[BugFix] Fix UAF in shared UDF #54592

stdpain · 2025-01-02T09:10:34Z

Why I'm doing:

In shared UDF the function context object is cached in memory, this can lead to a UAF when accessing the function context, resulting in undefined behavior.

What I'm doing:

In this commit, we remove the Function Context object of BatchCallStub. Use the StatusOr interface instead of the control flow.

==1404951==ERROR: AddressSanitizer: heap-use-after-free on address 0x614001250e80 at pc 0x00000c6298a1 bp 0x7f7f81b806f0 sp 0x7f7f81b806e0
READ of size 8 at 0x614001250e80 thread T590
    #0 0xc6298a0 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::size() const /usr/include/c++/11/bits/basic_string.h:921
    #1 0xc685eed in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::empty() const /usr/include/c++/11/bits/basic_string.h:1024
    #2 0x14934659 in starrocks::FunctionContext::has_error() const be/src/exprs/function_context.cpp:160
    #3 0x162357c1 in starrocks::UDFFunctionCallHelper::call(starrocks::FunctionContext*, std::vector<std::shared_ptr<starrocks::Column>, std::allocator<std::shared_ptr<starrocks::Column> > >&, unsigned long) be/src/exprs/java_function_call_expr.cpp:81
    #4 0x1622959e in operator() be/src/exprs/java_function_call_expr.cpp:114
    #5 0x16231d53 in __invoke_impl<starrocks::Status, starrocks::JavaFunctionCallExpr::evaluate_checked(starrocks::ExprContext*, starrocks::Chunk*)::<lambda()>&> /usr/include/c++/11/bits/invoke.h:61
    #6 0x16231093 in __invoke_r<starrocks::Status, starrocks::JavaFunctionCallExpr::evaluate_checked(starrocks::ExprContext*, starrocks::Chunk*)::<lambda()>&> /usr/include/c++/11/bits/invoke.h:116
    #7 0x16230746 in _M_invoke /usr/include/c++/11/bits/std_function.h:291
    #8 0xe2ada11 in std::function<starrocks::Status ()>::operator()() const /usr/include/c++/11/bits/std_function.h:590
    #9 0x19a18955 in starrocks::call_function_in_pthread(starrocks::RuntimeState*, std::function<starrocks::Status ()> const&) be/src/udf/java/utils.cpp:45
    #10 0x16229da8 in starrocks::JavaFunctionCallExpr::evaluate_checked(starrocks::ExprContext*, starrocks::Chunk*) be/src/exprs/java_function_call_expr.cpp:117
    #11 0x1491137f in starrocks::ExprContext::evaluate(starrocks::Expr*, starrocks::Chunk*, unsigned char*) be/src/exprs/expr_context.cpp:188
    #12 0x14910a53 in starrocks::ExprContext::evaluate(starrocks::Chunk*, unsigned char*) be/src/exprs/expr_context.cpp:164
    #13 0xfd85334 in starrocks::pipeline::ProjectOperator::push_chunk(starrocks::RuntimeState*, std::shared_ptr<starrocks::Chunk> const&) be/src/exec/pipeline/project_operator.cpp:60
    #14 0x10156289 in starrocks::pipeline::PipelineDriver::process(starrocks::RuntimeState*, int) be/src/exec/pipeline/pipeline_driver.cpp:352

close https://github.com/StarRocks/StarRocksTest/issues/9031

What type of PR is this:

Does this PR entail a change in behavior?

Yes, this PR will result in a change in behavior.
No, this PR will not result in a change in behavior.

If yes, please specify the type of change:

Interface/UI changes: syntax, type conversion, expression evaluation, display information
Parameter changes: default values, similar parameters but with different default values
Policy changes: use new policy to replace old one, functionality automatically enabled
Feature removed
Miscellaneous: upgrade & downgrade compatibility, etc.

Checklist:

I have added test cases for my bug fix or my new feature
This pr needs user documentation (for new or modified features or behaviors)
- I have added documentation for my new feature or new function
This is a backport pr

Bugfix cherry-pick branch check:

In shared UDF the function context object is cached in memory, this can lead to a UAF when accessing the function context, resulting in undefined behavior. In this commit, we remove the Function Context object of BatchCallStub. Use the StatusOr interface instead of the control flow. Signed-off-by: stdpain <[email protected]>

github-actions · 2025-01-02T13:15:38Z

[Java-Extensions Incremental Coverage Report]

✅ pass : 0 / 0 (0%)

github-actions · 2025-01-02T13:15:46Z

[FE Incremental Coverage Report]

✅ pass : 0 / 0 (0%)

github-actions · 2025-01-02T13:26:06Z

[BE Incremental Coverage Report]

✅ pass : 11 / 11 (100.00%)

file detail

	path	covered_line	new_line	coverage	not_covered_line_detail
🔵	be/src/udf/java/java_udf.cpp	3	3	100.00%	[]
🔵	be/src/exprs/java_function_call_expr.cpp	6	6	100.00%	[]
🔵	be/src/udf/java/java_udf.h	2	2	100.00%	[]

github-actions · 2025-01-02T13:42:18Z

@Mergifyio backport branch-3.4

github-actions · 2025-01-02T13:42:20Z

@Mergifyio backport branch-3.3

github-actions · 2025-01-02T13:42:21Z

@Mergifyio backport branch-3.2

github-actions · 2025-01-02T13:42:22Z

@Mergifyio backport branch-3.1

mergify · 2025-01-02T13:42:24Z

backport branch-3.4

✅ Backports have been created

#54607 [BugFix] Fix UAF in shared UDF (backport #54592) has been created for branch branch-3.4

mergify · 2025-01-02T13:42:26Z

backport branch-3.3

✅ Backports have been created

#54608 [BugFix] Fix UAF in shared UDF (backport #54592) has been created for branch branch-3.3

mergify · 2025-01-02T13:42:29Z

backport branch-3.2

✅ Backports have been created

#54609 [BugFix] Fix UAF in shared UDF (backport #54592) has been created for branch branch-3.2

mergify · 2025-01-02T13:42:31Z

backport branch-3.1

✅ Backports have been created

#54610 [BugFix] Fix UAF in shared UDF (backport #54592) has been created for branch branch-3.1 but encountered conflicts

Signed-off-by: stdpain <[email protected]> (cherry picked from commit a29b2b6)

Signed-off-by: stdpain <[email protected]> (cherry picked from commit a29b2b6) # Conflicts: # be/src/exprs/java_function_call_expr.cpp # be/src/exprs/java_function_call_expr.h

stdpain · 2025-01-02T14:03:15Z

https://github.com/Mergifyio backport branch-3.3.8

mergify · 2025-01-02T14:03:22Z

backport branch-3.3.8

✅ Backports have been created

#54611 [BugFix] Fix UAF in shared UDF (backport #54592) has been created for branch branch-3.3.8

Signed-off-by: stdpain <[email protected]> (cherry picked from commit a29b2b6)

Co-authored-by: stdpain <[email protected]>

Co-authored-by: stdpain <[email protected]> (cherry picked from commit 20ce63a)

…54613) Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

Co-authored-by: stdpain <[email protected]>

stdpain · 2025-01-03T11:42:10Z

https://github.com/Mergifyio backport branch-3.4.0-rc01

mergify · 2025-01-03T11:42:45Z

backport branch-3.4.0-rc01

✅ Backports have been created

#54693 [BugFix] Fix UAF in shared UDF (backport #54592) has been created for branch branch-3.4.0-rc01

Signed-off-by: stdpain <[email protected]> (cherry picked from commit a29b2b6)

Co-authored-by: stdpain <[email protected]>

stdpain requested a review from a team as a code owner January 2, 2025 09:10

mergify bot assigned stdpain Jan 2, 2025

github-actions bot added 3.4 3.3 3.2 3.1 labels Jan 2, 2025

satanson previously approved these changes Jan 2, 2025

View reviewed changes

Update test_jvm_udf

bc605b5

stdpain dismissed satanson’s stale review via bc605b5 January 2, 2025 11:01

Seaven approved these changes Jan 2, 2025

View reviewed changes

kangkaisen approved these changes Jan 2, 2025

View reviewed changes

andyziye merged commit a29b2b6 into StarRocks:main Jan 2, 2025
49 of 50 checks passed

github-actions bot removed the 3.4 label Jan 2, 2025

github-actions bot removed the 3.3 label Jan 2, 2025

github-actions bot removed the 3.2 label Jan 2, 2025

github-actions bot removed the 3.1 label Jan 2, 2025

mergify bot pushed a commit that referenced this pull request Jan 2, 2025

[BugFix] Fix UAF in shared UDF (#54592)

e9fc1ee

Signed-off-by: stdpain <[email protected]> (cherry picked from commit a29b2b6)

mergify bot pushed a commit that referenced this pull request Jan 2, 2025

[BugFix] Fix UAF in shared UDF (#54592)

e19145a

Signed-off-by: stdpain <[email protected]> (cherry picked from commit a29b2b6)

This was referenced Jan 2, 2025

[BugFix] Fix UAF in shared UDF (backport #54592) #54607

Merged

[BugFix] Fix UAF in shared UDF (backport #54592) #54608

Merged

mergify bot pushed a commit that referenced this pull request Jan 2, 2025

[BugFix] Fix UAF in shared UDF (#54592)

68fb43e

Signed-off-by: stdpain <[email protected]> (cherry picked from commit a29b2b6)

mergify bot mentioned this pull request Jan 2, 2025

[BugFix] Fix UAF in shared UDF (backport #54592) #54609

Merged

18 tasks

mergify bot mentioned this pull request Jan 2, 2025

[BugFix] Fix UAF in shared UDF (backport #54592) #54610

Closed

18 tasks

mergify bot pushed a commit that referenced this pull request Jan 2, 2025

[BugFix] Fix UAF in shared UDF (#54592)

2f96df0

Signed-off-by: stdpain <[email protected]> (cherry picked from commit a29b2b6)

mergify bot mentioned this pull request Jan 2, 2025

[BugFix] Fix UAF in shared UDF (backport #54592) #54611

Merged

18 tasks

wanpengfei-git pushed a commit that referenced this pull request Jan 2, 2025

[BugFix] Fix UAF in shared UDF (backport #54592) (#54608)

20ce63a

Co-authored-by: stdpain <[email protected]>

github-actions bot added the 3.3-merged label Jan 2, 2025

wanpengfei-git pushed a commit that referenced this pull request Jan 2, 2025

[BugFix] Fix UAF in shared UDF (backport #54592) (#54607)

8144874

Co-authored-by: stdpain <[email protected]>

mergify bot added a commit that referenced this pull request Jan 2, 2025

[BugFix] Fix UAF in shared UDF (backport #54592) (#54608)

0005c67

Co-authored-by: stdpain <[email protected]> (cherry picked from commit 20ce63a)

github-actions bot added the 3.4-merged label Jan 2, 2025

andyziye pushed a commit that referenced this pull request Jan 2, 2025

[BugFix] Fix UAF in shared UDF (backport #54592) (backport #54608) (#…

abf460f

…54613) Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

wanpengfei-git pushed a commit that referenced this pull request Jan 3, 2025

[BugFix] Fix UAF in shared UDF (backport #54592) (#54611)

b55f584

Co-authored-by: stdpain <[email protected]>

wanpengfei-git pushed a commit that referenced this pull request Jan 3, 2025

[BugFix] Fix UAF in shared UDF (backport #54592) (#54609)

9c501cc

Co-authored-by: stdpain <[email protected]>

github-actions bot added 3.2-merged 3.4 3.3 3.2 labels Jan 3, 2025

mergify bot pushed a commit that referenced this pull request Jan 3, 2025

[BugFix] Fix UAF in shared UDF (#54592)

46cae9f

Signed-off-by: stdpain <[email protected]> (cherry picked from commit a29b2b6)

mergify bot mentioned this pull request Jan 3, 2025

[BugFix] Fix UAF in shared UDF (backport #54592) #54693

Merged

18 tasks

andyziye pushed a commit that referenced this pull request Jan 3, 2025

[BugFix] Fix UAF in shared UDF (backport #54592) (#54693)

67a0be8

Co-authored-by: stdpain <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[BugFix] Fix UAF in shared UDF #54592

[BugFix] Fix UAF in shared UDF #54592

stdpain commented Jan 2, 2025 •

edited

Loading

github-actions bot commented Jan 2, 2025

github-actions bot commented Jan 2, 2025

github-actions bot commented Jan 2, 2025

github-actions bot commented Jan 2, 2025

github-actions bot commented Jan 2, 2025

github-actions bot commented Jan 2, 2025

github-actions bot commented Jan 2, 2025

mergify bot commented Jan 2, 2025 •

edited

Loading

mergify bot commented Jan 2, 2025 •

edited

Loading

mergify bot commented Jan 2, 2025 •

edited

Loading

mergify bot commented Jan 2, 2025 •

edited

Loading

stdpain commented Jan 2, 2025

mergify bot commented Jan 2, 2025 •

edited

Loading

stdpain commented Jan 3, 2025

mergify bot commented Jan 3, 2025 •

edited

Loading

[BugFix] Fix UAF in shared UDF #54592

[BugFix] Fix UAF in shared UDF #54592

Conversation

stdpain commented Jan 2, 2025 • edited Loading

Why I'm doing:

What I'm doing:

What type of PR is this:

Checklist:

Bugfix cherry-pick branch check:

github-actions bot commented Jan 2, 2025

[Java-Extensions Incremental Coverage Report]

github-actions bot commented Jan 2, 2025

[FE Incremental Coverage Report]

github-actions bot commented Jan 2, 2025

[BE Incremental Coverage Report]

file detail

github-actions bot commented Jan 2, 2025

github-actions bot commented Jan 2, 2025

github-actions bot commented Jan 2, 2025

github-actions bot commented Jan 2, 2025

mergify bot commented Jan 2, 2025 • edited Loading

✅ Backports have been created

mergify bot commented Jan 2, 2025 • edited Loading

✅ Backports have been created

mergify bot commented Jan 2, 2025 • edited Loading

✅ Backports have been created

mergify bot commented Jan 2, 2025 • edited Loading

✅ Backports have been created

stdpain commented Jan 2, 2025

mergify bot commented Jan 2, 2025 • edited Loading

✅ Backports have been created

stdpain commented Jan 3, 2025

mergify bot commented Jan 3, 2025 • edited Loading

✅ Backports have been created

stdpain commented Jan 2, 2025 •

edited

Loading

mergify bot commented Jan 2, 2025 •

edited

Loading

mergify bot commented Jan 2, 2025 •

edited

Loading

mergify bot commented Jan 2, 2025 •

edited

Loading

mergify bot commented Jan 2, 2025 •

edited

Loading

mergify bot commented Jan 2, 2025 •

edited

Loading

mergify bot commented Jan 3, 2025 •

edited

Loading