Segfault Debian 9 with MySQL 8.0 using libmysqlclient21

[QuantamHD]

I have recently been trying to update the MySQL version at my work to 8, and the first thing I did was to upgrade my mysql2 dependency to 0.5.1 and ActiveRecord to 5.2.0. This resulted in a segmentation fault when trying to query a simple table. The first thing I tried doing was to use the apt repository provided by the MySQL team to use their build of libmysqlclient21 which got the process farther along but still resulted in a segfault. Any ideas on how to fix this?

Ruby 2.5.1
Debian 9
Mysql2 0.5.1
ActiveRecord 5.2.0

Link to Segfault Trace

[sodabrew]

It's crashing at rb_enc_find_index, which is only called in one place while fetching results. It's actually crashing inside that function, which is part of the Ruby API itself. Your Ruby doesn't have debugging symbols available; if you can recompile with symbols that would give more detail here:

/usr/local/lib/libruby.so.2.5(rb_vm_bugreport+0x4f1) [0x7f635ec15221]
/usr/local/lib/libruby.so.2.5(0xaa804) [0x7f635ea90804]
/usr/local/lib/libruby.so.2.5(0x1a0902) [0x7f635eb86902]
/lib/x86_64-linux-gnu/libpthread.so.0(0x7f635e7da0c0) [0x7f635e7da0c0]
/usr/local/lib/libruby.so.2.5(0x7f635eb8f180) [0x7f635eb8f180]
/usr/local/lib/libruby.so.2.5(st_lookup+0x25) [0x7f635eb8ff45]
/usr/local/lib/libruby.so.2.5(rb_enc_find_index+0x45) [0x7f635ea7c6e5]
/usr/local/bundle/gems/mysql2-0.5.1/lib/mysql2/mysql2.so(rb_mysql_result_fetch_row+0x133) [0x7f6358f65f93]
/usr/local/bundle/gems/mysql2-0.5.1/lib/mysql2/mysql2.so(0x9d44) [0x7f6358f64d44]

The code that calls rb_enc_finc_index already protects again NULL values. The API is defined not to crash when requesting an unknown encoding. So I'm really not sure what's going on here.

In mysql2 result.c

    enc_name = mysql2_mysql_enc_to_rb[field.charsetnr-1];
    if (enc_name != NULL) {
      /* use the field encoding we were able to match */
      enc_index = rb_enc_find_index(enc_name);
      rb_enc_set_index(val, enc_index);
    } else {
      /* otherwise fall-back to the connection's encoding */
      rb_enc_associate(val, conn_enc);
    }

[QuantamHD]

Okay, so I've done some additional debugging as well just to give an update.

The following queries works correctly i.e no segfault

a = ActiveRecord::Base.connection.execute("SELECT id,id,id,id,id, FROM organizations").to_a
a = ActiveRecord::Base.connection.execute("SELECT id,id,id,id,id,id FROM organizations").to_a

where id is some integer, but when I call this query

a = ActiveRecord::Base.connection.execute("SELECT name FROM organizations").to_a

there is a segfault. There appears to be something wrong with loading strings which is what you've said before just wanted to make it more specific.

[QuantamHD]

Ran with debugging symbols enabled. @sodabrew

webapps.f4-back-end.puma_1              | -- C level backtrace information -------------------------------------------
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(rb_print_backtrace+0x19) [0x55bb54ed4836] vm_dump.c:703
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(rb_vm_bugreport+0x9e) [0x55bb54ed4c97] vm_dump.c:973
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(rb_bug_context+0x112) [0x55bb54f4b9ad] error.c:580
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(sigsegv+0x60) [0x55bb54e4b631] signal.c:928
webapps.f4-back-end.puma_1              | /lib/x86_64-linux-gnu/libpthread.so.0(0x7fb44721f0c0) [0x7fb44721f0c0]
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(strcasehash+0x42) [0x55bb54e57e6f] st.c:2065
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(do_hash+0x2a) [0x55bb54e5557f] st.c:322
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(st_lookup+0x27) [0x55bb54e564f7] st.c:1080
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(rb_enc_registered+0x4f) [0x55bb54f37992] encoding.c:640
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(rb_enc_find_index+0x18) [0x55bb54f37cee] encoding.c:706
webapps.f4-back-end.puma_1              | /usr/local/bundle/gems/mysql2-0.5.1/lib/mysql2/mysql2.so(mysql2_set_field_string_encoding+0x94) [0x7fb442233515]
webapps.f4-back-end.puma_1              | /usr/local/bundle/gems/mysql2-0.5.1/lib/mysql2/mysql2.so(0xc3e0) [0x7fb4422353e0]
webapps.f4-back-end.puma_1              | /usr/local/bundle/gems/mysql2-0.5.1/lib/mysql2/mysql2.so(0xc7c2) [0x7fb4422357c2]
webapps.f4-back-end.puma_1              | /usr/local/bundle/gems/mysql2-0.5.1/lib/mysql2/mysql2.so(0xcd1e) [0x7fb442235d1e]
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(call_cfunc_m1+0x2f) [0x55bb54eb4664] vm_insnhelper.c:1723
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_call0_cfunc_with_frame+0x16f) [0x55bb54ec52f3] vm_eval.c:85
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_call0_cfunc+0x3b) [0x55bb54ec53eb] vm_eval.c:100
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_call0_body+0x182) [0x55bb54ec556f] vm_eval.c:131
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_call0+0x8e) [0x55bb54ec5182] vm_eval.c:58
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(rb_call0+0xa6) [0x55bb54ec5b3d] vm_eval.c:296
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(rb_call+0x54) [0x55bb54ec6669] vm_eval.c:589
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(iterate_method+0x40) [0x55bb54ec7b19] vm_eval.c:1184
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(rb_iterate0+0x17b) [0x55bb54ec7968] vm_eval.c:1134
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(rb_iterate+0x58) [0x55bb54ec7ad2] vm_eval.c:1166
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(rb_block_call+0x58) [0x55bb54ec7b73] vm_eval.c:1197
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(enum_to_a+0x42) [0x55bb54f3ae33] enum.c:574
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(call_cfunc_m1+0x2f) [0x55bb54eb4664] vm_insnhelper.c:1723
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_call_cfunc_with_frame+0x17f) [0x55bb54eb516c] vm_insnhelper.c:1918
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_call_cfunc+0x95) [0x55bb54eb52b8] vm_insnhelper.c:1934
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_call_method_each_type+0xbe) [0x55bb54eb64f8] vm_insnhelper.c:2232
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_call_method+0x75) [0x55bb54eb6b83] vm_insnhelper.c:2355
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_call_general+0x3b) [0x55bb54eb6d59] vm_insnhelper.c:2398
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_exec_core+0x20dc) [0x55bb54ebcd77] insns.def:915
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_exec+0xe5) [0x55bb54ecd67b] vm.c:1778
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(invoke_block+0xe0) [0x55bb54ecb338] vm.c:979
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(invoke_iseq_block_from_c+0x184) [0x55bb54ecb69f] vm.c:1031
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(invoke_block_from_c_proc+0x6c) [0x55bb54ecba1b] vm.c:1124
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_invoke_proc+0x14f) [0x55bb54ecbbe6] vm.c:1149
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(rb_vm_invoke_proc+0x8f) [0x55bb54ecbd25] vm.c:1179
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_call_opt_call+0x15e) [0x55bb54eb5dd1] vm_insnhelper.c:2065
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_exec_core+0x20dc) [0x55bb54ebcd77] insns.def:915
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_exec+0xe5) [0x55bb54ecd67b] vm.c:1778
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(invoke_block+0xe0) [0x55bb54ecb338] vm.c:979
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(invoke_iseq_block_from_c+0x184) [0x55bb54ecb69f] vm.c:1031
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(invoke_block_from_c_proc+0x6c) [0x55bb54ecba1b] vm.c:1124
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(vm_invoke_proc+0x14f) [0x55bb54ecbbe6] vm.c:1149
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(rb_vm_invoke_proc+0x8f) [0x55bb54ecbd25] vm.c:1179
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(thread_do_start+0x111) [0x55bb54e83205] thread.c:597
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(thread_start_func_2+0x208) [0x55bb54e8349c] thread.c:641
webapps.f4-back-end.puma_1              | /usr/local/bin/ruby(thread_start_func_1+0x4a) [0x55bb54e7f59d] thread_pthread.c:881
webapps.f4-back-end.puma_1              | /lib/x86_64-linux-gnu/libpthread.so.0(0x7494) [0x7fb447215494]
webapps.f4-back-end.puma_1              | /lib/x86_64-linux-gnu/libc.so.6(__clone+0x3f) [0x7fb446817acf]

[QuantamHD]

Okay so after tracing the code I've found that one of two things is true here. It looks like it's trying to dereference a Null pointer which after stepping through the mysql2 code doesn't look like it's happening. Two, that the const char* you guys pass through is somehow freed memory or doesn't belong to the process.

I am using puma but not sure how that would affect anything.

It is failing here in ruby because it is trying to dereference the string that is passed to rb_enc_find_index

strcasehash(st_data_t arg)
{
    register const char *string = (const char *)arg;
    register st_index_t hval = FNV1_32A_INIT;

    /*
     * FNV-1a hash each octet in the buffer
     */
    while (*string) {//HERE HERE
	unsigned int c = (unsigned char)*string++;
	if ((unsigned int)(c - 'A') <= ('Z' - 'A')) c += 'a' - 'A';
	hval ^= c;

	/* multiply by the 32 bit FNV magic prime mod 2^32 */
	hval *= FNV_32_PRIME;
    }
    return hval;
}

[sodabrew]

Two, that the const char* you guys pass through is somehow freed memory or doesn't belong to the process.

😧

[QuantamHD]

I should add I'm not a C expert so I could be talking crazy here.

[QuantamHD]

Would it be worth trying to add a printf line this function to see what the enc_name is and whether it blows up there instead? It might also be possible that the string also might not have been null terminated?

    enc_name = mysql2_mysql_enc_to_rb[field.charsetnr-1];
    if (enc_name != NULL) {
      /* use the field encoding we were able to match */
      enc_index = rb_enc_find_index(enc_name);
      rb_enc_set_index(val, enc_index);
    } else {
      /* otherwise fall-back to the connection's encoding */
      rb_enc_associate(val, conn_enc);
    }

[QuantamHD]

Okay, so when you look up the charsetnr in mysql2_mysql_enc_to_rb my mysql server reports my charsetnr as 254 which breaks the bounds of the array which explains the segfault. This is the bug.