MySQL Bugs: #40757: server crash after failed plugin/engine initialization

Bug #40757	server crash after failed plugin/engine initialization
Submitted:	15 Nov 2008 0:36	Modified:	14 Mar 2:34
Reporter:	Alexey Stroganov
Status:	Closed
Category:	Server	Severity:	S3 (Non-critical)
Version:	5.1.30-win64	OS:	Any
Assigned to:	Ramil Kalimullin	Target Version:	5.1+
Triage:	Triaged: D1 (Critical)

Description:
Starting server on Windows with innodb_flush_method=O_DIRECT causes crash:

./bin/mysqld.exe --no-defaults --basedir=. --datadir=data/
--innodb_flush_method=O_DIRECT

00000001401AF1D4    mysqld.exe!intern_plugin_lock()[sql_plugin.cc:617]
00000001401AF262    mysqld.exe!plugin_lock()[sql_plugin.cc:656]
0000000140047A68    mysqld.exe!ha_resolve_by_legacy_type()[handler.cc:193]
0000000140047AC6    mysqld.exe!ha_checktype()[handler.cc:209]
000000014021DD85    mysqld.exe!open_binary_frm()[table.cc:706]
0000000140220B65    mysqld.exe!open_table_def()[table.cc:619]
0000000140162094    mysqld.exe!get_table_share()[sql_base.cc:377]
00000001401621AD    mysqld.exe!get_table_share_with_create()[sql_base.cc:476]
0000000140164EE3    mysqld.exe!open_unireg_entry()[sql_base.cc:3835]
0000000140169190    mysqld.exe!open_table()[sql_base.cc:2905]
000000014016A205    mysqld.exe!open_tables()[sql_base.cc:4553]
000000014016A898    mysqld.exe!open_and_lock_tables_derived()[sql_base.cc:4956]
0000000140150A4D    mysqld.exe!acl_reload()[sql_acl.cc:702]
00000001401572F0    mysqld.exe!acl_init()[sql_acl.cc:287]
0000000140101800    mysqld.exe!win_main()[mysqld.cc:4295]
0000000140101C02    mysqld.exe!mysql_service()[mysqld.cc:4439]
0000000140101F18    mysqld.exe!main()[mysqld.cc:4612]
00000001403CBEB5    mysqld.exe!__tmainCRTStartup()[crt0.c:327]
0000000077D5964C    kernel32.dll!BaseProcessStart()

How to repeat:
Start server as following:

./bin/mysqld.exe --no-defaults --basedir=. --datadir=data/ --innodb_flush_method=O_DIRECT

Actually it crashes with any value of this parameter except ones that are expected

Just checked it works ok for 5.0.70 and crashes for 5.1.29

Just checked - it works ok in 5.1.27 and 5.1.28. 

Also adding below snippet from documentation:

...
On Windows, the flush method is always async_unbuffered and cannot be changed.
...

Note that there is a bug report for 6.0.8 with a very similar crash, see bug #40766
"mysqld crashes if Falcon is started with non-existing serial log directory". The crash
looks very similar but happens with Falcon and without InnoDB being included in the
binaries.

The crash is caused by the fix of bug#37958, specifically the reuse of plugin slot.

From the error log, the InnoDB clearly identifies the invalid option value, and returns
error to the server:

InnoDB: Unrecognized value O_DIRECT for innodb_flush_method
081117 18:38:28 [ERROR] Plugin 'InnoDB' init function returned error.
081117 18:38:28 [ERROR] Plugin 'InnoDB' registration as a STORAGE ENGINE failed.

It works fine after taking the following new code out:

--- a/sql/handler.cc	2008-09-05 15:21:59 +0000
+++ b/sql/handler.cc	2008-09-29 10:34:07 +0000
@@ -373,6 +373,10 @@ int ha_finalize_handlerton(st_plugin_int
   handlerton *hton= (handlerton *)plugin->data;
   DBUG_ENTER("ha_finalize_handlerton");
 
+  /* hton can be NULL here, if ha_initialize_handlerton() failed. */
+  if (!hton)
+    goto end;
+
   switch (hton->state)
   {
   case SHOW_OPTION_NO:
@@ -401,8 +405,16 @@ int ha_finalize_handlerton(st_plugin_int
     }
   }
 
+  /*
+    In case a plugin is uninstalled and re-installed later, it should
+    reuse an array slot. Otherwise the number of uninstall/install
+    cycles would be limited.
+  */
+  hton2plugin[hton->slot]= NULL;
+
   my_free((uchar*)hton, MYF(0));
 
+ end:
   DBUG_RETURN(0);
 }

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/64543

2750 Ramil Kalimullin	2009-01-29
      Fix for bug #40757: Starting server on Windows with 
      innodb_flush_method=wrong_value causes crash 
      
      Problem: failed plugin initialization (e.g. due to improper parameters)
      may result in server crash.
      
      Fix: clean-up plugin related data if initialization failed.

Bug#40768, bug#42345, bug#41892 marked as duplicates of this one.

Bug: http://bugs.mysql.com/bug.php?id=42302 marked as duplicate of this one.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/65700

2796 Ramil Kalimullin	2009-02-10
      Fix for bug #40757: Starting server on Windows with 
      innodb_flush_method=wrong_value causes crash
      
      Problem: after a failed plugin initialization, incompletely 
      initialized data remained in the plugin and handlerton data 
      structures. These were used later and caused the crash.
      
      Fix: clean-up plugin related data if initialization failed.
      
      Note: no test case added, hand tested.

Good patch. Approved.

Pushed into 6.0.10-alpha (revid:sergey.glukhov@sun.com-20090218125737-5y5b2xo3duo1wlvo)
(version source revid:ramil@mysql.com-20090214140225-jm5lf0aj24so3h8d) (merge vers:
6.0.10-alpha) (pib:6)

Noted in 6.0.10 changelog.

On Windows, starting the server with an invalid value for
innodb_flush_method caused a crash.

Setting report to NDI pending push into 5.1.x.

Pushed into 5.1.33 (revid:joro@sun.com-20090313111355-7bsi1hgkvrg8pdds) (version source
revid:vvaintroub@mysql.com-20090218093153-sjzxf01i4ezte0xp) (merge vers: 5.1.33) (pib:6)

Noted in 5.1.33 changelog.

Bug #43845 was marked as duplicate of this one.

Pushed into 5.1.34-ndb-6.2.18 (revid:jonas@mysql.com-20090508185236-p9b3as7qyauybefl)
(version source revid:jonas@mysql.com-20090508100057-30ote4xggi4nq14v) (merge vers:
5.1.33-ndb-6.2.18) (pib:6)

Pushed into 5.1.34-ndb-6.3.25 (revid:jonas@mysql.com-20090509063138-1u3q3v09wnn2txyt)
(version source revid:jonas@mysql.com-20090508175813-s6yele2z3oh6o99z) (merge vers:
5.1.33-ndb-6.3.25) (pib:6)

Pushed into 5.1.34-ndb-7.0.6 (revid:jonas@mysql.com-20090509154927-im9a7g846c6u1hzc)
(version source revid:jonas@mysql.com-20090509073226-09bljakh9eppogec) (merge vers:
5.1.33-ndb-7.0.6) (pib:6)