[MDEV-29962] SIGSEGV in ha_spider::lock_tables on BEGIN after table lock - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Critical
Resolution: Fixed
Affects Version/s: 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11
Fix Version/s: 10.5.26, 10.6.19, 10.11.9, 11.1.6, 11.2.5, 11.4.3
Component/s: Locking, Storage Engine - Spider
Labels:
- locking

Description

Not a new regression. The crash is present in optimized builds only, debug builds seem to work fine.

INSTALL PLUGIN Spider SONAME 'ha_spider.so';

CREATE USER Spider@localhost IDENTIFIED BY '';

CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD '');

CREATE TABLE t (c INT) ENGINE=InnoDB;

CREATE TABLE t1 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';

SELECT * FROM t1;

LOCK TABLES t1 WRITE CONCURRENT,t1 AS t2 READ;

BEGIN;

Leads to:

10.11.1 50c5743adc87e1cdec1431a02558f6540fe5a6d5 (Optimized)
Core was generated by `/test/MD221022-mariadb-10.11.1-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000152d3d82cd4e in ha_spider::lock_tables (
this=this@entry=0x152ccc04bb50)
at /test/10.11_opt/storage/spider/ha_spider.cc:12184
12184 if (
[Current thread is 1 (Thread 0x152d3d8d6700 (LWP 354245))]
(gdb) bt
#0 0x0000152d3d82cd4e in ha_spider::lock_tables (this=this@entry=0x152ccc04bb50) at /test/10.11_opt/storage/spider/ha_spider.cc:12184
#1 0x0000152d3d82d200 in ha_spider::external_lock (this=0x152ccc04bb50, thd=<optimized out>, lock_type=2) at /test/10.11_opt/storage/spider/ha_spider.cc:921
#2 0x000055aa825b5d78 in handler::ha_external_lock (this=0x152ccc04bb50, thd=thd@entry=0x152ccc000c58, lock_type=lock_type@entry=2) at /test/10.11_opt/sql/handler.cc:7095
#3 0x000055aa826cb55c in handler::ha_external_unlock (thd=0x152ccc000c58, this=<optimized out>) at /test/10.11_opt/sql/handler.h:3538
#4 unlock_external (count=<optimized out>, table=0x152ccc0813f8, thd=0x152ccc000c58) at /test/10.11_opt/sql/lock.cc:744
#5 mysql_unlock_tables (thd=0x152ccc000c58, sql_lock=0x152ccc0813b8, free_lock=<optimized out>) at /test/10.11_opt/sql/lock.cc:435
#6 0x000055aa826cbad8 in mysql_unlock_tables (thd=thd@entry=0x152ccc000c58, sql_lock=<optimized out>) at /test/10.11_opt/sql/lock.cc:418
#7 0x000055aa822f2209 in close_thread_tables (thd=thd@entry=0x152ccc000c58) at /test/10.11_opt/sql/sql_base.cc:953
#8 0x000055aa822f307b in Locked_tables_list::unlock_locked_tables (thd=0x152ccc000c58, this=0x152ccc004af8) at /test/10.11_opt/sql/sql_base.cc:2571
#9 Locked_tables_list::unlock_locked_tables (this=this@entry=0x152ccc004af8, thd=thd@entry=0x152ccc000c58) at /test/10.11_opt/sql/sql_base.cc:2542
#10 0x000055aa8248f28d in trans_begin (thd=thd@entry=0x152ccc000c58, flags=0) at /test/10.11_opt/sql/transaction.cc:115
#11 0x000055aa8236a1ae in mysql_execute_command (thd=0x152ccc000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:5605
#12 0x000055aa82358335 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x152ccc000c58) at /test/10.11_opt/sql/sql_parse.cc:8023
#13 mysql_parse (thd=0x152ccc000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:7945
#14 0x000055aa823640ea in dispatch_command (command=COM_QUERY, thd=0x152ccc000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.11_opt/sql/sql_class.h:1346
#15 0x000055aa82365ee2 in do_command (thd=0x152ccc000c58, blocking=blocking@entry=true) at /test/10.11_opt/sql/sql_parse.cc:1407
#16 0x000055aa8247ffbf in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55aa8599ac18, put_in_cache=put_in_cache@entry=true) at /test/10.11_opt/sql/sql_connect.cc:1416
#17 0x000055aa8248029d in handle_one_connection (arg=0x55aa8599ac18) at /test/10.11_opt/sql/sql_connect.cc:1318
#18 0x0000152d63b56609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#19 0x0000152d63742133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.1 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.37 (dbg), 10.3.37 (opt), 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.1 (dbg)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)

Attachments

Issue Links

blocks

MDEV-28683 Spider: SIGSEGV in spider_db_direct_delete, SIGSEGV in spider_db_connect, ASAN: heap-use-after-free in spider_db_direct_delete

Closed

includes

MDEV-28683 Spider: SIGSEGV in spider_db_direct_delete, SIGSEGV in spider_db_connect, ASAN: heap-use-after-free in spider_db_direct_delete

Closed

MDEV-31996 Segfault when setting spider_delete_all_rows to 0 and delete all rows of a spider table, ASAN heap-use-after-free in spider_db_delete_all_rows

Closed

relates to

MDEV-28775 Implement connection manager in Spider

Stalled

MDEV-27239 Spider: Assertion `thd->transaction->stmt.ha_list == __null || trans == &thd->transaction->stmt' failed in ha_commit_trans on BEGIN WORK after FTWRL

Closed

MDEV-27526 Spider: SIGSEGV in ha_spider::lock_tables and Assertion `thd->transaction->stmt.ha_list == __null || trans == &thd->transaction->stmt' failed in ha_commit_trans on START TRANSACTION

Closed

MDEV-27902 Spider: Crashes, asserts, hangs, memory corruptions and ASAN heap-use-after-free's

Closed

MDEV-32492 SIGSEGV in spider_conn_first_link_idx and others on DELETE, INSERT and SELECT

Closed

MDEV-34590 SIGSEGV in spider_db_unlock_tables and ASAN: heap-use-after-free in ha_spider::lock_tables on INSERT

Closed

(4 relates to)

Activity

Ascending order - Click to sort in descending order

Roel Van de Paar created issue - 2022-11-07 07:07

Roel Van de Paar made changes - 2022-11-07 07:07

Field	Original Value	New Value
Link		This issue relates to ~~MDEV-27239~~ [ ~~MDEV-27239~~ ]

Roel Van de Paar made changes - 2022-11-07 07:07

Link

This issue relates to ~~MDEV-27526~~ [ ~~MDEV-27526~~ ]

Roel Van de Paar made changes - 2022-11-07 07:07

Link

This issue relates to TODO-3120 [ TODO-3120 ]

Roel Van de Paar made changes - 2022-11-07 07:13

Description

_Not a new regression. The crash is present in optimized builds only, debug builds seem to work fine._
{code:sql}
INSTALL PLUGIN Spider SONAME 'ha_spider.so';
CREATE USER Spider@localhost IDENTIFIED BY '';
CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD '');
CREATE TABLE t (c INT);
CREATE TABLE t1 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
SELECT * FROM t1;
LOCK TABLES t1 WRITE CONCURRENT,t1 AS t2 READ;
BEGIN;
{code}

Leads to:

{noformat:title=10.11.1 50c5743adc87e1cdec1431a02558f6540fe5a6d5 (Optimized)}
Core was generated by `/test/MD221022-mariadb-10.11.1-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000152d3d82cd4e in ha_spider::lock_tables (
this=this@entry=0x152ccc04bb50)
at /test/10.11_opt/storage/spider/ha_spider.cc:12184
12184 if (
[Current thread is 1 (Thread 0x152d3d8d6700 (LWP 354245))]
(gdb) bt
#0 0x0000152d3d82cd4e in ha_spider::lock_tables (this=this@entry=0x152ccc04bb50) at /test/10.11_opt/storage/spider/ha_spider.cc:12184
#1 0x0000152d3d82d200 in ha_spider::external_lock (this=0x152ccc04bb50, thd=<optimized out>, lock_type=2) at /test/10.11_opt/storage/spider/ha_spider.cc:921
#2 0x000055aa825b5d78 in handler::ha_external_lock (this=0x152ccc04bb50, thd=thd@entry=0x152ccc000c58, lock_type=lock_type@entry=2) at /test/10.11_opt/sql/handler.cc:7095
#3 0x000055aa826cb55c in handler::ha_external_unlock (thd=0x152ccc000c58, this=<optimized out>) at /test/10.11_opt/sql/handler.h:3538
#4 unlock_external (count=<optimized out>, table=0x152ccc0813f8, thd=0x152ccc000c58) at /test/10.11_opt/sql/lock.cc:744
#5 mysql_unlock_tables (thd=0x152ccc000c58, sql_lock=0x152ccc0813b8, free_lock=<optimized out>) at /test/10.11_opt/sql/lock.cc:435
#6 0x000055aa826cbad8 in mysql_unlock_tables (thd=thd@entry=0x152ccc000c58, sql_lock=<optimized out>) at /test/10.11_opt/sql/lock.cc:418
#7 0x000055aa822f2209 in close_thread_tables (thd=thd@entry=0x152ccc000c58) at /test/10.11_opt/sql/sql_base.cc:953
#8 0x000055aa822f307b in Locked_tables_list::unlock_locked_tables (thd=0x152ccc000c58, this=0x152ccc004af8) at /test/10.11_opt/sql/sql_base.cc:2571
#9 Locked_tables_list::unlock_locked_tables (this=this@entry=0x152ccc004af8, thd=thd@entry=0x152ccc000c58) at /test/10.11_opt/sql/sql_base.cc:2542
#10 0x000055aa8248f28d in trans_begin (thd=thd@entry=0x152ccc000c58, flags=0) at /test/10.11_opt/sql/transaction.cc:115
#11 0x000055aa8236a1ae in mysql_execute_command (thd=0x152ccc000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:5605
#12 0x000055aa82358335 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x152ccc000c58) at /test/10.11_opt/sql/sql_parse.cc:8023
#13 mysql_parse (thd=0x152ccc000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:7945
#14 0x000055aa823640ea in dispatch_command (command=COM_QUERY, thd=0x152ccc000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.11_opt/sql/sql_class.h:1346
#15 0x000055aa82365ee2 in do_command (thd=0x152ccc000c58, blocking=blocking@entry=true) at /test/10.11_opt/sql/sql_parse.cc:1407
#16 0x000055aa8247ffbf in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55aa8599ac18, put_in_cache=put_in_cache@entry=true) at /test/10.11_opt/sql/sql_connect.cc:1416
#17 0x000055aa8248029d in handle_one_connection (arg=0x55aa8599ac18) at /test/10.11_opt/sql/sql_connect.cc:1318
#18 0x0000152d63b56609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#19 0x0000152d63742133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
{noformat}

Bug confirmed present in:
MariaDB: 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.1 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.37 (dbg), 10.3.37 (opt), 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.1 (dbg)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)

_Not a new regression. The crash is present in optimized builds only, debug builds seem to work fine._
{code:sql}
INSTALL PLUGIN Spider SONAME 'ha_spider.so';
CREATE USER Spider@localhost IDENTIFIED BY '';
CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD '');
CREATE TABLE t (c INT) ENGINE=InnoDB;
CREATE TABLE t1 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
SELECT * FROM t1;
LOCK TABLES t1 WRITE CONCURRENT,t1 AS t2 READ;
BEGIN;
{code}

Leads to:

{noformat:title=10.11.1 50c5743adc87e1cdec1431a02558f6540fe5a6d5 (Optimized)}
Core was generated by `/test/MD221022-mariadb-10.11.1-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000152d3d82cd4e in ha_spider::lock_tables (
this=this@entry=0x152ccc04bb50)
at /test/10.11_opt/storage/spider/ha_spider.cc:12184
12184 if (
[Current thread is 1 (Thread 0x152d3d8d6700 (LWP 354245))]
(gdb) bt
#0 0x0000152d3d82cd4e in ha_spider::lock_tables (this=this@entry=0x152ccc04bb50) at /test/10.11_opt/storage/spider/ha_spider.cc:12184
#1 0x0000152d3d82d200 in ha_spider::external_lock (this=0x152ccc04bb50, thd=<optimized out>, lock_type=2) at /test/10.11_opt/storage/spider/ha_spider.cc:921
#2 0x000055aa825b5d78 in handler::ha_external_lock (this=0x152ccc04bb50, thd=thd@entry=0x152ccc000c58, lock_type=lock_type@entry=2) at /test/10.11_opt/sql/handler.cc:7095
#3 0x000055aa826cb55c in handler::ha_external_unlock (thd=0x152ccc000c58, this=<optimized out>) at /test/10.11_opt/sql/handler.h:3538
#4 unlock_external (count=<optimized out>, table=0x152ccc0813f8, thd=0x152ccc000c58) at /test/10.11_opt/sql/lock.cc:744
#5 mysql_unlock_tables (thd=0x152ccc000c58, sql_lock=0x152ccc0813b8, free_lock=<optimized out>) at /test/10.11_opt/sql/lock.cc:435
#6 0x000055aa826cbad8 in mysql_unlock_tables (thd=thd@entry=0x152ccc000c58, sql_lock=<optimized out>) at /test/10.11_opt/sql/lock.cc:418
#7 0x000055aa822f2209 in close_thread_tables (thd=thd@entry=0x152ccc000c58) at /test/10.11_opt/sql/sql_base.cc:953
#8 0x000055aa822f307b in Locked_tables_list::unlock_locked_tables (thd=0x152ccc000c58, this=0x152ccc004af8) at /test/10.11_opt/sql/sql_base.cc:2571
#9 Locked_tables_list::unlock_locked_tables (this=this@entry=0x152ccc004af8, thd=thd@entry=0x152ccc000c58) at /test/10.11_opt/sql/sql_base.cc:2542
#10 0x000055aa8248f28d in trans_begin (thd=thd@entry=0x152ccc000c58, flags=0) at /test/10.11_opt/sql/transaction.cc:115
#11 0x000055aa8236a1ae in mysql_execute_command (thd=0x152ccc000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:5605
#12 0x000055aa82358335 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x152ccc000c58) at /test/10.11_opt/sql/sql_parse.cc:8023
#13 mysql_parse (thd=0x152ccc000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:7945
#14 0x000055aa823640ea in dispatch_command (command=COM_QUERY, thd=0x152ccc000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.11_opt/sql/sql_class.h:1346
#15 0x000055aa82365ee2 in do_command (thd=0x152ccc000c58, blocking=blocking@entry=true) at /test/10.11_opt/sql/sql_parse.cc:1407
#16 0x000055aa8247ffbf in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55aa8599ac18, put_in_cache=put_in_cache@entry=true) at /test/10.11_opt/sql/sql_connect.cc:1416
#17 0x000055aa8248029d in handle_one_connection (arg=0x55aa8599ac18) at /test/10.11_opt/sql/sql_connect.cc:1318
#18 0x0000152d63b56609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#19 0x0000152d63742133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
{noformat}

Bug confirmed present in:
MariaDB: 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.1 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.37 (dbg), 10.3.37 (opt), 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.1 (dbg)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)

Roel Van de Paar made changes - 2022-11-07 07:20

Labels

locking

Julien Fritsch made changes - 2023-03-03 17:31

Fix Version/s

10.7 [ 24805 ]

Julien Fritsch made changes - 2023-04-27 14:47

Fix Version/s

10.8 [ 26121 ]

Yuchen Pei made changes - 2023-06-07 01:18

Assignee

Nayuta Yanagisawa [ JIRAUSER47117 ]

Yuchen Pei [ JIRAUSER52627 ]

Yuchen Pei made changes - 2023-10-09 01:59

Link

This issue is blocked by ~~MDEV-30014~~ [ ~~MDEV-30014~~ ]

Yuchen Pei made changes - 2023-10-11 05:52

Status

Open [ 1 ]

In Progress [ 3 ]

Yuchen Pei made changes - 2023-10-11 07:09

Link

This issue is blocked by ~~MDEV-30014~~ [ ~~MDEV-30014~~ ]

Yuchen Pei made changes - 2023-10-11 07:11

Status

In Progress [ 3 ]

In Review [ 10002 ]

Yuchen Pei made changes - 2023-10-11 22:56

Assignee

Yuchen Pei [ JIRAUSER52627 ]

Alexey Botchkov [ holyfoot ]

Yuchen Pei made changes - 2023-10-11 23:31

Assignee

Alexey Botchkov [ holyfoot ]

Yuchen Pei [ JIRAUSER52627 ]

Yuchen Pei made changes - 2023-10-11 23:33

Status

In Review [ 10002 ]

Stalled [ 10000 ]