[MDEV-27893] SIGSEGV in replace_proxies_priv_table on GRANT PROXY Created: 2022-02-19  Updated: 2023-09-27

Status: Open
Project: MariaDB Server
Component/s: Authentication and Privilege System
Affects Version/s: 10.2, 10.3, 10.4, 10.5, 10.6, 10.7, 10.8, 10.9
Fix Version/s: 10.4, 10.5, 10.6

Type: Bug Priority: Minor
Reporter: Roel Van de Paar Assignee: Oleksandr Byelkin
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-28128 SIGSEGV in replace_column_table on GRANT Confirmed

 Description   

SET sql_mode='';
RENAME TABLE mysql.proxies_priv TO mysql.proxies_priv_bak;
CREATE TABLE mysql.proxies_priv ENGINE=InnoDB SELECT * FROM mysql.proxies_priv_bak;
GRANT PROXY ON grant_plug TO grant_plug_dest;

Leads to:

10.9.0 b5852ffbeebc3000982988383daeefb0549e058a (Debug)

Core was generated by `/test/MD140222-mariadb-10.9.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000055d315c60865 in replace_proxies_priv_table (revoke_grant=false, 
    with_grant_arg=false, proxied_user=0x151598013ea8, user=0x151598013f90, 
    table=0x15159809b818, thd=0x151598000db8)
    at /test/10.9_dbg/sql/sql_acl.cc:5130
[Current thread is 1 (Thread 0x151610063700 (LWP 2575339))]
(gdb) bt
#0  0x000055d315c60865 in replace_proxies_priv_table (revoke_grant=false, with_grant_arg=false, proxied_user=0x151598013ea8, user=0x151598013f90, table=0x15159809b818, thd=0x151598000db8) at /test/10.9_dbg/sql/sql_acl.cc:5130
#1  mysql_grant (thd=thd@entry=0x151598000db8, db=db@entry=0x0, list=@0x151598006060: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x151598013f18, last = 0x151598013f08, elements = 2}, <No data fields>}, rights=NO_ACL, revoke_grant=false, is_proxy=is_proxy@entry=true) at /test/10.9_dbg/sql/sql_acl.cc:7760
#2  0x000055d315c61b80 in Sql_cmd_grant_proxy::execute (this=0x151598013f28, thd=0x151598000db8) at /test/10.9_dbg/sql/sql_acl.h:317
#3  0x000055d315d1080e in mysql_execute_command (thd=thd@entry=0x151598000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.9_dbg/sql/sql_parse.cc:5988
#4  0x000055d315cf7315 in mysql_parse (thd=thd@entry=0x151598000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x151610062400) at /test/10.9_dbg/sql/sql_parse.cc:8027
#5  0x000055d315d05fb1 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x151598000db8, packet=packet@entry=0x15159800b889 "GRANT PROXY ON grant_plug TO grant_plug_dest", packet_length=packet_length@entry=44, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_class.h:1362
#6  0x000055d315d093f8 in do_command (thd=0x151598000db8, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_parse.cc:1402
#7  0x000055d315e83fc4 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55d31973b3d8, put_in_cache=put_in_cache@entry=true) at /test/10.9_dbg/sql/sql_connect.cc:1418
#8  0x000055d315e845c9 in handle_one_connection (arg=arg@entry=0x55d31973b3d8) at /test/10.9_dbg/sql/sql_connect.cc:1312
#9  0x000055d31630ad67 in pfs_spawn_thread (arg=0x55d31964e8a8) at /test/10.9_dbg/storage/perfschema/pfs.cc:2201
#10 0x000015161a7d6609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#11 0x000015161a3c4293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Stack for 10.5 and below is different:

10.5.14 059a8fd87eb900a5a12185b1963e5623df874c21 (Debug)

Core was generated by `/test/MD290122-mariadb-10.5.14-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000558b9719c57d in replace_proxies_priv_table (revoke_grant=false, 
    with_grant_arg=false, proxied_user=0x14b0dc013db8, user=0x14b0dc013ea0, 
    table=0x14b0dc08d328, thd=0x14b0dc000db8)
    at /test/10.5_dbg/sql/sql_acl.cc:5116
[Current thread is 1 (Thread 0x14b15cb76700 (LWP 2575868))]
(gdb) bt
#0  0x0000558b9719c57d in replace_proxies_priv_table (revoke_grant=false, with_grant_arg=false, proxied_user=0x14b0dc013db8, user=0x14b0dc013ea0, table=0x14b0dc08d328, thd=0x14b0dc000db8) at /test/10.5_dbg/sql/sql_acl.cc:5116
#1  mysql_grant (thd=thd@entry=0x14b0dc000db8, db=db@entry=0x0, list=@0x14b0dc005e18: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14b0dc013e28, last = 0x14b0dc013e18, elements = 2}, <No data fields>}, rights=NO_ACL, revoke_grant=false, is_proxy=is_proxy@entry=true) at /test/10.5_dbg/sql/sql_acl.cc:7745
#2  0x0000558b9719d7d0 in Sql_cmd_grant_proxy::execute (this=0x14b0dc013e38, thd=0x14b0dc000db8) at /test/10.5_dbg/sql/sql_acl.h:317
#3  0x0000558b97249301 in mysql_execute_command (thd=thd@entry=0x14b0dc000db8) at /test/10.5_dbg/sql/sql_parse.cc:6056
#4  0x0000558b9722ecfe in mysql_parse (thd=thd@entry=0x14b0dc000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14b15cb753d0, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:8100
#5  0x0000558b9723e551 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14b0dc000db8, packet=packet@entry=0x14b0dc00b4a9 "GRANT PROXY ON grant_plug TO grant_plug_dest", packet_length=packet_length@entry=44, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_class.h:1290
#6  0x0000558b97241dcd in do_command (thd=0x14b0dc000db8) at /test/10.5_dbg/sql/sql_parse.cc:1370
#7  0x0000558b9739e676 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x558b9aa89c38, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1418
#8  0x0000558b9739ed79 in handle_one_connection (arg=arg@entry=0x558b9aa89c38) at /test/10.5_dbg/sql/sql_connect.cc:1312
#9  0x0000558b97857da3 in pfs_spawn_thread (arg=0x558b9a9a9fd8) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
#10 0x000014b16850b609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#11 0x000014b1680f9293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (dbg), 10.3.33 (opt), 10.4.23 (dbg), 10.4.23 (opt), 10.5.14 (dbg), 10.5.14 (opt), 10.6.6 (dbg), 10.6.6 (opt), 10.7.2 (dbg), 10.7.2 (opt), 10.8.1 (dbg), 10.8.1 (opt), 10.9.0 (dbg), 10.9.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.36 (dbg), 5.7.36 (opt), 8.0.27 (dbg), 8.0.27 (opt)



 Comments   
Comment by Roel Van de Paar [ 2022-02-19 ]

UniqueID's seen thus far

SIGSEGV|replace_proxies_priv_table|mysql_grant|Sql_cmd_grant_proxy::execute|mysql_execute_command
SIGSEGV|replace_proxies_priv_table|mysql_grant|mysql_execute_command|mysql_parse

Comment by Oleksandr Byelkin [ 2023-09-27 ]

IMHO it is the same as MDEV-28128: i.e. lets destroy system table and crash the server

Comment by Oleksandr Byelkin [ 2023-09-27 ]

as far as people who has rights to write in mysql schema always has ability to prevent server from working I move it to minor

Generated at Thu Feb 08 09:56:24 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.