[MDEV-32373] ASAN errors in ha_connect::GetStringOption upon information schema query Created: 2023-10-07  Updated: 2023-11-28

Status: Open
Project: MariaDB Server
Component/s: Storage Engine - Connect
Affects Version/s: 10.4, 10.5, 10.6, 10.10, 10.11, 11.0, 11.1, 11.2
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Andrew Hutchings
Resolution: Unresolved Votes: 0
Labels: None


 Description    

--source include/have_innodb.inc
 
--source include/have_partition.inc
 
 
 
INSTALL SONAME 'ha_connect';
 
CREATE TABLE t (a INT) ENGINE=InnoDB PARTITION BY HASH (a);
 
 
 
CREATE TABLE t_tbl (a INT) engine=Connect table_type=TBL table_list='t';
 
SELECT * from INFORMATION_SCHEMA.PARTITIONS;
 
 
 
# Cleanup
 
DROP TABLE t_tbl, t;
 
UNINSTALL SONAME 'ha_connect';

10.4 9b5275b8

 
==1008700==ERROR: AddressSanitizer: use-after-poison on address 0x6190000dd6c8 at pc 0x7f8e5c104b87 bp 0x7f8e5c842ab0 sp 0x7f8e5c842aa8
 
READ of size 8 at 0x6190000dd6c8 thread T27
 
    #0 0x7f8e5c104b86 in GetStringTableOption(_global*, ha_table_option_struct*, char const*, char const*) /data/src/10.4/storage/connect/ha_connect.cc:1291
 
    #1 0x7f8e5c106020 in ha_connect::GetStringOption(char const*, char const*) /data/src/10.4/storage/connect/ha_connect.cc:1445
 
    #2 0x7f8e5c1ede59 in RELDEF::GetStringCatInfo(_global*, char const*, char const*) /data/src/10.4/storage/connect/reldef.cpp:267
 
    #3 0x7f8e5c1ee754 in TABDEF::Define(_global*, CATALOG*, char const*, char const*, char const*) /data/src/10.4/storage/connect/reldef.cpp:362
 
    #4 0x7f8e5c140503 in MYCAT::MakeTableDesc(_global*, XTAB*, char const*) /data/src/10.4/storage/connect/mycat.cc:527
 
    #5 0x7f8e5c13fe89 in MYCAT::GetTableDesc(_global*, XTAB*, char const*, RELDEF**) /data/src/10.4/storage/connect/mycat.cc:431
 
    #6 0x7f8e5c140971 in MYCAT::GetTable(_global*, XTAB*, MODE, char const*) /data/src/10.4/storage/connect/mycat.cc:549
 
    #7 0x7f8e5c2782fb in TDBPRX::GetSubTable(_global*, XTAB*, bool) /data/src/10.4/storage/connect/tabutil.cpp:440
 
    #8 0x7f8e5c2720f0 in TDBTBL::InitTableList(_global*) /data/src/10.4/storage/connect/tabtbl.cpp:256
 
    #9 0x7f8e5c272af6 in TDBTBL::Cardinality(_global*) /data/src/10.4/storage/connect/tabtbl.cpp:360
 
    #10 0x7f8e5c1393b0 in CntInfo(_global*, TDB*, _xinfo*) /data/src/10.4/storage/connect/connect.cc:172
 
    #11 0x7f8e5c11cb70 in ha_connect::info(unsigned int) /data/src/10.4/storage/connect/ha_connect.cc:4402
 
    #12 0x55b231606d0b in handler::get_dynamic_partition_info(PARTITION_STATS*, unsigned int) /data/src/10.4/sql/handler.cc:5032
 
    #13 0x55b23102ffaa in store_schema_partitions_record /data/src/10.4/sql/sql_show.cc:7456
 
    #14 0x55b231035a29 in get_schema_partitions_record /data/src/10.4/sql/sql_show.cc:7797
 
    #15 0x55b23100bfbf in fill_schema_table_by_open /data/src/10.4/sql/sql_show.cc:4737
 
    #16 0x55b23100ff3b in get_all_tables(THD*, TABLE_LIST*, Item*) /data/src/10.4/sql/sql_show.cc:5389
 
    #17 0x55b231045ce2 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.4/sql/sql_show.cc:9102
 
    #18 0x55b230f11f1d in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4562
 
    #19 0x55b230f0fde5 in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4387
 
    #20 0x55b230f13e77 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4826
 
    #21 0x55b230ee49f8 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:442
 
    #22 0x55b230e53f20 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6475
 
    #23 0x55b230e41435 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3978
 
    #24 0x55b230e5d170 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012
 
    #25 0x55b230e333ff in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857
 
    #26 0x55b230e2ff6e in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378
 
    #27 0x55b23122f875 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420
 
    #28 0x55b23122f18c in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
 
    #29 0x55b231ea098f in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
 
    #30 0x7f8e714a7fd3 in start_thread nptl/pthread_create.c:442
 
    #31 0x7f8e715285bb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
 
 
 
0x6190000dd6c8 is located 584 bytes inside of 992-byte region [0x6190000dd480,0x6190000dd860)
 
allocated by thread T27 here:
 
    #0 0x7f8e71ab89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
 
    #1 0x55b2329ea452 in my_malloc /data/src/10.4/mysys/my_malloc.c:101
 
    #2 0x55b2329c6e78 in alloc_root /data/src/10.4/mysys/my_alloc.c:258
 
    #3 0x55b2329c8649 in memdup_root /data/src/10.4/mysys/my_alloc.c:501
 
    #4 0x55b2311482ae in TABLE_SHARE::init_from_binary_frm_image(THD*, bool, unsigned char const*, unsigned long) /data/src/10.4/sql/table.cc:1662
 
    #5 0x55b2311408b2 in open_table_def(THD*, TABLE_SHARE*, unsigned int) /data/src/10.4/sql/table.cc:704
 
    #6 0x7f8e5c274d35 in GetTableShare(_global*, THD*, char const*, char const*, bool&) /data/src/10.4/storage/connect/tabutil.cpp:98
 
    #7 0x7f8e5c277efe in TDBPRX::GetSubTable(_global*, XTAB*, bool) /data/src/10.4/storage/connect/tabutil.cpp:421
 
    #8 0x7f8e5c2720f0 in TDBTBL::InitTableList(_global*) /data/src/10.4/storage/connect/tabtbl.cpp:256
 
    #9 0x7f8e5c272af6 in TDBTBL::Cardinality(_global*) /data/src/10.4/storage/connect/tabtbl.cpp:360
 
    #10 0x7f8e5c1393b0 in CntInfo(_global*, TDB*, _xinfo*) /data/src/10.4/storage/connect/connect.cc:172
 
    #11 0x7f8e5c11cb70 in ha_connect::info(unsigned int) /data/src/10.4/storage/connect/ha_connect.cc:4402
 
    #12 0x55b231606d0b in handler::get_dynamic_partition_info(PARTITION_STATS*, unsigned int) /data/src/10.4/sql/handler.cc:5032
 
    #13 0x55b23102ffaa in store_schema_partitions_record /data/src/10.4/sql/sql_show.cc:7456
 
    #14 0x55b231035a29 in get_schema_partitions_record /data/src/10.4/sql/sql_show.cc:7797
 
    #15 0x55b23100bfbf in fill_schema_table_by_open /data/src/10.4/sql/sql_show.cc:4737
 
    #16 0x55b23100ff3b in get_all_tables(THD*, TABLE_LIST*, Item*) /data/src/10.4/sql/sql_show.cc:5389
 
    #17 0x55b231045ce2 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.4/sql/sql_show.cc:9102
 
    #18 0x55b230f11f1d in JOIN::exec_inner() /data/src/10.4/sql/sql_select.cc:4562
 
    #19 0x55b230f0fde5 in JOIN::exec() /data/src/10.4/sql/sql_select.cc:4387
 
    #20 0x55b230f13e77 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4826
 
    #21 0x55b230ee49f8 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:442
 
    #22 0x55b230e53f20 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6475
 
    #23 0x55b230e41435 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3978
 
    #24 0x55b230e5d170 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012
 
    #25 0x55b230e333ff in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857
 
    #26 0x55b230e2ff6e in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378
 
    #27 0x55b23122f875 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420
 
    #28 0x55b23122f18c in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324
 
    #29 0x55b231ea098f in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7f8e71a49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
 
    #1 0x55b231ea0d7c in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919
 
    #2 0x55b230b3af89 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x55b230b526b6 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6289
 
    #4 0x55b230b52e01 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6359
 
    #5 0x55b230b532cf in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6457
 
    #6 0x55b230b5417b in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6615
 
    #7 0x55b230b51e19 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5947
 
    #8 0x55b230b390b8 in main /data/src/10.4/sql/main.cc:25
 
    #9 0x7f8e71446189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
 
 
 
SUMMARY: AddressSanitizer: use-after-poison /data/src/10.4/storage/connect/ha_connect.cc:1291 in GetStringTableOption(_global*, ha_table_option_struct*, char const*, char const*)
 
Shadow bytes around the buggy address:
 
  0x0c3280013a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3280013a90: 00 00 00 00 f7 00 00 f7 01 f7 02 f7 00 00 00 01
 
  0x0c3280013aa0: f7 05 f7 01 f7 00 00 00 00 00 00 00 00 00 00 f7
 
  0x0c3280013ab0: 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3280013ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 00
 
=>0x0c3280013ad0: 00 00 00 f7 04 f7 f7 f7 f7[f7]f7 f7 f7 f7 f7 f7
 
  0x0c3280013ae0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c3280013af0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c3280013b00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 fa fa fa fa
 
  0x0c3280013b10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3280013b20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
==1008700==ABORTING


Generated at Thu Feb 08 10:30:51 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.