Bug #82886 Server may crash due to a glibc bug in handling short-lived detached threads
| Submitted: | 7 Sep 2016 10:44 | Modified: | 4 Oct 2016 16:31 |
|---|---|---|---|
| Reporter: | Laurynas Biveinis (OCA) | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server: InnoDB storage engine | Severity: | S1 (Critical) |
| Version: | 5.6 | OS: | Linux |
| Assigned to: | CPU Architecture: | Any | |
| Tags: | glibc, pthreads | ||
[7 Sep 2016 10:44]
Laurynas Biveinis
[7 Sep 2016 10:46]
Laurynas Biveinis
A standalone C program to show the bug:
#include <pthread.h>
#include <stdio.h>
void *thread_routine(void *arg __attribute__((unused)))
{
pthread_exit(0);
return NULL;
}
int main(void)
{
for (int i = 0; i < 32000; i++) {
pthread_t thread_handle;
pthread_attr_t thread_attr;
int err = pthread_attr_init(&thread_attr);
if (err != 0) {
perror("pthread_attr_init");
return 1;
}
err = pthread_attr_setdetachstate(&thread_attr,
PTHREAD_CREATE_DETACHED);
if (err != 0) {
perror("pthread_attr_setdetachstate");
return 4;
}
err = pthread_create(&thread_handle, &thread_attr, &thread_routine,
NULL);
if (err != 0) {
perror("pthread_create");
return 2;
}
err = pthread_attr_destroy(&thread_attr);
if (err != 0) {
perror("pthread_attr_destroy");
return 3;
}
}
return 0;
}
On my VM (Ubuntu 16.04 x86_64), running two copies in parallel crash about every third time. It differs from server source in the use of thread attributes instead of pthread_detach, but this does not appear to be a relevant difference.
[7 Sep 2016 13:35]
MySQL Verification Team
Hello Laurynas, Thank you for the report and test case. Observed the issue using provided 'C' test case on Ubuntu 16.04. Thanks, Umesh
[8 Sep 2016 13:25]
Laurynas Biveinis
Bug 82886 fix for 5.6 (*) I confirm the code being submitted is offered under the terms of the OCA, and that I am authorized to contribute it.
Contribution: bug82886-5.6.patch (application/octet-stream, text), 3.35 KiB.
[8 Sep 2016 13:26]
Laurynas Biveinis
Bug 82886 5.7 patch (*) I confirm the code being submitted is offered under the terms of the OCA, and that I am authorized to contribute it.
Contribution: bug82886-5.7.patch (application/octet-stream, text), 0 bytes.
[8 Sep 2016 13:28]
Laurynas Biveinis
The contributed fixes: - make no attempt to support Windows threads; - strive to be minimal. If they needed not to, then I'd also look into removing FTS_CHILD_EXITING and its associated code, which now looks mostly duplicated by joining.
[8 Sep 2016 13:32]
Laurynas Biveinis
Bug 82886 fix for 5.7, non-empty file this time (*) I confirm the code being submitted is offered under the terms of the OCA, and that I am authorized to contribute it.
Contribution: bug82886-5.7.patch (application/octet-stream, text), 3.94 KiB.
[12 Sep 2016 8:11]
Vasil Dimov
Laurynas, Thank you very much! The patches have been reviewed and pushed to mysql-5.6 (1a08bd0, 5.6.34) and mysql-5.7 (f8fe0bf, 5.7.16). mysql-trunk does not exhibit this problem.
[4 Oct 2016 16:31]
Daniel Price
Posted by developer: Fixed as of the upcoming 5.6.34, 5.7.16, 8.0.1 release, and here's the changelog entry: Due to a glibc bug, short-lived detached threads could exit before the caller has returned from pthread_create(), causing a server exit. Thanks to Laurynas Biveinis for the patch.
[4 Oct 2016 17:41]
Daniel Price
Posted by developer: The fix is in 5.6.35, 5.7.17, and 8.0.1. The changelog entry was updated accordingly.
Portions of this website are copyright © 2001, 2002 The PHP Group
Page generated in 0.046 sec. using MySQL 8.4.7-u6-cloud
Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the
respective copyright holders.
It is not reviewed in advance
by Oracle and does not necessarily represent the opinion of
Oracle or any other party.