[MDEV-30826] Invalid data on mysql.host segfaults the server after an upgrade to 10.4 Created: 2023-03-10  Updated: 2023-03-11  Resolved: 2023-03-11

Status: Closed
Project: MariaDB Server
Component/s: Authentication and Privilege System
Affects Version/s: 10.4.28
Fix Version/s: 10.11.3, 10.4.29, 10.5.20, 10.6.13, 10.8.8, 10.9.6, 10.10.4

Type: Bug Priority: Major
Reporter: Jean Weisbuch Assignee: Sergei Golubchik
Resolution: Fixed Votes: 0
Labels: None
Environment:

Debian 10 amd64


Issue Links:
Duplicate
duplicates MDEV-22580 MariaDB crashes on startup Closed
Relates
relates to MDEV-25515 Request: User Account Host Names usin... Open

 Description   

On a server that has a quite old datadir (probably dates back at least to 5.5), upgrading from 10.3.38 to 10.4.28 resulted in mysqld doing a segfault / crash with signal 11 with this backtrace on the error log :

Thread pointer: 0x562278421b08
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7ffe5c9c1248 thread_stack 0x49000
/usr/sbin/mysqld(my_print_stacktrace+0x2e)[0x5622692faf8e]
/usr/sbin/mysqld(handle_fatal_signal+0x54d)[0x562268dca99d]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x12730)[0x7f0c70c52730]
/usr/sbin/mysqld(+0x63307a)[0x562268b5207a]
/usr/sbin/mysqld(_Z10acl_reloadP3THD+0x678)[0x562268b5cba8]
/usr/sbin/mysqld(_Z8acl_initb+0x133)[0x562268b5df13]
/usr/sbin/mysqld(_Z11mysqld_mainiPPc+0x8f0)[0x562268b20e80]
csu/libc-start.c:342(__libc_start_main)[0x7f0c7079609b]
/usr/sbin/mysqld(_start+0x2a)[0x562268b14a6a]

After running the process on gdb (i haven't been able to produce a core file, not sure why), the backtrace revealed that it was crashing on the function get_magic_sort being called from acl_load which was reading the mysql.host table (i removed the optimized out variables) :

Thread 1 "mysqld" received signal SIGSEGV, Segmentation fault.
0x0000555555b9222a in get_magic_sort (templ=0x555556410e5c "d", templ@entry=0x555556410e5b "hd") at ./sql/sql_acl_getsort.ic:160
160	./sql/sql_acl_getsort.ic: No such file or directory.
(gdb) bt full
#0  0x0000555555b9222a in get_magic_sort (templ=0x555556410e5c "d", templ@entry=0x555556410e5b "hd") at ./sql/sql_acl_getsort.ic:160
        pat = 0x0
        sort = 0
        args = {{gp_offset = 24, fp_offset = 0, overflow_arg_area = 0x7fffffffdd40, reg_save_area = 0x7fffffffdcd8}}
#1  0x0000555555b9eae0 in acl_load (tables=..., thd=0x555564623758) at ./sql/sql_acl.cc:2442
        host = {<ACL_ACCESS> = {sort = 0, access = 31931455}, host = {hostname = 0x555564665760 "10.1.0.0/255.255.0.0", ip = 167837696, ip_mask = 4294901760}, db = 0x0}
        read_record_info = {table = 0x555564637bc8, unlock_row = 0x555555c44f60 <rr_unlock_row(st_join_table*)>, read_record_func = 0x555555f3d850 <rr_sequential(READ_RECORD*)>, thd = 0x555564623758, select = 0x0, ref_length = 7, reclength = 0, rec_cache_size = 0, error_offset = 0, ref_pos = 0x0, rec_buf = 0x0, cache = 0x0, cache_pos = 0x0, cache_end = 0x0, read_positions = 0x0, addon_field = 0x0, io_cache = 0x0, print_error = true, unpack = 0x0, copy_field = 0x0, 
          copy_field_end = 0x0}
        tmp_name = "`ZbdUU\000\000\000\207\033\221 AF\373\000\004\000\000\000\000\000\000X\nZdUU\000\000\020\000\001\000\000\000\000\000\b\004\000\000\000\000\000\000 \342\377\377\377\177\000\000d\334\063VUU\000\000X7bdUU\000\000\030\352\266VUU\000\000h\225bdUU\000\000H\224bdUU\000\000\320\342\377\377\377\177\000\000\327\212\275UUU\000\000\230\223bdUU\000\000 sbdUU\000\000\370pbdUU\000\000\330RbdUU\000\000\240\070bdUU\000\000\b\232bdUU\000\000(\222bdUU\000\000\000\000\000\000\000\000\000\000\370<bdUU\000\000\320<bdUU\000\000\350SbdUU\000\000("...
        host_table = @0x7fffffffe160: {<Grant_table_base> = {min_columns = 8, start_priv_columns = 2, end_priv_columns = 20, m_table = 0x555564637bc8}, <No data fields>}

So i did copy the myisam files for the table mysql.host to another server and the content did look like this :

*************************** 1. row ***************************
                 Host: 10.1.0.0/255.255.0.0
                   Db: 
          Select_priv: Y
          Insert_priv: Y
          Update_priv: Y
          Delete_priv: Y
          Create_priv: Y
            Drop_priv: Y
           Grant_priv: Y
      References_priv: Y
           Index_priv: Y
           Alter_priv: Y
Create_tmp_table_priv: Y
     Lock_tables_priv: Y
     Create_view_priv: Y
       Show_view_priv: Y
  Create_routine_priv: Y
   Alter_routine_priv: Y
         Execute_priv: Y
         Trigger_priv: N
*************************** 2. row ***************************
                 Host: 10.5.0.0/255.255.0.0
                   Db: 
          Select_priv: Y
          Insert_priv: Y
          Update_priv: Y
          Delete_priv: Y
          Create_priv: Y
            Drop_priv: Y
           Grant_priv: Y
      References_priv: Y
           Index_priv: Y
           Alter_priv: Y
Create_tmp_table_priv: Y
     Lock_tables_priv: Y
     Create_view_priv: Y
       Show_view_priv: Y
  Create_routine_priv: Y
   Alter_routine_priv: Y
         Execute_priv: Y
         Trigger_priv: N
*************************** 3. row ***************************
                 Host: 10.8.1.0/255.255.255.0
                   Db: 
          Select_priv: Y
          Insert_priv: Y
          Update_priv: Y
          Delete_priv: Y
          Create_priv: Y
            Drop_priv: Y
           Grant_priv: Y
      References_priv: Y
           Index_priv: Y
           Alter_priv: Y
Create_tmp_table_priv: Y
     Lock_tables_priv: Y
     Create_view_priv: Y
       Show_view_priv: Y
  Create_routine_priv: Y
   Alter_routine_priv: Y
         Execute_priv: Y
         Trigger_priv: N

Those entries are at least 4 or 5 years old (probably more) as those IP ranges are not in use anymore and have survived several MariaDB major version upgrade.

I assume it's the empty "Db" column that is not valid so i did copy the empty host table from the server i was on to the crashing one and it did fix it.



 Comments   
Comment by Alice Sherepa [ 2023-03-10 ]

Thank you for the report!
I repeated on 10.4-
to repeat:
on 10.3 "insert into mysql.host values('10.5.0.0/255.255.0.0','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','N')"
then start 10.4 with --datadir=(path to 10.3datadir)

230310 17:31:44 [ERROR] mysqld got signal 11 ;
 
Server version: 10.4.29-MariaDB-debug-log source revision: 99ee200b8bc8d76469249a828b642f3a1efee2de
 
mysys/stacktrace.c:174(my_print_stacktrace)[0x5636de7682bf]
sql/signal_handler.cc:234(handle_fatal_signal)[0x5636dd3243a2]
sigaction.c:0(__restore_rt)[0x7fe3aa0c2420]
sql/sql_acl_getsort.ic:174(get_magic_sort(char const*, ...))[0x5636dc96514d]
sql/sql_acl.cc:2442(acl_load(THD*, Grant_tables const&))[0x5636dc968bc4]
sql/sql_acl.cc:2784(acl_reload(THD*))[0x5636dc96bd2b]
sql/sql_acl.cc:2368(acl_init(bool))[0x5636dc96816d]
sql/mysqld.cc:5801(mysqld_main(int, char**))[0x5636dc883d95]
sql/main.cc:25(main)[0x5636dc86ae3d]

Generated at Thu Feb 08 10:19:11 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.