Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-31475

UBSAN: runtime error: applying non-zero offset in spider_free_mem and SIGSEGV in spider_free_mem on SELECT

Details

    Description

      SET sql_mode='';
      		 
      INSTALL PLUGIN Spider SONAME 'ha_spider.so';
      		 
      CREATE TABLE t (c INT) ENGINE=Spider PARTITION BY HASH (c) PARTITIONS 2;
      		 
      INSERT INTO t VALUES (0);
      		 
      INSERT INTO t VALUES (0);
      		 
      SELECT * FROM t WHERE c=1;
      		 
      ANALYZE TABLE t;
      		 
      SELECT * FROM t;

      Leads to:

      11.1.0 4e5b771e980edfdad5c5414aa62c81d409d585a4 (Debug)

      		 
      Core was generated by `/test/MD120523-mariadb-11.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --cor'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  spider_free_mem (trx=0x14e9800545b8, ptr=ptr@entry=0x0, 
          my_flags=my_flags@entry=0)
      		 
          at /test/11.1_dbg/storage/spider/spd_malloc.cc:180
      		 
      [Current thread is 1 (Thread 0x14e9e48dd640 (LWP 3317775))]
      		 
      (gdb) bt
      		 
      #0  spider_free_mem (trx=0x14e9800545b8, ptr=ptr@entry=0x0, my_flags=my_flags@entry=0) at /test/11.1_dbg/storage/spider/spd_malloc.cc:180
      		 
      #1  0x000014e9e48132ac in ha_spider::~ha_spider (this=0x14e98008f6d0, __in_chrg=<optimized out>) at /test/11.1_dbg/storage/spider/ha_spider.cc:182
      		 
      #2  0x000014e9e481338b in ha_spider::~ha_spider (this=0x14e98008f6d0, __in_chrg=<optimized out>) at /test/11.1_dbg/storage/spider/ha_spider.cc:187
      		 
      #3  0x0000558f35f884ec in ha_partition::~ha_partition (this=0x14e98008e560, __in_chrg=<optimized out>) at /test/11.1_dbg/sql/ha_partition.cc:487
      		 
      #4  0x0000558f35f88613 in ha_partition::~ha_partition (this=0x14e98008e560, __in_chrg=<optimized out>) at /test/11.1_dbg/sql/ha_partition.cc:501
      		 
      #5  0x0000558f35b4189e in open_table_from_share (thd=thd@entry=0x14e980000d58, share=share@entry=0x14e980030f20, alias=alias@entry=0x14e980013860, db_stat=db_stat@entry=33, prgflag=prgflag@entry=8, ha_open_flags=<optimized out>, outparam=0x14e980032768, is_create_table=false, partitions_to_open=0x0) at /test/11.1_dbg/sql/table.cc:4643
      		 
      #6  0x0000558f359a6e0d in open_table (thd=thd@entry=0x14e980000d58, table_list=table_list@entry=0x14e980013818, ot_ctx=ot_ctx@entry=0x14e9e48db7b0) at /test/11.1_dbg/sql/sql_base.cc:2210
      		 
      #7  0x0000558f359aa86d in open_and_process_table (ot_ctx=0x14e9e48db7b0, has_prelocking_list=false, prelocking_strategy=0x14e9e48db8a0, flags=0, counter=0x14e9e48db84c, tables=0x14e980013818, thd=0x14e980000d58) at /test/11.1_dbg/sql/sql_base.cc:4140
      		 
      #8  open_tables (thd=thd@entry=0x14e980000d58, options=@0x14e980006520: {m_options = DDL_options_st::OPT_NONE}, start=start@entry=0x14e9e48db838, counter=counter@entry=0x14e9e48db84c, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x14e9e48db8a0) at /test/11.1_dbg/sql/sql_base.cc:4627
      		 
      #9  0x0000558f359ab70e in open_and_lock_tables (thd=thd@entry=0x14e980000d58, options=<optimized out>, tables=<optimized out>, tables@entry=0x14e980013818, derived=derived@entry=true, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x14e9e48db8a0) at /test/11.1_dbg/sql/sql_base.cc:5601
      		 
      #10 0x0000558f35a19f7d in open_and_lock_tables (flags=0, derived=true, tables=0x14e980013818, thd=0x14e980000d58) at /test/11.1_dbg/sql/sql_base.h:525
      		 
      #11 execute_sqlcom_select (thd=thd@entry=0x14e980000d58, all_tables=0x14e980013818) at /test/11.1_dbg/sql/sql_parse.cc:5944
      		 
      #12 0x0000558f35a25a1c in mysql_execute_command (thd=thd@entry=0x14e980000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/11.1_dbg/sql/sql_parse.cc:3944
      		 
      #13 0x0000558f35a2bfad in mysql_parse (thd=thd@entry=0x14e980000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14e9e48dc230) at /test/11.1_dbg/sql/sql_parse.cc:7760
      		 
      #14 0x0000558f35a2e141 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14e980000d58, packet=packet@entry=0x14e98000ae49 "SELECT * FROM t", packet_length=packet_length@entry=15, blocking=blocking@entry=true) at /test/11.1_dbg/sql/sql_class.h:242
      		 
      #15 0x0000558f35a2ff9d in do_command (thd=0x14e980000d58, blocking=blocking@entry=true) at /test/11.1_dbg/sql/sql_parse.cc:1405
      		 
      #16 0x0000558f35b81e5a in do_handle_one_connection (connect=<optimized out>, connect@entry=0x558f397cd4c8, put_in_cache=put_in_cache@entry=true) at /test/11.1_dbg/sql/sql_connect.cc:1416
      		 
      #17 0x0000558f35b820b9 in handle_one_connection (arg=0x558f397cd4c8) at /test/11.1_dbg/sql/sql_connect.cc:1318
      		 
      #18 0x000014ea03094b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
      		 
      #19 0x000014ea03126a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

      And:

      11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug, UBASAN)

      		 
      /test/11.0_dbg_san/storage/spider/spd_malloc.cc:179:11: runtime error: applying non-zero offset 18446744073709551608 to null pointer
      		 
          #0 0x153db9652176 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /test/11.0_dbg_san/storage/spider/spd_malloc.cc:179
      		 
          #1 0x153db967a713 in ha_spider::~ha_spider() /test/11.0_dbg_san/storage/spider/ha_spider.cc:182
      		 
          #2 0x153db967aae6 in ha_spider::~ha_spider() /test/11.0_dbg_san/storage/spider/ha_spider.cc:187
      		 
          #3 0x561000228724 in ha_partition::~ha_partition() /test/11.0_dbg_san/sql/ha_partition.cc:487
      		 
          #4 0x5610002290aa in ha_partition::~ha_partition() /test/11.0_dbg_san/sql/ha_partition.cc:501
      		 
          #5 0x560ffde58d68 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4613
      		 
          #6 0x560ffd1a43e3 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178
      		 
          #7 0x560ffd1bbf14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108
      		 
          #8 0x560ffd1bbf14 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595
      		 
          #9 0x560ffd1c2dbe in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:5570
      		 
          #10 0x560ffd587f9c in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/11.0_dbg_san/sql/sql_base.h:510
      		 
          #11 0x560ffd587f9c in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6199
      		 
          #12 0x560ffd5ebef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
      		 
          #13 0x560ffd61b973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
      		 
          #14 0x560ffd62b707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
      		 
          #15 0x560ffd639542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
      		 
          #16 0x560ffe00e8b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
      		 
          #17 0x560ffe00fdd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
      		 
          #18 0x153ddca94b42 in start_thread nptl/pthread_create.c:442
      		 
          #19 0x153ddcb269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
      		 
       
      		 
      230614 15:43:30 [ERROR] mysqld got signal 11 ;

      Bug confirmed present in:
      MariaDB: 10.5.21 (dbg), 10.5.21 (opt), 10.6.14 (dbg), 10.6.14 (opt), 10.9.7 (dbg), 10.9.7 (opt), 10.10.5 (dbg), 10.10.5 (opt), 10.11.4 (dbg), 10.11.4 (opt), 11.0.2 (dbg), 11.0.2 (opt), 11.1.0 (dbg), 11.1.0 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.4.30 (dbg), 10.4.30 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.40 (dbg), 8.0.33 (dbg), 8.0.33 (opt)

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-27369 Renaming Spider table fails due to ERROR 1062 (23000): Duplicate entry '...' for key 'PRIMARY'

          • Major - Major loss of function.
          • Stalled

          Activity

            Ascending order - Click to sort in descending order
            View 8 older comments
            Roel Roel Van de Paar added a comment -

            The original testcase no longer produces a SIGSEGV nor UBSAN issue now.

            Roel Roel Van de Paar added a comment - The original testcase no longer produces a SIGSEGV nor UBSAN issue now.
            ycp Yuchen Pei added a comment - - edited

            Hi holyfoot, ptal thanks

            81760603246 upstream/bb-10.5-mdev-31475 MDEV-31475 Spider: only reset wide_handler when owning it
            		 
            70ed223a7f3 MDEV-31475 remove unnecessary assignment to spider share init_error

            A note on testcases: as Roel mentioned, the test case in the description no longer reproduces. The first and the second testcases are equivalent, so in the patch I include the first and the third testcases.

            ycp Yuchen Pei added a comment - - edited Hi holyfoot , ptal thanks 81760603246 upstream/bb-10.5-mdev-31475 MDEV-31475 Spider: only reset wide_handler when owning it 70ed223a7f3 MDEV-31475 remove unnecessary assignment to spider share init_error A note on testcases: as Roel mentioned, the test case in the description no longer reproduces. The first and the second testcases are equivalent, so in the patch I include the first and the third testcases.
            holyfoot Alexey Botchkov added a comment -

            ok to push.

            holyfoot Alexey Botchkov added a comment - ok to push.
            ycp Yuchen Pei added a comment -

            Thanks for the review, pushed the following to 10.5

            698dae54eff upstream/bb-10.5-mdev-31475 upstream/10.5 MDEV-31475 Spider: only reset wide_handler when owning it
            		 
            86adee38067 MDEV-31475 remove unnecessary assignment to spider share init_error

            ycp Yuchen Pei added a comment - Thanks for the review, pushed the following to 10.5 698dae54eff upstream/bb-10.5-mdev-31475 upstream/10.5 MDEV-31475 Spider: only reset wide_handler when owning it 86adee38067 MDEV-31475 remove unnecessary assignment to spider share init_error
            ycp Yuchen Pei added a comment -

            Alas, there was a bad typo in the commit message. It should be the following (note the added NOT)

            MDEV-31475 Spider: only reset wide_handler when NOT owning it
            		 
             
            		 
            A wide_handler is shared among ha_spider of partitions of the same
            		 
            spider table, where the last partition is designated the owner of the
            		 
            wide_handler, and is responsible for its deallocation. Therefore in
            		 
            case of failure, we only reset wide_handler in error handling if the
            		 
            current ha_spider is the NOT owner of the wide_handler, otherwise it will
            		 
            result in segv in the destructor of ha_spider, or during
            		 
            ha_spider::close().

            ycp Yuchen Pei added a comment - Alas, there was a bad typo in the commit message. It should be the following (note the added NOT) MDEV-31475 Spider: only reset wide_handler when NOT owning it   A wide_handler is shared among ha_spider of partitions of the same spider table, where the last partition is designated the owner of the wide_handler, and is responsible for its deallocation. Therefore in case of failure, we only reset wide_handler in error handling if the current ha_spider is the NOT owner of the wide_handler, otherwise it will result in segv in the destructor of ha_spider, or during ha_spider::close().

            People

              ycp Yuchen Pei
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.