Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

YCQL: SIGBUS crash on invalid statement #2476

Closed
ttyusupov opened this issue Oct 1, 2019 · 4 comments
Closed

YCQL: SIGBUS crash on invalid statement #2476

ttyusupov opened this issue Oct 1, 2019 · 4 comments
Assignees
@OlegLoginov
Labels
area/ysql Yugabyte SQL (YSQL) kind/bug This issue is a bug

Comments

@ttyusupov
Copy link
Contributor

Steps to reproduce on a fresh local cluster:

11:33 $ cqlsh
Connected to local cluster at 127.0.0.1:9042.
[cqlsh 5.0.1 | Cassandra 3.9-SNAPSHOT | CQL spec 3.4.2 | Native protocol v4]
Use HELP for help.
cqlsh> VALUES (1, 'Bob', 35, 'Ruby', '{"name": "John", 33, "age": 35}');
NoHostAvailable:

From tserver.err:

*** Aborted at 1569918922 (unix time) try "date -d @1569918922" if you are using GNU date ***
PC: @        0x1102fed18 yb::ql::TreeListNode<>
*** SIGBUS (@0x1102fed18) received by PID 50650 (TID 0x7000014b0000) stack trace: ***
    @     0x7fff649f3b5d _sigtramp
    @               0x20 (unknown)
    @        0x10faf1d81  yb::ql::GramProcessor::parse()
    @        0x10fab840d  yb::ql::Parser::Parse()
    @        0x10f7174a5  yb::ql::QLProcessor::Parse()
    @        0x10f717877  yb::ql::QLProcessor::Prepare()
    @        0x10f719888  yb::ql::QLProcessor::RunAsync()
    @        0x10d828060  yb::cqlserver::CQLProcessor::ProcessRequest()
    @        0x10d827239  yb::cqlserver::CQLProcessor::ProcessRequest()
    @        0x10d826b7d  yb::cqlserver::CQLProcessor::ProcessCall()
    @        0x10d859f0c  yb::cqlserver::CQLServiceImpl::Handle()
    @        0x116f5bb63  yb::rpc::ServicePoolImpl::Handle()
    @        0x116ec3369  yb::rpc::InboundCall::InboundCallTask::Run()
    @        0x116f70d1f  yb::rpc::(anonymous namespace)::Worker::Execute()
    @        0x1185faf03  yb::Thread::SuperviseThread()
    @     0x7fff649fc2eb _pthread_body
    @     0x7fff649ff249 _pthread_start
    @     0x7fff649fb40d thread_start
@ttyusupov ttyusupov added area/ysql Yugabyte SQL (YSQL) kind/bug This issue is a bug labels Oct 1, 2019
@OlegLoginov
Copy link
Contributor

Parser log:

Starting parse
Entering state 0
Reading a token: Next token is token VALUES (1.1-6: values)
Shifting token VALUES (1.1-6: values)
Entering state 50
Reading a token: Next token is token '(' (1.7-8: )
Shifting token '(' (1.7-8: )
Entering state 930
Reading a token: Next token is token ICONST (1.9: 0x10e3b1038)
Shifting token ICONST (1.9: 0x10e3b1038)
Entering state 717
Reducing stack by rule 834 (line 4422):
   $1 = token ICONST (1.9: 0x10e3b1038)
-> $$ = nterm AexprConst (1.9: 0x10e3b10c0)
Stack now 930 50 0
Entering state 750
Reducing stack by rule 586 (line 3473):
   $1 = nterm AexprConst (1.9: 0x10e3b10c0)
-> $$ = nterm c_expr (1.9: 0x10e3b10c0)
Stack now 930 50 0
Entering state 733
Reducing stack by rule 492 (line 3184):
   $1 = nterm c_expr (1.9: 0x10e3b10c0)
-> $$ = nterm a_expr (1.9: 0x10e3b10c0)
Stack now 930 50 0
Entering state 1447
Reading a token: Next token is token ',' (1.10: )
Reducing stack by rule 797 (line 4243):
   $1 = nterm a_expr (1.9: 0x10e3b10c0)
-> $$ = nterm ctext_expr (1.9: 0x10e3b10c0)
Stack now 930 50 0
Entering state 1449
Reducing stack by rule 795 (line 4233):
   $1 = nterm ctext_expr (1.9: 0x10e3b10c0)
-> $$ = nterm ctext_expr_list (1.9: 0x10e3b1180)
Stack now 930 50 0
Entering state 1448
Next token is token ',' (1.10: )
Shifting token ',' (1.10: )
Entering state 2172
Reading a token: Next token is token SCONST (1.11-16: 0x10e3b1200)
Shifting token SCONST (1.11-16: 0x10e3b1200)
Entering state 712
Reducing stack by rule 851 (line 4481):
   $1 = token SCONST (1.11-16: 0x10e3b1200)
-> $$ = nterm Sconst (1.11-16: 0x10e3b1200)
Stack now 2172 1448 930 50 0
Entering state 751
Reducing stack by rule 839 (line 4437):
   $1 = nterm Sconst (1.11-16: 0x10e3b1200)
-> $$ = nterm AexprConst (1.11-16: 0x10e3b1288)
Stack now 2172 1448 930 50 0
Entering state 750
Reducing stack by rule 586 (line 3473):
   $1 = nterm AexprConst (1.11-16: 0x10e3b1288)
-> $$ = nterm c_expr (1.11-16: 0x10e3b1288)
Stack now 2172 1448 930 50 0
Entering state 733
Reducing stack by rule 492 (line 3184):
   $1 = nterm c_expr (1.11-16: 0x10e3b1288)
-> $$ = nterm a_expr (1.11-16: 0x10e3b1288)
Stack now 2172 1448 930 50 0
Entering state 1447
Reading a token: Next token is token ',' (1.17: )
Reducing stack by rule 797 (line 4243):
   $1 = nterm a_expr (1.11-16: 0x10e3b1288)
-> $$ = nterm ctext_expr (1.11-16: 0x10e3b1288)
Stack now 2172 1448 930 50 0
Entering state 2880
Reducing stack by rule 796 (line 4236):
   $1 = nterm ctext_expr_list (1.9: 0x10e3b1180)
   $2 = token ',' (1.10: )
   $3 = nterm ctext_expr (1.11-16: 0x10e3b1288)
-> $$ = nterm ctext_expr_list (1.9-16: 0x10e3b1180)
Stack now 930 50 0
Entering state 1448
Next token is token ',' (1.17: )
Shifting token ',' (1.17: )
Entering state 2172
Reading a token: Next token is token ICONST (1.18-20: 0x10e3b1320)
Shifting token ICONST (1.18-20: 0x10e3b1320)
Entering state 717
Reducing stack by rule 834 (line 4422):
   $1 = token ICONST (1.18-20: 0x10e3b1320)
-> $$ = nterm AexprConst (1.18-20: 0x10e3b13a8)
Stack now 2172 1448 930 50 0
Entering state 750
Reducing stack by rule 586 (line 3473):
   $1 = nterm AexprConst (1.18-20: 0x10e3b13a8)
-> $$ = nterm c_expr (1.18-20: 0x10e3b13a8)
Stack now 2172 1448 930 50 0
Entering state 733
Reducing stack by rule 492 (line 3184):
   $1 = nterm c_expr (1.18-20: 0x10e3b13a8)
-> $$ = nterm a_expr (1.18-20: 0x10e3b13a8)
Stack now 2172 1448 930 50 0
Entering state 1447
Reading a token: Next token is token ',' (1.21: )
Reducing stack by rule 797 (line 4243):
   $1 = nterm a_expr (1.18-20: 0x10e3b13a8)
-> $$ = nterm ctext_expr (1.18-20: 0x10e3b13a8)
Stack now 2172 1448 930 50 0
Entering state 2880
Reducing stack by rule 796 (line 4236):
   $1 = nterm ctext_expr_list (1.9-16: 0x10e3b1180)
   $2 = token ',' (1.17: )
   $3 = nterm ctext_expr (1.18-20: 0x10e3b13a8)
-> $$ = nterm ctext_expr_list (1.9-20: 0x10e3b1180)
Stack now 930 50 0
Entering state 1448
Next token is token ',' (1.21: )
Shifting token ',' (1.21: )
Entering state 2172
Reading a token: Next token is token SCONST (1.22-28: 0x10e3b1440)
Shifting token SCONST (1.22-28: 0x10e3b1440)
Entering state 712
Reducing stack by rule 851 (line 4481):
   $1 = token SCONST (1.22-28: 0x10e3b1440)
-> $$ = nterm Sconst (1.22-28: 0x10e3b1440)
Stack now 2172 1448 930 50 0
Entering state 751
Reducing stack by rule 839 (line 4437):
   $1 = nterm Sconst (1.22-28: 0x10e3b1440)
-> $$ = nterm AexprConst (1.22-28: 0x10e3b14c8)
Stack now 2172 1448 930 50 0
Entering state 750
Reducing stack by rule 586 (line 3473):
   $1 = nterm AexprConst (1.22-28: 0x10e3b14c8)
-> $$ = nterm c_expr (1.22-28: 0x10e3b14c8)
Stack now 2172 1448 930 50 0
Entering state 733
Reducing stack by rule 492 (line 3184):
   $1 = nterm c_expr (1.22-28: 0x10e3b14c8)
-> $$ = nterm a_expr (1.22-28: 0x10e3b14c8)
Stack now 2172 1448 930 50 0
Entering state 1447
Reading a token: Next token is token ',' (I1004 19:16:30.368161 217468928 reactor.cc:420] Master_R002: timer tick at 415744
1.29: )
Reducing stack by rule 797 (line 4243):
   $1 = nterm a_expr (1.22-28: 0x10e3b14c8)
-> $$ = nterm ctext_expr (1.22-28: 0x10e3b14c8)
Stack now 2172 1448 930 50 0
Entering state 2880
Reducing stack by rule 796 (line 4236):
   $1 = nterm ctext_expr_list (1.9-20: 0x10e3b1180)
   $2 = token ',' (1.21: )
   $3 = nterm ctext_expr (1.22-28: 0x10e3b14c8)
-> $$ = nterm ctext_expr_list (1.9-28: 0x10e3b1180)
Stack now 930 50 0
Entering state 1448
Next token is token ',' (1.29: )
Shifting token ',' (1.29: )
Entering state 2172
Reading a token: Next token is token SCONST (1.30-63: 0x10e3b1560)
Shifting token SCONST (1.30-63: 0x10e3b1560)
Entering state 712
Reducing stack by rule 851 (line 4481):
   $1 = token SCONST (1.30-63: 0x10e3b1560)
-> $$ = nterm Sconst (1.30-63: 0x10e3b1560)
Stack now 2172 1448 930 50 0
Entering state 751
Reducing stack by rule 839 (line 4437):
   $1 = nterm Sconst (1.30-63: 0x10e3b1560)
-> $$ = nterm AexprConst (1.30-63: 0x10e3b1608)
Stack now 2172 1448 930 50 0
Entering state 750
Reducing stack by rule 586 (line 3473):
   $1 = nterm AexprConst (1.30-63: 0x10e3b1608)
-> $$ = nterm c_expr (1.30-63: 0x10e3b1608)
Stack now 2172 1448 930 50 0
Entering state 733
Reducing stack by rule 492 (line 3184):
   $1 = nterm c_expr (1.30-63: 0x10e3b1608)
-> $$ = nterm a_expr (1.30-63: 0x10e3b1608)
Stack now 2172 1448 930 50 0
Entering state 1447
Reading a token: Next token is token ')' (1.64: )
Reducing stack by rule 797 (line 4243):
   $1 = nterm a_expr (1.30-63: 0x10e3b1608)
-> $$ = nterm ctext_expr (1.30-63: 0x10e3b1608)
Stack now 2172 1448 930 50 0
Entering state 2880
Reducing stack by rule 796 (line 4236):
   $1 = nterm ctext_expr_list (1.9-28: 0x10e3b1180)
   $2 = token ',' (1.29: )
   $3 = nterm ctext_expr (1.30-63: 0x10e3b1608)
-> $$ = nterm ctext_expr_list (1.9-63: 0x10e3b1180)
Stack now 930 50 0
Entering state 1448
Next token is token ')' (1.64: )
Shifting token ')' (1.64: )
Entering state 2171
Reducing stack by rule 794 (line 4223):
   $1 = token '(' (1.7-8: )
   $2 = nterm ctext_expr_list (1.9-63: 0x10e3b1180)
   $3 = token ')' (1.64: )
-> $$ = nterm ctext_row (1.7-64: 0x10e3b1180)
Stack now 50 0
Entering state 931
Reducing stack by rule 280 (line 2174):
   $1 = token VALUES (1.1-6: values)
   $2 = nterm ctext_row (1.7-64: 0x10e3b1180)
-> $$ = nterm values_clause (1.1-64: 0x10e3b16e8)
Stack now 0
Entering state 67
Reading a token: Next token is token ';' (1.65: )
Reducing stack by rule 267 (line 2099):
   $1 = nterm values_clause (1.1-64: 0x10e3b16e8)
-> $$ = nterm select_no_parens (1.1-64: 0x10e3b16e8)
Stack now 0
Entering state 64
Reducing stack by rule 263 (line 2072):
   $1 = nterm select_no_parens (1.1-64: 0x10e3b16e8)
-> $$ = nterm SelectStmt (1.1-64: 0x10e3b16e8)
Stack now 0
Entering state 62
Reducing stack by rule 27 (line 920):
   $1 = nterm SelectStmt (1.1-64: 0x10e3b16e8)
*** Aborted at 1570205790 (unix time) try "date -d @1570205790" if you are using GNU date ***
PC: @                0x0 (unknown)
*** SIGSEGV (@0x0) received by PID 40112 (TID 0x1126ee5c0) stack trace: ***
    @     0x7fff5c6d6b3d _sigtramp
    @     0x7ffeea76eb08 (unknown)
I1004 19:16:30.371611 216395776 reactor.cc:420] Master_R000: timer tick at 415744
    @        0x105933b03 yb::ql::GramProcessor::parse()
    @        0x10590b527 yb::ql::Parser::Parse()
    @        0x1057635a6 yb::ql::QLProcessor::Parse()
    @        0x1054aae60 yb::ql::QLTestBase::TestParser()
    @        0x1054aa946 yb::ql::QLTestParser_TestQLParser_Test::TestBody()
    @        0x10a1819a8 testing::internal::HandleExceptionsInMethodIfSupported<>()
    @        0x10a1818fd testing::Test::Run()
    @        0x10a182ad0 testing::TestInfo::Run()
    @        0x10a183377 testing::TestCase::Run()
    @        0x10a18bd37 testing::internal::UnitTestImpl::RunAllTests()
    @        0x10a18b7c8 testing::internal::HandleExceptionsInMethodIfSupported<>()
    @        0x10a18b738 testing::UnitTest::Run()
    @        0x10553aaab main
    @     0x7fff5c4ebed9 start
Process finished with exit code 139 (interrupted by signal 11: SIGSEGV)

@OlegLoginov
Copy link
Contributor

Root cause: invalid pointer cast from PTInsertValuesClause into PTDmlStmt:

class Parser {
  void SetBindVariables(PTDmlStmt *stmt) {
    parse_context_->GetBindVariables(&stmt->bind_variables());
  }


stmt = {yb::ql::PTInsertValuesClause * | 0x111a446e8} 0x0000000111a446e8
 yb::ql::PTCollection = {yb::ql::PTCollection} 

  | SelectStmt {
    if ($1 != nullptr) {
      parser_->SetBindVariables(static_cast<PTDmlStmt*>($1.get()));    <<<<<<<<<<<<<<<
    }
    $$ = $1;
  }

@OlegLoginov
Copy link
Contributor

Fix:

   | SelectStmt {
     if ($1 != nullptr) {
       if ($1->IsDml()) {
         parser_->SetBindVariables(static_cast<PTDmlStmt*>($1.get()));
       } else { // PTInsertValuesClause, etc.
         PARSER_UNSUPPORTED(@1);
       }
     }
     $$ = $1;
   }

OlegLoginov added a commit that referenced this issue Oct 9, 2019
@OlegLoginov
[YCQL] #2476: Fix for SIGBUS TS crash on invalid statement
6449376 
Summary:
Fixed TS crash in the CQL parser.
Root cause: invalid pointer cast from PTInsertValuesClause into PTDmlStmt:

$1 = {yb::ql::PTInsertValuesClause * | 0x111a446e8}
```
  | SelectStmt {
    if ($1 != nullptr) {
      parser_->SetBindVariables(static_cast<PTDmlStmt*>($1.get()));    <<<<<<<<<<<<<<<
    }
    $$ = $1;
  }
```

Test Plan: ybd  --cxx-test ql-parser-test --gtest_filter QLTestParser.TestQLParser

Reviewers: timur, alex, neil

Reviewed By: neil

Subscribers: yql

Differential Revision: https://phabricator.dev.yugabyte.com/D7356
@OlegLoginov
Copy link
Contributor

Fixed by the commit above.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@OlegLoginov OlegLoginov

Labels
area/ysql Yugabyte SQL (YSQL) kind/bug This issue is a bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@ttyusupov @OlegLoginov