Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-32492

SIGSEGV in spider_conn_first_link_idx and others on DELETE, INSERT and SELECT

Details

    Description

      INSTALL PLUGIN Spider SONAME 'ha_spider.so';
      		 
      --error ER_NO_SUCH_TABLE
      		 
      SHOW CREATE TABLE t;
      		 
      CREATE TABLE t (c INT, PRIMARY KEY(c)) ENGINE=Spider;
      		 
      SHOW CREATE TABLE t;
      		 
      DROP TABLE t;
      		 
      CREATE TABLE t (c INT) ENGINE=Spider REMOTE_PORT="1 1";
      		 
      DELETE FROM t;

      11.3.0 a4031e4c051d4fc69f466a5678ceb5d3598bf525

      		 
      Core was generated by `/test/MDEV28856_MD141023-mariadb-11.3.0-linux-x86_64-dbg/bin/mariadbd --default'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  0x0000149a923b2764 in spider_conn_first_link_idx (
      		 
          thd=thd@entry=0x149a80000d58, link_statuses=0x149a80074468, 
          access_balances=0x149a80128b18, conn_link_idx=0x149a80166a48, 
          link_count=2, link_status=link_status@entry=1)
      		 
          at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/storage/spider/spd_conn.cc:3746
      		 
      [Current thread is 1 (Thread 0x149a924b4640 (LWP 3283577))]
      		 
      (gdb) bt
      		 
      #0  0x0000149a923b2764 in spider_conn_first_link_idx (thd=thd@entry=0x149a80000d58, link_statuses=0x149a80074468, access_balances=0x149a80128b18, conn_link_idx=0x149a80166a48, link_count=2, link_status=link_status@entry=1) at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/storage/spider/spd_conn.cc:3746
      		 
      #1  0x0000149a923905fe in spider_check_trx_and_get_conn (thd=0x149a80000d58, spider=spider@entry=0x149a80249a60) at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/storage/spider/spd_trx.cc:3523
      		 
      #2  0x0000149a9240198d in ha_spider::info (this=0x149a80249a60, flag=18) at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/storage/spider/ha_spider.cc:6653
      		 
      #3  0x000055c5cb7f5003 in Sql_cmd_delete::delete_from_single_table (this=this@entry=0x149a80015698, thd=thd@entry=0x149a80000d58) at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/sql/sql_delete.cc:430
      		 
      #4  0x000055c5cb7f7510 in Sql_cmd_delete::execute_inner (this=0x149a80015698, thd=0x149a80000d58) at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/sql/sql_delete.cc:1800
      		 
      #5  0x000055c5cb88ba57 in Sql_cmd_dml::execute (this=0x149a80015698, thd=0x149a80000d58) at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/sql/sql_select.cc:33350
      		 
      #6  0x000055c5cb84902a in mysql_execute_command (thd=thd@entry=0x149a80000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/sql/sql_parse.cc:4360
      		 
      #7  0x000055c5cb84e2a5 in mysql_parse (thd=thd@entry=0x149a80000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x149a924b31e0) at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/sql/sql_parse.cc:7734
      		 
      #8  0x000055c5cb85061b in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x149a80000d58, packet=packet@entry=0x149a801111d9 "DELETE FROM t", packet_length=packet_length@entry=13, blocking=blocking@entry=true) at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/sql/sql_class.h:251
      		 
      #9  0x000055c5cb85273b in do_command (thd=0x149a80000d58, blocking=blocking@entry=true) at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/sql/sql_parse.cc:1406
      		 
      #10 0x000055c5cb9b198d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55c5ce277188, put_in_cache=put_in_cache@entry=true) at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/sql/sql_connect.cc:1445
      		 
      #11 0x000055c5cb9b1c82 in handle_one_connection (arg=arg@entry=0x55c5ce277188) at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/sql/sql_connect.cc:1347
      		 
      #12 0x000055c5cbdf45bc in pfs_spawn_thread (arg=0x55c5ce1ef218) at /test/git-bisect/preview-11.3-preview_MDEV-28856_patched_dbg/storage/perfschema/pfs.cc:2201
      		 
      #13 0x0000149a97a94ac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
      		 
      #14 0x0000149a97b26a40 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

      Attachments

        Issue Links

          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-32558 ERROR 1429 (base) versus crash [SIGSEGV in spider_create_conn] (28856 patch) and ERROR 12719 infinite loop (base) versus ERROR 12518 table is read only (patch) on optimized builds in CLI

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          relates to

          Task - A task that needs to be done. MDEV-28856 Spider: Implement more engine-defined options

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-29962 SIGSEGV in ha_spider::lock_tables on BEGIN after table lock

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-27902 Spider: Crashes, asserts, hangs, memory corruptions and ASAN heap-use-after-free's

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-32558 ERROR 1429 (base) versus crash [SIGSEGV in spider_create_conn] (28856 patch) and ERROR 12719 infinite loop (base) versus ERROR 12518 table is read only (patch) on optimized builds in CLI

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            View 12 older comments
            Roel Roel Van de Paar added a comment -

            Testcase reductions for this UniqueID/stack specifically:

            SIGSEGV|is_prefix|build_table_filename|spider_conn_queue_loop_check|spider_get_conn

            Have not worked. Discussed with Yuchen who analyzed that Spider could not access share->tgt_table_names[conn_link_idx], where conn_link_idx = spider->conn_link_idx[link_idx] and link_idx == 1. Concluded to be the same issue. Full stack:

            11.3.0 cc08a83ef4225960dccb46bd68fc549160d21841 (Optimized)

            		 
            Core was generated by `/test/28856_P2_MD211023-mariadb-11.3.0-linux-x86_64-opt/bin/mariadbd --no-defau'.
            		 
            Program terminated with signal SIGSEGV, Segmentation fault.
            		 
            #0  is_prefix (
            		 
                s=0x40f5180000000001 <error: Cannot access memory at address 0x40f5180000000001>, t=0x5571e4e5e350 "#sql")
            		 
                at /test/bb-11.3-mdev-28856-and-fixes_opt/strings/is_prefix.c:42
            		 
            [Current thread is 1 (Thread 0x14d6ec051640 (LWP 1935713))]
            		 
            (gdb) bt
            		 
            #0  is_prefix (s=0x40f5180000000001 <error: Cannot access memory at address 0x40f5180000000001>, t=0x5571e4e5e350 "#sql") at /test/bb-11.3-mdev-28856-and-fixes_opt/strings/is_prefix.c:42
            		 
            #1  0x00005571e4386616 in build_table_filename (buff=buff@entry=0x14d6ec04e830 "\300", bufflen=bufflen@entry=512, db=<optimized out>, table_name=0x40f5180000000000 <error: Cannot access memory at address 0x40f5180000000000>, ext=ext@entry=0x14d6d8196c6b "", flags=flags@entry=0) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_table.cc:571
            		 
            #2  0x000014d6d81196a0 in spider_conn_queue_loop_check (conn=0x14d5dc0e5d48, spider=<optimized out>, link_idx=<optimized out>) at /test/bb-11.3-mdev-28856-and-fixes_opt/storage/spider/spd_conn.cc:1322
            		 
            #3  0x000014d6d811f8dd in spider_get_conn (share=share@entry=0x14d5dc0dca38, link_idx=<optimized out>, link_idx@entry=1, conn_key=<optimized out>, trx=trx@entry=0x14d5dc016b08, spider=spider@entry=0x14d5dc0c2240, another=another@entry=false, thd_chg=<optimized out>, error_num=<optimized out>) at /test/bb-11.3-mdev-28856-and-fixes_opt/storage/spider/spd_conn.cc:832
            		 
            #4  0x000014d6d8103984 in spider_check_trx_and_get_conn (thd=<optimized out>, spider=spider@entry=0x14d5dc0c2240) at /test/bb-11.3-mdev-28856-and-fixes_opt/storage/spider/spd_trx.cc:3578
            		 
            #5  0x000014d6d8162603 in ha_spider::info (this=0x14d5dc0c2240, flag=18) at /test/bb-11.3-mdev-28856-and-fixes_opt/storage/spider/ha_spider.cc:6653
            		 
            #6  0x00005571e434fa82 in make_join_statistics (join=0x14d5dc012338, tables_list=@0x14d5dc010da0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14d5dc012af0, last = 0x14d5dc012af0, elements = 1}, <No data fields>}, keyuse_array=0x14d5dc012698) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_select.cc:5499
            		 
            #7  0x00005571e4356852 in JOIN::optimize_inner (this=0x14d5dc012338) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_select.cc:2624
            		 
            #8  0x00005571e4356eaa in JOIN::optimize (this=this@entry=0x14d5dc012338) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_select.cc:1944
            		 
            #9  0x00005571e4356fa1 in mysql_select (thd=0x14d5dc000c68, tables=0x14d5dc0111a8, fields=<optimized out>, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x14d5dc012310, unit=0x14d5dc004fb8, select_lex=0x14d5dc010b88) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_select.cc:5235
            		 
            #10 0x00005571e43577f4 in handle_select (thd=thd@entry=0x14d5dc000c68, lex=lex@entry=0x14d5dc004ed8, result=result@entry=0x14d5dc012310, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_select.cc:628
            		 
            #11 0x00005571e42cb685 in execute_sqlcom_select (thd=0x14d5dc000c68, all_tables=0x14d5dc0111a8) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_parse.cc:6012
            		 
            #12 0x00005571e42da792 in mysql_execute_command (thd=0x14d5dc000c68, is_called_from_prepared_stmt=<optimized out>) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_parse.cc:3911
            		 
            #13 0x00005571e42dbb66 in mysql_parse (thd=0x14d5dc000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_parse.cc:7734
            		 
            #14 0x00005571e42de2fd in dispatch_command (command=COM_QUERY, thd=0x14d5dc000c68, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_parse.cc:1990
            		 
            #15 0x00005571e42e00a0 in do_command (thd=0x14d5dc000c68, blocking=blocking@entry=true) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_parse.cc:1406
            		 
            #16 0x00005571e44080ff in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_connect.cc:1445
            		 
            #17 0x00005571e440844d in handle_one_connection (arg=arg@entry=0x5571e6e657c8) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_connect.cc:1347
            		 
            #18 0x00005571e47b24f1 in pfs_spawn_thread (arg=0x5571e6e65838) at /test/bb-11.3-mdev-28856-and-fixes_opt/storage/perfschema/pfs.cc:2201
            		 
            #19 0x000014d6edc94ac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
            		 
            #20 0x000014d6edd26a40 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

            Roel Roel Van de Paar added a comment - Testcase reductions for this UniqueID/stack specifically: SIGSEGV|is_prefix|build_table_filename|spider_conn_queue_loop_check|spider_get_conn Have not worked. Discussed with Yuchen who analyzed that Spider could not access share->tgt_table_names [conn_link_idx] , where conn_link_idx = spider->conn_link_idx [link_idx] and link_idx == 1. Concluded to be the same issue. Full stack: 11.3.0 cc08a83ef4225960dccb46bd68fc549160d21841 (Optimized) Core was generated by `/test/28856_P2_MD211023-mariadb-11.3.0-linux-x86_64-opt/bin/mariadbd --no-defau'. Program terminated with signal SIGSEGV, Segmentation fault. #0 is_prefix ( s=0x40f5180000000001 <error: Cannot access memory at address 0x40f5180000000001>, t=0x5571e4e5e350 "#sql") at /test/bb-11.3-mdev-28856-and-fixes_opt/strings/is_prefix.c:42 [Current thread is 1 (Thread 0x14d6ec051640 (LWP 1935713))] (gdb) bt #0 is_prefix (s=0x40f5180000000001 <error: Cannot access memory at address 0x40f5180000000001>, t=0x5571e4e5e350 "#sql") at /test/bb-11.3-mdev-28856-and-fixes_opt/strings/is_prefix.c:42 #1 0x00005571e4386616 in build_table_filename (buff=buff@entry=0x14d6ec04e830 "\300", bufflen=bufflen@entry=512, db=<optimized out>, table_name=0x40f5180000000000 <error: Cannot access memory at address 0x40f5180000000000>, ext=ext@entry=0x14d6d8196c6b "", flags=flags@entry=0) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_table.cc:571 #2 0x000014d6d81196a0 in spider_conn_queue_loop_check (conn=0x14d5dc0e5d48, spider=<optimized out>, link_idx=<optimized out>) at /test/bb-11.3-mdev-28856-and-fixes_opt/storage/spider/spd_conn.cc:1322 #3 0x000014d6d811f8dd in spider_get_conn (share=share@entry=0x14d5dc0dca38, link_idx=<optimized out>, link_idx@entry=1, conn_key=<optimized out>, trx=trx@entry=0x14d5dc016b08, spider=spider@entry=0x14d5dc0c2240, another=another@entry=false, thd_chg=<optimized out>, error_num=<optimized out>) at /test/bb-11.3-mdev-28856-and-fixes_opt/storage/spider/spd_conn.cc:832 #4 0x000014d6d8103984 in spider_check_trx_and_get_conn (thd=<optimized out>, spider=spider@entry=0x14d5dc0c2240) at /test/bb-11.3-mdev-28856-and-fixes_opt/storage/spider/spd_trx.cc:3578 #5 0x000014d6d8162603 in ha_spider::info (this=0x14d5dc0c2240, flag=18) at /test/bb-11.3-mdev-28856-and-fixes_opt/storage/spider/ha_spider.cc:6653 #6 0x00005571e434fa82 in make_join_statistics (join=0x14d5dc012338, tables_list=@0x14d5dc010da0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14d5dc012af0, last = 0x14d5dc012af0, elements = 1}, <No data fields>}, keyuse_array=0x14d5dc012698) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_select.cc:5499 #7 0x00005571e4356852 in JOIN::optimize_inner (this=0x14d5dc012338) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_select.cc:2624 #8 0x00005571e4356eaa in JOIN::optimize (this=this@entry=0x14d5dc012338) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_select.cc:1944 #9 0x00005571e4356fa1 in mysql_select (thd=0x14d5dc000c68, tables=0x14d5dc0111a8, fields=<optimized out>, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x14d5dc012310, unit=0x14d5dc004fb8, select_lex=0x14d5dc010b88) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_select.cc:5235 #10 0x00005571e43577f4 in handle_select (thd=thd@entry=0x14d5dc000c68, lex=lex@entry=0x14d5dc004ed8, result=result@entry=0x14d5dc012310, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_select.cc:628 #11 0x00005571e42cb685 in execute_sqlcom_select (thd=0x14d5dc000c68, all_tables=0x14d5dc0111a8) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_parse.cc:6012 #12 0x00005571e42da792 in mysql_execute_command (thd=0x14d5dc000c68, is_called_from_prepared_stmt=<optimized out>) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_parse.cc:3911 #13 0x00005571e42dbb66 in mysql_parse (thd=0x14d5dc000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_parse.cc:7734 #14 0x00005571e42de2fd in dispatch_command (command=COM_QUERY, thd=0x14d5dc000c68, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_parse.cc:1990 #15 0x00005571e42e00a0 in do_command (thd=0x14d5dc000c68, blocking=blocking@entry=true) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_parse.cc:1406 #16 0x00005571e44080ff in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_connect.cc:1445 #17 0x00005571e440844d in handle_one_connection (arg=arg@entry=0x5571e6e657c8) at /test/bb-11.3-mdev-28856-and-fixes_opt/sql/sql_connect.cc:1347 #18 0x00005571e47b24f1 in pfs_spawn_thread (arg=0x5571e6e65838) at /test/bb-11.3-mdev-28856-and-fixes_opt/storage/perfschema/pfs.cc:2201 #19 0x000014d6edc94ac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442 #20 0x000014d6edd26a40 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
            Roel Roel Van de Paar added a comment - 

            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            		 
            CREATE TABLE t1 (a INT) ENGINE=Spider REMOTE_TABLE=t CONNECTION="srv s_2_1";
            		 
            SHOW CREATE TABLE t1;
            		 
            SET SESSION SPIDER_SUPPRESS_COMMENT_IGNORED_WARNING=1;
            		 
            SELECT table_name, SERVER, tgt_table_name FROM mysql.spider_tables;
            		 
            DROP TABLE t1;
            		 
            CREATE TABLE t1 (a INT) ENGINE=Spider REMOTE_PORT="123 456";
            		 
            DELETE FROM t1;

            Leads to:

            (conn_link_idx[link_idx] - link_idx) % link_count == 0|SIGABRT|spider_conn_first_link_idx|spider_check_trx_and_get_conn|ha_spider::info|Sql_cmd_delete::delete_from_single_table

            Roel Roel Van de Paar added a comment - INSTALL PLUGIN Spider SONAME 'ha_spider.so' ; CREATE TABLE t1 (a INT ) ENGINE=Spider REMOTE_TABLE=t CONNECTION = "srv s_2_1" ; SHOW CREATE TABLE t1; SET SESSION SPIDER_SUPPRESS_COMMENT_IGNORED_WARNING=1; SELECT table_name, SERVER, tgt_table_name FROM mysql.spider_tables; DROP TABLE t1; CREATE TABLE t1 (a INT ) ENGINE=Spider REMOTE_PORT= "123 456" ; DELETE FROM t1; Leads to: (conn_link_idx[link_idx] - link_idx) % link_count == 0|SIGABRT|spider_conn_first_link_idx|spider_check_trx_and_get_conn|ha_spider::info|Sql_cmd_delete::delete_from_single_table
            ycp Yuchen Pei added a comment - - edited

            Hi holyfoot, ptal thanks:

            f88f6d6079a upstream/bb-10.5-mdev-32492 MDEV-32492 Delete and remove trx_ha on spider share mismatch
            		 
            c8a857d57c2 MDEV-32492 MDEV-29676 Spider: some code documentation and cleanup

            ycp Yuchen Pei added a comment - - edited Hi holyfoot , ptal thanks: f88f6d6079a upstream/bb-10.5-mdev-32492 MDEV-32492 Delete and remove trx_ha on spider share mismatch c8a857d57c2 MDEV-32492 MDEV-29676 Spider: some code documentation and cleanup
            holyfoot Alexey Botchkov added a comment -

            ok to push.

            holyfoot Alexey Botchkov added a comment - ok to push.
            ycp Yuchen Pei added a comment -

            Thanks for the review - pushed the following to 10.5

            14c40509923 MDEV-32492 Delete and remove trx_ha on spider share mismatch
            		 
            653050ac849 MDEV-32492 MDEV-29676 Spider: some code documentation and cleanup

            ycp Yuchen Pei added a comment - Thanks for the review - pushed the following to 10.5 14c40509923 MDEV-32492 Delete and remove trx_ha on spider share mismatch 653050ac849 MDEV-32492 MDEV-29676 Spider: some code documentation and cleanup

            People

              ycp Yuchen Pei
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.