[MDEV-26396] SIGSEGV in __strcmp_avx2|st_select_lex::add_table_to_list Created: 2021-08-18  Updated: 2022-05-04

Status: Open
Project: MariaDB Server
Component/s: None
Affects Version/s: 10.2
Fix Version/s: 10.2

Type: Bug Priority: Major
Reporter: Ramesh Sivaraman Assignee: Sergei Petrunia
Resolution: Unresolved Votes: 0
Labels: None


 Description   

The crash is from galera multi-master pquery run.

10.2.41

 
Core was generated by `/test/mtest/GAL_MD170821-mariadb-10.2.41-linux-x86_64-dbg/bin/mysqld --defaults'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  0x0000000070000002 in ?? ()
 
[Current thread is 1 (Thread 0x7ffdaf7dc700 (LWP 2333010))]
 
(gdb) bt
 
#0  0x0000000070000002 in ?? ()
 
#1  0x000076cb45b2e766 in _raw_syscall () at /home/roc/rr/rr/src/preload/raw_syscall.S:120
 
#2  0x000076cb45b2a04e in traced_raw_syscall (call=<optimized out>) at /home/roc/rr/rr/src/preload/syscallbuf.c:272
 
#3  0x000076cb45b2d4d1 in syscall_hook_internal (call=0x14ca37ffffa0) at /home/roc/rr/rr/src/preload/syscallbuf.c:3295
 
#4  syscall_hook (call=0x14ca37ffffa0) at /home/roc/rr/rr/src/preload/syscallbuf.c:3329
 
#5  0x000076cb45b29e50 in _syscall_hook_trampoline () at /home/roc/rr/rr/src/preload/syscall_hook.S:313
 
#6  0x000076cb45b29eaf in __morestack () at /home/roc/rr/rr/src/preload/syscall_hook.S:458
 
#7  0x000076cb45b29f08 in _syscall_hook_trampoline_89_c2_f7_da () at /home/roc/rr/rr/src/preload/syscall_hook.S:504
 
#8  0x0000150b29d0cf0c in __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
 
#9  0x00005609dba45fe2 in my_write_core (sig=sig@entry=11) at /test/mtest/10.2_dbg/mysys/stacktrace.c:382
 
#10 0x00005609db3367b3 in handle_fatal_signal (sig=11) at /test/mtest/10.2_dbg/sql/signal_handler.cc:355
 
#11 <signal handler called>
 
#12 __strcmp_avx2 () at ../sysdeps/x86_64/multiarch/strcmp-avx2.S:101
 
#13 0x00005609db125858 in st_select_lex::add_table_to_list (this=this@entry=0x14ca38006778, thd=thd@entry=0x14ca38002430, table=<optimized out>, alias=<optimized out>, table_options=<optimized out>, lock_type=lock_type@entry=TL_READ_DEFAULT, mdl_type=<optimized out>, index_hints_arg=<optimized out>, partition_names=<optimized out>, option=<optimized out>) at /test/mtest/10.2_dbg/sql/sql_parse.cc:8037
 
#14 0x00005609db2ebc9f in MYSQLparse (thd=thd@entry=0x14ca38002430) at /test/mtest/10.2_dbg/sql/sql_lex.h:1116
 
#15 0x00005609db134225 in parse_sql (thd=thd@entry=0x14ca38002430, parser_state=parser_state@entry=0x7ffdaf7db540, creation_ctx=creation_ctx@entry=0x0, do_pfs_digest=do_pfs_digest@entry=true) at /test/mtest/10.2_dbg/sql/sql_parse.cc:10101
 
#16 0x00005609db134619 in mysql_parse (thd=thd@entry=0x14ca38002430, rawbuf=rawbuf@entry=0x14ca39a892d8 "explain with t as (select a FROM t1  where b >= 'c') select t1.b FROM t1 ,t1 where t1.a = t2.c", length=length@entry=94, parser_state=parser_state@entry=0x7ffdaf7db540, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/mtest/10.2_dbg/sql/sql_parse.cc:7746
 
#17 0x00005609db135e12 in wsrep_mysql_parse (thd=thd@entry=0x14ca38002430, rawbuf=0x14ca39a892d8 "explain with t as (select a FROM t1  where b >= 'c') select t1.b FROM t1 ,t1 where t1.a = t2.c", length=94, parser_state=parser_state@entry=0x7ffdaf7db540, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/mtest/10.2_dbg/sql/sql_parse.cc:7585
 
#18 0x00005609db13736b in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14ca38002430, packet=packet@entry=0x14ca3800a101 "explain with t as (select a FROM t1  where b >= 'c') select t1.b FROM t1 ,t1 where t1.a = t2.c;", packet_length=packet_length@entry=95, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/mtest/10.2_dbg/sql/sql_class.h:1109
 
#19 0x00005609db13a14a in do_command (thd=0x14ca38002430) at /test/mtest/10.2_dbg/sql/sql_parse.cc:1381
 
#20 0x00005609db2401b1 in do_handle_one_connection (connect=connect@entry=0x265f392c8370) at /test/mtest/10.2_dbg/sql/sql_connect.cc:1336
 
#21 0x00005609db2403dc in handle_one_connection (arg=0x265f392c8370) at /test/mtest/10.2_dbg/sql/sql_connect.cc:1241
 
#22 0x0000150b29d04609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#23 0x00005631401a1293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95



 Comments   
Comment by Ramesh Sivaraman [ 2022-05-04 ]

Reproducible test case

WITH t (f) as (SELECT * FROM t1 WHERE b='') SELECT t1.b FROM t1,t1 WHERE t1.a=t2.c;

Leads to:

10.2.44 (Debug)

 
Core was generated by `/test/GAL_MD040522-mariadb-10.2.44-linux-x86_64-dbg/bin/mysqld --defaults-file='.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
 
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
 
[Current thread is 1 (Thread 0x14a5f464a700 (LWP 1800731))]
 
(gdb) bt
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
 
#1  0x00005623dcdf9c14 in my_write_core (sig=sig@entry=11) at /test/mtest/10.2_dbg/mysys/stacktrace.c:382
 
#2  0x00005623dc6ea1ff in handle_fatal_signal (sig=11) at /test/mtest/10.2_dbg/sql/signal_handler.cc:355
 
#3  <signal handler called>
 
#4  __strcmp_avx2 () at ../sysdeps/x86_64/multiarch/strcmp-avx2.S:101
 
#5  0x00005623dc4d8f98 in st_select_lex::add_table_to_list (this=this@entry=0x14a5940050d8, thd=thd@entry=0x14a594000d90, table=<optimized out>, alias=<optimized out>, table_options=<optimized out>, lock_type=lock_type@entry=TL_READ_DEFAULT, mdl_type=<optimized out>, index_hints_arg=<optimized out>, partition_names=<optimized out>, option=<optimized out>) at /test/mtest/10.2_dbg/sql/sql_parse.cc:8037
 
#6  0x00005623dc69f6c0 in MYSQLparse (thd=thd@entry=0x14a594000d90) at /test/mtest/10.2_dbg/sql/sql_lex.h:1116
 
#7  0x00005623dc4e7afb in parse_sql (thd=thd@entry=0x14a594000d90, parser_state=parser_state@entry=0x14a5f4649540, creation_ctx=creation_ctx@entry=0x0, do_pfs_digest=do_pfs_digest@entry=true) at /test/mtest/10.2_dbg/sql/sql_parse.cc:10137
 
#8  0x00005623dc4e7eef in mysql_parse (thd=thd@entry=0x14a594000d90, rawbuf=rawbuf@entry=0x14a5940112f0 "WITH t (f) as (SELECT * FROM t1 WHERE b='') SELECT t1.b FROM t1,t1 WHERE t1.a=t2.c", length=length@entry=82, parser_state=parser_state@entry=0x14a5f4649540, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/mtest/10.2_dbg/sql/sql_parse.cc:7746
 
#9  0x00005623dc4e96e8 in wsrep_mysql_parse (thd=thd@entry=0x14a594000d90, rawbuf=0x14a5940112f0 "WITH t (f) as (SELECT * FROM t1 WHERE b='') SELECT t1.b FROM t1,t1 WHERE t1.a=t2.c", length=82, parser_state=parser_state@entry=0x14a5f4649540, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/mtest/10.2_dbg/sql/sql_parse.cc:7585
 
#10 0x00005623dc4eac41 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14a594000d90, packet=packet@entry=0x14a5940195e1 "WITH t (f) as (SELECT * FROM t1 WHERE b='') SELECT t1.b FROM t1,t1 WHERE t1.a=t2.c", packet_length=packet_length@entry=82, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/mtest/10.2_dbg/sql/sql_class.h:1109
 
#11 0x00005623dc4eda23 in do_command (thd=0x14a594000d90) at /test/mtest/10.2_dbg/sql/sql_parse.cc:1381
 
#12 0x00005623dc5f3cfd in do_handle_one_connection (connect=connect@entry=0x5623e0232530) at /test/mtest/10.2_dbg/sql/sql_connect.cc:1336
 
#13 0x00005623dc5f3f28 in handle_one_connection (arg=0x5623e0232530) at /test/mtest/10.2_dbg/sql/sql_connect.cc:1241
 
#14 0x000014a6174c2609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#15 0x000014a6170b6293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Generated at Thu Feb 08 09:44:59 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.