[MDEV-32325] Server crashes at __nss_database_lookup Created: 2023-09-30  Updated: 2023-12-15  Resolved: 2023-10-09

Status: Closed
Project: MariaDB Server
Component/s: N/A
Affects Version/s: 11.1.2, 11.2.1
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Jingzhou Fu Assignee: Unassigned
Resolution: Duplicate Votes: 0
Labels: None
Environment:

Ubuntu 20.04 x86-64, docker image mariadb:11.1.2

Issue Links:
Duplicate
duplicates MDEV-25158 SIGSEGV in hp_rec_key_cmp and Asserti... Confirmed

 Description   

PoC:

SELECT 28 UNION SELECT 3 UNION SELECT 1 UNION ALL SELECT 1 UNION ALL SELECT 1 EXCEPT ALL SELECT 1 ;

docker log:

mariadbd(my_print_stacktrace+0x32)[0x563b708a27c2]
 
mariadbd(handle_fatal_signal+0x488)[0x563b7037bcf8]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x42520)[0x7f61599a1520]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x199ef9)[0x7f6159af8ef9]
 
mariadbd(+0xd7423f)[0x563b7064a23f]
 
mariadbd(+0xd72457)[0x563b70648457]
 
mariadbd(_ZN15select_unit_ext9send_dataER4ListI4ItemE+0x283)[0x563b701daa03]
 
mariadbd(_ZN4JOIN10exec_innerEv+0xc90)[0x563b7018a880]
 
mariadbd(_ZN4JOIN4execEv+0x3f)[0x563b7018afff]
 
mariadbd(_ZN18st_select_lex_unit10exec_innerEv+0x5b4)[0x563b701dd344]
 
mariadbd(_Z11mysql_unionP3THDP3LEXP13select_resultP18st_select_lex_unity+0x48)[0x563b701e0438]
 
mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0x59)[0x563b70189679]
 
mariadbd(+0x826f55)[0x563b700fcf55]
 
mariadbd(_Z21mysql_execute_commandP3THDb+0x419e)[0x563b7010bf0e]
 
mariadbd(_Z11mysql_parseP3THDPcjP12Parser_state+0x1e7)[0x563b7010d237]
 
mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x14bd)[0x563b7010fa1d]
 
mariadbd(_Z10do_commandP3THDb+0x138)[0x563b70111818]
 
mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0x3bf)[0x563b702393af]
 
mariadbd(handle_one_connection+0x5d)[0x563b702396fd]
 
mariadbd(+0xcd1906)[0x563b705a7906]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x94b43)[0x7f61599f3b43]
 
/lib/x86_64-linux-gnu/libc.so.6(clone+0x44)[0x7f6159a84bb4]
 
 
 
Trying to get some variables.
 
Some pointers may be invalid and cause the dump to abort.
 
Query (0x7f60f00130d8): SELECT 28 UNION SELECT 3 UNION SELECT 1 UNION ALL SELECT 1 UNION ALL SELECT 1 EXCEPT ALL SELECT 1
 
 
 
Connection ID (thread ID): 4
 
Status: NOT_KILLED
 
 
 
Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off,hash_join_cardinality=on



 Comments   
Comment by Alice Sherepa [ 2023-10-09 ]

Thanks! This is the same as MDEV-25158

SELECT 28 UNION SELECT 3 UNION SELECT 1 UNION ALL SELECT 1 UNION ALL SELECT 1 EXCEPT ALL SELECT 1 ;


2023-10-09 16:30:01 0 [Note] Starting MariaDB 11.2.2-MariaDB-debug-log source revision 872ed5342d8f1ec02f8f8a7a25a606e4ff512234 as process 340455
 
 
 
Version: '11.2.2-MariaDB-debug-log'  
=================================================================
 
==340455==ERROR: AddressSanitizer: heap-use-after-free on address 0x6310000b48f0 at pc 0x5569899c6ba1 bp 0x7eff8cce5ba0 sp 0x7eff8cce5b90
 
READ of size 8 at 0x6310000b48f0 thread T11
 
    #0 0x5569899c6ba0 in ha_heap::find_unique_row(unsigned char*, unsigned int) /11.2/src/storage/heap/ha_heap.cc:872
 
    #1 0x556988a20f04 in select_unit_ext::send_data(List<Item>&) /11.2/src/sql/sql_union.cc:676
 
    #2 0x5569888bd25a in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /11.2/src/sql/sql_class.h:5794
 
    #3 0x5569887e39ac in JOIN::exec_inner() /11.2/src/sql/sql_select.cc:4809
 
    #4 0x5569887e249f in JOIN::exec() /11.2/src/sql/sql_select.cc:4720
 
    #5 0x556988a30df2 in st_select_lex_unit::exec_inner() /11.2/src/sql/sql_union.cc:2389
 
    #6 0x556988a2f866 in st_select_lex_unit::exec() /11.2/src/sql/sql_union.cc:2292
 
    #7 0x556988a1b499 in mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long long) /11.2/src/sql/sql_union.cc:45
 
    #8 0x5569887b5e6f in handle_select(THD*, LEX*, select_result*, unsigned long long) /11.2/src/sql/sql_select.cc:618
 
    #9 0x5569886d7f38 in execute_sqlcom_select /11.2/src/sql/sql_parse.cc:6064
 
    #10 0x5569886c8b8a in mysql_execute_command(THD*, bool) /11.2/src/sql/sql_parse.cc:3955
 
    #11 0x5569886e2db6 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.2/src/sql/sql_parse.cc:7810
 
    #12 0x5569886bb15d in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.2/src/sql/sql_parse.cc:1893
 
    #13 0x5569886b7ea7 in do_command(THD*, bool) /11.2/src/sql/sql_parse.cc:1406
 
    #14 0x556988b968f8 in do_handle_one_connection(CONNECT*, bool) /11.2/src/sql/sql_connect.cc:1445
 
    #15 0x556988b96255 in handle_one_connection /11.2/src/sql/sql_connect.cc:1347
 
    #16 0x556989804721 in pfs_spawn_thread /11.2/src/storage/perfschema/pfs.cc:2201
 
    #17 0x7eff9bd71608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #18 0x7eff9b942132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
0x6310000b48f0 is located 240 bytes inside of 78764-byte region [0x6310000b4800,0x6310000c7bac)
 
freed by thread T11 here:
 
    #0 0x7eff9c2fe40f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
 
    #1 0x55698a446d30 in free_memory /11.2/src/mysys/safemalloc.c:297
 
    #2 0x55698a44616d in sf_free /11.2/src/mysys/safemalloc.c:203
 
    #3 0x55698a413c25 in my_free /11.2/src/mysys/my_malloc.c:217
 
    #4 0x5569899dd4a7 in hp_free_level /11.2/src/storage/heap/hp_block.c:151
 
    #5 0x5569899ddc13 in hp_clear_keys /11.2/src/storage/heap/hp_clear.c:100
 
    #6 0x5569899ddeb5 in heap_disable_indexes /11.2/src/storage/heap/hp_clear.c:131
 
    #7 0x5569899c3b96 in ha_heap::disable_indexes(unsigned int) /11.2/src/storage/heap/ha_heap.cc:527
 
    #8 0x55698904a4df in handler::ha_disable_indexes(unsigned int) /11.2/src/sql/handler.cc:5384
 
    #9 0x556988a1f601 in select_unit_ext::disable_index_if_needed(st_select_lex*) /11.2/src/sql/sql_union.cc:486
 
    #10 0x556988a21f58 in select_unit_ext::send_eof() /11.2/src/sql/sql_union.cc:773
 
    #11 0x5569887e3c10 in JOIN::exec_inner() /11.2/src/sql/sql_select.cc:4820
 
    #12 0x5569887e249f in JOIN::exec() /11.2/src/sql/sql_select.cc:4720
 
    #13 0x556988a30df2 in st_select_lex_unit::exec_inner() /11.2/src/sql/sql_union.cc:2389
 
    #14 0x556988a2f866 in st_select_lex_unit::exec() /11.2/src/sql/sql_union.cc:2292
 
    #15 0x556988a1b499 in mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long long) /11.2/src/sql/sql_union.cc:45
 
    #16 0x5569887b5e6f in handle_select(THD*, LEX*, select_result*, unsigned long long) /11.2/src/sql/sql_select.cc:618
 
    #17 0x5569886d7f38 in execute_sqlcom_select /11.2/src/sql/sql_parse.cc:6064
 
    #18 0x5569886c8b8a in mysql_execute_command(THD*, bool) /11.2/src/sql/sql_parse.cc:3955
 
    #19 0x5569886e2db6 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.2/src/sql/sql_parse.cc:7810
 
    #20 0x5569886bb15d in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.2/src/sql/sql_parse.cc:1893
 
    #21 0x5569886b7ea7 in do_command(THD*, bool) /11.2/src/sql/sql_parse.cc:1406
 
    #22 0x556988b968f8 in do_handle_one_connection(CONNECT*, bool) /11.2/src/sql/sql_connect.cc:1445
 
    #23 0x556988b96255 in handle_one_connection /11.2/src/sql/sql_connect.cc:1347
 
    #24 0x556989804721 in pfs_spawn_thread /11.2/src/storage/perfschema/pfs.cc:2201
 
    #25 0x7eff9bd71608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
 
 
previously allocated by thread T11 here:
 
    #0 0x7eff9c2fe808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
 
    #1 0x55698a445b21 in sf_malloc /11.2/src/mysys/safemalloc.c:126
 
    #2 0x55698a412d72 in my_malloc /11.2/src/mysys/my_malloc.c:89
 
    #3 0x5569899dcdf5 in hp_get_new_block /11.2/src/storage/heap/hp_block.c:81
 
    #4 0x5569899dc4cc in hp_find_free_hash /11.2/src/storage/heap/hp_write.c:409
 
    #5 0x5569899db442 in hp_write_key /11.2/src/storage/heap/hp_write.c:212
 
    #6 0x5569899d9cb3 in heap_write /11.2/src/storage/heap/hp_write.c:52
 
    #7 0x5569899c1e6c in ha_heap::write_row(unsigned char const*) /11.2/src/storage/heap/ha_heap.cc:298
 
    #8 0x5569888bdd00 in handler::ha_write_tmp_row(unsigned char*) /11.2/src/sql/sql_class.h:7563
 
    #9 0x556988a1ee37 in select_unit::write_record() /11.2/src/sql/sql_union.cc:416
 
    #10 0x556988a20b42 in select_unit_ext::send_data(List<Item>&) /11.2/src/sql/sql_union.cc:661
 
    #11 0x5569888bd25a in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /11.2/src/sql/sql_class.h:5794
 
    #12 0x5569887e39ac in JOIN::exec_inner() /11.2/src/sql/sql_select.cc:4809
 
    #13 0x5569887e249f in JOIN::exec() /11.2/src/sql/sql_select.cc:4720
 
    #14 0x556988a30df2 in st_select_lex_unit::exec_inner() /11.2/src/sql/sql_union.cc:2389
 
    #15 0x556988a2f866 in st_select_lex_unit::exec() /11.2/src/sql/sql_union.cc:2292
 
    #16 0x556988a1b499 in mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long long) /11.2/src/sql/sql_union.cc:45
 
    #17 0x5569887b5e6f in handle_select(THD*, LEX*, select_result*, unsigned long long) /11.2/src/sql/sql_select.cc:618
 
    #18 0x5569886d7f38 in execute_sqlcom_select /11.2/src/sql/sql_parse.cc:6064
 
    #19 0x5569886c8b8a in mysql_execute_command(THD*, bool) /11.2/src/sql/sql_parse.cc:3955
 
    #20 0x5569886e2db6 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /11.2/src/sql/sql_parse.cc:7810
 
    #21 0x5569886bb15d in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /11.2/src/sql/sql_parse.cc:1893
 
    #22 0x5569886b7ea7 in do_command(THD*, bool) /11.2/src/sql/sql_parse.cc:1406
 
    #23 0x556988b968f8 in do_handle_one_connection(CONNECT*, bool) /11.2/src/sql/sql_connect.cc:1445
 
    #24 0x556988b96255 in handle_one_connection /11.2/src/sql/sql_connect.cc:1347
 
    #25 0x556989804721 in pfs_spawn_thread /11.2/src/storage/perfschema/pfs.cc:2201
 
    #26 0x7eff9bd71608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
 
 
Thread T11 created by T0 here:
 
    #0 0x7eff9c22b815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
 
    #1 0x5569898002fe in my_thread_create /11.2/src/storage/perfschema/my_thread.h:52
 
    #2 0x556989804b14 in pfs_spawn_thread_v1 /11.2/src/storage/perfschema/pfs.cc:2252
 
    #3 0x5569882f8019 in inline_mysql_thread_create /11.2/src/include/mysql/psi/mysql_thread.h:1139
 
    #4 0x556988310aa5 in create_thread_to_handle_connection(CONNECT*) /11.2/src/sql/mysqld.cc:6169
 
    #5 0x556988311135 in create_new_thread(CONNECT*) /11.2/src/sql/mysqld.cc:6231
 
    #6 0x5569883114a2 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /11.2/src/sql/mysqld.cc:6293
 
    #7 0x556988311e98 in handle_connections_sockets() /11.2/src/sql/mysqld.cc:6417
 
    #8 0x5569883102b2 in mysqld_main(int, char**) /11.2/src/sql/mysqld.cc:6064
 
    #9 0x5569882f70cc in main /11.2/src/sql/main.cc:34
 
    #10 0x7eff9b847082 in __libc_start_main ../csu/libc-start.c:308
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /11.2/src/storage/heap/ha_heap.cc:872 in ha_heap::find_unique_row(unsigned char*, unsigned int)
 
Shadow bytes around the buggy address:
 
  0x0c628000e8c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c628000e8d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c628000e8e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c628000e8f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c628000e900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c628000e910: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
 
  0x0c628000e920: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c628000e930: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c628000e940: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c628000e950: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c628000e960: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==340455==ABORTING

Generated at Thu Feb 08 10:30:30 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.