[MDEV-26258] Various crashes/asserts/corruptions when Aria encryption is enabled/used, but the encryption plugin is not loaded Created: 2021-07-28  Updated: 2023-06-07  Resolved: 2023-05-03

Status: Closed
Project: MariaDB Server
Component/s: Encryption, Storage Engine - Aria
Affects Version/s: 10.3, 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11
Fix Version/s: 10.4.31, 10.5.22, 10.6.15, 10.9.8, 10.10.6, 10.11.5

Type: Bug Priority: Critical
Reporter: Roel Van de Paar Assignee: Michael Widenius
Resolution: Fixed Votes: 0
Labels: affects-tests, corruption, regression-10.10, regression-10.4, stack-smashing

Issue Links:
Relates
relates to MDEV-18496 Crashes, asserts, errors and hangs wh... Closed
relates to MDEV-24640 ALTER on Aria table with aria_encrypt... Confirmed

 Description   

Further to MDEV-18496, there are still various cases where the server crashes/asserts when Aria encryption is enabled/used, but the plugin is not loaded. This bug will list only crashes/asserts. For "Unknown key id 1" and similar corruption errors, see MDEV-24640 instead.

Individual testcases/crashes/asserts listed in comments below.



 Comments   
Comment by Roel Van de Paar [ 2021-07-28 ]

USE test;
SET GLOBAL aria_encrypt_tables=1;
CREATE TABLE t (a INT AUTO_INCREMENT PRIMARY KEY, b INT) ENGINE=Aria;
INSERT INTO t VALUES (6,2);
ANALYZE NO_WRITE_TO_BINLOG TABLE t;

Leads to:

10.7.0 71ed8c136fa203b9b3a678a6d5cc72235ef73ef7 (Debug)

mysqld: /test/10.7_dbg/sql/sql_error.cc:374: void Diagnostics_area::set_eof_status(THD*): Assertion `!is_set() || (m_status == DA_EOF_BULK && is_bulk_op())' failed.

10.7.0 71ed8c136fa203b9b3a678a6d5cc72235ef73ef7 (Debug)

Core was generated by `/test/MD200721-mariadb-10.7.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
[Current thread is 1 (Thread 0x14bae1947700 (LWP 2432774))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x000014baf87bc859 in __GI_abort () at abort.c:79
#2  0x000014baf87bc729 in __assert_fail_base (fmt=0x14baf8952588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x5614ca1135e8 "!is_set() || (m_status == DA_EOF_BULK && is_bulk_op())", file=0x5614ca113448 "/test/10.7_dbg/sql/sql_error.cc", line=374, function=<optimized out>) at assert.c:92
#3  0x000014baf87cdf36 in __GI___assert_fail (assertion=assertion@entry=0x5614ca1135e8 "!is_set() || (m_status == DA_EOF_BULK && is_bulk_op())", file=file@entry=0x5614ca113448 "/test/10.7_dbg/sql/sql_error.cc", line=line@entry=374, function=function@entry=0x5614ca113620 "void Diagnostics_area::set_eof_status(THD*)") at assert.c:101
#4  0x00005614c9448f24 in Diagnostics_area::set_eof_status (this=0x14baa8006c40, thd=thd@entry=0x14baa8000db8) at /test/10.7_dbg/sql/sql_error.h:1029
#5  0x00005614c962bc64 in my_eof (thd=0x14baa8000db8) at /test/10.7_dbg/sql/sql_class.h:5557
#6  mysql_admin_table (thd=thd@entry=0x14baa8000db8, tables=tables@entry=0x14baa8013d70, check_opt=check_opt@entry=0x14baa80063c8, operator_name=operator_name@entry=0x5614ca853ad0 <msg_analyze>, lock_type=lock_type@entry=TL_READ_NO_INSERT, org_open_for_modify=org_open_for_modify@entry=true, repair_table_use_frm=false, extra_open_options=0, prepare_func=0x0, operator_func=(int (handler::*)(class handler * const, class THD *, HA_CHECK_OPT *)) 0x5614c97a7504 <handler::ha_analyze(THD*, st_ha_check_opt*)>, view_operator_func=0x0, is_cmd_replicated=true) at /test/10.7_dbg/sql/sql_admin.cc:1383
#7  0x00005614c962c08b in Sql_cmd_analyze_table::execute (this=<optimized out>, thd=0x14baa8000db8) at /test/10.7_dbg/sql/sql_admin.cc:1491
#8  0x00005614c94a81c2 in mysql_execute_command (thd=thd@entry=0x14baa8000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.7_dbg/sql/sql_parse.cc:5993
#9  0x00005614c948eead in mysql_parse (thd=thd@entry=0x14baa8000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14bae1946400) at /test/10.7_dbg/sql/sql_parse.cc:8026
#10 0x00005614c949d9f8 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14baa8000db8, packet=packet@entry=0x14baa800b749 "", packet_length=packet_length@entry=34, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_class.h:1340
#11 0x00005614c94a0e05 in do_command (thd=0x14baa8000db8, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_parse.cc:1404
#12 0x00005614c9616f48 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5614cc2d3cd8, put_in_cache=put_in_cache@entry=true) at /test/10.7_dbg/sql/sql_connect.cc:1410
#13 0x00005614c961754d in handle_one_connection (arg=arg@entry=0x5614cc2d3cd8) at /test/10.7_dbg/sql/sql_connect.cc:1312
#14 0x00005614c9a7f5b2 in pfs_spawn_thread (arg=0x5614cc1b71e8) at /test/10.7_dbg/storage/perfschema/pfs.cc:2201
#15 0x000014baf8ccb609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#16 0x000014baf88b9293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.2.39 (dbg), 10.3.30 (dbg), 10.4.20 (dbg), 10.5.11 (dbg), 10.6.4 (dbg), 10.7.0 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.39 (opt), 10.3.30 (opt), 10.4.20 (opt), 10.5.11 (opt), 10.6.4 (opt), 10.7.0 (opt)

Comment by Roel Van de Paar [ 2021-07-28 ]

# mysqld options required for replay: --log-bin
SET SQL_MODE='',tmp_table_size = 65535;
CREATE TABLE t1(c INT) ENGINE=InnoDB;
CREATE TABLE t2(c INT) ENGINE=MyISAM;
XA BEGIN 'a';
SET GLOBAL aria_encrypt_tables=1;
INSERT INTO t1 SELECT * FROM t1;
CREATE TEMPORARY TABLE t1(a INT PRIMARY KEY) ENGINE=Aria;
INSERT INTO t1 VALUES (1);
DELETE FROM t2;
DELETE FROM t1;
LOAD INDEX INTO CACHE t1 IGNORE LEAVES;
SELECT * FROM INFORMATION_SCHEMA.user_privileges LIMIT 1;
INSERT INTO t1 VALUES (1);
INSERT INTO t1 VALUES (2);

Leads to:

10.7.0 71ed8c136fa203b9b3a678a6d5cc72235ef73ef7 (Debug)

mysqld: /test/10.7_dbg/storage/maria/ma_page.c:449: _ma_new: Assertion `(key_del_current != 0) && ((key_del_current == (~ (my_off_t) 0)) || (key_del_current <= (share->state.state.key_file_length - block_size)))' failed.

10.7.0 71ed8c136fa203b9b3a678a6d5cc72235ef73ef7 (Debug)

Core was generated by `/test/MD200721-mariadb-10.7.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
[Current thread is 1 (Thread 0x1465d884e700 (LWP 879979))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00001465e1cfe859 in __GI_abort () at abort.c:79
#2  0x00001465e1cfe729 in __assert_fail_base (fmt=0x1465e1e94588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55dd2b835c30 "(key_del_current != 0) && ((key_del_current == (~ (my_off_t) 0)) || (key_del_current <= (share->state.state.key_file_length - block_size)))", file=0x55dd2b835aa8 "/test/10.7_dbg/storage/maria/ma_page.c", line=449, function=<optimized out>) at assert.c:92
#3  0x00001465e1d0ff36 in __GI___assert_fail (assertion=assertion@entry=0x55dd2b835c30 "(key_del_current != 0) && ((key_del_current == (~ (my_off_t) 0)) || (key_del_current <= (share->state.state.key_file_length - block_size)))", file=file@entry=0x55dd2b835aa8 "/test/10.7_dbg/storage/maria/ma_page.c", line=line@entry=449, function=function@entry=0x55dd2b835e28 <__PRETTY_FUNCTION__.20090> "_ma_new") at assert.c:101
#4  0x000055dd2af264c0 in _ma_new (info=info@entry=0x1465800975e8, level=level@entry=6, page_link=page_link@entry=0x1465d884bc98) at /test/10.7_dbg/storage/maria/ma_page.c:449
#5  0x000055dd2af468d7 in _ma_enlarge_root (info=info@entry=0x1465800975e8, key=key@entry=0x1465d884c9e0, root=root@entry=0x1465d884be18) at /test/10.7_dbg/storage/maria/ma_write.c:580
#6  0x000055dd2af4962d in _ma_ck_real_write_btree (info=info@entry=0x1465800975e8, key=key@entry=0x1465d884c9e0, root=root@entry=0x1465d884be18, comp_flag=comp_flag@entry=131137) at /test/10.7_dbg/storage/maria/ma_write.c:534
#7  0x000055dd2af496de in _ma_ck_write_btree_with_log (info=info@entry=0x1465800975e8, key=key@entry=0x1465d884c9e0, root=root@entry=0x146580080978, comp_flag=131137) at /test/10.7_dbg/storage/maria/ma_write.c:498
#8  0x000055dd2af49881 in _ma_ck_write_btree (info=info@entry=0x1465800975e8, key=key@entry=0x1465d884c9e0) at /test/10.7_dbg/storage/maria/ma_write.c:456
#9  0x000055dd2af49950 in _ma_ck_write (info=info@entry=0x1465800975e8, key=0x1465d884c9e0) at /test/10.7_dbg/storage/maria/ma_write.c:441
#10 0x000055dd2af45a41 in maria_write (info=0x1465800975e8, record=record@entry=0x14658007e8b8 "\377\002") at /test/10.7_dbg/storage/maria/ma_write.c:189
#11 0x000055dd2aedac2a in ha_maria::write_row (this=0x14658007ed40, buf=0x14658007e8b8 "\377\002") at /test/10.7_dbg/storage/maria/ha_maria.cc:1266
#12 0x000055dd2acc84bd in handler::ha_write_row (this=0x14658007ed40, buf=0x14658007e8b8 "\377\002") at /test/10.7_dbg/sql/handler.cc:7500
#13 0x000055dd2a96d5aa in write_record (thd=thd@entry=0x146580000db8, table=table@entry=0x14658007dfc8, info=info@entry=0x1465d884ccc0, sink=sink@entry=0x0) at /test/10.7_dbg/sql/sql_insert.cc:2135
#14 0x000055dd2a9791ec in mysql_insert (thd=thd@entry=0x146580000db8, table_list=0x146580013e88, fields=@0x146580005fd8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55dd2bf89b00 <end_of_list>, last = 0x146580005fd8, elements = 0}, <No data fields>}, values_list=@0x146580006020: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x146580014a90, last = 0x146580014a90, elements = 1}, <No data fields>}, update_fields=@0x146580006008: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55dd2bf89b00 <end_of_list>, last = 0x146580006008, elements = 0}, <No data fields>}, update_values=@0x146580005ff0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55dd2bf89b00 <end_of_list>, last = 0x146580005ff0, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.7_dbg/sql/sql_insert.cc:1123
#15 0x000055dd2a9bf1cb in mysql_execute_command (thd=thd@entry=0x146580000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.7_dbg/sql/sql_parse.cc:4566
#16 0x000055dd2a9a9ead in mysql_parse (thd=thd@entry=0x146580000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1465d884d400) at /test/10.7_dbg/sql/sql_parse.cc:8026
#17 0x000055dd2a9b89f8 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x146580000db8, packet=packet@entry=0x14658000b869 "INSERT INTO t1 VALUES (2)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_class.h:1340
#18 0x000055dd2a9bbe05 in do_command (thd=0x146580000db8, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_parse.cc:1404
#19 0x000055dd2ab31f48 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55dd2de96a28, put_in_cache=put_in_cache@entry=true) at /test/10.7_dbg/sql/sql_connect.cc:1410
#20 0x000055dd2ab3254d in handle_one_connection (arg=arg@entry=0x55dd2de96a28) at /test/10.7_dbg/sql/sql_connect.cc:1312
#21 0x000055dd2af9a5b2 in pfs_spawn_thread (arg=0x55dd2dd55118) at /test/10.7_dbg/storage/perfschema/pfs.cc:2201
#22 0x00001465e220d609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#23 0x00001465e1dfb293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.2.39 (dbg), 10.3.30 (dbg), 10.4.20 (dbg), 10.5.11 (dbg), 10.6.4 (dbg), 10.7.0 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.39 (opt), 10.3.30 (opt), 10.4.20 (opt), 10.5.11 (opt), 10.6.4 (opt), 10.7.0 (opt)

Comment by Roel Van de Paar [ 2021-07-28 ]

SET SQL_MODE='',GLOBAL aria_encrypt_tables=1;
CREATE TABLE ti (a TINYINT, b TINYINT, c CHAR(79), d CHAR(63), e CHAR(24), f BINARY(8), g BLOB, h MEDIUMBLOB, id BIGINT PRIMARY KEY, KEY(b), KEY(e)) ENGINE=Aria;
CREATE TEMPORARY TABLE t1(a INT NOT NULL PRIMARY KEY, b INT, KEY(b)) ENGINE=Aria;
INSERT INTO t1 VALUES(0, 0);
DELETE FROM t1 WHERE a BETWEEN 0 AND 20;
INSERT INTO t1 SELECT a, b FROM t1;
INSERT INTO ti VALUES (1,2,'a','b','c','d','e','g',2);
INSERT INTO t1 VALUES(0, 'a');
INSERT INTO t1 VALUES(0, 'a');

Leads to:

10.7.0 71ed8c136fa203b9b3a678a6d5cc72235ef73ef7 (Debug)

mysqld: /test/10.7_dbg/storage/maria/ma_page.c:449: _ma_new: Assertion `(key_del_current != 0) && ((key_del_current == (~ (my_off_t) 0)) || (key_del_current <= (share->state.state.key_file_length - block_size)))' failed.

10.7.0 71ed8c136fa203b9b3a678a6d5cc72235ef73ef7 (Debug)

Core was generated by `/test/MD200721-mariadb-10.7.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
[Current thread is 1 (Thread 0x14f534908700 (LWP 2817408))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x000014f54a7aa859 in __GI_abort () at abort.c:79
#2  0x000014f54a7aa729 in __assert_fail_base (fmt=0x14f54a940588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x56202bb63c30 "(key_del_current != 0) && ((key_del_current == (~ (my_off_t) 0)) || (key_del_current <= (share->state.state.key_file_length - block_size)))", file=0x56202bb63aa8 "/test/10.7_dbg/storage/maria/ma_page.c", line=449, function=<optimized out>) at assert.c:92
#3  0x000014f54a7bbf36 in __GI___assert_fail (assertion=assertion@entry=0x56202bb63c30 "(key_del_current != 0) && ((key_del_current == (~ (my_off_t) 0)) || (key_del_current <= (share->state.state.key_file_length - block_size)))", file=file@entry=0x56202bb63aa8 "/test/10.7_dbg/storage/maria/ma_page.c", line=line@entry=449, function=function@entry=0x56202bb63e28 <__PRETTY_FUNCTION__.20090> "_ma_new") at assert.c:101
#4  0x000056202b2544c0 in _ma_new (info=info@entry=0x14f4f8035708, level=level@entry=6, page_link=page_link@entry=0x14f534905c98) at /test/10.7_dbg/storage/maria/ma_page.c:449
#5  0x000056202b2748d7 in _ma_enlarge_root (info=info@entry=0x14f4f8035708, key=key@entry=0x14f5349069e0, root=root@entry=0x14f534905e18) at /test/10.7_dbg/storage/maria/ma_write.c:580
#6  0x000056202b27762d in _ma_ck_real_write_btree (info=info@entry=0x14f4f8035708, key=key@entry=0x14f5349069e0, root=root@entry=0x14f534905e18, comp_flag=comp_flag@entry=131137) at /test/10.7_dbg/storage/maria/ma_write.c:534
#7  0x000056202b2776de in _ma_ck_write_btree_with_log (info=info@entry=0x14f4f8035708, key=key@entry=0x14f5349069e0, root=root@entry=0x14f4f8024320, comp_flag=131137) at /test/10.7_dbg/storage/maria/ma_write.c:498
#8  0x000056202b277881 in _ma_ck_write_btree (info=info@entry=0x14f4f8035708, key=key@entry=0x14f5349069e0) at /test/10.7_dbg/storage/maria/ma_write.c:456
#9  0x000056202b277950 in _ma_ck_write (info=info@entry=0x14f4f8035708, key=0x14f5349069e0) at /test/10.7_dbg/storage/maria/ma_write.c:441
#10 0x000056202b273a41 in maria_write (info=0x14f4f8035708, record=record@entry=0x14f4f80345b8 <incomplete sequence \375>) at /test/10.7_dbg/storage/maria/ma_write.c:189
#11 0x000056202b208c2a in ha_maria::write_row (this=0x14f4f8034a40, buf=0x14f4f80345b8 <incomplete sequence \375>) at /test/10.7_dbg/storage/maria/ha_maria.cc:1266
#12 0x000056202aff64bd in handler::ha_write_row (this=0x14f4f8034a40, buf=0x14f4f80345b8 <incomplete sequence \375>) at /test/10.7_dbg/sql/handler.cc:7500
#13 0x000056202ac9b5aa in write_record (thd=thd@entry=0x14f4f8000db8, table=table@entry=0x14f4f8034128, info=info@entry=0x14f534906cc0, sink=sink@entry=0x0) at /test/10.7_dbg/sql/sql_insert.cc:2135
#14 0x000056202aca71ec in mysql_insert (thd=thd@entry=0x14f4f8000db8, table_list=0x14f4f8013d70, fields=@0x14f4f8005fd8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56202c2b7b00 <end_of_list>, last = 0x14f4f8005fd8, elements = 0}, <No data fields>}, values_list=@0x14f4f8006020: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f4f8014a08, last = 0x14f4f8014a08, elements = 1}, <No data fields>}, update_fields=@0x14f4f8006008: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56202c2b7b00 <end_of_list>, last = 0x14f4f8006008, elements = 0}, <No data fields>}, update_values=@0x14f4f8005ff0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56202c2b7b00 <end_of_list>, last = 0x14f4f8005ff0, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.7_dbg/sql/sql_insert.cc:1123
#15 0x000056202aced1cb in mysql_execute_command (thd=thd@entry=0x14f4f8000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.7_dbg/sql/sql_parse.cc:4566
#16 0x000056202acd7ead in mysql_parse (thd=thd@entry=0x14f4f8000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14f534907400) at /test/10.7_dbg/sql/sql_parse.cc:8026
#17 0x000056202ace69f8 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14f4f8000db8, packet=packet@entry=0x14f4f800b749 "INSERT INTO t1 VALUES(0, 'a')", packet_length=packet_length@entry=29, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_class.h:1340
#18 0x000056202ace9e05 in do_command (thd=0x14f4f8000db8, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_parse.cc:1404
#19 0x000056202ae5ff48 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x56202eb9ae18, put_in_cache=put_in_cache@entry=true) at /test/10.7_dbg/sql/sql_connect.cc:1410
#20 0x000056202ae6054d in handle_one_connection (arg=arg@entry=0x56202eb9ae18) at /test/10.7_dbg/sql/sql_connect.cc:1312
#21 0x000056202b2c85b2 in pfs_spawn_thread (arg=0x56202eac3e38) at /test/10.7_dbg/storage/perfschema/pfs.cc:2201
#22 0x000014f54acb9609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#23 0x000014f54a8a7293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.2.39 (dbg), 10.3.30 (dbg), 10.4.20 (dbg), 10.5.11 (dbg), 10.6.4 (dbg), 10.7.0 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.39 (opt), 10.3.30 (opt), 10.4.20 (opt), 10.5.11 (opt), 10.6.4 (opt), 10.7.0 (opt)

Comment by Roel Van de Paar [ 2022-02-08 ]

SET GLOBAL aria_encrypt_tables=1;
CREATE TABLE t1 (i INT,PRIMARY KEY(i)) ENGINE=Aria;
CREATE TRIGGER t1_bi BEFORE INSERT ON t1 FOR EACH ROW BEGIN END;
INSERT IGNORE INTO t1 VALUES (600),(NULL),(NULL),(610),(NULL);
DROP TABLE t1;

Leads to:

10.8.1 0c5d1342ae6b5ab3256848be7a83e5c3b1f21566 (Debug)

mysqld: /test/10.8_dbg/sql/sql_trigger.cc:1627: static bool Table_triggers_list::check_n_load(THD*, const LEX_CSTRING*, const LEX_CSTRING*, TABLE*, bool): Assertion `!parse_error || lex.sphead == 0' failed.

10.8.1 0c5d1342ae6b5ab3256848be7a83e5c3b1f21566 (Debug)

Core was generated by `/test/MD290122-mariadb-10.8.1-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
[Current thread is 1 (Thread 0x1513080ad700 (LWP 1960320))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x0000151327f2e859 in __GI_abort () at abort.c:79
#2  0x0000151327f2e729 in __assert_fail_base (fmt=0x1513280c4588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55d591d48370 "!parse_error || lex.sphead == 0", file=0x55d591d47bb0 "/test/10.8_dbg/sql/sql_trigger.cc", line=1627, function=<optimized out>) at assert.c:92
#3  0x0000151327f3ff36 in __GI___assert_fail (assertion=assertion@entry=0x55d591d48370 "!parse_error || lex.sphead == 0", file=file@entry=0x55d591d47bb0 "/test/10.8_dbg/sql/sql_trigger.cc", line=line@entry=1627, function=function@entry=0x55d591d48300 "static bool Table_triggers_list::check_n_load(THD*, const LEX_CSTRING*, const LEX_CSTRING*, TABLE*, bool)") at assert.c:101
#4  0x000055d5911548c8 in Table_triggers_list::check_n_load (thd=thd@entry=0x1512a0000db8, db=db@entry=0x1513080ab6e0, table_name=table_name@entry=0x1513080ab6f0, table=table@entry=0x1513080ab030, names_only=names_only@entry=true) at /test/10.8_dbg/sql/sql_trigger.cc:1627
#5  0x000055d591155577 in Table_triggers_list::drop_all_triggers (thd=thd@entry=0x1512a0000db8, db=db@entry=0x1513080ab6e0, name=name@entry=0x1513080ab6f0, MyFlags=MyFlags@entry=48) at /test/10.8_dbg/sql/sql_trigger.cc:2015
#6  0x000055d5911314ab in mysql_rm_table_no_locks (thd=thd@entry=0x1512a0000db8, tables=tables@entry=0x1512a0013e90, current_db=current_db@entry=0x1512a0000e50, ddl_log_state=0x1513080ab710, ddl_log_state@entry=0x0, if_exists=if_exists@entry=false, drop_temporary=drop_temporary@entry=false, drop_view=false, drop_sequence=false, dont_log_query=false, dont_free_locks=false) at /test/10.8_dbg/sql/sql_table.cc:1727
#7  0x000055d59113319f in mysql_rm_table (thd=thd@entry=0x1512a0000db8, tables=tables@entry=0x1512a0013e90, if_exists=<optimized out>, drop_temporary=<optimized out>, drop_sequence=<optimized out>, dont_log_query=dont_log_query@entry=false) at /test/10.8_dbg/sql/sql_table.cc:1186
#8  0x000055d59105b668 in mysql_execute_command (thd=thd@entry=0x1512a0000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.8_dbg/sql/structs.h:568
#9  0x000055d591044db7 in mysql_parse (thd=thd@entry=0x1512a0000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1513080ac400) at /test/10.8_dbg/sql/sql_parse.cc:8027
#10 0x000055d591053a53 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1512a0000db8, packet=packet@entry=0x1512a000b889 "DROP TABLE t1", packet_length=packet_length@entry=13, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_class.h:1362
#11 0x000055d591056e9a in do_command (thd=0x1512a0000db8, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_parse.cc:1402
#12 0x000055d5911d2110 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55d595639d88, put_in_cache=put_in_cache@entry=true) at /test/10.8_dbg/sql/sql_connect.cc:1418
#13 0x000055d5911d2715 in handle_one_connection (arg=arg@entry=0x55d595639d88) at /test/10.8_dbg/sql/sql_connect.cc:1312
#14 0x000055d59165bc8e in pfs_spawn_thread (arg=0x55d59554d0a8) at /test/10.8_dbg/storage/perfschema/pfs.cc:2201
#15 0x000015132843d609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#16 0x000015132802b293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.2.42 (dbg), 10.3.33 (dbg), 10.4.23 (dbg), 10.5.14 (dbg), 10.6.6 (dbg), 10.7.2 (dbg), 10.8.1 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.42 (opt), 10.3.33 (opt), 10.4.23 (opt), 10.5.14 (opt), 10.6.6 (opt), 10.7.2 (opt), 10.8.1 (opt)

This was one of the stacks seen in the previous bug MDEV-18496

Comment by Roel Van de Paar [ 2022-02-19 ]

Another stack with

SET GLOBAL aria_encrypt_tables=1;
CREATE TABLE t (c INT PRIMARY KEY) ENGINE=Aria;
INSERT INTO t (c) VALUES (1);
CHECK TABLE t;
SELECT * FROM t;

Leads to:

10.9.0 b5852ffbeebc3000982988383daeefb0549e058a (Debug)

+--------+-------+----------+--------------------------------------------------------+
| Table  | Op    | Msg_type | Msg_text                                               |
+--------+-------+----------+--------------------------------------------------------+
| test.t | check | error    | Failed to flush data or index file                     |
| test.t | check | error    | Size of indexfile is:     8192         Expected: 16384 |
| test.t | check | Error    | Unknown key id 1. Can't continue!                      |
| test.t | check | error    | Corrupt                                                |
+--------+-------+----------+--------------------------------------------------------+
4 rows in set (0.004 sec)

10.9.0 b5852ffbeebc3000982988383daeefb0549e058a (Debug)

mysqld: /test/10.9_dbg/sql/protocol.cc:617: void Protocol::end_statement(): Assertion `0' failed.

10.9.0 b5852ffbeebc3000982988383daeefb0549e058a (Debug)

Core was generated by `/test/MD140222-mariadb-10.9.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
[Current thread is 1 (Thread 0x1531740e6700 (LWP 2355463))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x0000153194996859 in __GI_abort () at abort.c:79
#2  0x0000153194996729 in __assert_fail_base (fmt=0x153194b2c588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x563bb5d9a1e7 "0", file=0x563bb5bbce00 "/test/10.9_dbg/sql/protocol.cc", line=617, function=<optimized out>) at assert.c:92
#3  0x00001531949a7f36 in __GI___assert_fail (assertion=assertion@entry=0x563bb5d9a1e7 "0", file=file@entry=0x563bb5bbce00 "/test/10.9_dbg/sql/protocol.cc", line=line@entry=617, function=function@entry=0x563bb5bbd6a0 "void Protocol::end_statement()") at assert.c:101
#4  0x0000563bb4dfc0c6 in Protocol::end_statement (this=0x1531080013a0) at /test/10.9_dbg/sql/protocol.cc:617
#5  0x0000563bb4f09e74 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x153108000db8, packet=<optimized out>, packet@entry=0x15310800b889 "SELECT * FROM t", packet_length=packet_length@entry=15, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_parse.cc:2401
#6  0x0000563bb4f0b3f8 in do_command (thd=0x153108000db8, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_parse.cc:1402
#7  0x0000563bb5085fc4 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x563bb8011de8, put_in_cache=put_in_cache@entry=true) at /test/10.9_dbg/sql/sql_connect.cc:1418
#8  0x0000563bb50865c9 in handle_one_connection (arg=arg@entry=0x563bb8011de8) at /test/10.9_dbg/sql/sql_connect.cc:1312
#9  0x0000563bb550cd67 in pfs_spawn_thread (arg=0x563bb7f24f48) at /test/10.9_dbg/storage/perfschema/pfs.cc:2201
#10 0x0000153194ea5609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#11 0x0000153194a93293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.2.42 (dbg), 10.3.33 (dbg), 10.4.23 (dbg), 10.5.14 (dbg), 10.6.6 (dbg), 10.7.2 (dbg), 10.8.1 (dbg), 10.9.0 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.42 (opt), 10.3.33 (opt), 10.4.23 (opt), 10.5.14 (opt), 10.6.6 (opt), 10.7.2 (opt), 10.8.1 (opt), 10.9.0 (opt)

Comment by Roel Van de Paar [ 2022-02-19 ]

Also please test any fixes with

SET GLOBAL aria_encrypt_tables=1;
SET sql_mode='';
CREATE TABLE t (i INT KEY) ENGINE=Aria;
INSERT INTO t VALUES (1);
INSERT INTO t VALUES (REPEAT (0,0));
LOAD INDEX INTO CACHE t,t2 KEY(PRIMARY,b) IGNORE LEAVES;
SELECT * FROM t;

Comment by Roel Van de Paar [ 2022-05-07 ]

SET GLOBAL aria_encrypt_tables=1;
CREATE TABLE t (a INT UNSIGNED,b INT,c CHAR(1),d CHAR(1),e VARCHAR(1),f VARCHAR(1),g BLOB,h BLOB,id INT,KEY(b),KEY(e)) ENGINE=Aria;
INSERT INTO t VALUES (0,0,0,0,0,0,0,0,0);
ALTER TABLE t ENGINE=InnoDB;
ALTER TABLE t CHANGE COLUMN g g BLOB;

10.9.0 0b14dbd45b5a1c02616d611876158d44b92b77bf (Debug)

2022-05-07 11:29:06 4 [ERROR] mysqld: Index for table 't' is corrupt; try to repair it
2022-05-07 11:29:07 4 [ERROR] mysqld: Table './test/t' is marked as crashed and should be repaired
2022-05-07 11:29:07 4 [Warning] Recovering table: './test/t'

And

SET GLOBAL aria_encrypt_tables=1;
CREATE TABLE t (id CHAR(1),VALUE CHAR(1),KEY(id)) ENGINE=Aria;
INSERT INTO t VALUES (0,0),(0,0);
ALTER TABLE t CHANGE COLUMN b b CHAR(1);
ANALYZE TABLE t;
INSERT INTO t VALUES (0);

10.9.0 0b14dbd45b5a1c02616d611876158d44b92b77bf (Debug)

2022-05-07 11:39:32 4 [ERROR] mysqld: Table './test/t' is marked as crashed and should be repaired
2022-05-07 11:39:32 4 [Warning] Recovering table: './test/t'

10.9.0 0b14dbd45b5a1c02616d611876158d44b92b77bf (Debug)

10.9.0-dbg>ANALYZE TABLE t;
+--------+---------+----------+------------------------------------------------+
| Table  | Op      | Msg_type | Msg_text                                       |
+--------+---------+----------+------------------------------------------------+
| test.t | analyze | error    | Wrong base information on indexpage at page: 1 |
| test.t | analyze | error    | Corrupt                                        |
+--------+---------+----------+------------------------------------------------+
2 rows in set (0.002 sec)

Comment by Roel Van de Paar [ 2022-06-04 ]

This bug keeps affecting tests with 1) regularly new crashes in different locations, 2) those crashes will be filtered, thereby potentially masking other bugs. A fix would be appreciated.

Comment by Roel Van de Paar [ 2022-06-04 ]

SET sql_mode='';
SET SESSION enforce_storage_engine=Aria;
CREATE TABLE tm1 (c INT);
SET GLOBAL aria_encrypt_tables=1;
CREATE TRIGGER tm1_ai AFTER INSERT ON tm1 FOR EACH ROW INSERT INTO t VALUES (1);
CREATE TABLE t3 (id INT KEY);
INSERT INTO t3 VALUES();
DROP DATABASE test;

Leads to:

10.10.0 081a284712bb661349e2e3802077b12211cede3e (Debug)

mysqld: /test/10.10_dbg/sql/sql_trigger.cc:1648: static bool Table_triggers_list::check_n_load(THD*, const LEX_CSTRING*, const LEX_CSTRING*, TABLE*, bool): Assertion `!parse_error || lex.sphead == 0' failed.

10.10.0 081a284712bb661349e2e3802077b12211cede3e (Debug)

Core was generated by `/test/MD310522-mariadb-10.10.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
[Current thread is 1 (Thread 0x146e2b5fb700 (LWP 774221))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x0000146e4fd65859 in __GI_abort () at abort.c:79
#2  0x0000146e4fd65729 in __assert_fail_base (fmt=0x146e4fefb588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x559f64566cf8 "!parse_error || lex.sphead == 0", file=0x559f645666b0 "/test/10.10_dbg/sql/sql_trigger.cc", line=1648, function=<optimized out>) at assert.c:92
#3  0x0000146e4fd76fd6 in __GI___assert_fail (assertion=assertion@entry=0x559f64566cf8 "!parse_error || lex.sphead == 0", file=file@entry=0x559f645666b0 "/test/10.10_dbg/sql/sql_trigger.cc", line=line@entry=1648, function=function@entry=0x559f64566c88 "static bool Table_triggers_list::check_n_load(THD*, const LEX_CSTRING*, const LEX_CSTRING*, TABLE*, bool)") at assert.c:101
#4  0x0000559f63a4d693 in Table_triggers_list::check_n_load (thd=thd@entry=0x146dc8000db8, db=db@entry=0x146e2b5f8f70, table_name=table_name@entry=0x146e2b5f8f80, table=table@entry=0x146e2b5f88b0, names_only=names_only@entry=true) at /test/10.10_dbg/sql/sql_trigger.cc:1648
#5  0x0000559f63a4e242 in Table_triggers_list::drop_all_triggers (thd=thd@entry=0x146dc8000db8, db=db@entry=0x146e2b5f8f70, name=name@entry=0x146e2b5f8f80, MyFlags=MyFlags@entry=48) at /test/10.10_dbg/sql/sql_trigger.cc:2036
#6  0x0000559f63a2bd23 in mysql_rm_table_no_locks (thd=thd@entry=0x146dc8000db8, tables=tables@entry=0x146dc8013cf0, current_db=current_db@entry=0x146e2b5f9680, ddl_log_state=ddl_log_state@entry=0x146e2b5f96a0, if_exists=if_exists@entry=true, drop_temporary=drop_temporary@entry=false, drop_view=true, drop_sequence=false, dont_log_query=true, dont_free_locks=false) at /test/10.10_dbg/sql/sql_table.cc:1727
#7  0x0000559f63905dda in mysql_rm_db_internal (thd=0x146dc8000db8, db=0x146dc8005c88, if_exists=<optimized out>, silent=silent@entry=false) at /test/10.10_dbg/sql/sql_db.cc:1124
#8  0x0000559f63906686 in mysql_rm_db (thd=thd@entry=0x146dc8000db8, db=db@entry=0x146dc8005c88, if_exists=<optimized out>) at /test/10.10_dbg/sql/sql_db.cc:1309
#9  0x0000559f63967325 in mysql_execute_command (thd=thd@entry=0x146dc8000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.10_dbg/sql/structs.h:569
#10 0x0000559f63951e3a in mysql_parse (thd=thd@entry=0x146dc8000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x146e2b5fa470) at /test/10.10_dbg/sql/sql_parse.cc:8036
#11 0x0000559f6395f422 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x146dc8000db8, packet=packet@entry=0x146dc800b6d9 "DROP DATABASE test", packet_length=packet_length@entry=18, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_class.h:1364
#12 0x0000559f63961b2c in do_command (thd=0x146dc8000db8, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_parse.cc:1407
#13 0x0000559f63ac13c0 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x559f66435fa8, put_in_cache=put_in_cache@entry=true) at /test/10.10_dbg/sql/sql_connect.cc:1418
#14 0x0000559f63ac18c9 in handle_one_connection (arg=0x559f66435fa8) at /test/10.10_dbg/sql/sql_connect.cc:1312
#15 0x0000146e50276609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#16 0x0000146e4fe62133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.4.26 (dbg), 10.5.17 (dbg), 10.6.9 (dbg), 10.7.5 (dbg), 10.8.4 (dbg), 10.9.2 (dbg), 10.10.0 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.36 (dbg), 10.3.36 (opt), 10.4.26 (opt), 10.5.17 (opt), 10.6.9 (opt), 10.7.5 (opt), 10.8.4 (opt), 10.9.2 (opt), 10.10.0 (opt)

Comment by Roel Van de Paar [ 2022-06-14 ]

SET GLOBAL aria_encrypt_tables=1;
CREATE TABLE t (c INT KEY,fk INT,INDEX index_fk (fk)) ENGINE=Aria PARTITION BY LIST (c) (PARTITION p VALUES IN (1,2));
INSERT INTO t VALUES (1,1);
ALTER TABLE t ADD COLUMN a INT;
SHOW CREATE TABLE t;

Leads to:

10.10.0 081a284712bb661349e2e3802077b12211cede3e (Debug)

Core was generated by `/test/MD310522-mariadb-10.10.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  show_create_table_ex (thd=thd@entry=0x14b384000db8, 
    table_list=table_list@entry=0x14b384013d00, force_db=force_db@entry=0x0, 
    force_name=force_name@entry=0x0, packet=packet@entry=0x14b3fc967f80, 
    create_info_arg=create_info_arg@entry=0x0, with_db_name=WITHOUT_DB_NAME)
    at /test/10.10_dbg/sql/sql_show.cc:2077
[Current thread is 1 (Thread 0x14b3fc96a700 (LWP 943612))]
(gdb) bt
#0  show_create_table_ex (thd=thd@entry=0x14b384000db8, table_list=table_list@entry=0x14b384013d00, force_db=force_db@entry=0x0, force_name=force_name@entry=0x0, packet=packet@entry=0x14b3fc967f80, create_info_arg=create_info_arg@entry=0x0, with_db_name=WITHOUT_DB_NAME) at /test/10.10_dbg/sql/sql_show.cc:2077
#1  0x0000562a6bfb4240 in show_create_table (thd=thd@entry=0x14b384000db8, table_list=table_list@entry=0x14b384013d00, packet=packet@entry=0x14b3fc967f80, create_info_arg=create_info_arg@entry=0x0, with_db_name=with_db_name@entry=WITHOUT_DB_NAME) at /test/10.10_dbg/sql/sql_show.cc:2029
#2  0x0000562a6bfb4cb7 in mysqld_show_create_get_fields (thd=thd@entry=0x14b384000db8, table_list=<optimized out>, table_list@entry=0x14b384013d00, field_list=field_list@entry=0x14b3fc967f60, buffer=buffer@entry=0x14b3fc967f80) at /test/10.10_dbg/sql/sql_show.cc:2675
#3  0x0000562a6bfb5c46 in mysqld_show_create (thd=thd@entry=0x14b384000db8, table_list=table_list@entry=0x14b384013d00) at /test/10.10_dbg/sql/sql_show.cc:1323
#4  0x0000562a6bf13fd3 in mysql_execute_command (thd=thd@entry=0x14b384000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.10_dbg/sql/sql_parse.cc:4367
#5  0x0000562a6bf00e3a in mysql_parse (thd=thd@entry=0x14b384000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14b3fc969470) at /test/10.10_dbg/sql/sql_parse.cc:8036
#6  0x0000562a6bf0e422 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14b384000db8, packet=packet@entry=0x14b38400b6d9 "SHOW CREATE TABLE t", packet_length=packet_length@entry=19, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_class.h:1364
#7  0x0000562a6bf10b2c in do_command (thd=0x14b384000db8, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_parse.cc:1407
#8  0x0000562a6c0703c0 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x562a6f35dfa8, put_in_cache=put_in_cache@entry=true) at /test/10.10_dbg/sql/sql_connect.cc:1418
#9  0x0000562a6c0708c9 in handle_one_connection (arg=0x562a6f35dfa8) at /test/10.10_dbg/sql/sql_connect.cc:1312
#10 0x000014b42382d609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#11 0x000014b423419133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

10.4.26 ebbd5ef6e2902a51a46e47dbb8a8667593cb25e7 (Optimized)

Core was generated by `/test/MD310522-mariadb-10.4.26-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00005632a773af57 in show_create_table (thd=0x149780000c48, 
    table_list=0x14978000ff30, packet=0x1497be0a2ca0, create_info_arg=0x0, 
    with_db_name=WITHOUT_DB_NAME) at /test/10.4_opt/sql/sql_list.h:500
[Current thread is 1 (Thread 0x1497be0a6700 (LWP 943930))]
(gdb) bt
#0  0x00005632a773af57 in show_create_table (thd=0x149780000c48, table_list=0x14978000ff30, packet=0x1497be0a2ca0, create_info_arg=0x0, with_db_name=WITHOUT_DB_NAME) at /test/10.4_opt/sql/sql_list.h:500
#1  0x00005632a773caf1 in mysqld_show_create_get_fields (thd=thd@entry=0x149780000c48, table_list=<optimized out>, table_list@entry=0x14978000ff30, field_list=field_list@entry=0x1497be0a2c80, buffer=buffer@entry=0x1497be0a2ca0) at /test/10.4_opt/sql/sql_show.cc:1386
#2  0x00005632a773d138 in mysqld_show_create (thd=thd@entry=0x149780000c48, table_list=table_list@entry=0x14978000ff30) at /test/10.4_opt/sql/sql_show.cc:1425
#3  0x00005632a76caead in mysql_execute_command (thd=0x149780000c48) at /test/10.4_opt/sql/sql_parse.cc:4396
#4  0x00005632a76d01a2 in mysql_parse (thd=0x149780000c48, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_parse.cc:7995
#5  0x00005632a76d2b5a in dispatch_command (command=COM_QUERY, thd=0x149780000c48, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_class.h:1201
#6  0x00005632a76d46af in do_command (thd=0x149780000c48) at /test/10.4_opt/sql/sql_parse.cc:1378
#7  0x00005632a77bfdbe in do_handle_one_connection (connect=0x5632a9958188) at /test/10.4_opt/sql/sql_connect.cc:1420
#8  0x00005632a77bfe4d in handle_one_connection (arg=<optimized out>) at /test/10.4_opt/sql/sql_connect.cc:1316
#9  0x00001497dd00e609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#10 0x00001497dcbfa133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.3.36 (dbg), 10.3.36 (opt), 10.4.26 (dbg), 10.4.26 (opt), 10.5.17 (dbg), 10.5.17 (opt), 10.6.9 (dbg), 10.6.9 (opt), 10.7.5 (dbg), 10.7.5 (opt), 10.8.4 (dbg), 10.8.4 (opt), 10.9.2 (dbg), 10.9.2 (opt), 10.10.0 (dbg), 10.10.0 (opt)

SIGSEGV|show_create_table_ex|show_create_table|mysqld_show_create_get_fields|mysqld_show_create
SIGSEGV|show_create_table|mysqld_show_create_get_fields|mysqld_show_create|mysql_execute_command

Comment by Roel Van de Paar [ 2022-08-23 ]

SET GLOBAL aria_encrypt_tables=ON;
ALTER TABLE mysql.db DROP COLUMN delete_history_priv;

Leads to

10.11.0 bc563f1a4b0b38de3b41fd0f0d3d8b7f1aacbd8b (Optimized)

10.11.0-opt>ALTER TABLE mysql.db DROP COLUMN delete_history_priv;
ERROR 192 (HY000): Unknown key id 1 for ./mysql/#sql-alter-83e10-4. Can't continue!

10.11.0 bc563f1a4b0b38de3b41fd0f0d3d8b7f1aacbd8b (Optimized)

2022-08-23 10:05:25 4 [ERROR] mysqld: Unknown key id 1 for ./mysql/#sql-alter-83e10-4. Can't continue!
2022-08-23 10:05:25 4 [ERROR] mysqld: Unknown key id 1 for ./mysql/#sql-alter-83e10-4. Can't continue!
2022-08-23 10:05:25 4 [ERROR] mysqld: Got error '126 "Index is corrupted"' for './mysql/#sql-alter-83e10-4.MAI'

Comment by Roel Van de Paar [ 2022-08-29 ]

SET GLOBAL aria_encrypt_tables=1;
INSTALL PLUGIN Spider SONAME 'ha_spider.so';
CREATE TABLE t (a INT KEY,b CHAR(1)) ENGINE=Spider;
SET GLOBAL table_open_cache=FALSE;
DROP DATABASE test;

Leads to

10.6.10 75c416d3627650a5b43c70a8150292990206e3e0 (Optimized)

10.6.10-opt>SET GLOBAL table_open_cache=FALSE;
ERROR 192 (HY000): Unknown key id 1 for ./mysql/spider_tables. Can't continue!
10.6.10-opt>DROP DATABASE test;
ERROR 192 (HY000): Got error '192 "Table encrypted but decryption failed. This could be because correct encryption management plugin is not loaded, used encryptio"' for './mysql/spider_tables.MAI'

Comment by Roel Van de Paar [ 2022-09-10 ]

Delayed stack smashing and/or memory or data corruption on shutdown in check_pagecache_is_cleaned_up::

SET GLOBAL aria_encrypt_tables=ON;
CREATE TABLE t (a INT KEY,b INT,KEY(b)) ENGINE=Aria;
INSERT INTO t VALUES (4,0);
LOAD INDEX INTO CACHE t IGNORE LEAVES;
LOAD INDEX INTO CACHE t;
SHUTDOWN;

Leads to:

10.3.37 a1055ab35d29437b717e83b1a388eaa02901c42f (Debug)

mysqld: /test/10.3_dbg/storage/maria/ma_pagecache.c:1142: check_pagecache_is_cleaned_up: Assertion `pagecache->block_root[i].status == 0' failed.

10.3.37 a1055ab35d29437b717e83b1a388eaa02901c42f (Debug)

Core was generated by `/test/MD200822-mariadb-10.3.37-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGABRT, Aborted.
#0  0x0000148750c4c00b in ?? ()
[Current thread is 1 (LWP 3709280)]
(gdb) bt
#0  0x0000148750c4c00b in ?? ()
#1  0x0000000000087007 in ?? ()
#2  0x00005583e0250ad0 in __isoc99_fscanf@plt ()
#3  0x00001487fbad8000 in ?? ()
#4  0x00001486f000c1c0 in ?? ()
#5  0x00001486f000c225 in ?? ()
#6  0x00001486f000c1c0 in ?? ()
#7  0x00001486f000c1c0 in ?? ()
#8  0x00001486f000c252 in ?? ()
#9  0x00001486f000c2ec in ?? ()
#10 0x00001486f000c1c0 in ?? ()
#11 0x00001486f000c2ec in ?? ()
#12 0x0000000000000000 in ?? ()

10.11.0 bc563f1a4b0b38de3b41fd0f0d3d8b7f1aacbd8b (Debug)

mysqld: /test/10.11_dbg/storage/maria/ma_pagecache.c:1166: check_pagecache_is_cleaned_up: Assertion `pagecache->block_root[i].status == 0' failed.

10.11.0 bc563f1a4b0b38de3b41fd0f0d3d8b7f1aacbd8b (Debug)

Core was generated by `/test/MD190822-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGABRT, Aborted.
#0  0x0000148417ca600b in ?? ()
[Current thread is 1 (LWP 3698728)]
(gdb) bt
#0  0x0000148417ca600b in ?? ()
Backtrace stopped: Cannot access memory at address 0x7ffde1c6e160

When executing directly from the CLI we can also get this crash:

10.11.0 bc563f1a4b0b38de3b41fd0f0d3d8b7f1aacbd8b (Debug)

mysqld: /test/10.11_dbg/storage/maria/ma_pagecache.c:1166: check_pagecache_is_cleaned_up: Assertion `pagecache->block_root[i].status == 0' failed.

10.11.0 bc563f1a4b0b38de3b41fd0f0d3d8b7f1aacbd8b (Debug)

Core was generated by `/test/MD190822-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
[Current thread is 1 (Thread 0x1544a5eb3940 (LWP 180133))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00001544a608c859 in __GI_abort () at abort.c:79
#2  0x00001544a608c729 in __assert_fail_base (fmt=0x1544a6222588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55d544f1b7e0 "pagecache->block_root[i].status == 0", file=0x55d544f1ab10 "/test/10.11_dbg/storage/maria/ma_pagecache.c", line=1166, function=<optimized out>) at assert.c:92
#3  0x00001544a609dfd6 in __GI___assert_fail (assertion=assertion@entry=0x55d544f1b7e0 "pagecache->block_root[i].status == 0", file=file@entry=0x55d544f1ab10 "/test/10.11_dbg/storage/maria/ma_pagecache.c", line=line@entry=1166, function=function@entry=0x55d544f1c9e0 <__PRETTY_FUNCTION__.20505> "check_pagecache_is_cleaned_up") at assert.c:101
#4  0x000055d54466a0ff in check_pagecache_is_cleaned_up (pagecache=pagecache@entry=0x55d545f92f40 <maria_pagecache_var>) at /test/10.11_dbg/storage/maria/ma_pagecache.c:1166
#5  0x000055d54466a1cf in end_pagecache (pagecache=0x55d545f92f40 <maria_pagecache_var>, cleanup=cleanup@entry=1 '\001') at /test/10.11_dbg/storage/maria/ma_pagecache.c:1199
#6  0x000055d54467a995 in maria_end () at /test/10.11_dbg/storage/maria/ma_init.c:110
#7  0x000055d5446abac6 in maria_panic (flag=flag@entry=HA_PANIC_CLOSE) at /test/10.11_dbg/storage/maria/ma_panic.c:135
#8  0x000055d5446477da in maria_hton_panic (hton=<optimized out>, flag=HA_PANIC_CLOSE) at /test/10.11_dbg/storage/maria/ha_maria.cc:3499
#9  0x000055d5444229a7 in ha_finalize_handlerton (plugin=0x55d54782e3a0) at /test/10.11_dbg/sql/handler.cc:596
#10 0x000055d544154f76 in plugin_deinitialize (plugin=0x55d54782e3a0, ref_check=ref_check@entry=true) at /test/10.11_dbg/sql/sql_plugin.cc:1269
#11 0x000055d544158e55 in reap_plugins () at /test/10.11_dbg/sql/sql_plugin.cc:1343
#12 0x000055d544159938 in plugin_shutdown () at /test/10.11_dbg/sql/sql_plugin.cc:2051
#13 0x000055d543ffe2c0 in clean_up (print_message=print_message@entry=true) at /test/10.11_dbg/sql/mysqld.cc:1988
#14 0x000055d54400a6c6 in mysqld_main (argc=<optimized out>, argv=<optimized out>) at /test/10.11_dbg/sql/mysqld.cc:5940
#15 0x000055d543ffdb76 in main (argc=<optimized out>, argv=<optimized out>) at /test/10.11_dbg/sql/main.cc:34

Bug confirmed present in:
MariaDB: 10.3.37 (dbg), 10.4.27 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.2 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.37 (opt), 10.4.27 (opt), 10.5.18 (dbg), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.2 (opt), 10.10.2 (opt), 10.11.0 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)

Comment by Roel Van de Paar [ 2022-10-01 ]

Please also test fix with these testcases. Thank you.

SET sql_mode='';
SET GLOBAL aria_encrypt_tables=1;
SET default_storage_engine=Aria;
CREATE TABLE t (c INT,c2 BINARY (1),c3 INT(1),c4 BINARY (1) KEY,c5 INT UNIQUE KEY,c6 NUMERIC(0,0) DEFAULT 3);
INSERT INTO t (c) VALUES (1),(1),(1),(1),(1);
ALTER TABLE t ADD armscii8_f CHAR(1) CHARACTER SET armscii8;
# [ERROR] mysqld: Got error '126 "Index is corrupted"' for './test/#sql-alter-268b58-4.MAI'

And

SET GLOBAL aria_encrypt_tables=1;
CREATE TABLE t (a INT KEY) ENGINE=Aria;
INSERT INTO t VALUES (1);
CHECK TABLE t quick;

And

SET GLOBAL aria_encrypt_tables=ON;
INSTALL PLUGIN Spider SONAME 'ha_spider.so';
CREATE TABLE t0 (a INT,b INT UNSIGNED,c CHAR(0),d CHAR(0),e VARCHAR(0),f BINARY (0),g BLOB,h BLOB,id INT,KEY(b),KEY(e)) ENGINE=Spider;
SET GLOBAL aria_checkpoint_INTERVAL=0;
DROP TABLE t_0;

Comment by Roel Van de Paar [ 2022-11-01 ]

This testcase:

SET GLOBAL aria_encrypt_tables=1;
SET SESSION storage_engine=Aria;
CREATE TABLE t (c INT KEY,c2 CHAR(1),c3 TIMESTAMP);
CREATE TRIGGER t_cnt_b BEFORE UPDATE ON t FOR EACH ROW UPDATE t SET cnt=cnt;
INSERT INTO t (c) VALUES (1),(1),(1),(1),(1);
LOCK TABLES t WRITE,t AS t0 READ;
SET STATEMENT sql_mode=''FOR ALTER TABLE t CHANGE c c FLOAT(0,0) UNSIGNED,CHANGE c2 c2 FLOAT(0,0) SIGNED;

Crashes only 10.10 and 10.11:

10.11.1 50c5743adc87e1cdec1431a02558f6540fe5a6d5 (Debug)

mysqld: /test/10.11_dbg/sql/sql_trigger.cc:1658: static bool Table_triggers_list::check_n_load(THD*, const LEX_CSTRING*, const LEX_CSTRING*, TABLE*, bool, uint): Assertion `!parse_error || lex.sphead == 0' failed.

10.11.1 50c5743adc87e1cdec1431a02558f6540fe5a6d5 (Debug)

Core was generated by `/test/MD221022-mariadb-10.11.1-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
[Current thread is 1 (Thread 0x146354069700 (LWP 275768))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x000014636ec0e859 in __GI_abort () at abort.c:79
#2  0x000014636ec0e729 in __assert_fail_base (fmt=0x14636eda4588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55db970a3e70 "!parse_error || lex.sphead == 0", file=0x55db970a3858 "/test/10.11_dbg/sql/sql_trigger.cc", line=1658, function=<optimized out>) at assert.c:92
#3  0x000014636ec1ffd6 in __GI___assert_fail (assertion=assertion@entry=0x55db970a3e70 "!parse_error || lex.sphead == 0", file=file@entry=0x55db970a3858 "/test/10.11_dbg/sql/sql_trigger.cc", line=line@entry=1658, function=function@entry=0x55db970a3e00 "static bool Table_triggers_list::check_n_load(THD*, const LEX_CSTRING*, const LEX_CSTRING*, TABLE*, bool, uint)") at assert.c:101
#4  0x000055db965bb3bb in Table_triggers_list::check_n_load (thd=thd@entry=0x1462c4000d48, db=db@entry=0x1462c4029ff0, table_name=table_name@entry=0x1462c402a000, table=table@entry=0x1462c4029bf8, names_only=names_only@entry=false, flags=flags@entry=0) at /test/10.11_dbg/sql/sql_trigger.cc:1658
#5  0x000055db9644a433 in open_table_entry_fini (entry=0x1462c4029bf8, share=0x1462c4029ff0, thd=0x1462c4000d48) at /test/10.11_dbg/sql/sql_base.cc:3158
#6  open_table (thd=thd@entry=0x1462c4000d48, table_list=table_list@entry=0x1462c40a1a40, ot_ctx=ot_ctx@entry=0x146354067bf0) at /test/10.11_dbg/sql/sql_base.cc:2203
#7  0x000055db9644af34 in Locked_tables_list::reopen_tables (this=this@entry=0x1462c4004da0, thd=thd@entry=0x1462c4000d48, need_reopen=need_reopen@entry=true) at /test/10.11_dbg/sql/sql_base.cc:2866
#8  0x000055db964d7aa0 in mysql_execute_command (thd=thd@entry=0x1462c4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:6031
#9  0x000055db964bff90 in mysql_parse (thd=thd@entry=0x1462c4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x146354068300) at /test/10.11_dbg/sql/sql_parse.cc:8023
#10 0x000055db964cd4ac in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1462c4000d48, packet=packet@entry=0x1462c400af09 "", packet_length=packet_length@entry=104, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1346
#11 0x000055db964cf8f4 in do_command (thd=0x1462c4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
#12 0x000055db9662c067 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55db99ad26b8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
#13 0x000055db9662c536 in handle_one_connection (arg=0x55db99ad26b8) at /test/10.11_dbg/sql/sql_connect.cc:1318
#14 0x000014636f11f609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#15 0x000014636ed0b133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment by Roel Van de Paar [ 2023-01-13 ]

This testcase:

# mysqld options required for replay:  --sql_mode= --binlog_format=ROW
SET GLOBAL aria_encrypt_tables=1;
SET SESSION enforce_storage_engine=Aria;
CREATE TABLE t (c INT KEY);
INSERT INTO t VALUES (1),(1),(1),(1),(1),(1),(1),(1),(1),(1);
ALTER TABLE t CHANGE COLUMN a b BINARY;
DELETE FROM t;
DELETE FROM t;

Produces an error where the error message seems partially cut off', i.e. "encryptio":

11.0.1 b075191ba8598af6aff5549e6e19f6255aef258a (Debug)

11.0.1-dbg>DELETE FROM t;
ERROR 192 (HY000): Got error '192 "Table encrypted but decryption failed. This could be because correct encryption management plugin is not loaded, used encryptio"' for './test/t.MAI'

Error log shows the same issue:

11.0.1 b075191ba8598af6aff5549e6e19f6255aef258a (Debug)

2023-01-13 18:55:31 4 [ERROR] mysqld: Unknown key id 1 for ./test/t. Can't continue!
2023-01-13 18:55:31 4 [ERROR] mysqld: Got error '192 "Table encrypted but decryption failed. This could be because correct encryption management plugin is not loaded, used encryptio"' for './test/t.MAI'
2023-01-13 18:55:31 4 [ERROR] mysqld: Index for table 't' is corrupt; try to repair it
2023-01-13 18:55:31 4 [ERROR] mysqld: Index for table 't' is corrupt; try to repair it

What is also interesting here is that the error log shows:

11.0.1 b075191ba8598af6aff5549e6e19f6255aef258a (Debug)

2023-01-13 19:11:41 0 [Warning] You need to use --log-bin to make --binlog-format work.

However, only --binlog-format is required for the testcase, and --log-bin is not (and the server shows it as turned off).

Comment by Michael Widenius [ 2023-03-16 ]

The reason for all the failures is that we are enabling encryption for Aria but not providing any keys.
This causes a crash when reading or writing to the table.

Fixed by checking if encryption keys exists before creating the table.
This fixes all the reported test cases

Comment by Michael Widenius [ 2023-05-03 ]

The reason for the MDEV reported failures is that the tests are enabling
encryption for Aria but not providing any encryption keys.

Fixed by checking if encryption keys exists before creating the table.

Other things:

  • maria.encrypt_wrong-key changed as we now get the error on CREATE
    instead during insert.
Generated at Thu Feb 08 09:43:56 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.