BUG #7968: Perl DBI segfaults in connect()

[m***@trueposition.com]

The following bug has been logged on the website:

Bug reference: 7968
Logged by: Mitchell Perilstein
Email address: ***@trueposition.com
PostgreSQL version: 9.1.5
Operating system: SPARC Solaris 10
Description:

Summary: A perl DBI/DBD client makes a connect() call to a db server in down
or restarting state and coredumps. There was a similar stack trace reported
in 2011 but not exactly. I can probably reproduce this more succinctly with
a testcase if needed.

This code (part of Bucardo) was the call:

$dbh = DBI->connect
(
$dsn,
$user,
$pass,
{AutoCommit=>0, RaiseError=>1, PrintError=>0}
);

The perl caller logs this and crashes:

DBI
connect('dbname=TPLocationGateway;port=5432;host=tplocalvirt','tpadmin',...)
failed:
FATAL: database "TPLocationGateway" does not exist at
/tpapp/tpdb/lib/perl5/Bucardo.pm line 4936

The Solaris coredump looks like this:

# pstack core
core 'core' of 18694: perl /tpapp/tpdb/bin/bucardo
--log-destination=/tpdata/tpdb/logs --log
fed60fb0 pg_warn (0, ae3648, 5fb0f0, 2d764, aa0f20, fed60f78) + 38
fed27174 pqGetErrorNotice3 (adb080, 11000, 0, abf545, 0, ffbfed0c) +
4fc
fed260a8 pqParseInput3 (adb080, adb3f4, 4, ffbfed78, fed431ac, 282019)
+ 168
fed1db30 PQgetResult (adb080, adb080, 1, 2000000, 128808, fed431ac) +
c4
fed726a8 handle_old_async (4bada0, a75548, 1000000, 8000000, 64,
fed8e6e0) + 5c4
fed6d088 pg_st_destroy (4bada0, adcf20, 0, 217ec, fed8e6e0, a75548) +
198
fed59af8 XS_DBD__Pg__st_DESTROY (128808, 4, 803948, fed8e6e0, 2245c,
4bada0) + 304
feecec58 XS_DBI_dispatch (803948, c06a8, feeda8b0, feeec0a4, 0, 22460)
+ 20f0
ff2a7634 Perl_pp_entersub (c0db4, 0, ffc00000, c2538, ffbff5a0,
ff348000) + 6fc
ff269c2c S_call_body (ffbff5a0, 0, 3000, de41c, 529e50, ff35d978) + 54
ff2698c0 Perl_call_sv (2c00, 2c00, 3050, 26e3c, ff35b3e4, ff35b3c8) +
9cc
ff2f0f8c Perl_sv_clear (8147b0, 3000, 3000, 124be0, ff348000, 41) +
280
ff2f18d0 Perl_sv_free (8147b0, ff2f0c98, 568f8, 8, 0, 8147b0) + 1d8
ff2f14a8 Perl_sv_clear (501f2c, 7d4, ff2f15a8, 0, ff348000, 3000) +
79c
ff2f18d0 Perl_sv_free (501f2c, 7d4, 568f8, ff, 0, 501f2c) + 1d8
ff245628 Perl_mg_free (a5c894, ff35b398, 0, b, 2000900b, 5ffdb8) + ac
ff2f121c Perl_sv_clear (a5c894, 1, 2c00, ff35d97c, ff348000, 0) + 510
ff2f18d0 Perl_sv_free (a5c894, 5fb428, 568f8, ff2e69e4, 0, a5c894) +
1d8
ff2e692c S_visit (ff2e6968, 5fb428, 5fb668, 5fb278, ff348000, 1d7) +
80
ff2e6b28 Perl_sv_clean_objs (2f80, 1, ff34b560, ff348000, 61514, 2c00)
+ 48
ff264c84 perl_destruct (0, 3400, 0, 1, ff35b3ec, 3400) + 2f8
00011050 main (8, ffbffaf4, 0, 22400, 22420, 22400) + b4
00010f84 _start (0, 0, 0, 0, 0, 0) + 108
# pflags core
core 'core' of 18694: perl /tpapp/tpdb/bin/bucardo
--log-destination=/tpdata/tpdb/logs --log
data model = _ILP32 flags = MSACCT|MSFORK
/1: flags = 0
sigmask = 0xffffbefc,0x0000ffff cursig = SIGSEGV

Solaris (but we've seen it on similar boxes):

# uname -a
SunOS WilWlg1 5.10 Generic_147440-25 sun4v sparc sun4v

Perl v5.8.4 :

# perl -V
Summary of my perl5 (revision 5 version 8 subversion 4) configuration:
Platform:
osname=solaris, osvers=2.10, archname=sun4-solaris-64int
uname='sunos localhost 5.10 sun4u sparc SUNW,Ultra-2'
config_args=''
hint=recommended, useposix=true, d_sigaction=define
usethreads=undef use5005threads=undef useithreads=undef
usemultiplicity=undef
useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
use64bitint=define use64bitall=undef uselongdouble=undef
usemymalloc=n, bincompat5005=undef
Compiler:
cc='cc', ccflags ='-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
-xarch=v8 -D_TS_ERRNO',
optimize='-xO3 -xspace -xildoff',
cppflags=''
ccversion='Sun WorkShop', gccversion='', gccosandvers=''
intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=87654321
d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16
ivtype='long long', ivsize=8, nvtype='double', nvsize=8,
Off_t='off_t', lseeksize=8
alignbytes=8, prototype=define
Linker and Libraries:
ld='cc', ldflags =''
libpth=/lib /usr/lib /usr/ccs/lib
libs=-lsocket -lnsl -ldl -lm -lc
perllibs=-lsocket -lnsl -ldl -lm -lc
libc=/lib/libc.so, so=so, useshrplib=true, libperl=libperl.so
gnulibc_version=''
Dynamic Linking:
dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-R
/usr/perl5/5.8.4/lib/sun4-solaris-64int/CORE'
cccdlflags='-KPIC', lddlflags='-G'


Characteristics of this binary (from libperl):
Compile-time options: USE_64_BIT_INT USE_LARGE_FILES
Locally applied patches:
22667 The optree builder was looping when constructing the ops
...
22715 Upgrade to FileCache 1.04
22733 Missing copyright in the README.
22746 fix a coredump caused by rv2gv not fully converting a PV
...
22755 Fix 29149 - another UTF8 cache bug hit by substr.
22774 [perl #28938] split could leave an array without ...
22775 [perl #29127] scalar delete of empty slice returned
garbage
22776 [perl #28986] perl -e "open m" crashes Perl
22777 add test for change #22776 ("open m" crashes Perl)
22778 add test for change #22746 ([perl #29102] Crash on assign
...
22781 [perl #29340] Bizarre copy of ARRAY make sure a pad op's
...
22796 [perl #29346] Double warning for int(undef) and abs(undef)
...
22818 BOM-marked and (BOMless) UTF-16 scripts not working
22823 [perl #29581] glob() misses a lot of matches
22827 Smoke [5.9.2] 22818 FAIL(F) MSWin32 WinXP/.Net SP1 (x86/1
cpu)
22830 [perl #29637] Thread creation time is hypersensitive
22831 improve hashing algorithm for ptr tables in perl_clone:
...
22839 [perl #29790] Optimization busted: '@a = "b", sort @a'
...
22850 [PATCH] 'perl -v' fails if local_patches contains code
snippets
22852 TEST needs to ignore SCM files
22886 Pod::Find should ignore SCM files and dirs
22888 Remove redundant %SIG assignments from FileCache
23006 [perl #30509] use encoding and "eq" cause memory leak
23074 Segfault using HTML::Entities
23106 Numeric comparison operators mustn't compare addresses of
...
23320 [perl #30066] Memory leak in nested shared data structures
...
23321 [perl #31459] Bug in read()
27722 perlio.c breaks on Solaris/gcc when > 256 FDs are
available
SPRINTF0 - fixes for sprintf formatting issues - CVE-2005-3962
6663288 Upgrade to CGI.pm 3.33
REGEXP0 - fix for UTF-8 recoding in regexps - CVE-2007-5116
6758953 Perl Sys::Syslog can log messages with wrong severity
6935710 patch 141552-01 causes an error when the Syslog perl
module is used
6961567 CVE-2010-1168 - Safe.pm 2.24 and earlier may allow
attackers to break out of safe compartment
7004391 CGI.pm needs update to filter newlines in headers
(CVE-2010-2761, CVE-2010-4411)
7116936 Problem with utility/perl
Built under solaris
Compiled at Jan 8 2012 04:18:12
%ENV:
PERL5LIB="/tpapp/tpdb/lib/perl5"
@INC:
/tpapp/tpdb/lib/perl5/sun4-solaris-64int
/tpapp/tpdb/lib/perl5
/usr/perl5/5.8.4/lib/sun4-solaris-64int
/usr/perl5/5.8.4/lib
/usr/perl5/site_perl/5.8.4/sun4-solaris-64int
/usr/perl5/site_perl/5.8.4
/usr/perl5/site_perl
/usr/perl5/vendor_perl/5.8.4/sun4-solaris-64int
/usr/perl5/vendor_perl/5.8.4
/usr/perl5/vendor_perl
.

Interesting Modules:
DBD-Pg-2.19.3
DBI-1.623
DBIx-Safe-1.2.5

Bucardo:
git version e83e2e22e79c6cf6be5912925d50e271e02a886d
approximately version 4.99.6 plus a little

[Tom Lane]

Post by m***@trueposition.com
Summary: A perl DBI/DBD client makes a connect() call to a db server in down
or restarting state and coredumps.

The stack trace looks like the problem is in a notice handler installed
by DBD-Pg, not in libpq proper. I'm not sure that the authors of DBD-Pg
read pgsql-bugs --- you might want to contact them another way. The
bug tracker at http://search.cpan.org/dist/DBD-Pg/ might be a good bet.

regards, tom lane

[Tom Lane]

https://rt.cpan.org/Public/Bug/Display.html?id=69664

Looks like they don't know how to reproduce it though, so you could
help them out by adding a test case there.

regards, tom lane

[Mitchell Perilstein]

Yes, that was a better place to look. They have it already:
https://rt.cpan.org/Public/Bug/Display.html?id=69664

Thanks!

Post by Tom Lane

Post by m***@trueposition.com
Summary: A perl DBI/DBD client makes a connect() call to a db server in down
or restarting state and coredumps.

The stack trace looks like the problem is in a notice handler installed
by DBD-Pg, not in libpq proper. I'm not sure that the authors of DBD-Pg
read pgsql-bugs --- you might want to contact them another way. The
bug tracker at http://search.cpan.org/dist/DBD-Pg/ might be a good bet.
regards, tom lane

Confidentiality Notice: This e-mail (including any attachments) is intended only for the recipients named above. It may contain confidential or privileged information and should not be read, copied or otherwise used by any other person. If you are not a named recipient, please notify the sender of that fact and delete the e-mail from your system.