Skip to content

Fuzzer: Segfault without stacktrace #19108

@tavplubix

Description

@tavplubix

https://clickhouse-test-reports.s3.yandex.net/18979/27600064159ac63e05800ef37afa41b317771352/fuzzer/report.html#fail1

Fuzzer log:

SELECT ((100, (toUInt8(3), toUInt8(NULL)), toUInt8(1048576)), 65537, toUInt8(1023))
FROM dist_01528
WHERE dummy = 100
SETTINGS allow_nondeterministic_optimize_skip_unused_shards = 1

Error on processing query 'SELECT ((100, (toUInt8(3), toUInt8(NULL)), toUInt8(1048576)), 65537, toUInt8(1023)) FROM dist_01528 WHERE dummy = 100 SETTINGS allow_nondeterministic_optimize_skip_unused_shards = 1': Code: 32, e.displayText() = DB::Exception: Attempt to read after eof: while receiving packet from localhost:9000, Stack trace (when copying this message, always include the lines below):

0. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/exception:133: std::exception::capture() @ 0x10763718 in /workspace/clickhouse
1. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/exception:111: std::exception::exception() @ 0x107636e5 in /workspace/clickhouse
2. ./obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Exception.cpp:27: Poco::Exception::Exception(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int) @ 0x1e2fad93 in /workspace/clickhouse
3. ./obj-x86_64-linux-gnu/../src/Common/Exception.cpp:54: DB::Exception::Exception(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int) @ 0x107455ea in /workspace/clickhouse
4. ./obj-x86_64-linux-gnu/../src/IO/VarInt.h:122: DB::throwReadAfterEOF() @ 0x10763ac7 in /workspace/clickhouse
5. ./obj-x86_64-linux-gnu/../src/IO/VarInt.h:135: void DB::readVarUIntImpl<false>(unsigned long&, DB::ReadBuffer&) @ 0x1079ec87 in /workspace/clickhouse
6. ./obj-x86_64-linux-gnu/../src/IO/VarInt.h:149: DB::readVarUInt(unsigned long&, DB::ReadBuffer&) @ 0x1079e914 in /workspace/clickhouse
7. ./obj-x86_64-linux-gnu/../src/Client/Connection.cpp:762: DB::Connection::receivePacket(std::__1::function<void (Poco::Net::Socket&)>) @ 0x1a954da2 in /workspace/clickhouse
8. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:1667: DB::Client::receiveAndProcessPacket(bool) @ 0x1088fc7b in /workspace/clickhouse
9. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:1653: DB::Client::receiveResult() @ 0x1089477c in /workspace/clickhouse
10. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:1373: DB::Client::processOrdinaryQuery() @ 0x1087be6c in /workspace/clickhouse
11. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:1280: DB::Client::processParsedSingleQuery() @ 0x1087ac5b in /workspace/clickhouse
12. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:1130: DB::Client::processWithFuzzing(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) @ 0x108786b8 in /workspace/clickhouse
13. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:988: DB::Client::processMultiQuery(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) @ 0x10879591 in /workspace/clickhouse
14. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:804: DB::Client::nonInteractive() @ 0x10866314 in /workspace/clickhouse
15. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:706: DB::Client::mainImpl() @ 0x10863665 in /workspace/clickhouse
16. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:278: DB::Client::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) @ 0x10859a76 in /workspace/clickhouse
17. ./obj-x86_64-linux-gnu/../contrib/poco/Util/src/Application.cpp:334: Poco::Util::Application::run() @ 0x1e254aef in /workspace/clickhouse
18. ./obj-x86_64-linux-gnu/../programs/client/Client.cpp:2486: mainEntryClickHouseClient(int, char**) @ 0x10851787 in /workspace/clickhouse
19. ./obj-x86_64-linux-gnu/../programs/main.cpp:368: main @ 0x10736ae5 in /workspace/clickhouse
20. /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:344: __libc_start_main @ 0x21bf7 in /usr/lib/debug/lib/x86_64-linux-gnu/libc-2.27.so
21. _start @ 0x1073672e in /workspace/clickhouse
 (version 21.1.1.5681)
Fuzzing step 314 out of 1000

Server log:

2021.01.15 01:03:18.452778 [ 66 ] {4d77c30c-b1e8-4cf0-8b78-f1ad5573edb1} <Debug> executeQuery: (from [::1]:46782, using production parser) SELECT (65537, toUInt8(-1)) FROM dist_01528 WHERE dummy = 100 SETTINGS allow_nondeterministic_optimize_skip_unused_shards = 1
2021.01.15 01:03:18.455101 [ 66 ] {4d77c30c-b1e8-4cf0-8b78-f1ad5573edb1} <Debug> StorageDistributed (dist_01528): Skipping irrelevant shards - the query will be sent to the following shards of the cluster (shard numbers): [1]
2021.01.15 01:03:18.457177 [ 66 ] {4d77c30c-b1e8-4cf0-8b78-f1ad5573edb1} <Trace> ContextAccess (default): Access granted: SELECT(dummy) ON default.dist_01528
2021.01.15 01:03:18.459540 [ 66 ] {4d77c30c-b1e8-4cf0-8b78-f1ad5573edb1} <Debug> StorageDistributed (dist_01528): Skipping irrelevant shards - the query will be sent to the following shards of the cluster (shard numbers): [1]
2021.01.15 01:03:18.461553 [ 66 ] {4d77c30c-b1e8-4cf0-8b78-f1ad5573edb1} <Trace> ContextAccess (default): Access granted: SELECT(dummy) ON default.dist_01528
2021.01.15 01:03:18.465080 [ 66 ] {4d77c30c-b1e8-4cf0-8b78-f1ad5573edb1} <Trace> ContextAccess (default): Access granted: SELECT(dummy) ON system.one
2021.01.15 01:03:18.465414 [ 66 ] {4d77c30c-b1e8-4cf0-8b78-f1ad5573edb1} <Trace> InterpreterSelectQuery: FetchColumns -> Complete
2021.01.15 01:03:18.466918 [ 66 ] {4d77c30c-b1e8-4cf0-8b78-f1ad5573edb1} <Trace> InterpreterSelectQuery: Complete -> Complete
2021.01.15 01:03:18.470815 [ 114 ] {4d77c30c-b1e8-4cf0-8b78-f1ad5573edb1} <Trace> PipelineExecutor: Thread finished. Total time: 0.000321977 sec. Execution time: 0.000111691 sec. Processing time: 0.000193292 sec. Wait time: 1.6994e-05 sec.
2021.01.15 01:03:18.471511 [ 66 ] {4d77c30c-b1e8-4cf0-8b78-f1ad5573edb1} <Information> executeQuery: Read 1 rows, 1.00 B in 0.018558757 sec., 53 rows/sec., 53.88 B/sec.
2021.01.15 01:03:18.471696 [ 66 ] {4d77c30c-b1e8-4cf0-8b78-f1ad5573edb1} <Debug> MemoryTracker: Peak memory usage (for query): 0.00 B.
2021.01.15 01:03:18.472569 [ 66 ] {} <Debug> TCPHandler: Processed in 0.022818956 sec.
2021.01.15 01:03:18.482945 [ 66 ] {d4a8e027-35e0-4fa2-94d7-9f1fa1d61276} <Debug> executeQuery: (from [::1]:46782, using production parser) SELECT ((-1, (toUInt8(3), toUInt8(NULL)), toUInt8(65537)), 65537, toUInt8(1023)) FROM dist_01528 WHERE dummy = 100 SETTINGS allow_nondeterministic_optimize_skip_unused_shards = 1
2021.01.15 01:03:18.485741 [ 66 ] {d4a8e027-35e0-4fa2-94d7-9f1fa1d61276} <Debug> StorageDistributed (dist_01528): Skipping irrelevant shards - the query will be sent to the following shards of the cluster (shard numbers): [1]
2021.01.15 01:03:18.489727 [ 66 ] {d4a8e027-35e0-4fa2-94d7-9f1fa1d61276} <Trace> ContextAccess (default): Access granted: SELECT(dummy) ON default.dist_01528
2021.01.15 01:03:18.492585 [ 66 ] {d4a8e027-35e0-4fa2-94d7-9f1fa1d61276} <Debug> StorageDistributed (dist_01528): Skipping irrelevant shards - the query will be sent to the following shards of the cluster (shard numbers): [2]
2021.01.15 01:03:18.496532 [ 66 ] {d4a8e027-35e0-4fa2-94d7-9f1fa1d61276} <Trace> ContextAccess (default): Access granted: SELECT(dummy) ON default.dist_01528
2021.01.15 01:03:18.502449 [ 66 ] {d4a8e027-35e0-4fa2-94d7-9f1fa1d61276} <Trace> ContextAccess (default): Access granted: SELECT(dummy) ON system.one
2021.01.15 01:03:18.502786 [ 66 ] {d4a8e027-35e0-4fa2-94d7-9f1fa1d61276} <Trace> InterpreterSelectQuery: FetchColumns -> Complete
2021.01.15 01:03:18.505113 [ 66 ] {d4a8e027-35e0-4fa2-94d7-9f1fa1d61276} <Trace> InterpreterSelectQuery: Complete -> Complete
2021.01.15 01:03:18.510451 [ 131 ] {d4a8e027-35e0-4fa2-94d7-9f1fa1d61276} <Trace> PipelineExecutor: Thread finished. Total time: 0.000431822 sec. Execution time: 0.000240757 sec. Processing time: 0.000171492 sec. Wait time: 1.9573e-05 sec.
2021.01.15 01:03:18.511127 [ 66 ] {d4a8e027-35e0-4fa2-94d7-9f1fa1d61276} <Information> executeQuery: Read 1 rows, 1.00 B in 0.027976969 sec., 35 rows/sec., 35.74 B/sec.
2021.01.15 01:03:18.511310 [ 66 ] {d4a8e027-35e0-4fa2-94d7-9f1fa1d61276} <Debug> MemoryTracker: Peak memory usage (for query): 0.00 B.
2021.01.15 01:03:18.512219 [ 66 ] {} <Debug> TCPHandler: Processed in 0.035391971 sec.
2021.01.15 01:03:18.520945 [ 66 ] {5c6bacee-e200-4b99-84c7-193fd79cef3b} <Debug> executeQuery: (from [::1]:46782, using production parser) SELECT ((100, (toUInt8(3), toUInt8(NULL)), toUInt8(1048576)), 65537, toUInt8(1023)) FROM dist_01528 WHERE dummy = 100 SETTINGS allow_nondeterministic_optimize_skip_unused_shards = 1
2021.01.15 01:03:18.523659 [ 66 ] {5c6bacee-e200-4b99-84c7-193fd79cef3b} <Debug> StorageDistributed (dist_01528): Skipping irrelevant shards - the query will be sent to the following shards of the cluster (shard numbers): [2]
2021.01.15 01:03:18.527695 [ 66 ] {5c6bacee-e200-4b99-84c7-193fd79cef3b} <Trace> ContextAccess (default): Access granted: SELECT(dummy) ON default.dist_01528
2021.01.15 01:03:18.530462 [ 66 ] {5c6bacee-e200-4b99-84c7-193fd79cef3b} <Debug> StorageDistributed (dist_01528): Skipping irrelevant shards - the query will be sent to the following shards of the cluster (shard numbers): [1]
2021.01.15 01:03:18.534410 [ 66 ] {5c6bacee-e200-4b99-84c7-193fd79cef3b} <Trace> ContextAccess (default): Access granted: SELECT(dummy) ON default.dist_01528
2021.01.15 01:03:18.535889 [ 66 ] {5c6bacee-e200-4b99-84c7-193fd79cef3b} <Trace> InterpreterSelectQuery: Complete -> Complete
2021.01.15 01:03:18.546266 [ 142 ] {ae3f89c4-0593-425a-ba17-513c9b90ca4a} <Debug> executeQuery: (from [::ffff:127.0.0.1]:46004, initial_query_id: 5c6bacee-e200-4b99-84c7-193fd79cef3b, using production parser) SELECT ((100, (toUInt8(3), toUInt8(NULL)), toUInt8(1048576)), 65537, toUInt8(1023)) FROM system.one WHERE dummy = 100
2021.01.15 01:03:18.552015 [ 142 ] {ae3f89c4-0593-425a-ba17-513c9b90ca4a} <Trace> ContextAccess (default): Access granted: SELECT(dummy) ON system.one
2021.01.15 01:03:18.552394 [ 142 ] {ae3f89c4-0593-425a-ba17-513c9b90ca4a} <Trace> InterpreterSelectQuery: FetchColumns -> Complete
2021.01.15 01:03:20.101390 [ 56 ] {} <Fatal> Application: Child process was terminated by signal 11.

No other messages from thread 56 in log.

Metadata

Metadata

Labels

fuzzProblem found by one of the fuzzers

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions