27eb0543 in mysql_execute_command(THD*, bool) /data/bld/12.3-rel-asan/sql/sql_parse.cc:3992
|
#22 0x55fe27eb60b1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/12.3-rel-asan/sql/sql_parse.cc:7945
|
#23 0x55fe27ebd6c8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/12.3-rel-asan/sql/sql_parse.cc:1903
|
#24 0x55fe27ec373e in do_command(THD*, bool) /data/bld/12.3-rel-asan/sql/sql_parse.cc:1437
|
#25 0x55fe2832096c in do_handle_one_connection(CONNECT*, bool) /data/bld/12.3-rel-asan/sql/sql_connect.cc:1514
|
#26 0x55fe28321164 in handle_one_connection /data/bld/12.3-rel-asan/sql/sql_connect.cc:1426
|
#27 0x55fe2912e797 in pfs_spawn_thread /data/bld/12.3-rel-asan/storage/perfschema/pfs.cc:2198
|
#28 0x7fd5e00a71f4 in start_thread nptl/pthread_create.c:442
|
Thread T42 created by T0 here:
|
#0 0x7fd5e0649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
|
#1 0x55fe2912ea0d in my_thread_create /data/bld/12.3-rel-asan/storage/perfschema/my_thread.h:38
|
#2 0x55fe2912ea0d in pfs_spawn_thread_v1 /data/bld/12.3-rel-asan/storage/perfschema/pfs.cc:2249
|
#3 0x55fe27abc503 in inline_mysql_thread_create /data/bld/12.3-rel-asan/include/mysql/psi/mysql_thread.h:1139
|
#4 0x55fe27abc503 in create_thread_to_handle_connection(CONNECT*) /data/bld/12.3-rel-asan/sql/mysqld.cc:6542
|
#5 0x55fe27acb15c in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/12.3-rel-asan/sql/mysqld.cc:6666
|
#6 0x55fe27acbdb7 in handle_connections_sockets() /data/bld/12.3-rel-asan/sql/mysqld.cc:6778
|
#7 0x55fe27acf99a in run_main_loop /data/bld/12.3-rel-asan/sql/mysqld.cc:6012
|
#8 0x55fe27acf99a in mysqld_main(int, char**) /data/bld/12.3-rel-asan/sql/mysqld.cc:6438
|
#9 0x7fd5e0045249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
Thread T23 created by T0 here:
|
#0 0x7fd5e0649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
|
#1 0x55fe2912ea0d in my_thread_create /data/bld/12.3-rel-asan/storage/perfschema/my_thread.h:38
|
#2 0x55fe2912ea0d in pfs_spawn_thread_v1 /data/bld/12.3-rel-asan/storage/perfschema/pfs.cc:2249
|
#3 0x55fe27abc503 in inline_mysql_thread_create /data/bld/12.3-rel-asan/include/mysql/psi/mysql_thread.h:1139
|
#4 0x55fe27abc503 in create_thread_to_handle_connection(CONNECT*) /data/bld/12.3-rel-asan/sql/mysqld.cc:6542
|
#5 0x55fe27acb15c in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/12.3-rel-asan/sql/mysqld.cc:6666
|
#6 0x55fe27acbdb7 in handle_connections_sockets() /data/bld/12.3-rel-asan/sql/mysqld.cc:6778
|
#7 0x55fe27acf99a in run_main_loop /data/bld/12.3-rel-asan/sql/mysqld.cc:6012
|
#8 0x55fe27acf99a in mysqld_main(int, char**) /data/bld/12.3-rel-asan/sql/mysqld.cc:6438
|
#9 0x7fd5e0045249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
SUMMARY: AddressSanitizer: heap-buffer-overflow /data/bld/12.3-rel-asan/include/mysql/psi/mysql_thread.h:901 in inline_mysql_rwlock_rdlock
|
Shadow bytes around the buggy address:
|
0x0c4080005b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c4080005b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c4080005b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c4080005b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c4080005b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
=>0x0c4080005b80: fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa
|
0x0c4080005b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c4080005ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c4080005bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c4080005bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c4080005bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
==2674469==ABORTING
|
cmake . -DPLUGIN_TOKUDB=NO -DPLUGIN_COLUMNSTORE=NO -DPLUGIN_XPAND=NO -DCMAKE_C_FLAGS=-fno-omit-frame-pointer -DCMAKE_CXX_FLAGS=-fno-omit-frame-pointer -DBUILD_CONFIG=mysql_release -DWITH_ASAN=YES -DMYSQL_MAINTAINER_MODE=OFF -DWITH_SAFEMALLOC=OFF
|
|
MariaDB/randgen 9ac89e57b2deeca4bce6f8534dcee2e6805764c7 |
perl ./run.pl --basedir=$basedir --vardir=$vardir \
|
--compatibility=130199 --compatibility=13.1 \
|
--duration=300 --engine=InnoDB,Aria --filter=conf/ff/global.ff \
|
--gendata=data/sql/vector_gist_960_1K.sql \
|
--gendata=data/sql/vector_deep_image_96_10K.sql \
|
--gendata=data/sql/engine-heap.sql --gendata=conf/zz/blobs.zz \
|
--gendata=advanced --gendata=data/dbt3/dbt3-s0.0001.dump --gendata=advanced \
|
--gis --grammar=conf/yy/vector.yy --grammar=conf/yy/desc_indexes.yy \
|
--grammar=conf/yy/dml.yy --grammar=conf/preview/heap.yy \
|
--grammar=conf/yy/engine-heap-dml.yy:2 \
|
--mysqld=--file-key-management --mysqld=--log-bin \
|
--mysqld=--innodb-encrypt-tables --mysqld=--innodb-encrypt-log \
|
--mysqld=--encrypt-binlog --mysqld=--aria-encrypt-tables=1 \
|
--mysqld=--binlog-alter-two-phase=ON --mysqld=--binlog-format=row \
|
--mysqld=--binlog_annotate_row_events=OFF --mysqld=--binlog_row_metadata=MINIMAL \
|
--mysqld=--character-set-server=utf8 --mysqld=--collation-server=utf8_general_ci \
|
--mysqld=--default-storage-engine=HEAP --mysqld=--encrypt-tmp-disk-tables=1 \
|
--mysqld=--encrypt-tmp-files=1 \
|
--mysqld=--file-key-management-filename=`pwd`/util/file_key_management_keys.txt \
|
--mysqld=--histogram_size=0 --mysqld=--innodb-encryption-threads=4 \
|
--mysqld=--innodb-lock-wait-timeout=5 --mysqld=--lock-wait-timeout=10 \
|
--mysqld=--log-bin-trust-function-creators=1 --mysqld=--max-heap-table-size=256M \
|
--mysqld=--max-statement-time=20 --mysqld=--mhnsw_ef_search=4096 \
|
--mysqld=--mhnsw_max_cache_size=128M --mysqld=--optimizer_max_sel_arg_weight=1000000 \
|
--mysqld=--optimizer_switch=derived_merge=off \
|
--mysqld=--optimizer_use_condition_selectivity=1 \
|
--mysqld=--plugin-load-add=file_key_management \
|
--mysqld=--plugin-maturity=experimental --mysqld=--debug-no-sync \
|
--queries=1000000 \
|
--reporters=Backtrace,Deadlock,FeatureUsage,UniqueConstraintValidity \
|
--scenario=CrashRecovery --threads=6 \
|
--variator=OrderBy --variator=SelectOption --seed=random
|