[MDEV-23268] SIGSEGV in srv_monitor_timer_schedule_now when setting innodb_status_output during innodb-force-recovery Created: 2020-07-23  Updated: 2020-07-23  Resolved: 2020-07-23

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - InnoDB, Storage Engine - XtraDB
Affects Version/s: 10.1, 10.2, 10.3, 10.4, 10.5
Fix Version/s: 10.1.46, 10.2.33, 10.3.24, 10.4.14, 10.5.5

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Marko Mäkelä
Resolution: Fixed Votes: 0
Labels: None


 Description   

# mysqld options required for replay: --innodb-force-recovery=6
SET GLOBAL innodb_status_output=0;

Leads to:

10.5.5 054f10365c49b70a3868edc0c955ffe187f8344c (Debug)

Core was generated by `/test/MD200720-mariadb-10.5.5-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
[Current thread is 1 (Thread 0x150426803700 (LWP 3660993))]
(gdb) bt
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
#1  0x00005575963d782d in my_write_core (sig=sig@entry=11) at /test/10.5_dbg/mysys/stacktrace.c:518
#2  0x0000557595b9175c in handle_fatal_signal (sig=11) at /test/10.5_dbg/sql/signal_handler.cc:330
#3  <signal handler called>
#4  srv_monitor_timer_schedule_now () at /test/10.5_dbg/storage/innobase/include/srv0srv.h:947
#5  innodb_status_output_update (var=<optimized out>, save=<optimized out>) at /test/10.5_dbg/storage/innobase/handler/ha_innodb.cc:18769
#6  0x00005575958fe573 in sys_var_pluginvar::global_update (this=0x150423774280, thd=0x150405415088, var=0x150405474370) at /test/10.5_dbg/sql/sql_plugin.cc:3583
#7  0x00005575957fd074 in sys_var::update (this=0x150423774280, thd=0x150405415088, var=0x150405474370) at /test/10.5_dbg/sql/set_var.cc:207
#8  0x00005575957fd59d in set_var::update (this=<optimized out>, thd=<optimized out>) at /test/10.5_dbg/sql/set_var.cc:859
#9  0x00005575957fe950 in sql_set_variables (thd=thd@entry=0x150405415088, var_list=var_list@entry=0x150405419fb0, free=free@entry=true) at /test/10.5_dbg/sql/set_var.cc:746
#10 0x00005575958e7b8f in mysql_execute_command (thd=thd@entry=0x150405415088) at /test/10.5_dbg/sql/sql_parse.cc:5008
#11 0x00005575958f1b8a in mysql_parse (thd=thd@entry=0x150405415088, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x150426802350, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7993
#12 0x00005575958de63c in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x150405415088, packet=packet@entry=0x150405467089 "SET GLOBAL innodb_status_output=0", packet_length=packet_length@entry=33, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1866
#13 0x00005575958dce16 in do_command (thd=0x150405415088) at /test/10.5_dbg/sql/sql_parse.cc:1347
#14 0x0000557595a394af in do_handle_one_connection (connect=<optimized out>, connect@entry=0x150408bfa568, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1411
#15 0x0000557595a39bcb in handle_one_connection (arg=arg@entry=0x150408bfa568) at /test/10.5_dbg/sql/sql_connect.cc:1313
#16 0x0000557595e9ddca in pfs_spawn_thread (arg=0x150423444e88) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
#17 0x000015042577c6db in start_thread (arg=0x150426803700) at pthread_create.c:463
#18 0x0000150424b7aa3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.1.46 (dbg), 10.1.46 (opt), 10.2.33 (dbg), 10.2.33 (opt), 10.3.24 (dbg), 10.3.24 (opt), 10.4.14 (dbg), 10.4.14 (opt), 10.5.5 (dbg), 10.5.5 (opt)

Bug confirmed not present in:
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt)



 Comments   
Comment by Roel Van de Paar [ 2020-07-23 ]

Unique ID's across versions. First 3 all seen on optimized builds.

SIGSEGV|OSMutex::enter|os_event::set|os_event_set|innodb_status_output_update
SIGSEGV|__GI___pthread_mutex_lock|OSMutex::enter|os_event::set|os_event_set
SIGSEGV|srv_monitor_timer_schedule_now|innodb_status_output_update|sys_var_pluginvar::global_update|sys_var::update
event|SIGABRT|os_event_set|innodb_status_output_update|sys_var_pluginvar::global_update|sys_var::update

Comment by Marko Mäkelä [ 2020-07-23 ]

This also affects innodb_read_only=ON and a few other places where os_event_set(srv_monitor_event) is invoked.

Comment by Roel Van de Paar [ 2020-07-23 ]

Quickest bug fix ever Thank you Marko!

Generated at Thu Feb 08 09:21:08 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.