Bug #113710 Spec/HttpClientSecureTest.ensure/default_client_cipher_succeeds ASan error

Submitted: 22 Jan 2024 12:29 Modified: 17 Oct 2024 13:26
Reporter: Laurynas Biveinis (OCA) Email Updates:
Status: Verified Impact on me:
None 
Category:MySQL Router Severity:S3 (Non-critical)
Version:8.0.37, 8.4.1, 9.0.0 OS:MacOS (12.4.1)
Assigned to: CPU Architecture:Any

[22 Jan 2024 12:29] Laurynas Biveinis
Description:
./runtime_output_directory/routertest_component_http_server
...
[ RUN      ] Spec/HttpClientSecureTest.ensure/default_client_cipher_succeeds
AddressSanitizer:DEADLYSIGNAL
=================================================================
==80462==ERROR: AddressSanitizer: BUS on unknown address (pc 0x0001062edb78 bp 0x00016b3d1180 sp 0x00016b3d1160 T0)
==80462==The signal is caused by a WRITE memory access.
==80462==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
    #0 0x1062edb78 in SSL_CTX_free+0x20 (libssl.3.dylib:arm64+0x11b78)
    #1 0x1062ecb74 in SSL_free+0x68 (libssl.3.dylib:arm64+0x10b74)
    #2 0x105a0a1cc in bufferevent_openssl_new_impl+0x134 (libevent_openssl-2.1.7.dylib:arm64+0x21cc)
    #3 0x105b78224 in HttpsClientConnection::HttpsClientConnection(IOContext&, TlsClientContext&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unsigned short) http_client.cc:211
    #4 0x105b77610 in std::__1::__unique_if<HttpsClientConnection>::__unique_single std::__1::make_unique[abi:v160006]<HttpsClientConnection, IOContext&, TlsClientContext&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unsigned short&>(IOContext&, TlsClientContext&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unsigned short&) unique_ptr.h:686
    #5 0x105b77218 in HttpsClient::make_connection() http_client.cc:92
    #6 0x105b75f88 in HttpClient::make_request_sync(HttpRequest*, int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) http_client.cc:73
    #7 0x105b832b4 in RestClient::request_sync(int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) rest_client.cc:58
    #8 0x104a3c7b8 in HttpClientSecureTest_ensure_Test::TestBody() test_http_server.cc:1091
    #9 0x104d38d88 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) gtest.cc:2635
    #10 0x104d389a0 in testing::Test::Run() gtest.cc:2674
    #11 0x104d3b2f0 in testing::TestInfo::Run() gtest.cc:2853
    #12 0x104d3ea74 in testing::TestSuite::Run() gtest.cc:3012
    #13 0x104d5f7a0 in testing::internal::UnitTestImpl::RunAllTests() gtest.cc:5870
    #14 0x104d5e7d0 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) gtest.cc:2635
    #15 0x104d5e37c in testing::UnitTest::Run() gtest.cc:5444
    #16 0x104a4c0c0 in main test_http_server.cc:1887
    #17 0x185d350dc  (<unknown module>)

==80462==Register values:
 x[0] = 0x0000000106071830   x[1] = 0x0000000109757cd0   x[2] = 0x000000000000019c   x[3] = 0x00000001095b03e0  
 x[4] = 0x00000101000001c0   x[5] = 0x0000000000000100   x[6] = 0x0000010100000180   x[7] = 0x0000000000000000  
 x[8] = 0x00000001060718d4   x[9] = 0x00000000ffffffff  x[10] = 0x0000000000000101  x[11] = 0x0000000000000000  
x[12] = 0x0000000000000000  x[13] = 0x0000000000000001  x[14] = 0x0000000100000000  x[15] = 0x00000001000000c0  
x[16] = 0x00000001089e72e8  x[17] = 0x0000000108a380b8  x[18] = 0x0000000000000000  x[19] = 0x0000000106071830  
x[20] = 0x0000000000000000  x[21] = 0x0000000000000001  x[22] = 0x000000010c305500  x[23] = 0x0000000000000005  
x[24] = 0x00000000ffffffff  x[25] = 0x000000010c20f200  x[26] = 0x0000000109462ac0  x[27] = 0x0000007000020000  
x[28] = 0x000000016b3d1360     fp = 0x000000016b3d1180     lr = 0x00000001062ecb78     sp = 0x000000016b3d1160  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: BUS (libssl.3.dylib:arm64+0x11b78) in SSL_CTX_free+0x20
==80462==ABORTING

How to repeat:
CMake options used are
-DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DCMAKE_BUILD_TYPE=Debug -DWITH_DEBUG=ON -DMYSQL_MAINTAINER_MODE=ON -DDOWNLOAD_BOOST=ON -DWITH_BOOST=~/vilniusdb/mysql-boost/ -DWITH_SYSTEM_LIBS=ON -DFORCE_COLORED_OUTPUT=ON -DCMAKE_C_FLAGS_DEBUG=-g -DCMAKE_CXX_FLAGS_DEBUG=-g -DCMAKE_CXX_FLAGS_RELEASE=-O2 -g -DNDEBUG -Wno-unused-variable -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON
[22 Jan 2024 12:31] Laurynas Biveinis
Same error on
./runtime_output_directory/routertest_component_rest_api_enable
...
[ RUN      ] TestRestApiEnable.ensure_rest_works_on_custom_port
AddressSanitizer:DEADLYSIGNAL
=================================================================
==80732==ERROR: AddressSanitizer: BUS on unknown address (pc 0x000105b39b78 bp 0x00016bcd4ec0 sp 0x00016bcd4ea0 T0)
==80732==The signal is caused by a WRITE memory access.
==80732==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
    #0 0x105b39b78 in SSL_CTX_free+0x20 (libssl.3.dylib:arm64+0x11b78)
    #1 0x105b38b74 in SSL_free+0x68 (libssl.3.dylib:arm64+0x10b74)
    #2 0x1052561cc in bufferevent_openssl_new_impl+0x134 (libevent_openssl-2.1.7.dylib:arm64+0x21cc)
    #3 0x1053c4224 in HttpsClientConnection::HttpsClientConnection(IOContext&, TlsClientContext&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unsigned short) http_client.cc:211
    #4 0x1053c3610 in std::__1::__unique_if<HttpsClientConnection>::__unique_single std::__1::make_unique[abi:v160006]<HttpsClientConnection, IOContext&, TlsClientContext&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unsigned short&>(IOContext&, TlsClientContext&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unsigned short&) unique_ptr.h:686
    #5 0x1053c3218 in HttpsClient::make_connection() http_client.cc:92
    #6 0x1053c1f88 in HttpClient::make_request_sync(HttpRequest*, int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) http_client.cc:73
    #7 0x1053cf2b4 in RestClient::request_sync(int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) rest_client.cc:58
    #8 0x1043d3c68 in request_json(RestClient&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, int, int, rapidjson::GenericDocument<rapidjson::UTF8<char>, rapidjson::CrtAllocator, rapidjson::CrtAllocator>&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) rest_api_testutils.cc:85
    #9 0x104137954 in TestRestApiEnable::assert_rest_works(unsigned short) test_rest_api_enable.cc:287
    #10 0x104136db8 in TestRestApiEnable_ensure_rest_works_on_custom_port_Test::TestBody() test_rest_api_enable.cc:587
    #11 0x10449711c in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) gtest.cc:2635
    #12 0x104496d34 in testing::Test::Run() gtest.cc:2674
    #13 0x10449963c in testing::TestInfo::Run() gtest.cc:2853
    #14 0x10449ccec in testing::TestSuite::Run() gtest.cc:3012
    #15 0x1044bd98c in testing::internal::UnitTestImpl::RunAllTests() gtest.cc:5870
    #16 0x1044bc9bc in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) gtest.cc:2635
    #17 0x1044bc568 in testing::UnitTest::Run() gtest.cc:5444
    #18 0x1041566dc in main test_rest_api_enable.cc:1094
    #19 0x185d350dc  (<unknown module>)

==80732==Register values:
 x[0] = 0x00000001058bd830   x[1] = 0x0000000108fa3cd0   x[2] = 0x000000000000019c   x[3] = 0x0000000108dfc3e0  
 x[4] = 0x00000101000001c0   x[5] = 0x0000000000000100   x[6] = 0x0000010100000180   x[7] = 0x0000000000000000  
 x[8] = 0x00000001058bd8d4   x[9] = 0x00000000ffffffff  x[10] = 0x0000000000000101  x[11] = 0x0000000000000000  
x[12] = 0x0000000000000000  x[13] = 0x0000000000000001  x[14] = 0x0000000100000000  x[15] = 0x00000001000000c0  
x[16] = 0x00000001082332e8  x[17] = 0x00000001082840b8  x[18] = 0x0000000000000000  x[19] = 0x00000001058bd830  
x[20] = 0x0000000000000000  x[21] = 0x0000000000000001  x[22] = 0x000000010c200100  x[23] = 0x0000000000000005  
x[24] = 0x00000000ffffffff  x[25] = 0x000000010b900080  x[26] = 0x0000000108caeac0  x[27] = 0x0000007000020000  
x[28] = 0x000000016bcd50a0     fp = 0x000000016bcd4ec0     lr = 0x0000000105b38b78     sp = 0x000000016bcd4ea0  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: BUS (libssl.3.dylib:arm64+0x11b78) in SSL_CTX_free+0x20
==80732==ABORTING
[24 Jan 2024 6:00] MySQL Verification Team
Hello Laurynas,

Thank you for the report and feedback!
I'm able to reproduce only on Mac(M1, MacOSX14.1.2) and no issues observed on x86*.

regards,
Umesh
[8 May 2024 13:24] Laurynas Biveinis
Same on 8.0.37
[8 May 2024 13:25] Laurynas Biveinis
No ASan error on 8.4.0, but the sanitizer output is not clean with a UBSan error:

[ RUN      ] Spec/HttpServerPlainTest.ensure/bind_address_ipv4_any_404
/Users/laurynas/vilniusdb/mysql-8.4.0/extra/libcno/libcno-208939f540957a35b337dacdd5c5e34d51821bd2/cno/common.h:150:16: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/laurynas/vilniusdb/mysql-8.4.0/extra/libcno/libcno-208939f540957a35b337dacdd5c5e34d51821bd2/cno/common.h:150:16 in
[4 Jul 2024 8:43] Laurynas Biveinis
No changes in 8.0.38 / 8.4.1 from their previous versions (ASan error in 8.0; UBSan in 8.4)
9.0.0 fails with the same UBSan error as 8.4
[17 Oct 2024 13:26] Laurynas Biveinis
Did not see any instances so far under 8.0.40 / 8.4.3 / 9.1.0

Portions of this website are copyright © 2001, 2002 The PHP Group

Page generated in 0.057 sec. using MySQL 8.4.7-u6-cloud

Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the respective copyright holders.
It is not reviewed in advance by Oracle and does not necessarily represent the opinion of Oracle or any other party.