Crash using logging_query plugin and drizzledump
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Drizzle |
Fix Released
|
High
|
fmpwizard |
Bug Description
session->query was being assigned <Address 0x15 out of bounds> when you had a new thread and new session.
This causes a crash when you use the logging query plugin (as well as the gearman and syslog plugins) and drizzledump.
The crash happens when you try to get strlen(query), as query is an address out of bounds, drizzled crashes.
How to repeat:
1- Start Drizzle and create this database and table
CREATE DATABASE test;
USE test;
CREATE TABLE t1 (a int);
2- On another terminal, run this loop:
$ while [ true ]; do
./drizzle/
done;
Short after you start the loop, you will see this message printing on the screen
$ drizzledump: Got error: 21 when trying to connect
You can ctrl + c to stop it.
And drizzle crashed.
Suggest fix:
After looking at this for days, the best solution I found was to add
query= NULL to
drizzled/
(near query_id= 0; )
My thinking was that query was not being initialized when a new session started.
If drizzle did not crashed, it then added wrong entries to the log files:
125183821066282
That entry shows part of the "previous" query, as the query text for a Inint DB command.
=======
Extra debugging information:
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION
[Switching to process 46525 thread 0x2807]
0x95bdcf30 in strlen ()
(gdb) bt
#0 0x95bdcf30 in strlen ()
#1 0x001b4a40 in Session:
#2 0x0034960c in Logging_query::post (this=0xf19430, session=0x104b000) at plugin/
#3 0x000d5437 in LoggingPostIter
#4 0x000d5647 in std::find_
#5 0x000d56ce in std::find_
#6 0x000d4bb7 in logging_post_do (session=0x104b000) at logging.cc:115
#7 0x00142455 in dispatch_command (command=
#8 0x001030dc in Session:
#9 0x0010380f in Session::run (this=0x104b000) at session.cc:599
#10 0x0034c1b5 in MultiThreadSche
#11 0x0034aefb in session_thread (arg=0x104b000) at plugin/
#12 0x95c05155 in _pthread_start ()
#13 0x95c05012 in thread_start ()
=======
(gdb) bt full
#0 0x95bdcf30 in strlen ()
No symbol table info available.
#1 0x001b4a40 in Session:
No locals.
#2 0x0034960c in Logging_query::post (this=0xf19430, session=0x104b000) at plugin/
msgbuf = '\0' <repeats 29407 times>, "\001\000\
msgbuf_len = 0
wrv = 67108864
t_mark = 1251912774966650
qs = '\0' <repeats 15 times>, "###\002\
dbs = 0x2d196e0 "test"
dbl = 4
ln = 2958183784
#3 0x000d5437 in LoggingPostIter
No locals.
#4 0x000d5647 in std::find_
#5 0x000d56ce in std::find_
No locals.
#6 0x000d4bb7 in logging_post_do (session=0x104b000) at logging.cc:115
iter = {
_M_current = 0x104b742
}
#7 0x00142455 in dispatch_command (command=
error = false
query_id = (Query_id &) @0x557000: {
the_query_id = {
<drizzled:
<
my_value = 758
},
members of drizzled:
traits = {
my_lock = {
the_mutex = {
__sig = 1297437784,
},
locked = false
}
}
}, <No data fields>}
}
#8 0x001030dc in Session:
l_packet = 0x226b000 "\a"
l_command = COM_INIT_DB
#9 0x0010380f in Session::run (this=0x104b000) at session.cc:599
No locals.
#10 0x0034c1b5 in MultiThreadSche
No locals.
#11 0x0034aefb in session_thread (arg=0x104b000) at plugin/
session = (Session *) 0x104b000
scheduler = (MultiThreadSch
#12 0x95c05155 in _pthread_start ()
No symbol table info available.
#13 0x95c05012 in thread_start ()
No symbol table info available.
================
Looking at gdb, I see this:
[Switching to process 52177 thread 0x27ab]
Breakpoint 1, session_thread (arg=0x1024000) at plugin/
123 scheduler-
(gdb) c
Continuing.
[Switching to process 52177 thread 0x27af]
Breakpoint 1, session_thread (arg=0x1024000) at plugin/
123 scheduler-
(gdb) c
Continuing.
[Switching to process 52177 thread 0x2807]
Breakpoint 1, session_thread (arg=0x104b200) at plugin/
123 scheduler-
(gdb) c
Continuing.
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION
0x95bdcf30 in strlen ()
Note that once the thread goes from 0x27af to 0x2807, session_thread goes from 0x1024000 to 0x104b200.
At that point, if I do
(gdb)print session->query
I get <Address 0x15 out of bounds> and soon after that, a crash when trying to do strlen(query) on session.h
If at the time I find that session_query is pointing to an address out of bound, I do
(gdb)set session-
(gdb)cont
It all goes well, I see the query text SELECT 1 on the logs, and a Query type of INIT_DB
Related branches
- fmpwizard (community): Needs Resubmitting
- Brian Aker: Needs Information
- Drizzle Developers: Pending requested
-
Diff: 82 lines4 files modifieddrizzled/sql_delete.cc (+10/-0)
drizzled/sql_update.cc (+10/-0)
tests/r/update.result (+2/-0)
tests/t/update.test (+6/-0)
Changed in drizzle: | |
status: | New → Fix Committed |
Changed in drizzle: | |
status: | Fix Committed → Fix Released |
revno: 1129 session. cc
committer: Diego Medina <email address hidden>
branch nick: bug-fixes
timestamp: Thu 2009-09-03 00:00:45 -0400
message:
Fixes bug #423502 - Crash using logging_query plugin and drizzledump
modified:
drizzled/