Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-37384

SIGSEGV in mysql_unpack_partition on CREATE GTT ... LIKE partitioned table

    XMLWordPrintable

Details

    • Not for Release Notes
    • Q4/2025 Server Maintenance

    Description

      CREATE TABLE t1 (c INT) PARTITION BY HASH(c) PARTITIONS 3;
      CREATE GLOBAL TEMPORARY TABLE t2 LIKE t1;
      CREATE GLOBAL TEMPORARY TABLE t3 LIKE t2;
      

      Leads to:

      MDEV-35915 CS 12.0.1 21489191d3683c5655afa170533480c86843ecba (Optimized, Clang) Build 04/08/2025

      Core was generated by `/test/MDEV-35915_MD040825-mariadb-12.0.1-linux-x86_64-opt/bin/mariadbd --no-def'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  mysql_unpack_partition (thd=thd@entry=0x782578000c68, part_buf=<optimized out>, part_info_len=<optimized out>, table=table@entry=0x7826c8491648, is_create_table_ind=true, default_db_type=0x57dc30c46ae8, work_part_info_used=0x7826c8490595)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_partition.cc:4544
      4544	  part_info->table= table;
      [Current thread is 1 (LWP 262827)]
      (gdb) bt
      #0  mysql_unpack_partition (thd=thd@entry=0x782578000c68, part_buf=<optimized out>, part_info_len=<optimized out>, table=table@entry=0x7826c8491648, is_create_table_ind=true, default_db_type=0x57dc30c46ae8, work_part_info_used=0x7826c8490595)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_partition.cc:4544
      #1  0x000057dc2e50f85c in open_table_from_share (thd=thd@entry=0x782578000c68, share=share@entry=0x782578033df0, alias=0x57dc2ece9190 <empty_clex_str>, db_stat=db_stat@entry=1, prgflag=prgflag@entry=1, ha_open_flags=ha_open_flags@entry=0, outparam=0x7826c8491648, is_create_table=<optimized out>, partitions_to_open=0x0)at /test/bb-12.0-nikita-global-tmp_opt/sql/table.cc:4572
      #2  0x000057dc2e4cf72b in open_global_temporary_table (thd=thd@entry=0x782578000c68, source=source@entry=0x782578033df0, out_table=out_table@entry=0x782578017f90, mdl_ticket=mdl_ticket@entry=0x78257802d450)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_table.cc:6162
      #3  0x000057dc2e337243 in open_table (thd=0x782578000c68, table_list=table_list@entry=0x782578017f90, ot_ctx=ot_ctx@entry=0x7826c8491d58)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_base.cc:2330
      #4  0x000057dc2e339f8f in open_and_process_table (thd=0x782578000c68, tables=0x782578017f90, counter=0x7826c8492074, flags=0, prelocking_strategy=0x7826c84920d0, ot_ctx=0x7826c8491d58, has_prelocking_list=<optimized out>)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_base.cc:4285
      #5  open_tables (thd=thd@entry=0x782578000c68, options=@0x7826c8493d64: {m_options = DDL_options_st::OPT_LIKE}, start=0x782578004fb8, counter=counter@entry=0x7826c8492074, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x7826c84920d0)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_base.cc:4771
      #6  0x000057dc2e4df336 in open_tables (thd=0x782578000c68, options=@0x7826c8493d64: {m_options = DDL_options_st::OPT_LIKE}, tables=tables@entry=0x0, counter=0x7826c8492074, flags=0)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_base.h:506
      #7  mysql_create_like_table (thd=thd@entry=0x782578000c68, table=0x782578017818, src_table=src_table@entry=0x782578017f90, create_info=create_info@entry=0x7826c8493b20)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_table.cc:5767
      #8  0x000057dc2e4deccb in Sql_cmd_create_table_like::execute (this=<optimized out>, thd=0x782578000c68)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_table.cc:13828
      #9  0x000057dc2e403fa3 in mysql_execute_command (thd=thd@entry=0x782578000c68, is_called_from_prepared_stmt=false)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_parse.cc:5865
      #10 0x000057dc2e3ff961 in mysql_parse (thd=thd@entry=0x782578000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7826c8494420)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_parse.cc:7893
      #11 0x000057dc2e3fde7f in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x782578000c68, packet=packet@entry=0x782578008a69 "CREATE GLOBAL TEMPORARY TABLE t3 LIKE t2", packet_length=packet_length@entry=40, blocking=true)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_parse.cc:1881
      #12 0x000057dc2e3ffd71 in do_command (thd=thd@entry=0x782578000c68, blocking=true) at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_parse.cc:1420
      #13 0x000057dc2e55549d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x57dc3151b7f8, put_in_cache=true)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_connect.cc:1414
      #14 0x000057dc2e55525f in handle_one_connection (arg=arg@entry=0x57dc3151b7f8)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_connect.cc:1326
      #15 0x000057dc2e712039 in pfs_spawn_thread (arg=0x57dc314cb568)at /test/bb-12.0-nikita-global-tmp_opt/storage/perfschema/pfs.cc:2198
      #16 0x00007826c949ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #17 0x00007826c9529c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Same stack on ES 11.8/CS 12.0 dbg.
      And UBSAN sees a null-pointer-use:

      MDEV-35915 CS 12.0.1 21489191d3683c5655afa170533480c86843ecba (Optimized, UBASAN, Clang) Build 04/08/2025

      /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_partition.cc:4544:14: runtime error: member access within null pointer of type 'partition_info'
          #0 0x57849645bbd5 in mysql_unpack_partition(THD*, char*, unsigned int, TABLE*, bool, handlerton*, bool*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_partition.cc:4544:14
          #1 0x5784969b467a in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/table.cc:4572:10
          #2 0x5784968502ad in open_global_temporary_table(THD*, TABLE_SHARE*, TABLE_LIST*, MDL_ticket*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_table.cc:6162:9
          #3 0x578495f47fc0 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_base.cc:2330:22
          #4 0x578495f54caf in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_base.cc:4285:14
          #5 0x578495f54caf in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_base.cc:4771:14
          #6 0x5784968a7734 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_base.h:506:10
          #7 0x5784968a7734 in mysql_create_like_table(THD*, TABLE_LIST*, TABLE_LIST*, Table_specification_st*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_table.cc:5767:8
          #8 0x5784968a633a in Sql_cmd_create_table_like::execute(THD*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_table.cc:13828:12
          #9 0x5784963f2049 in mysql_execute_command(THD*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:5865:26
          #10 0x5784963d4180 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:7893:18
          #11 0x5784963cb4d6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:1881:7
          #12 0x5784963d6446 in do_command(THD*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:1420:17
          #13 0x578496b2e17c in do_handle_one_connection(CONNECT*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_connect.cc:1414:11
          #14 0x578496b2d9d6 in handle_one_connection /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_connect.cc:1326:5
          #15 0x5784952abc0c in asan_thread_start(void*) crtstuff.c
          #16 0x723ab229ca93 in start_thread nptl/pthread_create.c:447:8
          #17 0x723ab2329c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
      SUMMARY: UndefinedBehaviorSanitizer: null-pointer-use /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_partition.cc:4544:14 
      

      Same SAN issue/stack on ES 11.8/CS 12.0 dbg.

      Affects at least InnoDB + MyISAM.

      Attachments

        Issue Links

          Activity

            People

              nikitamalyavin Nikita Malyavin
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.