Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Fixed
-
10.3(EOL), 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11, 11.1(EOL)
Description
On a 10.11 debug build, this testcase results in the MDEV-29854 stack. On optimized builds, it looks to be a different issue.
INSTALL PLUGIN Spider SONAME 'ha_spider.so'; |
CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET'',DATABASE'',USER'',PASSWORD ''); |
CREATE TABLE t (a INT) ENGINE=Spider; |
CREATE TABLE t2 (b INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"'; |
LOCK TABLES t AS a READ,t2 AS b LOW_PRIORITY WRITE,t2 AS c WRITE; |
DROP TABLE t2; |
CREATE TABLE t2 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"'; |
LOCK TABLES t2 WRITE;
|
Leads to:
10.11.1 50c5743adc87e1cdec1431a02558f6540fe5a6d5 (Optimized) |
Core was generated by `/test/MD221022-mariadb-10.11.1-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 spider_db_mbase::append_lock_tables (str=<optimized out>,
|
this=<optimized out>)
|
at /test/10.11_opt/storage/spider/spd_db_mysql.cc:3678
|
3678 switch (tmp_spider->wide_handler->lock_type)
|
[Current thread is 1 (Thread 0x154848051700 (LWP 1408423))]
|
(gdb) bt
|
#0 spider_db_mbase::append_lock_tables (str=<optimized out>, this=<optimized out>) at /test/10.11_opt/storage/spider/spd_db_mysql.cc:3678
|
#1 spider_db_mbase::append_lock_tables (this=0x1547a0088b70, str=0x1547a008c730) at /test/10.11_opt/storage/spider/spd_db_mysql.cc:3652
|
#2 0x00001548389aa92c in spider_mbase_handler::lock_tables (this=0x1547a008c6d0, link_idx=0) at /test/10.11_opt/storage/spider/spd_db_mysql.cc:14578
|
#3 0x00001548389a1ecb in ha_spider::lock_tables (this=this@entry=0x1547a008a760) at /test/10.11_opt/storage/spider/ha_spider.cc:12214
|
#4 0x00001548389a2200 in ha_spider::external_lock (this=0x1547a008a760, thd=<optimized out>, lock_type=1) at /test/10.11_opt/storage/spider/ha_spider.cc:921
|
#5 0x000055bd59af5d78 in handler::ha_external_lock (this=0x1547a008a760, thd=thd@entry=0x1547a0000c58, lock_type=lock_type@entry=1) at /test/10.11_opt/sql/handler.cc:7095
|
#6 0x000055bd59c0b8f9 in lock_external (count=<optimized out>, tables=0x1547a008a718, thd=0x1547a0000c58) at /test/10.11_opt/sql/lock.cc:396
|
#7 mysql_lock_tables (thd=thd@entry=0x1547a0000c58, sql_lock=sql_lock@entry=0x1547a008a6e8, flags=flags@entry=0) at /test/10.11_opt/sql/lock.cc:341
|
#8 0x000055bd59c0c3cf in mysql_lock_tables (thd=thd@entry=0x1547a0000c58, tables=0x1547a00111f8, count=count@entry=1, flags=flags@entry=0) at /test/10.11_opt/sql/lock.cc:304
|
#9 0x000055bd59836a42 in lock_tables (thd=thd@entry=0x1547a0000c58, tables=tables@entry=0x1547a0010920, count=<optimized out>, flags=flags@entry=0) at /test/10.11_opt/sql/sql_base.cc:5821
|
#10 0x000055bd598a0a54 in lock_tables_open_and_lock_tables (thd=thd@entry=0x1547a0000c58, tables=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:2958
|
#11 0x000055bd598ab643 in mysql_execute_command (thd=0x1547a0000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:5124
|
#12 0x000055bd59898335 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x1547a0000c58) at /test/10.11_opt/sql/sql_parse.cc:8023
|
#13 mysql_parse (thd=0x1547a0000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:7945
|
#14 0x000055bd598a40ea in dispatch_command (command=COM_QUERY, thd=0x1547a0000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.11_opt/sql/sql_class.h:1346
|
#15 0x000055bd598a5ee2 in do_command (thd=0x1547a0000c58, blocking=blocking@entry=true) at /test/10.11_opt/sql/sql_parse.cc:1407
|
#16 0x000055bd599bffbf in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55bd5d2bdce8, put_in_cache=put_in_cache@entry=true) at /test/10.11_opt/sql/sql_connect.cc:1416
|
#17 0x000055bd599c029d in handle_one_connection (arg=0x55bd5d2bdce8) at /test/10.11_opt/sql/sql_connect.cc:1318
|
#18 0x000015485fefe609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#19 0x000015485faea133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
Bug confirmed present in:
MariaDB: [10.11.1 (dbg) (MDEV-29854)], 10.11.1 (opt)
Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.37 (dbg), 10.3.37 (opt), 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.5.18 (opt), 10.6.10 (dbg), 10.6.10 (opt), 10.7.6 (dbg), 10.7.6 (opt), 10.8.5 (dbg), 10.8.5 (opt), 10.9.3 (dbg), 10.9.3 (opt), 10.10.2 (dbg), 10.10.2 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
Attachments
Issue Links
- blocks
-
MDEV-31357 ASAN heap-use-after-free in spider_link_get_key on LOCK TABLES
- Closed
- includes
-
MDEV-31357 ASAN heap-use-after-free in spider_link_get_key on LOCK TABLES
- Closed
- is duplicated by
-
MDEV-29854 SIGSEGV in spider_string::length on LOCK TABLES
- Closed
- relates to
-
MDEV-27240 SIGSEGV in ha_spider::store_lock on LOCK TABLE
- Closed
-
MDEV-35011 SIGSEGV in spider_db_mbase::append_lock_tables (or spider_string::length) on SELECT, ASAN: heap-use-after-free in spider_link_get_key
- Open