Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-34421

SIGSEGV in parse_engine_part_options on INSERT, SELECT or ALTER

Details

    Description

      New regression:

      --source include/have_partition.inc
      		 
      SET sql_mode='';
      		 
      INSTALL SONAME 'ha_spider';
      		 
      CREATE TABLE t (c INT) ENGINE=Spider PARTITION BY KEY(c) (PARTITION p);
      		 
      UNINSTALL SONAME IF EXISTS 'ha_spider';
      		 
      INSERT INTO t SELECT 1;

      Leads to:

      11.2.5 a21e49cbcc5f4adb1a1b4970ceead6a85e968063 (Debug)

      		 
      Core was generated by `/test/MD190624-mariadb-11.2.5-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  parse_engine_part_options (thd=thd@entry=0x154270000d58, table=table@entry=0x154270056a68)at /test/11.2_dbg/sql/create_options.cc:540
      		 
      Downloading source file /test/11.2_dbg/sql/create_options.cc...
      		 
      [Current thread is 1 (LWP 2665548)]
      		 
      (gdb) bt
      		 
      #0  parse_engine_part_options (thd=thd@entry=0x154270000d58, table=table@entry=0x154270056a68)at /test/11.2_dbg/sql/create_options.cc:540
      		 
      #1  0x000056180e853b03 in open_table_from_share (thd=thd@entry=0x154270000d58, share=share@entry=0x1542700d17f0, alias=alias@entry=0x154270013750, db_stat=db_stat@entry=33, prgflag=prgflag@entry=8, ha_open_flags=16, outparam=0x154270056a68, is_create_table=false, partitions_to_open=0x0)at /test/11.2_dbg/sql/table.cc:4485
      		 
      #2  0x000056180e6a22f0 in open_table (thd=thd@entry=0x154270000d58, table_list=table_list@entry=0x154270013708, ot_ctx=ot_ctx@entry=0x1542a4107c40) at /test/11.2_dbg/sql/sql_base.cc:2247
      		 
      #3  0x000056180e6a5e72 in open_and_process_table (ot_ctx=0x1542a4107c40, has_prelocking_list=false, prelocking_strategy=0x1542a4107d78, flags=0, counter=0x1542a4107cdc, tables=0x154270013708, thd=0x154270000d58)at /test/11.2_dbg/sql/sql_base.cc:4180
      		 
      #4  open_tables (thd=thd@entry=0x154270000d58, options=@0x154270006828: {m_options = DDL_options_st::OPT_NONE}, start=start@entry=0x1542a4107cc8, counter=counter@entry=0x1542a4107cdc, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x1542a4107d78)at /test/11.2_dbg/sql/sql_base.cc:4666
      		 
      #5  0x000056180e6a6d67 in open_and_lock_tables (thd=thd@entry=0x154270000d58, options=<optimized out>, tables=<optimized out>, derived=derived@entry=true, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x1542a4107d78)at /test/11.2_dbg/sql/sql_base.cc:5639
      		 
      #6  0x000056180e727274 in open_and_lock_tables (flags=0, derived=true, tables=<optimized out>, thd=0x154270000d58)at /test/11.2_dbg/sql/sql_base.h:530
      		 
      #7  mysql_execute_command (thd=thd@entry=0x154270000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_dbg/sql/sql_parse.cc:4581
      		 
      #8  0x000056180e72c010 in mysql_parse (thd=thd@entry=0x154270000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1542a41082e0)at /test/11.2_dbg/sql/sql_parse.cc:7920
      		 
      #9  0x000056180e72e3d3 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x154270000d58, packet=packet@entry=0x15427000b2f9 "INSERT INTO t SELECT 1", packet_length=packet_length@entry=22, blocking=blocking@entry=true)at /test/11.2_dbg/sql/sql_class.h:247
      		 
      #10 0x000056180e73076c in do_command (thd=0x154270000d58, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1407
      		 
      #11 0x000056180e897c49 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5618117b7fa8, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1439
      		 
      #12 0x000056180e897f3e in handle_one_connection (arg=arg@entry=0x5618117b7fa8)at /test/11.2_dbg/sql/sql_connect.cc:1341
      		 
      #13 0x000056180ecea52c in pfs_spawn_thread (arg=0x561811724838)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201
      		 
      #14 0x00001542bb897ada in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:444
      		 
      #15 0x00001542bb92847c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

      Bug confirmed present in:
      MariaDB: 10.11.9 (dbg), 10.11.9 (opt), 11.1.6 (dbg), 11.1.6 (opt), 11.2.5 (dbg), 11.2.5 (opt), 11.4.3 (dbg), 11.4.3 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.5.26 (dbg), 10.5.26 (opt), 10.6.19 (dbg), 10.6.19 (opt)

      Unconfirmed (pending upmerge):
      11.5.2 (dbg), 11.5.2 (opt), 11.6.0 (dbg), 11.6.0 (opt)

      Attachments

        Issue Links

          is caused by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-32487 SIGSEGV in ha_resolve_storage_engine_name, UBSAN: runtime error: index 4294967295 out of bounds for type 'st_plugin_int *[64]'

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            View 10 older comments
            Roel Roel Van de Paar added a comment - - edited

            This bug observed, as to be expected, during MDEV-31788 testing. However, this time it was on SELECT:

            --source include/have_partition.inc
            		 
            SET sql_mode='';
            		 
            INSTALL SONAME 'ha_spider';
            		 
            CREATE SERVER s FOREIGN DATA WRAPPER MYSQL OPTIONS (HOST 'LOCALHOST', DATABASE 'test', USER 'Spider', PASSWORD '', SOCKET '../socket.sock');
            		 
            CREATE TABLE t (pKEY INT NOT NULL, PRIMARY KEY(pKEY)) ENGINE=Spider COMMENT='TABLE "t"' PARTITION BY KEY(pKEY) (PARTITION pt1 COMMENT='SRV "s"', PARTITION pt2 COMMENT='SRV "s"', PARTITION pt3 COMMENT='SRV "s"');
            		 
            UNINSTALL SONAME IF EXISTS "ha_spider";
            		 
            SELECT * FROM t ORDER BY id;

            Roel Roel Van de Paar added a comment - - edited This bug observed, as to be expected, during MDEV-31788 testing. However, this time it was on SELECT: --source include/have_partition.inc SET sql_mode= '' ; INSTALL SONAME 'ha_spider' ; CREATE SERVER s FOREIGN DATA WRAPPER MYSQL OPTIONS (HOST 'LOCALHOST' , DATABASE 'test' , USER 'Spider' , PASSWORD '' , SOCKET '../socket.sock' ); CREATE TABLE t (pKEY INT NOT NULL , PRIMARY KEY (pKEY)) ENGINE=Spider COMMENT= 'TABLE "t"' PARTITION BY KEY (pKEY) (PARTITION pt1 COMMENT= 'SRV "s"' , PARTITION pt2 COMMENT= 'SRV "s"' , PARTITION pt3 COMMENT= 'SRV "s"' ); UNINSTALL SONAME IF EXISTS "ha_spider" ; SELECT * FROM t ORDER BY id;
            holyfoot Alexey Botchkov added a comment -

            ok to push.

            holyfoot Alexey Botchkov added a comment - ok to push.
            ycp Yuchen Pei added a comment -

            Thanks for the review - pushed 384ec03e4884fcd224d5b12a8ccd53a7766280b2 to 10.5

            ycp Yuchen Pei added a comment - Thanks for the review - pushed 384ec03e4884fcd224d5b12a8ccd53a7766280b2 to 10.5
            Roel Roel Van de Paar added a comment -

            Documenting another set of stacks seen during MDEV-31788 testing produced by this testcase:

            SET sql_mode='';
            		 
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            		 
            CREATE TABLE t (a INT,KEY(a)) ENGINE=Spider;
            		 
            UNINSTALL SONAME IF EXISTS 'ha_spider';
            		 
            ALTER TABLE t ENGINE=Spider PARTITION BY KEY(a) (PARTITION p0 ENGINE=Spider);

            Leads to:

            SIGSEGV|parse_engine_part_options|open_table_from_share|ha_create_table|mysql_alter_table
            		 
            UBSAN|member access within null pointer of type 'struct handlerton'|sql/create_options.cc|parse_engine_part_options|open_table_from_share|ha_create_table|mysql_alter_table

            The testcase does not produce any issues on a 10.5 build as of today, which may indicate it is fixed, however the original testcase did not produce any outcome on 10.5 either. NTS: recheck after upmerge.

            Roel Roel Van de Paar added a comment - Documenting another set of stacks seen during MDEV-31788 testing produced by this testcase: SET sql_mode= '' ; INSTALL PLUGIN Spider SONAME 'ha_spider.so' ; CREATE TABLE t (a INT , KEY (a)) ENGINE=Spider; UNINSTALL SONAME IF EXISTS 'ha_spider' ; ALTER TABLE t ENGINE=Spider PARTITION BY KEY (a) (PARTITION p0 ENGINE=Spider); Leads to: SIGSEGV|parse_engine_part_options|open_table_from_share|ha_create_table|mysql_alter_table UBSAN|member access within null pointer of type 'struct handlerton'|sql/create_options.cc|parse_engine_part_options|open_table_from_share|ha_create_table|mysql_alter_table The testcase does not produce any issues on a 10.5 build as of today, which may indicate it is fixed, however the original testcase did not produce any outcome on 10.5 either. NTS: recheck after upmerge.
            Roel Roel Van de Paar added a comment -

            Furthermore, the two original testcases also produced this UBSAN (Still present in 11.6 ftm):

            UBSAN|member access within null pointer of type 'struct handlerton'|sql/create_options.cc|parse_engine_part_options|open_table_from_share|open_table|open_and_process_table

            Roel Roel Van de Paar added a comment - Furthermore, the two original testcases also produced this UBSAN (Still present in 11.6 ftm): UBSAN|member access within null pointer of type 'struct handlerton'|sql/create_options.cc|parse_engine_part_options|open_table_from_share|open_table|open_and_process_table

            People

              ycp Yuchen Pei
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.