[MDEV-25586] SIGSEGV in my_strcasecmp_utf8mb3 Created: 2021-05-03  Updated: 2021-05-06  Resolved: 2021-05-05

Status: Closed
Project: MariaDB Server
Component/s: Galera
Affects Version/s: 10.5, 10.6
Fix Version/s: 10.6.1, 10.5.11

Type: Bug Priority: Major
Reporter: Ramesh Sivaraman Assignee: Jan Lindström (Inactive)
Resolution: Fixed Votes: 0
Labels: not-10.2, not-10.3, not-10.4


 Description   

DROP DATABASE test;
SET GLOBAL wsrep_ignore_apply_errors=0;
CREATE USER dummy_user@localhost IDENTIFIED WITH dummy_plugin;
WITH t AS (SELECT * FROM t0 WHERE b=0) SELECT * FROM t0;

Leads to:

10.6.0 8751aa7397b2e698fa0b46ec3e60abb9e2fd7e1b (Optimized)

Core was generated by `/test/GAL_MD200421-mariadb-10.6.0-linux-x86_64-opt/bin/mysqld --defaults-file=/'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
[Current thread is 1 (Thread 0x1554e405a700 (LWP 167011))]
(gdb) bt
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
#1  0x000055ee7510c68f in my_write_core (sig=sig@entry=11) at /test/10.6_opt/mysys/stacktrace.c:424
#2  0x000055ee74b8b190 in handle_fatal_signal (sig=11) at /test/10.6_opt/sql/signal_handler.cc:343
#3  <signal handler called>
#4  my_strcasecmp_utf8mb3 (cs=<optimized out>, s=0x0, t=0x55ee75266719 "mysql") at /test/10.6_opt/strings/ctype-utf8.c:5109
#5  0x000055ee74a4aa6a in get_table_category (db=db@entry=0x1554e4058f70, name=name@entry=0x1554e4059060) at /test/10.6_opt/sql/table.cc:283
#6  0x000055ee74984e8a in wsrep_tables_accessible_when_detached (tables=<optimized out>) at /test/10.6_opt/sql/sql_parse.cc:1140
#7  mysql_execute_command (thd=0x1554700103d8) at /test/10.6_opt/sql/sql_parse.cc:3688
#8  0x000055ee74975c45 in mysql_parse (thd=0x1554700103d8, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.6_opt/sql/sql_parse.cc:8017
#9  0x000055ee74975696 in wsrep_mysql_parse (thd=0x1554700103d8, rawbuf=0x155470008960 "WITH t AS (SELECT * FROM t0 WHERE b=0) SELECT * FROM t0", length=55, parser_state=0x1554e4059440) at /test/10.6_opt/sql/sql_parse.cc:7831
#10 0x000055ee74983139 in dispatch_command (command=COM_QUERY, thd=0x1554700103d8, packet=0x1554700008e9 "WITH t AS (SELECT * FROM t0 WHERE b=0) SELECT * FROM t0", packet_length=<optimized out>, blocking=<optimized out>) at /test/10.6_opt/sql/sql_class.h:1331
#11 0x000055ee74983c58 in do_command (thd=0x1554700103d8, blocking=blocking@entry=true) at /test/10.6_opt/sql/sql_parse.cc:1406
#12 0x000055ee74a86517 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/10.6_opt/sql/sql_connect.cc:1410
#13 0x000055ee74a8687d in handle_one_connection (arg=arg@entry=0x55ee788a6a58) at /test/10.6_opt/sql/sql_connect.cc:1312
#14 0x000055ee74e049c6 in pfs_spawn_thread (arg=0x55ee788ab308) at /test/10.6_opt/storage/perfschema/pfs.cc:2201
#15 0x00001554e689f609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#16 0x00001554e648e293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

10.5.10 675c22c065110be03a5fab82442d2c3dc32aefff (Optimized)

Core was generated by `/test/GAL_MD200421-mariadb-10.5.10-linux-x86_64-opt/bin/mysqld --defaults-file='.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
[Current thread is 1 (Thread 0x14b728503700 (LWP 751197))]
(gdb) bt
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
#1  0x000055fe08893eef in my_write_core (sig=sig@entry=11) at /test/10.5_opt/mysys/stacktrace.c:424
#2  0x000055fe082bcf60 in handle_fatal_signal (sig=11) at /test/10.5_opt/sql/signal_handler.cc:343
#3  <signal handler called>
#4  my_strcasecmp_utf8mb3 (cs=<optimized out>, s=0x0, t=0x55fe089ef595 "mysql") at /test/10.5_opt/strings/ctype-utf8.c:5109
#5  0x000055fe0817768a in get_table_category (db=db@entry=0x14b728501ed0, name=name@entry=0x14b728501fa0) at /test/10.5_opt/sql/table.cc:282
#6  0x000055fe080affca in wsrep_tables_accessible_when_detached (tables=<optimized out>) at /test/10.5_opt/sql/sql_parse.cc:1158
#7  mysql_execute_command (thd=0x14b6c4000c58) at /test/10.5_opt/sql/sql_parse.cc:3762
#8  0x000055fe0809ff4f in mysql_parse (thd=thd@entry=0x14b6c4000c58, rawbuf=rawbuf@entry=0x14b6c40103f0 "WITH t AS (SELECT * FROM t0 WHERE b=0) SELECT * FROM t0", length=length@entry=55, parser_state=parser_state@entry=0x14b728502400, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_opt/sql/sql_parse.cc:8099
#9  0x000055fe0809f95c in wsrep_mysql_parse (thd=0x14b6c4000c58, rawbuf=0x14b6c40103f0 "WITH t AS (SELECT * FROM t0 WHERE b=0) SELECT * FROM t0", length=55, parser_state=0x14b728502400, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.5_opt/sql/sql_parse.cc:7902
#10 0x000055fe080adeef in dispatch_command (command=COM_QUERY, thd=0x14b6c4000c58, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.5_opt/sql/sql_class.h:1270
#11 0x000055fe080aedec in do_command (thd=0x14b6c4000c58) at /test/10.5_opt/sql/sql_parse.cc:1370
#12 0x000055fe081b4101 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55fe0b2d9278, put_in_cache=put_in_cache@entry=true) at /test/10.5_opt/sql/sql_connect.cc:1410
#13 0x000055fe081b457d in handle_one_connection (arg=arg@entry=0x55fe0b2d9278) at /test/10.5_opt/sql/sql_connect.cc:1312
#14 0x000055fe0853f5b6 in pfs_spawn_thread (arg=0x55fe0b335988) at /test/10.5_opt/storage/perfschema/pfs.cc:2201
#15 0x000014b739ca2609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#16 0x000014b739891293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.5.10 (opt), 10.5.10 (dbg), 10.6.0 (dbg), 10.6.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.38, 10.3.29, 10.4.19


Generated at Thu Feb 08 09:38:48 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.