Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41035

MariaDB Server heap-use-after-free when optimizer_replay_context is used inside a stored procedure

    XMLWordPrintable

Details

    • Bug
    • Status: Confirmed (View Workflow)
    • Critical
    • Resolution: Unresolved
    • 13.1
    • 13.1
    • Optimizer, Stored routines
    • 13.1.0-MariaDB-asan with AddressSanitizer enabled
      Source revision: b2a8c2234dbc276fe3947633c9ffea454badf48f
      Build: ASAN
      OS: Linux 6.6.98-40.6.tl4.x86_64
    • Can result in hang or crash

    Description

      poc：

      DROP DATABASE IF EXISTS t1;
      		 
      CREATE DATABASE t1;
      		 
      USE t1;
      		 
       
      		 
      CREATE TABLE t2 (a INT PRIMARY KEY, b INT, KEY(b));
      		 
      INSERT INTO t2 SELECT seq, MOD(seq, 10) FROM seq_1_to_2000;
      		 
      ANALYZE TABLE t2;
      		 
       
      		 
      SET SESSION optimizer_record_context=ON;
      		 
      SELECT COUNT(*) FROM t2 WHERE b > 1990;
      		 
      SET SESSION optimizer_record_context=OFF;
      		 
       
      		 
      SET @t3 = (
      		 
        SELECT REGEXP_SUBSTR(
      		 
          context,
      		 
          '(?<=set @opt_context=\')([\n\r].*)*(?=\'\;#opt_context_ends)'
      		 
        )
      		 
        FROM information_schema.optimizer_context
      		 
      );
      		 
       
      		 
      DELIMITER $$
      		 
      CREATE PROCEDURE t4()
      		 
      BEGIN
      		 
        EXPLAIN SELECT * FROM t2 WHERE b BETWEEN 5 AND 6;
      		 
        SET SESSION optimizer_replay_context='';
      		 
        EXPLAIN SELECT * FROM t2 WHERE b BETWEEN 5 AND 6;
      		 
      END$$
      		 
      DELIMITER ;
      		 
       
      		 
      SET SESSION optimizer_replay_context='t3';
      		 
      CALL t4();
      		 
       
      		 
      DROP PROCEDURE t4;
      		 
      DROP DATABASE t1;

      asan report：
      =================================================================
      ==1==ERROR: AddressSanitizer: heap-use-after-free on address
      0x525000431fe0 at pc 0x60218dea879f bp 0x6fe0daa7cac0 sp
      0x6fe0daa7cab8
      READ of size 8 at 0x525000431fe0 thread T12
      ==1==WARNING: invalid path to external symbolizer!
      ==1==WARNING: Failed to use and restart external symbolizer!
      #0 0x60218dea879e (/usr/local/mariadb/bin/mariadbd+0x165379e)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #1 0x60218d8aca7a (/usr/local/mariadb/bin/mariadbd+0x1057a7a)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #2 0x60218ddd1316 (/usr/local/mariadb/bin/mariadbd+0x157c316)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #3 0x60218ddcb1f5 (/usr/local/mariadb/bin/mariadbd+0x15761f5)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #4 0x60218ddcc7cc (/usr/local/mariadb/bin/mariadbd+0x15777cc)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #5 0x60218ddcffd2 (/usr/local/mariadb/bin/mariadbd+0x157afd2)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #6 0x60218d696721 (/usr/local/mariadb/bin/mariadbd+0xe41721)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #7 0x60218d69a17d (/usr/local/mariadb/bin/mariadbd+0xe4517d)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #8 0x60218d8a724d (/usr/local/mariadb/bin/mariadbd+0x105224d)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #9 0x60218d8a6919 (/usr/local/mariadb/bin/mariadbd+0x1051919)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #10 0x60218d8aa0fa (/usr/local/mariadb/bin/mariadbd+0x10550fa)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #11 0x60218d8a0b4b (/usr/local/mariadb/bin/mariadbd+0x104bb4b)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #12 0x60218d89b783 (/usr/local/mariadb/bin/mariadbd+0x1046783)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #13 0x60218d8a178d (/usr/local/mariadb/bin/mariadbd+0x104c78d)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #14 0x60218dc478cc (/usr/local/mariadb/bin/mariadbd+0x13f28cc)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #15 0x60218dc47417 (/usr/local/mariadb/bin/mariadbd+0x13f2417)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #16 0x60218e75a34b (/usr/local/mariadb/bin/mariadbd+0x1f0534b)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #17 0x60218d537978 (/usr/local/mariadb/bin/mariadbd+0xce2978)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #18 0x77e0ff242aa3 (/lib/x86_64-linux-gnu/libc.so.6+0x9caa3)
      (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
      #19 0x77e0ff2cfa63 (/lib/x86_64-linux-gnu/libc.so.6+0x129a63)
      (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)

      0x525000431fe0 is located 5856 bytes inside of 8192-byte region
      [0x525000430900,0x525000432900)
      freed by thread T12 here:
      #0 0x60218d539ba6 (/usr/local/mariadb/bin/mariadbd+0xce4ba6)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #1 0x60218ee8baf4 (/usr/local/mariadb/bin/mariadbd+0x2636af4)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #2 0x60218d696889 (/usr/local/mariadb/bin/mariadbd+0xe41889)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #3 0x60218d69a17d (/usr/local/mariadb/bin/mariadbd+0xe4517d)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #4 0x60218d8a724d (/usr/local/mariadb/bin/mariadbd+0x105224d)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #5 0x60218d8a6919 (/usr/local/mariadb/bin/mariadbd+0x1051919)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #6 0x60218d8aa0fa (/usr/local/mariadb/bin/mariadbd+0x10550fa)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #7 0x60218d8a0b4b (/usr/local/mariadb/bin/mariadbd+0x104bb4b)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #8 0x60218d89b783 (/usr/local/mariadb/bin/mariadbd+0x1046783)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #9 0x60218d8a178d (/usr/local/mariadb/bin/mariadbd+0x104c78d)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #10 0x60218dc478cc (/usr/local/mariadb/bin/mariadbd+0x13f28cc)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #11 0x60218dc47417 (/usr/local/mariadb/bin/mariadbd+0x13f2417)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #12 0x60218e75a34b (/usr/local/mariadb/bin/mariadbd+0x1f0534b)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #13 0x60218d537978 (/usr/local/mariadb/bin/mariadbd+0xce2978)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)

      previously allocated by thread T12 here:
      #0 0x60218d539e3f (/usr/local/mariadb/bin/mariadbd+0xce4e3f)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #1 0x60218eea0910 (/usr/local/mariadb/bin/mariadbd+0x264b910)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #2 0x60218ee8b3a7 (/usr/local/mariadb/bin/mariadbd+0x26363a7)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #3 0x60218d8a29f2 (/usr/local/mariadb/bin/mariadbd+0x104d9f2)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #4 0x60218ddcf835 (/usr/local/mariadb/bin/mariadbd+0x157a835)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #5 0x60218d696721 (/usr/local/mariadb/bin/mariadbd+0xe41721)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #6 0x60218d69a17d (/usr/local/mariadb/bin/mariadbd+0xe4517d)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #7 0x60218d8a724d (/usr/local/mariadb/bin/mariadbd+0x105224d)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #8 0x60218d8a6919 (/usr/local/mariadb/bin/mariadbd+0x1051919)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #9 0x60218d8aa0fa (/usr/local/mariadb/bin/mariadbd+0x10550fa)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #10 0x60218d8a0b4b (/usr/local/mariadb/bin/mariadbd+0x104bb4b)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #11 0x60218d89b783 (/usr/local/mariadb/bin/mariadbd+0x1046783)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #12 0x60218d8a178d (/usr/local/mariadb/bin/mariadbd+0x104c78d)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #13 0x60218dc478cc (/usr/local/mariadb/bin/mariadbd+0x13f28cc)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #14 0x60218dc47417 (/usr/local/mariadb/bin/mariadbd+0x13f2417)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #15 0x60218e75a34b (/usr/local/mariadb/bin/mariadbd+0x1f0534b)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #16 0x60218d537978 (/usr/local/mariadb/bin/mariadbd+0xce2978)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)

      Thread T12 created by T0 here:
      #0 0x60218d51f9c1 (/usr/local/mariadb/bin/mariadbd+0xcca9c1)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #1 0x60218e75a630 (/usr/local/mariadb/bin/mariadbd+0x1f05630)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #2 0x60218d589b68 (/usr/local/mariadb/bin/mariadbd+0xd34b68)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #3 0x60218d58a1e8 (/usr/local/mariadb/bin/mariadbd+0xd351e8)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #4 0x60218d58ab48 (/usr/local/mariadb/bin/mariadbd+0xd35b48)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #5 0x60218d58868c (/usr/local/mariadb/bin/mariadbd+0xd3368c)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #6 0x60218d57f750 (/usr/local/mariadb/bin/mariadbd+0xd2a750)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)
      #7 0x77e0ff1d01c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9)
      (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
      #8 0x77e0ff1d028a (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a)
      (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
      #9 0x60218d4a0e24 (/usr/local/mariadb/bin/mariadbd+0xc4be24)
      (BuildId: abc215d3c90df40e6d8fc5489105a945a2965c6d)

      SUMMARY: AddressSanitizer: heap-use-after-free
      (/usr/local/mariadb/bin/mariadbd+0x165379e) (BuildId:
      abc215d3c90df40e6d8fc5489105a945a2965c6d)
      Shadow bytes around the buggy address:
      0x525000431d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x525000431d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x525000431e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x525000431e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x525000431f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x525000431f80: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
      0x525000432000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x525000432080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x525000432100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x525000432180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x525000432200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable: 00
      Partially addressable: 01 02 03 04 05 06 07
      Heap left redzone: fa
      Freed heap region: fd
      Stack left redzone: f1
      Stack mid redzone: f2
      Stack right redzone: f3
      Stack after return: f5
      Stack use after scope: f8
      Global redzone: f9
      Global init order: f6
      Poisoned by user: f7
      Container overflow: fc
      Array cookie: ac
      Intra object redzone: bb
      ASan internal: fe
      Left alloca redzone: ca
      Right alloca redzone: cb
      ==1==ABORTING

      Attachments

        Issue Links

          relates to

          Task - A task that needs to be done. MDEV-38701 Optimizer Trace Replay: Q1 2026 Dev Sprint Work 1

          • Major - Major loss of function.
          • Closed

          New Feature - A new feature of the product, which has yet to be developed. MDEV-38923 [Limitation] context capture should work for stored procedures

          • Major - Major loss of function.
          • Open

          Activity

            People

              psergei Sergei Petrunia
              miaorp miao runpei
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.