Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.11, 11.4, 11.8, 12.3, 13.0, 13.1
-
Can result in hang or crash
Description
CLI compatible test case:-
SET sql_mode=''; |
CREATE ROLE r1; |
DELETE FROM mysql.user WHERE user='r1'; |
GRANT SELECT ON *.* TO r1; |
DROP ROLE r2,r1; |
GRANT r1 TO u1; |
Leads to:
|
CS 13.0.2 b2c4e675049e23ce8c7346985f40840fcd4e583f (Optimized, Clang 22.1.8-20260621) Build 09/09/2026 |
Core was generated by `/test/MD090926-mariadb-13.0.2-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 can_grant_role_callback (grantee=grantee@entry=0x5f764b2bb690, role=<optimized out>, data=data@entry=0x5f764b2bfb30)at /test/13.0_opt/sql/sql_acl.cc:7787
|
 |
[Current thread is 1 (LWP 1803210)]
|
(gdb) bt
|
#0 can_grant_role_callback (grantee=grantee@entry=0x5f764b2bb690, role=<optimized out>, data=data@entry=0x5f764b2bfb30)at /test/13.0_opt/sql/sql_acl.cc:7787
|
#1 0x00005f7633b03fdd in traverse_role_graph_impl (user=0x5f764b2bb690, context=context@entry=0x5f764b2bfb30, offset=offset@entry=40, on_node=on_node@entry=0x0, on_edge=0x5f7633b04920 <can_grant_role_callback(ACL_USER_BASE*, ACL_ROLE*, void*)>) at /test/13.0_opt/sql/sql_acl.cc:6652
|
#2 0x00005f7633af2488 in traverse_role_graph_down (user=0x0, context=0x5f764b2bfb30, on_node=0x0, on_edge=0x7e252d9b2774)at /test/13.0_opt/sql/sql_acl.cc:6729
|
#3 can_grant_role (thd=0x762464000c70, role=0x5f764b2bfb30)at /test/13.0_opt/sql/sql_acl.cc:7813
|
#4 mysql_grant_role (thd=thd@entry=0x762464000c70, list=@0x762464006160: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x762464017c70, last = 0x762464017c60, elements = 2}, <No data fields>}, revoke=false) at /test/13.0_opt/sql/sql_acl.cc:7860
|
#5 0x00005f7633b83c1a in mysql_execute_command (thd=thd@entry=0x762464000c70, is_called_from_prepared_stmt=false) at /test/13.0_opt/sql/sql_parse.cc:5316
|
#6 0x00005f7633b7ea2d in mysql_parse (thd=thd@entry=0x762464000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7e252d9b34f0)at /test/13.0_opt/sql/sql_parse.cc:7943
|
#7 0x00005f7633b7d1ff in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x762464000c70, packet=packet@entry=0x762464008d91 "GRANT r1 TO u1", packet_length=packet_length@entry=14, blocking=true)at /test/13.0_opt/sql/sql_parse.cc:1903
|
#8 0x00005f7633b7eeb0 in do_command (thd=thd@entry=0x762464000c70, blocking=true) at /test/13.0_opt/sql/sql_parse.cc:1437
|
#9 0x00005f7633ca735d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5f764b2546c0, put_in_cache=true)at /test/13.0_opt/sql/sql_connect.cc:1514
|
#10 0x00005f7633ca7192 in handle_one_connection (arg=arg@entry=0x5f764b2546c0)at /test/13.0_opt/sql/sql_connect.cc:1426
|
#11 0x00005f763404a453 in pfs_spawn_thread (arg=0x5f764b274ab0)at /test/13.0_opt/storage/perfschema/pfs.cc:2198
|
#12 0x00007e255d49cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#13 0x00007e255d529ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
CS 13.0.2 b2c4e675049e23ce8c7346985f40840fcd4e583f (Debug, Clang 22.1.8-20260621) Build 09/09/2026 |
Core was generated by `/test/MD090926-mariadb-13.0.2-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x000061948a71a57f in can_grant_role_callback (grantee=0x6194900f85f0, role=0x6194900f8a60, data=0x6194900f8a60)at /test/13.0_dbg/sql/sql_acl.cc:7787
|
 |
[Current thread is 1 (LWP 1803263)]
|
(gdb) bt
|
#0 0x000061948a71a57f in can_grant_role_callback (grantee=0x6194900f85f0, role=0x6194900f8a60, data=0x6194900f8a60)at /test/13.0_dbg/sql/sql_acl.cc:7787
|
#1 0x000061948a718599 in traverse_role_graph_impl (user=0x6194900f85f0, context=0x6194900f8a60, offset=40, on_node=0x0, on_edge=0x61948a71a4e0 <can_grant_role_callback(ACL_USER_BASE*, ACL_ROLE*, void*)>) at /test/13.0_dbg/sql/sql_acl.cc:6652
|
#2 0x000061948a70362c in traverse_role_graph_down (user=0x6194900f85f0, context=0x6194900f8a60, on_node=0x0, on_edge=0x61948a71a4e0 <can_grant_role_callback(ACL_USER_BASE*, ACL_ROLE*, void*)>) at /test/13.0_dbg/sql/sql_acl.cc:6729
|
#3 0x000061948a70310d in can_grant_role (thd=0x72bcd0000d60, role=0x6194900f8a60) at /test/13.0_dbg/sql/sql_acl.cc:7813
|
#4 0x000061948a70259f in mysql_grant_role (thd=0x72bcd0000d60, list=@0x72bcd0006228: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x72bcd001a4d0, last = 0x72bcd001a4c0, elements = 2}, <No data fields>}, revoke=false) at /test/13.0_dbg/sql/sql_acl.cc:7860
|
#5 0x000061948a7fa929 in mysql_execute_command (thd=0x72bcd0000d60, is_called_from_prepared_stmt=false) at /test/13.0_dbg/sql/sql_parse.cc:5316
|
#6 0x000061948a7edd18 in mysql_parse (thd=0x72bcd0000d60, rawbuf=0x72bcd001a3c0 "GRANT r1 TO u1", length=14, parser_state=0x7abde40e39f0) at /test/13.0_dbg/sql/sql_parse.cc:7943
|
#7 0x000061948a7eb46e in dispatch_command (command=COM_QUERY, thd=0x72bcd0000d60, packet=0x72bcd000b5f1 "GRANT r1 TO u1", packet_length=14, blocking=true) at /test/13.0_dbg/sql/sql_parse.cc:1903
|
#8 0x000061948a7ee79a in do_command (thd=0x72bcd0000d60, blocking=true)at /test/13.0_dbg/sql/sql_parse.cc:1437
|
#9 0x000061948a9c075e in do_handle_one_connection (connect=0x61949014f890, put_in_cache=true) at /test/13.0_dbg/sql/sql_connect.cc:1514
|
#10 0x000061948a9c0541 in handle_one_connection (arg=0x61949012e1f0)at /test/13.0_dbg/sql/sql_connect.cc:1426
|
#11 0x00007abde889cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#12 0x00007abde8929ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.11 dbg 090926 2753b5919a10abd32ba822877c6a1cbf602d3748 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
CS 10.11 opt 090926 2753b5919a10abd32ba822877c6a1cbf602d3748 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
CS 11.4 dbg 090926 42038e1145dd43b3910055c364fb720a8a152d61 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
CS 11.4 opt 090926 42038e1145dd43b3910055c364fb720a8a152d61 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
CS 11.8 dbg 090926 e2e060ce3d8c3ce11b6c7ba28ced0f1a30c50a54 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
CS 11.8 opt 090926 e2e060ce3d8c3ce11b6c7ba28ced0f1a30c50a54 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
CS 12.3 dbg 090926 e9f84a1fdf7093191e55b55dc14b08b9d4ebaa20 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
CS 12.3 opt 090926 e9f84a1fdf7093191e55b55dc14b08b9d4ebaa20 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
CS 13.0 dbg 090926 b2c4e675049e23ce8c7346985f40840fcd4e583f SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
CS 13.0 opt 090926 b2c4e675049e23ce8c7346985f40840fcd4e583f SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
CS 13.1 dbg 090926 02c842c30dcb05a962eaac58c69920e6be3369cf SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
CS 13.1 opt 090926 02c842c30dcb05a962eaac58c69920e6be3369cf SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
ES 10.6 dbg 090926 aa3fb9800c358182ee2a1f8cca8ffbdd6d0a37eb SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
ES 10.6 opt 090926 aa3fb9800c358182ee2a1f8cca8ffbdd6d0a37eb SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
ES 11.4 dbg 090926 32807340954440071ca8ae8e2de51fb180d134c6 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
ES 11.4 opt 090926 32807340954440071ca8ae8e2de51fb180d134c6 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
ES 11.8 dbg 090926 c4af6f687a2dd983072457429aa2294f11957650 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
ES 11.8 opt 090926 c4af6f687a2dd983072457429aa2294f11957650 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
ES 12.3 dbg 090926 c3bd5108d81f19e33efb93f7b6ae971293732fd0 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
ES 12.3 opt 090926 c3bd5108d81f19e33efb93f7b6ae971293732fd0 SIGSEGV|can_grant_role_callback|traverse_role_graph_impl|traverse_role_graph_down|can_grant_role
|
