Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
11.4, 11.8, 12.0
Description
Possibly related to, though different from (ref versions, RocksDB etc.), MDEV-35011.
INSTALL PLUGIN Spider SONAME 'ha_spider.so'; |
INSTALL PLUGIN RocksDB SONAME 'ha_rocksdb'; |
SET SESSION spider_ignore_comments=1; |
SET SESSION TRANSACTION ISOLATION LEVEL READ UNCOMMITTED; |
SET SESSION spider_semi_table_lock=1; |
CREATE TABLE t1 (c1 INT) ENGINE=Spider COMMENT='WRAPPER "mysql", srv "srv", TABLE "t"'; |
CREATE TABLE t2 (c1 INT) ENGINE=Spider COMMENT='WRAPPER "mysql", srv "srv", TABLE "t"'; |
CREATE TABLE t3 (c1 VARBINARY(25), c2 INT, c3 DECIMAL) ENGINE=RocksDB; |
--error ER_ISOLATION_MODE_NOT_SUPPORTED
|
SELECT * FROM t3 UNION SELECT c1 FROM t1; |
DROP TABLE t1; |
SELECT * FROM t2; |
Leads to:
CS 11.4.6 ef966af801afc2a07222b5df65dddd52c77431dd (Debug) Build 15/02/2025 |
Core was generated by `/test/MD150225-mariadb-11.4.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 Binary_string::length (this=0x12) at /test/11.4_dbg/sql/sql_string.h:355
|
|
[Current thread is 1 (LWP 2067669)]
|
(gdb) bt
|
#0 Binary_string::length (this=0x12) at /test/11.4_dbg/sql/sql_string.h:355
|
#1 0x00007f318c16ae2a in spider_string::length (this=0x2)at /test/11.4_dbg/storage/spider/spd_malloc.cc:400
|
#2 0x00007f318c12e92a in spider_link_get_key (link_for_hash_=0x7f12a02ae4b8, length=0x7f318ccde8d8) at /test/11.4_dbg/storage/spider/spd_table.cc:493
|
#3 0x00005573bbe3cafe in my_hash_key (hash=0x7f12a00374f8, record=0x7f12a02ae4b8 "\030,", length=0x7f318ccde8d8, first=1 '\001')at /test/11.4_dbg/mysys/hash.c:197
|
#4 0x00005573bbe3c3a2 in hashcmp (hash=0x7f12a00374f8, pos=0x7f12a04adc88, key=0x7f12a02b27c8 "`test`.`t2`", length=11)at /test/11.4_dbg/mysys/hash.c:380
|
#5 0x00005573bbe3c263 in my_hash_first_from_hash_value (hash=0x7f12a00374f8, hash_value=2873112761, key=0x7f12a02b27c8 "`test`.`t2`", length=11, current_record=0x7f318ccde96c) at /test/11.4_dbg/mysys/hash.c:291
|
#6 0x00005573bbe3c1bf in my_hash_search_using_hash_value (hash=0x7f12a00374f8, hash_value=2873112761, key=0x7f12a02b27c8 "`test`.`t2`", length=11)at /test/11.4_dbg/mysys/hash.c:245
|
#7 0x00007f318c1b8b9a in spider_mbase_handler::append_lock_tables_list (this=0x7f12a0114be0, conn=0x7f12a01185b8, link_idx=0, appended=0x7f318ccdea3c)at /test/11.4_dbg/storage/spider/spd_db_mysql.cc:12096
|
#8 0x00007f318c179bbe in ha_spider::append_lock_tables_list (this=0x7f12a01d8168) at /test/11.4_dbg/storage/spider/ha_spider.cc:10194
|
#9 0x00007f318c179834 in ha_spider::store_lock (this=0x7f12a01d8168, thd=0x7f12a0000d58, to=0x7f12a001b1d0, lock_type=TL_READ)at /test/11.4_dbg/storage/spider/ha_spider.cc:781
|
#10 0x00005573bb72197c in get_lock_data (thd=0x7f12a0000d58, table_ptr=0x7f12a001b1a8, count=1, flags=3)at /test/11.4_dbg/sql/lock.cc:825
|
#11 0x00005573bb72115e in mysql_lock_tables (thd=0x7f12a0000d58, tables=0x7f12a001b1a8, count=1, flags=0) at /test/11.4_dbg/sql/lock.cc:301
|
#12 0x00005573bb0b9e7d in lock_tables (thd=0x7f12a0000d58, tables=0x7f12a001a178, count=1, flags=0)at /test/11.4_dbg/sql/sql_base.cc:5933
|
#13 0x00005573bb0ba973 in open_and_lock_tables (thd=0x7f12a0000d58, options=@0x7f12a0006590: {m_options = DDL_options_st::OPT_NONE}, tables=0x7f12a001a178, derived=true, flags=0, prelocking_strategy=0x7f318ccded30) at /test/11.4_dbg/sql/sql_base.cc:5665
|
#14 0x00005573bb0c87ee in open_and_lock_tables (thd=0x7f12a0000d58, tables=0x7f12a001a178, derived=true, flags=0)at /test/11.4_dbg/sql/sql_base.h:532
|
#15 0x00005573bb177f8e in execute_sqlcom_select (thd=0x7f12a0000d58, all_tables=0x7f12a001a178) at /test/11.4_dbg/sql/sql_parse.cc:6104
|
#16 0x00005573bb16d620 in mysql_execute_command (thd=0x7f12a0000d58, is_called_from_prepared_stmt=false) at /test/11.4_dbg/sql/sql_parse.cc:3975
|
#17 0x00005573bb1657a4 in mysql_parse (thd=0x7f12a0000d58, rawbuf=0x7f12a0019ac0 "SELECT * FROM t2", length=16, parser_state=0x7f318cce0a30) at /test/11.4_dbg/sql/sql_parse.cc:7907
|
#18 0x00005573bb162c54 in dispatch_command (command=COM_QUERY, thd=0x7f12a0000d58, packet=0x7f12a000afd9 "SELECT * FROM t2", packet_length=16, blocking=true) at /test/11.4_dbg/sql/sql_parse.cc:1904
|
#19 0x00005573bb166353 in do_command (thd=0x7f12a0000d58, blocking=true)at /test/11.4_dbg/sql/sql_parse.cc:1417
|
#20 0x00005573bb3485a9 in do_handle_one_connection (connect=0x5573bf096de8, put_in_cache=true) at /test/11.4_dbg/sql/sql_connect.cc:1408
|
#21 0x00005573bb348342 in handle_one_connection (arg=0x5573bf0fa898)at /test/11.4_dbg/sql/sql_connect.cc:1320
|
#22 0x00007f319269ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#23 0x00007f3192729c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.5 dbg 150225 c43d0a015f974c5a0142e6779332089a7a979853 No bug found
|
CS 10.5 opt 150225 c43d0a015f974c5a0142e6779332089a7a979853 No bug found
|
CS 10.6 dbg 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 No bug found
|
CS 10.6 opt 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 No bug found
|
CS 10.11 dbg 150225 43c5d1303f5c7c726db276815c459436110f342f No bug found
|
CS 10.11 opt 150225 43c5d1303f5c7c726db276815c459436110f342f No bug found
|
CS 11.4 dbg 150225 ef966af801afc2a07222b5df65dddd52c77431dd SIGSEGV|Binary_string::length|spider_string::length|spider_link_get_key|my_hash_key
|
CS 11.4 opt 150225 ef966af801afc2a07222b5df65dddd52c77431dd SIGSEGV|spider_db_mbase::append_lock_tables|spider_mbase_handler::lock_tables|ha_spider::lock_tables|ha_spider::external_lock
|
CS 11.8 dbg 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d SIGSEGV|Binary_string::length|spider_string::length|spider_link_get_key|my_hash_key
|
CS 11.8 opt 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d No bug found
|
CS 12.0 dbg 150225 c92add291e636c797e6d6ddca605905541b2a441 SIGSEGV|Binary_string::length|spider_string::length|spider_link_get_key|my_hash_key
|
CS 12.0 opt 150225 c92add291e636c797e6d6ddca605905541b2a441 No bug found
|
ES 10.5 dbg 130325 52e0fd3f76eaa4b1e88fd2028f5640c48b6cbb06 No bug found
|
ES 10.5 opt 130325 52e0fd3f76eaa4b1e88fd2028f5640c48b6cbb06 No bug found
|
ES 10.6 dbg 130325 66c9276fa67d1aacf5cf47b31254e79a9d0e4a5d No bug found
|
ES 10.6 opt 130325 66c9276fa67d1aacf5cf47b31254e79a9d0e4a5d No bug found
|
ES 11.4 dbg 130325 ca7a2a835c4c982ffa35d3f0b5748b30c4c22763 SIGSEGV|Binary_string::length|spider_string::length|spider_link_get_key|my_hash_key
|
ES 11.4 opt 130325 ca7a2a835c4c982ffa35d3f0b5748b30c4c22763 No bug found
|
MS 5.5 dbg 070123 bac287c315b1792e7ae33f91add6a60292f9bae8 No bug found
|
MS 5.5 opt 070123 bac287c315b1792e7ae33f91add6a60292f9bae8 No bug found
|
MS 5.6 dbg 070123 dab95781a1244104d6b87020ac2fc4d190ba2946 No bug found
|
MS 5.6 opt 070123 dab95781a1244104d6b87020ac2fc4d190ba2946 No bug found
|
MS 5.7 dbg 060224 f7680e98b6bbe3500399fbad465d08a6b75d7a5c No bug found
|
MS 5.7 opt 060224 f7680e98b6bbe3500399fbad465d08a6b75d7a5c No bug found
|
MS 8.0 dbg 060224 49ef33f7edadef3ae04665e73d1babd40179a4f1 No bug found
|
MS 8.0 opt 060224 49ef33f7edadef3ae04665e73d1babd40179a4f1 No bug found
|
MS 9.1 dbg 211024 61a3a1d8ef15512396b4c2af46e922a19bf2b174 No bug found
|
MS 9.1 opt 211024 61a3a1d8ef15512396b4c2af46e922a19bf2b174 No bug found
|
Testcase is CLI and MTR compatible.
Attachments
Issue Links
- relates to
-
MDEV-35011 SIGSEGV in spider_db_mbase::append_lock_tables (or spider_string::length) on SELECT, ASAN: heap-use-after-free in spider_link_get_key
-
- Open
-
SAN Testing shows the same issue as on one of the testcases from MDEV-35011:
SAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.5 dbg 150225 c43d0a015f974c5a0142e6779332089a7a979853 No bug found
CS 10.5 opt 150225 c43d0a015f974c5a0142e6779332089a7a979853 No bug found
CS 10.6 dbg 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 No bug found
CS 10.6 opt 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 No bug found
CS 10.11 dbg 150225 43c5d1303f5c7c726db276815c459436110f342f No bug found
CS 10.11 opt 150225 43c5d1303f5c7c726db276815c459436110f342f No bug found
CS 11.4 dbg 150225 ef966af801afc2a07222b5df65dddd52c77431dd ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
CS 11.4 opt 150225 ef966af801afc2a07222b5df65dddd52c77431dd ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
CS 11.8 dbg 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
CS 11.8 opt 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
CS 12.0 dbg 150225 c92add291e636c797e6d6ddca605905541b2a441 ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
CS 12.0 opt 150225 c92add291e636c797e6d6ddca605905541b2a441 ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
ES 10.5 dbg 140325 6553c62369ab3606efc74295c902181f793fd6d1 UBSAN|load of value X, which is not a valid value for type 'bool'|sql/sql_table.cc|mysql_alter_table|Sql_cmd_alter_table::execute|mysql_execute_command|execute_server_code
ES 10.5 opt 140325 6553c62369ab3606efc74295c902181f793fd6d1 No bug found
ES 10.6 dbg 140325 a99e9e4101f5d56a379577e6d81c829b7658df99 No bug found
ES 10.6 opt 140325 a99e9e4101f5d56a379577e6d81c829b7658df99 UBSAN|member access within null pointer of type 'struct st_my_thread_var'|storage/spider/spd_table.cc|spider_create_sys_thd|spider_table_bg_sts_action|asan_thread_start|start_thread
ES 11.4 dbg 140325 26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
ES 11.4 opt 140325 26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value