[MDEV-28270] ASAN heap-use-after-free in my_strnncoll_binary / l_find / xid_cache_search Created: 2022-04-08  Updated: 2023-08-24  Resolved: 2023-08-24

Status: Closed
Project: MariaDB Server
Component/s: XA
Affects Version/s: 10.2, 10.3
Fix Version/s: N/A

Type: Bug Priority: Minor
Reporter: Elena Stepanova Assignee: Unassigned
Resolution: Won't Fix Votes: 0
Labels: not-10.4, not-10.5, not-10.6, not-10.7, not-10.8


 Description   

Set to minor because only old versions are affected, and the use case is not of practical importance.

Run with --mysqld=--thread-handling=pool-of-threads.

--source include/have_innodb.inc
 
--source include/have_pool_of_threads.inc
 
 
 
CREATE TABLE t (pk INT PRIMARY KEY) ENGINE=InnoDB;
 
SET GLOBAL custom_cache.key_buffer_size = 65536;
 
 
 
--connect (con1,localhost,root,,test)
 
XA START 'xid';
 
SET STATEMENT MAX_STATEMENT_TIME= 0.000001 FOR CACHE INDEX t IN custom_cache;
 
SELECT * FROM t;
 
--disconnect con1
 
 
 
--connection default
 
--error ER_XAER_NOTA
 
XA ROLLBACK 'xid';
 
 
 
# Cleanup
 
DROP TABLE t;

10.2 5a8766a9

 
==3621429==ERROR: AddressSanitizer: heap-use-after-free on address 0x62a0000c3360 at pc 0x7f2e615db039 bp 0x7f2e4996f110 sp 0x7f2e4996e8c0
 
READ of size 19 at 0x62a0000c3360 thread T31
 
    #0 0x7f2e615db038 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:839
 
    #1 0x7f2e615db648 in __interceptor_memcmp ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:871
 
    #2 0x7f2e615db648 in __interceptor_memcmp ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:866
 
    #3 0x55ac2eb9fb6b in my_strnncoll_binary /data/src/10.2/strings/ctype-bin.c:85
 
    #4 0x55ac2eb7784b in l_find /data/src/10.2/mysys/lf_hash.c:136
 
    #5 0x55ac2eb79614 in l_search /data/src/10.2/mysys/lf_hash.c:289
 
    #6 0x55ac2eb79614 in lf_hash_search_using_hash_value /data/src/10.2/mysys/lf_hash.c:491
 
    #7 0x55ac2d5664f2 in xid_cache_search(THD*, xid_t*) /data/src/10.2/sql/sql_class.cc:5562
 
    #8 0x55ac2d944b14 in trans_xa_rollback(THD*) /data/src/10.2/sql/transaction.cc:1001
 
    #9 0x55ac2d616ee5 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:5902
 
    #10 0x55ac2d621d87 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7793
 
    #11 0x55ac2d6281ce in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
 
    #12 0x55ac2d62c06d in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
 
    #13 0x55ac2d9dd9f0 in threadpool_process_request /data/src/10.2/sql/threadpool_common.cc:375
 
    #14 0x55ac2d9dd9f0 in tp_callback(TP_connection*) /data/src/10.2/sql/threadpool_common.cc:191
 
    #15 0x55ac2dafd0ad in worker_main /data/src/10.2/sql/threadpool_generic.cc:1612
 
    #16 0x55ac2eaa0144 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
 
    #17 0x7f2e61082ea6 in start_thread nptl/pthread_create.c:477
 
    #18 0x7f2e60c87dee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfddee)
 
 
 
0x62a0000c3360 is located 12640 bytes inside of 21872-byte region [0x62a0000c0200,0x62a0000c5770)
 
freed by thread T33 here:
 
    #0 0x7f2e615f9b6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123
 
    #1 0x55ac2d9dd666 in threadpool_remove_connection /data/src/10.2/sql/threadpool_common.cc:301
 
    #2 0x55ac2d9ddd68 in tp_callback(TP_connection*) /data/src/10.2/sql/threadpool_common.cc:215
 
    #3 0x55ac2dafd0ad in worker_main /data/src/10.2/sql/threadpool_generic.cc:1612
 
    #4 0x55ac2eaa0144 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
 
    #5 0x7f2e61082ea6 in start_thread nptl/pthread_create.c:477
 
 
 
previously allocated by thread T32 here:
 
    #0 0x7f2e615f9e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
 
    #1 0x55ac2eb58702 in my_malloc /data/src/10.2/mysys/my_malloc.c:101
 
    #2 0x55ac2d90e8ee in ilink::operator new(unsigned long) /data/src/10.2/sql/sql_list.h:664
 
    #3 0x55ac2d90e8ee in CONNECT::create_thd(THD*) /data/src/10.2/sql/sql_connect.cc:1440
 
    #4 0x55ac2d9ddeec in threadpool_add_connection /data/src/10.2/sql/threadpool_common.cc:233
 
    #5 0x55ac2d9ddeec in tp_callback(TP_connection*) /data/src/10.2/sql/threadpool_common.cc:183
 
    #6 0x55ac2dafd0ad in worker_main /data/src/10.2/sql/threadpool_generic.cc:1612
 
    #7 0x55ac2eaa0144 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
 
    #8 0x7f2e61082ea6 in start_thread nptl/pthread_create.c:477
 
 
 
Thread T31 created by T30 here:
 
    #0 0x7f2e615a52a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
 
    #1 0x55ac2eaa53ca in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
 
    #2 0x55ac2daf6c5a in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
 
    #3 0x55ac2daf6c5a in create_worker /data/src/10.2/sql/threadpool_generic.cc:955
 
    #4 0x55ac2dafd91f in wait_begin(thread_group_t*) /data/src/10.2/sql/threadpool_generic.cc:1351
 
    #5 0x55ac2ec07d5d in vio_io_wait /data/src/10.2/vio/viosocket.c:940
 
    #6 0x55ac2ec0814a in vio_socket_io_wait /data/src/10.2/vio/viosocket.c:108
 
    #7 0x55ac2ec08489 in vio_read /data/src/10.2/vio/viosocket.c:184
 
    #8 0x55ac2d4334d3 in my_real_read /data/src/10.2/sql/net_serv.cc:905
 
    #9 0x55ac2d436306 in my_net_read_packet_reallen /data/src/10.2/sql/net_serv.cc:1175
 
    #10 0x55ac2d43678f in my_net_read_packet /data/src/10.2/sql/net_serv.cc:1159
 
    #11 0x55ac2d4e3987 in server_mpvio_read_packet /data/src/10.2/sql/sql_acl.cc:13064
 
    #12 0x55ac2d4b909e in native_password_authenticate /data/src/10.2/sql/sql_acl.cc:13687
 
    #13 0x55ac2d4b57a1 in do_auth_once /data/src/10.2/sql/sql_acl.cc:13240
 
    #14 0x55ac2d4fe641 in acl_authenticate(THD*, unsigned int) /data/src/10.2/sql/sql_acl.cc:13338
 
    #15 0x55ac2d908bce in check_connection /data/src/10.2/sql/sql_connect.cc:1004
 
    #16 0x55ac2d90c50f in login_connection(THD*) /data/src/10.2/sql/sql_connect.cc:1073
 
    #17 0x55ac2d90e3b6 in thd_prepare_connection(THD*) /data/src/10.2/sql/sql_connect.cc:1249
 
    #18 0x55ac2d9de325 in threadpool_add_connection /data/src/10.2/sql/threadpool_common.cc:273
 
    #19 0x55ac2d9de325 in tp_callback(TP_connection*) /data/src/10.2/sql/threadpool_common.cc:183
 
    #20 0x55ac2dafd0ad in worker_main /data/src/10.2/sql/threadpool_generic.cc:1612
 
    #21 0x55ac2eaa0144 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
 
    #22 0x7f2e61082ea6 in start_thread nptl/pthread_create.c:477
 
 
 
Thread T30 created by T0 here:
 
    #0 0x7f2e615a52a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
 
    #1 0x55ac2eaa53ca in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
 
    #2 0x55ac2daf6c5a in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
 
    #3 0x55ac2daf6c5a in create_worker /data/src/10.2/sql/threadpool_generic.cc:955
 
    #4 0x55ac2daf8157 in queue_put /data/src/10.2/sql/threadpool_generic.cc:1189
 
    #5 0x55ac2daf8157 in TP_pool_generic::add(TP_connection*) /data/src/10.2/sql/threadpool_generic.cc:1394
 
    #6 0x55ac2d42e24c in create_new_thread /data/src/10.2/sql/mysqld.cc:6645
 
    #7 0x55ac2d42e24c in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6903
 
    #8 0x55ac2d43077f in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6194
 
    #9 0x7f2e60bb0d09 in __libc_start_main ../csu/libc-start.c:308
 
 
 
Thread T33 created by T32 here:
 
    #0 0x7f2e615a52a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
 
    #1 0x55ac2eaa53ca in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
 
    #2 0x55ac2daf6c5a in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
 
    #3 0x55ac2daf6c5a in create_worker /data/src/10.2/sql/threadpool_generic.cc:955
 
    #4 0x55ac2dafd91f in wait_begin(thread_group_t*) /data/src/10.2/sql/threadpool_generic.cc:1351
 
    #5 0x55ac2ec07d5d in vio_io_wait /data/src/10.2/vio/viosocket.c:940
 
    #6 0x55ac2ec0814a in vio_socket_io_wait /data/src/10.2/vio/viosocket.c:108
 
    #7 0x55ac2ec08489 in vio_read /data/src/10.2/vio/viosocket.c:184
 
    #8 0x55ac2d4334d3 in my_real_read /data/src/10.2/sql/net_serv.cc:905
 
    #9 0x55ac2d436306 in my_net_read_packet_reallen /data/src/10.2/sql/net_serv.cc:1175
 
    #10 0x55ac2d43678f in my_net_read_packet /data/src/10.2/sql/net_serv.cc:1159
 
    #11 0x55ac2d4e3987 in server_mpvio_read_packet /data/src/10.2/sql/sql_acl.cc:13064
 
    #12 0x55ac2d4b909e in native_password_authenticate /data/src/10.2/sql/sql_acl.cc:13687
 
    #13 0x55ac2d4b57a1 in do_auth_once /data/src/10.2/sql/sql_acl.cc:13240
 
    #14 0x55ac2d4fe641 in acl_authenticate(THD*, unsigned int) /data/src/10.2/sql/sql_acl.cc:13338
 
    #15 0x55ac2d908bce in check_connection /data/src/10.2/sql/sql_connect.cc:1004
 
    #16 0x55ac2d90c50f in login_connection(THD*) /data/src/10.2/sql/sql_connect.cc:1073
 
    #17 0x55ac2d90e3b6 in thd_prepare_connection(THD*) /data/src/10.2/sql/sql_connect.cc:1249
 
    #18 0x55ac2d9de325 in threadpool_add_connection /data/src/10.2/sql/threadpool_common.cc:273
 
    #19 0x55ac2d9de325 in tp_callback(TP_connection*) /data/src/10.2/sql/threadpool_common.cc:183
 
    #20 0x55ac2dafd0ad in worker_main /data/src/10.2/sql/threadpool_generic.cc:1612
 
    #21 0x55ac2eaa0144 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
 
    #22 0x7f2e61082ea6 in start_thread nptl/pthread_create.c:477
 
 
 
Thread T32 created by T0 here:
 
    #0 0x7f2e615a52a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
 
    #1 0x55ac2eaa53ca in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
 
    #2 0x55ac2daf6c5a in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
 
    #3 0x55ac2daf6c5a in create_worker /data/src/10.2/sql/threadpool_generic.cc:955
 
    #4 0x55ac2daf8157 in queue_put /data/src/10.2/sql/threadpool_generic.cc:1189
 
    #5 0x55ac2daf8157 in TP_pool_generic::add(TP_connection*) /data/src/10.2/sql/threadpool_generic.cc:1394
 
    #6 0x55ac2d42e24c in create_new_thread /data/src/10.2/sql/mysqld.cc:6645
 
    #7 0x55ac2d42e24c in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6903
 
    #8 0x55ac2d43077f in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6194
 
    #9 0x7f2e60bb0d09 in __libc_start_main ../csu/libc-start.c:308
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:839 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)
 
Shadow bytes around the buggy address:
 
  0x0c5480010610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5480010620: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5480010630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5480010640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5480010650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c5480010660: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
 
  0x0c5480010670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5480010680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5480010690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c54800106a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c54800106b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==3621429==ABORTING

Reproducible on 10.2, 10.3.
Could not reproduce on 10.4-10.8.

 Comments   
Comment by Elena Stepanova [ 2023-08-24 ]

10.3 is EOL

Generated at Thu Feb 08 09:59:25 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.