[MDEV-18734] ASAN heap-use-after-free upon sorting by blob column from partitioned table Created: 2019-02-25  Updated: 2021-08-18  Resolved: 2021-08-07

Status: Closed
Project: MariaDB Server
Component/s: Data Manipulation - Update, Partitioning, Virtual Columns
Affects Version/s: 10.2, 10.3, 10.4
Fix Version/s: 10.2.41, 10.3.32, 10.4.22, 10.5.13, 10.6.5

Type: Bug Priority: Critical
Reporter: Elena Stepanova Assignee: Aleksey Midenkov
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-18957 UPDATE with LIMIT clause is wrong for... Closed
relates to MDEV-18414 Server crash or ASAN heap-use-after-f... Closed

 Description   

ASAN heap-use-after-free in my_strnxfrm_simple_internal upon update on versioned partitioned table.

--source include/have_partition.inc
 
 
 
CREATE TABLE t1 ( 
  pk INT AUTO_INCREMENT,
 
  b TINYTEXT DEFAULT '',
 
  i INT,
 
  v TEXT AS (b) VIRTUAL,
 
  PRIMARY KEY(pk)
 
) WITH SYSTEM VERSIONING PARTITION BY system_time LIMIT 100 ( PARTITION p1 HISTORY, PARTITION pn CURRENT );
 
 
 
INSERT INTO t1 (pk) VALUES (NULL),(NULL),(NULL),(NULL);
 
UPDATE t1 SET b = 'foo' WHERE pk = 3;
 
REPLACE INTO t1 (pk, b, i) SELECT pk, b, i FROM t1;
 
INSERT INTO t1 (pk) VALUES (NULL);
 
UPDATE t1 SET i = 10 WHERE pk < 20 ORDER BY v LIMIT 2;
 
 
 
# Cleanup
 
DROP TABLE t1;

10.4 09bd2138

 
==6107==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000260f0 at pc 0x560b15b508f0 bp 0x7f656fcd5e10 sp 0x7f656fcd5e08
 
READ of size 1 at 0x60c0000260f0 thread T5
 
    #0 0x560b15b508ef in my_strnxfrm_simple_internal /data/src/10.3/strings/ctype-simple.c:87
 
    #1 0x560b15b50ace in my_strnxfrm_simple /data/src/10.3/strings/ctype-simple.c:105
 
    #2 0x560b1497107f in Field_blob::sort_string(unsigned char*, unsigned int) /data/src/10.3/sql/field.cc:8578
 
    #3 0x560b1490ea56 in Field::make_sort_key(unsigned char*, unsigned int) /data/src/10.3/sql/field.cc:1018
 
    #4 0x560b149b0377 in make_sortkey /data/src/10.3/sql/filesort.cc:1165
 
    #5 0x560b149b7a45 in Bounded_queue<unsigned char, unsigned char>::push(unsigned char*) (/data/bld/10.3-asan/bin/mysqld+0x1566a45)
 
    #6 0x560b149adb9f in find_all_keys /data/src/10.3/sql/filesort.cc:832
 
    #7 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
 
    #8 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672
 
    #9 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
 
    #10 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
 
    #11 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
 
    #12 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
 
    #13 0x560b1460b861 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #14 0x560b1460b26d in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309
 
    #15 0x560b15140349 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #16 0x7f657c2ad493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #17 0x7f657a69393e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x60c0000260f0 is located 112 bytes inside of 124-byte region [0x60c000026080,0x60c0000260fc)
 
freed by thread T5 here:
 
    #0 0x7f657c517527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
 
    #1 0x560b15af026f in free_memory /data/src/10.3/mysys/safemalloc.c:279
 
    #2 0x560b15aef875 in sf_free /data/src/10.3/mysys/safemalloc.c:197
 
    #3 0x560b15ac02be in my_free /data/src/10.3/mysys/my_malloc.c:223
 
    #4 0x560b14027585 in String::free() /data/src/10.3/sql/sql_string.h:358
 
    #5 0x560b1406c285 in String::set(char const*, unsigned long, charset_info_st const*) /data/src/10.3/sql/sql_string.h:278
 
    #6 0x560b1496e849 in Field_blob::val_str(String*, String*) /data/src/10.3/sql/field.cc:8357
 
    #7 0x560b1404d01b in Field::val_str(String*) /data/src/10.3/sql/field.h:840
 
    #8 0x560b149974da in Field_blob::store_field(Field*) /data/src/10.3/sql/field.h:3631
 
    #9 0x560b149a5967 in field_conv_incompatible /data/src/10.3/sql/field_conv.cc:836
 
    #10 0x560b149a5a04 in field_conv(Field*, Field*) /data/src/10.3/sql/field_conv.cc:849
 
    #11 0x560b14a2b6a4 in save_field_in_field /data/src/10.3/sql/item.cc:6708
 
    #12 0x560b14a2bd00 in Item_field::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6759
 
    #13 0x560b14571036 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.3/sql/table.cc:7814
 
    #14 0x560b149cde63 in handler::ha_index_next(unsigned char*) /data/src/10.3/sql/handler.cc:2928
 
    #15 0x560b149e05db in handler::read_range_next() /data/src/10.3/sql/handler.cc:5702
 
    #16 0x560b146a996f in handler::multi_range_read_next(void**) /data/src/10.3/sql/multi_range_read.cc:271
 
    #17 0x560b146aa060 in Mrr_simple_index_reader::get_next(void**) /data/src/10.3/sql/multi_range_read.cc:336
 
    #18 0x560b146b3182 in DsMrr_impl::dsmrr_next(void**) /data/src/10.3/sql/multi_range_read.cc:1406
 
    #19 0x560b158b3be3 in ha_myisam::multi_range_read_next(void**) /data/src/10.3/storage/myisam/ha_myisam.cc:2495
 
    #20 0x560b15a2e543 in ha_partition::handle_ordered_next(unsigned char*, bool) /data/src/10.3/sql/ha_partition.cc:7824
 
    #21 0x560b15a225fb in ha_partition::multi_range_read_next(void**) /data/src/10.3/sql/ha_partition.cc:6486
 
    #22 0x560b14d4a2d2 in QUICK_RANGE_SELECT::get_next() /data/src/10.3/sql/opt_range.cc:11470
 
    #23 0x560b149ad646 in find_all_keys /data/src/10.3/sql/filesort.cc:776
 
    #24 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
 
    #25 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672
 
    #26 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
 
    #27 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
 
    #28 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
 
    #29 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
 
 
 
previously allocated by thread T5 here:
 
    #0 0x7f657c51773f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
 
    #1 0x560b15aeefe5 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
 
    #2 0x560b15abf8e0 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
 
    #3 0x560b14488f2b in String::realloc_raw(unsigned long) /data/src/10.3/sql/sql_string.cc:101
 
    #4 0x560b140276ac in String::realloc(unsigned long) /data/src/10.3/sql/sql_string.h:374
 
    #5 0x560b14489d45 in String::copy() /data/src/10.3/sql/sql_string.cc:212
 
    #6 0x560b149975e3 in Field_blob::store_field(Field*) /data/src/10.3/sql/field.h:3634
 
    #7 0x560b149a5967 in field_conv_incompatible /data/src/10.3/sql/field_conv.cc:836
 
    #8 0x560b149a5a04 in field_conv(Field*, Field*) /data/src/10.3/sql/field_conv.cc:849
 
    #9 0x560b14a2b6a4 in save_field_in_field /data/src/10.3/sql/item.cc:6708
 
    #10 0x560b14a2bd00 in Item_field::save_in_field(Field*, bool) /data/src/10.3/sql/item.cc:6759
 
    #11 0x560b14571036 in TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) /data/src/10.3/sql/table.cc:7814
 
    #12 0x560b149cde63 in handler::ha_index_next(unsigned char*) /data/src/10.3/sql/handler.cc:2928
 
    #13 0x560b149e05db in handler::read_range_next() /data/src/10.3/sql/handler.cc:5702
 
    #14 0x560b146a996f in handler::multi_range_read_next(void**) /data/src/10.3/sql/multi_range_read.cc:271
 
    #15 0x560b146aa060 in Mrr_simple_index_reader::get_next(void**) /data/src/10.3/sql/multi_range_read.cc:336
 
    #16 0x560b146b3182 in DsMrr_impl::dsmrr_next(void**) /data/src/10.3/sql/multi_range_read.cc:1406
 
    #17 0x560b158b3be3 in ha_myisam::multi_range_read_next(void**) /data/src/10.3/storage/myisam/ha_myisam.cc:2495
 
    #18 0x560b15a2e543 in ha_partition::handle_ordered_next(unsigned char*, bool) /data/src/10.3/sql/ha_partition.cc:7824
 
    #19 0x560b15a225fb in ha_partition::multi_range_read_next(void**) /data/src/10.3/sql/ha_partition.cc:6486
 
    #20 0x560b14d4a2d2 in QUICK_RANGE_SELECT::get_next() /data/src/10.3/sql/opt_range.cc:11470
 
    #21 0x560b149ad646 in find_all_keys /data/src/10.3/sql/filesort.cc:776
 
    #22 0x560b149a9ef5 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.3/sql/filesort.cc:278
 
    #23 0x560b1451032a in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.3/sql/sql_update.cc:672
 
    #24 0x560b142aa58b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4584
 
    #25 0x560b142c0fa2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8095
 
    #26 0x560b1429b07a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1854
 
    #27 0x560b1429808c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
 
    #28 0x560b1460b861 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #29 0x560b1460b26d in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1309
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7f657c4e6bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x560b15140911 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
 
    #2 0x560b14002c08 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
 
    #3 0x560b14018d9a in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6573
 
    #4 0x560b1401949f in create_new_thread /data/src/10.3/sql/mysqld.cc:6643
 
    #5 0x560b1401a4b6 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6918
 
    #6 0x560b14018257 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6195
 
    #7 0x560b14000c8f in main /data/src/10.3/sql/main.cc:25
 
    #8 0x7f657a5cb2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/strings/ctype-simple.c:87 my_strnxfrm_simple_internal
 
Shadow bytes around the buggy address:
 
  0x0c187fffcbc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c187fffcbd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c187fffcbe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
 
  0x0c187fffcbf0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 
  0x0c187fffcc00: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
 
=>0x0c187fffcc10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
 
  0x0c187fffcc20: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
  0x0c187fffcc30: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
 
  0x0c187fffcc40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c187fffcc50: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
  0x0c187fffcc60: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
==6107==ABORTING

Or with valgrind:

==6629== Invalid read of size 1
 
==6629==    at 0x1303139: my_strnxfrm_simple_internal (ctype-simple.c:87)
 
==6629==    by 0x13031FD: my_strnxfrm_simple (ctype-simple.c:105)
 
==6629==    by 0xAAD2FC: Field_blob::sort_string(unsigned char*, unsigned int) (field.cc:8578)
 
==6629==    by 0xA8B34F: Field::make_sort_key(unsigned char*, unsigned int) (field.cc:1018)
 
==6629==    by 0xAC6991: make_sortkey(Sort_param*, unsigned char*, unsigned char*) (filesort.cc:1165)
 
==6629==    by 0xAC98E6: Bounded_queue<unsigned char, unsigned char>::push(unsigned char*) (bounded_queue.h:184)
 
==6629==    by 0xAC5A97: find_all_keys(THD*, Sort_param*, SQL_SELECT*, SORT_INFO*, st_io_cache*, st_io_cache*, Bounded_queue<unsigned char, unsigned char>*, unsigned long long*) (filesort.cc:832)
 
==6629==    by 0xAC3E00: filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) (filesort.cc:278)
 
==6629==    by 0x8C0655: mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) (sql_update.cc:672)
 
==6629==    by 0x7C5FC8: mysql_execute_command(THD*) (sql_parse.cc:4584)
 
==6629==    by 0x7D14E4: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:8095)
 
==6629==    by 0x7BE54C: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1854)
 
==6629==    by 0x7BCF24: do_command(THD*) (sql_parse.cc:1396)
 
==6629==    by 0x92B078: do_handle_one_connection(CONNECT*) (sql_connect.cc:1403)
 
==6629==    by 0x92ADFC: handle_one_connection (sql_connect.cc:1309)
 
==6629==    by 0xDE91AA: pfs_spawn_thread (pfs.cc:1862)
 
==6629==  Address 0xd9c92a8 is 8 bytes inside a block of size 16 free'd
 
==6629==    at 0x4C2CDDB: free (vg_replace_malloc.c:530)
 
==6629==    by 0x12C442D: my_free (my_malloc.c:223)
 
==6629==    by 0x6A7D12: String::free() (sql_string.h:358)
 
==6629==    by 0x6C6A19: String::set(char const*, unsigned long, charset_info_st const*) (sql_string.h:278)
 
==6629==    by 0xAAC726: Field_blob::val_str(String*, String*) (field.cc:8357)
 
==6629==    by 0x6B85C0: Field::val_str(String*) (field.h:840)
 
==6629==    by 0xABCA46: Field_blob::store_field(Field*) (field.h:3631)
 
==6629==    by 0xAC1C5E: field_conv_incompatible(Field*, Field*) (field_conv.cc:836)
 
==6629==    by 0xAC1CBA: field_conv(Field*, Field*) (field_conv.cc:849)
 
==6629==    by 0xAF6C93: save_field_in_field(Field*, bool*, Field*, bool) (item.cc:6708)
 
==6629==    by 0xAF6ED5: Item_field::save_in_field(Field*, bool) (item.cc:6759)
 
==6629==    by 0x8E6B02: TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) (table.cc:7814)
 
==6629==    by 0xAD29B1: handler::ha_index_next(unsigned char*) (handler.cc:2928)
 
==6629==    by 0xAD98B9: handler::read_range_next() (handler.cc:5702)
 
==6629==    by 0x97B559: handler::multi_range_read_next(void**) (multi_range_read.cc:271)
 
==6629==    by 0x97B7F1: Mrr_simple_index_reader::get_next(void**) (multi_range_read.cc:336)
 
==6629==  Block was alloc'd at
 
==6629==    at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
 
==6629==    by 0x12C3CB3: my_malloc (my_malloc.c:101)
 
==6629==    by 0x886C97: String::realloc_raw(unsigned long) (sql_string.cc:101)
 
==6629==    by 0x6A7D66: String::realloc(unsigned long) (sql_string.h:374)
 
==6629==    by 0x8871A3: String::copy() (sql_string.cc:212)
 
==6629==    by 0xABCAB1: Field_blob::store_field(Field*) (field.h:3634)
 
==6629==    by 0xAC1C5E: field_conv_incompatible(Field*, Field*) (field_conv.cc:836)
 
==6629==    by 0xAC1CBA: field_conv(Field*, Field*) (field_conv.cc:849)
 
==6629==    by 0xAF6C93: save_field_in_field(Field*, bool*, Field*, bool) (item.cc:6708)
 
==6629==    by 0xAF6ED5: Item_field::save_in_field(Field*, bool) (item.cc:6759)
 
==6629==    by 0x8E6B02: TABLE::update_virtual_fields(handler*, enum_vcol_update_mode) (table.cc:7814)
 
==6629==    by 0xAD29B1: handler::ha_index_next(unsigned char*) (handler.cc:2928)
 
==6629==    by 0xAD98B9: handler::read_range_next() (handler.cc:5702)
 
==6629==    by 0x97B559: handler::multi_range_read_next(void**) (multi_range_read.cc:271)
 
==6629==    by 0x97B7F1: Mrr_simple_index_reader::get_next(void**) (multi_range_read.cc:336)
 
==6629==    by 0x97E441: DsMrr_impl::dsmrr_next(void**) (multi_range_read.cc:1406)

Not reproducible on 10.4.

 Comments   
Comment by Aleksey Midenkov [ 2019-03-18 ]

Also affected by MDEV-18957.

Comment by Aleksey Midenkov [ 2019-03-18 ]

Reproducible without System Versioning:

create or replace table t1 (x int primary key, b tinytext, v text as (b) virtual)
 
partition by range columns (x) (
 
  partition p1 values less than (4),
 
  partition pn values less than (maxvalue));
 
insert into t1 (x, b) values (1, ''), (2, ''), (3, 'a'), (4, 'b');
 
update t1 set b= 'bar' where x > 0 order by v limit 2;

Cause

update_virtual_fields() reallocates Field_blob::value buffer while its address may go to m_ordered_rec_buffer as part of a record. When the record is restored from m_ordered_rec_buffer via return_top_record(), this value address may be already freed.

Fix

Do update_virtual_fields() after record is restored from m_ordered_rec_buffer.

More investigation

Comment by Aleksey Midenkov [ 2020-08-17 ]

Investigation

Comment by Sergei Golubchik [ 2021-07-26 ]

bb-10.2-midenok-MDEV-18734 as of 50dcbf14e1de is ok to push!

Generated at Thu Feb 08 08:46:20 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.