Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-29962

SIGSEGV in ha_spider::lock_tables on BEGIN after table lock

Details

    Description

      Not a new regression. The crash is present in optimized builds only, debug builds seem to work fine.

      INSTALL PLUGIN Spider SONAME 'ha_spider.so';
      		 
      CREATE USER Spider@localhost IDENTIFIED BY '';
      		 
      CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD '');
      		 
      CREATE TABLE t (c INT) ENGINE=InnoDB;
      		 
      CREATE TABLE t1 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
      		 
      SELECT * FROM t1;
      		 
      LOCK TABLES t1 WRITE CONCURRENT,t1 AS t2 READ;
      		 
      BEGIN;

      Leads to:

      10.11.1 50c5743adc87e1cdec1431a02558f6540fe5a6d5 (Optimized)

      		 
      Core was generated by `/test/MD221022-mariadb-10.11.1-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  0x0000152d3d82cd4e in ha_spider::lock_tables (
      		 
          this=this@entry=0x152ccc04bb50)
      		 
          at /test/10.11_opt/storage/spider/ha_spider.cc:12184
      		 
      12184	        if (
      		 
      [Current thread is 1 (Thread 0x152d3d8d6700 (LWP 354245))]
      		 
      (gdb) bt
      		 
      #0  0x0000152d3d82cd4e in ha_spider::lock_tables (this=this@entry=0x152ccc04bb50) at /test/10.11_opt/storage/spider/ha_spider.cc:12184
      		 
      #1  0x0000152d3d82d200 in ha_spider::external_lock (this=0x152ccc04bb50, thd=<optimized out>, lock_type=2) at /test/10.11_opt/storage/spider/ha_spider.cc:921
      		 
      #2  0x000055aa825b5d78 in handler::ha_external_lock (this=0x152ccc04bb50, thd=thd@entry=0x152ccc000c58, lock_type=lock_type@entry=2) at /test/10.11_opt/sql/handler.cc:7095
      		 
      #3  0x000055aa826cb55c in handler::ha_external_unlock (thd=0x152ccc000c58, this=<optimized out>) at /test/10.11_opt/sql/handler.h:3538
      		 
      #4  unlock_external (count=<optimized out>, table=0x152ccc0813f8, thd=0x152ccc000c58) at /test/10.11_opt/sql/lock.cc:744
      		 
      #5  mysql_unlock_tables (thd=0x152ccc000c58, sql_lock=0x152ccc0813b8, free_lock=<optimized out>) at /test/10.11_opt/sql/lock.cc:435
      		 
      #6  0x000055aa826cbad8 in mysql_unlock_tables (thd=thd@entry=0x152ccc000c58, sql_lock=<optimized out>) at /test/10.11_opt/sql/lock.cc:418
      		 
      #7  0x000055aa822f2209 in close_thread_tables (thd=thd@entry=0x152ccc000c58) at /test/10.11_opt/sql/sql_base.cc:953
      		 
      #8  0x000055aa822f307b in Locked_tables_list::unlock_locked_tables (thd=0x152ccc000c58, this=0x152ccc004af8) at /test/10.11_opt/sql/sql_base.cc:2571
      		 
      #9  Locked_tables_list::unlock_locked_tables (this=this@entry=0x152ccc004af8, thd=thd@entry=0x152ccc000c58) at /test/10.11_opt/sql/sql_base.cc:2542
      		 
      #10 0x000055aa8248f28d in trans_begin (thd=thd@entry=0x152ccc000c58, flags=0) at /test/10.11_opt/sql/transaction.cc:115
      		 
      #11 0x000055aa8236a1ae in mysql_execute_command (thd=0x152ccc000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:5605
      		 
      #12 0x000055aa82358335 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x152ccc000c58) at /test/10.11_opt/sql/sql_parse.cc:8023
      		 
      #13 mysql_parse (thd=0x152ccc000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:7945
      		 
      #14 0x000055aa823640ea in dispatch_command (command=COM_QUERY, thd=0x152ccc000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.11_opt/sql/sql_class.h:1346
      		 
      #15 0x000055aa82365ee2 in do_command (thd=0x152ccc000c58, blocking=blocking@entry=true) at /test/10.11_opt/sql/sql_parse.cc:1407
      		 
      #16 0x000055aa8247ffbf in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55aa8599ac18, put_in_cache=put_in_cache@entry=true) at /test/10.11_opt/sql/sql_connect.cc:1416
      		 
      #17 0x000055aa8248029d in handle_one_connection (arg=0x55aa8599ac18) at /test/10.11_opt/sql/sql_connect.cc:1318
      		 
      #18 0x0000152d63b56609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      		 
      #19 0x0000152d63742133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

      Bug confirmed present in:
      MariaDB: 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.1 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.3.37 (dbg), 10.3.37 (opt), 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.1 (dbg)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)

      Attachments

        Issue Links

          blocks

          Bug - A problem which impairs or prevents the functions of the product. MDEV-28683 Spider: SIGSEGV in spider_db_direct_delete, SIGSEGV in spider_db_connect, ASAN: heap-use-after-free in spider_db_direct_delete

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          includes

          Bug - A problem which impairs or prevents the functions of the product. MDEV-28683 Spider: SIGSEGV in spider_db_direct_delete, SIGSEGV in spider_db_connect, ASAN: heap-use-after-free in spider_db_direct_delete

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-31996 Segfault when setting spider_delete_all_rows to 0 and delete all rows of a spider table, ASAN heap-use-after-free in spider_db_delete_all_rows

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          relates to

          Task - A task that needs to be done. MDEV-28775 Implement connection manager in Spider

          • Major - Major loss of function.
          • Stalled

          Bug - A problem which impairs or prevents the functions of the product. MDEV-27239 Spider: Assertion `thd->transaction->stmt.ha_list == __null || trans == &thd->transaction->stmt' failed in ha_commit_trans on BEGIN WORK after FTWRL

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-27526 Spider: SIGSEGV in ha_spider::lock_tables and Assertion `thd->transaction->stmt.ha_list == __null || trans == &thd->transaction->stmt' failed in ha_commit_trans on START TRANSACTION

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-27902 Spider: Crashes, asserts, hangs, memory corruptions and ASAN heap-use-after-free's

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-32492 SIGSEGV in spider_conn_first_link_idx and others on DELETE, INSERT and SELECT

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-34590 SIGSEGV in spider_db_unlock_tables and ASAN: heap-use-after-free in ha_spider::lock_tables on INSERT

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            View 7 older comments
            ycp Yuchen Pei added a comment - - edited

            holyfoot, if I do that (i.e. apply the following diff on top, see commit 1b8db551a7d5dba054e80e74682c47899ac1b2af) I get heap-use-after-free when testing spider/bugfix.mdev_29962, so I think the function should be called regardless.

            modified   storage/spider/ha_spider.cc
            		 
            @@ -897,8 +897,9 @@ int ha_spider::external_lock(
            		 
                 }
            		 
               }
            		 
             
            -  if ((error_num= spider_check_trx_and_get_conn(thd, this)))
            		 
            -    DBUG_RETURN(error_num);
            		 
            +  if (lock_type != F_UNLCK)
            		 
            +    if ((error_num= spider_check_trx_and_get_conn(thd, this)))
            		 
            +      DBUG_RETURN(error_num);
            		 
               if (!partition_handler || !partition_handler->handlers)
            		 
               {
            		 
                 DBUG_RETURN(lock_tables()); /* Non-partitioned table */

            ycp Yuchen Pei added a comment - - edited holyfoot , if I do that (i.e. apply the following diff on top, see commit 1b8db551a7d5dba054e80e74682c47899ac1b2af) I get heap-use-after-free when testing spider/bugfix.mdev_29962, so I think the function should be called regardless. modified storage/spider/ha_spider.cc @@ -897,8 +897,9 @@ int ha_spider::external_lock( } } - if ((error_num= spider_check_trx_and_get_conn(thd, this))) - DBUG_RETURN(error_num); + if (lock_type != F_UNLCK) + if ((error_num= spider_check_trx_and_get_conn(thd, this))) + DBUG_RETURN(error_num); if (!partition_handler || !partition_handler->handlers) { DBUG_RETURN(lock_tables()); /* Non-partitioned table */
            ycp Yuchen Pei added a comment - - edited

            I've checked this issue with its related issue MDEV-27902 etc. and the patch seems still alright.

            Hi holyfoot, ptal thanks (basically the same patch)

            15ef5566135 upstream/bb-10.5-mdev-29962 MDEV-29962 Spider: creates connections if needed before lock_tables()

            ycp Yuchen Pei added a comment - - edited I've checked this issue with its related issue MDEV-27902 etc. and the patch seems still alright. Hi holyfoot , ptal thanks (basically the same patch) 15ef5566135 upstream/bb-10.5-mdev-29962 MDEV-29962 Spider: creates connections if needed before lock_tables()
            Roel Roel Van de Paar added a comment -

            See MDEV-34590 for an ASAN heap-use-after-free in ha_spider::lock_tables, which may be caused by this bug, as this bug exists in 10.5, unlike the bug described in MDEV-34590 which is 10.6+ only.

            Roel Roel Van de Paar added a comment - See MDEV-34590 for an ASAN heap-use-after-free in ha_spider::lock_tables, which may be caused by this bug, as this bug exists in 10.5, unlike the bug described in MDEV-34590 which is 10.6+ only.
            holyfoot Alexey Botchkov added a comment -

            ok to push.

            holyfoot Alexey Botchkov added a comment - ok to push.
            ycp Yuchen Pei added a comment -

            Thanks for the review - pushed 0bb9862888567a5304aec18e85bf6dd002fc25d3 to 10.5

            ycp Yuchen Pei added a comment - Thanks for the review - pushed 0bb9862888567a5304aec18e85bf6dd002fc25d3 to 10.5

            People

              ycp Yuchen Pei
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.