[MDEV-32808] using sql_service within encryption key management plugin segfaults Created: 2023-11-15  Updated: 2023-12-21

Status: Open
Project: MariaDB Server
Component/s: Encryption, Plugins, Server
Affects Version/s: 10.4.32
Fix Version/s: 10.4, 11.3

Type: Bug Priority: Major
Reporter: Daniel Black Assignee: Daniel Black
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-27595 Backport SQL service, introduced by M... Closed

 Description   

test case: https://github.com/pluots/mariadb-server/commit/e58cd30dee6c2c3fd0a935c3a95446d5a9925347

cherrypick of top test case onto 10.4 - debug mode crash

#1  0x000055b88831064a in my_write_core (sig=11) at /home/dan/repos/mariadb-server-10.4/mysys/stacktrace.c:386
#2  0x000055b8879b13fa in handle_fatal_signal (sig=11) at /home/dan/repos/mariadb-server-10.4/sql/signal_handler.cc:369
#3  <signal handler called>
#4  0x000055b88830eb65 in my_thread_name () at /home/dan/repos/mariadb-server-10.4/mysys/my_thr_init.c:426
#5  0x000055b88832018a in wt_thd_lazy_init (thd=0x7f3e28004d78, ds=0x7f3e28002198, ts=0x7f3e28002190, dl=0x7f3e280021a8, tl=0x7f3e280021a0)
    at /home/dan/repos/mariadb-server-10.4/mysys/waiting_threads.c:513
#6  0x000055b8875d16c1 in THD::THD (this=0x7f3e280016e0, id=0, is_wsrep_applier=false)
    at /home/dan/repos/mariadb-server-10.4/sql/sql_class.cc:782
#7  0x000055b887686064 in mysql_real_connect_local (mysql=0x7f3e28000e40) at /home/dan/repos/mariadb-server-10.4/sql/sql_prepare.cc:6207
#8  0x00007f3e8046d36f in connect_local ()
    at /home/dan/repos/mariadb-server-10.4/plugin/example_keymgt_sql_service/example_keymgt_sql_service.cc:63
#9  0x00007f3e8046d3ff in get_latest_key_version (key_id=1)
    at /home/dan/repos/mariadb-server-10.4/plugin/example_keymgt_sql_service/example_keymgt_sql_service.cc:84
#10 0x000055b8881d8a92 in fil_space_crypt_t::key_get_latest_version (this=0x7f3e28000b70)
    at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:141
#11 0x000055b8881dfbd7 in fil_space_crypt_t::fil_space_crypt_t (this=0x7f3e28000b70, new_type=0, new_min_key_version=0, new_key_id=1,
    new_encryption=FIL_ENCRYPTION_DEFAULT) at /home/dan/repos/mariadb-server-10.4/storage/innobase/include/fil0crypt.h:135
#12 0x000055b8881d8c96 in fil_space_create_crypt_data (type=0, encrypt_mode=FIL_ENCRYPTION_DEFAULT, min_key_version=0, key_id=1)
    at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:231
#13 0x000055b8881d8cf2 in fil_space_create_crypt_data (encrypt_mode=FIL_ENCRYPTION_DEFAULT, key_id=1)
    at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:251
#14 0x000055b8881db1c9 in fil_crypt_start_encrypting_space (space=0x55b88a63e460)
    at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:1141
#15 0x000055b8881db8c6 in fil_crypt_space_needs_rotation (state=0x7f3e597f9bf0, key_state=0x7f3e597f9be4, recheck=0x7f3e597f9bcb)
    at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:1326
#16 0x000055b8881dc564 in fil_crypt_find_space_to_rotate (key_state=0x7f3e597f9be4, state=0x7f3e597f9bf0, recheck=0x7f3e597f9bcb)
    at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:1754
#17 0x000055b8881de74d in fil_crypt_thread () at /home/dan/repos/mariadb-server-10.4/storage/innobase/fil/fil0crypt.cc:2456

Non-debug mode crash

Thread 12 received signal SIGSEGV, Segmentation fault.
0x00000000006f1271 in THD::store_globals (this=0x7ff8680354d8) at /home/dan/repos/mariadb-server-11.3/sql/sql_class.cc:2193
2193      mysys_var->id=      thread_id;
(rr) p mysys_var
$5 = (st_my_thread_var *) 0x0
(rr) bt
#0  0x00000000006f1271 in THD::store_globals (this=0x7ff8680354d8) at /home/dan/repos/mariadb-server-11.3/sql/sql_class.cc:2193
#1  0x000000000076a634 in mysql_real_connect_local (mysql=0x7ff868034d98) at /home/dan/repos/mariadb-server-11.3/sql/sql_prepare.cc:6276
#2  0x00007ff8a8fa4318 in connect_local ()
    at /home/dan/repos/mariadb-server-11.3/plugin/example_keymgt_sql_service/example_keymgt_sql_service.cc:62
#3  0x00007ff8a8fa4409 in get_latest_key_version (key_id=<optimized out>)
    at /home/dan/repos/mariadb-server-11.3/plugin/example_keymgt_sql_service/example_keymgt_sql_service.cc:83
#4  0x0000000000d32db4 in fil_space_crypt_t::key_get_latest_version (this=0x7ff868007ce8)
    at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:139
#5  fil_space_crypt_t::fil_space_crypt_t (this=this@entry=0x7ff868007ce8, new_type=new_type@entry=0,
    new_min_key_version=new_min_key_version@entry=0, new_key_id=new_key_id@entry=1,
    new_encryption=new_encryption@entry=FIL_ENCRYPTION_DEFAULT)
    at /home/dan/repos/mariadb-server-11.3/storage/innobase/include/fil0crypt.h:129
#6  0x0000000000d30578 in fil_space_create_crypt_data (type=0, encrypt_mode=FIL_ENCRYPTION_DEFAULT, min_key_version=0, key_id=1)
    at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:222
#7  fil_space_create_crypt_data (encrypt_mode=FIL_ENCRYPTION_DEFAULT, key_id=1)
    at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:245
#8  fil_crypt_start_encrypting_space (space=0x4287608) at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:954
#9  fil_crypt_space_needs_rotation (state=0x7ff884fb1900, key_state=<optimized out>, recheck=<optimized out>)
    at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:1116
#10 fil_crypt_find_space_to_rotate (state=<optimized out>, key_state=<optimized out>, recheck=<optimized out>)
    at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:1527
#11 fil_crypt_thread () at /home/dan/repos/mariadb-server-11.3/storage/innobase/fil/fil0crypt.cc:2035
#12 0x00007ff8a82e31b3 in execute_native_thread_routine () from /lib64/libstdc++.so.6
#13 0x00007ff8a80ac897 in start_thread () from /lib64/libc.so.6
#14 0x00007ff8a8133524 in clone () from /lib64/libc.so.6

The SQL service assumes its being called by a THD that exists hence the two null pointer dereferences.

Found by tgross35.



 Comments   
Comment by Daniel Black [ 2023-11-15 ]

wip https://github.com/grooverdan/mariadb-server/pull/new/bb-10.4-MDEV-32808-encrypt-sql-crash

Generated at Thu Feb 08 10:34:10 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.