Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
13.1
-
Can result in hang or crash
Description
SELECT SQL_BUFFER_RESULT GROUP_CONCAT(DISTINCT a) FROM (SELECT 1 a UNION SELECT 2) d GROUP BY a; |
SELECT 1; |
Leads to:
|
CS 13.2.0 c894d97781b54fbf074677c9d67f81cd60a162ac (Debug, Clang 22.1.8-20260621) Build 26/10/2026 |
Core was generated by `/test/MD261026-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x00005e3152a8b695 in end_io_cache (info=0x71634c035228)at /test/13.1_dbg/mysys/mf_iocache.c:1871
|
|
|
[Current thread is 1 (LWP 1832920)]
|
(gdb) bt
|
#0 0x00005e3152a8b695 in end_io_cache (info=0x71634c035228)at /test/13.1_dbg/mysys/mf_iocache.c:1871
|
#1 0x00005e3152a879e0 in close_cached_file (cache=0x71634c035228)at /test/13.1_dbg/mysys/mf_cache.c:89
|
#2 0x00005e3151f4008d in Unique::~Unique (this=0x71634c0351e0)at /test/13.1_dbg/sql/uniques.cc:387
|
#3 0x00005e315230a477 in Item_func_group_concat::cleanup (this=0x71634c01ade0)at /test/13.1_dbg/sql/item_sum.cc:4291
|
#4 0x00005e3151d19baa in Item::delete_self (this=0x71634c01ade0)at /test/13.1_dbg/sql/item.h:2718
|
#5 0x00005e3151d062b0 in Query_arena::free_items (this=0x71634c000d78)at /test/13.1_dbg/sql/sql_class.cc:4366
|
#6 0x00005e3151d060fc in THD::cleanup_after_query (this=0x71634c000d60)at /test/13.1_dbg/sql/sql_class.cc:2639
|
#7 0x00005e3151d99863 in mysql_parse (thd=0x71634c000d60, rawbuf=0x71634c01a630 "SELECT SQL_BUFFER_RESULT GROUP_CONCAT(DISTINCT a) FROM (SELECT 1 a UNION SELECT 2) d GROUP BY a", length=95, parser_state=0x79647c1159c0) at /test/13.1_dbg/sql/sql_parse.cc:8029
|
#8 0x00005e3151d96ece in dispatch_command (command=COM_QUERY, thd=0x71634c000d60, packet=0x71634c00b691 "", packet_length=95, blocking=true) at /test/13.1_dbg/sql/sql_parse.cc:1903
|
#9 0x00005e3151d9a19a in do_command (thd=0x71634c000d60, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1437
|
#10 0x00005e3151f750ce in do_handle_one_connection (connect=0x5e317a8070e0, put_in_cache=true) at /test/13.1_dbg/sql/sql_connect.cc:1514
|
#11 0x00005e3151f74eb1 in handle_one_connection (arg=0x5e317a7bbcb0)at /test/13.1_dbg/sql/sql_connect.cc:1426
|
#12 0x000079647e29cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#13 0x000079647e329ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.11 dbg 261026 6a063120d4d3d451bff3ea84b3ffbee288b33be8 No bug found
|
CS 10.11 opt 261026 6a063120d4d3d451bff3ea84b3ffbee288b33be8 No bug found
|
CS 11.4 dbg 261026 b6406d42c8e26be3d86a4a743180f6b415a4559b No bug found
|
CS 11.4 opt 261026 b6406d42c8e26be3d86a4a743180f6b415a4559b No bug found
|
CS 11.8 dbg 261026 274dd0d8d90bc773090d13303b8d5e36d2390241 No bug found
|
CS 11.8 opt 261026 274dd0d8d90bc773090d13303b8d5e36d2390241 No bug found
|
CS 12.3 dbg 261026 788a07c52132d9f42b6991e599510c62d1625c0f No bug found
|
CS 12.3 opt 261026 788a07c52132d9f42b6991e599510c62d1625c0f No bug found
|
CS 13.0 dbg 261026 620a4b5624222048fece7fe1789978ae0675cae2 No bug found
|
CS 13.0 opt 261026 620a4b5624222048fece7fe1789978ae0675cae2 No bug found
|
CS 13.2 dbg 261026 c894d97781b54fbf074677c9d67f81cd60a162ac SIGSEGV|end_io_cache|close_cached_file|Unique::~Unique|Item_func_group_concat::cleanup
|
CS 13.2 opt 261026 c894d97781b54fbf074677c9d67f81cd60a162ac No bug found
|
ES 10.6 dbg 261026 45fbb1583d8cdcc7da5a123a844b3bf512f31c9d No bug found
|
ES 10.6 opt 261026 45fbb1583d8cdcc7da5a123a844b3bf512f31c9d No bug found
|
ES 11.4 dbg 261026 6b2ae48e6e2488060adfdd02a7114bb60d4d150c No bug found
|
ES 11.4 opt 261026 6b2ae48e6e2488060adfdd02a7114bb60d4d150c No bug found
|
ES 11.8 dbg 261026 6e6ba60bdc2b3f478513c5afa3faa062d8e73736 No bug found
|
ES 11.8 opt 261026 6e6ba60bdc2b3f478513c5afa3faa062d8e73736 No bug found
|
ES 12.3 dbg 261026 781803ca9943d806ecb4b3b3fb39264dfafe1cf0 No bug found
|
ES 12.3 opt 261026 781803ca9943d806ecb4b3b3fb39264dfafe1cf0 No bug found
|
SELECT SQL_BUFFER_RESULT GROUP_CONCAT(DISTINCT a) FROM (SELECT 1 a UNION SELECT 2) d GROUP BY a; |
SELECT 1; |
Leads to:
|
CS 13.2.0 c894d97781b54fbf074677c9d67f81cd60a162ac (Debug, UBASAN, Clang 22.1.8-20260621) Build 26/10/2026 |
Version: '13.2.0-MariaDB-asan-debug' socket: '/test/UBASAN_MD261026-mariadb-13.2.0-linux-x86_64-dbg/socket.sock' port: 10956 MariaDB Server
|
=================================================================
|
==2643476==ERROR: AddressSanitizer: use-after-poison on address 0x74bcc597b228 at pc 0x6512dbe9dad6 bp 0x69ec132706e0 sp 0x69ec132706d8
|
READ of size 8 at 0x74bcc597b228 thread T11
|
#0 0x6512dbe9dad5 in my_b_inited /test/13.1_dbg_san/include/my_sys.h:558:70
|
#1 0x6512dbe9dad5 in close_cached_file /test/13.1_dbg_san/mysys/mf_cache.c:74:7
|
#2 0x6512daa5b4cc in Unique::~Unique() /test/13.1_dbg_san/sql/uniques.cc:387:3
|
#3 0x6512d9cbfd4f in Item_func_group_concat::cleanup() /test/13.1_dbg_san/sql/item_sum.cc:4291:9
|
#4 0x6512da210695 in Item::delete_self() /test/13.1_dbg_san/sql/item.h:2718:5
|
#5 0x6512da210695 in Query_arena::free_items() /test/13.1_dbg_san/sql/sql_class.cc:4366:16
|
#6 0x6512da20ff9b in THD::cleanup_after_query() /test/13.1_dbg_san/sql/sql_class.cc:2639:3
|
#7 0x6512da4f52d6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1903:7
|
#8 0x6512da4fd663 in do_command(THD*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1437:17
|
#9 0x6512dab066fc in do_handle_one_connection(CONNECT*, bool) /test/13.1_dbg_san/sql/sql_connect.cc:1514:11
|
#10 0x6512dab06318 in handle_one_connection /test/13.1_dbg_san/sql/sql_connect.cc:1426:5
|
#11 0x6512d97beec6 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28
|
#12 0x75ecc669cb83 in start_thread nptl/pthread_create.c:447:8
|
#13 0x75ecc6729ecb in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
0x74bcc597b228 is located 3624 bytes inside of 32768-byte region [0x74bcc597a400,0x74bcc5982400)
|
allocated by thread T11 here:
|
#0 0x6512d97c1644 in malloc /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3
|
#1 0x6512dbf1268a in my_malloc /test/13.1_dbg_san/mysys/my_malloc.c:93:29
|
|
|
Thread T11 created by T0 here:
|
#0 0x6512d97a4b41 in pthread_create /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:257:3
|
#1 0x6512d9817d45 in create_thread_to_handle_connection(CONNECT*) /test/13.1_dbg_san/sql/mysqld.cc:6694:19
|
#2 0x6512d9818b52 in handle_connections_sockets() /test/13.1_dbg_san/sql/mysqld.cc:6930:9
|
#3 0x6512d9817017 in run_main_loop() /test/13.1_dbg_san/sql/mysqld.cc:6171:3
|
#4 0x75ecc662a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
|
#5 0x75ecc662a28a in __libc_start_main csu/../csu/libc-start.c:360:3
|
#6 0x6512d971c264 in _start (/test/UBASAN_MD261026-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd+0x2c3d264)
|
|
|
SUMMARY: AddressSanitizer: use-after-poison /test/13.1_dbg_san/include/my_sys.h:558:70 in my_b_inited
|
Shadow bytes around the buggy address:
|
0x74bcc597af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x74bcc597b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x74bcc597b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x74bcc597b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x74bcc597b180: 00 00 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
=>0x74bcc597b200: f7 f7 f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x74bcc597b280: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x74bcc597b300: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x74bcc597b380: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x74bcc597b400: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x74bcc597b480: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
|
|
NOTE: the stack trace above identifies the code that *accessed* the poisoned memory.
|
To identify the code that *poisoned* the memory, try the experimental setting ASAN_OPTIONS=poison_history_size=<size>.
|
==2643476==ABORTING
|
Setup:
Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O1 -march=native -mtune=native'" and:
|
-DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
|
Set before execution:
|
export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1
|
|
SAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.11 dbg 261026 6a063120d4d3d451bff3ea84b3ffbee288b33be8 No bug found
|
CS 10.11 opt 261026 6a063120d4d3d451bff3ea84b3ffbee288b33be8 No bug found
|
CS 11.4 dbg 261026 b6406d42c8e26be3d86a4a743180f6b415a4559b No bug found
|
CS 11.4 opt 261026 b6406d42c8e26be3d86a4a743180f6b415a4559b No bug found
|
CS 11.8 dbg 261026 274dd0d8d90bc773090d13303b8d5e36d2390241 No bug found
|
CS 11.8 opt 261026 274dd0d8d90bc773090d13303b8d5e36d2390241 No bug found
|
CS 12.3 dbg 261026 788a07c52132d9f42b6991e599510c62d1625c0f No bug found
|
CS 12.3 opt 261026 788a07c52132d9f42b6991e599510c62d1625c0f No bug found
|
CS 13.0 dbg 261026 620a4b5624222048fece7fe1789978ae0675cae2 No bug found
|
CS 13.0 opt 261026 620a4b5624222048fece7fe1789978ae0675cae2 No bug found
|
CS 13.2 dbg 261026 c894d97781b54fbf074677c9d67f81cd60a162ac ASAN|use-after-poison|include/my_sys.h|my_b_inited|close_cached_file|Unique::~Unique|Item_func_group_concat::cleanup
|
CS 13.2 opt 261026 c894d97781b54fbf074677c9d67f81cd60a162ac No bug found
|
ES 10.6 dbg 261026 45fbb1583d8cdcc7da5a123a844b3bf512f31c9d No bug found
|
ES 10.6 opt 261026 45fbb1583d8cdcc7da5a123a844b3bf512f31c9d No bug found
|
ES 11.4 dbg 261026 6b2ae48e6e2488060adfdd02a7114bb60d4d150c No bug found
|
ES 11.4 opt 261026 6b2ae48e6e2488060adfdd02a7114bb60d4d150c No bug found
|
ES 11.8 dbg 261026 6e6ba60bdc2b3f478513c5afa3faa062d8e73736 No bug found
|
ES 11.8 opt 261026 6e6ba60bdc2b3f478513c5afa3faa062d8e73736 No bug found
|
ES 12.3 dbg 261026 781803ca9943d806ecb4b3b3fb39264dfafe1cf0 No bug found
|
ES 12.3 opt 261026 781803ca9943d806ecb4b3b3fb39264dfafe1cf0 No bug found
|
