[MDEV-18460] Server crashed in strmake / tdc_create_key / THD::create_tmp_table_def_key Created: 2019-02-03  Updated: 2020-08-25  Resolved: 2019-12-10

Status: Closed
Project: MariaDB Server
Component/s: Data Definition - Temporary, Optimizer - CTE
Affects Version/s: 10.2, 10.3, 10.4
Fix Version/s: 10.2.31, 10.3.22, 10.4.12

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Oleksandr Byelkin
Resolution: Fixed Votes: 0
Labels: None


 Description   

10.2 97930df

190129 14:14:42 [ERROR] mysqld got signal 11 ;
 
#3  <signal handler called>
#4  0x0000559bb2a6efd1 in strmake (dst=0x7f9e243983b1 "\203\071$\236\177", src=0x1 <error: Cannot access memory at address 0x1>, length=191) at /home/travis/src/strings/strmake.c:36
#5  0x0000559bb1fd2a6f in tdc_create_key (key=0x7f9e243983b0 "Ѓ9$\236\177", db=0x0, table_name=0x7f9dd8015080 "cte1") at /home/travis/src/sql/table_cache.h:122
#6  0x0000559bb222abbd in THD::create_tmp_table_def_key (this=0x7f9dd8000cd0, key=0x7f9e243983b0 "Ѓ9$\236\177", db=0x0, table_name=0x7f9dd8015080 "cte1") at /home/travis/src/sql/temporary_tables.cc:885
#7  0x0000559bb222b587 in THD::find_and_use_tmp_table (this=0x7f9dd8000cd0, tl=0x7f9dd80150b8, out_table=0x7f9e24398580) at /home/travis/src/sql/temporary_tables.cc:1141
#8  0x0000559bb2229c7d in THD::open_temporary_table (this=0x7f9dd8000cd0, tl=0x7f9dd80150b8) at /home/travis/src/sql/temporary_tables.cc:361
#9  0x0000559bb2229f16 in THD::open_temporary_tables (this=0x7f9dd8000cd0, tl=0x7f9dd80150b8) at /home/travis/src/sql/temporary_tables.cc:439
#10 0x0000559bb2031f4c in mysql_execute_command (thd=0x7f9dd8000cd0) at /home/travis/src/sql/sql_parse.cc:3397
#11 0x0000559bb2040589 in mysql_parse (thd=0x7f9dd8000cd0, rawbuf=0x7f9dd80134a8 "/* GenTest::Transform::ExecuteAsCTE */  /* testdb_N */ WITH cte1 AS ( SELECT * FROM information_schema.schemata WHERE schema_name = TRIM( ' testdb_N ') /* QNO 3064 CON_ID 18 */ ) SELECT * FROM cte1  /"..., length=263, parser_state=0x7f9e24399250, is_com_multi=false, is_next_command=false) at /home/travis/src/sql/sql_parse.cc:8015
#12 0x0000559bb202dbda in dispatch_command (command=COM_QUERY, thd=0x7f9dd8000cd0, packet=0x7f9dd8008a71 "/* GenTest::Transform::ExecuteAsCTE */  /* testdb_N */ WITH cte1 AS ( SELECT * FROM information_schema.schemata WHERE schema_name = TRIM( ' testdb_N ') /* QNO 3064 CON_ID 18 */ ) SELECT * FROM cte1  /"..., packet_length=264, is_com_multi=false, is_next_command=false) at /home/travis/src/sql/sql_parse.cc:1826
#13 0x0000559bb202c52a in do_command (thd=0x7f9dd8000cd0) at /home/travis/src/sql/sql_parse.cc:1379
#14 0x0000559bb217f006 in do_handle_one_connection (connect=0x559bb54db290) at /home/travis/src/sql/sql_connect.cc:1335
#15 0x0000559bb217ed86 in handle_one_connection (arg=0x559bb54db290) at /home/travis/src/sql/sql_connect.cc:1241
#16 0x00007f9e278e36ba in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#17 0x00007f9e26d7841d in clone () from /lib/x86_64-linux-gnu/libc.so.6

See comments for the test case.



 Comments   
Comment by Matthias Schröder [ 2019-11-08 ]

I encountered a similar problem when using CTEs after creating a temporary table. I can reproduce the crash on mariadb 10.3.17, 10.3.18 and 10.3.19 with these two statements

CREATE TEMPORARY TABLE test.sometemp(somefiled integer);
 
WITH usable AS (SELECT 1) SELECT * FROM usable;

Comment by Elena Stepanova [ 2019-11-08 ]

matzehh, Thanks a lot!
It turns out, one needs not to have a default database in the session in order to get this failure.
While using a command line client, it is indeed enough to connect without a default database and run two statements above. In MTR terms, it can be this:

--change_user root,,
 
CREATE TEMPORARY TABLE test.t (a INT);
WITH cte AS (SELECT 1) SELECT * FROM t;

10.2 90451a59

#3  <signal handler called>
#4  0x0000562ec1fe43b3 in strmake (dst=0x7f5128a6b3a1 "\263\246(Q\177", src=0x1 <error: Cannot access memory at address 0x1>, length=191) at /data/src/10.2/strings/strmake.c:36
#5  0x0000562ec154a571 in tdc_create_key (key=0x7f5128a6b3a0 "\300\263\246(Q\177", db=0x0, table_name=0x7f5118013378 "t") at /data/src/10.2/sql/table_cache.h:122
#6  0x0000562ec17a6431 in THD::create_tmp_table_def_key (this=0x7f5118000af0, key=0x7f5128a6b3a0 "\300\263\246(Q\177", db=0x0, table_name=0x7f5118013378 "t") at /data/src/10.2/sql/temporary_tables.cc:901
#7  0x0000562ec17a6e0d in THD::find_and_use_tmp_table (this=0x7f5118000af0, tl=0x7f51180133b0, out_table=0x7f5128a6b570) at /data/src/10.2/sql/temporary_tables.cc:1157
#8  0x0000562ec17a53ff in THD::open_temporary_table (this=0x7f5118000af0, tl=0x7f51180133b0) at /data/src/10.2/sql/temporary_tables.cc:361
#9  0x0000562ec17a5736 in THD::open_temporary_tables (this=0x7f5118000af0, tl=0x7f51180133b0) at /data/src/10.2/sql/temporary_tables.cc:455
#10 0x0000562ec15a94b0 in mysql_execute_command (thd=0x7f5118000af0) at /data/src/10.2/sql/sql_parse.cc:3433
#11 0x0000562ec15b6e4e in mysql_parse (thd=0x7f5118000af0, rawbuf=0x7f5118012458 "WITH cte AS (SELECT 1) SELECT * FROM t", length=38, parser_state=0x7f5128a6c200, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7740
#12 0x0000562ec15a5169 in dispatch_command (command=COM_QUERY, thd=0x7f5118000af0, packet=0x7f511808de91 "WITH cte AS (SELECT 1) SELECT * FROM t", packet_length=38, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1831
#13 0x0000562ec15a3abd in do_command (thd=0x7f5118000af0) at /data/src/10.2/sql/sql_parse.cc:1384
#14 0x0000562ec16f91e3 in do_handle_one_connection (connect=0x562ec4075b60) at /data/src/10.2/sql/sql_connect.cc:1336
#15 0x0000562ec16f8f4e in handle_one_connection (arg=0x562ec4075b60) at /data/src/10.2/sql/sql_connect.cc:1241
#16 0x0000562ec1f2b952 in pfs_spawn_thread (arg=0x562ec407b970) at /data/src/10.2/storage/perfschema/pfs.cc:1862
#17 0x00007f51302ae4a4 in start_thread (arg=0x7f5128a6d700) at pthread_create.c:456
#18 0x00007f512e7f5d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

All of non-debug, debug and ASAN builds crash the same way.
Reproducible on 10.2-10.5.

Comment by Oleksandr Byelkin [ 2019-12-07 ]

I hope that all understand that correct reaction is an error (we do not create tables without database)

Comment by Oleksandr Byelkin [ 2019-12-07 ]

Sorry, we create full defined tables, but "t" in SELECT is the problem and it will return error because have no table;

Comment by Oleksandr Byelkin [ 2019-12-07 ]

Problem is that with WITH clause we skip check on absence of DB in THD::copy_db_to so have catch it later...

      /*
        No default database is set. In this case if it's guaranteed that
        no CTE can be used in the statement then we can throw an error right
        now at the parser stage. Otherwise the decision about throwing such
        a message must be postponed until a post-parser stage when we are able
        to resolve all CTE names as we don't need this message to be thrown
        for any CTE references.
      */
      if (!lex->with_clauses_list)
      {
        my_message(ER_NO_DB_ERROR, ER(ER_NO_DB_ERROR), MYF(0));
        return TRUE;
      }

Comment by Oleksandr Byelkin [ 2019-12-07 ]

I think correct test case is following (there is a temporary table but the query do not use it, and have to be resolved without any external table):

--change_user root,,
 
CREATE TEMPORARY TABLE test.t123 (a INT);
WITH t AS (SELECT 1) SELECT * FROM t;

(without the temporary table it work as it should because do not try to find a table without db among temporary tables)

Comment by Oleksandr Byelkin [ 2019-12-07 ]

commit 62a4972c4d29a8703c45f1ea6c081eed5f742873 (HEAD > bb-10.2MDEV-18460, origin/bb-10.2-MDEV-18460)
Author: Oleksandr Byelkin <sanja@mariadb.com>
Date: Sat Dec 7 22:15:38 2019 +0100

MDEV-18460: Server crashed in strmake / tdc_create_key / THD::create_tmp_table_def_key

When there is a WITH clause we postpone check for tables without
database for later stages when tables in WITH will be defined.
But we should not try to open such tables as temporary tables because
temporary tables always belong to a some database.

Comment by Oleksandr Byelkin [ 2019-12-09 ]

commit 8c7636cf2b0c6cc691fc8a8a08181e9a481ed9a6 (HEAD > bb-10.2MDEV-18460, origin/bb-10.2-MDEV-18460)
Author: Oleksandr Byelkin <sanja@mariadb.com>
Date: Sat Dec 7 22:15:38 2019 +0100

MDEV-18460: Server crashed in strmake / tdc_create_key / THD::create_tmp_table_def_key

When there is a WITH clause we postpone check for tables without
database for later stages when tables in WITH will be defined.
But we should not try to open such tables as temporary tables because
temporary tables always belong to a some database.

Comment by Oleksandr Byelkin [ 2019-12-09 ]

commit 864abd362c2a1594506cfae020e6c60bf80596a8 (HEAD > bb-10.2MDEV-18460, origin/bb-10.2-MDEV-18460)
Author: Oleksandr Byelkin <sanja@mariadb.com>
Date: Sat Dec 7 22:15:38 2019 +0100

MDEV-18460: Server crashed in strmake / tdc_create_key / THD::create_tmp_table_def_key

When there is a WITH clause we postpone check for tables without
database for later stages when tables in WITH will be defined.
But we should not try to open such tables as temporary tables because
temporary tables always belong to a some database.

Generated at Thu Feb 08 08:44:16 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.