[MDEV-32095] Assertion `role == *(ACL_ROLE**)pop' failed in undo_add_role_user_mapping Created: 2023-09-05  Updated: 2023-11-28

Status: Open
Project: MariaDB Server
Component/s: Authentication and Privilege System
Affects Version/s: 10.4, 10.5, 10.6, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2, 11.3
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Sergei Golubchik
Resolution: Unresolved Votes: 0
Labels: None


 Description   

May be minor prio depending on evaluation. MTR testcase:

CREATE ROLE r1;
CREATE ROLE r2;
DELETE FROM mysql.roles_mapping;
GRANT r1 TO CURRENT_USER() IDENTIFIED BY '';

Leads to:

11.3.0 7ba9c7fb84b5f28e4736656b57d9508b70ca6369 (Debug)

mariadbd: /test/git-bisect/11.3_dbg/sql/sql_acl.cc:3877: void undo_add_role_user_mapping(ACL_USER_BASE*, ACL_ROLE*): Assertion `role == *(ACL_ROLE**)pop' failed.

11.3.0 7ba9c7fb84b5f28e4736656b57d9508b70ca6369 (Debug)

Core was generated by `/test/MD020923-mariadb-11.3.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --cor'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=22735746041408)
    at ./nptl/pthread_kill.c:44
[Current thread is 1 (Thread 0x14ad94110640 (LWP 2872892))]
(gdb) bt
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=22735746041408) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=22735746041408) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=22735746041408, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x000014adad242476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x000014adad2287f3 in __GI_abort () at ./stdlib/abort.c:79
#5  0x000014adad22871b in __assert_fail_base (fmt=0x14adad3dd150 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55fc4b4f91d4 "role == *(ACL_ROLE**)pop", file=0x55fc4b4f9bb0 "/test/git-bisect/11.3_dbg/sql/sql_acl.cc", line=3877, function=<optimized out>) at ./assert/assert.c:92
#6  0x000014adad239e96 in __GI___assert_fail (assertion=0x55fc4b4f91d4 "role == *(ACL_ROLE**)pop", file=0x55fc4b4f9bb0 "/test/git-bisect/11.3_dbg/sql/sql_acl.cc", line=3877, function=0x55fc4b4f6d10 "void undo_add_role_user_mapping(ACL_USER_BASE*, ACL_ROLE*)") at ./assert/assert.c:101
#7  0x000055fc4a91784c in undo_add_role_user_mapping (grantee=grantee@entry=0x55fc4e331bc8, role=role@entry=0x14acf001e070) at /test/git-bisect/11.3_dbg/sql/sql_acl.cc:3877
#8  0x000055fc4a935a5b in mysql_grant_role (thd=thd@entry=0x14acf0000d58, list=@0x14acf0005f80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14acf0013438, last = 0x14acf0013428, elements = 2}, <No data fields>}, revoke=false) at /test/git-bisect/11.3_dbg/sql/sql_acl.cc:7815
#9  0x000055fc4a9c422c in mysql_execute_command (thd=thd@entry=0x14acf0000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/git-bisect/11.3_dbg/sql/sql_parse.cc:5122
#10 0x000055fc4a9c73a8 in mysql_parse (thd=thd@entry=0x14acf0000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14ad9410f200) at /test/git-bisect/11.3_dbg/sql/sql_parse.cc:7760
#11 0x000055fc4a9c953c in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14acf0000d58, packet=packet@entry=0x14acf000af69 "GRANT r1 TO CURRENT_USER() IDENTIFIED BY ''", packet_length=packet_length@entry=43, blocking=blocking@entry=true) at /test/git-bisect/11.3_dbg/sql/sql_class.h:247
#12 0x000055fc4a9cb417 in do_command (thd=0x14acf0000d58, blocking=blocking@entry=true) at /test/git-bisect/11.3_dbg/sql/sql_parse.cc:1406
#13 0x000055fc4ab222ae in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55fc4e36f178, put_in_cache=put_in_cache@entry=true) at /test/git-bisect/11.3_dbg/sql/sql_connect.cc:1445
#14 0x000055fc4ab2250d in handle_one_connection (arg=0x55fc4e36f178) at /test/git-bisect/11.3_dbg/sql/sql_connect.cc:1347
#15 0x000014adad294b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#16 0x000014adad326a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Bug confirmed present in:
MariaDB: 10.4.31 (dbg), 10.5.22 (dbg), 10.6.15 (dbg), 10.9.8 (dbg), 10.10.6 (dbg), 10.11.5 (dbg), 11.0.3 (dbg), 11.1.2 (dbg), 11.2.0 (dbg), 11.3.0 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.4.31 (opt), 10.5.22 (opt), 10.6.15 (opt), 10.9.8 (opt), 10.10.6 (opt), 10.11.5 (opt), 11.0.3 (opt), 11.1.2 (opt), 11.2.0 (opt), 11.3.0 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.40 (dbg), 8.0.33 (dbg), 8.0.33 (opt)


Generated at Thu Feb 08 10:28:47 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.