Bug #65234 Memcached crashes when use "caching" policy on get and without cas_column
Submitted: 8 May 2012 6:51 Modified: 9 Jan 2015 10:17
Reporter: Peng Shu Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Cluster: Cluster (NDB) storage engine Severity:S1 (Critical)
Version:NDB 7.2.5, MySQL 5.5.20 OS:Linux (Ubuntu 11.10 x64)
Assigned to:
Tags: memcached, ndb_engine
Triage: Needs Triage: D1 (Critical)

[8 May 2012 6:51] Peng Shu
Description:
Using "caching" policy on get, and the mapped key-value pair has no cas_column.
When trying to get a value that is not in cache but in ndb, memcached crashes.

<63 get t:1
worker.0 --> attach_thread()
Pipeline 0 attached to S scheduler.
worker.0 ndb_get(): cache miss
worker.0 ndb_get():creating workitem 0.0
worker.0 schedule():SchedulerWorker / config gen. 1
worker.0 worker_set_ext_flag(): 0.0: F
worker.0 --> do_read()
worker.0 --> setKeyForReading()
worker.0 workitem_allocate_rowbuffer_1(): 88 [cls 7]
worker.0 schedule():0.0 placed on send queue.
cl0.conn0.send run_ndb_send_thread():Sent 0.0
cl0.conn0.poll run_ndb_poll_thread(): ** adding 0.0 to wait group ** 
cl0.conn0.poll run_ndb_poll_thread():Polling 0.0
cl0.conn0.poll callback_main():Success.
cl0.conn0.poll worker_finalize_read():0.0
cl0.conn0.poll --> build_hash_item()
cl0.conn0.poll build_hash_item():nbytes: 12   ncopied: 7
Segmentation fault

memcached starts by:
./memcached -E /opt/mysql/mysqlc/lib/ndb_engine.so -e "connectstring=10.0.1.116;debug=true;role=ndb-caching" -vvv -c 20 -t 8 -uroot

How to repeat:
1. Run SQL:
   insert into ndbmemcache.demo_table_tabs values('1', 'a', 'b', 1, 0, NULL);
   (to make the data in ndb only)
2. Start memcached with role=ndb-caching
3. In telnet:
   get t:1
4. Memcached crashes.

Suggested fix:
It seems the crash happens here:
In ndb_worker.cc, function build_hash_item(...)

status = store_item(se, item, wqitem->cas, OPERATION_SET, wqitem->cookie);

When there is no cas_column, wqitem->cas is NULL but the function store_item() is trying assign value to where it points.

Maybe there's something wrong with wqitem->cas?
[10 May 2012 16:00] Amol Rajoba
Facing same problem.
Any workaround or bug fix ?
[11 May 2012 21:02] Sveta Smirnova
Thank you for the report.

Verified as described.
[8 Dec 2012 11:37] Shahanavaz Syed
Facing the above issue in 7.2.8 GA!
[16 Apr 2013 16:14] Joshua Gigg
Seems identical to my bug report at #68717
[25 Oct 2013 16:54] John Duncan
This was fixed in 7.2.11.