Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Fixed
-
10.4(EOL)
-
Linux, GCC 9.1, QT 5.12.4, MythTV 30+
Description
On upgrade from MariaDB 10.3 to 10.4, merge_key_fields() calls eq_by_collation(), Item_const_eq() and finally String::eq(NULL, <String>, <charset>), and thus SEGV. MariaDB 10.3 and below are not affected. The bug is reliably reproduced, but hard to narrow down, as the same query will execute twice correctly, and crash the server on the third go.
The client in this case is "mythbackend," the server component to the MythTV DVR. It communicates with MariaDB via QT, using prepared statements. The statement that causes the crash is always the same:
SELECT recordid, category, (category = ?) AS catmatch, (category = ?) AS typematch FROM record WHERE type = ? AND (category = ? OR category = ? OR category = 'Default') ORDER BY catmatch DESC, typematch DESC
The mythbackend program reports the DB error as follows:
Query was:
SELECT recordid, category, (category = ?) AS catmatch, (category = ?) AS typematch FROM record WHERE type = ? AND (category = ? OR category = ? OR category = 'Default') ORDER BY catmatch DESC, typematch DESC
Bindings were:
:CAT1="", :CAT2="", :CATTYPE1="", :CATTYPE2="", :TEMPLATE=11
Driver error was:
QMYSQL3: Unable to execute statement
Database error was:
MySQL server has gone away
As mentioned, this query has been run twice before in the same session, successfully. Immediately prior to the third (and failing) execution is a "smoking gun" of sorts, this log entry in mythbackend's log file:
QMYSQLResult::cleanup: unable to free statement handle
Immediately afterwards, the SELECT statement is prepared, executed, and crashes. This suggests that the "Close stmt" operation from the immediately preceding prepared statement returned an error. I upgraded QT from 5.12.2 to 5.12.4 (and also MythTV), but the result was the same.
I am attaching the MariaDB error.log and general.log showing the SQL executed and the resulting crash. Also attaching the log generated by mythbackend/QT, showing its activity. I recompiled MariaDB with CMAKE_BUILD_TYPE=Debug, and used that with GDB to obtain a more useful backtrace, also attached.
Attachments
Issue Links
- is duplicated by
-
MDEV-21629 MythTV query causes MariaDB crash
-
- Closed
-
-
MDEV-22050 OR + incorrect bound null causes segfault
-
- Closed
-
-
MDEV-23220 MythTV SELECT request causes Mariadb server to get a segmentation violation
-
- Closed
-
Activity
Field | Original Value | New Value |
---|---|---|
Fix Version/s | 10.4 [ 22408 ] | |
Assignee | Oleksandr Byelkin [ sanja ] |
Assignee | Oleksandr Byelkin [ sanja ] | Alexander Barkov [ bar ] |
Link |
This issue relates to |
Labels | mythtv |
Status | Open [ 1 ] | Confirmed [ 10101 ] |
Priority | Major [ 3 ] | Critical [ 2 ] |
Link |
This issue relates to |
issue.field.resolutiondate | 2020-05-13 05:01:45.0 | 2020-05-13 05:01:45.898 |
Fix Version/s | 10.4.13 [ 24223 ] | |
Fix Version/s | 10.4 [ 22408 ] | |
Resolution | Fixed [ 1 ] | |
Status | Confirmed [ 10101 ] | Closed [ 6 ] |
Fix Version/s | 10.4.14 [ 24305 ] | |
Fix Version/s | 10.4.13 [ 24223 ] |
Link |
This issue relates to |
Link |
This issue is duplicated by |
Link |
This issue relates to |
Link |
This issue relates to |
Link |
This issue relates to |
Link |
This issue is duplicated by |
Link |
This issue is duplicated by |
Fix Version/s | 10.5.4 [ 24264 ] |
Workflow | MariaDB v3 [ 98735 ] | MariaDB v4 [ 156574 ] |
I had hoped that, with the update to 10.4.8, that perhaps this bug would have been fixed (from some other bug report). But the bug remains. I also just tested against 10.4.0, in case the bug was introduced somewhere along the 10.4.x timeline; but it is present in 10.4.0 as well. I have also upgraded to the latest gcc, 9.2.0, as there were reported ABI issues with gcc 9.1.0 (which was used when compiling mariadb 10.4.7). But again, no change.
Looks as if I may need to find some way to reproduce this via a script, something that can trivially be run on your side. Due to the complexity of the app, I'm not sure how feasible that will be. Another reasonable tack would be to bisect the code between 10.3.x and 10.4.0 and narrow it down to a particular commit. Any "howto" available for that? I don't have any MariaDB source available locally except for the released tarballs.