[MDEV-9723] MariaDB segfault and fake rows in ha_connect.so when using thread=yes Created: 2016-03-14  Updated: 2018-08-20  Resolved: 2018-08-20

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - Connect
Affects Version/s: 10.1.13, 10.0, 10.1
Fix Version/s: 10.0.25, 10.1.14

Type: Bug Priority: Major
Reporter: Sergey Antonyuk Assignee: Olivier Bertrand
Resolution: Fixed Votes: 0
Labels: None
Environment:

3.2.0-4-amd64 #1 SMP Debian 3.2.35-2 x86_64 GNU/Linux


 Description   

I've found two critical problems (fake rows and segfault) using CONNECT engine with simplest queries. The probles are reproducable using Debian Wheezy, Jessy and 3 different ha_connect.so files including self-compiled.

Scenario

 
CREATE TABLE t1 ENGINE=CONNECT TABLE_TYPE=MYSQL DBNAME=my_db OPTION_LIST='user=xxx,host=localhost,password=yyy'
 
SRCDEF='select 11 as v';
 
 
 
CREATE TABLE t2 ENGINE=CONNECT TABLE_TYPE=MYSQL DBNAME=my_db OPTION_LIST='user=xxx,host=localhost,password=yyy'
 
SRCDEF='select 22 as v';
 
 
 
CREATE TABLE t (
 
  `v` bigint(20) unsigned NOT NULL
 
) ENGINE=CONNECT
 
TABLE_TYPE=TBL
 
table_list='t1,t2'
 
option_list='thread=yes';
 
 
 
select * from t;

Actual result

 
+----+
 
| v  |
 
+----+
 
| 11 |
 
| 22 |
 
|  0 |
 
|  0 |
 
+----+

We have 2 fake rows filled by zero.

Repeat step 4 several times and you got "Lost connection to MySQL".

Please look below for gdb stacktrace:

#0  0x00007f5bd707ed61 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
 
#1  0x00007f5bd2d525ba in MYSQLCOL::ReadColumn (this=0x7f5ba00009d0, g=0x7f5bdc4a4d30) at /storage/connect/tabmysql.cpp:1383
 
#2  0x00007f5bd2d0ede7 in Eval (g=0x7f5bdc4a4d30, this=0x7f5ba00009d0) at /storage/connect/colblk.cpp:140
 
#3  COLBLK::Eval (this=0x7f5ba00009d0, g=0x7f5bdc4a4d30) at /storage/connect/colblk.cpp:129
 
#4  0x00007f5bd2d5bead in PRXCOL::ReadColumn (this=0x7f5b9ffffc88, g=0x7f5bdc4a4d30) at /storage/connect/tabutil.cpp:736
 
#5  0x00007f5bd2d0ede7 in Eval (g=0x7f5bdc4a4d30, this=0x7f5b9ffffc88) at /storage/connect/colblk.cpp:140
 
#6  COLBLK::Eval (this=0x7f5b9ffffc88, g=0x7f5bdc4a4d30) at /storage/connect/colblk.cpp:129
 
#7  0x00007f5bd2d065e4 in EvalColumns (g=g@entry=0x1, tdbp=tdbp@entry=0x7f5b9ffff2c8, reset=reset@entry=false, mrr=mrr@entry=false) at /storage/connect/connect.cc:420
 
#8  0x00007f5bd2d067b0 in CntReadNext (g=0x7f5bdc4a4d30, tdbp=0x7f5b9ffff2c8) at /storage/connect/connect.cc:472
 
#9  0x00007f5bd2cfd120 in ha_connect::rnd_next (this=0x7f5bdc4d3660, buf=0x7f5bdc54b1e0 "\377") at /storage/connect/ha_connect.cc:3768
 
#10 0x00007f5bd8b6dbaf in handler::ha_rnd_next (this=0x7f5bdc4d3660, buf=0x7f5bdc54b1e0 "\377") at /sql/handler.cc:2577
 
#11 0x00007f5bd8c55519 in rr_sequential (info=0x7f5bdc4ecfb0) at /sql/records.cc:470
 
#12 0x00007f5bd8a3c8a9 in sub_select (join=0x7f5bdc4ebe50, join_tab=0x7f5bdc4ecef0, end_of_records=<optimized out>) at /sql/sql_select.cc:18256
 
#13 0x00007f5bd8a488dd in do_select (join=0x7f5bdc4ebe50, fields=0x7f5bdc4871c8, table=0x0, procedure=0x0) at /sql/sql_select.cc:17914
 
#14 0x00007f5bd8a58c04 in JOIN::exec_inner (this=this@entry=0x7f5bdc4ebe50) at /sql/sql_select.cc:3228
 
#15 0x00007f5bd8a5a8ac in JOIN::exec (this=0x7f5bdc4ebe50) at /sql/sql_select.cc:2518
 
#16 0x00007f5bd8a57530 in mysql_select (thd=thd@entry=0x7f5bdc4830d8, rref_pointer_array=rref_pointer_array@entry=0x7f5bdc487328, tables=0x7f5bdc4eb768, wild_num=<optimized out>, fields=...,
 
    conds=<optimized out>, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=result@entry=0x7f5bdc4ebe30, unit=unit@entry=0x7f5bdc4869b0,
 
    select_lex=select_lex@entry=0x7f5bdc4870b0) at /sql/sql_select.cc:3451
 
#17 0x00007f5bd8a5ab8c in handle_select (thd=0x7f5bdc4830d8, lex=0x7f5bdc4868e8, result=0x7f5bdc4ebe30, setup_tables_done_option=0) at /sql/sql_select.cc:384
 
#18 0x00007f5bd8a03a1e in execute_sqlcom_select (thd=thd@entry=0x7f5bdc4830d8, all_tables=0x7f5bdc4eb768) at /sql/sql_parse.cc:5936
 
#19 0x00007f5bd8a0f9b8 in mysql_execute_command (thd=thd@entry=0x7f5bdc4830d8) at /sql/sql_parse.cc:2962
 
#20 0x00007f5bd8a12d3e in mysql_parse (thd=0x7f5bdc4830d8, rawbuf=<optimized out>, length=<optimized out>, parser_state=0x7f5bbaa1fd00) at /sql/sql_parse.cc:7336
 
#21 0x00007f5bd8a1570e in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f5bdc4830d8, packet=packet@entry=0x7f5bdc47e6d9 "", packet_length=3696145712, packet_length@entry=50)
 
    at /sql/sql_parse.cc:1488
 
#22 0x00007f5bd8a15cb0 in do_command (thd=0x7f5bdc4830d8) at /sql/sql_parse.cc:1109
 
#23 0x00007f5bd8ac608a in do_handle_one_connection (thd_arg=thd_arg@entry=0x7f5bdc4830d8) at /sql/sql_connect.cc:1349
 
#24 0x00007f5bd8ac61f6 in handle_one_connection (arg=0x7f5bdc4830d8) at /sql/sql_connect.cc:1261
 
#25 0x00007f5bd8174b50 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
 
#26 0x00007f5bd70dd30d in clone () from /lib/x86_64-linux-gnu/libc.so.6

I have found the following strange behaviour in the MYSQLCOL::ReadColumn (tabmysql.cpp). When fake row appear, this function is called and Rank is equal to -1 and segfault appears on strlen(p).

The problems can't be reproduced when t table is created using option_list='thread=no';

 Comments   
Comment by Elena Stepanova [ 2016-03-15 ]

Thanks for the report and the test case.

Comment by Elena Stepanova [ 2016-03-15 ]

Stack trace from 10.0 commit 0125e588f3967bcaf01cf60b6a64e92758158ac4

 
#2  0x000000000085afd8 in handle_fatal_signal (sig=11) at /src/10.0/sql/signal_handler.cc:262
 
#3  <signal handler called>
 
#4  0x00007f05e4c3b32a in strlen () from /lib64/libc.so.6
 
#5  0x00007f05bcb70bcf in MYSQLCOL::ReadColumn (this=0x7f05b6401780, g=0x7f05ba451000) at /src/10.0/storage/connect/tabmysql.cpp:1412
 
#6  0x00007f05bcb0e7a2 in COLBLK::Eval (this=0x7f05b6401780, g=0x7f05ba451000) at /src/10.0/storage/connect/colblk.cpp:140
 
#7  0x00007f05bcb7de98 in PRXCOL::ReadColumn (this=0x7f05b6400b50, g=0x7f05ba451000) at /src/10.0/storage/connect/tabutil.cpp:736
 
#8  0x00007f05bcb0e7a2 in COLBLK::Eval (this=0x7f05b6400b50, g=0x7f05ba451000) at /src/10.0/storage/connect/colblk.cpp:140
 
#9  0x00007f05bcb02974 in EvalColumns (g=0x7f05ba451000, tdbp=0x7f05b6400270, reset=false, mrr=false) at /src/10.0/storage/connect/connect.cc:420
 
#10 0x00007f05bcb02b80 in CntReadNext (g=0x7f05ba451000, tdbp=0x7f05b6400270) at /src/10.0/storage/connect/connect.cc:472
 
#11 0x00007f05bcaf6bfd in ha_connect::rnd_next (this=0x7f05ba488288, buf=0x7f05ba492088 "\377") at /src/10.0/storage/connect/ha_connect.cc:3768
 
#12 0x0000000000860da6 in handler::ha_rnd_next (this=0x7f05ba488288, buf=0x7f05ba492088 "\377") at /src/10.0/sql/handler.cc:2597
 
#13 0x000000000098f78f in rr_sequential (info=0x7f05ba423a30) at /src/10.0/sql/records.cc:469
 
#14 0x00000000006ce9ab in join_init_read_record (tab=0x7f05ba423988) at /src/10.0/sql/sql_select.cc:18745
 
#15 0x00000000006cc8ff in sub_select (join=0x7f05ba422920, join_tab=0x7f05ba423988, end_of_records=false) at /src/10.0/sql/sql_select.cc:17837
 
#16 0x00000000006cc1d5 in do_select (join=0x7f05ba422920, fields=0x7f05cc7beb28, table=0x0, procedure=0x0) at /src/10.0/sql/sql_select.cc:17502
 
#17 0x00000000006a9446 in JOIN::exec_inner (this=0x7f05ba422920) at /src/10.0/sql/sql_select.cc:3084
 
#18 0x00000000006a6916 in JOIN::exec (this=0x7f05ba422920) at /src/10.0/sql/sql_select.cc:2373
 
#19 0x00000000006a9cc3 in mysql_select (thd=0x7f05cc7ba9b0, rref_pointer_array=0x7f05cc7bec88, tables=0x7f05ba422268, wild_num=1, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f05ba422900, unit=0x7f05cc7be320, select_lex=0x7f05cc7bea10) at /src/10.0/sql/sql_select.cc:3308
 
#20 0x00000000006a003f in handle_select (thd=0x7f05cc7ba9b0, lex=0x7f05cc7be258, result=0x7f05ba422900, setup_tables_done_option=0) at /src/10.0/sql/sql_select.cc:373
 
#21 0x00000000006748f2 in execute_sqlcom_select (thd=0x7f05cc7ba9b0, all_tables=0x7f05ba422268) at /src/10.0/sql/sql_parse.cc:5304
 
#22 0x000000000066ccdb in mysql_execute_command (thd=0x7f05cc7ba9b0) at /src/10.0/sql/sql_parse.cc:2562
 
#23 0x0000000000677479 in mysql_parse (thd=0x7f05cc7ba9b0, rawbuf=0x7f05ba422088 "select * from t", length=15, parser_state=0x7f05e6c7b6a0) at /src/10.0/sql/sql_parse.cc:6565
 
#24 0x0000000000669f45 in dispatch_command (command=COM_QUERY, thd=0x7f05cc7ba9b0, packet=0x7f05bdaaf2f1 "", packet_length=15) at /src/10.0/sql/sql_parse.cc:1308
 
#25 0x0000000000669212 in do_command (thd=0x7f05cc7ba9b0) at /src/10.0/sql/sql_parse.cc:998
 
#26 0x00000000007878a7 in do_handle_one_connection (thd_arg=0x7f05cc7ba9b0) at /src/10.0/sql/sql_connect.cc:1377
 
#27 0x0000000000787619 in handle_one_connection (arg=0x7f05cc7ba9b0) at /src/10.0/sql/sql_connect.cc:1292
 
#28 0x00007f05e690b0a4 in start_thread () from /lib64/libpthread.so.0
 
#29 0x00007f05e4c9f04d in clone () from /lib64/libc.so.6

Comment by Olivier Bertrand [ 2016-03-17 ]

Fixing this bug, I found and fixed another one: crash when trying to sort the result of a threaded TBL table:

select * from t order by v;

Comment by Olivier Bertrand [ 2018-08-20 ]

This fix did not always work and wrong result can be sometimes retuned.

Therfore the THREAD option was removed and is no more available.

Generated at Thu Feb 08 07:36:50 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.