[MDEV-22695] Server crashes in heap_rnext upon DELETE from a HEAP table Created: 2020-05-25  Updated: 2023-04-27

Status: Confirmed
Project: MariaDB Server
Component/s: Storage Engine - Memory
Affects Version/s: 5.5, 10.1, 10.2, 10.3, 10.4, 10.5, 10.6, 10.7
Fix Version/s: 10.4, 10.5, 10.6

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Oleksandr Byelkin
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-28130 MariaDB SEGV issue at tree_search_next Confirmed

 Description    

CREATE TABLE t1 (a VARCHAR(128), b VARCHAR(32), KEY(a) USING BTREE, KEY(b) USING BTREE) ENGINE=HEAP;
 
INSERT INTO t1 VALUES ('foo',NULL),('m','b'),(6,'j'),('bar','qux'),(NULL,NULL);
 
DELETE FROM t1 WHERE a <=> 'm' OR b <=> NULL;
 
 
 
# Cleanup
 
DROP TABLE t1;

10.1 debug cb9c49a9

 
#3  <signal handler called>
 
#4  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:325
 
#5  0x000056475c1759c9 in heap_rnext (info=0x7f0a4489d970, record=0x7f0a4489c588 "\374\001moo") at /data/src/10.1/storage/heap/hp_rnext.c:127
 
#6  0x000056475c17000c in ha_heap::index_next (this=0x7f0a44a77808, buf=0x7f0a4489c588 "\374\001moo") at /data/src/10.1/storage/heap/ha_heap.cc:317
 
#7  0x000056475bfd95e1 in handler::index_next_same (this=0x7f0a44a77808, buf=0x7f0a4489c588 "\374\001moo", key=0x7f0a44a77350 "\001", keylen=35) at /data/src/10.1/sql/handler.cc:4547
 
#8  0x000056475bfd6183 in handler::ha_index_next_same (this=0x7f0a44a77808, buf=0x7f0a4489c588 "\374\001moo", key=0x7f0a44a77350 "\001", keylen=35) at /data/src/10.1/sql/handler.cc:2799
 
#9  0x000056475bfdb996 in handler::read_range_next (this=0x7f0a44a77808) at /data/src/10.1/sql/handler.cc:5431
 
#10 0x000056475bf126cf in handler::multi_range_read_next (this=0x7f0a44a77808, range_info=0x7f0a4f183188) at /data/src/10.1/sql/multi_range_read.cc:257
 
#11 0x000056475c10346e in QUICK_RANGE_SELECT::get_next (this=0x7f0a4499f280) at /data/src/10.1/sql/opt_range.cc:11293
 
#12 0x000056475c102dfd in QUICK_ROR_UNION_SELECT::get_next (this=0x7f0a44a73100) at /data/src/10.1/sql/opt_range.cc:11160
 
#13 0x000056475c113537 in rr_quick (info=0x7f0a4f1833d0) at /data/src/10.1/sql/records.cc:350
 
#14 0x000056475c12abc4 in mysql_delete (thd=0x7f0a467cb070, table_list=0x7f0a448f6190, conds=0x7f0a448f6d70, order_list=0x7f0a467cf528, limit=18446744073709551613, options=0, result=0x0) at /data/src/10.1/sql/sql_delete.cc:570
 
#15 0x000056475bd94c45 in mysql_execute_command (thd=0x7f0a467cb070) at /data/src/10.1/sql/sql_parse.cc:3869
 
#16 0x000056475bd9f15c in mysql_parse (thd=0x7f0a467cb070, rawbuf=0x7f0a448f6088 "DELETE FROM t1 WHERE a <=> 'm' OR b <=> NULL", length=44, parser_state=0x7f0a4f1845f0) at /data/src/10.1/sql/sql_parse.cc:7208
 
#17 0x000056475bd8e332 in dispatch_command (command=COM_QUERY, thd=0x7f0a467cb070, packet=0x7f0a487ee071 "DELETE FROM t1 WHERE a <=> 'm' OR b <=> NULL", packet_length=44) at /data/src/10.1/sql/sql_parse.cc:1499
 
#18 0x000056475bd8d217 in do_command (thd=0x7f0a467cb070) at /data/src/10.1/sql/sql_parse.cc:1131
 
#19 0x000056475beca4e1 in do_handle_one_connection (thd_arg=0x7f0a467cb070) at /data/src/10.1/sql/sql_connect.cc:1331
 
#20 0x000056475beca212 in handle_one_connection (arg=0x7f0a467cb070) at /data/src/10.1/sql/sql_connect.cc:1242
 
#21 0x000056475c2e7e3a in pfs_spawn_thread (arg=0x7f0a4cc39c70) at /data/src/10.1/storage/perfschema/pfs.cc:1868
 
#22 0x00007f0a4ee074a4 in start_thread (arg=0x7f0a4f185700) at pthread_create.c:456
 
#23 0x00007f0a4d615d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

Release build doesn't crash on my machine, but both debug and non-debug builds with ASAN throw heap-use-after-free errors:

10.1 cb9c49a9 non-debug with ASAN

 
==20111==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000003b60 at pc 0x55ed6a9b254f bp 0x7f93f5e898d0 sp 0x7f93f5e898c8
 
READ of size 8 at 0x604000003b60 thread T6
 
    #0 0x55ed6a9b254e in tree_search_next /data/src/10.1/mysys/tree.c:474
 
    #1 0x55ed6a1c1ea4 in heap_rnext /data/src/10.1/storage/heap/hp_rnext.c:56
 
    #2 0x55ed6a1b6d6a in ha_heap::index_next(unsigned char*) /data/src/10.1/storage/heap/ha_heap.cc:317
 
    #3 0x55ed69df2710 in handler::index_next_same(unsigned char*, unsigned char const*, unsigned int) /data/src/10.1/sql/handler.cc:4547
 
    #4 0x55ed69e01052 in handler::ha_index_next_same(unsigned char*, unsigned char const*, unsigned int) /data/src/10.1/sql/handler.cc:2799
 
    #5 0x55ed69e0b4a5 in handler::read_range_next() /data/src/10.1/sql/handler.cc:5431
 
    #6 0x55ed69c987fa in handler::multi_range_read_next(void**) /data/src/10.1/sql/multi_range_read.cc:257
 
    #7 0x55ed6a097bce in QUICK_RANGE_SELECT::get_next() /data/src/10.1/sql/opt_range.cc:11293
 
    #8 0x55ed6a09c772 in QUICK_ROR_UNION_SELECT::get_next() /data/src/10.1/sql/opt_range.cc:11160
 
    #9 0x55ed6a0e7397 in rr_quick /data/src/10.1/sql/records.cc:350
 
    #10 0x55ed6a11af7d in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /data/src/10.1/sql/sql_delete.cc:570
 
    #11 0x55ed699ac147 in mysql_execute_command(THD*) /data/src/10.1/sql/sql_parse.cc:3869
 
    #12 0x55ed699b8359 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.1/sql/sql_parse.cc:7208
 
    #13 0x55ed699be884 in dispatch_command(enum_server_command, THD*, char*, unsigned int) /data/src/10.1/sql/sql_parse.cc:1499
 
    #14 0x55ed699c36ac in do_command(THD*) /data/src/10.1/sql/sql_parse.cc:1131
 
    #15 0x55ed69c1824a in do_handle_one_connection(THD*) /data/src/10.1/sql/sql_connect.cc:1331
 
    #16 0x55ed69c187d0 in handle_one_connection /data/src/10.1/sql/sql_connect.cc:1242
 
    #17 0x55ed6a4344d7 in pfs_spawn_thread /data/src/10.1/storage/perfschema/pfs.cc:1868
 
    #18 0x7f94016bd4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
 
    #19 0x7f93ffecbd0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)
 
 
 
0x604000003b60 is located 16 bytes inside of 48-byte region [0x604000003b50,0x604000003b80)
 
freed by thread T6 here:
 
    #0 0x7f9401994a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)
 
    #1 0x55ed6a9991da in my_free /data/src/10.1/mysys/my_malloc.c:218
 
 
 
previously allocated by thread T6 here:
 
    #0 0x7f9401994d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
 
    #1 0x55ed6a998ff8 in my_malloc /data/src/10.1/mysys/my_malloc.c:101
 
 
 
Thread T6 created by T0 here:
 
    #0 0x7f9401903f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
 
    #1 0x55ed6a43e9e6 in spawn_thread_v1 /data/src/10.1/storage/perfschema/pfs.cc:1918
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.1/mysys/tree.c:474 in tree_search_next
 
Shadow bytes around the buggy address:
 
  0x0c087fff8710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c087fff8720: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
 
  0x0c087fff8730: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
 
  0x0c087fff8740: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
 
  0x0c087fff8750: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
 
=>0x0c087fff8760: fa fa 00 00 00 00 00 00 fa fa fd fd[fd]fd fd fd
 
  0x0c087fff8770: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00
 
  0x0c087fff8780: fa fa 00 00 00 00 00 00 fa fa fd fd fd fd fd fd
 
  0x0c087fff8790: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 fa
 
  0x0c087fff87a0: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 fa
 
  0x0c087fff87b0: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
==20111==ABORTING

All of 5.5-10.5 are affected, debug- and non-debug builds as described above.
Generated at Thu Feb 08 09:16:44 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.