Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-25237

crash after setting global session_track_system_variables to an invalid value

Details

    Description

      SET sql_mode='';  # Also try with ONLY_FULL_GROUP_BY
      SET 'a';
      SET collation_connection=utf6_unicode_520_ci;
      SET GLOBAL session_track_system_variables='a';
      SET GLOBAL event_scheduler=1;
      

      Leads to:

      10.6.0 cb545f11169d2425316d96feafc78ac841950e43 (Debug)

      mysqld: /data/10.6_dbg/sql/session_tracker.cc:334: void Session_sysvars_tracker::init(THD*): Assertion `global_system_variables.session_track_system_variables' failed.
      

      10.6.0 cb545f11169d2425316d96feafc78ac841950e43 (Debug)

      Core was generated by `/test/MD240321-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
          at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      [Current thread is 1 (Thread 0x1549d06ca700 (LWP 1961238))]
      (gdb) bt
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      #1  0x0000559464766dd1 in my_write_core (sig=sig@entry=6) at /data/10.6_dbg/mysys/stacktrace.c:424
      #2  0x0000559463f07d31 in handle_fatal_signal (sig=6) at /data/10.6_dbg/sql/signal_handler.cc:331
      #3  <signal handler called>
      #4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      #5  0x00001549dbb2f859 in __GI_abort () at abort.c:79
      #6  0x00001549dbb2f729 in __assert_fail_base (fmt=0x1549dbcc5588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x5594648b3758 "global_system_variables.session_track_system_variables", file=0x5594648b3498 "/data/10.6_dbg/sql/session_tracker.cc", line=334, function=<optimized out>) at assert.c:92
      #7  0x00001549dbb40f36 in __GI___assert_fail (assertion=assertion@entry=0x5594648b3758 "global_system_variables.session_track_system_variables", file=file@entry=0x5594648b3498 "/data/10.6_dbg/sql/session_tracker.cc", line=line@entry=334, function=function@entry=0x5594648b36c0 "void Session_sysvars_tracker::init(THD*)") at assert.c:101
      #8  0x0000559463b4929e in Session_sysvars_tracker::init (this=<optimized out>, thd=0x15498001df98) at /data/10.6_dbg/sql/session_tracker.cc:334
      #9  0x0000559463c53b95 in plugin_thdvar_init (thd=thd@entry=0x15498001df98) at /data/10.6_dbg/sql/sql_plugin.cc:3251
      #10 0x0000559463bd4e9a in THD::init (this=this@entry=0x15498001df98) at /data/10.6_dbg/sql/sql_class.cc:1255
      #11 0x0000559463bde05b in THD::THD (this=0x15498001df98, id=<optimized out>, is_wsrep_applier=<optimized out>) at /data/10.6_dbg/sql/sql_class.cc:858
      #12 0x000055946412c7d3 in Event_scheduler::start (this=0x5594667ddc50, err_no=err_no@entry=0x1549d06c8d7c) at /data/10.6_dbg/sql/sql_list.h:680
      #13 0x0000559463d79695 in Events::start (err_no=err_no@entry=0x1549d06c8d7c) at /data/10.6_dbg/sql/events.cc:1128
      #14 0x0000559463db8b75 in event_scheduler_update (self=<optimized out>, thd=<optimized out>, type=<optimized out>) at /data/10.6_dbg/sql/sys_vars.cc:1125
      #15 0x0000559463b4af30 in sys_var::update (this=0x559465237da0 <Sys_event_scheduler>, thd=0x154980000db8, var=0x154980013cf8) at /data/10.6_dbg/sql/set_var.cc:207
      #16 0x0000559463b4b447 in set_var::update (this=<optimized out>, thd=<optimized out>) at /data/10.6_dbg/sql/set_var.cc:859
      #17 0x0000559463b4c792 in sql_set_variables (thd=thd@entry=0x154980000db8, var_list=var_list@entry=0x154980005eb8, free=free@entry=true) at /data/10.6_dbg/sql/set_var.cc:746
      #18 0x0000559463c4aeab in mysql_execute_command (thd=thd@entry=0x154980000db8) at /data/10.6_dbg/sql/sql_parse.cc:5017
      #19 0x0000559463c34264 in mysql_parse (thd=thd@entry=0x154980000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1549d06c9410) at /data/10.6_dbg/sql/sql_parse.cc:8004
      #20 0x0000559463c42e6a in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x154980000db8, packet=packet@entry=0x15498000b359 "SET GLOBAL event_scheduler=1", packet_length=packet_length@entry=28, blocking=blocking@entry=true) at /data/10.6_dbg/sql/sql_class.h:1331
      #21 0x0000559463c46245 in do_command (thd=0x154980000db8, blocking=blocking@entry=true) at /data/10.6_dbg/sql/sql_parse.cc:1399
      #22 0x0000559463d9f466 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5594667b5888, put_in_cache=put_in_cache@entry=true) at /data/10.6_dbg/sql/sql_connect.cc:1410
      #23 0x0000559463d9fa6b in handle_one_connection (arg=arg@entry=0x5594667b5888) at /data/10.6_dbg/sql/sql_connect.cc:1312
      #24 0x0000559464249eb9 in pfs_spawn_thread (arg=0x5594666d9f28) at /data/10.6_dbg/storage/perfschema/pfs.cc:2201
      #25 0x00001549dc03d609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #26 0x00001549dbc2c293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      10.6.0 cb545f11169d2425316d96feafc78ac841950e43 (Optimized)

      Core was generated by `/test/MD240321-mariadb-10.6.0-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
          at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      [Current thread is 1 (Thread 0x151620d52700 (LWP 2158236))]
      (gdb) bt
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      #1  0x000055771cb353bf in my_write_core (sig=sig@entry=11) at /data/10.6_opt/mysys/stacktrace.c:424
      #2  0x000055771c5ba830 in handle_fatal_signal (sig=11) at /data/10.6_opt/sql/signal_handler.cc:331
      #3  <signal handler called>
      #4  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:65
      #5  0x000055771cb31b71 in my_strdup (key=key@entry=0, from=0x0, my_flags=my_flags@entry=65552) at /data/10.6_opt/mysys/my_malloc.c:230
      #6  0x000055771c2f677a in Session_sysvars_tracker::init (this=<optimized out>, thd=0x1515d001a278) at /data/10.6_opt/sql/session_tracker.cc:335
      #7  0x000055771c35db00 in THD::init (this=this@entry=0x1515d001a278) at /data/10.6_opt/sql/sql_class.cc:1255
      #8  0x000055771c3631ec in THD::THD (this=0x1515d001a278, id=<optimized out>, is_wsrep_applier=<optimized out>) at /data/10.6_opt/sql/sql_class.cc:858
      #9  0x000055771c748f82 in Event_scheduler::start (this=0x55771f56a540, err_no=err_no@entry=0x151620d50e5c) at /data/10.6_opt/sql/sql_list.h:680
      #10 0x000055771c49a676 in Events::start (err_no=err_no@entry=0x151620d50e5c) at /data/10.6_opt/sql/events.cc:1128
      #11 0x000055771c4c6bf9 in event_scheduler_update (self=<optimized out>, thd=<optimized out>, type=<optimized out>) at /data/10.6_opt/sql/sys_vars.cc:1141
      #12 0x000055771c2f7d3a in sys_var::update (this=0x55771d4c8f60 <Sys_event_scheduler>, thd=0x1515d0000c58, var=0x1515d0010608) at /data/10.6_opt/include/mysql/psi/mysql_thread.h:795
      #13 0x000055771c2f81bb in set_var::update (this=<optimized out>, thd=<optimized out>) at /data/10.6_opt/sql/set_var.cc:859
      #14 0x000055771c2f9369 in sql_set_variables (thd=thd@entry=0x1515d0000c58, var_list=var_list@entry=0x1515d0005b98, free=free@entry=true) at /data/10.6_opt/sql/set_var.cc:746
      #15 0x000055771c3b509f in mysql_execute_command (thd=0x1515d0000c58) at /data/10.6_opt/sql/sql_parse.cc:5017
      #16 0x000055771c3a4074 in mysql_parse (thd=0x1515d0000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /data/10.6_opt/sql/sql_parse.cc:8004
      #17 0x000055771c3aff95 in dispatch_command (command=COM_QUERY, thd=0x1515d0000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /data/10.6_opt/sql/sql_class.h:1331
      #18 0x000055771c3b1fe0 in do_command (thd=0x1515d0000c58, blocking=blocking@entry=true) at /data/10.6_opt/sql/sql_parse.cc:1399
      #19 0x000055771c4b3f27 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /data/10.6_opt/sql/sql_connect.cc:1410
      #20 0x000055771c4b428d in handle_one_connection (arg=arg@entry=0x55771f569698) at /data/10.6_opt/sql/sql_connect.cc:1312
      #21 0x000055771c833239 in pfs_spawn_thread (arg=0x55771f4e5298) at /data/10.6_opt/storage/perfschema/pfs.cc:2201
      #22 0x000015162b68b609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #23 0x000015162b27a293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      10.3.29 7d5ec9f1aeec1ea8d00a0aa5bfec521948cfb8be (Optimized)

      Core was generated by `/test/MD240321-mariadb-10.3.29-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
          at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      [Current thread is 1 (Thread 0x147a3415c700 (LWP 2176807))]
      (gdb) bt
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      #1  0x000055613b70eb7f in my_write_core (sig=sig@entry=11) at /data/10.3_opt/mysys/stacktrace.c:386
      #2  0x000055613b1a7eb8 in handle_fatal_signal (sig=11) at /data/10.3_opt/sql/signal_handler.cc:343
      #3  <signal handler called>
      #4  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:65
      #5  0x000055613b70b2bd in my_strdup (from=0x0, my_flags=my_flags@entry=65552) at /data/10.3_opt/mysys/my_malloc.c:243
      #6  0x000055613af038f8 in Session_sysvars_tracker::init (this=<optimized out>, thd=0x1479e0018f48) at /data/10.3_opt/sql/session_tracker.cc:335
      #7  0x000055613afbc683 in plugin_thdvar_init (thd=thd@entry=0x1479e0018f48) at /data/10.3_opt/sql/sql_plugin.cc:3177
      #8  0x000055613af64800 in THD::init (this=this@entry=0x1479e0018f48) at /data/10.3_opt/sql/sql_class.cc:1179
      #9  0x000055613af657cb in THD::THD (this=0x1479e0018f48, id=<optimized out>, is_wsrep_applier=<optimized out>) at /data/10.3_opt/sql/sql_class.cc:803
      #10 0x000055613b310ee0 in Event_scheduler::start (this=0x55613d997230, err_no=err_no@entry=0x147a34159bfc) at /data/10.3_opt/sql/sql_list.h:622
      #11 0x000055613b0878a6 in Events::start (err_no=err_no@entry=0x147a34159bfc) at /data/10.3_opt/sql/events.cc:1111
      #12 0x000055613b0b09b1 in event_scheduler_update (self=<optimized out>, thd=<optimized out>, type=<optimized out>) at /data/10.3_opt/sql/sys_vars.cc:1058
      #13 0x000055613af04ee2 in sys_var::update (this=0x55613bef4660 <Sys_event_scheduler>, thd=0x1479e0000c48, var=0x1479e000f7c0) at /data/10.3_opt/include/mysql/psi/mysql_thread.h:788
      #14 0x000055613af053cb in set_var::update (this=<optimized out>, thd=<optimized out>) at /data/10.3_opt/sql/set_var.cc:837
      #15 0x000055613af06649 in sql_set_variables (thd=thd@entry=0x1479e0000c48, var_list=var_list@entry=0x1479e0005778, free=free@entry=true) at /data/10.3_opt/sql/set_var.cc:740
      #16 0x000055613afae786 in mysql_execute_command (thd=<optimized out>) at /data/10.3_opt/sql/sql_parse.cc:4936
      #17 0x000055613afb2f57 in mysql_parse (thd=0x1479e0000c48, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /data/10.3_opt/sql/sql_parse.cc:7871
      #18 0x000055613afb52f5 in dispatch_command (command=COM_QUERY, thd=0x1479e0000c48, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /data/10.3_opt/sql/sql_class.h:1152
      #19 0x000055613afb730d in do_command (thd=0x1479e0000c48) at /data/10.3_opt/sql/sql_parse.cc:1398
      #20 0x000055613b09e986 in do_handle_one_connection (connect=connect@entry=0x55613d9c2388) at /data/10.3_opt/sql/sql_connect.cc:1403
      #21 0x000055613b09eb5f in handle_one_connection (arg=0x55613d9c2388) at /data/10.3_opt/sql/sql_connect.cc:1308
      #22 0x0000147a3e02f609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #23 0x0000147a3dc26293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.3.29 (dbg), 10.3.29 (opt), 10.4.19 (dbg), 10.4.19 (opt), 10.5.10 (dbg), 10.5.10 (opt), 10.6.0 (dbg), 10.6.0 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.38 (dbg), 10.2.38 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.33 (dbg), 5.7.33 (opt), 8.0.23 (dbg), 8.0.23 (opt)

      Attachments

        Issue Links

          Activity

            Roel Roel Van de Paar added a comment - - edited

            Additional testcase (10.3-10.11, dbg+opt)

            CREATE TABLE t (c INT,KEY(c)) ENGINE=InnoDB;
            SET @@autocommit=0;
            SET GLOBAL session_track_system_variables='a';
            INSERT INTO t (c) VALUES (1);
            

            This produces a somewhat different UBSAN stack/UniqueID:

            10.11.2 70be59913c90e93fe5136d6f6df03c4254aa515d (Optimized, UBASAN)

            UBSAN|null pointer passed as argument 1, which is declared to never be null|mysys/my_malloc.c|my_strdup|Session_sysvars_tracker::init|THD::init|THD::THD
            

            Roel Roel Van de Paar added a comment - - edited Additional testcase (10.3-10.11, dbg+opt) CREATE TABLE t (c INT , KEY (c)) ENGINE=InnoDB; SET @@autocommit=0; SET GLOBAL session_track_system_variables= 'a' ; INSERT INTO t (c) VALUES (1); This produces a somewhat different UBSAN stack/UniqueID: 10.11.2 70be59913c90e93fe5136d6f6df03c4254aa515d (Optimized, UBASAN) UBSAN|null pointer passed as argument 1, which is declared to never be null|mysys/my_malloc.c|my_strdup|Session_sysvars_tracker::init|THD::init|THD::THD
            alice Alice Sherepa added a comment -

            MDEV-31534, also repeatable on 11.0, non-debug:

            230626  9:48:06 [ERROR] mysqld got signal 11 ;
             
            Server version: 10.11.2-MariaDB source revision: cafba8761af55ae16cc69c9b53a341340a845b36
             
            mysys/stacktrace.c:213(my_print_stacktrace)[0x5589a1492bde]
            sql/signal_handler.cc:238(handle_fatal_signal)[0x5589a0e72067]
            sigaction.c:0(__restore_rt)[0x7fb82fffa420]
            ??:0(__nss_database_lookup)[0x7fb82fc436e5]
            mysys/my_malloc.c:232(my_strdup)[0x5589a148f20c]
            sql/session_tracker.cc:338(Session_sysvars_tracker::init(THD*))[0x5589a0b6ee06]
            sql/sql_class.cc:1237(THD::init())[0x5589a0bd9cad]
            sql/sql_class.cc:1427(THD::change_user())[0x5589a0bda15e]
            sql/sql_class.cc:1627(THD::reset_for_reuse())[0x5589a0bda359]
            sql/sql_connect.cc:1531(CONNECT::create_thd(THD*))[0x5589a0d3ff66]
            sql/sql_connect.cc:1436(do_handle_one_connection(CONNECT*, bool))[0x5589a0d40365]
            sql/sql_connect.cc:1324(handle_one_connection)[0x5589a0d40554]
            perfschema/pfs.cc:2204(pfs_spawn_thread)[0x5589a10c4b2c]
            nptl/pthread_create.c:478(start_thread)[0x7fb82ffee609]
            ??:0(clone)[0x7fb82fbda133]
            

            alice Alice Sherepa added a comment - MDEV-31534 , also repeatable on 11.0, non-debug: 230626 9:48:06 [ERROR] mysqld got signal 11 ;   Server version: 10.11.2-MariaDB source revision: cafba8761af55ae16cc69c9b53a341340a845b36   mysys/stacktrace.c:213(my_print_stacktrace)[0x5589a1492bde] sql/signal_handler.cc:238(handle_fatal_signal)[0x5589a0e72067] sigaction.c:0(__restore_rt)[0x7fb82fffa420] ??:0(__nss_database_lookup)[0x7fb82fc436e5] mysys/my_malloc.c:232(my_strdup)[0x5589a148f20c] sql/session_tracker.cc:338(Session_sysvars_tracker::init(THD*))[0x5589a0b6ee06] sql/sql_class.cc:1237(THD::init())[0x5589a0bd9cad] sql/sql_class.cc:1427(THD::change_user())[0x5589a0bda15e] sql/sql_class.cc:1627(THD::reset_for_reuse())[0x5589a0bda359] sql/sql_connect.cc:1531(CONNECT::create_thd(THD*))[0x5589a0d3ff66] sql/sql_connect.cc:1436(do_handle_one_connection(CONNECT*, bool))[0x5589a0d40365] sql/sql_connect.cc:1324(handle_one_connection)[0x5589a0d40554] perfschema/pfs.cc:2204(pfs_spawn_thread)[0x5589a10c4b2c] nptl/pthread_create.c:478(start_thread)[0x7fb82ffee609] ??:0(clone)[0x7fb82fbda133]

            I tested the patch on 10.4 and 11.1. On 10.4, the crash does not appear anymore, however there is a memory leak:

            10.4.31 d214628af47b2335a9da03a3f7ae54d7ea3241f0 (Debug, UBASAN)

            ==1197614==ERROR: LeakSanitizer: detected memory leaks
             
            Direct leak of 16 byte(s) in 1 object(s) allocated from:
                #0 0x559bcdcd6207 in malloc (/test/UBASAN_MD280623-mariadb-10.4.31-linux-x86_64-dbg/bin/mysqld+0x733f207)
                #1 0x559bd208a4bc in my_malloc /test/10.4_dbg_san/mysys/my_malloc.c:101
                #2 0x559bd208ac5f in my_memdup /test/10.4_dbg_san/mysys/my_malloc.c:233
                #3 0x559bced60624 in Sys_var_charptr_base::global_update_prepare(THD*, set_var*) /test/10.4_dbg_san/sql/sys_vars.inl:535
                #4 0x559bced60624 in Sys_var_sesvartrack::global_update(THD*, set_var*) /test/10.4_dbg_san/sql/sys_vars.inl:618
                #5 0x559bcddbc24d in sys_var::update(THD*, set_var*) /test/10.4_dbg_san/sql/set_var.cc:208
                #6 0x559bcddbf013 in set_var::update(THD*) /test/10.4_dbg_san/sql/set_var.cc:837
                #7 0x559bcddc69ae in sql_set_variables(THD*, List<set_var_base>*, bool) /test/10.4_dbg_san/sql/set_var.cc:740
                #8 0x559bce40add2 in mysql_execute_command(THD*) /test/10.4_dbg_san/sql/sql_parse.cc:5045
                #9 0x559bce431a55 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.4_dbg_san/sql/sql_parse.cc:8008
                #10 0x559bce4417ae in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.4_dbg_san/sql/sql_parse.cc:1857
                #11 0x559bce44fb9a in do_command(THD*) /test/10.4_dbg_san/sql/sql_parse.cc:1378
                #12 0x559bcec8a8dc in do_handle_one_connection(CONNECT*) /test/10.4_dbg_san/sql/sql_connect.cc:1420
                #13 0x559bcec8aeac in handle_one_connection /test/10.4_dbg_san/sql/sql_connect.cc:1324
                #14 0x147932694b42 in start_thread nptl/pthread_create.c:442
             
            SUMMARY: AddressSanitizer: 16 byte(s) leaked in 1 allocation(s).
            

            On 11.1, after applying I see the following build issue:

            11.1.2 3883eb63dc5e663558571c33d086c9fd3aa0cf8f (Debug, during build)

            In file included from /test/11.1_dbg/sql/sys_vars.cc:37:
            /test/11.1_dbg/sql/sys_vars.inl: In member function ‘virtual bool Sys_var_sesvartrack::global_update(THD*, set_var*)’:
            /test/11.1_dbg/sql/sys_vars.inl:75:27: error: invalid conversion from ‘const char*’ to ‘PSI_memory_key’ {aka ‘unsigned int’} [-fpermissive]
               75 | #define global_var(TYPE) (*(TYPE*)global_var_ptr())
                  |                          ~^~~~~~~~~~~~~~~~~~~~~~~~~
                  |                           |
                  |                           const char*
            /test/11.1_dbg/sql/sys_vars.inl:670:35: note: in expansion of macro ‘global_var’
              670 |         new_val= (char*)my_strdup(global_var(const char*), MYF(MY_WME));
                  |                                   ^~~~~~~~~~
            In file included from /test/11.1_dbg/sql/mariadb.h:29,
                             from /test/11.1_dbg/sql/sql_plugin.h:30,
                             from /test/11.1_dbg/sql/sys_vars.cc:34:
            /test/11.1_dbg/include/my_global.h:994:25: error: invalid conversion from ‘myf’ {aka ‘long unsigned int’} to ‘const char*’ [-fpermissive]
              994 | #define MYF(v)          (myf) (v)
                  |                         ^~~~~~~~~
                  |                         |
                  |                         myf {aka long unsigned int}
            /test/11.1_dbg/sql/sys_vars.inl:670:60: note: in expansion of macro ‘MYF’
              670 |         new_val= (char*)my_strdup(global_var(const char*), MYF(MY_WME));
                  |                                                            ^~~
            In file included from /test/11.1_dbg/sql/sys_vars.cc:37:
            /test/11.1_dbg/sql/sys_vars.inl:670:34: error: too few arguments to function ‘char* my_strdup(PSI_memory_key, const char*, myf)’
              670 |         new_val= (char*)my_strdup(global_var(const char*), MYF(MY_WME));
                  |                         ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
            In file included from /test/11.1_dbg/sql/sql_plugin.h:45,
                             from /test/11.1_dbg/sql/sys_vars.cc:34:
            /test/11.1_dbg/include/my_sys.h:173:14: note: declared here
              173 | extern char *my_strdup(PSI_memory_key key, const char *from,myf MyFlags);
                  |              ^~~~~~~~~
            

            Roel Roel Van de Paar added a comment - I tested the patch on 10.4 and 11.1. On 10.4, the crash does not appear anymore, however there is a memory leak: 10.4.31 d214628af47b2335a9da03a3f7ae54d7ea3241f0 (Debug, UBASAN) ==1197614==ERROR: LeakSanitizer: detected memory leaks   Direct leak of 16 byte(s) in 1 object(s) allocated from: #0 0x559bcdcd6207 in malloc (/test/UBASAN_MD280623-mariadb-10.4.31-linux-x86_64-dbg/bin/mysqld+0x733f207) #1 0x559bd208a4bc in my_malloc /test/10.4_dbg_san/mysys/my_malloc.c:101 #2 0x559bd208ac5f in my_memdup /test/10.4_dbg_san/mysys/my_malloc.c:233 #3 0x559bced60624 in Sys_var_charptr_base::global_update_prepare(THD*, set_var*) /test/10.4_dbg_san/sql/sys_vars.inl:535 #4 0x559bced60624 in Sys_var_sesvartrack::global_update(THD*, set_var*) /test/10.4_dbg_san/sql/sys_vars.inl:618 #5 0x559bcddbc24d in sys_var::update(THD*, set_var*) /test/10.4_dbg_san/sql/set_var.cc:208 #6 0x559bcddbf013 in set_var::update(THD*) /test/10.4_dbg_san/sql/set_var.cc:837 #7 0x559bcddc69ae in sql_set_variables(THD*, List<set_var_base>*, bool) /test/10.4_dbg_san/sql/set_var.cc:740 #8 0x559bce40add2 in mysql_execute_command(THD*) /test/10.4_dbg_san/sql/sql_parse.cc:5045 #9 0x559bce431a55 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.4_dbg_san/sql/sql_parse.cc:8008 #10 0x559bce4417ae in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.4_dbg_san/sql/sql_parse.cc:1857 #11 0x559bce44fb9a in do_command(THD*) /test/10.4_dbg_san/sql/sql_parse.cc:1378 #12 0x559bcec8a8dc in do_handle_one_connection(CONNECT*) /test/10.4_dbg_san/sql/sql_connect.cc:1420 #13 0x559bcec8aeac in handle_one_connection /test/10.4_dbg_san/sql/sql_connect.cc:1324 #14 0x147932694b42 in start_thread nptl/pthread_create.c:442   SUMMARY: AddressSanitizer: 16 byte(s) leaked in 1 allocation(s). On 11.1, after applying I see the following build issue: 11.1.2 3883eb63dc5e663558571c33d086c9fd3aa0cf8f (Debug, during build) In file included from /test/11.1_dbg/sql/sys_vars.cc:37: /test/11.1_dbg/sql/sys_vars.inl: In member function ‘virtual bool Sys_var_sesvartrack::global_update(THD*, set_var*)’: /test/11.1_dbg/sql/sys_vars.inl:75:27: error: invalid conversion from ‘const char*’ to ‘PSI_memory_key’ {aka ‘unsigned int’} [-fpermissive] 75 | #define global_var(TYPE) (*(TYPE*)global_var_ptr()) | ~^~~~~~~~~~~~~~~~~~~~~~~~~ | | | const char* /test/11.1_dbg/sql/sys_vars.inl:670:35: note: in expansion of macro ‘global_var’ 670 | new_val= (char*)my_strdup(global_var(const char*), MYF(MY_WME)); | ^~~~~~~~~~ In file included from /test/11.1_dbg/sql/mariadb.h:29, from /test/11.1_dbg/sql/sql_plugin.h:30, from /test/11.1_dbg/sql/sys_vars.cc:34: /test/11.1_dbg/include/my_global.h:994:25: error: invalid conversion from ‘myf’ {aka ‘long unsigned int’} to ‘const char*’ [-fpermissive] 994 | #define MYF(v) (myf) (v) | ^~~~~~~~~ | | | myf {aka long unsigned int} /test/11.1_dbg/sql/sys_vars.inl:670:60: note: in expansion of macro ‘MYF’ 670 | new_val= (char*)my_strdup(global_var(const char*), MYF(MY_WME)); | ^~~ In file included from /test/11.1_dbg/sql/sys_vars.cc:37: /test/11.1_dbg/sql/sys_vars.inl:670:34: error: too few arguments to function ‘char* my_strdup(PSI_memory_key, const char*, myf)’ 670 | new_val= (char*)my_strdup(global_var(const char*), MYF(MY_WME)); | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from /test/11.1_dbg/sql/sql_plugin.h:45, from /test/11.1_dbg/sql/sys_vars.cc:34: /test/11.1_dbg/include/my_sys.h:173:14: note: declared here 173 | extern char *my_strdup(PSI_memory_key key, const char *from,myf MyFlags); | ^~~~~~~~~
            sanja Oleksandr Byelkin added a comment - - edited

            sanja@SanjasLaptop:~/maria/git/10.4/mysql-test$ git log
            commit d8e04ef367b7b80104a59634aca9ca101add59db (HEAD -> bb-10.4-MDEV-25237, origin/bb-10.4-MDEV-25237)
            Author: Oleksandr Byelkin <sanja@mariadb.com>
            Date:   Tue Jun 27 12:10:48 2023 +0200
             
                MDEV-25237 Assertion `global_system_variables.session_track_system_variables' failed in Session_sysvars_tracker::init | SIGSEGV's in __strlen_avx2 | UBSAN: runtime error: null pointer passed as argument 1, which is declared to never be null in my_strdup
                
                Restore old value of the variable in case of error
            

            sanja Oleksandr Byelkin added a comment - - edited sanja@SanjasLaptop:~/maria/git/10.4/mysql-test$ git log commit d8e04ef367b7b80104a59634aca9ca101add59db (HEAD -> bb-10.4-MDEV-25237, origin/bb-10.4-MDEV-25237) Author: Oleksandr Byelkin <sanja@mariadb.com> Date: Tue Jun 27 12:10:48 2023 +0200   MDEV-25237 Assertion `global_system_variables.session_track_system_variables' failed in Session_sysvars_tracker::init | SIGSEGV's in __strlen_avx2 | UBSAN: runtime error: null pointer passed as argument 1, which is declared to never be null in my_strdup Restore old value of the variable in case of error

            commit 8e9c68b49dd82cfda2ac22949666c9d1adae2db7 (HEAD -> bb-10.4-MDEV-25237, origin/bb-10.4-MDEV-25237)
            Author: Oleksandr Byelkin <sanja@mariadb.com>
            Date:   Tue Jun 27 12:10:48 2023 +0200
             
                MDEV-25237 Assertion `global_system_variables.session_track_system_variables' failed in Session_sysvars_tracker::init | SIGSEGV's in __strlen_avx2 | UBSAN: runtime error: null pointer passed as argument 1, which is declared to never be null in my_strdup
                
                Fix of typo in checking variable list corectness.
                
                Fix of error handling in case of variable list parse error
            

            sanja Oleksandr Byelkin added a comment - commit 8e9c68b49dd82cfda2ac22949666c9d1adae2db7 (HEAD -> bb-10.4-MDEV-25237, origin/bb-10.4-MDEV-25237) Author: Oleksandr Byelkin <sanja@mariadb.com> Date: Tue Jun 27 12:10:48 2023 +0200   MDEV-25237 Assertion `global_system_variables.session_track_system_variables' failed in Session_sysvars_tracker::init | SIGSEGV's in __strlen_avx2 | UBSAN: runtime error: null pointer passed as argument 1, which is declared to never be null in my_strdup Fix of typo in checking variable list corectness. Fix of error handling in case of variable list parse error

            People

              sanja Oleksandr Byelkin
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.