Bug #67991 Server crash due to bad "ft_stopword_file"
Submitted: 29 Dec 2012 22:10 Modified: 30 Dec 2012 6:34
Reporter: Jackie Zhang Email Updates:
Status: Verified Impact on me:
None 
Category:MySQL Server: FULLTEXT search Severity:S2 (Serious)
Version:5.5 OS:Linux (Ubuntu)
Assigned to: CPU Architecture:Any

[29 Dec 2012 22:10] Jackie Zhang
Description:
When I wrongly set "ft_stopword_file" to an exist directory name in my.cnf and then start the server, it crashes with the following trace attached below.

My OS is Ubuntu 12.04 (x86_64), and I tried on another machine (Ubuntu 10.04), and the crash is the same.

The wrong setting is quite specific. The value of "ft_stopword_file" should be set as an existing directory path (described in next section). 

===============================TRACE===========================================
$ ./bin/mysqld
121229 13:28:28 InnoDB: The InnoDB memory heap is disabled
121229 13:28:28 InnoDB: Mutexes and rw_locks use GCC atomic builtins
121229 13:28:28 InnoDB: Compressed tables use zlib 1.2.3.4
121229 13:28:28 InnoDB: Initializing buffer pool, size = 128.0M
121229 13:28:28 InnoDB: Completed initialization of buffer pool
121229 13:28:28 InnoDB: highest supported file format is Barracuda.
121229 13:28:29  InnoDB: Waiting for the background threads to start
121229 13:28:30 InnoDB: 1.1.8 started; log sequence number 34427578
./bin/mysqld: Error reading file '/home/jiaqi/mysql-5.5.28/usr/local/mysql/bla' (Errcode: 21)
21:28:30 UTC - mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed, 
something is definitely wrong and this may fail.

key_buffer_size=8388608
read_buffer_size=131072
max_used_connections=0
max_threads=151
thread_count=0
connection_count=0
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 338489 K  bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x0
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0 thread_stack 0x40000
./bin/mysqld(my_print_stacktrace+0x35)[0x849c1e]
./bin/mysqld(handle_fatal_signal+0x3af)[0x70517f]
/lib/x86_64-linux-gnu/libpthread.so.0(+0xfcb0)[0x7fee8c8e3cb0]
./bin/mysqld(my_mb_ctype_8bit+0x3b)[0xa0b82f]
./bin/mysqld(ft_simple_get_word+0x62)[0x995b18]
./bin/mysqld(ft_init_stopwords+0x1e4)[0x99c59d]
./bin/mysqld[0x54933d]
./bin/mysqld(_Z11mysqld_mainiPPc+0x43d)[0x5497ad]
./bin/mysqld(main+0x20)[0x543f24]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed)[0x7fee8bb0176d]
./bin/mysqld[0x543e49]
The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.

How to repeat:
1. make an empty directory

$ mkdir /home/jiaqi/mysql-5.5.28/exist_dir

2. start mysqld with "--ft-stopword-file" configured as the directory (or simply write it in my.cnf)

$ ./bin/mysqld --ft-stopword-file=/home/jiaqi/mysql-5.5.28/exist_dir

3. You will see the crash trace shown in the previous section.

Suggested fix:
The root cause seems to be segfault in "ft_simple_get_word()" according to the trace. I guess it is because the server read the directory structure as the expected file and causes something bad happened. 

Perhaps adding a checking at the very beginning is the most convenient way to workaround the bug.
[30 Dec 2012 6:13] MySQL Verification Team
5.7.1-debug stack trace:

/home/sbester/mysql/release/mysql-5.7.1-m11-linux-x86_64/bin/mysqld: Error reading file '/tmp' (Errcode: 21 - Is a directory)

Program received signal SIGSEGV, Segmentation fault.
my_mb_ctype_8bit (cs=0x1226760, ctype=0x7fffffffde00, s=0x1ad5000 <Address 0x1ad5000 out of bounds>, e=0x10185a67f <Address 0x10185a67f out of bounds>)
at ./strings/ctype-simple.c:1299
1299      *ctype= cs->ctype[*s + 1];
(gdb) bt
#0 in my_mb_ctype_8bit  at ./strings/ctype-simple.c:1299
#1 in ft_simple_get_word at ./storage/myisam/ft_parser.c:218
#2 in ft_init_stopwords () at ./storage/myisam/ft_stopwords.c:95
#3 in init_server_components () at ./sql/mysqld.cc:4979
#4 in mysqld_main at ./sql/mysqld.cc:5363
#5 in __libc_start_main at libc-start.c:226
#6 in _start ()
[30 Dec 2012 6:34] Jackie Zhang
Wow, I'm glad it's repeatable! Thank you, Shane!

Best regards,
Jackie