database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-27 18:02:13 +03:00
Code Activity

MDEV-34533 asan error about stack overflow when writing record in Aria

Browse Source 
The problem was that when using clang + asan, we do not get a correct value
for the thread stack as some local variables are not allocated at the
normal stack.

It looks like that for example clang 18.1.3, when compiling with
-O2 -fsanitize=addressan it puts local variables and things allocated by
alloca() in other areas than on the stack.

The following code shows the issue

Thread 6 "mariadbd" hit Breakpoint 3, do_handle_one_connection
    (connect=0x5080000027b8,
    put_in_cache=<optimized out>) at sql/sql_connect.cc:1399

THD *thd;
1399      thd->thread_stack= (char*) &thd;
(gdb) p &thd
(THD **) 0x7fffedee7060
(gdb) p $sp
(void *) 0x7fffef4e7bc0

The address of thd is 24M away from the stack pointer

(gdb) info reg
...
rsp            0x7fffef4e7bc0      0x7fffef4e7bc0
...
r13            0x7fffedee7060      140737185214560

r13 is pointing to the address of the thd. Probably some kind of
"local stack" used by the sanitizer

I have verified this with gdb on a recursive call that calls alloca()
in a loop. In this case all objects was stored in a local heap,
not on the stack.

To solve this issue in a portable way, I have added two functions:

my_get_stack_pointer() returns the address of the current stack pointer.
The code is using asm instructions for intel 32/64 bit, powerpc,
arm 32/64 bit and sparc 32/64 bit.
Supported compilers are gcc, clang and MSVC.
For MSVC 64 bit we are using _AddressOfReturnAddress()

As a fallback for other compilers/arch we use the address of a local
variable.

my_get_stack_bounds() that will return the address of the base stack
and stack size using pthread_attr_getstack() or NtCurrentTed() with
fallback to using the address of a local variable and user provided
stack size.

Server changes are:

- Moving setting of thread_stack to THD::store_globals() using
  my_get_stack_bounds().
- Removing setting of thd->thread_stack, except in functions that
  allocates a lot on the stack before calling store_globals().  When
  using estimates for stack start, we reduce stack_size with
  MY_STACK_SAFE_MARGIN (8192) to take into account the stack used
  before calling store_globals().

I also added a unittest, stack_allocation-t, to verify the new code.

Reviewed-by: Sergei Golubchik <serg@mariadb.org>
This commit is contained in:
Monty
2024-10-01 17:07:48 +03:00
parent c1fc59277a
commit bddbef3573
35 changed files with 328 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
sql/sql_class.cc
View File

@ -2202,12 +2202,6 @@ void THD::reset_killed()
void THD::store_globals()
{
/*
Assert that thread_stack is initialized: it's necessary to be able
to track stack overrun.
*/
DBUG_ASSERT(thread_stack);
set_current_thd(this);
/*
mysys_var is concurrently readable by a killer thread.
@ -2239,8 +2233,11 @@ void THD::store_globals()
os_thread_id= 0;
#endif
real_id= pthread_self(); // For debugging
mysys_var->stack_ends_here= thread_stack + // for consistency, see libevent_thread_proc
STACK_DIRECTION * (long)my_thread_stack_size;
/* Set stack start and stack end */
my_get_stack_bounds(&thread_stack, &mysys_var->stack_ends_here,
thread_stack, my_thread_stack_size);
if (net.vio)
{
net.thd= this;
@ -2252,6 +2249,7 @@ void THD::store_globals()
thr_lock_info_init(&lock_info, mysys_var);
}
/**
Untie THD from current thread
@ -5018,7 +5016,6 @@ TABLE *find_fk_open_table(THD *thd, const char *db, size_t db_len,
MYSQL_THD create_thd()
{
THD *thd= new THD(next_thread_id());
thd->thread_stack= (char*) &thd;
thd->store_globals();
thd->set_command(COM_DAEMON);
thd->system_thread= SYSTEM_THREAD_GENERIC;
@ -5095,7 +5092,6 @@ void *thd_attach_thd(MYSQL_THD thd)
auto save_mysysvar= pthread_getspecific(THR_KEY_mysys);
pthread_setspecific(THR_KEY_mysys, thd->mysys_var);
thd->thread_stack= (char *) &thd;
thd->store_globals();
return save_mysysvar;
}