Details
-
Bug
-
Status: Open (View Workflow)
-
Critical
-
Resolution: Unresolved
-
12.3, 13.0, 13.1, 13.2
-
Can result in hang or crash
Description
# mysqld options required for replay: --performance-schema=ON |
SET sql_mode=ORACLE; |
DELIMITER $$
|
DECLARE TYPE t IS TABLE OF INT INDEX BY INTEGER; a t; BEGIN BEGIN DO a(1); EXCEPTION WHEN OTHERS THEN NULL; END; SELECT 1; END$$ |
Leads to:
N/A
|
CS 13.2.0 45717ef4c736a6a92e0acf49399ce677bfcaea89 (Optimized, UBASAN, Clang 18.1.3-11) Build 24/09/2026 |
==2854552==ERROR: AddressSanitizer: heap-use-after-free on address 0x5250000ff148 at pc 0x5655af637d76 bp 0x69247e8d3f70 sp 0x69247e8d3730
|
READ of size 7 at 0x5250000ff148 thread T12
|
#0 0x5655af637d75 in __asan_memcpy (/test/UBASAN_MD240926-mariadb-13.2.0-linux-x86_64-opt/bin/mariadbd+0x2f03d75) (BuildId: 0855c5e4fa8f9a86)
|
#1 0x5655b18547a7 in pfs_set_thread_info_v1 /test/13.2_opt_san/storage/perfschema/pfs.cc:2554:7
|
#2 0x5655b12506ec in sp_instr_stmt::execute(THD*, unsigned int*) /test/13.2_opt_san/sql/sp_instr.cc:1251:10
|
#3 0x5655b01ce753 in sp_head::execute(THD*, bool) /test/13.2_opt_san/sql/sp_head.cc:1346:20
|
#4 0x5655b01d93e2 in sp_head::execute_procedure(THD*, List<Item>*) /test/13.2_opt_san/sql/sp_head.cc:2421:5
|
#5 0x5655b07f02c6 in do_execute_sp(THD*, sp_head*) /test/13.2_opt_san/sql/sql_parse.cc:3099:16
|
#6 0x5655b07fd71c in mysql_execute_command(THD*, bool) /test/13.2_opt_san/sql/sql_parse.cc:5703:9
|
#7 0x5655b07d9882 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.2_opt_san/sql/sql_parse.cc:8005:18
|
#8 0x5655b07cfd19 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.2_opt_san/sql/sql_parse.cc:1903:7
|
#9 0x5655b07db0bc in do_command(THD*, bool) /test/13.2_opt_san/sql/sql_parse.cc:1437:17
|
#10 0x5655b0f3bfec in do_handle_one_connection(CONNECT*, bool) /test/13.2_opt_san/sql/sql_connect.cc:1514:11
|
#11 0x5655b0f3b732 in handle_one_connection /test/13.2_opt_san/sql/sql_connect.cc:1426:5
|
#12 0x5655b1852fb8 in pfs_spawn_thread /test/13.2_opt_san/storage/perfschema/pfs.cc:2198:3
|
#13 0x5655af6379ac in asan_thread_start(void*) crtstuff.c
|
#14 0x71255329cb83 in start_thread nptl/pthread_create.c:447:8
|
#15 0x712553329ecb in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
0x5250000ff148 is located 72 bytes inside of 8192-byte region [0x5250000ff100,0x525000101100)
|
freed by thread T12 here:
|
#0 0x5655af639c2a in free (/test/UBASAN_MD240926-mariadb-13.2.0-linux-x86_64-opt/bin/mariadbd+0x2f05c2a) (BuildId: 0855c5e4fa8f9a86)
|
#1 0x5655b249ea17 in root_free /test/13.2_opt_san/mysys/my_alloc.c:75:5
|
#2 0x5655b249ea17 in free_root /test/13.2_opt_san/mysys/my_alloc.c:515:7
|
#3 0x5655b01d0985 in sp_head::execute(THD*, bool) /test/13.2_opt_san/sql/sp_head.cc:1440:5
|
#4 0x5655b01d93e2 in sp_head::execute_procedure(THD*, List<Item>*) /test/13.2_opt_san/sql/sp_head.cc:2421:5
|
#5 0x5655b07f02c6 in do_execute_sp(THD*, sp_head*) /test/13.2_opt_san/sql/sql_parse.cc:3099:16
|
#6 0x5655b07fd71c in mysql_execute_command(THD*, bool) /test/13.2_opt_san/sql/sql_parse.cc:5703:9
|
#7 0x5655b07d9882 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.2_opt_san/sql/sql_parse.cc:8005:18
|
#8 0x5655b07cfd19 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.2_opt_san/sql/sql_parse.cc:1903:7
|
#9 0x5655b07db0bc in do_command(THD*, bool) /test/13.2_opt_san/sql/sql_parse.cc:1437:17
|
#10 0x5655b0f3bfec in do_handle_one_connection(CONNECT*, bool) /test/13.2_opt_san/sql/sql_connect.cc:1514:11
|
#11 0x5655b0f3b732 in handle_one_connection /test/13.2_opt_san/sql/sql_connect.cc:1426:5
|
#12 0x5655b1852fb8 in pfs_spawn_thread /test/13.2_opt_san/storage/perfschema/pfs.cc:2198:3
|
#13 0x5655af6379ac in asan_thread_start(void*) crtstuff.c
|
|
|
previously allocated by thread T12 here:
|
#0 0x5655af639ec3 in malloc (/test/UBASAN_MD240926-mariadb-13.2.0-linux-x86_64-opt/bin/mariadbd+0x2f05ec3) (BuildId: 0855c5e4fa8f9a86)
|
#1 0x5655b24c02d8 in my_malloc /test/13.2_opt_san/mysys/my_malloc.c:93:29
|
#2 0x5655b249de02 in root_alloc /test/13.2_opt_san/mysys/my_alloc.c:63:10
|
#3 0x5655b249de02 in alloc_root /test/13.2_opt_san/mysys/my_alloc.c:334:29
|
#4 0x5655b07e1025 in Query_arena::memdup_w_gap(void const*, unsigned long, unsigned long) const /test/13.2_opt_san/sql/sql_class.h:1392:9
|
#5 0x5655b07e1025 in alloc_query(THD*, char const*, unsigned long) /test/13.2_opt_san/sql/sql_parse.cc:2778:30
|
#6 0x5655b124e2c4 in sp_instr_stmt::execute(THD*, unsigned int*) /test/13.2_opt_san/sql/sp_instr.cc:1195:14
|
#7 0x5655b01ce753 in sp_head::execute(THD*, bool) /test/13.2_opt_san/sql/sp_head.cc:1346:20
|
#8 0x5655b01d93e2 in sp_head::execute_procedure(THD*, List<Item>*) /test/13.2_opt_san/sql/sp_head.cc:2421:5
|
#9 0x5655b07f02c6 in do_execute_sp(THD*, sp_head*) /test/13.2_opt_san/sql/sql_parse.cc:3099:16
|
#10 0x5655b07fd71c in mysql_execute_command(THD*, bool) /test/13.2_opt_san/sql/sql_parse.cc:5703:9
|
#11 0x5655b07d9882 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.2_opt_san/sql/sql_parse.cc:8005:18
|
#12 0x5655b07cfd19 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.2_opt_san/sql/sql_parse.cc:1903:7
|
#13 0x5655b07db0bc in do_command(THD*, bool) /test/13.2_opt_san/sql/sql_parse.cc:1437:17
|
#14 0x5655b0f3bfec in do_handle_one_connection(CONNECT*, bool) /test/13.2_opt_san/sql/sql_connect.cc:1514:11
|
#15 0x5655b0f3b732 in handle_one_connection /test/13.2_opt_san/sql/sql_connect.cc:1426:5
|
#16 0x5655b1852fb8 in pfs_spawn_thread /test/13.2_opt_san/storage/perfschema/pfs.cc:2198:3
|
#17 0x5655af6379ac in asan_thread_start(void*) crtstuff.c
|
|
|
Thread T12 created by T0 here:
|
#0 0x5655af61f835 in pthread_create (/test/UBASAN_MD240926-mariadb-13.2.0-linux-x86_64-opt/bin/mariadbd+0x2eeb835) (BuildId: 0855c5e4fa8f9a86)
|
#1 0x5655b185333d in my_thread_create(unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /test/13.2_opt_san/storage/perfschema/my_thread.h:38:10
|
#2 0x5655b185333d in pfs_spawn_thread_v1 /test/13.2_opt_san/storage/perfschema/pfs.cc:2249:15
|
#3 0x5655af6931ac in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /test/13.2_opt_san/include/mysql/psi/mysql_thread.h:1139:11
|
#4 0x5655af6931ac in create_thread_to_handle_connection(CONNECT*) /test/13.2_opt_san/sql/mysqld.cc:6613:19
|
#5 0x5655af6947b8 in handle_connections_sockets() /test/13.2_opt_san/sql/mysqld.cc:6849:9
|
#6 0x5655af6928b2 in run_main_loop() /test/13.2_opt_san/sql/mysqld.cc:6077:3
|
#7 0x5655af687c6c in mysqld_main(int, char**) /test/13.2_opt_san/sql/mysqld.cc:6509:3
|
#8 0x71255322a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
|
#9 0x71255322a28a in __libc_start_main csu/../csu/libc-start.c:360:3
|
#10 0x5655af59f074 in _start (/test/UBASAN_MD240926-mariadb-13.2.0-linux-x86_64-opt/bin/mariadbd+0x2e6b074) (BuildId: 0855c5e4fa8f9a86)
|
|
|
SUMMARY: AddressSanitizer: heap-use-after-free (/test/UBASAN_MD240926-mariadb-13.2.0-linux-x86_64-opt/bin/mariadbd+0x2f03d75) (BuildId: 0855c5e4fa8f9a86) in __asan_memcpy
|
Setup:
grep: /test/UBASAN_EMD170226-mariadb-10.6.25-21-linux-x86_64-dbg/BUILD_CMD_CMAKE: No such file or directory
|
Compiled with a recent version of GCC (I used GCC 13.3.0) and:
|
-DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
|
Set before execution:
|
export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1
|
|
SAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.11 dbg 280926 f24a3ef7edd4080d4cf6e109dac26e93872068dc No bug found
|
CS 10.11 opt 280926 f24a3ef7edd4080d4cf6e109dac26e93872068dc No bug found
|
CS 11.4 dbg 140926 03acdd67d599ab7136ef18c36f3479a306870290 No bug found
|
CS 11.4 opt 140926 03acdd67d599ab7136ef18c36f3479a306870290 No bug found
|
CS 12.3 dbg 140926 0fcc374c2df8b9a7a5004b3afcc7cc42c3b7c13f No bug found
|
CS 12.3 opt 140926 0fcc374c2df8b9a7a5004b3afcc7cc42c3b7c13f ASAN|heap-use-after-free|storage/perfschema/pfs.cc|__asan_memcpy|pfs_set_thread_info_v1|sp_instr_stmt::execute|sp_head::execute
|
CS 13.1 dbg 140926 e30f2bd21e463d5f5f9f9210b75193a0257b8a8c No bug found
|
CS 13.1 opt 140926 e30f2bd21e463d5f5f9f9210b75193a0257b8a8c ASAN|heap-use-after-free|storage/perfschema/pfs.cc|__asan_memcpy|pfs_set_thread_info_v1|sp_instr_stmt::execute|sp_head::execute
|
CS 13.2 dbg 240926 45717ef4c736a6a92e0acf49399ce677bfcaea89 No bug found
|
CS 13.2 opt 240926 45717ef4c736a6a92e0acf49399ce677bfcaea89 ASAN|heap-use-after-free|storage/perfschema/pfs.cc|__asan_memcpy|pfs_set_thread_info_v1|sp_instr_stmt::execute|sp_head::execute
|
ES 10.6 dbg 170226 22e626b9c17e9969925c54f14d30e39e25320b22 No bug found
|
ES 10.6 opt 170226 22e626b9c17e9969925c54f14d30e39e25320b22 No bug found
|
ES 11.4 dbg 170226 34f616d5fd2c649d0c79acb4e2423c90b8f10436 No bug found
|
ES 11.4 opt 170226 34f616d5fd2c649d0c79acb4e2423c90b8f10436 No bug found
|
ES 11.8 dbg 170226 405ee76b60c4ab82155f339136ed20d3b7363717 No bug found
|
ES 11.8 opt 170226 405ee76b60c4ab82155f339136ed20d3b7363717 No bug found
|
ES 12.3 dbg 280926 082387a5f3cbb877157998bb4baa95928f4aa121 No bug found
|
ES 12.3 opt 280926 082387a5f3cbb877157998bb4baa95928f4aa121 ASAN|heap-use-after-free|storage/perfschema/pfs.cc|__asan_memcpy|pfs_set_thread_info_v1|sp_instr_stmt::execute|sp_head::execute
|
