MySQL Bugs: #65234: Memcached crashes when use "caching" policy on get and without cas

Bug #65234	Memcached crashes when use "caching" policy on get and without cas_column
Submitted:	8 May 2012 6:51	Modified:	9 Jan 2015 10:17
Reporter:	Peng Shu	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Cluster: Cluster (NDB) storage engine	Severity:	S1 (Critical)
Version:	NDB 7.2.5, MySQL 5.5.20	OS:	Linux (Ubuntu 11.10 x64)
Assigned to:		CPU Architecture:	Any
Tags:	memcached, ndb_engine

Description:
Using "caching" policy on get, and the mapped key-value pair has no cas_column.
When trying to get a value that is not in cache but in ndb, memcached crashes.

<63 get t:1
worker.0 --> attach_thread()
Pipeline 0 attached to S scheduler.
worker.0 ndb_get(): cache miss
worker.0 ndb_get():creating workitem 0.0
worker.0 schedule():SchedulerWorker / config gen. 1
worker.0 worker_set_ext_flag(): 0.0: F
worker.0 --> do_read()
worker.0 --> setKeyForReading()
worker.0 workitem_allocate_rowbuffer_1(): 88 [cls 7]
worker.0 schedule():0.0 placed on send queue.
cl0.conn0.send run_ndb_send_thread():Sent 0.0
cl0.conn0.poll run_ndb_poll_thread(): ** adding 0.0 to wait group ** 
cl0.conn0.poll run_ndb_poll_thread():Polling 0.0
cl0.conn0.poll callback_main():Success.
cl0.conn0.poll worker_finalize_read():0.0
cl0.conn0.poll --> build_hash_item()
cl0.conn0.poll build_hash_item():nbytes: 12   ncopied: 7
Segmentation fault

memcached starts by:
./memcached -E /opt/mysql/mysqlc/lib/ndb_engine.so -e "connectstring=10.0.1.116;debug=true;role=ndb-caching" -vvv -c 20 -t 8 -uroot

How to repeat:
1. Run SQL:
   insert into ndbmemcache.demo_table_tabs values('1', 'a', 'b', 1, 0, NULL);
   (to make the data in ndb only)
2. Start memcached with role=ndb-caching
3. In telnet:
   get t:1
4. Memcached crashes.

Suggested fix:
It seems the crash happens here:
In ndb_worker.cc, function build_hash_item(...)

status = store_item(se, item, wqitem->cas, OPERATION_SET, wqitem->cookie);

When there is no cas_column, wqitem->cas is NULL but the function store_item() is trying assign value to where it points.

Maybe there's something wrong with wqitem->cas?

Facing same problem.
Any workaround or bug fix ?

Thank you for the report.

Verified as described.

Facing the above issue in 7.2.8 GA!

Seems identical to my bug report at #68717

This was fixed in 7.2.11.