Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-32808

using sql_service within encryption key management plugin segfaults

    XMLWordPrintable

Details

    Description

      test case: https://github.com/pluots/mariadb-server/commit/e58cd30dee6c2c3fd0a935c3a95446d5a9925347

      cherrypick of top test case onto 10.4 - debug mode crash

      #1  0x000055b88831064a in my_write_core (sig=11) at /home/dan/repos/mariadb-server-10.4/mysys/stacktrace.c:386
      #2  0x000055b8879b13fa in handle_fatal_signal (sig=11) at /home/dan/repos/mariadb-server-10.4/sql/signal_handler.cc:369
      #3  <signal handler called>
      #4  0x000055b88830eb65 in my_thread_name () at /home/dan/repos/mariadb-server-10.4/mysys/my_thr_init.c:426
      #5  0x000055b88832018a in wt_thd_lazy_init (thd=0x7f3e28004d78, ds=0x7f3e28002198, ts=0x7f3e28002190, dl=0x7f3e280021a8, tl=0x7f3e280021a0)
          at /home/dan/repos/mariadb-server-10.4/mysys/waiting_threads.c:513
      #6  0x000055b8875d16c1 in THD::THD (this=0x7f3e280016e0, id=0, is_wsrep_applier=false)
          at /home/dan/repos/mariadb-server-10.4/sql/sql_class.cc:782
      #7  0x000055b887686064 in mysql_real_connect_local (mysql=0x7f3e28000e40) at /home/dan/repos/mariadb-server-10.4/sql/sql_prepare.cc:6207
      #8  0x00007f3e8046d36f in connect_local ()
          at /home/dan/repos/mariadb-server-10.4/plugin/example_keymgt_sql_service/example_keymgt_sql_service.cc:63
      #9  0x00007f3e8046d3ff in get_latest_key_version (key_id=1)
          at /home/dan/repos/mariadb-server-10.4/plugin/example_keymgt_sql_service/example_keymgt_sql_service.cc:84
      #10 0x000055b8881d8a92 in fil_space_crypt_t::key_get_latest_version (this=0x7f3e28000b70)
          at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:141
      #11 0x000055b8881dfbd7 in fil_space_crypt_t::fil_space_crypt_t (this=0x7f3e28000b70, new_type=0, new_min_key_version=0, new_key_id=1,
          new_encryption=FIL_ENCRYPTION_DEFAULT) at /home/dan/repos/mariadb-server-10.4/storage/innobase/include/fil0crypt.h:135
      #12 0x000055b8881d8c96 in fil_space_create_crypt_data (type=0, encrypt_mode=FIL_ENCRYPTION_DEFAULT, min_key_version=0, key_id=1)
          at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:231
      #13 0x000055b8881d8cf2 in fil_space_create_crypt_data (encrypt_mode=FIL_ENCRYPTION_DEFAULT, key_id=1)
          at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:251
      #14 0x000055b8881db1c9 in fil_crypt_start_encrypting_space (space=0x55b88a63e460)
          at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:1141
      #15 0x000055b8881db8c6 in fil_crypt_space_needs_rotation (state=0x7f3e597f9bf0, key_state=0x7f3e597f9be4, recheck=0x7f3e597f9bcb)
          at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:1326
      #16 0x000055b8881dc564 in fil_crypt_find_space_to_rotate (key_state=0x7f3e597f9be4, state=0x7f3e597f9bf0, recheck=0x7f3e597f9bcb)
          at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:1754
      #17 0x000055b8881de74d in fil_crypt_thread () at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:2456
      

      Non-debug mode crash

      Thread 12 received signal SIGSEGV, Segmentation fault.
      0x00000000006f1271 in THD::store_globals (this=0x7ff8680354d8) at /home/dan/repos/mariadb-server-11.3/sql/sql_class.cc:2193
      2193      mysys_var->id=      thread_id;
      (rr) p mysys_var
      $5 = (st_my_thread_var *) 0x0
      (rr) bt
      #0  0x00000000006f1271 in THD::store_globals (this=0x7ff8680354d8) at /home/dan/repos/mariadb-server-11.3/sql/sql_class.cc:2193
      #1  0x000000000076a634 in mysql_real_connect_local (mysql=0x7ff868034d98) at /home/dan/repos/mariadb-server-11.3/sql/sql_prepare.cc:6276
      #2  0x00007ff8a8fa4318 in connect_local ()
          at /home/dan/repos/mariadb-server-11.3/plugin/example_keymgt_sql_service/example_keymgt_sql_service.cc:62
      #3  0x00007ff8a8fa4409 in get_latest_key_version (key_id=<optimized out>)
          at /home/dan/repos/mariadb-server-11.3/plugin/example_keymgt_sql_service/example_keymgt_sql_service.cc:83
      #4  0x0000000000d32db4 in fil_space_crypt_t::key_get_latest_version (this=0x7ff868007ce8)
          at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:139
      #5  fil_space_crypt_t::fil_space_crypt_t (this=this@entry=0x7ff868007ce8, new_type=new_type@entry=0,
          new_min_key_version=new_min_key_version@entry=0, new_key_id=new_key_id@entry=1,
          new_encryption=new_encryption@entry=FIL_ENCRYPTION_DEFAULT)
          at /home/dan/repos/mariadb-server-11.3/storage/innobase/include/fil0crypt.h:129
      #6  0x0000000000d30578 in fil_space_create_crypt_data (type=0, encrypt_mode=FIL_ENCRYPTION_DEFAULT, min_key_version=0, key_id=1)
          at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:222
      #7  fil_space_create_crypt_data (encrypt_mode=FIL_ENCRYPTION_DEFAULT, key_id=1)
          at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:245
      #8  fil_crypt_start_encrypting_space (space=0x4287608) at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:954
      #9  fil_crypt_space_needs_rotation (state=0x7ff884fb1900, key_state=<optimized out>, recheck=<optimized out>)
          at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:1116
      #10 fil_crypt_find_space_to_rotate (state=<optimized out>, key_state=<optimized out>, recheck=<optimized out>)
          at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:1527
      #11 fil_crypt_thread () at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:2035
      #12 0x00007ff8a82e31b3 in execute_native_thread_routine () from /lib64/libstdc++.so.6
      #13 0x00007ff8a80ac897 in start_thread () from /lib64/libc.so.6
      #14 0x00007ff8a8133524 in clone () from /lib64/libc.so.6
      

      The SQL service assumes its being called by a THD that exists hence the two null pointer dereferences.

      Found by tgross35.

      Attachments

        Issue Links

          Activity

            People

              danblack Daniel Black
              danblack Daniel Black
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.