Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BugFix] Fix UAF in shared UDF (backport #54592) #54610

Closed
wants to merge 1 commit into from

Conversation

mergify[bot]
Copy link
Contributor

@mergify mergify bot commented Jan 2, 2025

Why I'm doing:

In shared UDF the function context object is cached in memory, this can lead to a UAF when accessing the function context, resulting in undefined behavior.

What I'm doing:

In this commit, we remove the Function Context object of BatchCallStub. Use the StatusOr interface instead of the control flow.

==1404951==ERROR: AddressSanitizer: heap-use-after-free on address 0x614001250e80 at pc 0x00000c6298a1 bp 0x7f7f81b806f0 sp 0x7f7f81b806e0
READ of size 8 at 0x614001250e80 thread T590
    #0 0xc6298a0 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::size() const /usr/include/c++/11/bits/basic_string.h:921
    #1 0xc685eed in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::empty() const /usr/include/c++/11/bits/basic_string.h:1024
    #2 0x14934659 in starrocks::FunctionContext::has_error() const be/src/exprs/function_context.cpp:160
    #3 0x162357c1 in starrocks::UDFFunctionCallHelper::call(starrocks::FunctionContext*, std::vector<std::shared_ptr<starrocks::Column>, std::allocator<std::shared_ptr<starrocks::Column> > >&, unsigned long) be/src/exprs/java_function_call_expr.cpp:81
    #4 0x1622959e in operator() be/src/exprs/java_function_call_expr.cpp:114
    #5 0x16231d53 in __invoke_impl<starrocks::Status, starrocks::JavaFunctionCallExpr::evaluate_checked(starrocks::ExprContext*, starrocks::Chunk*)::<lambda()>&> /usr/include/c++/11/bits/invoke.h:61
    #6 0x16231093 in __invoke_r<starrocks::Status, starrocks::JavaFunctionCallExpr::evaluate_checked(starrocks::ExprContext*, starrocks::Chunk*)::<lambda()>&> /usr/include/c++/11/bits/invoke.h:116
    #7 0x16230746 in _M_invoke /usr/include/c++/11/bits/std_function.h:291
    #8 0xe2ada11 in std::function<starrocks::Status ()>::operator()() const /usr/include/c++/11/bits/std_function.h:590
    #9 0x19a18955 in starrocks::call_function_in_pthread(starrocks::RuntimeState*, std::function<starrocks::Status ()> const&) be/src/udf/java/utils.cpp:45
    #10 0x16229da8 in starrocks::JavaFunctionCallExpr::evaluate_checked(starrocks::ExprContext*, starrocks::Chunk*) be/src/exprs/java_function_call_expr.cpp:117
    #11 0x1491137f in starrocks::ExprContext::evaluate(starrocks::Expr*, starrocks::Chunk*, unsigned char*) be/src/exprs/expr_context.cpp:188
    #12 0x14910a53 in starrocks::ExprContext::evaluate(starrocks::Chunk*, unsigned char*) be/src/exprs/expr_context.cpp:164
    #13 0xfd85334 in starrocks::pipeline::ProjectOperator::push_chunk(starrocks::RuntimeState*, std::shared_ptr<starrocks::Chunk> const&) be/src/exec/pipeline/project_operator.cpp:60
    #14 0x10156289 in starrocks::pipeline::PipelineDriver::process(starrocks::RuntimeState*, int) be/src/exec/pipeline/pipeline_driver.cpp:352

close https://github.com/StarRocks/StarRocksTest/issues/9031

What type of PR is this:

  • BugFix
  • Feature
  • Enhancement
  • Refactor
  • UT
  • Doc
  • Tool

Does this PR entail a change in behavior?

  • Yes, this PR will result in a change in behavior.
  • No, this PR will not result in a change in behavior.

If yes, please specify the type of change:

  • Interface/UI changes: syntax, type conversion, expression evaluation, display information
  • Parameter changes: default values, similar parameters but with different default values
  • Policy changes: use new policy to replace old one, functionality automatically enabled
  • Feature removed
  • Miscellaneous: upgrade & downgrade compatibility, etc.

Checklist:

  • I have added test cases for my bug fix or my new feature
  • This pr needs user documentation (for new or modified features or behaviors)
    • I have added documentation for my new feature or new function
  • This is a backport pr

Signed-off-by: stdpain <[email protected]>
(cherry picked from commit a29b2b6)

# Conflicts:
#	be/src/exprs/java_function_call_expr.cpp
#	be/src/exprs/java_function_call_expr.h
@mergify mergify bot added the conflicts label Jan 2, 2025
Copy link
Contributor Author

mergify bot commented Jan 2, 2025

Cherry-pick of a29b2b6 has failed:

On branch mergify/bp/branch-3.1/pr-54592
Your branch is up to date with 'origin/branch-3.1'.

You are currently cherry-picking commit a29b2b6b33.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   be/src/udf/java/java_udf.cpp
	modified:   be/src/udf/java/java_udf.h
	modified:   test/sql/test_udf/R/test_jvm_udf
	modified:   test/sql/test_udf/T/test_jvm_udf

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   be/src/exprs/java_function_call_expr.cpp
	both modified:   be/src/exprs/java_function_call_expr.h

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

@mergify mergify bot mentioned this pull request Jan 2, 2025
24 tasks
@wanpengfei-git wanpengfei-git enabled auto-merge (squash) January 2, 2025 13:45
@mergify mergify bot closed this Jan 2, 2025
auto-merge was automatically disabled January 2, 2025 13:45

Pull request was closed

Copy link
Contributor Author

mergify bot commented Jan 2, 2025

@mergify[bot]: Backport conflict, please reslove the conflict and resubmit the pr

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant