[MDEV-17616] ASAN heap-use-after-free in subselect_engine::calc_const_tables on 2nd execution of PS Created: 2018-11-05  Updated: 2023-02-24  Resolved: 2023-02-24

Status: Closed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 5.5, 10.0, 10.1, 10.2
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Alice Sherepa Assignee: Oleksandr Byelkin
Resolution: Won't Fix Votes: 0
Labels: not-10.3, not-10.4, not-10.5

Issue Links:
Relates
relates to MDEV-6736 [10.0] Valgrind warnings 'Invalid rea... Closed

 Description    

CREATE TABLE t1 (a INT);
 
INSERT INTO t1 VALUES (3),(8);
 
 
CREATE TABLE t2 (b INT);
 
INSERT INTO t2 VALUES (2),(1);
 
 
prepare stmt from "SELECT a FROM t1
 
WHERE 9 IN ( SELECT MIN( a ) FROM t1 )  AND 1<>1 
HAVING a <> ( SELECT COUNT(*) FROM t2 ) 
ORDER BY a;";
 
execute stmt;
 
execute stmt;


 10.2 af9649c722810eb1754953eb406a84ec876ce693
 
Version: '10.2.19-MariaDB-debug-log' 
=================================================================
 
==4378==ERROR: AddressSanitizer: heap-use-after-free on address 0x622000039c1d at pc 0x55a599d3fe81 bp 0x7fc6107bae50 sp 0x7fc6107bae40
 
READ of size 1 at 0x622000039c1d thread T27
 
    #0 0x55a599d3fe80 in subselect_engine::calc_const_tables(List<TABLE_LIST>&) /git/10.2/sql/item_subselect.cc:4376
 
    #1 0x55a599d3ffd3 in subselect_single_select_engine::upper_select_const_tables() /git/10.2/sql/item_subselect.cc:4385
 
    #2 0x55a599d20274 in Item_subselect::update_used_tables() /git/10.2/sql/item_subselect.cc:950
 
    #3 0x55a5994ba9e5 in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join(Item*) /git/10.2/sql/item.h:4043
 
    #4 0x55a5994baa61 in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join(unsigned int, Item**) /git/10.2/sql/item.h:4055
 
    #5 0x55a5994be166 in Item_func::update_used_tables() /git/10.2/sql/item_func.h:144
 
    #6 0x55a5995811e8 in st_select_lex::update_used_tables() /git/10.2/sql/sql_lex.cc:4253
 
    #7 0x55a599634e04 in JOIN::optimize_inner() /git/10.2/sql/sql_select.cc:1232
 
    #8 0x55a599633aa0 in JOIN::optimize() /git/10.2/sql/sql_select.cc:1115
 
    #9 0x55a59964cd76 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /git/10.2/sql/sql_select.cc:3790
 
    #10 0x55a59962c938 in handle_select(THD*, LEX*, select_result*, unsigned long) /git/10.2/sql/sql_select.cc:376
 
    #11 0x55a5995b36f3 in execute_sqlcom_select /git/10.2/sql/sql_parse.cc:6477
 
    #12 0x55a5995a0703 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3484
 
    #13 0x55a599602b49 in Prepared_statement::execute(String*, bool) /git/10.2/sql/sql_prepare.cc:4787
 
    #14 0x55a5995fe511 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /git/10.2/sql/sql_prepare.cc:4216
 
    #15 0x55a5995f918b in mysql_sql_stmt_execute(THD*) /git/10.2/sql/sql_prepare.cc:3324
 
    #16 0x55a5995a0748 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3500
 
    #17 0x55a5995bbe58 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.2/sql/sql_parse.cc:8011
 
    #18 0x55a5995973a7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.2/sql/sql_parse.cc:1824
 
    #19 0x55a59959455b in do_command(THD*) /git/10.2/sql/sql_parse.cc:1378
 
    #20 0x55a5998b9aa1 in do_handle_one_connection(CONNECT*) /git/10.2/sql/sql_connect.cc:1335
 
    #21 0x55a5998b94a9 in handle_one_connection /git/10.2/sql/sql_connect.cc:1241
 
    #22 0x55a59aa5e8ff in pfs_spawn_thread /git/10.2/storage/perfschema/pfs.cc:1862
 
    #23 0x7fc627da66b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
 
    #24 0x7fc62723b41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)
 
 
 
0x622000039c1d is located 2845 bytes inside of 5028-byte region [0x622000039100,0x62200003a4a4)
 
freed by thread T27 here:
 
    #0 0x7fc62921f2ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
 
    #1 0x55a59ab7aaca in free_memory /git/10.2/mysys/safemalloc.c:279
 
    #2 0x55a59ab7a154 in sf_free /git/10.2/mysys/safemalloc.c:197
 
    #3 0x55a59ab4ac4d in my_free /git/10.2/mysys/my_malloc.c:217
 
    #4 0x55a59ab2cfd3 in free_root /git/10.2/mysys/my_alloc.c:393
 
    #5 0x55a5996a804f in free_tmp_table(THD*, TABLE*) /git/10.2/sql/sql_select.cc:18079
 
    #6 0x55a599d44e88 in subselect_hash_sj_engine::cleanup() /git/10.2/sql/item_subselect.cc:5220
 
    #7 0x55a599d1a434 in Item_subselect::cleanup() /git/10.2/sql/item_subselect.cc:155
 
    #8 0x55a599d1ab37 in Item_in_subselect::cleanup() /git/10.2/sql/item_subselect.cc:196
 
    #9 0x55a599592e94 in cleanup_items(Item*) /git/10.2/sql/sql_parse.cc:1135
 
    #10 0x55a5995fc572 in Prepared_statement::cleanup_stmt() /git/10.2/sql/sql_prepare.cc:3851
 
    #11 0x55a599602e1f in Prepared_statement::execute(String*, bool) /git/10.2/sql/sql_prepare.cc:4815
 
    #12 0x55a5995fe511 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /git/10.2/sql/sql_prepare.cc:4216
 
    #13 0x55a5995f918b in mysql_sql_stmt_execute(THD*) /git/10.2/sql/sql_prepare.cc:3324
 
    #14 0x55a5995a0748 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3500
 
    #15 0x55a5995bbe58 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.2/sql/sql_parse.cc:8011
 
    #16 0x55a5995973a7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.2/sql/sql_parse.cc:1824
 
    #17 0x55a59959455b in do_command(THD*) /git/10.2/sql/sql_parse.cc:1378
 
    #18 0x55a5998b9aa1 in do_handle_one_connection(CONNECT*) /git/10.2/sql/sql_connect.cc:1335
 
    #19 0x55a5998b94a9 in handle_one_connection /git/10.2/sql/sql_connect.cc:1241
 
    #20 0x55a59aa5e8ff in pfs_spawn_thread /git/10.2/storage/perfschema/pfs.cc:1862
 
    #21 0x7fc627da66b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
 
 
 
previously allocated by thread T27 here:
 
    #0 0x7fc62921f602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
 
    #1 0x55a59ab79b25 in sf_malloc /git/10.2/mysys/safemalloc.c:118
 
    #2 0x55a59ab4a40f in my_malloc /git/10.2/mysys/my_malloc.c:101
 
    #3 0x55a59ab2c1a0 in alloc_root /git/10.2/mysys/my_alloc.c:242
 
    #4 0x55a59ab2c869 in multi_alloc_root /git/10.2/mysys/my_alloc.c:310
 
    #5 0x55a59969c489 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, char const*, bool, bool) /git/10.2/sql/sql_select.cc:16683
 
    #6 0x55a5995030d5 in select_materialize_with_stats::create_result_table(THD*, List<Item>*, bool, unsigned long long, char const*, bool, bool, bool) /git/10.2/sql/sql_class.cc:3827
 
    #7 0x55a599d42b67 in subselect_hash_sj_engine::init(List<Item>*, unsigned int) /git/10.2/sql/item_subselect.cc:4983
 
    #8 0x55a599d38535 in Item_in_subselect::setup_mat_engine() /git/10.2/sql/item_subselect.cc:3404
 
    #9 0x55a599986102 in JOIN::choose_subquery_plan(unsigned long long) /git/10.2/sql/opt_subselect.cc:5912
 
    #10 0x55a59965418b in make_join_statistics /git/10.2/sql/sql_select.cc:4580
 
    #11 0x55a599638251 in JOIN::optimize_inner() /git/10.2/sql/sql_select.cc:1580
 
    #12 0x55a599633aa0 in JOIN::optimize() /git/10.2/sql/sql_select.cc:1115
 
    #13 0x55a599d1efd2 in Item_in_subselect::optimize(double*, double*) /git/10.2/sql/item_subselect.cc:760
 
    #14 0x55a599984068 in setup_jtbm_semi_joins(JOIN*, List<TABLE_LIST>*, Item**) /git/10.2/sql/opt_subselect.cc:5551
 
    #15 0x55a599635e29 in JOIN::optimize_inner() /git/10.2/sql/sql_select.cc:1345
 
    #16 0x55a599633aa0 in JOIN::optimize() /git/10.2/sql/sql_select.cc:1115
 
    #17 0x55a59964cd76 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /git/10.2/sql/sql_select.cc:3790
 
    #18 0x55a59962c938 in handle_select(THD*, LEX*, select_result*, unsigned long) /git/10.2/sql/sql_select.cc:376
 
    #19 0x55a5995b36f3 in execute_sqlcom_select /git/10.2/sql/sql_parse.cc:6477
 
    #20 0x55a5995a0703 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3484
 
    #21 0x55a599602b49 in Prepared_statement::execute(String*, bool) /git/10.2/sql/sql_prepare.cc:4787
 
    #22 0x55a5995fe511 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /git/10.2/sql/sql_prepare.cc:4216
 
    #23 0x55a5995f918b in mysql_sql_stmt_execute(THD*) /git/10.2/sql/sql_prepare.cc:3324
 
    #24 0x55a5995a0748 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3500
 
    #25 0x55a5995bbe58 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.2/sql/sql_parse.cc:8011
 
    #26 0x55a5995973a7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.2/sql/sql_parse.cc:1824
 
    #27 0x55a59959455b in do_command(THD*) /git/10.2/sql/sql_parse.cc:1378
 
    #28 0x55a5998b9aa1 in do_handle_one_connection(CONNECT*) /git/10.2/sql/sql_connect.cc:1335
 
    #29 0x55a5998b94a9 in handle_one_connection /git/10.2/sql/sql_connect.cc:1241
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7fc6291bd253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
 
    #1 0x55a59aa5ecec in spawn_thread_v1 /git/10.2/storage/perfschema/pfs.cc:1912
 
    #2 0x55a5993a3e46 in inline_mysql_thread_create /git/10.2/include/mysql/psi/mysql_thread.h:1239
 
    #3 0x55a5993b806c in create_thread_to_handle_connection(CONNECT*) /git/10.2/sql/mysqld.cc:6454
 
    #4 0x55a5993b876c in create_new_thread /git/10.2/sql/mysqld.cc:6524
 
    #5 0x55a5993b97af in handle_connections_sockets() /git/10.2/sql/mysqld.cc:6799
 
    #6 0x55a5993b75bc in mysqld_main(int, char**) /git/10.2/sql/mysqld.cc:6073
 
    #7 0x55a5993a27df in main /git/10.2/sql/main.cc:25
 
    #8 0x7fc62715482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /git/10.2/sql/item_subselect.cc:4376 subselect_engine::calc_const_tables(List<TABLE_LIST>&)
 
Shadow bytes around the buggy address:
 
  0x0c447ffff330: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447ffff340: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447ffff350: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447ffff360: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447ffff370: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c447ffff380: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447ffff390: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447ffff3a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447ffff3b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447ffff3c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c447ffff3d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
==4378==ABORTING
 
----------SERVER LOG END-------------


 5.5 b68d8a05d326bed43aefa73d717c0307278ca6bb
 
Version: '5.5.63-MariaDB-debug'  socket: '/git/5.5/mysql-test/var/tmp/mysqld.1.sock'  port: 16000  Source distribution
 
=================================================================
 
==4146==ERROR: AddressSanitizer: heap-use-after-free on address 0x621000062195 at pc 0x000000bdc805 bp 0x7f1d7d987b00 sp 0x7f1d7d987af0
 
READ of size 1 at 0x621000062195 thread T15
 
    #0 0xbdc804 in subselect_engine::calc_const_tables(List<TABLE_LIST>&) /git/5.5/sql/item_subselect.cc:3783
 
    #1 0xbdc8a8 in subselect_single_select_engine::upper_select_const_tables() /git/5.5/sql/item_subselect.cc:3792
 
    #2 0xbc1c0d in Item_subselect::update_used_tables() /git/5.5/sql/item_subselect.cc:885
 
    #3 0xb2e737 in Item_func::update_used_tables() /git/5.5/sql/item_func.cc:448
 
    #4 0x66723f in st_select_lex::update_used_tables() /git/5.5/sql/sql_lex.cc:3925
 
    #5 0x75cb89 in JOIN::optimize() /git/5.5/sql/sql_select.cc:1020
 
    #6 0x76a8d7 in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /git/5.5/sql/sql_select.cc:3119
 
    #7 0x76b149 in handle_select(THD*, LEX*, select_result*, unsigned long) /git/5.5/sql/sql_select.cc:323
 
    #8 0x66d464 in execute_sqlcom_select /git/5.5/sql/sql_parse.cc:4678
 
    #9 0x6831a6 in mysql_execute_command(THD*) /git/5.5/sql/sql_parse.cc:2224
 
    #10 0x6c2f22 in Prepared_statement::execute(String*, bool) /git/5.5/sql/sql_prepare.cc:3933
 
    #11 0x6c380a in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /git/5.5/sql/sql_prepare.cc:3591
 
    #12 0x6c4520 in mysql_sql_stmt_execute(THD*) /git/5.5/sql/sql_prepare.cc:2740
 
    #13 0x6831ca in mysql_execute_command(THD*) /git/5.5/sql/sql_parse.cc:2234
 
    #14 0x694e8a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /git/5.5/sql/sql_parse.cc:5923
 
    #15 0x698287 in dispatch_command(enum_server_command, THD*, char*, unsigned int) /git/5.5/sql/sql_parse.cc:1066
 
    #16 0x69c365 in do_command(THD*) /git/5.5/sql/sql_parse.cc:793
 
    #17 0x8ce523 in do_handle_one_connection(THD*) /git/5.5/sql/sql_connect.cc:1268
 
    #18 0x8ce79c in handle_one_connection /git/5.5/sql/sql_connect.cc:1184
 
    #19 0x143c257 in pfs_spawn_thread /git/5.5/storage/perfschema/pfs.cc:1015
 
    #20 0x7f1d8beed6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
 
    #21 0x7f1d8b39441c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)
 
 
 
0x621000062195 is located 2197 bytes inside of 4108-byte region [0x621000061900,0x62100006290c)
 
freed by thread T15 here:
 
    #0 0x7f1d8c5d52ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
 
    #1 0x15033da in free_memory /git/5.5/mysys/safemalloc.c:205
 
 
 
previously allocated by thread T15 here:
 
    #0 0x7f1d8c5d5602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
 
    #1 0x15034d2 in sf_malloc /git/5.5/mysys/safemalloc.c:105
 
 
 
Thread T15 created by T0 here:
 
    #0 0x7f1d8c573253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
 
    #1 0x143f821 in spawn_thread_v1 /git/5.5/storage/perfschema/pfs.cc:1038
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /git/5.5/sql/item_subselect.cc:3783 subselect_engine::calc_const_tables(List<TABLE_LIST>&)
 
Shadow bytes around the buggy address:
 
  0x0c42800043e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c42800043f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4280004400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4280004410: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4280004420: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c4280004430: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4280004440: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4280004450: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4280004460: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4280004470: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4280004480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
==4146==ABORTING
 
----------SERVER LOG END-------------



 Comments   
Comment by Roel Van de Paar [ 2023-02-24 ]

Closing this bug as 10.2 is EOL and 10.3+ confirmed not reproducible

Generated at Thu Feb 08 08:37:49 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.