Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-34421

SIGSEGV in parse_engine_part_options on INSERT, SELECT or ALTER

Details

    Description

      New regression:

      --source include/have_partition.inc
      		 
      SET sql_mode='';
      		 
      INSTALL SONAME 'ha_spider';
      		 
      CREATE TABLE t (c INT) ENGINE=Spider PARTITION BY KEY(c) (PARTITION p);
      		 
      UNINSTALL SONAME IF EXISTS 'ha_spider';
      		 
      INSERT INTO t SELECT 1;

      Leads to:

      11.2.5 a21e49cbcc5f4adb1a1b4970ceead6a85e968063 (Debug)

      		 
      Core was generated by `/test/MD190624-mariadb-11.2.5-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  parse_engine_part_options (thd=thd@entry=0x154270000d58, table=table@entry=0x154270056a68)at /test/11.2_dbg/sql/create_options.cc:540
      		 
      Downloading source file /test/11.2_dbg/sql/create_options.cc...
      		 
      [Current thread is 1 (LWP 2665548)]
      		 
      (gdb) bt
      		 
      #0  parse_engine_part_options (thd=thd@entry=0x154270000d58, table=table@entry=0x154270056a68)at /test/11.2_dbg/sql/create_options.cc:540
      		 
      #1  0x000056180e853b03 in open_table_from_share (thd=thd@entry=0x154270000d58, share=share@entry=0x1542700d17f0, alias=alias@entry=0x154270013750, db_stat=db_stat@entry=33, prgflag=prgflag@entry=8, ha_open_flags=16, outparam=0x154270056a68, is_create_table=false, partitions_to_open=0x0)at /test/11.2_dbg/sql/table.cc:4485
      		 
      #2  0x000056180e6a22f0 in open_table (thd=thd@entry=0x154270000d58, table_list=table_list@entry=0x154270013708, ot_ctx=ot_ctx@entry=0x1542a4107c40) at /test/11.2_dbg/sql/sql_base.cc:2247
      		 
      #3  0x000056180e6a5e72 in open_and_process_table (ot_ctx=0x1542a4107c40, has_prelocking_list=false, prelocking_strategy=0x1542a4107d78, flags=0, counter=0x1542a4107cdc, tables=0x154270013708, thd=0x154270000d58)at /test/11.2_dbg/sql/sql_base.cc:4180
      		 
      #4  open_tables (thd=thd@entry=0x154270000d58, options=@0x154270006828: {m_options = DDL_options_st::OPT_NONE}, start=start@entry=0x1542a4107cc8, counter=counter@entry=0x1542a4107cdc, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x1542a4107d78)at /test/11.2_dbg/sql/sql_base.cc:4666
      		 
      #5  0x000056180e6a6d67 in open_and_lock_tables (thd=thd@entry=0x154270000d58, options=<optimized out>, tables=<optimized out>, derived=derived@entry=true, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x1542a4107d78)at /test/11.2_dbg/sql/sql_base.cc:5639
      		 
      #6  0x000056180e727274 in open_and_lock_tables (flags=0, derived=true, tables=<optimized out>, thd=0x154270000d58)at /test/11.2_dbg/sql/sql_base.h:530
      		 
      #7  mysql_execute_command (thd=thd@entry=0x154270000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_dbg/sql/sql_parse.cc:4581
      		 
      #8  0x000056180e72c010 in mysql_parse (thd=thd@entry=0x154270000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1542a41082e0)at /test/11.2_dbg/sql/sql_parse.cc:7920
      		 
      #9  0x000056180e72e3d3 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x154270000d58, packet=packet@entry=0x15427000b2f9 "INSERT INTO t SELECT 1", packet_length=packet_length@entry=22, blocking=blocking@entry=true)at /test/11.2_dbg/sql/sql_class.h:247
      		 
      #10 0x000056180e73076c in do_command (thd=0x154270000d58, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1407
      		 
      #11 0x000056180e897c49 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5618117b7fa8, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1439
      		 
      #12 0x000056180e897f3e in handle_one_connection (arg=arg@entry=0x5618117b7fa8)at /test/11.2_dbg/sql/sql_connect.cc:1341
      		 
      #13 0x000056180ecea52c in pfs_spawn_thread (arg=0x561811724838)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201
      		 
      #14 0x00001542bb897ada in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:444
      		 
      #15 0x00001542bb92847c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

      Bug confirmed present in:
      MariaDB: 10.11.9 (dbg), 10.11.9 (opt), 11.1.6 (dbg), 11.1.6 (opt), 11.2.5 (dbg), 11.2.5 (opt), 11.4.3 (dbg), 11.4.3 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.5.26 (dbg), 10.5.26 (opt), 10.6.19 (dbg), 10.6.19 (opt)

      Unconfirmed (pending upmerge):
      11.5.2 (dbg), 11.5.2 (opt), 11.6.0 (dbg), 11.6.0 (opt)

      Attachments

        Issue Links

          is caused by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-32487 SIGSEGV in ha_resolve_storage_engine_name, UBSAN: runtime error: index 4294967295 out of bounds for type 'st_plugin_int *[64]'

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            Roel Roel Van de Paar added a comment -

            No UB/ASAN issues observed

            Roel Roel Van de Paar added a comment - No UB/ASAN issues observed
            Roel Roel Van de Paar added a comment - - edited

            Interestingly, removing the sql_mode clearing leads to this MTR output:

            11.2.5 a21e49cbcc5f4adb1a1b4970ceead6a85e968063 (Debug)

            		 
            worker[01] Using MTR_BUILD_THREAD 300, with reserved ports 19000..19029
            		 
            INSTALL SONAME 'ha_spider';
            		 
            Warnings:
            		 
            Warning	1105	Cannot enable tc-log at run-time. XA features of SPIDER are disabled
            		 
            CREATE TABLE t (c INT) ENGINE=Spider PARTITION BY KEY(c) (PARTITION p);
            		 
             
            		 
            UNINSTALL SONAME IF EXISTS 'ha_spider';
            		 
            Warnings:
            		 
            Warning	1620	Plugin is busy and will be uninstalled on shutdown
            		 
            INSERT INTO t SELECT 1;
            		 
            main.test                                [ fail ]
            		 
                    Test ended at 2024-06-19 13:34:35
            		 
             
            		 
            CURRENT_TEST: main.test
            		 
            mysqltest: At line 5: query 'INSERT INTO t SELECT 1' failed: ER_UNKNOWN_STORAGE_ENGINE (1286): Unknown storage engine 'SPIDER'

            Note the "Plugin is busy and will be uninstalled on shutdown".

            In the CLI we see:

            11.2.5 a21e49cbcc5f4adb1a1b4970ceead6a85e968063 (Debug)

            		 
            11.2.5-dbg>INSTALL SONAME 'ha_spider';
            		 
            Query OK, 0 rows affected (0.754 sec)
            		 
             
            		 
            11.2.5-dbg>CREATE TABLE t (c INT) ENGINE=Spider PARTITION BY KEY(c) (PARTITION p);
            		 
            Query OK, 0 rows affected (0.005 sec)
            		 
             
            		 
            11.2.5-dbg>UNINSTALL SONAME IF EXISTS 'ha_spider';
            		 
            Query OK, 0 rows affected, 1 warning (0.001 sec)
            		 
             
            		 
            11.2.5-dbg>SHOW WARNINGS;
            		 
            +---------+------+----------------------------------------------------+
            		 
            | Level   | Code | Message                                            |
            		 
            +---------+------+----------------------------------------------------+
            		 
            | Warning | 1620 | Plugin is busy and will be uninstalled on shutdown |
            		 
            +---------+------+----------------------------------------------------+
            		 
            1 row in set (0.000 sec)
            		 
             
            		 
            11.2.5-dbg>INSERT INTO t SELECT 1;
            		 
            ERROR 1286 (42000): Unknown storage engine 'SPIDER'

            Roel Roel Van de Paar added a comment - - edited Interestingly, removing the sql_mode clearing leads to this MTR output: 11.2.5 a21e49cbcc5f4adb1a1b4970ceead6a85e968063 (Debug) worker[01] Using MTR_BUILD_THREAD 300, with reserved ports 19000..19029 INSTALL SONAME 'ha_spider'; Warnings: Warning 1105 Cannot enable tc-log at run-time. XA features of SPIDER are disabled CREATE TABLE t (c INT) ENGINE=Spider PARTITION BY KEY(c) (PARTITION p);   UNINSTALL SONAME IF EXISTS 'ha_spider'; Warnings: Warning 1620 Plugin is busy and will be uninstalled on shutdown INSERT INTO t SELECT 1; main.test [ fail ] Test ended at 2024-06-19 13:34:35   CURRENT_TEST: main.test mysqltest: At line 5: query 'INSERT INTO t SELECT 1' failed: ER_UNKNOWN_STORAGE_ENGINE (1286): Unknown storage engine 'SPIDER' Note the "Plugin is busy and will be uninstalled on shutdown". In the CLI we see: 11.2.5 a21e49cbcc5f4adb1a1b4970ceead6a85e968063 (Debug) 11.2.5-dbg>INSTALL SONAME 'ha_spider'; Query OK, 0 rows affected (0.754 sec)   11.2.5-dbg>CREATE TABLE t (c INT) ENGINE=Spider PARTITION BY KEY(c) (PARTITION p); Query OK, 0 rows affected (0.005 sec)   11.2.5-dbg>UNINSTALL SONAME IF EXISTS 'ha_spider'; Query OK, 0 rows affected, 1 warning (0.001 sec)   11.2.5-dbg>SHOW WARNINGS; +---------+------+----------------------------------------------------+ | Level | Code | Message | +---------+------+----------------------------------------------------+ | Warning | 1620 | Plugin is busy and will be uninstalled on shutdown | +---------+------+----------------------------------------------------+ 1 row in set (0.000 sec)   11.2.5-dbg>INSERT INTO t SELECT 1; ERROR 1286 (42000): Unknown storage engine 'SPIDER'
            ycp Yuchen Pei added a comment -

            ok, bisecting done.

            22ba7e4ff823f71d99cba78ef58a867931874bad is the first bad commit
            		 
            commit 22ba7e4ff823f71d99cba78ef58a867931874bad
            		 
            Merge: a960e95febd 5ba542e9eec
            		 
            Author: Marko Mäkelä <marko.makela@mariadb.com>
            		 
            Date:   Thu May 30 16:04:00 2024 +0300
            		 
                Merge 10.6 into 10.11

            Some old commits result in thread stack overrun. In my setup it could be fixed with the following patch (h/t sanja):

            modified   sql/sql_parse.cc
            		 
            @@ -7446,6 +7446,10 @@ check_stack_overrun(THD *thd, long margin, uchar *buf __attribute__((unused)))
            		 
             {
            		 
               long stack_used;
            		 
               DBUG_ASSERT(thd == current_thd);
            		 
            +#ifdef __SANITIZE_ADDRESS__
            		 
            +  return 0;
            		 
            +#endif
            		 
            +
            		 
               if ((stack_used= available_stack_size(thd->thread_stack, &stack_used)) >=
            		 
                   (long) (my_thread_stack_size - margin))
            		 
               {

            ycp Yuchen Pei added a comment - ok, bisecting done. 22ba7e4ff823f71d99cba78ef58a867931874bad is the first bad commit commit 22ba7e4ff823f71d99cba78ef58a867931874bad Merge: a960e95febd 5ba542e9eec Author: Marko Mäkelä <marko.makela@mariadb.com> Date: Thu May 30 16:04:00 2024 +0300 Merge 10.6 into 10.11 Some old commits result in thread stack overrun. In my setup it could be fixed with the following patch (h/t sanja ): modified sql/sql_parse.cc @@ -7446,6 +7446,10 @@ check_stack_overrun(THD *thd, long margin, uchar *buf __attribute__((unused))) { long stack_used; DBUG_ASSERT(thd == current_thd); +#ifdef __SANITIZE_ADDRESS__ + return 0; +#endif + if ((stack_used= available_stack_size(thd->thread_stack, &stack_used)) >= (long) (my_thread_stack_size - margin)) {
            ycp Yuchen Pei added a comment -

            The issue is "caused" by MDEV-32487, as in that change causes Storage_engine_name::resolve_storage_engine_with_error() to resolve the engine handlerton to NULL without failure when the plugin is not available and NO_ENGINE_SUBSTITUTION is not set. In the first place, engine substitution is only supposed to take effect in CREATE TABLE and ALTER TABLE statements, but here it is executing an INSERT statement, so no engine substitution should happen, and the INSERT statement should raise ER_UNKNOWN_STORAGE_ENGINE rather than whatever it is raising now in 10.5-6 (ER_CONNECT_TO_FOREIGN_DATA_SOURCE). In this sense the present issue is not a regression and is present in 10.5. I have an initial fix that checks the thd_sql_command() as well as NO_ENGINE_SUBSTITUTION when deciding whether to return failure in Storage_engine_name::resolve_storage_engine_with_error():

            b4897145d8b upstream/bb-10.11-mdev-34421 MDEV-34421 Check the SQL command when resolving storage engine

            Let's see how the CI reacts...

            ycp Yuchen Pei added a comment - The issue is "caused" by MDEV-32487 , as in that change causes Storage_engine_name::resolve_storage_engine_with_error() to resolve the engine handlerton to NULL without failure when the plugin is not available and NO_ENGINE_SUBSTITUTION is not set. In the first place, engine substitution is only supposed to take effect in CREATE TABLE and ALTER TABLE statements, but here it is executing an INSERT statement, so no engine substitution should happen, and the INSERT statement should raise ER_UNKNOWN_STORAGE_ENGINE rather than whatever it is raising now in 10.5-6 ( ER_CONNECT_TO_FOREIGN_DATA_SOURCE ). In this sense the present issue is not a regression and is present in 10.5. I have an initial fix that checks the thd_sql_command() as well as NO_ENGINE_SUBSTITUTION when deciding whether to return failure in Storage_engine_name::resolve_storage_engine_with_error() : b4897145d8b upstream/bb-10.11-mdev-34421 MDEV-34421 Check the SQL command when resolving storage engine Let's see how the CI reacts...
            Roel Roel Van de Paar added a comment - - edited

            It is a bit more serious than originally expected: I just saw the same stack with a setup/testcase which did not use UNINSTALL in any way.
            The setup in this case was multi-threaded & was using XA.

            Roel Roel Van de Paar added a comment - - edited It is a bit more serious than originally expected: I just saw the same stack with a setup/testcase which did not use UNINSTALL in any way. The setup in this case was multi-threaded & was using XA.
            ycp Yuchen Pei added a comment - - edited

            Thanks Roel, do you have a test case without UNINSTALL? Alternatively, maybe you could test with my current fix applied?

            The CI looks happy with the fix btw.

            ycp Yuchen Pei added a comment - - edited Thanks Roel , do you have a test case without UNINSTALL? Alternatively, maybe you could test with my current fix applied? The CI looks happy with the fix btw.
            Roel Roel Van de Paar added a comment - - edited

            ycp Thank you! No testcase for the single multi-threaded occurrence I had without UNINSTALL.

            I will test bb-10.11-mdev-34421 using multi-threaded to see if anything shows.

            Roel Roel Van de Paar added a comment - - edited ycp Thank you! No testcase for the single multi-threaded occurrence I had without UNINSTALL. I will test bb-10.11-mdev-34421 using multi-threaded to see if anything shows.
            ycp Yuchen Pei added a comment -

            Thanks Roel. I also have a 10.5 patch at 2350d2bf166740ccbd13be2f429f4ee18e31ad78, which is the 10.11 patch applied to 10.5. But for the purpose of checking for segv I suppose there's no need to test the 10.5 version.

            ycp Yuchen Pei added a comment - Thanks Roel . I also have a 10.5 patch at 2350d2bf166740ccbd13be2f429f4ee18e31ad78, which is the 10.11 patch applied to 10.5. But for the purpose of checking for segv I suppose there's no need to test the 10.5 version.
            Roel Roel Van de Paar added a comment -

            I did not see the bug resurface in the 10.11 patch @ b4897145d8b61aa317e489ed6f62376553a2f93e testing. Thank you.

            Roel Roel Van de Paar added a comment - I did not see the bug resurface in the 10.11 patch @ b4897145d8b61aa317e489ed6f62376553a2f93e testing. Thank you.
            ycp Yuchen Pei added a comment -

            Thanks Roel, that's good to know.

            Hi holyfoot, ptal thanks:

            [Revision 2350d2bf166740ccbd13be2f429f4ee18e31ad78]
            		 
            Author: Yuchen Pei <ycp@mariadb.com>
            		 
            Date: 2024-06-21 Fri 19:37:00 +08
            		 
             
            		 
            MDEV-34421 Check the SQL command when resolving storage engine
            		 
             
            		 
            ENGINE_SUBSTITUTION only applies to CREATE TABLE and ALTER TABLE, and
            		 
            Storage_engine_name::resolve_storage_engine_with_error() could be
            		 
            called when executing any sql command.

            cc serg as the patch touches relevant bits in the sql layer.

            ycp Yuchen Pei added a comment - Thanks Roel , that's good to know. Hi holyfoot , ptal thanks: [Revision 2350d2bf166740ccbd13be2f429f4ee18e31ad78] Author: Yuchen Pei <ycp@mariadb.com> Date: 2024-06-21 Fri 19:37:00 +08   MDEV-34421 Check the SQL command when resolving storage engine   ENGINE_SUBSTITUTION only applies to CREATE TABLE and ALTER TABLE, and Storage_engine_name::resolve_storage_engine_with_error() could be called when executing any sql command. cc serg as the patch touches relevant bits in the sql layer.
            Roel Roel Van de Paar added a comment - - edited

            This bug observed, as to be expected, during MDEV-31788 testing. However, this time it was on SELECT:

            --source include/have_partition.inc
            		 
            SET sql_mode='';
            		 
            INSTALL SONAME 'ha_spider';
            		 
            CREATE SERVER s FOREIGN DATA WRAPPER MYSQL OPTIONS (HOST 'LOCALHOST', DATABASE 'test', USER 'Spider', PASSWORD '', SOCKET '../socket.sock');
            		 
            CREATE TABLE t (pKEY INT NOT NULL, PRIMARY KEY(pKEY)) ENGINE=Spider COMMENT='TABLE "t"' PARTITION BY KEY(pKEY) (PARTITION pt1 COMMENT='SRV "s"', PARTITION pt2 COMMENT='SRV "s"', PARTITION pt3 COMMENT='SRV "s"');
            		 
            UNINSTALL SONAME IF EXISTS "ha_spider";
            		 
            SELECT * FROM t ORDER BY id;

            Roel Roel Van de Paar added a comment - - edited This bug observed, as to be expected, during MDEV-31788 testing. However, this time it was on SELECT: --source include/have_partition.inc SET sql_mode= '' ; INSTALL SONAME 'ha_spider' ; CREATE SERVER s FOREIGN DATA WRAPPER MYSQL OPTIONS (HOST 'LOCALHOST' , DATABASE 'test' , USER 'Spider' , PASSWORD '' , SOCKET '../socket.sock' ); CREATE TABLE t (pKEY INT NOT NULL , PRIMARY KEY (pKEY)) ENGINE=Spider COMMENT= 'TABLE "t"' PARTITION BY KEY (pKEY) (PARTITION pt1 COMMENT= 'SRV "s"' , PARTITION pt2 COMMENT= 'SRV "s"' , PARTITION pt3 COMMENT= 'SRV "s"' ); UNINSTALL SONAME IF EXISTS "ha_spider" ; SELECT * FROM t ORDER BY id;
            holyfoot Alexey Botchkov added a comment -

            ok to push.

            holyfoot Alexey Botchkov added a comment - ok to push.
            ycp Yuchen Pei added a comment -

            Thanks for the review - pushed 384ec03e4884fcd224d5b12a8ccd53a7766280b2 to 10.5

            ycp Yuchen Pei added a comment - Thanks for the review - pushed 384ec03e4884fcd224d5b12a8ccd53a7766280b2 to 10.5
            Roel Roel Van de Paar added a comment -

            Documenting another set of stacks seen during MDEV-31788 testing produced by this testcase:

            SET sql_mode='';
            		 
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            		 
            CREATE TABLE t (a INT,KEY(a)) ENGINE=Spider;
            		 
            UNINSTALL SONAME IF EXISTS 'ha_spider';
            		 
            ALTER TABLE t ENGINE=Spider PARTITION BY KEY(a) (PARTITION p0 ENGINE=Spider);

            Leads to:

            SIGSEGV|parse_engine_part_options|open_table_from_share|ha_create_table|mysql_alter_table
            		 
            UBSAN|member access within null pointer of type 'struct handlerton'|sql/create_options.cc|parse_engine_part_options|open_table_from_share|ha_create_table|mysql_alter_table

            The testcase does not produce any issues on a 10.5 build as of today, which may indicate it is fixed, however the original testcase did not produce any outcome on 10.5 either. NTS: recheck after upmerge.

            Roel Roel Van de Paar added a comment - Documenting another set of stacks seen during MDEV-31788 testing produced by this testcase: SET sql_mode= '' ; INSTALL PLUGIN Spider SONAME 'ha_spider.so' ; CREATE TABLE t (a INT , KEY (a)) ENGINE=Spider; UNINSTALL SONAME IF EXISTS 'ha_spider' ; ALTER TABLE t ENGINE=Spider PARTITION BY KEY (a) (PARTITION p0 ENGINE=Spider); Leads to: SIGSEGV|parse_engine_part_options|open_table_from_share|ha_create_table|mysql_alter_table UBSAN|member access within null pointer of type 'struct handlerton'|sql/create_options.cc|parse_engine_part_options|open_table_from_share|ha_create_table|mysql_alter_table The testcase does not produce any issues on a 10.5 build as of today, which may indicate it is fixed, however the original testcase did not produce any outcome on 10.5 either. NTS: recheck after upmerge.
            Roel Roel Van de Paar added a comment -

            Furthermore, the two original testcases also produced this UBSAN (Still present in 11.6 ftm):

            UBSAN|member access within null pointer of type 'struct handlerton'|sql/create_options.cc|parse_engine_part_options|open_table_from_share|open_table|open_and_process_table

            Roel Roel Van de Paar added a comment - Furthermore, the two original testcases also produced this UBSAN (Still present in 11.6 ftm): UBSAN|member access within null pointer of type 'struct handlerton'|sql/create_options.cc|parse_engine_part_options|open_table_from_share|open_table|open_and_process_table

            People

              ycp Yuchen Pei
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.