[MDEV-29605] SIGSEGV in spider_db_ping on INSERT Created: 2022-09-22  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Storage Engine - Spider
Affects Version/s: 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11
Fix Version/s: 10.4, 10.5, 10.6

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Yuchen Pei
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-28683 Spider: SIGSEGV in spider_db_direct_d... Closed
relates to MDEV-29583 Disallow Spider self/dual/multi/cross... Closed
relates to MDEV-30580 Investigate whether self-/multi- refe... Open

 Description   

Whilst the bug here comes close to MDEV-29583, there are some differences, so logging as a separate issue.
Possibly also related/similar to MDEV-28683.

SET sql_mode='';
INSTALL PLUGIN Spider SONAME 'ha_spider.so';
CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
SET GLOBAL init_connect='dummy';
CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
XA START 'a';
INSERT INTO t VALUES (1);
SHOW CREATE TABLE t0;
SELECT * FROM t0 JOIN t0 a ON a=a;
INSERT INTO t0 VALUES (1);

Leads to:

10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)

Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, 
    conn=conn@entry=0x1488f408b3b8, link_idx=0)
    at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
[Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
(gdb) bt
#0  0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
#1  0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
#2  0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
#3  0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
#4  0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
#5  0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
#6  0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
#7  0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
#8  0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
#9  0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
#10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
#11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
#12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
#13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
#14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
#15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
#16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)



 Comments   
Comment by Roel Van de Paar [ 2022-09-28 ]

Additional interesting and shorter testcase, with slightly different stack:

INSTALL PLUGIN Spider SONAME 'ha_spider.so';
CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
SET unique_checks=0,foreign_key_checks=0,autocommit=0;
SET GLOBAL init_connect="dummy";
CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1;

Leads to:

10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)

Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000014baa23056ca in spider_db_ping (spider=0x14ba54073f70, 
    conn=conn@entry=0x14ba54082a78, link_idx=0)
    at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
[Current thread is 1 (Thread 0x14bab00ac700 (LWP 1722759))]
(gdb) bt
#0  0x000014baa23056ca in spider_db_ping (spider=0x14ba54073f70, conn=conn@entry=0x14ba54082a78, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
#1  0x000014baa230592b in spider_db_conn_queue_action (conn=conn@entry=0x14ba54082a78) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
#2  0x000014baa230dfa5 in spider_db_before_query (conn=conn@entry=0x14ba54082a78, need_mon=need_mon@entry=0x14bab00aa24c) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
#3  0x000014baa230e4e3 in spider_db_query (conn=0x14ba54082a78, query=query@entry=0x14baa23d0b48 "commit", length=length@entry=6, quick_mode=quick_mode@entry=-1, need_mon=need_mon@entry=0x14bab00aa24c) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:653
#4  0x000014baa2398d75 in spider_db_mbase::commit (this=0x14ba540836e0, need_mon=0x14bab00aa24c) at /test/10.11_dbg/storage/spider/spd_db_mysql.cc:2555
#5  0x000014baa230701b in spider_db_commit (conn=conn@entry=0x14ba54082a78) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:1132
#6  0x000014baa230050f in spider_commit (hton=0x14ba54038f18, thd=0x14ba54000d48, all=<optimized out>) at /test/10.11_dbg/storage/spider/spd_trx.cc:3179
#7  0x0000561e66bd4cc1 in commit_one_phase_2 (thd=thd@entry=0x14ba54000d48, all=all@entry=true, trans=trans@entry=0x14ba54004718, is_real_trans=true) at /test/10.11_dbg/sql/handler.cc:2068
#8  0x0000561e66bd4e9a in ha_commit_one_phase (thd=thd@entry=0x14ba54000d48, all=all@entry=true) at /test/10.11_dbg/sql/handler.cc:2021
#9  0x0000561e66be7031 in ha_commit_trans (thd=thd@entry=0x14ba54000d48, all=all@entry=true) at /test/10.11_dbg/sql/handler.cc:1815
#10 0x0000561e66a60c2b in trans_commit_implicit (thd=thd@entry=0x14ba54000d48) at /test/10.11_dbg/sql/transaction.cc:329
#11 0x0000561e668f05ee in mysql_execute_command (thd=thd@entry=0x14ba54000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:6096
#12 0x0000561e668d803c in mysql_parse (thd=thd@entry=0x14ba54000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14bab00ab330) at /test/10.11_dbg/sql/sql_parse.cc:8037
#13 0x0000561e668e566d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14ba54000d48, packet=packet@entry=0x14ba5400aed9 "CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER \"mysql\",srv \"srv\",TABLE \"t\"' AS SELECT 1", packet_length=packet_length@entry=86, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
#14 0x0000561e668e7d97 in do_command (thd=0x14ba54000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
#15 0x0000561e66a4bfb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x561e68ef08f8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
#16 0x0000561e66a4c4c3 in handle_one_connection (arg=0x561e68ef08f8) at /test/10.11_dbg/sql/sql_connect.cc:1318
#17 0x000014bac7938609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#18 0x000014bac7524133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.5.18 (opt), 10.6.10 (dbg), 10.6.10 (opt), 10.7.6 (dbg), 10.7.6 (opt), 10.8.5 (dbg), 10.8.5 (opt), 10.9.3 (dbg), 10.9.3 (opt), 10.10.0 (dbg), 10.10.0 (opt), 10.10.2 (dbg), 10.10.2 (opt), 10.11.0 (dbg), 10.11.0 (opt)

Generated at Thu Feb 08 10:09:54 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.