Segfault when used within a forking application

[justinschoeman]

This is tested with DBD::Oracle from 1.83 to current git head. And with Oracle Client Library versions from 19.4 to 23.4.

The following test application omits the guts of the main and child processes, but still triggers the issue:

test-clean.pl.gz

It usually takes a few 100 to 1000 iterations, but it eventually crashes with:

kpedbg_dmp_stack()+396<-kpeDbgCrash()+204<-kpeDbgSignalHandler()+113<-skgesig_sigactionHandler()+258<-__sighandler()<-Perl_csighandler3()+80<-__sighandler()<-__futex_abstimed_wait_common()+169<-pthread_cond_timedwait()+610<-sltspctimewait()+131<-kpucpincrtime()+113<-start_thread()+759<-__clone3()+44
Segmentation fault (core dumped)

The stack trace is:

(gdb) t a a bt

Thread 2 (Thread 0x7fe9e13dad40 (LWP 3995823)):
#0  0x00007fe9e0f2640a in __GI___libc_read (nbytes=8208, buf=0x558fb093f936, fd=4) at ../sysdeps/unix/sysv/linux/read.c:26
#1  __GI___libc_read (fd=4, buf=0x558fb093f936, nbytes=8208) at ../sysdeps/unix/sysv/linux/read.c:24
#2  0x00007fe9d24d02d0 in snttread () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#3  0x00007fe9d24ceb35 in nttfprd () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#4  0x00007fe9d24c3c95 in nsbasic_brc () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#5  0x00007fe9d24b7e7f in nioqrc () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#6  0x00007fe9d24f7ecf in ttcdrv () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#7  0x00007fe9d24bdccd in nioqwa () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#8  0x00007fe9d248b690 in upirtrc () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#9  0x00007fe9d24a0331 in kpurcsc () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#10 0x00007fe9d2490f40 in kpuexec () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#11 0x00007fe9d248ad49 in OCIStmtExecute () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#12 0x00007fe9e0da43ae in ora_st_execute (sth=0x558fb094ac70, imp_sth=0x558fb067d010) at /home/justin/git/DBD-Oracle/dbdimp.c:3433
#13 0x00007fe9e0d899d8 in XS_DBD__Oracle__st_execute (my_perl=0x558fb03492a0, cv=<optimized out>) at ./Oracle.xsi:640
#14 0x00007fe9e0dd0028 in XS_DBI_dispatch (my_perl=0x558fb03492a0, cv=0x558fb0639e30) at /usr/src/debug/perl-DBI-1.643-18.fc39.x86_64/DBI.xs:3783
#15 0x00007fe9e113c5ea in Perl_pp_entersub (my_perl=0x558fb03492a0) at /usr/src/debug/perl-5.38.2-502.fc39.x86_64/pp_hot.c:5555
#16 0x00007fe9e112d618 in Perl_runops_standard (my_perl=0x558fb03492a0) at /usr/src/debug/perl-5.38.2-502.fc39.x86_64/run.c:41
#17 0x00007fe9e107324f in Perl_call_sv (my_perl=my_perl@entry=0x558fb03492a0, sv=<optimized out>, flags=flags@entry=2) at /usr/src/debug/perl-5.38.2-502.fc39.x86_64/perl.c:3133
#18 0x00007fe9e0dd0804 in XS_DBI_dispatch (my_perl=0x558fb03492a0, cv=0x558fb06320e0) at /usr/src/debug/perl-DBI-1.643-18.fc39.x86_64/DBI.xs:3802
#19 0x00007fe9e113c5ea in Perl_pp_entersub (my_perl=0x558fb03492a0) at /usr/src/debug/perl-5.38.2-502.fc39.x86_64/pp_hot.c:5555
#20 0x00007fe9e112d618 in Perl_runops_standard (my_perl=0x558fb03492a0) at /usr/src/debug/perl-5.38.2-502.fc39.x86_64/run.c:41
#21 0x00007fe9e1072d37 in S_run_body (oldscope=<optimized out>, my_perl=<optimized out>) at /usr/src/debug/perl-5.38.2-502.fc39.x86_64/perl.c:2812
#22 perl_run (my_perl=0x558fb03492a0) at /usr/src/debug/perl-5.38.2-502.fc39.x86_64/perl.c:2727
#23 0x0000558f907b8342 in main (argc=<optimized out>, argv=<optimized out>, env=<optimized out>) at /usr/src/debug/perl-5.38.2-502.fc39.x86_64/perlmain.c:127--Type <RET> for more, q to quit, c to continue without paging--


Thread 1 (Thread 0x7fe9e0c21680 (LWP 3995826)):
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=11, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1  0x00007fe9e0eae8a3 in __pthread_kill_internal (signo=11, threadid=<optimized out>) at pthread_kill.c:78
#2  0x00007fe9e0e5c8ee in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
#3  0x00007fe9d18cb73f in skgesigOSCrash () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#4  0x00007fe9d1fca9ed in kpeDbgSignalHandler () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#5  0x00007fe9d18cba52 in skgesig_sigactionHandler () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#6  <signal handler called>
#7  0x00007fe9e1110bc0 in Perl_csighandler3 (sig=<optimized out>, sip=<optimized out>, uap=<optimized out>) at /usr/src/debug/perl-5.38.2-502.fc39.x86_64/mg.c:1599
#8  <signal handler called>
#9  0x00007fe9e0ea9169 in __futex_abstimed_wait_common64 (private=0, cancel=true, abstime=0x7fe9e0c20e00, op=137, expected=0, futex_word=0x558fb04fb698) at futex-internal.c:57
#10 __futex_abstimed_wait_common (futex_word=futex_word@entry=0x558fb04fb698, expected=expected@entry=0, clockid=clockid@entry=1, abstime=abstime@entry=0x7fe9e0c20e00, private=private@entry=0, cancel=cancel@entry=true) at futex-internal.c:87
#11 0x00007fe9e0ea91ef in __GI___futex_abstimed_wait_cancelable64 (futex_word=futex_word@entry=0x558fb04fb698, expected=expected@entry=0, clockid=clockid@entry=1, abstime=abstime@entry=0x7fe9e0c20e00, private=private@entry=0) at futex-internal.c:139
#12 0x00007fe9e0eabe72 in __pthread_cond_wait_common (abstime=0x7fe9e0c20e00, clockid=1, mutex=<optimized out>, cond=0x558fb04fb670) at pthread_cond_wait.c:503
#13 ___pthread_cond_timedwait64 (cond=0x558fb04fb670, mutex=<optimized out>, abstime=0x7fe9e0c20e00) at pthread_cond_wait.c:643
#14 0x00007fe9cdeabfc3 in sltspctimewait () from /usr/lib/oracle/21/client64/lib/libclntshcore.so.21.1
#15 0x00007fe9cf4cf501 in kpucpincrtime () from /usr/lib/oracle/21/client64/lib/libclntsh.so.21.1
#16 0x00007fe9e0eac897 in start_thread (arg=<optimized out>) at pthread_create.c:444
#17 0x00007fe9e0f33a5c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

It looks like 'Thread 1' is a separate thread started from within the OCI libraries, and it is this thread which eventually crashes.