[MDEV-29124] ASAN errors in st_select_lex::print / With_element::print with optimizer trace on 2nd execution of PS Created: 2022-07-18  Updated: 2023-11-28

Status: Open
Project: MariaDB Server
Component/s: Optimizer, Prepared Statements
Affects Version/s: 10.3, 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10
Fix Version/s: 10.4, 10.5, 10.6

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Sergei Petrunia
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Problem/Incident
is caused by MDEV-26221 my_sys DYNAMIC_ARRAY and DYNAMIC_STRI... Closed

 Description    

CREATE TABLE t (a INT);
 
INSERT INTO t VALUES (1),(2);
 
 
 
SET SESSION optimizer_trace = 'enabled=on';
 
 
 
PREPARE stmt FROM 'EXPLAIN EXTENDED WITH cte AS (SELECT CASE a WHEN 2 THEN 0 END AS f FROM t) SELECT * FROM cte';
 
EXECUTE stmt;
 
EXECUTE stmt;
 
 
 
# Cleanup
 
DROP TABLE t;

10.7 c3ddffe2

 
==1813883==ERROR: AddressSanitizer: use-after-poison on address 0x629000097340 at pc 0x562c3c9225b8 bp 0x7fbc220054c0 sp 0x7fbc220054b8
 
READ of size 8 at 0x629000097340 thread T5
 
    #0 0x562c3c9225b7 in st_select_lex::print(THD*, String*, enum_query_type) /data/src/10.7/sql/sql_select.cc:28482
 
    #1 0x562c3c71aade in st_select_lex_unit::print(String*, enum_query_type) /data/src/10.7/sql/sql_lex.cc:3729
 
    #2 0x562c3cd644e5 in With_element::print(THD*, String*, enum_query_type) /data/src/10.7/sql/sql_cte.cc:1701
 
    #3 0x562c3cd64b18 in With_clause::print(THD*, String*, enum_query_type) /data/src/10.7/sql/sql_cte.cc:1657
 
    #4 0x562c3c71aa3c in st_select_lex_unit::print(String*, enum_query_type) /data/src/10.7/sql/sql_lex.cc:3704
 
    #5 0x562c3c78c7d2 in execute_sqlcom_select /data/src/10.7/sql/sql_parse.cc:6218
 
    #6 0x562c3c7b444a in mysql_execute_command(THD*, bool) /data/src/10.7/sql/sql_parse.cc:3943
 
    #7 0x562c3c825ad9 in Prepared_statement::execute(String*, bool) /data/src/10.7/sql/sql_prepare.cc:5221
 
    #8 0x562c3c82634e in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.7/sql/sql_prepare.cc:4644
 
    #9 0x562c3c827071 in mysql_sql_stmt_execute(THD*) /data/src/10.7/sql/sql_prepare.cc:3688
 
    #10 0x562c3c7b1475 in mysql_execute_command(THD*, bool) /data/src/10.7/sql/sql_parse.cc:3959
 
    #11 0x562c3c7b925a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.7/sql/sql_parse.cc:8027
 
    #12 0x562c3c7be8c4 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/src/10.7/sql/sql_parse.cc:1894
 
    #13 0x562c3c7c42c5 in do_command(THD*, bool) /data/src/10.7/sql/sql_parse.cc:1407
 
    #14 0x562c3cb7b0cd in do_handle_one_connection(CONNECT*, bool) /data/src/10.7/sql/sql_connect.cc:1418
 
    #15 0x562c3cb7b60c in handle_one_connection /data/src/10.7/sql/sql_connect.cc:1312
 
    #16 0x562c3d64ad4b in pfs_spawn_thread /data/src/10.7/storage/perfschema/pfs.cc:2201
 
    #17 0x7fbc2b39dea6 in start_thread nptl/pthread_create.c:477
 
    #18 0x7fbc2af9cdee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfddee)
 
 
 
0x629000097340 is located 4416 bytes inside of 16400-byte region [0x629000096200,0x62900009a210)
 
allocated by thread T5 here:
 
    #0 0x7fbc2b8a3e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
 
    #1 0x562c3df3f238 in my_malloc /data/src/10.7/mysys/my_malloc.c:90
 
    #2 0x562c3df2bdeb in reset_root_defaults /data/src/10.7/mysys/my_alloc.c:243
 
    #3 0x562c3c66e673 in THD::init_for_queries() /data/src/10.7/sql/sql_class.cc:1387
 
    #4 0x562c3cb79092 in prepare_new_connection_state(THD*) /data/src/10.7/sql/sql_connect.cc:1240
 
    #5 0x562c3cb79947 in thd_prepare_connection(THD*) /data/src/10.7/sql/sql_connect.cc:1333
 
    #6 0x562c3cb79947 in thd_prepare_connection(THD*) /data/src/10.7/sql/sql_connect.cc:1322
 
    #7 0x562c3cb7b079 in do_handle_one_connection(CONNECT*, bool) /data/src/10.7/sql/sql_connect.cc:1408
 
    #8 0x562c3cb7b60c in handle_one_connection /data/src/10.7/sql/sql_connect.cc:1312
 
    #9 0x562c3d64ad4b in pfs_spawn_thread /data/src/10.7/storage/perfschema/pfs.cc:2201
 
    #10 0x7fbc2b39dea6 in start_thread nptl/pthread_create.c:477
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7fbc2b84f2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
 
    #1 0x562c3d64afc9 in my_thread_create /data/src/10.7/storage/perfschema/my_thread.h:52
 
    #2 0x562c3d64afc9 in pfs_spawn_thread_v1 /data/src/10.7/storage/perfschema/pfs.cc:2252
 
    #3 0x562c3c48a47d in inline_mysql_thread_create /data/src/10.7/include/mysql/psi/mysql_thread.h:1139
 
    #4 0x562c3c48a47d in create_thread_to_handle_connection(CONNECT*) /data/src/10.7/sql/mysqld.cc:6008
 
    #5 0x562c3c496227 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.7/sql/mysqld.cc:6129
 
    #6 0x562c3c496d9f in handle_connections_sockets() /data/src/10.7/sql/mysqld.cc:6253
 
    #7 0x562c3c4986b0 in mysqld_main(int, char**) /data/src/10.7/sql/mysqld.cc:5903
 
    #8 0x7fbc2aec5d09 in __libc_start_main ../csu/libc-start.c:308
 
 
 
SUMMARY: AddressSanitizer: use-after-poison /data/src/10.7/sql/sql_select.cc:28482 in st_select_lex::print(THD*, String*, enum_query_type)
 
Shadow bytes around the buggy address:
 
  0x0c528000ae10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c528000ae20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c528000ae30: 00 00 00 00 00 f7 00 00 f7 00 00 00 00 f7 00 f7
 
  0x0c528000ae40: 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c528000ae50: 00 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00
 
=>0x0c528000ae60: 00 00 00 00 00 00 00 00[f7]00 00 00 00 00 00 00
 
  0x0c528000ae70: 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 00
 
  0x0c528000ae80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c528000ae90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c528000aea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c528000aeb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==1813883==ABORTING

The failure started happening on 10.7 after this commit:

commit 401ff6994d842a4072b7b155e5a958e178e6497a
 
Author: Eric Herman
 
Date:   Fri Sep 3 06:38:54 2021 +0200
 
 
 
    MDEV-26221: DYNAMIC_ARRAY use size_t for sizes



 Comments   
Comment by Elena Stepanova [ 2022-07-30 ]

The test case in the description fails on 10.7+ and does not fail on 10.3-10.6.
Below is a counter-part of it, which fails on 10.3-10.6 and doesn't fail on 10.7+.
It is the same test case, but it uses QUERY_PREALLOC_SIZE (and doesn't need optimizer trace). I didn't check whether it's scalable in regard to QUERY_PREALLOC_SIZE or it is limited to extremely low values – anyway, the scenario in the description, the one about 10.7+, is in no way a corner case, so whether this one is or not, doesn't matter much.

SET QUERY_PREALLOC_SIZE= 1024;
 
 
 
CREATE TABLE t (a INT);
 
INSERT INTO t VALUES (1),(2);
 
 
 
PREPARE stmt FROM 'EXPLAIN EXTENDED WITH cte AS (SELECT CASE a WHEN 2 THEN 0 END AS f FROM t) SELECT * FROM cte';
 
EXECUTE stmt;
 
EXECUTE stmt;
 
 
 
# Cleanup
 
DROP TABLE t;

10.3 25219920

 
==1730727==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290000e7168 at pc 0x55ab82fd4402 bp 0x7f12ed116250 sp 0x7f12ed116248
 
READ of size 1 at 0x6290000e7168 thread T5
 
    #0 0x55ab82fd4401 in st_select_lex::print(THD*, String*, enum_query_type) /data/src/10.3/sql/sql_select.cc:26891
 
    #1 0x55ab82e2c396 in st_select_lex_unit::print(String*, enum_query_type) /data/src/10.3/sql/sql_lex.cc:2978
 
    #2 0x55ab8333e28a in With_element::print(String*, enum_query_type) /data/src/10.3/sql/sql_cte.cc:1646
 
    #3 0x55ab8333eda5 in With_clause::print(String*, enum_query_type) /data/src/10.3/sql/sql_cte.cc:1608
 
    #4 0x55ab82e2c2dd in st_select_lex_unit::print(String*, enum_query_type) /data/src/10.3/sql/sql_lex.cc:2951
 
    #5 0x55ab82e89259 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6306
 
    #6 0x55ab82ead688 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3871
 
    #7 0x55ab82ef3fc8 in Prepared_statement::execute(String*, bool) /data/src/10.3/sql/sql_prepare.cc:5027
 
    #8 0x55ab82ef46a4 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.3/sql/sql_prepare.cc:4455
 
    #9 0x55ab82ef57c0 in mysql_sql_stmt_execute(THD*) /data/src/10.3/sql/sql_prepare.cc:3545
 
    #10 0x55ab82ea6e46 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3887
 
    #11 0x55ab82eb5b37 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7871
 
    #12 0x55ab82eba679 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #13 0x55ab82ec041d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #14 0x55ab831de506 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #15 0x55ab831ded6a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #16 0x55ab844257a4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #17 0x7f12f7b3aea6 in start_thread nptl/pthread_create.c:477
 
    #18 0x7f12f7a6adee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfddee)
 
 
 
0x6290000e7168 is located 3944 bytes inside of 16352-byte region [0x6290000e6200,0x6290000ea1e0)
 
freed by thread T5 here:
 
    #0 0x7f12f83dcb6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123
 
    #1 0x55ab844e382d in free_root /data/src/10.3/mysys/my_alloc.c:430
 
    #2 0x55ab82eb9fc7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:2449
 
    #3 0x55ab82ec041d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #4 0x55ab831de506 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #5 0x55ab831ded6a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #6 0x55ab844257a4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #7 0x7f12f7b3aea6 in start_thread nptl/pthread_create.c:477
 
 
 
previously allocated by thread T5 here:
 
    #0 0x7f12f83dce8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
 
    #1 0x55ab844f6b12 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
 
    #2 0x55ab844e304b in alloc_root /data/src/10.3/mysys/my_alloc.c:251
 
    #3 0x55ab82c7f657 in Item::operator new(unsigned long, st_mem_root*) /data/src/10.3/sql/item.h:649
 
    #4 0x55ab82da4bb6 in THD::make_explain_field_list(List<Item>&, unsigned char, bool) /data/src/10.3/sql/sql_class.cc:2704
 
    #5 0x55ab82da5be0 in THD::prepare_explain_fields(select_result*, List<Item>*, unsigned char, bool) /data/src/10.3/sql/sql_class.cc:2654
 
    #6 0x55ab82da5cfa in THD::send_explain_fields(select_result*, unsigned char, bool) /data/src/10.3/sql/sql_class.cc:2666
 
    #7 0x55ab82e88be1 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6273
 
    #8 0x55ab82ead688 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3871
 
    #9 0x55ab82ef3fc8 in Prepared_statement::execute(String*, bool) /data/src/10.3/sql/sql_prepare.cc:5027
 
    #10 0x55ab82ef46a4 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.3/sql/sql_prepare.cc:4455
 
    #11 0x55ab82ef57c0 in mysql_sql_stmt_execute(THD*) /data/src/10.3/sql/sql_prepare.cc:3545
 
    #12 0x55ab82ea6e46 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3887
 
    #13 0x55ab82eb5b37 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7871
 
    #14 0x55ab82eba679 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #15 0x55ab82ec041d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #16 0x55ab831de506 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #17 0x55ab831ded6a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #18 0x55ab844257a4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #19 0x7f12f7b3aea6 in start_thread nptl/pthread_create.c:477
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7f12f83882a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
 
    #1 0x55ab84429dfa in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
 
    #2 0x55ab82c4cf1b in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x55ab82c4cf1b in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6668
 
    #4 0x55ab82c5d22d in create_new_thread /data/src/10.3/sql/mysqld.cc:6738
 
    #5 0x55ab82c5d22d in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6996
 
    #6 0x55ab82c5f1d5 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6290
 
    #7 0x7f12f7993d09 in __libc_start_main ../csu/libc-start.c:308
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/sql/sql_select.cc:26891 in st_select_lex::print(THD*, String*, enum_query_type)
 
Shadow bytes around the buggy address:
 
  0x0c5280014dd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280014de0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280014df0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280014e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280014e10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c5280014e20: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd
 
  0x0c5280014e30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280014e40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280014e50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280014e60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c5280014e70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==1730727==ABORTING

Generated at Thu Feb 08 10:06:05 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.