Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-39883

SIGSEGV (NULL pointer dereference) in ib_tpool_worker under heavy DELETE/write load on 12.3.2

    XMLWordPrintable

Details

    • Bug
    • Status: Needs Feedback (View Workflow)
    • Major
    • Resolution: Unresolved
    • 12.3.2
    • None
    • None
    • Ubuntu 24.04.4 LTS, kernel 6.8.0-100-generic, x86_64 (DigitalOcean droplet, NVMe). MariaDB 12.3.2-ubu2404-log. InnoDB with io_uring active, innodb_buffer_pool_size=48G, thread_handling=pool-of-threads.

    Description

      mariadbd crashed spontaneously with signal 11 in an InnoDB background thread (ib_tpool_worker) during sustained heavy write/DELETE load (bulk import pipeline: hundreds of concurrent connections doing INSERT/UPDATE/DELETE on a 620GB schema; the coredump shows other threads in Sql_cmd_delete::delete_from_single_table). No client query was involved in the crashing thread (Query: null, connection 0).
      The crash tore a page in a 114M-row table. Subsequent crash recovery could not repair it and refused to start, leaving the server in a systemd restart loop until started with innodb_force_recovery=1:

      2026-06-06 14:04:33 0 [ERROR] InnoDB: Unable to apply log to corrupted page 14734719 in file ./bigshopper_nl_be/product_entries.ibd
      2026-06-06 14:04:33 0 [ERROR] InnoDB: Plugin initialization aborted with error Data structure corruption
      2026-06-06 14:04:33 0 [ERROR] Plugin 'InnoDB' registration as a STORAGE ENGINE failed.
      

      Crash stack (error log)

      260606 14:03:21 [ERROR] /usr/sbin/mariadbd got signal 11 ;
      Server version: 12.3.2-MariaDB-ubu2404-log source revision: 9f98f82b14a9b939834281672b6d0cf965db69a3
      Thread pointer: 0x6221da25e8e0
      /usr/sbin/mariadbd(my_print_stacktrace+0x30)[0x62219c98b6d0]
      /usr/sbin/mariadbd(handle_fatal_signal+0x1d7)[0x62219c53c017]
      /lib/x86_64-linux-gnu/libc.so.6(+0x45330)[0x77a408c45330]
      /usr/sbin/mariadbd(+0xf7abbf)[0x62219c8c0bbf]
      /usr/sbin/mariadbd(+0xf7c128)[0x62219c8c2128]
      /usr/sbin/mariadbd(+0xf2d8b9)[0x62219c8738b9]
      /usr/sbin/mariadbd(+0xf2e498)[0x62219c874498]
      /usr/sbin/mariadbd(+0xf04553)[0x62219c84a553]
      /usr/sbin/mariadbd(+0xf4ac35)[0x62219c890c35]
      /usr/sbin/mariadbd(+0xf4ae81)[0x62219c890e81]
      /usr/sbin/mariadbd(_ZN5tpool10task_group7executeEPNS_4taskE+0x6c)[0x62219c934eac]
      /usr/sbin/mariadbd(_ZN5tpool19thread_pool_generic11worker_mainEPNS_11worker_dataE+0x7c)[0x62219c93507c]
      Connection ID (thread ID): 0
      Query (0x0): (null)
      

      Kernel log: ib_tpool_worker[2166270]: segfault at 10 ip 000062219c8c0bbf sp 00006fa388b27340 error 4 in mariadbd (read of address 0x10 = NULL pointer + struct offset).
      Not reproduced on demand; the same workload runs nightly and crashed once, 4 days after upgrading to 12.3.2 (on 2026-06-02). A 404MB systemd coredump of the crash is available and can be shared on request.

      Attachments

        Activity

          People

            shipjain Shipra Jain
            rmdefries Michiel de Vries
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.