Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40371

SIGSEGV in __strlen_evex | PlugDup | RELDEF::GetStringCatInfo | TABDEF::Define

    XMLWordPrintable

Details

    Description

      --source include/have_partition.inc
      --source include/have_innodb.inc
       
      INSTALL SONAME 'ha_connect';
      CREATE OR REPLACE TABLE t1 (c1 INT PRIMARY KEY, c2 INT) ENGINE=INNODB PARTITION BY KEY() PARTITIONS 1;
      CREATE OR REPLACE TABLE t3 ENGINE=CONNECT TABLE_TYPE=PROXY TABNAME='t1';
      SELECT COUNT(*) FROM information_schema.key_column_usage WHERE REFERENCED_TABLE_NAME in ('t1') ;
      

      Leads to:

      CS 10.11.19 0617cf2ab5fc37f49b25c22524c909f26069bd44 (Debug, Clang 18.1.3-11) Build 10/07/2026

      Core was generated by `/test/MD100726-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd --no-defaults --l'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  __strlen_evex () at ../sysdeps/x86_64/multiarch/strlen-evex-base.S:81
       
      [Current thread is 1 (LWP 2616516)]
      (gdb) bt
      #0  __strlen_evex () at ../sysdeps/x86_64/multiarch/strlen-evex-base.S:81
      #1  0x000079f26090609c in PlugDup (g=0x71db38056f50, str=0x8f8f8f8f8f8f8f8f <error: Cannot access memory at address 0x8f8f8f8f8f8f8f8f>) at /test/10.11_dbg/storage/connect/plugutil.cpp:609
      #2  0x000079f260906b0a in RELDEF::GetStringCatInfo (this=0x71db2ffff3b0, g=0x71db38056f50, what=0x79f2609dbf75 "Catfunc", sdef=0x0)at /test/10.11_dbg/storage/connect/reldef.cpp:272
      #3  0x000079f260906e75 in TABDEF::Define (this=0x71db2ffff3b0, g=0x71db38056f50, cat=0x71db3803a140, name=0x71db2ffff3a0 "t1", schema=0x71db2ffff3a8 "test", am=0x79f2609de60e "MYPRX")at /test/10.11_dbg/storage/connect/reldef.cpp:361
      #4  0x000079f2608c2839 in MYCAT::MakeTableDesc (this=0x71db3803a140, g=0x71db38056f50, tablep=0x71db2ffff108, am=0x79f2609de60e "MYPRX")at /test/10.11_dbg/storage/connect/mycat.cc:527
      #5  0x000079f2608c1dfd in MYCAT::GetTableDesc (this=0x71db3803a140, g=0x71db38056f50, tablep=0x71db2ffff108, type=0x79f2609de60e "MYPRX")at /test/10.11_dbg/storage/connect/mycat.cc:431
      #6  0x000079f2608c2900 in MYCAT::GetTable (this=0x71db3803a140, g=0x71db38056f50, tablep=0x71db2ffff108, mode=MODE_ANY, type=0x79f2609de60e "MYPRX")at /test/10.11_dbg/storage/connect/mycat.cc:549
      #7  0x000079f26093e761 in TDBPRX::GetSubTable (this=0x71db2ffff2e0, g=0x71db38056f50, tabp=0x71db2ffff108, b=false)at /test/10.11_dbg/storage/connect/tabutil.cpp:440
      #8  0x000079f26093ea90 in TDBPRX::InitTable (this=0x71db2ffff2e0, g=0x71db38056f50) at /test/10.11_dbg/storage/connect/tabutil.cpp:490
      #9  0x000079f26093eba3 in TDBPRX::Cardinality (this=0x71db2ffff2e0, g=0x71db38056f50) at /test/10.11_dbg/storage/connect/tabutil.cpp:513
      #10 0x000079f2608be36c in CntInfo (g=0x71db38056f50, tp=0x71db2ffff2e0, info=0x71db380544d8) at /test/10.11_dbg/storage/connect/connect.cc:172
      #11 0x000079f2608ad53c in ha_connect::info (this=0x71db38053bf8, flag=22)at /test/10.11_dbg/storage/connect/ha_connect.cc:4405
      #12 0x0000604be176f89a in get_schema_key_column_usage_record (thd=0x71db38000d58, tables=0x71db3804b410, table=0x71db380433d0, res=false, db_name=0x71db38019438, table_name=0x71db38019450)at /test/10.11_dbg/sql/sql_show.cc:7597
      #13 0x0000604be1762cb6 in fill_schema_table_by_open (thd=0x71db38000d58, mem_root=0x79f260c21ee0, is_show_fields_or_keys=false, table=0x71db380433d0, schema_table=0x604be2fb93a0 <schema_tables+1280>, orig_db_name=0x71db38019438, orig_table_name=0x71db38019450, open_tables_state_backup=0x79f260c21f48, can_deadlock=false)at /test/10.11_dbg/sql/sql_show.cc:4841
      #14 0x0000604be1762552 in get_all_tables (thd=0x71db38000d58, tables=0x71db38013c98, cond=0x71db38014578)at /test/10.11_dbg/sql/sql_show.cc:5476
      #15 0x0000604be176d63a in get_schema_tables_result (join=0x71db38015710, executed_place=PROCESSED_BY_JOIN_EXEC)at /test/10.11_dbg/sql/sql_show.cc:9314
      #16 0x0000604be170d751 in JOIN::exec_inner (this=0x71db38015710)at /test/10.11_dbg/sql/sql_select.cc:4980
      #17 0x0000604be170cc50 in JOIN::exec (this=0x71db38015710)at /test/10.11_dbg/sql/sql_select.cc:4807
      #18 0x0000604be16e8b96 in mysql_select (thd=0x71db38000d58, tables=0x71db38013c98, fields=@0x71db38013850: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x71db38013bf8, last = 0x71db38013bf8, elements = 1}, <No data fields>}, conds=0x71db38014578, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2701396736, result=0x71db380156e8, unit=0x71db38005028, select_lex=0x71db38013598)at /test/10.11_dbg/sql/sql_select.cc:5285
      #19 0x0000604be16e8625 in handle_select (thd=0x71db38000d58, lex=0x71db38004f50, result=0x71db380156e8, setup_tables_done_option=0)at /test/10.11_dbg/sql/sql_select.cc:601
      #20 0x0000604be168f861 in execute_sqlcom_select (thd=0x71db38000d58, all_tables=0x71db38013c98) at /test/10.11_dbg/sql/sql_parse.cc:6461
      #21 0x0000604be168335a in mysql_execute_command (thd=0x71db38000d58, is_called_from_prepared_stmt=false)at /test/10.11_dbg/sql/sql_parse.cc:4040
      #22 0x0000604be167b414 in mysql_parse (thd=0x71db38000d58, rawbuf=0x71db38013480 "SELECT COUNT(*) FROM information_schema.key_column_usage WHERE REFERENCED_TABLE_NAME in ('t1')", length=94, parser_state=0x79f260c24a20) at /test/10.11_dbg/sql/sql_parse.cc:8219
      #23 0x0000604be1678869 in dispatch_command (command=COM_QUERY, thd=0x71db38000d58, packet=0x71db3800af09 "SELECT COUNT(*) FROM information_schema.key_column_usage WHERE REFERENCED_TABLE_NAME in ('t1')", packet_length=94, blocking=true)at /test/10.11_dbg/sql/sql_parse.cc:1924
      #24 0x0000604be167bfc3 in do_command (thd=0x71db38000d58, blocking=true)at /test/10.11_dbg/sql/sql_parse.cc:1434
      #25 0x0000604be185a9e9 in do_handle_one_connection (connect=0x604bf816c3c8, put_in_cache=true) at /test/10.11_dbg/sql/sql_connect.cc:1482
      #26 0x0000604be185a782 in handle_one_connection (arg=0x604bf82522a8)at /test/10.11_dbg/sql/sql_connect.cc:1394
      #27 0x000079f63ec9caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #28 0x000079f63ed29c6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed
      CS  10.11  dbg  100726  0617cf2ab5fc37f49b25c22524c909f26069bd44  SIGSEGV|__strlen_evex|PlugDup|RELDEF::GetStringCatInfo|TABDEF::Define
      CS  10.11  opt  100726  0617cf2ab5fc37f49b25c22524c909f26069bd44  No bug found
      CS  11.4   dbg  100726  1fff140f0c25f6a5b2f6fd0b5ef6b6c50d60e913  SIGSEGV|__strlen_evex|PlugDup|RELDEF::GetStringCatInfo|TABDEF::Define
      CS  11.4   opt  100726  1fff140f0c25f6a5b2f6fd0b5ef6b6c50d60e913  No bug found
      CS  11.8   dbg  130726  666b2aca09cb84d59b4ece2185a9200d745cb287  SIGSEGV|__strlen_evex|PlugDup|RELDEF::GetStringCatInfo|TABDEF::Define
      CS  11.8   opt  130726  666b2aca09cb84d59b4ece2185a9200d745cb287  No bug found
      CS  12.3   dbg  130726  27df5668c2e3eef406a5357672d3d8e89d25ff48  SIGSEGV|__strlen_evex|PlugDup|RELDEF::GetStringCatInfo|TABDEF::Define
      CS  12.3   opt  130726  27df5668c2e3eef406a5357672d3d8e89d25ff48  No bug found
      CS  13.0   dbg  130726  84c246ca5387c0611f75097136ff4f4bea092aa3  SIGSEGV|__strlen_evex|PlugDup|RELDEF::GetStringCatInfo|TABDEF::Define
      CS  13.0   opt  130726  84c246ca5387c0611f75097136ff4f4bea092aa3  No bug found
      CS  13.1   dbg  130726  0350ad8cb0540e0f57f930b1f6e5dc225bff41bb  SIGSEGV|__strlen_evex|PlugDup|RELDEF::GetStringCatInfo|TABDEF::Define
      CS  13.1   opt  130726  0350ad8cb0540e0f57f930b1f6e5dc225bff41bb  No bug found
      ES  10.6   dbg  040825  9b794f34b48fb7eee490b6da44edc0f33a947447  SIGSEGV|__strlen_evex|PlugDup|RELDEF::GetStringCatInfo|TABDEF::Define
      ES  10.6   opt  040825  9b794f34b48fb7eee490b6da44edc0f33a947447  No bug found
      ES  11.4   dbg  040825  a1c03ccd54b582e75506687ee19b273ca897f261  SIGSEGV|__strlen_evex|PlugDup|RELDEF::GetStringCatInfo|TABDEF::Define
      ES  11.4   opt  040825  a1c03ccd54b582e75506687ee19b273ca897f261  No bug found
      ES  11.8   dbg  151025  780565c207e9ce0ebf7d8e3d59f223801447b619  SIGSEGV|__strlen_evex|PlugDup|RELDEF::GetStringCatInfo|TABDEF::Define
      ES  11.8   opt  151025  780565c207e9ce0ebf7d8e3d59f223801447b619  No bug found
      

       opt: ASAN|use-after-poison|storage/connect/ha_connect.cc|GetStringTableOption|ha_connect::GetStringOption|RELDEF::GetStringCatInfo|TABDEF::Define
       dbg: ASAN|use-after-poison|storage/connect/ha_connect.cc|GetStringTableOption|ha_connect::GetStringOption|RELDEF::GetStringCatInfo|TABDEF::Define
      

      Attachments

        Activity

          People

            sanja Oleksandr Byelkin
            ramesh Ramesh Sivaraman
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 0.5h
                0.5h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.