Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41426

SIGSEGV in THD::cleanup_after_query on CALL after failed BINLOG

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      MTR Test case

      CREATE TABLE t1 (c1 INT);
      CREATE TEMPORARY TABLE t1 (c1 INT);
      CREATE PROCEDURE sp1() SELECT c1 FROM t1;
      --error ER_SYNTAX_ERROR
      BINLOG '';
      SET max_statement_time=0.0001;
      --disable_query_log
      --disable_result_log
      let $i=300;
      while ($i) {
        SET server_id=36;
        --error 0,ER_BAD_FIELD_ERROR,ER_STATEMENT_TIMEOUT
        CALL sp1;
        SET server_id=DEFAULT;
        --error 0,ER_BAD_FIELD_ERROR,ER_STATEMENT_TIMEOUT
        CALL sp1;
        dec $i;
      }
      

      Leads to

      CS 13.2.0 9d7ab2c0092df4bc73b64b915464aecf7e5fe6c4 (Debug, Clang 18.1.3-11) Build 06/10/2026

      Core was generated by `/test/MD061026-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd --defaults-group-su'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x00005e685c1f340f in THD::cleanup_after_query (this=0x7d7e08000d60)at /test/13.2_dbg/sql/sql_class.cc:2615
       
      [Current thread is 1 (LWP 3770610)]
      (gdb) bt
      #0  0x00005e685c1f340f in THD::cleanup_after_query (this=0x7d7e08000d60)at /test/13.2_dbg/sql/sql_class.cc:2615
      #1  0x00005e685c15ffc4 in sp_head::execute (this=0x7d7e081dbd10, thd=0x7d7e08000d60, merge_da_on_success=true)at /test/13.2_dbg/sql/sp_head.cc:1439
      #2  0x00005e685c16258e in sp_head::execute_procedure (this=0x7d7e081dbd10, thd=0x7d7e08000d60, args=0x7d7e080062e8)at /test/13.2_dbg/sql/sp_head.cc:2421
      #3  0x00005e685c298dfb in do_execute_sp (thd=0x7d7e08000d60, sp=0x7d7e081dbd10)at /test/13.2_dbg/sql/sql_parse.cc:3099
      #4  0x00005e685c29887d in Sql_cmd_call::execute (this=0x7d7e08017300, thd=0x7d7e08000d60) at /test/13.2_dbg/sql/sql_parse.cc:3366
      #5  0x00005e685c2a4d07 in mysql_execute_command (thd=0x7d7e08000d60, is_called_from_prepared_stmt=false) at /test/13.2_dbg/sql/sql_parse.cc:5947
      #6  0x00005e685c293db4 in mysql_parse (thd=0x7d7e08000d60, rawbuf=0x7d7e08017060 "CALL sp1", length=8, parser_state=0x7d7e39a5aa80)at /test/13.2_dbg/sql/sql_parse.cc:8005
      #7  0x00005e685c29117d in dispatch_command (command=COM_QUERY, thd=0x7d7e08000d60, packet=0x7d7e081d3ae1 "CALL sp1", packet_length=8, blocking=true) at /test/13.2_dbg/sql/sql_parse.cc:1903
      #8  0x00005e685c294963 in do_command (thd=0x7d7e08000d60, blocking=true)at /test/13.2_dbg/sql/sql_parse.cc:1437
      #9  0x00005e685c49acd9 in do_handle_one_connection (connect=0x5e68786b8f30, put_in_cache=true) at /test/13.2_dbg/sql/sql_connect.cc:1514
      #10 0x00005e685c49aa7e in handle_one_connection (arg=0x5e6878642a40)at /test/13.2_dbg/sql/sql_connect.cc:1426
      #11 0x00007d7e3b09cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #12 0x00007d7e3b129ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Attachments

        Activity

          People

            shulga Dmitry Shulga
            ramesh Ramesh Sivaraman
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 0.5h
                0.5h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.