1. Problem description
If ADMIN_MOVE_TABLE is executed on a table in which some
specific kinds of statements larger than 64 KB size are defined,
SQL0104N(syntax error) will be returned or SQL1224N will be
returned (and instance will be crash with SYGSEGV).
The ADMIN_MOVE_TABLE procedure takes a 64 KB chunk of strings
inside a loop and concatenates the segments to create a complete
string.
However, if the data is larger than the buffer provided (64 KB),
the defect in logic for storing data in the buffer may make the
statement incomplete and return SQL0104N or crash the instance
due to a memory access violation.
* Statements possibly affected by this issue are:
-- CREATE TRIGGER
-- CREATE VIEW
-- the statistics profile statement ('STATISTICS_PROFILE' column
in SYSCAT.TABLES)
2. Diagnostic information
db2diag.log is as below.
2018-09-03-13.24.31.675288+540 E345017A1077 LEVEL: Error
PID : 22393 TID : 70367112524205 PROC
:db2sysc 0
INSTANCE: db2inst NODE : 000 DB : SAMPLE
APPHDL : 0-7 APPID:*LOCAL.db2inst.180809072000
AUTHID : TEST HOSTNAME: test_host
EDUID : 23 EDUNAME: db2agent (SAMPLE) 0
FUNCTION: DB2 UDB, database application extension for utilities,
adminotm_online_table_move, probe:26296
DATA #1 : String, 5 bytes
SAMPLE
DATA #2 : String, 33 bytes
TEST_TABLE_FOR_REPRO_SQL0104N
DATA #3 : String, 4 bytes
MOVE
DATA #4 : SQLCA, PD_DB2_TYPE_SQLCA, 136 bytes
sqlcaid : SQLCA sqlcabc: 136 sqlcode: -104 sqlerrml: 47
sqlerrmc: TEST_TABLE2_FOR_REPRO_SQL0104N
, END-OF-STATEMENT
sqlerrp : SQL10055
sqlerrd : (1) 0x00000000 (2) 0x00000000 (3)
0x00000000
(4) 0x00000000 (5) 0x00000000 (6)
0x00000000
sqlwarn : (1) (2) (3) (4) (5) (6)
(7) (8) (9) (10) (11)
sqlstate: 42601
The stack trace from trap.txt is as below.
-------Frame------ ------Function + Offset------
0x000000000000F480 ?unknown + 0x0
0x09000002E861CB04 getDataAsString__15StoredProcedureFiUsP5sqlca
+ 0x2A4
0x09000002E86FA5DC
dropDependantObjects__3OtmFPCcN21PPcPiRlP5sqlca + 0xADC
0x09000002E87088EC renameTables__3OtmFP5sqlca + 0x36C
0x09000002E87324BC swapOffline__3OtmFbT1P5sqlca + 0x1ABC
0x09000002E8736290 swap__3OtmFP5sqlca + 0xDB0
0x09000002E87418A0
admin_move_table__FPCcN91N21PsN913_N213_P13sqludf_dbinfoP5sqlcaP
FUiPPv_ibT28_ + 0x20E0
0x09000002E8747354 admin_move_table_int1 + 0x114
Nested signal handlers detected
And the stack trace from gdb_out.txt is as follows:
[Switching to thread 1 (Thread 0x3fff633ef1b0 (LWP 2205))]
#0 0x00003fff6b8f69a0 in .__memcpy_power7 () from
/lib64/power8/libc.so.6
Stack level 0, frame at 0x3fff633b4bf0:
pc = 0x3fff6b8f69a0 in .__memcpy_power7; saved pc
0x3fff482866ec
called by frame at 0x3fff633c4d40
Arglist at 0x3fff633b4bf0, args:
Locals at 0x3fff633b4bf0, Previous frame's sp is
0x3fff633b4bf0
Saved registers:
r31 at 0x3fff633b4be8
#0 0x00003fff6b8f69a0 in .__memcpy_power7 () from
/lib64/power8/libc.so.6
#1 0x00003fff482866ec in
._ZN15StoredProcedure15getDataAsStringEitP5sqlca ()
from /data29/dbinst29/sqllib/bin/routine/db2dbroutext
#2 0x00003fff48379218 in
._ZN3Otm20dropDependantObjectsEPKcS1_S1_PPcPiRlP5sqlca ()
from /data29/dbinst29/sqllib/bin/routine/db2dbroutext
#3 0x00003fff48388d98 in ._ZN3Otm12renameTablesEP5sqlca ()
from /data29/dbinst29/sqllib/bin/routine/db2dbroutext
#4 0x00003fff483b6934 in ._ZN3Otm11swapOfflineEbbP5sqlca ()
from /data29/dbinst29/sqllib/bin/routine/db2dbroutext
#5 0x00003fff483babf4 in ._ZN3Otm4swapEP5sqlca () from
/data29/dbinst29/sqllib/bin/routine/db2dbroutext |
