Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-14237

Server crash on query with regexp_substr

Details

    Description

      select * from (
      select regexp_substr('a','^[A-Za-z]+') f
      )t
      where f = f

      causes server reboot. Error in mysql.err is :

      Error in `/usr/sbin/mysqld': double free or corruption (out): 0x00007f0730006110 ***
      

      After attaching gdb the cause seems to be in Item_func_regexp_substr::cleanup() function.

      Attachments

        Activity

          Thanks for the report.
          The workaround might be optimizer_switch='condition_pushdown_for_derived=off'.

          10.2.10 release build

          #2  <signal handler called>
          #3  0x00007f3d433d3fcf in raise () from /lib/x86_64-linux-gnu/libc.so.6
          #4  0x00007f3d433d53fa in abort () from /lib/x86_64-linux-gnu/libc.so.6
          #5  0x00007f3d43411bd0 in __libc_message () from /lib/x86_64-linux-gnu/libc.so.6
          #6  0x00007f3d43417f96 in malloc_printerr () from /lib/x86_64-linux-gnu/libc.so.6
          #7  0x00007f3d4341878e in _int_free () from /lib/x86_64-linux-gnu/libc.so.6
          #8  0x000055adee3c67b3 in cleanup (this=0x7f3d2c0121f0) at /home/buildbot/buildbot/build/sql/item_cmpfunc.h:2090
          #9  Item_func_regexp_substr::cleanup (this=0x7f3d2c012130) at /home/buildbot/buildbot/build/sql/item_strfunc.h:352
          #10 0x000055adee35092a in cleanup_processor (this=<optimized out>, arg=<optimized out>) at /home/buildbot/buildbot/build/sql/item.cc:657
          #11 Item::cleanup_processor (this=<optimized out>, arg=<optimized out>) at /home/buildbot/buildbot/build/sql/item.cc:654
          #12 0x000055adee17cbe2 in Item_args::walk_args (processor=&virtual table offset 784, walk_subquery=<optimized out>, arg=arg@entry=0x0, this=0x7f3d2c011b30, this=0x7f3d2c011b30) at /home/buildbot/buildbot/build/sql/item.h:3873
          #13 0x000055adee1885ec in Item_func_or_sum::walk (this=0x7f3d2c011aa8, processor=&virtual table offset 784, walk_subquery=<optimized out>, arg=0x0) at /home/buildbot/buildbot/build/sql/item.h:4158
          #14 0x000055adee1a24b8 in pushdown_cond_for_derived (thd=0x7f3d2c0009a8, cond=<optimized out>, derived=derived@entry=0x7f3d2c010190) at /home/buildbot/buildbot/build/sql/sql_derived.cc:1238
          #15 0x000055adee20f545 in JOIN::optimize_inner (this=this@entry=0x7f3d2c010be0) at /home/buildbot/buildbot/build/sql/sql_select.cc:1334
          #16 0x000055adee21292f in JOIN::optimize (this=this@entry=0x7f3d2c010be0) at /home/buildbot/buildbot/build/sql/sql_select.cc:1085
          #17 0x000055adee212b6d in mysql_select (thd=thd@entry=0x7f3d2c0009a8, tables=0x7f3d2c010190, wild_num=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=result@entry=0x7f3d2c010bc0, unit=unit@entry=0x7f3d2c004388, select_lex=select_lex@entry=0x7f3d2c004ac0) at /home/buildbot/buildbot/build/sql/sql_select.cc:3664
          #18 0x000055adee213ef4 in handle_select (thd=thd@entry=0x7f3d2c0009a8, lex=lex@entry=0x7f3d2c0042c0, result=result@entry=0x7f3d2c010bc0, setup_tables_done_option=setup_tables_done_option@entry=0) at /home/buildbot/buildbot/build/sql/sql_select.cc:373
          #19 0x000055adee105b40 in execute_sqlcom_select (thd=thd@entry=0x7f3d2c0009a8, all_tables=0x7f3d2c010190) at /home/buildbot/buildbot/build/sql/sql_parse.cc:6420
          #20 0x000055adee1c2e1a in mysql_execute_command (thd=thd@entry=0x7f3d2c0009a8) at /home/buildbot/buildbot/build/sql/sql_parse.cc:3454
          #21 0x000055adee1c81ba in mysql_parse (thd=thd@entry=0x7f3d2c0009a8, rawbuf=<optimized out>, length=71, parser_state=parser_state@entry=0x7f3d3d490260, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /home/buildbot/buildbot/build/sql/sql_parse.cc:7861
          #22 0x000055adee1ca581 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f3d2c0009a8, packet=<optimized out>, packet_length=738258960, packet_length@entry=71, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /home/buildbot/buildbot/build/sql/sql_parse.cc:1805
          #23 0x000055adee1cab5e in do_command (thd=0x7f3d2c0009a8) at /home/buildbot/buildbot/build/sql/sql_parse.cc:1360
          #24 0x000055adee287e4f in do_handle_one_connection (connect=connect@entry=0x55adefefa668) at /home/buildbot/buildbot/build/sql/sql_connect.cc:1354
          #25 0x000055adee287f74 in handle_one_connection (arg=arg@entry=0x55adefefa668) at /home/buildbot/buildbot/build/sql/sql_connect.cc:1260
          #26 0x000055adee4c0c2d in pfs_spawn_thread (arg=0x55adefea4fb8) at /home/buildbot/buildbot/build/storage/perfschema/pfs.cc:1863
          #27 0x00007f3d43dcc494 in start_thread (arg=0x7f3d3d491700) at pthread_create.c:333
          #28 0x00007f3d4348993f in clone () from /lib/x86_64-linux-gnu/libc.so.6
          

          10.2 debug 7cca0df0d75

          Error: Freeing overrun buffer  0x560f73e9da4c, 0x560f73e8b1f5, 0x560f733def88, 0x560f737816f2, 0x560f737e7cea, 0x560f73741d2b, 0x560f733f9c7e, 0x560f7345bb6b
          Allocated at 0x560f733def6e, 0x560f73f06da2, 0x560f73f060bf, 0x560f73779dca, 0x560f73779f21, 0x560f7377a5ec, 0x560f737d9ba8, 0x560f737a3a5b
          Error: Freeing overrun buffer  0x560f73e9da4c, 0x560f73e8b1f5, 0x560f733def88, 0x560f737816f2, mysys/safemalloc.c:194, sql/item_cmpfunc.h:2091, sql/item.cc:658, 0x560f73474db9
          Allocated at 0x560f733def6e, 0x560f73f06da2, 0x560f73f060bf, 0x560f73779dca, 0x560f73779f21, 0x560f7377a5ec, 0x560f737d9ba8, 0x560f737a3a5b
          

          Not reproducible on 10.1.
          Not reproducible on 10.2 with condition_pushdown_for_derived=off.

          elenst Elena Stepanova added a comment - Thanks for the report. The workaround might be optimizer_switch='condition_pushdown_for_derived=off' . 10.2.10 release build #2 <signal handler called> #3 0x00007f3d433d3fcf in raise () from /lib/x86_64-linux-gnu/libc.so.6 #4 0x00007f3d433d53fa in abort () from /lib/x86_64-linux-gnu/libc.so.6 #5 0x00007f3d43411bd0 in __libc_message () from /lib/x86_64-linux-gnu/libc.so.6 #6 0x00007f3d43417f96 in malloc_printerr () from /lib/x86_64-linux-gnu/libc.so.6 #7 0x00007f3d4341878e in _int_free () from /lib/x86_64-linux-gnu/libc.so.6 #8 0x000055adee3c67b3 in cleanup (this=0x7f3d2c0121f0) at /home/buildbot/buildbot/build/sql/item_cmpfunc.h:2090 #9 Item_func_regexp_substr::cleanup (this=0x7f3d2c012130) at /home/buildbot/buildbot/build/sql/item_strfunc.h:352 #10 0x000055adee35092a in cleanup_processor (this=<optimized out>, arg=<optimized out>) at /home/buildbot/buildbot/build/sql/item.cc:657 #11 Item::cleanup_processor (this=<optimized out>, arg=<optimized out>) at /home/buildbot/buildbot/build/sql/item.cc:654 #12 0x000055adee17cbe2 in Item_args::walk_args (processor=&virtual table offset 784, walk_subquery=<optimized out>, arg=arg@entry=0x0, this=0x7f3d2c011b30, this=0x7f3d2c011b30) at /home/buildbot/buildbot/build/sql/item.h:3873 #13 0x000055adee1885ec in Item_func_or_sum::walk (this=0x7f3d2c011aa8, processor=&virtual table offset 784, walk_subquery=<optimized out>, arg=0x0) at /home/buildbot/buildbot/build/sql/item.h:4158 #14 0x000055adee1a24b8 in pushdown_cond_for_derived (thd=0x7f3d2c0009a8, cond=<optimized out>, derived=derived@entry=0x7f3d2c010190) at /home/buildbot/buildbot/build/sql/sql_derived.cc:1238 #15 0x000055adee20f545 in JOIN::optimize_inner (this=this@entry=0x7f3d2c010be0) at /home/buildbot/buildbot/build/sql/sql_select.cc:1334 #16 0x000055adee21292f in JOIN::optimize (this=this@entry=0x7f3d2c010be0) at /home/buildbot/buildbot/build/sql/sql_select.cc:1085 #17 0x000055adee212b6d in mysql_select (thd=thd@entry=0x7f3d2c0009a8, tables=0x7f3d2c010190, wild_num=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=result@entry=0x7f3d2c010bc0, unit=unit@entry=0x7f3d2c004388, select_lex=select_lex@entry=0x7f3d2c004ac0) at /home/buildbot/buildbot/build/sql/sql_select.cc:3664 #18 0x000055adee213ef4 in handle_select (thd=thd@entry=0x7f3d2c0009a8, lex=lex@entry=0x7f3d2c0042c0, result=result@entry=0x7f3d2c010bc0, setup_tables_done_option=setup_tables_done_option@entry=0) at /home/buildbot/buildbot/build/sql/sql_select.cc:373 #19 0x000055adee105b40 in execute_sqlcom_select (thd=thd@entry=0x7f3d2c0009a8, all_tables=0x7f3d2c010190) at /home/buildbot/buildbot/build/sql/sql_parse.cc:6420 #20 0x000055adee1c2e1a in mysql_execute_command (thd=thd@entry=0x7f3d2c0009a8) at /home/buildbot/buildbot/build/sql/sql_parse.cc:3454 #21 0x000055adee1c81ba in mysql_parse (thd=thd@entry=0x7f3d2c0009a8, rawbuf=<optimized out>, length=71, parser_state=parser_state@entry=0x7f3d3d490260, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /home/buildbot/buildbot/build/sql/sql_parse.cc:7861 #22 0x000055adee1ca581 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f3d2c0009a8, packet=<optimized out>, packet_length=738258960, packet_length@entry=71, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /home/buildbot/buildbot/build/sql/sql_parse.cc:1805 #23 0x000055adee1cab5e in do_command (thd=0x7f3d2c0009a8) at /home/buildbot/buildbot/build/sql/sql_parse.cc:1360 #24 0x000055adee287e4f in do_handle_one_connection (connect=connect@entry=0x55adefefa668) at /home/buildbot/buildbot/build/sql/sql_connect.cc:1354 #25 0x000055adee287f74 in handle_one_connection (arg=arg@entry=0x55adefefa668) at /home/buildbot/buildbot/build/sql/sql_connect.cc:1260 #26 0x000055adee4c0c2d in pfs_spawn_thread (arg=0x55adefea4fb8) at /home/buildbot/buildbot/build/storage/perfschema/pfs.cc:1863 #27 0x00007f3d43dcc494 in start_thread (arg=0x7f3d3d491700) at pthread_create.c:333 #28 0x00007f3d4348993f in clone () from /lib/x86_64-linux-gnu/libc.so.6 10.2 debug 7cca0df0d75 Error: Freeing overrun buffer 0x560f73e9da4c, 0x560f73e8b1f5, 0x560f733def88, 0x560f737816f2, 0x560f737e7cea, 0x560f73741d2b, 0x560f733f9c7e, 0x560f7345bb6b Allocated at 0x560f733def6e, 0x560f73f06da2, 0x560f73f060bf, 0x560f73779dca, 0x560f73779f21, 0x560f7377a5ec, 0x560f737d9ba8, 0x560f737a3a5b Error: Freeing overrun buffer 0x560f73e9da4c, 0x560f73e8b1f5, 0x560f733def88, 0x560f737816f2, mysys/safemalloc.c:194, sql/item_cmpfunc.h:2091, sql/item.cc:658, 0x560f73474db9 Allocated at 0x560f733def6e, 0x560f73f06da2, 0x560f73f060bf, 0x560f73779dca, 0x560f73779f21, 0x560f7377a5ec, 0x560f737d9ba8, 0x560f737a3a5b Not reproducible on 10.1. Not reproducible on 10.2 with condition_pushdown_for_derived=off .
          igor Igor Babaev added a comment -

          Here's a more natural test case causing the same problem:

          create table t1 (a char(8));
          insert into t1 values ('b', 'a', 'xx');
           
          select *
          from ( select distinct regexp_substr(t1.a,'^[A-Za-z]+') as f from t1) as t
          where t.f = 'a' or t.f = 'b'
          

          igor Igor Babaev added a comment - Here's a more natural test case causing the same problem: create table t1 (a char(8)); insert into t1 values ('b', 'a', 'xx');   select * from ( select distinct regexp_substr(t1.a,'^[A-Za-z]+') as f from t1) as t where t.f = 'a' or t.f = 'b'
          igor Igor Babaev added a comment -

          A fix for this bug was pushed into 10.2

          igor Igor Babaev added a comment - A fix for this bug was pushed into 10.2

          People

            igor Igor Babaev
            Kavinski Stanley
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.