Public bug reported:

Copy of http://bugs.mysql.com/bug.php?id=83073:

[21 Sep 8:57] Laurynas Biveinis
Description:
mach_parse_compressed should load 1 to 5 bytes depending on the value of the 
first byte. GCC 5 and 6 emit code to load four bytes at first, before the 1st 
byte value is checked. Even though those bytes are not used for computation, 
loading them causes an out of bounds read if we are reading a short integer 
close to the end of buffer.

The GCC bug is https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77673, you
can also see a discussion leading to the bug report at
http://stackoverflow.com/questions/38821284/why-is-compiler-generating-4
-byte-load-instead....

How to repeat:
This presented as

innodb.innodb_bug59641                   w3 [ fail ]
        Test ended at 2016-08-03 14:46:26

CURRENT_TEST: innodb.innodb_bug59641
safe_process[13442]: Child process: 13444, killed by signal: 9

Server [mysqld.1 - pid: 13470, winpid: 13470, exit: 256] failed during test run
Server log from this test:
----------SERVER LOG START-----------
safe_process[10399]: Child process: 10401, killed by signal: 9
160803 21:46:25 [Note] 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/sql/mysqld
 (mysqld 5.5.51-38.2-log) starting as process 13471 ...
160803 21:46:25 [Warning] setrlimit could not change the size of core files to 
'infinity';  We may not be able to generate a core file on signals
160803 21:46:25 [Note] Plugin 'FEDERATED' is disabled.
160803 21:46:25 InnoDB: The InnoDB memory heap is disabled
160803 21:46:25 InnoDB: Mutexes and rw_locks use GCC atomic builtins
160803 21:46:25 InnoDB: Compressed tables use zlib 1.2.8
160803 21:46:25 InnoDB: Using Linux native AIO
160803 21:46:25 InnoDB: Initializing buffer pool, size = 32.0M
160803 21:46:25 InnoDB: Completed initialization of buffer pool
160803 21:46:25 InnoDB: highest supported file format is Barracuda.
InnoDB: Log scan progressed past the checkpoint lsn 31407366
160803 21:46:25  InnoDB: Database was not shut down normally!
InnoDB: Starting crash recovery.
InnoDB: Reading tablespace information from the .ibd files...
InnoDB: Restoring possible half-written data pages from the doublewrite
InnoDB: buffer...
InnoDB: Doing recovery: scanned up to log sequence number 33806487
InnoDB: Transaction DFC was in the XA prepared state.
InnoDB: Transaction DFD was in the XA prepared state.
InnoDB: Transaction DFE was in the XA prepared state.
InnoDB: 3 transaction(s) which must be rolled back or cleaned up
InnoDB: in total 0 row operations to undo
InnoDB: Trx id counter is F00
160803 21:46:26  InnoDB: Starting an apply batch of log records to the 
database...
InnoDB: Progress in percents: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 
26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 
52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 
78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 
=================================================================
==13471==ERROR: AddressSanitizer: unknown-crash on address 0x61e00000d745 at pc 
0x0000011a5269 bp 0x7fc80c25da60 sp 0x7fc80c25da50
READ of size 4 at 0x61e00000d745 thread T4
    #0 0x11a5268 in mach_parse_compressed 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/mach/mach0data.c:64
    #1 0x11d45e8 in page_cur_parse_insert_rec 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/page/page0cur.c:808
    #2 0x11d5b88 in page_parse_copy_rec_list_to_created_page 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/page/page0cur.c:1583
    #3 0x118aa6c in recv_parse_or_apply_log_rec_body 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/log/log0recv.c:1217
    #4 0x118f63c in recv_recover_page_func 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/log/log0recv.c:1708
    #5 0x103c243 in buf_page_io_complete 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/buf/buf0buf.c:4022
    #6 0x10efc0b in fil_aio_wait 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/fil/fil0fil.c:5719
    #7 0xf4b53f in io_handler_thread 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/srv/srv0start.c:496
    #8 0x7fc8179fa6f9 in start_thread 
(/lib/x86_64-linux-gnu/libpthread.so.0+0x76f9)
    #9 0x7fc8165a5b5c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x106b5c)

0x61e00000d748 is located 0 bytes to the right of 2760-byte region 
[0x61e00000cc80,0x61e00000d748)
allocated by thread T0 here:
    #0 0x7fc8180c4602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x11a897c in mem_area_alloc 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/mem/mem0pool.c:381
    #2 0x11a6a86 in mem_heap_create_block 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/mem/mem0mem.c:333
    #3 0x11a6a86 in mem_heap_add_block 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/mem/mem0mem.c:452
    #4 0x118bfda in mem_heap_alloc 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/include/mem0mem.ic:186
    #5 0x118bfda in recv_add_to_hash_table 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/log/log0recv.c:1477
    #6 0x118cf89 in recv_add_to_hash_table 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/log/log0recv.c:1421
    #7 0x118cf89 in recv_parse_log_recs 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/log/log0recv.c:2562
    #8 0x11980aa in recv_scan_log_recs 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/log/log0recv.c:2874
    #9 0x11980aa in recv_group_scan_log_recs 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/log/log0recv.c:2929
    #10 0x11980aa in recv_recovery_from_checkpoint_start_func 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/log/log0recv.c:3200
    #11 0xf503a6 in innobase_start_or_create_for_mysql 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/srv/srv0start.c:1933
    #12 0xe9016b in innobase_init 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/handler/ha_innodb.cc:3273
    #13 0x9a8a5b in ha_initialize_handlerton(st_plugin_int*) 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/sql/handler.cc:577
    #14 0x6cdd76 in plugin_initialize 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/sql/sql_plugin.cc:1111
    #15 0x6dff5e in plugin_init(int*, char**, int) 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/sql/sql_plugin.cc:1400
    #16 0x5428d3 in init_server_components 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/sql/mysqld.cc:4037
    #17 0x54d755 in mysqld_main(int, char**) 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/sql/mysqld.cc:4772
    #18 0x7fc8164bf82f in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Thread T4 created by T0 here:
    #0 0x7fc818062253 in pthread_create 
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
    #1 0x11c8e4a in os_thread_create 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/os/os0thread.c:173
    #2 0xf4e1d3 in innobase_start_or_create_for_mysql 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/srv/srv0start.c:1630
    #3 0xe9016b in innobase_init 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/handler/ha_innodb.cc:3273
    #4 0x9a8a5b in ha_initialize_handlerton(st_plugin_int*) 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/sql/handler.cc:577
    #5 0x6cdd76 in plugin_initialize 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/sql/sql_plugin.cc:1111
    #6 0x6dff5e in plugin_init(int*, char**, int) 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/sql/sql_plugin.cc:1400
    #7 0x5428d3 in init_server_components 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/sql/mysqld.cc:4037
    #8 0x54d755 in mysqld_main(int, char**) 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/sql/mysqld.cc:4772
    #9 0x7fc8164bf82f in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: unknown-crash 
/mnt/workspace/percona-server-5.5-asan-param/BUILD_TYPE/release-asan/Host/ubuntu-xenial-64bit/storage/innobase/mach/mach0data.c:64
 mach_parse_compressed
Shadow bytes around the buggy address:
  0x0c3c7fff9a90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c7fff9aa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c7fff9ab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c7fff9ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c7fff9ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3c7fff9ae0: 00 00 00 00 00 00 00 00[00]fa fa fa fa fa fa fa
  0x0c3c7fff9af0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3c7fff9b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3c7fff9b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c7fff9b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3c7fff9b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==13471==ABORTING
safe_process[13470]: Child process: 13471, exit: 1
----------SERVER LOG END-------------

Suggested fix:
Separating 1st byte < 0x80 case from the rest by "asm volatile("": : 
:"memory");" appears to be a viable workaround for the affected compilers.

** Affects: mysql-server
     Importance: Unknown
         Status: Unknown

** Affects: percona-server
     Importance: Medium
     Assignee: Laurynas Biveinis (laurynas-biveinis)
         Status: Triaged

** Affects: percona-server/5.5
     Importance: Medium
     Assignee: Laurynas Biveinis (laurynas-biveinis)
         Status: In Progress

** Affects: percona-server/5.6
     Importance: Medium
     Assignee: Laurynas Biveinis (laurynas-biveinis)
         Status: Triaged

** Affects: percona-server/5.7
     Importance: Medium
     Assignee: Laurynas Biveinis (laurynas-biveinis)
         Status: Triaged


** Tags: innodb upstream

** Also affects: percona-server/5.6
   Importance: Undecided
       Status: New

** Also affects: percona-server/5.5
   Importance: Undecided
       Status: New

** Also affects: percona-server/5.7
   Importance: Undecided
       Status: New

** Bug watch added: MySQL Bug System #83073
   http://bugs.mysql.com/bug.php?id=83073

** Also affects: mysql-server via
   http://bugs.mysql.com/bug.php?id=83073
   Importance: Unknown
       Status: Unknown

** Changed in: percona-server/5.5
     Assignee: (unassigned) => Laurynas Biveinis (laurynas-biveinis)

** Changed in: percona-server/5.7
     Assignee: (unassigned) => Laurynas Biveinis (laurynas-biveinis)

** Changed in: percona-server/5.6
     Assignee: (unassigned) => Laurynas Biveinis (laurynas-biveinis)

** Tags added: innodb upstream

** Changed in: percona-server/5.5
   Importance: Undecided => Medium

** Changed in: percona-server/5.6
   Importance: Undecided => Medium

** Changed in: percona-server/5.5
       Status: New => In Progress

** Changed in: percona-server/5.7
   Importance: Undecided => Medium

** Changed in: percona-server/5.7
       Status: New => Triaged

** Changed in: percona-server/5.6
       Status: New => Triaged

-- 
You received this bug notification because you are a member of Ubuntu
Server/Client Support Team, which is subscribed to MySQL.
Matching subscriptions: Ubuntu Server/Client Support Team
https://bugs.launchpad.net/bugs/1626002

Title:
  GCC 5 and 6 miscompile mach_parse_compressed

To manage notifications about this bug go to:
https://bugs.launchpad.net/mysql-server/+bug/1626002/+subscriptions

-- 
Mailing list: https://launchpad.net/~enterprise-support
Post to     : enterprise-support@lists.launchpad.net
Unsubscribe : https://launchpad.net/~enterprise-support
More help   : https://help.launchpad.net/ListHelp

Reply via email to