| Bug #46456 | HANDLER OPEN + TRUNCATE + DROP (temporary) TABLE, crash | ||
|---|---|---|---|
| Submitted: | 29 Jul 2009 17:44 | Modified: | 18 Dec 2009 13:24 |
| Reporter: | Matthias Leich | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server: Locking | Severity: | S3 (Non-critical) |
| Version: | 5.1, 5.4 | OS: | Any |
| Assigned to: | Ramil Kalimullin | CPU Architecture: | Any |
[12 Aug 2009 16:52]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/80695 3062 Ramil Kalimullin 2009-08-12 Fix for bug #46456 [Ver->Prg]: HANDLER OPEN + TRUNCATE + DROP (temporary) TABLE, crash Problem: if one has an open "HANDLER t1", further "TRUNCATE t1" doesn't close the handler and leaves handler table hash in an inconsistent state, that may lead to a server crash. Fix: TRUNCATE should implicitly close all open handlers. Doc. request: the fact should be described in the manual accordingly. @ mysql-test/r/handler_myisam.result Fix for bug #46456 [Ver->Prg]: HANDLER OPEN + TRUNCATE + DROP (temporary) TABLE, crash - test result. @ mysql-test/t/handler_myisam.test Fix for bug #46456 [Ver->Prg]: HANDLER OPEN + TRUNCATE + DROP (temporary) TABLE, crash - test case. @ sql/sql_delete.cc Fix for bug #46456 [Ver->Prg]: HANDLER OPEN + TRUNCATE + DROP (temporary) TABLE, crash - remove all truncated tables from the HANDLER's hash.
[21 Aug 2009 5:56]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/81232 3075 Ramil Kalimullin 2009-08-21 Fix for bug #46456 [Ver->Prg]: HANDLER OPEN + TRUNCATE + DROP (temporary) TABLE, crash Problem: if one has an open "HANDLER t1", further "TRUNCATE t1" doesn't close the handler and leaves handler table hash in an inconsistent state, that may lead to a server crash. Fix: TRUNCATE should implicitly close all open handlers. Doc. request: the fact should be described in the manual accordingly. @ mysql-test/r/handler_myisam.result Fix for bug #46456 [Ver->Prg]: HANDLER OPEN + TRUNCATE + DROP (temporary) TABLE, crash - test result. @ mysql-test/t/handler_myisam.test Fix for bug #46456 [Ver->Prg]: HANDLER OPEN + TRUNCATE + DROP (temporary) TABLE, crash - test case. @ sql/sql_delete.cc Fix for bug #46456 [Ver->Prg]: HANDLER OPEN + TRUNCATE + DROP (temporary) TABLE, crash - remove all truncated tables from the HANDLER's hash.
[2 Sep 2009 16:42]
Bugs System
Pushed into 5.1.39 (revid:joro@sun.com-20090902154533-8actmfcsjfqovgsb) (version source revid:ramil@mysql.com-20090821055535-a5aeas33epokjjnp) (merge vers: 5.1.39) (pib:11)
[14 Sep 2009 16:03]
Bugs System
Pushed into 5.4.4-alpha (revid:alik@sun.com-20090914155317-m1g9wodmndzdj4l1) (version source revid:alik@sun.com-20090914155317-m1g9wodmndzdj4l1) (merge vers: 5.4.4-alpha) (pib:11)
[18 Sep 2009 19:42]
Paul DuBois
Noted in 5.1.39, 5.4.4 changelogs. TRUNCATE TABLE for a table that was opened with HANDLER did not close the handler and left it in an inconsistent state that could lead to a server crash.
[1 Oct 2009 5:59]
Bugs System
Pushed into 5.1.39-ndb-6.3.28 (revid:jonas@mysql.com-20091001055605-ap2kiaarr7p40mmv) (version source revid:jonas@mysql.com-20091001055605-ap2kiaarr7p40mmv) (merge vers: 5.1.39-ndb-6.3.28) (pib:11)
[1 Oct 2009 7:25]
Bugs System
Pushed into 5.1.39-ndb-7.0.9 (revid:jonas@mysql.com-20091001072547-kv17uu06hfjhgjay) (version source revid:jonas@mysql.com-20091001071652-irejtnumzbpsbgk2) (merge vers: 5.1.39-ndb-7.0.9) (pib:11)
[1 Oct 2009 13:25]
Bugs System
Pushed into 5.1.39-ndb-7.1.0 (revid:jonas@mysql.com-20091001123013-g9ob2tsyctpw6zs0) (version source revid:jonas@mysql.com-20091001123013-g9ob2tsyctpw6zs0) (merge vers: 5.1.39-ndb-7.1.0) (pib:11)
[2 Oct 2009 1:22]
Paul DuBois
Move 5.4 changelog entry from 5.4.4 to 5.4.3.
[2 Oct 2009 17:16]
Paul DuBois
Added to changelog entry: Now TRUNCATE TABLE for a table closes all open handlers for the table. Also updated HANDLER and TRUNCATE TABLE sections of manual accordingly.
[5 Oct 2009 10:50]
Bugs System
Pushed into 5.1.39-ndb-6.2.19 (revid:jonas@mysql.com-20091005103850-dwij2dojwpvf5hi6) (version source revid:jonas@mysql.com-20090930185117-bhud4ek1y0hsj1nv) (merge vers: 5.1.39-ndb-6.2.19) (pib:11)
[13 Oct 2009 18:30]
Bugs System
Pushed into 5.1.41 (revid:build@mysql.com-20091013182142-vgsjky3t1v4btufv) (version source revid:build@mysql.com-20091013182142-vgsjky3t1v4btufv) (merge vers: 5.1.41) (pib:13)
[13 Oct 2009 23:31]
Paul DuBois
Already fixed in 5.1.39.
[22 Oct 2009 6:33]
Bugs System
Pushed into 6.0.14-alpha (revid:alik@sun.com-20091022063126-l0qzirh9xyhp0bpc) (version source revid:alik@sun.com-20091019135554-s1pvptt6i750lfhv) (merge vers: 6.0.14-alpha) (pib:13)
[22 Oct 2009 7:05]
Bugs System
Pushed into 5.5.0-beta (revid:alik@sun.com-20091022060553-znkmxm0g0gm6ckvw) (version source revid:alik@sun.com-20091019131937-nchb8tjk88jpfjav) (merge vers: 5.5.0-beta) (pib:13)
[22 Oct 2009 19:17]
Paul DuBois
Noted in 5.5.0, 6.0.14 changelogs.
[18 Dec 2009 10:26]
Bugs System
Pushed into 5.1.41-ndb-7.1.0 (revid:jonas@mysql.com-20091218102229-64tk47xonu3dv6r6) (version source revid:jonas@mysql.com-20091218095730-26gwjidfsdw45dto) (merge vers: 5.1.41-ndb-7.1.0) (pib:15)
[18 Dec 2009 10:42]
Bugs System
Pushed into 5.1.41-ndb-6.2.19 (revid:jonas@mysql.com-20091218100224-vtzr0fahhsuhjsmt) (version source revid:jonas@mysql.com-20091217101452-qwzyaig50w74xmye) (merge vers: 5.1.41-ndb-6.2.19) (pib:15)
[18 Dec 2009 10:58]
Bugs System
Pushed into 5.1.41-ndb-6.3.31 (revid:jonas@mysql.com-20091218100616-75d9tek96o6ob6k0) (version source revid:jonas@mysql.com-20091217154335-290no45qdins5bwo) (merge vers: 5.1.41-ndb-6.3.31) (pib:15)
[18 Dec 2009 11:12]
Bugs System
Pushed into 5.1.41-ndb-7.0.11 (revid:jonas@mysql.com-20091218101303-ga32mrnr15jsa606) (version source revid:jonas@mysql.com-20091218064304-ezreonykd9f4kelk) (merge vers: 5.1.41-ndb-7.0.11) (pib:15)
[18 Dec 2009 13:24]
MC Brown
Already noted in earlier changelogs.
Description: --disable_warnings DROP TABLE IF EXISTS t1; --enable_warnings CREATE TEMPORARY TABLE t1 AS SELECT 1 AS f1; HANDLER t1 OPEN; TRUNCATE t1; # Here comes the crash DROP TABLE t1; Backtrace from mysql-5.1-bugteam 2009-07-29: -------------------------------------------- #0 0x00007f044d9cece6 in pthread_kill () from /lib64/libpthread.so.0 #1 0x0000000000afe9fb in my_write_core (sig=11) at stacktrace.c:310 #2 0x00000000006b59a7 in handle_segfault (sig=11) at mysqld.cc:2552 #3 <signal handler called> #4 0x00000000005ccc00 in handler::ha_index_or_rnd_end (this=0x8f8f8f8f8f8f8f8f) at handler.h:1204 #5 0x00000000005cb062 in mysql_ha_close_table (thd=0x118d1e8, tables=0x121c5e8, is_locked=false) at sql_handler.cc:159 #6 0x00000000005cb310 in mysql_ha_rm_tables (thd=0x118d1e8, tables=0x11f5230, is_locked=false) at sql_handler.cc:765 #7 0x000000000081e4cc in mysql_rm_table_part2 (thd=0x118d1e8, tables=0x11f5230, if_exists=false, drop_temporary=false, drop_view=false, dont_log_query=false) at sql_table.cc:1817 #8 0x000000000081f136 in mysql_rm_table (thd=0x118d1e8, tables=0x11f5230, if_exists=0 '\0', drop_temporary=0 '\0') at sql_table.cc:1749 #9 0x00000000006ca99a in mysql_execute_command (thd=0x118d1e8) at sql_parse.cc:3352 #10 0x00000000006cffbc in mysql_parse (thd=0x118d1e8, inBuf=0x11f5168 "DROP TABLE t1", length=13, found_semicolon=0x40c0bef0) at sql_parse.cc:5931 #11 0x00000000006d0de9 in dispatch_command (command=COM_QUERY, thd=0x118d1e8, packet=0x11e1729 "DROP TABLE t1", packet_length=13) at sql_parse.cc:1213 #12 0x00000000006d2197 in do_command (thd=0x118d1e8) at sql_parse.cc:854 #13 0x00000000006bed68 in handle_one_connection (arg=0x118d1e8) at sql_connect.cc:1127 #14 0x00007f044d9ca040 in start_thread () from /lib64/libpthread.so.0 #15 0x00007f044cc7808d in clone () from /lib64/libc.so.6 #16 0x0000000000000000 in ?? () The "magic" thing is that I use a *TEMPORARY* TABLE. In case of a non TEMPORARY TABLE I get query 'TRUNCATE t1' failed: 1105: MyISAM table 't1' is in use (most likely by a MERGE table). Try FLUSH TABLES. which is acceptable. Results on MySQL 5.4 Azalea 2009-07-23: --------------------------------------- temporary table: crash with backtrace similar to above no temporary table: Bug#46452 Crash in MDL, HANDLER OPEN + TRUNCATE TABLE = the backtrace is different and shows MDL stuff Results on mysql-5.0-bugteam 2009-07-14: ---------------------------------------- No crash and for temporary table: TRUNCATE is successful non temporary table: TRUNCATE fails with 1105: MyISAM table 't1' is in use (most likely by a MERGE table). Try FLUSH TABLES. "Nice" inconsistency My environment: - All release compiled from source with /BUILD/compile-pentium64-debug-max - Linux OpenSuSE 11,0 (64 Bit) IMHO the current crash could be used for a DoS attack. How to repeat: Please see above