[MDEV-33398] Server crashes when executing DML with innodb_checksum_algorithm set to strict_innodb Created: 2024-02-07  Updated: 2024-02-07  Resolved: 2024-02-07

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - InnoDB
Affects Version/s: 10.4
Fix Version/s: 10.6.9

Type: Bug Priority: Critical
Reporter: Ramesh Sivaraman Assignee: Marko Mäkelä
Resolution: Duplicate Votes: 0
Labels: None

Issue Links:
Duplicate
duplicates MDEV-13542 Crashing on a corrupted page is unhel... Closed

 Description   

PS : Use MariaDB cli to reproduce the issue. MTR test fails due to encryption plugin error

CREATE TABLE tbl1 (a INT,b INT,KEY(b)) ENGINE=INNODB;
 
CREATE TABLE tbl2 (f INT KEY) ENGINE=INNODB;
 
SELECT SLEEP (1);
 
SLEEP (1)
 
0
 
SET GLOBAL innodb_checksum_algorithm=3;
 
Warnings:
 
Warning	138	Setting innodb_checksum_algorithm to values other than crc32, full_crc32, strict_crc32 or strict_full_crc32 is UNSAFE and DEPRECATED. These deprecated values will be disallowed in MariaDB 10.6.
 
CREATE TEMPORARY TABLE t (f INT) ENGINE=InnoDB;
 
INSERT INTO tbl2 SELECT SEQ FROM seq_1_to_3000;
 
INSERT INTO tbl1 VALUES (+1,0);
 
INSERT INTO tbl1 VALUES (+1,0);
 
SET GLOBAL innodb_lru_scan_depth=10000;
 
INSERT INTO t SELECT 1 FROM tbl2 AS t,tbl2 AS t2;
 
 
 
main.mytest 'innodb'                     [ fail ]
 
        Test ended at 2024-02-07 05:07:23
 
 
 
CURRENT_TEST: main.mytest
 
mysqltest: At line 13: query 'INSERT INTO t SELECT 1 FROM tbl2 AS t,tbl2 AS t2' failed: 1296: Got error 192 'Table encrypted but decryption failed. This could be because correct encryption management plugin is not loaded, used encryption key is not available or encryption method does not match.' from InnoDB

Testcase

CREATE TABLE tbl1 (a INT,b INT,KEY(b));
 
CREATE TABLE tbl2 (f INT KEY);
 
SELECT SLEEP (1);
 
SET GLOBAL innodb_checksum_algorithm=strict_innodb;
 
CREATE TEMPORARY TABLE t (f INT);
 
INSERT INTO tbl2 SELECT SEQ FROM seq_1_to_3000;
 
INSERT INTO tbl1 VALUES (+1,0);
 
INSERT INTO tbl1 VALUES (+1,0);
 
SET GLOBAL innodb_lru_scan_depth=10000;
 
INSERT INTO t SELECT 1 FROM tbl2 AS t,tbl2 AS t2;

Leads to:

10.4.33 f4ee7c110cd6faee3fa80b61ae572f471341c906 (Debug)

 
Core was generated by `/test/MD010224-mariadb-10.4.33-linux-x86_64-dbg/bin/mariadbd --no-defaults --ma'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  mach_read_from_4 (b=<optimized out>)
 
    at /test/10.4_dbg/storage/innobase/include/mach0data.inl:358
 
[Current thread is 1 (Thread 0x14c96d12a700 (LWP 195410))]
 
(gdb) bt
 
#0  mach_read_from_4 (b=<optimized out>) at /test/10.4_dbg/storage/innobase/include/mach0data.inl:358
 
#1  mach_read_from_8 (b=0x32 <error: Cannot access memory at address 0x32>) at /test/10.4_dbg/storage/innobase/include/mach0data.inl:358
 
#2  fseg_inode_try_get (header=header@entry=0x14c970644054 "", space=space@entry=5, zip_size=0, mtr=mtr@entry=0x14c96d129040, block=block@entry=0x0) at /test/10.4_dbg/storage/innobase/fsp/fsp0fsp.cc:1668
 
#3  0x000055ae7cc8aa6f in fseg_inode_get (header=header@entry=0x14c970644054 "", space=space@entry=5, zip_size=<optimized out>, mtr=mtr@entry=0x14c96d129040, block=block@entry=0x0) at /test/10.4_dbg/storage/innobase/fsp/fsp0fsp.cc:1695
 
#4  0x000055ae7cc8c7a1 in fseg_n_reserved_pages (header=header@entry=0x14c970644054 "", used=used@entry=0x14c96d128e18, mtr=mtr@entry=0x14c96d129040) at /test/10.4_dbg/storage/innobase/include/fil0fil.h:370
 
#5  0x000055ae7cb45a02 in btr_get_size (index=index@entry=0x14c930022030, flag=flag@entry=2, mtr=mtr@entry=0x14c96d129040) at /test/10.4_dbg/storage/innobase/btr/btr0btr.cc:636
 
#6  0x000055ae7cc554a9 in dict_stats_analyze_index (index=index@entry=0x14c930022030) at /test/10.4_dbg/storage/innobase/dict/dict0stats.cc:1941
 
#7  0x000055ae7cc57fd0 in dict_stats_update_persistent (table=0x14c93001ee60) at /test/10.4_dbg/storage/innobase/dict/dict0stats.cc:2246
 
#8  dict_stats_update (table=table@entry=0x14c93001ee60, stats_upd_option=stats_upd_option@entry=DICT_STATS_RECALC_PERSISTENT) at /test/10.4_dbg/storage/innobase/dict/dict0stats.cc:3221
 
#9  0x000055ae7cc5be8f in dict_stats_process_entry_from_recalc_pool () at /test/10.4_dbg/storage/innobase/dict/dict0stats_bg.cc:431
 
#10 dict_stats_thread () at /test/10.4_dbg/storage/innobase/dict/dict0stats_bg.cc:515
 
#11 0x000014c994ce4609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#12 0x000014c9948d0133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.4.33 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.4.33 (opt), 10.5.24 (dbg), 10.5.24 (opt), 10.6.17 (dbg), 10.6.17 (opt), 10.11.7 (dbg), 10.11.7 (opt), 11.0.5 (dbg), 11.0.5 (opt), 11.1.4 (dbg), 11.1.4 (opt), 11.2.3 (dbg), 11.2.3 (opt), 11.3.2 (dbg), 11.3.2 (opt), 11.4.0 (dbg), 11.4.0 (opt)

 Comments   
Comment by Ramesh Sivaraman [ 2024-02-07 ]

Another test case crashes release build with slightly different stack

CREATE TABLE t (c INT,c2 CHAR(5)) ENGINE=InnoDB PARTITION BY LINEAR KEY(c) PARTITIONS 99;
 
SET GLOBAL innodb_lru_scan_depth=10000;
 
SELECT SLEEP (1);
 
SELECT * FROM t;
 
SET GLOBAL innodb_checksum_algorithm=strict_innodb;
 
SELECT * FROM mysql.innodb_index_stats;

Leads to:

10.4.33 f4ee7c110cd6faee3fa80b61ae572f471341c906 (Optimized)

 
Core was generated by `/test/MD010224-mariadb-10.4.33-linux-x86_64-opt/bin/mariadbd --no-defaults --ma'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  fut_get_ptr (rw_latch=RW_SX_LATCH, ptr_block=0x0, mtr=<optimized out>,
 
    addr=..., zip_size=<optimized out>, space=2)
 
    at /test/10.4_opt/storage/innobase/include/fut0fut.h:63
 
[Current thread is 1 (Thread 0x14e2cc0fd700 (LWP 4015468))]
 
(gdb) bt
 
#0  fut_get_ptr (rw_latch=RW_SX_LATCH, ptr_block=0x0, mtr=<optimized out>, addr=<optimized out>, zip_size=<optimized out>, space=2) at /test/10.4_opt/storage/innobase/include/fut0fut.h:63
 
#1  fseg_inode_try_get (block=0x0, mtr=<optimized out>, zip_size=<optimized out>, space=2, header=0x14e2c0bbc054 <error: Cannot access memory at address 0x14e2c0bbc054>) at /test/10.4_opt/storage/innobase/fsp/fsp0fsp.cc:1665
 
#2  fseg_inode_get (block=0x0, mtr=<optimized out>, zip_size=<optimized out>, space=2, header=0x14e2c0bbc054 <error: Cannot access memory at address 0x14e2c0bbc054>) at /test/10.4_opt/storage/innobase/fsp/fsp0fsp.cc:1696
 
#3  fseg_n_reserved_pages (header=header@entry=0x14e2c0bbc054 <error: Cannot access memory at address 0x14e2c0bbc054>, used=used@entry=0x14e2cc0f7c18, mtr=mtr@entry=0x14e2cc0f7cf0) at /test/10.4_opt/storage/innobase/fsp/fsp0fsp.cc:2003
 
#4  0x0000563632cf7965 in btr_get_size (index=index@entry=0x14e2a801de68, flag=flag@entry=2, mtr=mtr@entry=0x14e2cc0f7cf0) at /test/10.4_opt/storage/innobase/btr/btr0btr.cc:636
 
#5  0x0000563632d77a92 in dict_stats_update_transient_for_index (index=0x14e2a801de68) at /test/10.4_opt/storage/innobase/dict/dict0stats.cc:848
 
#6  0x0000563632d7e942 in dict_stats_update_transient (table=0x0) at /test/10.4_opt/storage/innobase/dict/dict0stats.cc:947
 
#7  dict_stats_update (table=table@entry=0x14e2a801cc08, stats_upd_option=<optimized out>) at /test/10.4_opt/storage/innobase/dict/dict0stats.cc:3383
 
#8  0x0000563632bc0ec9 in dict_stats_init (table=0x14e2a801cc08) at /test/10.4_opt/storage/innobase/include/dict0stats.inl:165
 
#9  ha_innobase::info_low (this=0x14e27c1aeaa0, flag=<optimized out>, is_analyze=<optimized out>) at /test/10.4_opt/storage/innobase/handler/ha_innodb.cc:14374
 
#10 0x0000563632bc2777 in ha_innobase::info (flag=282, this=0x14e27c1aeaa0) at /test/10.4_opt/storage/innobase/handler/ha_innodb.cc:14640
 
#11 ha_innobase::open (this=<optimized out>, name=<optimized out>) at /test/10.4_opt/storage/innobase/handler/ha_innodb.cc:6451
 
#12 0x00005636328c9a2e in handler::ha_open (this=0x14e27c1aeaa0, table_arg=table_arg@entry=0x14e27c1ab138, name=0x14e27c1ab108 "./mysql/innodb_index_stats", mode=mode@entry=2, test_if_locked=test_if_locked@entry=18, mem_root=mem_root@entry=0x0, partitions_to_open=0x0) at /test/10.4_opt/sql/handler.cc:2831
 
#13 0x000056363278a700 in open_table_from_share (thd=thd@entry=0x14e27c000c48, share=share@entry=0x14e27c1aac70, alias=alias@entry=0x14e27c010788, db_stat=db_stat@entry=33, prgflag=prgflag@entry=8, ha_open_flags=18, outparam=0x14e27c1ab138, is_create_table=false, partitions_to_open=0x0) at /test/10.4_opt/sql/table.cc:4137
 
#14 0x0000563632649012 in open_table (thd=0x14e27c000c48, table_list=0x14e27c010740, ot_ctx=0x14e2cc0fa580) at /test/10.4_opt/sql/sql_base.cc:2116
 
#15 0x000056363264c87e in open_and_process_table (ot_ctx=0x14e2cc0fa580, has_prelocking_list=false, prelocking_strategy=0x14e2cc0fa670, flags=0, counter=0x14e2cc0fa61c, tables=0x14e27c010740, thd=0x14e27c000c48) at /test/10.4_opt/sql/sql_base.cc:3919
 
#16 open_tables (thd=thd@entry=0x14e27c000c48, options=@0x14e27c005f08: {m_options = DDL_options_st::OPT_NONE}, start=start@entry=0x14e2cc0fa608, counter=counter@entry=0x14e2cc0fa61c, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x14e2cc0fa670) at /test/10.4_opt/sql/sql_base.cc:4401
 
#17 0x000056363264d37a in open_and_lock_tables (thd=thd@entry=0x14e27c000c48, options=<optimized out>, tables=<optimized out>, tables@entry=0x14e27c010740, derived=derived@entry=true, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x14e2cc0fa670) at /test/10.4_opt/sql/sql_base.cc:5348
 
#18 0x00005636326a64dd in open_and_lock_tables (flags=0, derived=true, tables=0x14e27c010740, thd=0x14e27c000c48) at /test/10.4_opt/sql/sql_base.h:503
 
#19 execute_sqlcom_select (thd=0x14e27c000c48, all_tables=0x14e27c010740) at /test/10.4_opt/sql/sql_parse.cc:6470
 
#20 0x00005636326b5363 in mysql_execute_command (thd=0x14e27c000c48) at /test/10.4_opt/sql/sql_parse.cc:3980
 
#21 0x00005636326b7c4a in mysql_parse (thd=0x14e27c000c48, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_parse.cc:8088
 
#22 0x00005636326ba265 in dispatch_command (command=COM_QUERY, thd=0x14e27c000c48, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_class.h:1242
 
#23 0x00005636326bc95f in do_command (thd=0x14e27c000c48) at /test/10.4_opt/sql/sql_parse.cc:1378
 
#24 0x00005636327b716e in do_handle_one_connection (connect=connect@entry=0x563636827e78) at /test/10.4_opt/sql/sql_connect.cc:1419
 
#25 0x00005636327b729f in handle_one_connection (arg=0x563636827e78) at /test/10.4_opt/sql/sql_connect.cc:1323
 
#26 0x000014e2e1d20609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#27 0x000014e2e190c133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

10.4.33 f4ee7c110cd6faee3fa80b61ae572f471341c906 (Debug)

 
Core was generated by `/test/MD010224-mariadb-10.4.33-linux-x86_64-dbg/bin/mariadbd --no-defaults --ma'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  mach_read_from_4 (b=<optimized out>)
 
    at /test/10.4_dbg/storage/innobase/include/mach0data.inl:358
 
[Current thread is 1 (Thread 0x14d21004e700 (LWP 736205))]
 
(gdb) bt
 
#0  mach_read_from_4 (b=<optimized out>) at /test/10.4_dbg/storage/innobase/include/mach0data.inl:358
 
#1  mach_read_from_8 (b=0x32 <error: Cannot access memory at address 0x32>) at /test/10.4_dbg/storage/innobase/include/mach0data.inl:358
 
#2  fseg_inode_try_get (header=header@entry=0x14d1f0e7c054 "", space=space@entry=2, zip_size=0, mtr=mtr@entry=0x14d210048cd0, block=block@entry=0x0) at /test/10.4_dbg/storage/innobase/fsp/fsp0fsp.cc:1668
 
#3  0x000055f6145e0a6f in fseg_inode_get (header=header@entry=0x14d1f0e7c054 "", space=space@entry=2, zip_size=<optimized out>, mtr=mtr@entry=0x14d210048cd0, block=block@entry=0x0) at /test/10.4_dbg/storage/innobase/fsp/fsp0fsp.cc:1695
 
#4  0x000055f6145e27a1 in fseg_n_reserved_pages (header=header@entry=0x14d1f0e7c054 "", used=used@entry=0x14d210048c78, mtr=mtr@entry=0x14d210048cd0) at /test/10.4_dbg/storage/innobase/include/fil0fil.h:370
 
#5  0x000055f61449ba02 in btr_get_size (index=index@entry=0x14d1d0020af0, flag=flag@entry=2, mtr=mtr@entry=0x14d210048cd0) at /test/10.4_dbg/storage/innobase/btr/btr0btr.cc:636
 
#6  0x000055f6145a7adb in dict_stats_update_transient_for_index (index=index@entry=0x14d1d0020af0) at /test/10.4_dbg/storage/innobase/dict/dict0stats.cc:848
 
#7  0x000055f6145aef91 in dict_stats_update_transient (table=0x14d1d001f600) at /test/10.4_dbg/storage/innobase/dict/dict0stats.cc:947
 
#8  dict_stats_update (table=table@entry=0x14d1d001f600, stats_upd_option=<optimized out>) at /test/10.4_dbg/storage/innobase/dict/dict0stats.cc:3383
 
#9  0x000055f614214028 in dict_stats_init (table=0x14d1d001f600) at /test/10.4_dbg/storage/innobase/include/dict0stats.inl:165
 
#10 ha_innobase::info_low (this=this@entry=0x14d1b01e6a80, flag=flag@entry=282, is_analyze=is_analyze@entry=false) at /test/10.4_dbg/storage/innobase/handler/ha_innodb.cc:14374
 
#11 0x000055f614214fec in ha_innobase::info (this=this@entry=0x14d1b01e6a80, flag=flag@entry=282) at /test/10.4_dbg/storage/innobase/handler/ha_innodb.cc:14640
 
#12 0x000055f614215df6 in ha_innobase::open (this=<optimized out>, name=<optimized out>) at /test/10.4_dbg/storage/innobase/handler/ha_innodb.cc:6451
 
#13 0x000055f613e89bfd in handler::ha_open (this=0x14d1b01e6a80, table_arg=table_arg@entry=0x14d1b01e5c68, name=0x14d1b01e22e8 "./mysql/innodb_index_stats", mode=mode@entry=2, test_if_locked=test_if_locked@entry=18, mem_root=mem_root@entry=0x0, partitions_to_open=0x0) at /test/10.4_dbg/sql/handler.cc:2831
 
#14 0x000055f613ce6d1f in open_table_from_share (thd=thd@entry=0x14d1b0000d28, share=share@entry=0x14d1b01e1d50, alias=alias@entry=0x14d1b0012d98, db_stat=db_stat@entry=33, prgflag=prgflag@entry=8, ha_open_flags=18, outparam=0x14d1b01e5c68, is_create_table=false, partitions_to_open=0x0) at /test/10.4_dbg/sql/table.cc:4137
 
#15 0x000055f613b6e110 in open_table (thd=thd@entry=0x14d1b0000d28, table_list=table_list@entry=0x14d1b0012d50, ot_ctx=ot_ctx@entry=0x14d21004b4b0) at /test/10.4_dbg/sql/sql_base.cc:2116
 
#16 0x000055f613b720d9 in open_and_process_table (ot_ctx=0x14d21004b4b0, has_prelocking_list=false, prelocking_strategy=0x14d21004b5a0, flags=0, counter=0x14d21004b54c, tables=0x14d1b0012d50, thd=0x14d1b0000d28) at /test/10.4_dbg/sql/sql_base.cc:3919
 
#17 open_tables (thd=thd@entry=0x14d1b0000d28, options=@0x14d1b00061a8: {m_options = DDL_options_st::OPT_NONE}, start=start@entry=0x14d21004b538, counter=counter@entry=0x14d21004b54c, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x14d21004b5a0) at /test/10.4_dbg/sql/sql_base.cc:4401
 
#18 0x000055f613b731f1 in open_and_lock_tables (thd=thd@entry=0x14d1b0000d28, options=<optimized out>, tables=<optimized out>, tables@entry=0x14d1b0012d50, derived=derived@entry=true, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x14d21004b5a0) at /test/10.4_dbg/sql/sql_base.cc:5348
 
#19 0x000055f613bdcec6 in open_and_lock_tables (flags=0, derived=true, tables=0x14d1b0012d50, thd=0x14d1b0000d28) at /test/10.4_dbg/sql/sql_base.h:503
 
#20 execute_sqlcom_select (thd=thd@entry=0x14d1b0000d28, all_tables=0x14d1b0012d50) at /test/10.4_dbg/sql/sql_parse.cc:6470
 
#21 0x000055f613be7634 in mysql_execute_command (thd=thd@entry=0x14d1b0000d28) at /test/10.4_dbg/sql/sql_parse.cc:3980
 
#22 0x000055f613bf2229 in mysql_parse (thd=thd@entry=0x14d1b0000d28, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14d21004d360, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:8088
 
#23 0x000055f613bf523b in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14d1b0000d28, packet=packet@entry=0x14d1b0019699 "SELECT * FROM mysql.innodb_index_stats", packet_length=packet_length@entry=38, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_class.h:1242
 
#24 0x000055f613bf7eba in do_command (thd=0x14d1b0000d28) at /test/10.4_dbg/sql/sql_parse.cc:1378
 
#25 0x000055f613d23846 in do_handle_one_connection (connect=connect@entry=0x55f616f95108) at /test/10.4_dbg/sql/sql_connect.cc:1419
 
#26 0x000055f613d23965 in handle_one_connection (arg=0x55f616f95108) at /test/10.4_dbg/sql/sql_connect.cc:1323
 
#27 0x000014d212b4b609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#28 0x000014d212737133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.4.33 (dbg), 10.4.33 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.5.24 (dbg), 10.5.24 (opt), 10.6.17 (dbg), 10.6.17 (opt), 10.11.7 (dbg), 10.11.7 (opt), 11.0.5 (dbg), 11.0.5 (opt), 11.1.4 (dbg), 11.1.4 (opt), 11.2.3 (dbg), 11.2.3 (opt), 11.3.2 (dbg), 11.3.2 (opt), 11.4.0 (dbg), 11.4.0 (opt)

Comment by Marko Mäkelä [ 2024-02-07 ]

This basically duplicates MDEV-13542, which was fixed in MariaDB Server 10.6.9.

If you change innodb_checksum_algorithm to one of the strict_ values other than strict_crc32 or strict_full_crc32, you will get page checksum mismatch. Before MDEV-13542, this was not being handled gracefully.

It is not feasible to fix MDEV-13542 in earlier major releases than 10.6, and especially not in 10.4 when we only have one planned maintenance release remaining, and we want to avoid any extensive changes.

I do not know why you could not reproduce this known bug in 10.5.

Generated at Thu Feb 08 10:38:36 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.