Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36376

SIGSEGV in Binary_string::length on SELECT when using RocksDB

Details

    Description

      Possibly related to, though different from (ref versions, RocksDB etc.), MDEV-35011.

      INSTALL PLUGIN Spider SONAME 'ha_spider.so';
      INSTALL PLUGIN RocksDB SONAME 'ha_rocksdb';
      SET SESSION spider_ignore_comments=1;
      SET SESSION TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
      SET SESSION spider_semi_table_lock=1;
      CREATE TABLE t1 (c1 INT) ENGINE=Spider COMMENT='WRAPPER "mysql", srv "srv", TABLE "t"';
      CREATE TABLE t2 (c1 INT) ENGINE=Spider COMMENT='WRAPPER "mysql", srv "srv", TABLE "t"';
      CREATE TABLE t3 (c1 VARBINARY(25), c2 INT, c3 DECIMAL) ENGINE=RocksDB;
      --error ER_ISOLATION_MODE_NOT_SUPPORTED
      SELECT * FROM t3 UNION SELECT c1 FROM t1;
      DROP TABLE t1;
      SELECT * FROM t2;
      

      Leads to:

      CS 11.4.6 ef966af801afc2a07222b5df65dddd52c77431dd (Debug) Build 15/02/2025

      Core was generated by `/test/MD150225-mariadb-11.4.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  Binary_string::length (this=0x12) at /test/11.4_dbg/sql/sql_string.h:355
       
      [Current thread is 1 (LWP 2067669)]
      (gdb) bt
      #0  Binary_string::length (this=0x12) at /test/11.4_dbg/sql/sql_string.h:355
      #1  0x00007f318c16ae2a in spider_string::length (this=0x2)at /test/11.4_dbg/storage/spider/spd_malloc.cc:400
      #2  0x00007f318c12e92a in spider_link_get_key (link_for_hash_=0x7f12a02ae4b8, length=0x7f318ccde8d8) at /test/11.4_dbg/storage/spider/spd_table.cc:493
      #3  0x00005573bbe3cafe in my_hash_key (hash=0x7f12a00374f8, record=0x7f12a02ae4b8 "\030,", length=0x7f318ccde8d8, first=1 '\001')at /test/11.4_dbg/mysys/hash.c:197
      #4  0x00005573bbe3c3a2 in hashcmp (hash=0x7f12a00374f8, pos=0x7f12a04adc88, key=0x7f12a02b27c8 "`test`.`t2`", length=11)at /test/11.4_dbg/mysys/hash.c:380
      #5  0x00005573bbe3c263 in my_hash_first_from_hash_value (hash=0x7f12a00374f8, hash_value=2873112761, key=0x7f12a02b27c8 "`test`.`t2`", length=11, current_record=0x7f318ccde96c) at /test/11.4_dbg/mysys/hash.c:291
      #6  0x00005573bbe3c1bf in my_hash_search_using_hash_value (hash=0x7f12a00374f8, hash_value=2873112761, key=0x7f12a02b27c8 "`test`.`t2`", length=11)at /test/11.4_dbg/mysys/hash.c:245
      #7  0x00007f318c1b8b9a in spider_mbase_handler::append_lock_tables_list (this=0x7f12a0114be0, conn=0x7f12a01185b8, link_idx=0, appended=0x7f318ccdea3c)at /test/11.4_dbg/storage/spider/spd_db_mysql.cc:12096
      #8  0x00007f318c179bbe in ha_spider::append_lock_tables_list (this=0x7f12a01d8168) at /test/11.4_dbg/storage/spider/ha_spider.cc:10194
      #9  0x00007f318c179834 in ha_spider::store_lock (this=0x7f12a01d8168, thd=0x7f12a0000d58, to=0x7f12a001b1d0, lock_type=TL_READ)at /test/11.4_dbg/storage/spider/ha_spider.cc:781
      #10 0x00005573bb72197c in get_lock_data (thd=0x7f12a0000d58, table_ptr=0x7f12a001b1a8, count=1, flags=3)at /test/11.4_dbg/sql/lock.cc:825
      #11 0x00005573bb72115e in mysql_lock_tables (thd=0x7f12a0000d58, tables=0x7f12a001b1a8, count=1, flags=0) at /test/11.4_dbg/sql/lock.cc:301
      #12 0x00005573bb0b9e7d in lock_tables (thd=0x7f12a0000d58, tables=0x7f12a001a178, count=1, flags=0)at /test/11.4_dbg/sql/sql_base.cc:5933
      #13 0x00005573bb0ba973 in open_and_lock_tables (thd=0x7f12a0000d58, options=@0x7f12a0006590: {m_options = DDL_options_st::OPT_NONE}, tables=0x7f12a001a178, derived=true, flags=0, prelocking_strategy=0x7f318ccded30) at /test/11.4_dbg/sql/sql_base.cc:5665
      #14 0x00005573bb0c87ee in open_and_lock_tables (thd=0x7f12a0000d58, tables=0x7f12a001a178, derived=true, flags=0)at /test/11.4_dbg/sql/sql_base.h:532
      #15 0x00005573bb177f8e in execute_sqlcom_select (thd=0x7f12a0000d58, all_tables=0x7f12a001a178) at /test/11.4_dbg/sql/sql_parse.cc:6104
      #16 0x00005573bb16d620 in mysql_execute_command (thd=0x7f12a0000d58, is_called_from_prepared_stmt=false) at /test/11.4_dbg/sql/sql_parse.cc:3975
      #17 0x00005573bb1657a4 in mysql_parse (thd=0x7f12a0000d58, rawbuf=0x7f12a0019ac0 "SELECT * FROM t2", length=16, parser_state=0x7f318cce0a30) at /test/11.4_dbg/sql/sql_parse.cc:7907
      #18 0x00005573bb162c54 in dispatch_command (command=COM_QUERY, thd=0x7f12a0000d58, packet=0x7f12a000afd9 "SELECT * FROM t2", packet_length=16, blocking=true) at /test/11.4_dbg/sql/sql_parse.cc:1904
      #19 0x00005573bb166353 in do_command (thd=0x7f12a0000d58, blocking=true)at /test/11.4_dbg/sql/sql_parse.cc:1417
      #20 0x00005573bb3485a9 in do_handle_one_connection (connect=0x5573bf096de8, put_in_cache=true) at /test/11.4_dbg/sql/sql_connect.cc:1408
      #21 0x00005573bb348342 in handle_one_connection (arg=0x5573bf0fa898)at /test/11.4_dbg/sql/sql_connect.cc:1320
      #22 0x00007f319269ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #23 0x00007f3192729c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.5   dbg  150225  c43d0a015f974c5a0142e6779332089a7a979853  No bug found                  
      CS  10.5   opt  150225  c43d0a015f974c5a0142e6779332089a7a979853  No bug found                  
      CS  10.6   dbg  150225  f1d7e0c17e33f77278e6226dd94aeb30fc856bf0  No bug found                  
      CS  10.6   opt  150225  f1d7e0c17e33f77278e6226dd94aeb30fc856bf0  No bug found                  
      CS  10.11  dbg  150225  43c5d1303f5c7c726db276815c459436110f342f  No bug found                  
      CS  10.11  opt  150225  43c5d1303f5c7c726db276815c459436110f342f  No bug found                  
      CS  11.4   dbg  150225  ef966af801afc2a07222b5df65dddd52c77431dd  SIGSEGV|Binary_string::length|spider_string::length|spider_link_get_key|my_hash_key
      CS  11.4   opt  150225  ef966af801afc2a07222b5df65dddd52c77431dd  SIGSEGV|spider_db_mbase::append_lock_tables|spider_mbase_handler::lock_tables|ha_spider::lock_tables|ha_spider::external_lock
      CS  11.8   dbg  150225  33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d  SIGSEGV|Binary_string::length|spider_string::length|spider_link_get_key|my_hash_key
      CS  11.8   opt  150225  33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d  No bug found                  
      CS  12.0   dbg  150225  c92add291e636c797e6d6ddca605905541b2a441  SIGSEGV|Binary_string::length|spider_string::length|spider_link_get_key|my_hash_key
      CS  12.0   opt  150225  c92add291e636c797e6d6ddca605905541b2a441  No bug found                  
      ES  10.5   dbg  130325  52e0fd3f76eaa4b1e88fd2028f5640c48b6cbb06  No bug found                  
      ES  10.5   opt  130325  52e0fd3f76eaa4b1e88fd2028f5640c48b6cbb06  No bug found                  
      ES  10.6   dbg  130325  66c9276fa67d1aacf5cf47b31254e79a9d0e4a5d  No bug found                  
      ES  10.6   opt  130325  66c9276fa67d1aacf5cf47b31254e79a9d0e4a5d  No bug found                  
      ES  11.4   dbg  130325  ca7a2a835c4c982ffa35d3f0b5748b30c4c22763  SIGSEGV|Binary_string::length|spider_string::length|spider_link_get_key|my_hash_key
      ES  11.4   opt  130325  ca7a2a835c4c982ffa35d3f0b5748b30c4c22763  No bug found                  
      MS  5.5    dbg  070123  bac287c315b1792e7ae33f91add6a60292f9bae8  No bug found                  
      MS  5.5    opt  070123  bac287c315b1792e7ae33f91add6a60292f9bae8  No bug found                  
      MS  5.6    dbg  070123  dab95781a1244104d6b87020ac2fc4d190ba2946  No bug found                  
      MS  5.6    opt  070123  dab95781a1244104d6b87020ac2fc4d190ba2946  No bug found                  
      MS  5.7    dbg  060224  f7680e98b6bbe3500399fbad465d08a6b75d7a5c  No bug found                  
      MS  5.7    opt  060224  f7680e98b6bbe3500399fbad465d08a6b75d7a5c  No bug found                  
      MS  8.0    dbg  060224  49ef33f7edadef3ae04665e73d1babd40179a4f1  No bug found                  
      MS  8.0    opt  060224  49ef33f7edadef3ae04665e73d1babd40179a4f1  No bug found                  
      MS  9.1    dbg  211024  61a3a1d8ef15512396b4c2af46e922a19bf2b174  No bug found                  
      MS  9.1    opt  211024  61a3a1d8ef15512396b4c2af46e922a19bf2b174  No bug found                  
      

      Testcase is CLI and MTR compatible.

      Attachments

        Issue Links

          Activity

            SAN Testing shows the same issue as on one of the testcases from MDEV-35011:

            SAN Bug Detection Matrix

                Rel    o/d  Build   Commit                                    UniqueID observed             
            CS  10.5   dbg  150225  c43d0a015f974c5a0142e6779332089a7a979853  No bug found                  
            CS  10.5   opt  150225  c43d0a015f974c5a0142e6779332089a7a979853  No bug found                  
            CS  10.6   dbg  150225  f1d7e0c17e33f77278e6226dd94aeb30fc856bf0  No bug found                  
            CS  10.6   opt  150225  f1d7e0c17e33f77278e6226dd94aeb30fc856bf0  No bug found                  
            CS  10.11  dbg  150225  43c5d1303f5c7c726db276815c459436110f342f  No bug found                  
            CS  10.11  opt  150225  43c5d1303f5c7c726db276815c459436110f342f  No bug found                  
            CS  11.4   dbg  150225  ef966af801afc2a07222b5df65dddd52c77431dd  ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
            CS  11.4   opt  150225  ef966af801afc2a07222b5df65dddd52c77431dd  ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
            CS  11.8   dbg  150225  33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d  ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
            CS  11.8   opt  150225  33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d  ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
            CS  12.0   dbg  150225  c92add291e636c797e6d6ddca605905541b2a441  ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
            CS  12.0   opt  150225  c92add291e636c797e6d6ddca605905541b2a441  ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
            ES  10.5   dbg  140325  6553c62369ab3606efc74295c902181f793fd6d1  UBSAN|load of value X, which is not a valid value for type 'bool'|sql/sql_table.cc|mysql_alter_table|Sql_cmd_alter_table::execute|mysql_execute_command|execute_server_code
            ES  10.5   opt  140325  6553c62369ab3606efc74295c902181f793fd6d1  No bug found                  
            ES  10.6   dbg  140325  a99e9e4101f5d56a379577e6d81c829b7658df99  No bug found                  
            ES  10.6   opt  140325  a99e9e4101f5d56a379577e6d81c829b7658df99  UBSAN|member access within null pointer of type 'struct st_my_thread_var'|storage/spider/spd_table.cc|spider_create_sys_thd|spider_table_bg_sts_action|asan_thread_start|start_thread
            ES  11.4   dbg  140325  26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba  ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
            ES  11.4   opt  140325  26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba  ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value
            

            Roel Roel Van de Paar added a comment - SAN Testing shows the same issue as on one of the testcases from MDEV-35011 : SAN Bug Detection Matrix Rel o/d Build Commit UniqueID observed CS 10.5 dbg 150225 c43d0a015f974c5a0142e6779332089a7a979853 No bug found CS 10.5 opt 150225 c43d0a015f974c5a0142e6779332089a7a979853 No bug found CS 10.6 dbg 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 No bug found CS 10.6 opt 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 No bug found CS 10.11 dbg 150225 43c5d1303f5c7c726db276815c459436110f342f No bug found CS 10.11 opt 150225 43c5d1303f5c7c726db276815c459436110f342f No bug found CS 11.4 dbg 150225 ef966af801afc2a07222b5df65dddd52c77431dd ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value CS 11.4 opt 150225 ef966af801afc2a07222b5df65dddd52c77431dd ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value CS 11.8 dbg 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value CS 11.8 opt 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value CS 12.0 dbg 150225 c92add291e636c797e6d6ddca605905541b2a441 ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value CS 12.0 opt 150225 c92add291e636c797e6d6ddca605905541b2a441 ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value ES 10.5 dbg 140325 6553c62369ab3606efc74295c902181f793fd6d1 UBSAN|load of value X, which is not a valid value for type 'bool'|sql/sql_table.cc|mysql_alter_table|Sql_cmd_alter_table::execute|mysql_execute_command|execute_server_code ES 10.5 opt 140325 6553c62369ab3606efc74295c902181f793fd6d1 No bug found ES 10.6 dbg 140325 a99e9e4101f5d56a379577e6d81c829b7658df99 No bug found ES 10.6 opt 140325 a99e9e4101f5d56a379577e6d81c829b7658df99 UBSAN|member access within null pointer of type 'struct st_my_thread_var'|storage/spider/spd_table.cc|spider_create_sys_thd|spider_table_bg_sts_action|asan_thread_start|start_thread ES 11.4 dbg 140325 26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value ES 11.4 opt 140325 26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba ASAN|heap-use-after-free|storage/spider/spd_table.cc|spider_link_get_key|hashcmp|my_hash_first_from_hash_value|my_hash_search_using_hash_value

            People

              ycp Yuchen Pei
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.