Type:
Bug
Priority:
Critical
Resolution:
Fixed
Affects Version/s:
10.1.26 , 10.1.37 , 10.0(EOL) , 10.1(EOL) , 10.2(EOL) , 10.3(EOL) , 10.4(EOL)
With a set of data in the mysql system schema `FLUSH PRIVILEGES` crashes the server with segfault.
There seem to be an aleatory factor that determines the number of times it's needed to FLUSH PRIVILEGES before the crash, between 0 and 19 was tested.
sql_acl.cc:5306:
GRANT_NAME **first= NULL, *UNINIT_VAR(merged);
ulong UNINIT_VAR(privs);
for (GRANT_NAME **cur= grants.front(); cur <= grants.back(); cur++)
{
ACL_DB **first= NULL, *UNINIT_VAR(merged);
ulong UNINIT_VAR(access), update_flags= 0 ;
for (ACL_DB **cur= dbs.front(); cur <= dbs.back(); cur++)
{
if (!first || (!dbname && strcmp(cur[ 0 ]->db, cur[- 1 ]->db)))
{ // new db name series
update_flags|= *update_role_db*(merged, first, access, grantee->user.str);
merged= NULL;
access= 0 ;
first= cur;
}
if (strcmp(cur[ 0 ]->user, grantee->user.str) == 0 ) *# SEGFAULT*
access|= (merged= cur[ 0 ])->initial_access;
else
access|= cur[ 0 ]->access;
}
What I noticed is that when the problem occurs `cur` is valued before the call to update_role_db(), but after it comes back `cur` is empty (at least if I'm not mistaken).
It definitely depends on data in the mysql schema tables.
I could not identify one specific data culprit, also because the occurrence seems to happen after a variable number of `FLUSH PRIVILEGES`.
Stack trace:
Thread pointer: 0x7f3ea83a8008
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7f3e9d517110 thread_stack 0x48400
mysys/stacktrace.c:268(my_print_stacktrace)[0x555a1a1bdd4b]
sql/signal_handler.cc:168(handle_fatal_signal)[0x555a19d1a485]
/lib64/libpthread.so.0(+0x3639a0f7e0)[0x7f43230827e0]
/lib64/libc.so.6(+0x3638f28696)[0x7f43219e8696]
sql/sql_acl.cc:5317(merge_role_db_privileges)[0x555a19b42e9b]
sql/sql_acl.cc:5081(traverse_role_graph_impl)[0x555a19b35bab]
sql/sql_acl.cc:6779(propagate_role_grants_action)[0x555a19b35de4]
mysys/hash.c:769(my_hash_iterate)[0x555a1a19fd6c]
sql/sql_acl.cc:6845(grant_reload(THD*))[0x555a19b44dbc]
sql/sql_reload.cc:86(reload_acl_and_cache(THD*, unsigned long long, TABLE_LIST*, int*))[0x555a19c851ce]
sql/sql_parse.cc:4885(mysql_execute_command(THD*))[0x555a19b9e7e3]
sql/sql_parse.cc:7466(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x555a19ba6405]
sql/sql_parse.cc:1582(dispatch_command(enum_server_command, THD*, char*, unsigned int))[0x555a19ba9015]
sql/sql_parse.cc:1126(do_command(THD*))[0x555a19ba9687]
sql/sql_connect.cc:1330(do_handle_one_connection(THD*))[0x555a19c6b99f]
sql/sql_connect.cc:1244(handle_one_connection)[0x555a19c6bad7]
perfschema/pfs.cc:1864(pfs_spawn_thread)[0x555a19e8bb8d]
/lib64/libpthread.so.0(+0x3639a07aa1)[0x7f432307aaa1]
/lib64/libc.so.6(clone+0x6d)[0x7f43219a8bdd]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x7f3eac4364e5): FLUSH PRIVILEGES
Connection ID (thread ID): 3
Status: NOT_KILLED
{"report":{"fcp":3321.5,"ttfb":1067.5999999046326,"pageVisibility":"visible","entityId":71218,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":32,"apdex":0.5,"journeyId":"4d52348b-400a-4863-9853-ec2c7bf7db24","navigationType":0,"readyForUser":2782.2999997138977,"redirectCount":0,"resourceLoadedEnd":4697.199999809265,"resourceLoadedStart":1391.7999997138977,"resourceTiming":[{"duration":376.09999990463257,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":1391.7999997138977,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1391.7999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1767.8999996185303,"responseStart":0,"secureConnectionStart":0},{"duration":376,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2cib/820016/12ta74/494e4c556ecbb29f90a3d3b4f09cb99c/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true&whisper-enabled=true","startTime":1392.0999999046326,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1392.0999999046326,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1768.0999999046326,"responseStart":0,"secureConnectionStart":0},{"duration":369.1000003814697,"initiatorType":"script","name":"https://jira.mariadb.org/s/0917945aaa57108d00c5076fea35e069-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":1392.3999996185303,"connectEnd":1392.3999996185303,"connectStart":1392.3999996185303,"domainLookupEnd":1392.3999996185303,"domainLookupStart":1392.3999996185303,"fetchStart":1392.3999996185303,"redirectEnd":0,"redirectStart":0,"requestStart":1392.3999996185303,"responseEnd":1761.5,"responseStart":1761.5,"secureConnectionStart":1392.3999996185303},{"duration":492.30000019073486,"initiatorType":"script","name":"https://jira.mariadb.org/s/2d8175ec2fa4c816e8023260bd8c1786-CDN/lu2cib/820016/12ta74/494e4c556ecbb29f90a3d3b4f09cb99c/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true&whisper-enabled=true","startTime":1393.2999997138977,"connectEnd":1393.2999997138977,"connectStart":1393.2999997138977,"domainLookupEnd":1393.2999997138977,"domainLookupStart":1393.2999997138977,"fetchStart":1393.2999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":1393.2999997138977,"responseEnd":1885.5999999046326,"responseStart":1885.5999999046326,"secureConnectionStart":1393.2999997138977},{"duration":631.5999999046326,"initiatorType":"script","name":"https://jira.mariadb.org/s/a9324d6758d385eb45c462685ad88f1d-CDN/lu2cib/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":1393.5,"connectEnd":1393.5,"connectStart":1393.5,"domainLookupEnd":1393.5,"domainLookupStart":1393.5,"fetchStart":1393.5,"redirectEnd":0,"redirectStart":0,"requestStart":1393.5,"responseEnd":2025.0999999046326,"responseStart":2025.0999999046326,"secureConnectionStart":1393.5},{"duration":632.0999999046326,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":1393.5999999046326,"connectEnd":1393.5999999046326,"connectStart":1393.5999999046326,"domainLookupEnd":1393.5999999046326,"domainLookupStart":1393.5999999046326,"fetchStart":1393.5999999046326,"redirectEnd":0,"redirectStart":0,"requestStart":1393.5999999046326,"responseEnd":2025.6999998092651,"responseStart":2025.6999998092651,"secureConnectionStart":1393.5999999046326},{"duration":775,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":1393.7999997138977,"connectEnd":1393.7999997138977,"connectStart":1393.7999997138977,"domainLookupEnd":1393.7999997138977,"domainLookupStart":1393.7999997138977,"fetchStart":1393.7999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":1393.7999997138977,"responseEnd":2168.7999997138977,"responseStart":2168.7999997138977,"secureConnectionStart":1393.7999997138977},{"duration":1120.3999996185303,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2cib/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":1394,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1394,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":2514.3999996185303,"responseStart":0,"secureConnectionStart":0},{"duration":1007.7999997138977,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":1394,"connectEnd":1394,"connectStart":1394,"domainLookupEnd":1394,"domainLookupStart":1394,"fetchStart":1394,"redirectEnd":0,"redirectStart":0,"requestStart":1394,"responseEnd":2401.7999997138977,"responseStart":2401.7999997138977,"secureConnectionStart":1394},{"duration":1179,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":1394.2999997138977,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1394.2999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":2573.2999997138977,"responseStart":0,"secureConnectionStart":0},{"duration":1174.8000001907349,"initiatorType":"script","name":"https://jira.mariadb.org/s/5d5e8fe91fbc506585e83ea3b62ccc4b-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":1394.3999996185303,"connectEnd":1394.3999996185303,"connectStart":1394.3999996185303,"domainLookupEnd":1394.3999996185303,"domainLookupStart":1394.3999996185303,"fetchStart":1394.3999996185303,"redirectEnd":0,"redirectStart":0,"requestStart":1394.3999996185303,"responseEnd":2569.199999809265,"responseStart":2569.199999809265,"secureConnectionStart":1394.3999996185303},{"duration":3213.0999999046326,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":1396,"connectEnd":1396,"connectStart":1396,"domainLookupEnd":1396,"domainLookupStart":1396,"fetchStart":1396,"redirectEnd":0,"redirectStart":0,"requestStart":1396,"responseEnd":4609.099999904633,"responseStart":4609.099999904633,"secureConnectionStart":1396},{"duration":3301.0999999046326,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":1396.0999999046326,"connectEnd":1396.0999999046326,"connectStart":1396.0999999046326,"domainLookupEnd":1396.0999999046326,"domainLookupStart":1396.0999999046326,"fetchStart":1396.0999999046326,"redirectEnd":0,"redirectStart":0,"requestStart":1396.0999999046326,"responseEnd":4697.199999809265,"responseStart":4697.199999809265,"secureConnectionStart":1396.0999999046326},{"duration":1515.7000002861023,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":2133.7999997138977,"connectEnd":2133.7999997138977,"connectStart":2133.7999997138977,"domainLookupEnd":2133.7999997138977,"domainLookupStart":2133.7999997138977,"fetchStart":2133.7999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":2133.7999997138977,"responseEnd":3649.5,"responseStart":3649.5,"secureConnectionStart":2133.7999997138977},{"duration":2147,"initiatorType":"script","name":"https://www.google-analytics.com/analytics.js","startTime":2674.5999999046326,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":2674.5999999046326,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":4821.599999904633,"responseStart":0,"secureConnectionStart":0}],"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":242,"responseStart":1067,"responseEnd":1391,"domLoading":1141,"domInteractive":4902,"domContentLoadedEventStart":4902,"domContentLoadedEventEnd":5014,"domComplete":7905,"loadEventStart":7905,"loadEventEnd":7908,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":4829},{"name":"bigPipe.sidebar-id.end","time":4829.89999961853},{"name":"bigPipe.activity-panel-pipe-id.start","time":4830.099999904633},{"name":"bigPipe.activity-panel-pipe-id.end","time":4832.299999713898},{"name":"activityTabFullyLoaded","time":5030}],"measures":[],"correlationId":"101cd6cc1d5754","effectiveType":"4g","downlink":9.5,"rtt":0,"serverDuration":154,"dbReadsTimeInMs":12,"dbConnsTimeInMs":22,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}