Uploaded image for project: 'Percona XtraDB Cluster'
  1. Percona XtraDB Cluster
  2. PXC-2687

BF abort of a SP causes a write-after-free error

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: On Hold
    • Priority: Medium
    • Resolution: Unresolved
    • Affects Version/s: 5.7.27-31.39
    • Fix Version/s: None
    • Component/s: None
    • Labels:
      None

      Description

      BF abort of a stored procedure, causes a write-after-free error.

      For a repro, see PXC-2684 (and send the update on node2 when running the SP).

      =================================================================
      ==28816==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000fb5490 at pc 0x555557498e39 bp 0x7fffca7336e0 sp 0x7fffca7336d0
      READ of size 4 at 0x606000fb5490 thread T36
      #0 0x555557498e38 in Protocol_text::store(char const*, unsigned long, charset_info_st const*, charset_info_st const*) /home/kennt/dev/pxc/sql/protocol_classic.cc:1297
      #1 0x5555574990c3 in Protocol_text::store(char const*, unsigned long, charset_info_st const*) /home/kennt/dev/pxc/sql/protocol_classic.h:222
      #2 0x555556427574 in Item::send(Protocol*, String*) /home/kennt/dev/pxc/sql/item.cc:7534
      #3 0x5555575f8fb7 in THD::send_result_set_row(List<Item>*) /home/kennt/dev/pxc/sql/sql_class.cc:5420
      #4 0x5555575f9521 in Query_result_send::send_data(List<Item>&) /home/kennt/dev/pxc/sql/sql_class.cc:3321
      #5 0x55555763713b in JOIN::exec() /home/kennt/dev/pxc/sql/sql_executor.cc:158
      #6 0x5555577f7d2d in handle_query(THD*, LEX*, Query_result*, unsigned long long, unsigned long long) /home/kennt/dev/pxc/sql/sql_select.cc:185
      #7 0x5555576f2685 in execute_sqlcom_select /home/kennt/dev/pxc/sql/sql_parse.cc:6422
      #8 0x555557706582 in mysql_execute_command(THD*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:3460
      #9 0x55555750e3fc in sp_instr_stmt::exec_core(THD*, unsigned int*) /home/kennt/dev/pxc/sql/sp_instr.cc:1057
      #10 0x555557513a22 in sp_lex_instr::reset_lex_and_exec_core(THD*, unsigned int*, bool) /home/kennt/dev/pxc/sql/sp_instr.cc:446
      #11 0x555557516650 in sp_lex_instr::validate_lex_and_execute_core(THD*, unsigned int*, bool) /home/kennt/dev/pxc/sql/sp_instr.cc:748
      #12 0x555557519ea1 in sp_instr_stmt::execute(THD*, unsigned int*) /home/kennt/dev/pxc/sql/sp_instr.cc:944
      #13 0x5555574fa2f5 in sp_head::execute(THD*, bool) /home/kennt/dev/pxc/sql/sp_head.cc:803
      #14 0x55555750b6da in sp_head::execute_procedure(THD*, List<Item>*) /home/kennt/dev/pxc/sql/sp_head.cc:1577
      #15 0x55555771ca74 in mysql_execute_command(THD*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:5665
      #16 0x555557724441 in mysql_parse(THD*, Parser_state*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:6874
      #17 0x55555772496d in wsrep_mysql_parse /home/kennt/dev/pxc/sql/sql_parse.cc:7869
      #18 0x55555772b4a5 in dispatch_command(THD*, COM_DATA const*, enum_server_command) /home/kennt/dev/pxc/sql/sql_parse.cc:1857
      #19 0x555557732b0f in do_command(THD*) /home/kennt/dev/pxc/sql/sql_parse.cc:1186
      #20 0x555557a47212 in handle_connection /home/kennt/dev/pxc/sql/conn_handler/connection_handler_per_thread.cc:318
      #21 0x55555801a2b3 in pfs_spawn_thread /home/kennt/dev/pxc/storage/perfschema/pfs.cc:2190
      #22 0x7ffff583c6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
      #23 0x7ffff4c2688e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)

      0x606000fb5490 is located 48 bytes inside of 64-byte region [0x606000fb5460,0x606000fb54a0)
      freed by thread T36 here:
      #0 0x7ffff6ef87b8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7b8)
      #1 0x555557fc15d9 in my_raw_free /home/kennt/dev/pxc/mysys/my_malloc.c:290
      #2 0x555557fc15d9 in my_free /home/kennt/dev/pxc/mysys/my_malloc.c:133
      #3 0x555557fb1ce1 in free_root /home/kennt/dev/pxc/mysys/my_alloc.c:451
      #4 0x5555574fafc9 in sp_head::execute(THD*, bool) /home/kennt/dev/pxc/sql/sp_head.cc:859
      #5 0x55555750b6da in sp_head::execute_procedure(THD*, List<Item>*) /home/kennt/dev/pxc/sql/sp_head.cc:1577
      #6 0x55555771ca74 in mysql_execute_command(THD*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:5665
      #7 0x555557724441 in mysql_parse(THD*, Parser_state*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:6874
      #8 0x55555772496d in wsrep_mysql_parse /home/kennt/dev/pxc/sql/sql_parse.cc:7869
      #9 0x55555772b4a5 in dispatch_command(THD*, COM_DATA const*, enum_server_command) /home/kennt/dev/pxc/sql/sql_parse.cc:1857
      #10 0x555557732b0f in do_command(THD*) /home/kennt/dev/pxc/sql/sql_parse.cc:1186
      #11 0x555557a47212 in handle_connection /home/kennt/dev/pxc/sql/conn_handler/connection_handler_per_thread.cc:318
      #12 0x55555801a2b3 in pfs_spawn_thread /home/kennt/dev/pxc/storage/perfschema/pfs.cc:2190
      #13 0x7ffff583c6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)

      previously allocated by thread T36 here:
      #0 0x7ffff6ef8b50 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb50)
      #1 0x555557fc0fd0 in my_raw_malloc /home/kennt/dev/pxc/mysys/my_malloc.c:191
      #2 0x555557fc0fd0 in my_malloc /home/kennt/dev/pxc/mysys/my_malloc.c:54
      #3 0x555557fb0f31 in alloc_root /home/kennt/dev/pxc/mysys/my_alloc.c:217
      #4 0x5555579d8bb6 in sql_alloc(unsigned long) /home/kennt/dev/pxc/sql/thr_malloc.cc:39
      #5 0x5555564dc60a in Sql_alloc::operator new(unsigned long) /home/kennt/dev/pxc/sql/sql_alloc.h:30
      #6 0x5555564dc60a in base_list::push_back(void*) /home/kennt/dev/pxc/sql/sql_list.h:195
      #7 0x5555564dc60a in List<Item>::push_back(Item*) /home/kennt/dev/pxc/sql/sql_list.h:545
      #8 0x5555564dc60a in Item_cond::copy_andor_arguments(THD*, Item_cond*) /home/kennt/dev/pxc/sql/item_cmpfunc.cc:5792
      #9 0x5555564f9b5d in Item_cond_and::copy_andor_structure(THD*) (/home/kennt/dev/pxc/build/usr/local/Percona-XtraDB-Cluster-5.7.27-rel30-31.39-debug.1.Linux.x86_64/bin/mysqld+0xfa5b5d)
      #10 0x55555767a3c6 in st_select_lex::get_optimizable_conditions(THD*, Item*, Item*) /home/kennt/dev/pxc/sql/sql_lex.cc:4484
      #11 0x555557923656 in mysql_update(THD*, List<Item>&, List<Item>&, unsigned long long, enum_duplicates, unsigned long long*, unsigned long long*) /home/kennt/dev/pxc/sql/sql_update.cc:298
      #12 0x555557930f05 in Sql_cmd_update::try_single_table_update(THD*, bool*) /home/kennt/dev/pxc/sql/sql_update.cc:2930
      #13 0x555557931a11 in Sql_cmd_update::execute(THD*) /home/kennt/dev/pxc/sql/sql_update.cc:3057
      #14 0x555557712287 in mysql_execute_command(THD*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:4368
      #15 0x55555750e3fc in sp_instr_stmt::exec_core(THD*, unsigned int*) /home/kennt/dev/pxc/sql/sp_instr.cc:1057
      #16 0x555557513a22 in sp_lex_instr::reset_lex_and_exec_core(THD*, unsigned int*, bool) /home/kennt/dev/pxc/sql/sp_instr.cc:446
      #17 0x555557516650 in sp_lex_instr::validate_lex_and_execute_core(THD*, unsigned int*, bool) /home/kennt/dev/pxc/sql/sp_instr.cc:748
      #18 0x555557519ea1 in sp_instr_stmt::execute(THD*, unsigned int*) /home/kennt/dev/pxc/sql/sp_instr.cc:944
      #19 0x5555574fa2f5 in sp_head::execute(THD*, bool) /home/kennt/dev/pxc/sql/sp_head.cc:803
      #20 0x55555750b6da in sp_head::execute_procedure(THD*, List<Item>*) /home/kennt/dev/pxc/sql/sp_head.cc:1577
      #21 0x55555771ca74 in mysql_execute_command(THD*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:5665
      #22 0x555557724441 in mysql_parse(THD*, Parser_state*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:6874
      #23 0x55555772496d in wsrep_mysql_parse /home/kennt/dev/pxc/sql/sql_parse.cc:7869
      #24 0x55555772b4a5 in dispatch_command(THD*, COM_DATA const*, enum_server_command) /home/kennt/dev/pxc/sql/sql_parse.cc:1857
      #25 0x555557732b0f in do_command(THD*) /home/kennt/dev/pxc/sql/sql_parse.cc:1186
      #26 0x555557a47212 in handle_connection /home/kennt/dev/pxc/sql/conn_handler/connection_handler_per_thread.cc:318
      #27 0x55555801a2b3 in pfs_spawn_thread /home/kennt/dev/pxc/storage/perfschema/pfs.cc:2190
      #28 0x7ffff583c6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)

      Thread T36 created by T0 here:
      #0 0x7ffff6e51d2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f)
      #1 0x555557fe4666 in my_thread_create /home/kennt/dev/pxc/mysys/my_thread.c:92
      #2 0x555558021ceb in pfs_spawn_thread_v1 /home/kennt/dev/pxc/storage/perfschema/pfs.cc:2241
      #3 0x555557a48c05 in inline_mysql_thread_create /home/kennt/dev/pxc/include/mysql/psi/mysql_thread.h:1297
      #4 0x555557a48c05 in Per_thread_connection_handler::add_connection(Channel_info*) /home/kennt/dev/pxc/sql/conn_handler/connection_handler_per_thread.cc:433
      #5 0x5555563188e6 in Connection_handler_manager::process_new_connection(Channel_info*) /home/kennt/dev/pxc/sql/conn_handler/connection_handler_manager.cc:315
      #6 0x5555562043ec in Connection_acceptor<Mysqld_socket_listener>::connection_event_loop() /home/kennt/dev/pxc/sql/conn_handler/connection_acceptor.h:68
      #7 0x5555562043ec in mysqld_main(int, char**) /home/kennt/dev/pxc/sql/mysqld.cc:6328
      #8 0x5555561e1ab2 in main /home/kennt/dev/pxc/sql/main.cc:25
      #9 0x7ffff4b26b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

      SUMMARY: AddressSanitizer: heap-use-after-free /home/kennt/dev/pxc/sql/protocol_classic.cc:1297 in Protocol_text::store(char const*, unsigned long, charset_info_st const*, charset_info_st const*)
      Shadow bytes around the buggy address:
      0x0c0c801eea40: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
      0x0c0c801eea50: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
      0x0c0c801eea60: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fa
      0x0c0c801eea70: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
      0x0c0c801eea80: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
      =>0x0c0c801eea90: fd fd[fd]fd fa fa fa fa fd fd fd fd fd fd fd fd
      0x0c0c801eeaa0: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
      0x0c0c801eeab0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
      0x0c0c801eeac0: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fa
      0x0c0c801eead0: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
      0x0c0c801eeae0: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable: 00
      Partially addressable: 01 02 03 04 05 06 07
      Heap left redzone: fa
      Freed heap region: fd
      Stack left redzone: f1
      Stack mid redzone: f2
      Stack right redzone: f3
      Stack after return: f5
      Stack use after scope: f8
      Global redzone: f9
      Global init order: f6
      Poisoned by user: f7
      Container overflow: fc
      Array cookie: ac
      Intra object redzone: bb
      ASan internal: fe
      Left alloca redzone: ca
      Right alloca redzone: cb

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              kenn.takara Kenn Takara
              Reporter:
              kenn.takara Kenn Takara
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - Not Specified
                  Not Specified
                  Logged:
                  Time Spent - 3 days, 2 hours
                  3d 2h

                    Smart Checklist