Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36119

Server crashes when querying to wrong mysql.transaction_registry structure

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Duplicate
    • 10.5, 10.6, 10.11, 11.4, 11.8
    • N/A
    • Versioned Tables
    • None

    Description

      Bug fix for MDEV-33783 has not been addressed all the cases added in the comments.

      --source include/have_innodb.inc
       
      CREATE TABLE sv_t (x INT,start_trxid BIGINT UNSIGNED GENERATED ALWAYS AS ROW START,end_trxid BIGINT UNSIGNED GENERATED ALWAYS AS ROW END,PERIOD FOR SYSTEM_TIME(start_trxid,end_trxid)) ENGINE=INNODB WITH SYSTEM VERSIONING;
      CREATE OR REPLACE TABLE mysql.transaction_registry (id INT);
      XA START 'a';
      INSERT INTO sv_t (x) VALUES(1);
      SELECT * FROM sv_t FOR SYSTEM_TIME FROM  (NOW() - INTERVAL 1 MINUTE) TO NOW();
      

      Leads to:

      CS 11.8.1 1c4aed7c680c0402d6e97e097f03815c0e9bf4c5 (Optimized) Build 17/02/2025

      Core was generated by `/test/MD170225-mariadb-11.8.1-linux-x86_64-opt/bin/mariadbd --no-defaults --max'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  Item_field::Item_field (this=0x1534a801cda8, thd=0x1534a8000c68, context_arg=0x1534a80175f0, f=0x1534a8064741)at /test/11.8_opt/sql/item.cc:3230
       
      [Current thread is 1 (Thread 0x153505fc36c0 (LWP 3061186))]
      (gdb) bt
      #0  Item_field::Item_field (this=0x1534a801cda8, thd=0x1534a8000c68, context_arg=0x1534a80175f0, f=0x1534a8064741)at /test/11.8_opt/sql/item.cc:3230
      #1  0x0000561c6b0ddb68 in TR_table::query (this=0x153505fc0498, commit_time=@0x153505fc0470: {year = 2000, month = 9, day = 8, hour = 0, minute = 0, second = 0, second_part = 0, neg = 0 '\000', time_type = MYSQL_TIMESTAMP_DATETIME}, backwards=false) at /test/11.8_opt/sql/table.cc:10636
      #2  0x0000561c6b1bb9f9 in Item_func_trt_id::get_by_commit_ts (this=0x1534a8019728, commit_ts=@0x153505fc0470: {year = 2000, month = 9, day = 8, hour = 0, minute = 0, second = 0, second_part = 0, neg = 0 '\000', time_type = MYSQL_TIMESTAMP_DATETIME}, backwards=<optimized out>) at /test/11.8_opt/sql/item_vers.cc:136
      #3  Item_func_trt_id::val_int (this=0x1534a8019728)at /test/11.8_opt/sql/item_vers.cc:170
      #4  0x0000561c6b277426 in Item_cache_int::cache_value (this=0x1534a801c200)at /test/11.8_opt/sql/item.cc:10562
      #5  0x0000561c6b2775be in Item_cache::has_value (this=0x1534a801c200)at /test/11.8_opt/sql/item.h:7530
      #6  Item_cache_int::val_int (this=0x1534a801c200)at /test/11.8_opt/sql/item.cc:10595
      #7  0x0000561c6b1bbbbc in Item::val_uint (this=0x1534a801cda8)at /test/11.8_opt/sql/item.h:1523
      #8  Item_func_trt_trx_sees::val_bool (this=0x1534a80197e0)at /test/11.8_opt/sql/item_vers.cc:189
      #9  0x0000561c6b294068 in Item_cond_and::val_bool (this=0x1534a801c3a8)at /test/11.8_opt/sql/item_cmpfunc.cc:5702
      #10 0x0000561c6b04eac3 in evaluate_join_record (join=join@entry=0x1534a8018c68, join_tab=join_tab@entry=0x1534a801b238, error=<optimized out>) at /test/11.8_opt/sql/sql_select.cc:24287
      #11 0x0000561c6b017a3b in sub_select (join=0x1534a8018c68, join_tab=0x1534a801b238, end_of_records=<optimized out>)at /test/11.8_opt/sql/sql_select.cc:24186
      #12 0x0000561c6b032ce3 in do_select (join=join@entry=0x1534a8018c68, procedure=<optimized out>) at /test/11.8_opt/sql/sql_select.cc:23697
      #13 0x0000561c6b0325f2 in JOIN::exec_inner (this=this@entry=0x1534a8018c68)at /test/11.8_opt/sql/sql_select.cc:5059
      #14 0x0000561c6b018297 in JOIN::exec (this=0x1534a8018c68)at /test/11.8_opt/sql/sql_select.cc:4842
      #15 mysql_select (thd=thd@entry=0x1534a8000c68, tables=<optimized out>, fields=@0x1534a8017860: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1534a8017b98, last = 0x1534a8017b98, elements = 1}, <No data fields>}, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x1534a8018c40, unit=0x1534a8004fc0, select_lex=0x1534a80175a8)at /test/11.8_opt/sql/sql_select.cc:5375
      #16 0x0000561c6b017f19 in handle_select (thd=thd@entry=0x1534a8000c68, lex=lex@entry=0x1534a8004ee0, result=result@entry=0x1534a8018c40, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/11.8_opt/sql/sql_select.cc:633
      #17 0x0000561c6afe550e in execute_sqlcom_select (thd=thd@entry=0x1534a8000c68, all_tables=0x1534a8017be8) at /test/11.8_opt/sql/sql_parse.cc:6191
      #18 0x0000561c6afe3a00 in mysql_execute_command (thd=thd@entry=0x1534a8000c68, is_called_from_prepared_stmt=false) at /test/11.8_opt/sql/sql_parse.cc:3979
      #19 0x0000561c6afdc261 in mysql_parse (thd=thd@entry=0x1534a8000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x153505fc2430)at /test/11.8_opt/sql/sql_parse.cc:7915
      #20 0x0000561c6afda6f0 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1534a8000c68, packet=packet@entry=0x1534a80088a9 "", packet_length=packet_length@entry=15, blocking=true)at /test/11.8_opt/sql/sql_parse.cc:1902
      #21 0x0000561c6afdc671 in do_command (thd=thd@entry=0x1534a8000c68, blocking=true) at /test/11.8_opt/sql/sql_parse.cc:1415
      #22 0x0000561c6b107e8d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x561caa284c38, put_in_cache=true)at /test/11.8_opt/sql/sql_connect.cc:1415
      #23 0x0000561c6b107c4f in handle_one_connection (arg=arg@entry=0x561caa284c38)at /test/11.8_opt/sql/sql_connect.cc:1327
      #24 0x0000561c6b48cd29 in pfs_spawn_thread (arg=0x561caa231528)at /test/11.8_opt/storage/perfschema/pfs.cc:2198
      #25 0x000015350b89caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #26 0x000015350b929c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug confirmed present in:
      MariaDB: 10.6.21 (dbg), 10.6.21 (opt), 10.11.12 (dbg), 10.11.12 (opt), 11.4.6 (dbg), 11.4.6 (opt), 11.7.2 (dbg), 11.7.2 (opt), 11.8.0 (dbg), 11.8.1 (opt)

      Attachments

        Issue Links

          Activity

            Another test case

            --source include/have_innodb.inc
             
            CREATE OR REPLACE TABLE mysql.procs_priv(id INT) ENGINE=INNODB;
            INSERT INTO mysql.procs_priv SELECT seq FROM seq_1_to_1001;
            FLUSH PRIVILEGES;
            

            CS 11.8.1 1c4aed7c680c0402d6e97e097f03815c0e9bf4c5 (Optimized) Build 17/02/2025

            Core was generated by `/test/MD170225-mariadb-11.8.1-linux-x86_64-opt/bin/mariadbd --no-defaults --max'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0  Sql_mode_save::Sql_mode_save (thd=0x841f0f, this=<optimized out>)at /test/11.8_opt/sql/sql_class.h:8149
             
            [Current thread is 1 (Thread 0x1547647ff6c0 (LWP 1034778))]
            (gdb) bt
            #0  Sql_mode_save::Sql_mode_save (thd=0x841f0f, this=<optimized out>)at /test/11.8_opt/sql/sql_class.h:8149
            #1  Sql_mode_instant_remove::Sql_mode_instant_remove (thd=0x841f0f, temporary_remove_flags=2147483648, this=<optimized out>)at /test/11.8_opt/sql/sql_class.h:8233
            #2  get_field (mem=mem@entry=0x558a067237a0 <grant_memroot>, field=0x558a06522820 <vtable for Field_long+16>)at /test/11.8_opt/sql/table.cc:5294
            #3  0x0000558a0535d2d2 in GRANT_NAME::GRANT_NAME (this=this@entry=0x558a213964c8, form=form@entry=0x15470c04e5a8, is_routine=true) at /test/11.8_opt/sql/sql_acl.cc:5645
            #4  0x0000558a0536359b in grant_load (thd=0x15470c000c68, tables_priv=@0x1547647fdcb0: {<Grant_table_base> = {min_columns = 8, start_priv_columns = 0, end_priv_columns = 8, m_table = 0x558a213c1ce8}, <No data fields>}, columns_priv=@0x1547647fdcc8: {<Grant_table_base> = {min_columns = 7, start_priv_columns = 0, end_priv_columns = 7, m_table = 0x558a213bd338}, <No data fields>}, procs_priv=@0x1547647fdcf8: {<Grant_table_base> = {min_columns = 8, start_priv_columns = 0, end_priv_columns = 1, m_table = 0x15470c04e5a8}, <No data fields>}) at /test/11.8_opt/sql/sql_acl.cc:8277
            #5  grant_reload (thd=thd@entry=0x15470c000c68)at /test/11.8_opt/sql/sql_acl.cc:8389
            #6  0x0000558a055387de in reload_acl_and_cache (thd=thd@entry=0x15470c000c68, options=1, tables=tables@entry=0x0, write_to_binlog=write_to_binlog@entry=0x1547647fe000)at /test/11.8_opt/sql/sql_reload.cc:101
            #7  0x0000558a053f5ca9 in mysql_execute_command (thd=thd@entry=0x15470c000c68, is_called_from_prepared_stmt=false) at /test/11.8_opt/sql/sql_parse.cc:5354
            #8  0x0000558a053ef261 in mysql_parse (thd=thd@entry=0x15470c000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1547647fe430)at /test/11.8_opt/sql/sql_parse.cc:7915
            #9  0x0000558a053ed6f0 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x15470c000c68, packet=packet@entry=0x15470c0088a9 "FLUSH PRIVILEGES", packet_length=packet_length@entry=16, blocking=true)at /test/11.8_opt/sql/sql_parse.cc:1902
            #10 0x0000558a053ef671 in do_command (thd=thd@entry=0x15470c000c68, blocking=true) at /test/11.8_opt/sql/sql_parse.cc:1415
            #11 0x0000558a0551ae8d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x558a213c4dd8, put_in_cache=true)at /test/11.8_opt/sql/sql_connect.cc:1415
            #12 0x0000558a0551ac4f in handle_one_connection (arg=arg@entry=0x558a213c4dd8)at /test/11.8_opt/sql/sql_connect.cc:1327
            #13 0x0000558a0589fd29 in pfs_spawn_thread (arg=0x558a213716c8)at /test/11.8_opt/storage/perfschema/pfs.cc:2198
            #14 0x000015476aa9caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
            #15 0x000015476ab29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
            

            ramesh Ramesh Sivaraman added a comment - Another test case --source include/have_innodb.inc   CREATE OR REPLACE TABLE mysql.procs_priv(id INT ) ENGINE=INNODB; INSERT INTO mysql.procs_priv SELECT seq FROM seq_1_to_1001; FLUSH PRIVILEGES ; CS 11.8.1 1c4aed7c680c0402d6e97e097f03815c0e9bf4c5 (Optimized) Build 17/02/2025 Core was generated by `/test/MD170225-mariadb-11.8.1-linux-x86_64-opt/bin/mariadbd --no-defaults --max'. Program terminated with signal SIGSEGV, Segmentation fault. #0 Sql_mode_save::Sql_mode_save (thd=0x841f0f, this=<optimized out>)at /test/11.8_opt/sql/sql_class.h:8149   [Current thread is 1 (Thread 0x1547647ff6c0 (LWP 1034778))] (gdb) bt #0 Sql_mode_save::Sql_mode_save (thd=0x841f0f, this=<optimized out>)at /test/11.8_opt/sql/sql_class.h:8149 #1 Sql_mode_instant_remove::Sql_mode_instant_remove (thd=0x841f0f, temporary_remove_flags=2147483648, this=<optimized out>)at /test/11.8_opt/sql/sql_class.h:8233 #2 get_field (mem=mem@entry=0x558a067237a0 <grant_memroot>, field=0x558a06522820 <vtable for Field_long+16>)at /test/11.8_opt/sql/table.cc:5294 #3 0x0000558a0535d2d2 in GRANT_NAME::GRANT_NAME (this=this@entry=0x558a213964c8, form=form@entry=0x15470c04e5a8, is_routine=true) at /test/11.8_opt/sql/sql_acl.cc:5645 #4 0x0000558a0536359b in grant_load (thd=0x15470c000c68, tables_priv=@0x1547647fdcb0: {<Grant_table_base> = {min_columns = 8, start_priv_columns = 0, end_priv_columns = 8, m_table = 0x558a213c1ce8}, <No data fields>}, columns_priv=@0x1547647fdcc8: {<Grant_table_base> = {min_columns = 7, start_priv_columns = 0, end_priv_columns = 7, m_table = 0x558a213bd338}, <No data fields>}, procs_priv=@0x1547647fdcf8: {<Grant_table_base> = {min_columns = 8, start_priv_columns = 0, end_priv_columns = 1, m_table = 0x15470c04e5a8}, <No data fields>}) at /test/11.8_opt/sql/sql_acl.cc:8277 #5 grant_reload (thd=thd@entry=0x15470c000c68)at /test/11.8_opt/sql/sql_acl.cc:8389 #6 0x0000558a055387de in reload_acl_and_cache (thd=thd@entry=0x15470c000c68, options=1, tables=tables@entry=0x0, write_to_binlog=write_to_binlog@entry=0x1547647fe000)at /test/11.8_opt/sql/sql_reload.cc:101 #7 0x0000558a053f5ca9 in mysql_execute_command (thd=thd@entry=0x15470c000c68, is_called_from_prepared_stmt=false) at /test/11.8_opt/sql/sql_parse.cc:5354 #8 0x0000558a053ef261 in mysql_parse (thd=thd@entry=0x15470c000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1547647fe430)at /test/11.8_opt/sql/sql_parse.cc:7915 #9 0x0000558a053ed6f0 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x15470c000c68, packet=packet@entry=0x15470c0088a9 "FLUSH PRIVILEGES", packet_length=packet_length@entry=16, blocking=true)at /test/11.8_opt/sql/sql_parse.cc:1902 #10 0x0000558a053ef671 in do_command (thd=thd@entry=0x15470c000c68, blocking=true) at /test/11.8_opt/sql/sql_parse.cc:1415 #11 0x0000558a0551ae8d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x558a213c4dd8, put_in_cache=true)at /test/11.8_opt/sql/sql_connect.cc:1415 #12 0x0000558a0551ac4f in handle_one_connection (arg=arg@entry=0x558a213c4dd8)at /test/11.8_opt/sql/sql_connect.cc:1327 #13 0x0000558a0589fd29 in pfs_spawn_thread (arg=0x558a213716c8)at /test/11.8_opt/storage/perfschema/pfs.cc:2198 #14 0x000015476aa9caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447 #15 0x000015476ab29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

            People

              midenok Aleksey Midenkov
              ramesh Ramesh Sivaraman
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.