[MDEV-31849] SIGSEGV in Field::set_default | Field::save_in_field_default_value Created: 2023-08-04  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: None
Affects Version/s: 10.4, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2, 11.3
Fix Version/s: 10.4, 10.11, 11.0, 11.1

Type: Bug Priority: Major
Reporter: Ramesh Sivaraman Assignee: Dmitry Shulga
Resolution: Unresolved Votes: 0
Labels: None


 Description   

CREATE TEMPORARY TABLE t (i INT KEY,c INT) ENGINE=Aria row_format=COMPRESSED KEY_BLOCK_SIZE=8;
CREATE TABLE t (c INT);
INSERT INTO t VALUES (1,0),(2,0),(3,0),(4,0);
CREATE TABLE t (f INT) ENGINE=InnoDB;
INSERT INTO t SELECT * FROM t;
PREPARE s FROM 'SELECT * FROM t WHERE i=?';
EXECUTE s USING DEFAULT;

Leads to:

11.2.0 e81fa345020ec6a067583db6a7019d6404b26f93 (Debug)

Core was generated by `/test/MD270723-mariadb-11.2.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --cor'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __memmove_avx_unaligned_erms ()
    at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:319
[Current thread is 1 (Thread 0x150523bfd700 (LWP 4136307))]
(gdb) bt
#0  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:319
#1  0x000055b466e12202 in memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34
#2  Field::set_default (this=0x1504fc015398) at /test/11.2_dbg/sql/field.cc:2665
#3  0x000055b466e34e94 in Field::save_in_field_default_value (this=0x1504fc015398, view_error_processing=<optimized out>) at /test/11.2_dbg/sql/field.cc:11353
#4  0x000055b466e65974 in Item_param::save_in_field (this=<optimized out>, field=<optimized out>, no_conversions=<optimized out>) at /test/11.2_dbg/sql/table.h:2873
#5  0x000055b466bdb2af in store_key_item::copy_inner (this=this@entry=0x150523bfac20) at /test/11.2_dbg/sql/sql_select.h:2142
#6  0x000055b466b9d1de in store_key::copy (thd=0x1504fc000d48, this=0x150523bfac20) at /test/11.2_dbg/sql/sql_select.h:2035
#7  create_ref_for_key (join=join@entry=0x1504fc013478, j=j@entry=0x1504fc013d48, org_keyuse=org_keyuse@entry=0x1504fc014c88, allow_full_scan=allow_full_scan@entry=false, used_tables=<optimized out>) at /test/11.2_dbg/sql/sql_select.cc:13058
#8  0x000055b466bd01b9 in make_join_statistics (join=join@entry=0x1504fc013478, tables_list=@0x1504fc03cfb0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1504fc013c40, last = 0x1504fc013c40, elements = 1}, <No data fields>}, keyuse_array=keyuse_array@entry=0x1504fc0137e0) at /test/11.2_dbg/sql/sql_select.cc:5877
#9  0x000055b466bd850b in JOIN::optimize_inner (this=this@entry=0x1504fc013478) at /test/11.2_dbg/sql/sql_select.cc:2618
#10 0x000055b466bd89af in JOIN::optimize (this=this@entry=0x1504fc013478) at /test/11.2_dbg/sql/sql_select.cc:1944
#11 0x000055b466bd8acf in mysql_select (thd=thd@entry=0x1504fc000d48, tables=0x1504fc03d3b8, fields=@0x1504fc03d050: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1504fc03d370, last = 0x1504fc03ead8, elements = 2}, <No data fields>}, conds=0x1504fc03ddb0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2201187781376, result=0x1504fc03e840, unit=0x1504fc03b138, select_lex=0x1504fc03cd98) at /test/11.2_dbg/sql/sql_select.cc:5229
#12 0x000055b466bd92ce in handle_select (thd=thd@entry=0x1504fc000d48, lex=lex@entry=0x1504fc03b058, result=result@entry=0x1504fc03e840, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/11.2_dbg/sql/sql_select.cc:628
#13 0x000055b466b3e0da in execute_sqlcom_select (thd=thd@entry=0x1504fc000d48, all_tables=0x1504fc03d3b8) at /test/11.2_dbg/sql/sql_parse.cc:6056
#14 0x000055b466b4a43b in mysql_execute_command (thd=0x1504fc000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:3944
#15 0x000055b466b72073 in Prepared_statement::execute (this=this@entry=0x1504fc035698, expanded_query=expanded_query@entry=0x150523bfbcb0, open_cursor=open_cursor@entry=false) at /test/11.2_dbg/sql/sql_prepare.cc:5027
#16 0x000055b466b72415 in Prepared_statement::execute_loop (this=this@entry=0x1504fc035698, expanded_query=expanded_query@entry=0x150523bfbcb0, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/11.2_dbg/sql/sql_prepare.cc:4433
#17 0x000055b466b72a5f in mysql_sql_stmt_execute (thd=thd@entry=0x1504fc000d48) at /test/11.2_dbg/sql/sql_prepare.cc:3470
#18 0x000055b466b4a498 in mysql_execute_command (thd=thd@entry=0x1504fc000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/11.2_dbg/sql/sql_parse.cc:3960
#19 0x000055b466b3873b in mysql_parse (thd=thd@entry=0x1504fc000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x150523bfc2c0) at /test/11.2_dbg/sql/sql_parse.cc:7800
#20 0x000055b466b45c00 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1504fc000d48, packet=packet@entry=0x1504fc00af49 "EXECUTE s USING DEFAULT", packet_length=packet_length@entry=23, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_class.h:1374
#21 0x000055b466b480b8 in do_command (thd=0x1504fc000d48, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1405
#22 0x000055b466cad717 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55b469e69bc8, put_in_cache=put_in_cache@entry=true) at /test/11.2_dbg/sql/sql_connect.cc:1445
#23 0x000055b466cadbe6 in handle_one_connection (arg=0x55b469e69bc8) at /test/11.2_dbg/sql/sql_connect.cc:1347
#24 0x00001505648ad609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#25 0x0000150564499133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.4.31 (dbg), 10.9.8 (dbg), 10.10.6 (dbg), 10.11.5 (dbg), 11.0.2 (dbg), 11.0.3 (dbg), 11.1.2 (dbg), 11.2.0 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.4.31 (opt), 10.5.22 (dbg), 10.5.22 (opt), 10.6.15 (dbg), 10.6.15 (opt), 10.9.8 (opt), 10.10.6 (opt), 10.11.5 (opt), 11.0.3 (opt), 11.1.2 (opt), 11.2.0 (opt)



 Comments   
Comment by Ramesh Sivaraman [ 2023-09-27 ]

Following test case crashes release build with a slightly different stack

CREATE TEMPORARY TABLE t (a INT KEY);
CREATE TABLE t1 (a INT);
PREPARE s FROM ' SELECT * FROM t WHERE a=? ';
INSERT INTO t1 VALUES (1);
INSERT INTO t SELECT * FROM t;
EXECUTE s USING DEFAULT;

Leads to

11.3.0 b09e99ff759f66c29e3f67911ef4c7c0591c8a4e (Optimized)

Core was generated by `/test/mtest/MD180923-mariadb-11.3.0-linux-x86_64-opt/bin/mariadbd --no-defaults'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __memmove_avx_unaligned_erms ()
    at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:319
[Current thread is 1 (Thread 0x1532a0174700 (LWP 2137487))]
(gdb) bt
#0  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:319
#1  0x000055f949750d96 in memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34
#2  Field::set_default (this=0x153264018040) at /test/mtest/11.3_opt/sql/field.cc:2665
#3  Field::set_default (this=0x153264018040) at /test/mtest/11.3_opt/sql/field.cc:2647
#4  0x000055f94976595d in Field::save_in_field_default_value (this=0x153264018040, view_error_processing=<optimized out>) at /test/mtest/11.3_opt/sql/field.cc:11350
#5  0x000055f9497868fa in Item_param::save_in_field (this=<optimized out>, field=<optimized out>, no_conversions=<optimized out>) at /test/mtest/11.3_opt/sql/table.h:2888
#6  0x000055f94954f415 in store_key_item::copy_inner (this=0x1532a0171c10) at /test/mtest/11.3_opt/sql/sql_select.h:2142
#7  store_key::copy (thd=0x153264000c58, this=0x1532a0171c10) at /test/mtest/11.3_opt/sql/sql_select.h:2035
#8  create_ref_for_key (join=<optimized out>, j=<optimized out>, org_keyuse=<optimized out>, allow_full_scan=<optimized out>, used_tables=<optimized out>) at /test/mtest/11.3_opt/sql/sql_select.cc:13064
#9  0x000055f949580a3c in make_join_statistics (keyuse_array=0x1532640164d0, tables_list=@0x153264028980: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x153264016928, last = 0x153264016928, elements = 1}, <No data fields>}, join=0x153264016170) at /test/mtest/11.3_opt/sql/sql_select.cc:5883
#10 JOIN::optimize_inner (this=0x153264016170) at /test/mtest/11.3_opt/sql/sql_select.cc:2624
#11 0x000055f94958226a in JOIN::optimize (this=this@entry=0x153264016170) at /test/mtest/11.3_opt/sql/sql_select.cc:1944
#12 0x000055f949582361 in mysql_select (thd=0x153264000c58, tables=0x153264028d88, fields=<optimized out>, conds=0x153264029778, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x15326402a208, unit=0x153264026b08, select_lex=0x153264028768) at /test/mtest/11.3_opt/sql/sql_select.cc:5235
#13 0x000055f949582b27 in handle_select (thd=thd@entry=0x153264000c58, lex=lex@entry=0x153264026a28, result=result@entry=0x15326402a208, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/mtest/11.3_opt/sql/sql_select.cc:628
#14 0x000055f9494ffa9e in execute_sqlcom_select (thd=0x153264000c58, all_tables=0x153264028d88) at /test/mtest/11.3_opt/sql/sql_parse.cc:6013
#15 0x000055f94950d747 in mysql_execute_command (thd=0x153264000c58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true) at /test/mtest/11.3_opt/sql/sql_parse.cc:3912
#16 0x000055f94952c44d in Prepared_statement::execute (this=0x153264020a28, expanded_query=<optimized out>, open_cursor=false) at /test/mtest/11.3_opt/sql/sql_prepare.cc:5027
#17 0x000055f94952c615 in Prepared_statement::execute_loop (this=this@entry=0x153264020a28, expanded_query=expanded_query@entry=0x1532a0172d20, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/mtest/11.3_opt/sql/sql_prepare.cc:4433
#18 0x000055f94952c92b in mysql_sql_stmt_execute (thd=thd@entry=0x153264000c58) at /test/mtest/11.3_opt/sql/sql_prepare.cc:3470
#19 0x000055f94950ba19 in mysql_execute_command (thd=0x153264000c58, is_called_from_prepared_stmt=<optimized out>) at /test/mtest/11.3_opt/sql/sql_parse.cc:3928
#20 0x000055f9494faa65 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x153264000c58) at /test/mtest/11.3_opt/sql/sql_parse.cc:7734
#21 mysql_parse (thd=0x153264000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/mtest/11.3_opt/sql/sql_parse.cc:7656
#22 0x000055f949506932 in dispatch_command (command=COM_QUERY, thd=0x153264000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/mtest/11.3_opt/sql/sql_class.h:1531
#23 0x000055f94950881e in do_command (thd=0x153264000c58, blocking=blocking@entry=true) at /test/mtest/11.3_opt/sql/sql_parse.cc:1406
#24 0x000055f94962a51f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55f94b9c2988, put_in_cache=put_in_cache@entry=true) at /test/mtest/11.3_opt/sql/sql_connect.cc:1445
#25 0x000055f94962a80d in handle_one_connection (arg=0x55f94b9c2988) at /test/mtest/11.3_opt/sql/sql_connect.cc:1347
#26 0x00001532cc281609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#27 0x00001532cbe6d133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Generated at Thu Feb 08 10:26:56 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.