Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-37294

segv in flst::remove_complete(buf_block_t*, unsigned short, unsigned char*, mtr_t*)

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • 11.4.6, 11.4.7, 11.4.8
    • 11.4
    • Ubuntu server 24.04.02 LTS
      40GB RAM
      20 Cores
      VM running under ESX
      Using MariaDB repos
      Table encryption enabled

    Description

      When upgrading from MariaDB 11.4.5 to latest version the upgrade fails with the following error in systemctl status

      Setting up mariadb-server (1:11.4.7+maria~ubu2404) ...
      Job for mariadb.service failed because a fatal signal was delivered causing the control process to dump core.
      See "systemctl status mariadb.service" and "journalctl -xeu mariadb.service" for details.
      invoke-rc.d: initscript mariadb, action "restart" failed.
      ● mariadb.service - MariaDB 11.4.7 database server
           Loaded: loaded (/usr/lib/systemd/system/mariadb.service; enabled; preset: enabled)
          Drop-In: /etc/systemd/system/mariadb.service.d
                   └─migrated-from-my.cnf-settings.conf, override.conf
           Active: activating (auto-restart) (Result: core-dump) since Tue 2025-07-22 11:45:25 UTC; 6ms ago
             Docs: man:mariadbd(8)
                   https://mariadb.com/kb/en/library/systemd/
          Process: 289360 ExecStartPre=/usr/bin/install -m 755 -o mysql -g root -d /var/run/mysqld (code=exited, status=0/SUCCESS)
          Process: 289362 ExecStartPre=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS)
          Process: 289365 ExecStartPre=/bin/sh -c [ ! -e /usr/bin/galera_recovery ] && VAR= ||   VAR=`/usr/bin/galera_recovery`; [ $? -eq 0 ]   && systemctl set-environment _WSREP_START_POSITION=$VAR || exit 1 (code=exited, status=0/SUCCESS)
          Process: 289552 ExecStart=/usr/sbin/mariadbd $MYSQLD_OPTS $_WSREP_NEW_CLUSTER $_WSREP_START_POSITION (code=dumped, signal=SEGV)
         Main PID: 289552 (code=dumped, signal=SEGV)
              CPU: 2.785s
      dpkg: error processing package mariadb-server (--configure):
       installed mariadb-server package post-installation script subprocess returned error exit status 1}}
      

      The error log for the server looked like this:

      2025-07-22 11:48:57 0 [Note] Starting MariaDB 11.4.7-MariaDB-ubu2404-log source revision 118cfcf82107188f2295631193658b2ef94f4f3f server_uid H4KbMzEOxqG2qVsO2+6EFA+zeWs= as process 299823
      2025-07-22 11:48:57 0 [Note] InnoDB: Compressed tables use zlib 1.3
      2025-07-22 11:48:57 0 [Note] InnoDB: Number of transaction pools: 1
      2025-07-22 11:48:57 0 [Note] InnoDB: Using crc32 + pclmulqdq instructions
      2025-07-22 11:48:57 0 [Note] InnoDB: Using liburing
      2025-07-22 11:48:57 0 [Note] InnoDB: innodb_buffer_pool_size_max=22528m, innodb_buffer_pool_size=22528m
      2025-07-22 11:48:57 0 [Note] InnoDB: Initialized memory pressure event listener
      2025-07-22 11:48:57 0 [Note] InnoDB: Completed initialization of buffer pool
      2025-07-22 11:48:57 0 [Note] InnoDB: File system buffers for log disabled (block size=512 bytes)
      2025-07-22 11:48:57 0 [Note] InnoDB: Resetting space id's in the doublewrite buffer
      2025-07-22 11:48:57 0 [Note] InnoDB: End of log at LSN=47462002707934
      2025-07-22 11:48:57 0 [Note] InnoDB: Opened 3 undo tablespaces
      2025-07-22 11:48:57 0 [Note] InnoDB: 128 rollback segments in 3 undo tablespaces are active.
      2025-07-22 11:48:58 0 [Note] InnoDB: System tablespace defragmentation process starts
      2025-07-22 11:48:58 0 [Note] InnoDB: Moving the data from extents 14144 through 2452672
      250722 11:48:58 [ERROR] /usr/sbin/mariadbd got signal 11 ;
      Sorry, we probably made a mistake, and this is a bug.
       
      Your assistance in bug reporting will enable us to fix this for the next release.
      To report this bug, see https://mariadb.com/kb/en/reporting-bugs about how to report
      a bug on https://jira.mariadb.org/.
       
      Please include the information from the server start above, to the end of the
      information below.
       
      Server version: 11.4.7-MariaDB-ubu2404-log source revision: 118cfcf82107188f2295631193658b2ef94f4f3f
       
      The information page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/
      contains instructions to obtain a better version of the backtrace below.
      Following these instructions will help MariaDB developers provide a fix quicker.
       
      Attempting backtrace. Include this in the bug report.
      (note: Retrieving this information may fail)
       
      Thread pointer: 0x0
      stack_bottom = 0x0 thread_stack 0x30000
      /usr/sbin/mariadbd(my_print_stacktrace+0x30)[0x616bb2b93560]
      /usr/sbin/mariadbd(handle_fatal_signal+0x2a1)[0x616bb272cae1]
      libc_sigaction.c:0(__restore_rt)[0x7baee3045330]
      /usr/sbin/mariadbd(+0x63660b)[0x616bb227360b]
      /usr/sbin/mariadbd(+0x1043036)[0x616bb2c80036]
      /usr/sbin/mariadbd(+0xeba8c9)[0x616bb2af78c9]
      /usr/sbin/mariadbd(+0xec4725)[0x616bb2b01725]
      /usr/sbin/mariadbd(+0x622c5a)[0x616bb225fc5a]
      /usr/sbin/mariadbd(+0xd9b926)[0x616bb29d8926]
      /usr/sbin/mariadbd(_Z24ha_initialize_handlertonPv+0x8c)[0x616bb272f17c]
      /usr/sbin/mariadbd(+0x8165b3)[0x616bb24535b3]
      /usr/sbin/mariadbd(+0x8167a7)[0x616bb24537a7]
      /usr/sbin/mariadbd(_Z11plugin_initPiPPci+0xbfc)[0x616bb2459e3c]
      /usr/sbin/mariadbd(+0x6bbd65)[0x616bb22f8d65]
      /usr/sbin/mariadbd(_Z11mysqld_mainiPPc+0xf79)[0x616bb22fcf79]
      x86/libc-start.c:74(__libc_start_call_main)[0x7baee302a1ca]
      csu/libc-start.c:128(call_init)[0x7baee302a28b]
      /usr/sbin/mariadbd(_start+0x25)[0x616bb22d6865]
      Writing a core file...
      Working directory at /var/lib/mysql
      Resource Limits (excludes unlimited resources):
      Limit                     Soft Limit           Hard Limit           Units     
      Max stack size            8388608              unlimited            bytes     
      Max processes             160119               160119               processes 
      Max open files            1048576              1048576              files     
      Max locked memory         524288               524288               bytes     
      Max pending signals       160119               160119               signals   
      Max msgqueue size         819200               819200               bytes     
      Max nice priority         0                    0                    
      Max realtime priority     0                    0                    
      Core pattern: |/usr/lib/systemd/systemd-coredump %P %u %g %s %t 9223372036854775808 %h %d
       
      Kernel version: Linux version 6.8.0-64-generic (buildd@lcy02-amd64-083) (x86_64-linux-gnu-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #67-Ubuntu SMP PREEMPT_DYNAMIC Sun Jun 15 20:23:31 UTC 2025}}
      

      I had taken a clone of a production server as had hit this issue and had to roll back the versions which allowed me to run some tests to see if anything would allow the upgrade to go though. Nothing helped but these were the things which I have tried (reverting back to the snapshot and re-running all of the previous steps each time):

      • Optimizing all of the databases with mariadb-check --skip-write-binlog --optimize --auto-repair --all-databases (I took another snapshot after that as this took a while)
      • Forced innodb_fast_shutdown to 0 in the server config file and restarted before upgrade.
      • Stopped all the named slaves to ensure there were no running processes which be counted towards the rollback segments.
      • Optimized all of the InnoDB and Aria tables in the mysql schema (to ensure this had been done)

      Each time this failed at the same point as above.

      Core dump is below

      Kind regards
      Derick

      coredumpctl debug 
                 PID: 294918 (mariadbd)
                 UID: 124 (mysql)
                 GID: 134 (mysql)
              Signal: 11 (SEGV)
           Timestamp: Tue 2025-07-22 13:12:00 UTC (13s ago)
        Command Line: /usr/sbin/mariadbd
          Executable: /usr/sbin/mariadbd
       Control Group: /system.slice/mariadb.service
                Unit: mariadb.service
               Slice: system.slice
             Boot ID: 87a18b11527e440aa0955e0121d378b0
          Machine ID: e7027c3ebde74f4a870b311db52087a0
            Hostname: testdebbie.e-learndesign.scot
             Storage: /var/lib/systemd/coredump/core.mariadbd.124.87a18b11527e440aa0955e0121d378b0.294918.1753189920000000.zst (present)
        Size on Disk: 2.6M
             Package: mariadb/1:11.4.7+maria~ubu2404
            build-id: 082d7769ab844a0690ee7a7fbf3888d73ca70585
             Message: Process 294918 (mariadbd) of user 124 dumped core.
                      
                      Module file_key_management.so from deb mariadb-1:11.4.7+maria~ubu2404.amd64
                      Module libzstd.so.1 from deb libzstd-1.5.5+dfsg2-2build1.1.amd64
                      Module libgcc_s.so.1 from deb gcc-14-14.2.0-4ubuntu2~24.04.amd64
                      Module libstdc++.so.6 from deb gcc-14-14.2.0-4ubuntu2~24.04.amd64
                      Module libsystemd.so.0 from deb systemd-255.4-1ubuntu8.8.amd64
                      Module mariadbd from deb mariadb-1:11.4.7+maria~ubu2404.amd64
                      Stack trace of thread 294918:
                      #0  0x00007ce543a9eb2c __pthread_kill_implementation (libc.so.6 + 0x9eb2c)
                      #1  0x0000575b0a7b0aba my_write_core (mariadbd + 0xaefaba)
                      #2  0x00007ce543a45330 __restore_rt (libc.so.6 + 0x45330)
                      #3  0x0000575b0a2f760b _ZN4flstL15remove_completeEP11buf_block_ttPhP5mtr_t.lto_priv.0.cold (mariadbd + 0x63660b)
                      #4  0x0000575b0ad04036 _ZN12PageOperator24alloc_from_fseg_completeEv (mariadbd + 0x1043036)
                      #5  0x0000575b0ab7b8c9 _ZN17SpaceDefragmenter16defragment_indexER12dict_index_t (mariadbd + 0xeba8c9)
                      #6  0x0000575b0ab85725 _ZN17SpaceDefragmenter24defragment_system_tablesEv (mariadbd + 0xec4725)
                      #7  0x0000575b0a2e3c5a _Z9srv_startb (mariadbd + 0x622c5a)
                      #8  0x0000575b0aa5c926 innodb_init (mariadbd + 0xd9b926)
                      #9  0x0000575b0a7b317c _Z24ha_initialize_handlertonPv (mariadbd + 0xaf217c)
                      #10 0x0000575b0a4d75b3 plugin_do_initialize (mariadbd + 0x8165b3)
                      #11 0x0000575b0a4d77a7 plugin_initialize (mariadbd + 0x8167a7)
                      #12 0x0000575b0a4dde3c _Z11plugin_initPiPPci (mariadbd + 0x81ce3c)
                      #13 0x0000575b0a37cd65 init_server_components (mariadbd + 0x6bbd65)
                      #14 0x0000575b0a380f79 _Z11mysqld_mainiPPc (mariadbd + 0x6bff79)
                      #15 0x00007ce543a2a1ca __libc_start_call_main (libc.so.6 + 0x2a1ca)
                      #16 0x00007ce543a2a28b __libc_start_main_impl (libc.so.6 + 0x2a28b)
                      #17 0x0000575b0a35a865 _start (mariadbd + 0x699865)
                      
                      Stack trace of thread 294920:
                      #0  0x00007ce543a98d71 __futex_abstimed_wait_common64 (libc.so.6 + 0x98d71)
                      #1  0x00007ce543a9bc8e __pthread_cond_wait_common (libc.so.6 + 0x9bc8e)
                      #2  0x0000575b0a301685 psi_cond_timedwait (mariadbd + 0x640685)
                      #3  0x0000575b0a301758 inline_mysql_cond_timedwait (mariadbd + 0x640758)
                      #4  0x0000575b0a9b4953 pfs_spawn_thread (mariadbd + 0xcf3953)
                      #5  0x00007ce543a9caa4 start_thread (libc.so.6 + 0x9caa4)
                      #6  0x00007ce543b29c3c __clone3 (libc.so.6 + 0x129c3c)
                      
                      Stack trace of thread 294923:
                      #0  0x00007ce5449b2ab0 n/a (liburing.so.2 + 0x2ab0)
                      #1  0x00007ce5449b30ad __io_uring_get_cqe (liburing.so.2 + 0x30ad)
                      #2  0x0000575b0aba6de8 _ZN12_GLOBAL__N_19aio_uring14thread_routineEPS0_ (mariadbd + 0xee5de8)
                      #3  0x00007ce543eecdb4 n/a (libstdc++.so.6 + 0xecdb4)
                      #4  0x00007ce543a9caa4 start_thread (libc.so.6 + 0x9caa4)
                      #5  0x00007ce543b29c3c __clone3 (libc.so.6 + 0x129c3c)
                      
                      Stack trace of thread 294922:
                      #0  0x00007ce543a98d71 __futex_abstimed_wait_common64 (libc.so.6 + 0x98d71)
                      #1  0x00007ce543a9bc8e __pthread_cond_wait_common (libc.so.6 + 0x9bc8e)
                      #2  0x0000575b0a301685 psi_cond_timedwait (mariadbd + 0x640685)
                      #3  0x0000575b0a2bb5e8 inline_mysql_cond_timedwait (mariadbd + 0x5fa5e8)
                      #4  0x0000575b0a9b4953 pfs_spawn_thread (mariadbd + 0xcf3953)
                      #5  0x00007ce543a9caa4 start_thread (libc.so.6 + 0x9caa4)
                      #6  0x00007ce543b29c3c __clone3 (libc.so.6 + 0x129c3c)
                      
                      Stack trace of thread 294925:
                      #0  0x00007ce543a98d71 __futex_abstimed_wait_common64 (libc.so.6 + 0x98d71)
                      #1  0x00007ce543a9b7ed __pthread_cond_wait_common (libc.so.6 + 0x9b7ed)
                      #2  0x0000575b0ab55675 buf_flush_page_cleaner (mariadbd + 0xe94675)
                      #3  0x00007ce543eecdb4 n/a (libstdc++.so.6 + 0xecdb4)
                      #4  0x00007ce543a9caa4 start_thread (libc.so.6 + 0x9caa4)
                      #5  0x00007ce543b29c3c __clone3 (libc.so.6 + 0x129c3c)
                      
                      Stack trace of thread 294924:
                      #0  0x00007ce543b1b4cd __GI___poll (libc.so.6 + 0x11b4cd)
                      #1  0x0000575b0ab5052d poll (mariadbd + 0xe8f52d)
                      #2  0x00007ce543eecdb4 n/a (libstdc++.so.6 + 0xecdb4)
                      #3  0x00007ce543a9caa4 start_thread (libc.so.6 + 0x9caa4)
                      #4  0x00007ce543b29c3c __clone3 (libc.so.6 + 0x129c3c)
                      ELF object binary architecture: AMD x86-64
       
      GNU gdb (Ubuntu 15.0.50.20240403-0ubuntu1) 15.0.50.20240403-git
      Copyright (C) 2024 Free Software Foundation, Inc.
      License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
      Type "show copying" and "show warranty" for details.
      This GDB was configured as "x86_64-linux-gnu".
      Type "show configuration" for configuration details.
      For bug reporting instructions, please see:
      <https://www.gnu.org/software/gdb/bugs/>.
      Find the GDB manual and other documentation resources online at:
          <http://www.gnu.org/software/gdb/documentation/>.
       
      For help, type "help".
      Type "apropos word" to search for commands related to "word"...
      Reading symbols from /usr/sbin/mariadbd...
      Reading symbols from /usr/lib/debug/.build-id/08/2d7769ab844a0690ee7a7fbf3888d73ca70585.debug...
       
      warning: Can't open file anon_inode:[io_uring] which was expanded to anon_inode:[io_uring] during file-backed mapping note processing
      [New LWP 294918]
      [New LWP 294920]
      [New LWP 294923]
      [New LWP 294922]
      [New LWP 294925]
      [New LWP 294924]
       
      warning: could not find '.gnu_debugaltlink' file for /lib/x86_64-linux-gnu/liburing.so.2
       
      warning: could not find '.gnu_debugaltlink' file for /lib/x86_64-linux-gnu/libcap.so.2
      [Thread debugging using libthread_db enabled]
      Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
      Core was generated by `/usr/sbin/mariadbd'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
       
      warning: 44	./nptl/pthread_kill.c: No such file or directory
      [Current thread is 1 (Thread 0x7ce544716880 (LWP 294918))}}
      

      Attachments

        Issue Links

          Activity

            People

              thiru Thirunarayanan Balathandayuthapani
              turf212 Derick Turner
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.