[MDEV-22879] SIGSEGV (or hang) in free/my_free from _ma_end_block_record (on optimized builds) Created: 2020-06-12  Updated: 2020-10-29  Resolved: 2020-10-29

Status: Closed
Project: MariaDB Server
Component/s: Locking
Affects Version/s: 10.4, 10.5
Fix Version/s: 10.4.15, 10.5.7

Type: Bug Priority: Critical
Reporter: Roel Van de Paar Assignee: Michael Widenius
Resolution: Fixed Votes: 0
Labels: not-10.1, not-10.2, not-10.3, regression

Issue Links:
Relates
relates to MDEV-20945 BACKUP UNLOCK + FTWRL assertion failu... Closed

 Description   

SET SQL_MODE='';
USE test;
SET STATEMENT max_statement_time=20 FOR BACKUP LOCK test.t1;
CREATE TABLE IF NOT EXISTS t3 (c1 CHAR(1) BINARY,c2 SMALLINT(10),c3 NUMERIC(1,0), PRIMARY KEY(c1(1))) ENGINE=InnoDB;
LOCK TABLES t3 AS a2 WRITE, t3 AS a1 READ LOCAL;
UNLOCK TABLES;
DROP TABLE t1,t2,t0;
# Shutdown (using mysqladmin shutdown), observe crash (or hang) during shutdown

Slightly different testcase for variation. Note the slightly different lock setup. Please test any fix with this testcase also.

USE test;
SET SQL_MODE='';
SET STATEMENT max_statement_time=180 FOR BACKUP LOCK test.t;
CREATE TABLE t (c1 INT PRIMARY KEY) ENGINE=Aria;
LOCK TABLES t AS a2 WRITE, t AS a1 READ LOCAL;
UNLOCK TABLES;
DROP TABLE t1,t2,t0;
# Shutdown (using mysqladmin shutdown), observe crash (or hang) during shutdown

Leads to:

10.5.4 07d1c8567cbfe94398a9857c47fb9919cad42651

Core was generated by `/test/MD120620-mariadb-10.5.4-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
[Current thread is 1 (Thread 0x14e9678a6840 (LWP 1828221))]
(gdb) bt
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
#1  0x00005593ef35a9e7 in my_write_core (sig=sig@entry=11) at /test/10.5_opt/mysys/stacktrace.c:518
#2  0x00005593eed25daa in handle_fatal_signal (sig=11) at /test/10.5_opt/sql/signal_handler.cc:330
#3  <signal handler called>
#4  0x000014e96746919d in free () from /usr/lib/x86_64-linux-gnu/libjemalloc.so.1
#5  0x00005593ef356ef3 in my_free (ptr=<optimized out>) at /test/10.5_opt/mysys/my_malloc.c:209
#6  0x00005593eef39020 in _ma_end_block_record (info=0x14e943952018) at /test/10.5_opt/storage/maria/ma_blockrec.c:566
#7  0x00005593eeeea80a in maria_close (info=0x14e943952018) at /test/10.5_opt/storage/maria/ma_close.c:93
#8  0x00005593eebe5ea9 in closefrm (table=table@entry=0x14e9438d0818) at /test/10.5_opt/sql/table.cc:4288
#9  0x00005593eeca99c1 in intern_close_table (table=0x14e9438d0818) at /test/10.5_opt/sql/table_cache.cc:220
#10 tc_purge () at /test/10.5_opt/sql/table_cache.cc:312
#11 0x00005593eeaca02e in purge_tables () at /test/10.5_opt/sql/sql_base.cc:327
#12 0x00005593eeca8082 in tdc_start_shutdown () at /test/10.5_opt/sql/table_cache.cc:634
#13 0x00005593eea65dee in clean_up (print_message=print_message@entry=true) at /test/10.5_opt/sql/mysqld.cc:1980
#14 0x00005593eea71b1a in clean_up (print_message=true) at /test/10.5_opt/include/mysql/psi/mysql_thread.h:1137
#15 mysqld_main (argc=<optimized out>, argv=<optimized out>) at /test/10.5_opt/sql/mysqld.cc:5647
#16 0x000014e965a61b97 in __libc_start_main (main=0x5593eea33260 <main(int, char**)>, argc=10, argv=0x7ffe8791b6a8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffe8791b698) at ../csu/libc-start.c:310
#17 0x00005593eea64c3a in _start ()

Bug confirmed present in:
MariaDB: 10.4.14 (dbg), 10.4.14 (opt), 10.5.4 (dbg), 10.5.4 (opt)

Bug confirmed not present in:
MariaDB: 10.1.46 (dbg), 10.1.46 (opt), 10.2.33 (dbg), 10.2.33 (opt), 10.3.24 (dbg), 10.3.24 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt)



 Comments   
Comment by Roel Van de Paar [ 2020-10-17 ]

See comment in MDEV-20945 with many stacks on optimized + free() crashes.

Comment by Michael Widenius [ 2020-10-29 ]

The problem is that one should not do LOCK TABLES under BACKUP LOCK.

This was fixed as part of "MDEV-20945: BACKUP UNLOCK + FTWRL assertion failure"

I have added the test case to 10.4

Comment by Michael Widenius [ 2020-10-29 ]

Pushed test case to 10.4

Generated at Thu Feb 08 09:18:10 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.