[MDEV-25634] Bug report: abortion in sql/sql_prepare.cc:0 Created: 2021-05-10  Updated: 2021-05-14  Resolved: 2021-05-10

Status: Closed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.5.9
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Zuming Jiang Assignee: Unassigned
Resolution: Duplicate Votes: 0
Labels: crash
Environment:

Ubuntu 18.04
MariaDB 10.5.9


Attachments: Text File abortion_report.txt     File fuzz.sql    
Issue Links:
Duplicate
duplicates MDEV-25636 Bug report: abortion in sql/sql_parse... Closed

 Description   

I used my fuzzing tool to test Mariadb , and found a bug that can result in an abortion.

Mariadb installation:
1) cd mariadb-10.5.9
2) mkdir build; cd build
3) cmake -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_DEBUG=ON ../
4) make -j8 && sudo make install

How to Repeat:
export ASAN_OPTIONS=detect_leaks=0
/usr/local/mysql/bin/mysqld_safe &
/usr/local/mysql/bin/mysql -uroot -p123456(your password)
MariaDB> drop database if exists test_db;
MariaDB> create database test_db;
MariaDB> source fuzz.sql;

I have simplified the content of fuzz.sql, and I hope fuzz.sql can help you reproduce the bug and fix it. In addition, I attach the abortion report (which has its stack trace).



 Comments   
Comment by Alice Sherepa [ 2021-05-10 ]

this is a duplicate of MDEV-25636:

Version: '10.5.10-MariaDB-debug-log' 
mariadbd: /10.5/src/sql/sql_select.cc:20593: enum_nested_loop_state sub_select_cache(JOIN*, JOIN_TAB*, bool): Assertion `cache != __null' failed.
210510 16:20:49 [ERROR] mysqld got signal 6 ;
 
Server version: 10.5.10-MariaDB-debug-log
 
sql/signal_handler.cc:224(handle_fatal_signal)[0x5619fb64fe7d]
sigaction.c:0(__restore_rt)[0x7fe32b2603c0]
linux/raise.c:51(__GI_raise)[0x7fe32ad4c18b]
stdlib/abort.c:81(__GI_abort)[0x7fe32ad2b859]
intl/loadmsgcat.c:509(get_sysdep_segment_value)[0x7fe32ad2b729]
:0(__GI___assert_fail)[0x7fe32ad3cf36]
sql/sql_select.cc:20595(sub_select_cache(JOIN*, st_join_table*, bool))[0x5619faf6d011]
sql/sql_select.cc:21048(evaluate_join_record(JOIN*, st_join_table*, int))[0x5619faf6f57d]
sql/sql_select.cc:20825(sub_select(JOIN*, st_join_table*, bool))[0x5619faf6ded3]
sql/sql_select.cc:20359(do_select(JOIN*, Procedure*))[0x5619faf6ba46]
sql/sql_select.cc:4505(JOIN::exec_inner())[0x5619faef6a8a]
sql/sql_select.cc:4286(JOIN::exec())[0x5619faef4070]
sql/sql_union.cc:2236(st_select_lex_unit::exec())[0x5619fb1207e3]
sql/item_subselect.cc:4103(subselect_union_engine::exec())[0x5619fb8bace9]
sql/item_subselect.cc:834(Item_subselect::exec())[0x5619fb89513f]
sql/item_subselect.cc:1441(Item_singlerow_subselect::val_int())[0x5619fb89aec8]
sql/item.h:1571(Item::val_int_result())[0x5619fab48864]
sql/item.cc:9917(Item_cache_int::cache_value())[0x5619fb700847]
sql/item.cc:8704(Item_cache_wrapper::cache())[0x5619fb716866]
sql/item.cc:8758(Item_cache_wrapper::val_int())[0x5619fb6f5c01]
sql/item_cmpfunc.cc:942(Arg_comparator::compare_int_signed())[0x5619fb7296e6]
sql/item_cmpfunc.h:102(Arg_comparator::compare())[0x5619fb76d7ee]
sql/item_cmpfunc.cc:1798(Item_func_ne::val_int())[0x5619fb73388d]
sql/sql_select.cc:20923(evaluate_join_record(JOIN*, st_join_table*, int))[0x5619faf6ec09]
sql/sql_select.cc:20864(sub_select(JOIN*, st_join_table*, bool))[0x5619faf6e545]
sql/sql_select.cc:20359(do_select(JOIN*, Procedure*))[0x5619faf6ba46]
sql/sql_select.cc:4505(JOIN::exec_inner())[0x5619faef6a8a]
sql/sql_select.cc:4286(JOIN::exec())[0x5619faef4070]
sql/sql_select.cc:4763(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5619faef84c7]
sql/sql_select.cc:443(handle_select(THD*, LEX*, select_result*, unsigned long))[0x5619faec9653]
sql/sql_parse.cc:6313(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5619fae2ff52]
sql/sql_parse.cc:4009(mysql_execute_command(THD*))[0x5619fae1ef7c]
sql/sql_parse.cc:8099(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x5619fae3b342]
sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x5619fae1103a]
sql/sql_parse.cc:1370(do_command(THD*))[0x5619fae0d985]
sql/sql_connect.cc:1410(do_handle_one_connection(CONNECT*, bool))[0x5619fb26a834]
sql/sql_connect.cc:1314(handle_one_connection)[0x5619fb26a198]
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x5619fbfd9661]
nptl/pthread_create.c:478(start_thread)[0x7fe32b254609]
x86_64/clone.S:97(__GI___clone)[0x7fe32ae28293]
 
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x615000033eb0): SELECT ref_3.c_e74k22bw AS c12
FROM t1 AS ref_3
WHERE ref_3.c_e <>
(SELECT ref_4.c_cozuu AS c0
FROM t1 AS ref_4
WHERE ref_3.c_cozuu > (SELECT c_e FROM t1 ORDER BY c_e LIMIT 1 OFFSET 4)
UNION SELECT ref_6.c_cozuu AS c0
FROM (t1 AS ref_5
JOIN t1 AS ref_6 ON ((ref_6.c_e74k22bw > ref_6.c_cozuu)
OR (ref_5.c_r < ref_5.c_r)))
WHERE (ref_3.c_cozuu >= ref_3.c_cozuu))

I will add this test case there

Generated at Thu Feb 08 09:39:11 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.