[MDEV-17964] Assertion `status == 0' failed in add_role_user_mapping_action upon CREATE USER and DROP ROLE Created: 2018-12-10  Updated: 2021-11-16  Resolved: 2021-11-16

Status: Closed
Project: MariaDB Server
Component/s: Authentication and Privilege System
Affects Version/s: 10.0, 10.1, 10.2, 10.3, 10.4, 10.5, 10.6
Fix Version/s: 10.2.41, 10.3.32, 10.4.22, 10.5.13, 10.6.5, 10.7.1

Type: Bug Priority: Critical
Reporter: Elena Stepanova Assignee: Vicențiu Ciorbaru
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-5525 Assertion `status == 0' fails on crea... Closed
relates to MDEV-8174 Assertion `status == 0' failed in add... Closed
relates to MDEV-8614 Assertion `status == 0' failed in add... Closed

 Description   

Upd: Here is a new test case, which appears to be deterministic, although still fairly fragile. I keep the initial concurrent one as well in the "Initial report" section, it needs to be re-checked after a fix.

CREATE USER u@localhost;
 
--let $n= 1
while ($n < 129)
{
  eval CREATE ROLE r$n;
  inc $n;
}
 
CREATE ROLE n;
CREATE ROLE d WITH ADMIN n;
CREATE ROLE '%' WITH ADMIN u@localhost;
DROP ROLE n;
CREATE USER '%';

10.3 f4484dfd

mysqld: /data/src/10.3/sql/sql_acl.cc:3103: my_bool add_role_user_mapping_action(void*, void*): Assertion `status == 0' failed.
190323 22:18:23 [ERROR] mysqld got signal 6 ;
 
#7  0x00007f26f7e8eee2 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
#8  0x00005626a662c87f in add_role_user_mapping_action (ptr=0x7f26e0041038, unused=0x0) at /data/src/10.3/sql/sql_acl.cc:3103
#9  0x00005626a7162ef3 in my_hash_iterate (hash=0x5626a7e4d080 <acl_roles_mappings>, action=0x5626a662c812 <add_role_user_mapping_action(void*, void*)>, argument=0x0) at /data/src/10.3/mysys/hash.c:796
#10 0x00005626a662c923 in rebuild_role_grants () at /data/src/10.3/sql/sql_acl.cc:3128
#11 0x00005626a662b89f in acl_insert_user (user=0x7f26e0014d80 "%", host=0x5626a723d6e3 "%", password=0x5626a725256f "", password_len=0, ssl_type=SSL_TYPE_NOT_SPECIFIED, ssl_cipher=0x0, x509_issuer=0x0, x509_subject=0x0, mqh=0x7f26e0005cb8, privileges=0, plugin=0x7f26e0014da8, auth=0x7f26e0014db8) at /data/src/10.3/sql/sql_acl.cc:2759
#12 0x00005626a6630824 in replace_user_table (thd=0x7f26e0000b00, user_table=..., combo=..., rights=0, revoke_grant=false, can_create_user=true, no_auto_create=false) at /data/src/10.3/sql/sql_acl.cc:4196
#13 0x00005626a6643adc in mysql_create_user (thd=0x7f26e0000b00, list=..., handle_as_role=false) at /data/src/10.3/sql/sql_acl.cc:10241
#14 0x00005626a66ed3a6 in mysql_execute_command (thd=0x7f26e0000b00) at /data/src/10.3/sql/sql_parse.cc:5389
#15 0x00005626a66f57ac in mysql_parse (thd=0x7f26e0000b00, rawbuf=0x7f26e0014ce8 "CREATE USER '%'", length=15, parser_state=0x7f26f20355f0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:8091
#16 0x00005626a66e2a60 in dispatch_command (command=COM_QUERY, thd=0x7f26e0000b00, packet=0x7f26e000b1f1 "CREATE USER '%'", packet_length=15, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1857
#17 0x00005626a66e144a in do_command (thd=0x7f26e0000b00) at /data/src/10.3/sql/sql_parse.cc:1403
#18 0x00005626a6849f41 in do_handle_one_connection (connect=0x5626aa509470) at /data/src/10.3/sql/sql_connect.cc:1402
#19 0x00005626a6849cc5 in handle_one_connection (arg=0x5626aa509470) at /data/src/10.3/sql/sql_connect.cc:1308
#20 0x00005626a6ce67e5 in pfs_spawn_thread (arg=0x5626aa44e1d0) at /data/src/10.3/storage/perfschema/pfs.cc:1862
#21 0x00007f26f9d7d494 in start_thread (arg=0x7f26f2036700) at pthread_create.c:333
#22 0x00007f26f7f4b93f in clone () from /lib/x86_64-linux-gnu/libc.so.6


Initial report:

The test is highly non-deterministic and fragile. Run with big enough --repeat=N. It usually failed for me within 50 attempts, but it can vary on different machines/builds.

CREATE USER rqa@localhost;
GRANT CREATE USER, SUPER ON *.* TO rqa@localhost;
 
--connect (con1,localhost,rqa,,test)
 
CREATE ROLE o1, m1, a1, c1, g1, j1, t1, x1, c2, q1, u1, pirzd, y1, l1, n1, f1, p1, c3, v1, w1, d1, q2, h1, f2, w2, h2, n2, u2, u3, m2, t2, w3, b1, x2, f3, h3, t3, y2, m3, r1, b2, e1, y3, t4, d2, b3, v2, x3, p2, u4, s1, y4, d3, m4, n3, h4, a2, d4, l2, k1, w4, s2, e2, g2, b4, y5, t5, f4, s3, l, e, i, j2, q3, v3, o2, k2;
CREATE ROLE '%' WITH ADMIN l;
CREATE ROLE r, g3;
DROP ROLE e, r;
 
SET ROLE i;
 
--connection default
--send
  CREATE USER c@localhost;
 
--connection con1
DROP ROLE l;
 
# Cleanup
--disconnect con1
--connection default
--reap
 
DROP ROLE o1, m1, a1, c1, g1, j1, t1, x1, c2, q1, u1, pirzd, y1, l1, n1, f1, p1, c3, v1, w1, d1, q2, h1, f2, w2, h2, n2, u2, u3, m2, t2, w3, b1, x2, f3, h3, t3, y2, m3, r1, b2, e1, y3, t4, d2, b3, v2, x3, p2, u4, s1, y4, d3, m4, n3, h4, a2, d4, l2, k1, w4, s2, e2, g2, b4, y5, t5, f4, s3, l, i, j2, q3, v3, o2, k2, g3, '%';
 
DROP USER rqa@localhost, c@localhost;

10.0 4886d1482

mysqld: /data/src/10.0/sql/sql_acl.cc:2473: my_bool add_role_user_mapping_action(void*, void*): Assertion `status == 0' failed.
181210 17:59:47 [ERROR] mysqld got signal 6 ;
 
#7  0x00007f1b7d29aee2 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
#8  0x00000000005c84f2 in add_role_user_mapping_action (ptr=0x7f1b755122c8, unused=0x0) at /data/src/10.0/sql/sql_acl.cc:2473
#9  0x0000000000e065ee in my_hash_iterate (hash=0x17e7280 <acl_roles_mappings>, action=0x5c8490 <add_role_user_mapping_action(void*, void*)>, argument=0x0) at /data/src/10.0/mysys/hash.c:770
#10 0x00000000005c8598 in rebuild_role_grants () at /data/src/10.0/sql/sql_acl.cc:2498
#11 0x00000000005c7735 in acl_insert_user (user=0x7f1b759a4128 "c", host=0x7f1b759a4130 "localhost", password=0xed7cb0 "", password_len=0, ssl_type=SSL_TYPE_NOT_SPECIFIED, ssl_cipher=0x0, x509_issuer=0x0, x509_subject=0x0, mqh=0x7f1b787e9b00, privileges=0, plugin=0x7f1b759a4170, auth=0x7f1b759a4180) at /data/src/10.0/sql/sql_acl.cc:2130
#12 0x00000000005cb55b in replace_user_table (thd=0x7f1b787e5070, table=0x7f1b754b0c70, combo=..., rights=0, revoke_grant=false, can_create_user=true, no_auto_create=false) at /data/src/10.0/sql/sql_acl.cc:3331
#13 0x00000000005dc4c9 in mysql_create_user (thd=0x7f1b787e5070, list=..., handle_as_role=false) at /data/src/10.0/sql/sql_acl.cc:9322
#14 0x000000000065220b in mysql_execute_command (thd=0x7f1b787e5070) at /data/src/10.0/sql/sql_parse.cc:4091
#15 0x00000000006589d0 in mysql_parse (thd=0x7f1b787e5070, rawbuf=0x7f1b759a4088 "CREATE USER c@localhost", length=23, parser_state=0x7f1b7f14f640) at /data/src/10.0/sql/sql_parse.cc:6637
#16 0x000000000064b2f0 in dispatch_command (command=COM_QUERY, thd=0x7f1b787e5070, packet=0x7f1b772b6071 "CREATE USER c@localhost", packet_length=23) at /data/src/10.0/sql/sql_parse.cc:1300
#17 0x000000000064a5f0 in do_command (thd=0x7f1b787e5070) at /data/src/10.0/sql/sql_parse.cc:1003
#18 0x000000000076bf08 in do_handle_one_connection (thd_arg=0x7f1b787e5070) at /data/src/10.0/sql/sql_connect.cc:1377
#19 0x000000000076bc7a in handle_one_connection (arg=0x7f1b787e5070) at /data/src/10.0/sql/sql_connect.cc:1292
#20 0x0000000000acdb54 in pfs_spawn_thread (arg=0x7f1b772ad570) at /data/src/10.0/storage/perfschema/pfs.cc:1861
#21 0x00007f1b7ed83494 in start_thread (arg=0x7f1b7f150700) at pthread_create.c:333
#22 0x00007f1b7d35793f in clone () from /lib/x86_64-linux-gnu/libc.so.6

No visible effect on a non-debug build.



 Comments   
Comment by Vicențiu Ciorbaru [ 2021-10-13 ]

Hi Sergei!

Can you please review the changes here: https://github.com/MariaDB/server/pull/1930

It basically adds a restart flag when anything involving grant hash tables changes, as we discussed.

You can quickly see the diff by doing:
git show cd4cac2b95afe21a75b1846d03c9549a17784486 --ignore-white-space

Comment by Eric Herman [ 2021-10-15 ]

I believe you meant to write "ignore-all-space" (not "ignore-white-space")

git show --help | grep -A2 'w, --ignore-all-space'
       -w, --ignore-all-space
           Ignore whitespace when comparing lines. This ignores differences
           even if one line has whitespace where the other line has none.

Generated at Thu Feb 08 08:40:28 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.