ORA-07445: exception encountered: core dump [qctosop()+1504]

+++今天下午收到一封报警邮件，alter日志里检测到有ORA-07445错误
+++alter日志信息
Fri Jan 10 16:21:41 2014
Exception [type: SIGSEGV, Address not mapped to object] [ADDR:0x170] [PC:0x244A0CE, qctosop()+1504] [flags: 0x0, count: 1]
Errors in file /tol/app/oracle/admin/rac/diag/rdbms/dg_114/rac/trace/rac_ora_22041.trc  (incident=220018):
ORA-07445: exception encountered: core dump [qctosop()+1504] [SIGSEGV] [ADDR:0x170] [PC:0x244A0CE] [Address not mapped to object] []
Incident details in: /tol/app/oracle/admin/rac/diag/rdbms/dg_114/rac/incident/incdir_220018/rac_ora_22041_i220018.trc
Fri Jan 10 16:21:46 2014
Trace dumping is performing id=[cdmp_20140110162146]
Fri Jan 10 16:21:48 2014

+++trace信息：
Dump continued from file: /tol/app/oracle/admin/rac/diag/rdbms/dg_114/rac/trace/rac_ora_22041.trc
ORA-07445: exception encountered: core dump [qctosop()+1504] [SIGSEGV] [ADDR:0x170] [PC:0x244A0CE] [Address not mapped to obj
ect] []

========= Dump for incident 220018 (ORA 7445 [qctosop()+1504]) ========
----- Beginning of Customized Incident Dump(s) -----
Exception [type: SIGSEGV, Address not mapped to object] [ADDR:0x170] [PC:0x244A0CE, qctosop()+1504] [flags: 0x0, count: 1]
Registers:
%rax: 0x0000000000000000 %rbx: 0x0000000000000000 %rcx: 0x000000000000001a
%rdx: 0x0000000000000000 %rdi: 0x000000087132eff0 %rsi: 0x000000087132eed8
%rsp: 0x00007fff4ce761c0 %rbp: 0x00007fff4ce76260  %r8: 0x0000000000000001
 %r9: 0x0000000000000007 %r10: 0x000000000000001a %r11: 0x0000000000000fa0
%r12: 0x0000000000000002 %r13: 0x00002b32a9d64480 %r14: 0x0000000000000000
%r15: 0x000000000000001a %rip: 0x000000000244a0ce %efl: 0x0000000000010246
> (0x244a0ce) mov 0x170(%rdx),%rax
  (0x244a0d5) test %rax,%rax
  (0x244a0d8) je 0x244a115
  (0x244a0da) mov %r10d,-0x50(%rbp)
  (0x244a0de) mov %r14,-0x88(%rbp)

*** 2014-01-10 16:21:42.253
dbkedDefDump(): Starting a non-incident diagnostic dump (flags=0x3, level=3, mask=0x0)
----- Current SQL Statement for this session (sql_id=29q07j31dbqfp) -----
select * from ( select row_.*, rownum rownum_ from ( select * from kyds_user where batch = '2013' and status != 0 and name li
ke '%q' || utl_inaddr.get_host_address((select chr(126)||chr(39)||global_name||chr(39)||chr(126) from global_name where rownu
m=1)) and '1'='1%'  and area like '2%' order by createTime desc ) row_ where rownum <= 20) where rownum_ > 0

----- Call Stack Trace -----
calling              call     entry                argument values in hex
location             type     point                (? means dubious value)
-------------------- -------- -------------------- ----------------------------

+++可以看出，这个错误由这个sql引起
select * from ( select row_.*, rownum rownum_ from ( select * from kyds_user where batch = '2013' and status != 0 and name li
ke '%q' || utl_inaddr.get_host_address((select chr(126)||chr(39)||global_name||chr(39)||chr(126) from global_name where rownu
m=1)) and '1'='1%'  and area like '2%' order by createTime desc ) row_ where rownum <= 20) where rownum_ > 0

+++检查一下kyds_user这个表是哪个用户的，
SQL> select object_name,object_type,owner from dba_objects where object_name='KYDS_USER';
OBJECT_NAME
--------------------------------------------------------------------------------
OBJECT_TYPE         OWNER
------------------- ------------------------------
KYDS_USER
TABLE               SUBJECT

+++用subject登录，手工执行一下看看
SQL> conn subject/XXXXXXXX
Connected.
SQL> SELECT *
  2    FROM (SELECT row_.*, ROWNUM rownum_
  3            FROM (SELECT *
  4                    FROM kyds_user
  5                   WHERE batch = '2013' 
 AND status != 0 
 AND name like '%q' || UTL_INADDR.get_host_address((select CHR(126)||CHR(39)||global_name||CHR(39)||CHR(126) from global_name where rownum=1)) 
  8   and '1'='1%'  
  9   and area like '2%' 
 10   order by createTime DESC ) 
 11  row_ where ROWNUM <= 20) 
 12  where rownum_ > 0;
SELECT *
*
ERROR at line 1:
ORA-03113: end-of-file on communication channel
Process ID: 4671
Session ID: 962 Serial number: 50676

+++可以看到手工执行也报错，检查alter日志信息：如下
Fri Jan 10 16:28:27 2014
Archived Log entry 428185 added for thread 1 sequence 161134 ID 0x8e79ab49 dest 1:
Fri Jan 10 16:38:24 2014
Exception [type: SIGSEGV, Address not mapped to object] [ADDR:0x170] [PC:0x244A0CE, qctosop()+1504] [flags: 0x0, count: 1]
Errors in file /tol/app/oracle/admin/rac/diag/rdbms/dg_114/rac/trace/rac_ora_4671.trc  (incident=221602):
ORA-07445: exception encountered: core dump [qctosop()+1504] [SIGSEGV] [ADDR:0x170] [PC:0x244A0CE] [Address not mapped to object] []
Incident details in: /tol/app/oracle/admin/rac/diag/rdbms/dg_114/rac/incident/incdir_221602/rac_ora_4671_i221602.trc
Fri Jan 10 16:38:26 2014
Trace dumping is performing id=[cdmp_20140110163826]
Fri Jan 10 16:38:27 2014
Sweep [inc][221602]: completed
Sweep [inc2][221602]: completed

+++同样的错误
+++单独执行子查询也报错
SQL> SELECT *
  2                    FROM kyds_user
  3                   WHERE batch = '2013' 
  4   AND status != 0 
  5   AND name like '%q' || UTL_INADDR.get_host_address((select CHR(126)||CHR(39)||global_name||CHR(39)||CHR(126) from global_name where rownum=1)) 
  6    and '1'='1%'  
  7   and area like '2%' 
  8   order by createTime DESC;
  *
ERROR at line 2:
ORA-03113: end-of-file on communication channel
Process ID: 9431
Session ID: 1021 Serial number: 44925

SQL> SELECT row_.*, ROWNUM rownum_
  2            FROM (SELECT *
  3                    FROM kyds_user
  4                   WHERE batch = '2013' 
  5   AND status != 0 
  6   AND name like '%q' || UTL_INADDR.get_host_address((select CHR(126)||CHR(39)||global_name||CHR(39)||CHR(126) from global_name where rownum=1)) 
  7    and '1'='1%'  
  8   and area like '2%' 
  9   order by createTime DESC ) 
 10  row_ where rownum <= 20;
          FROM (SELECT *
  *
ERROR at line 2:
ORA-03113: end-of-file on communication channel
Process ID: 9431
Session ID: 1021 Serial number: 44925

+++刚开始以为是bug，查询了一些资料，发现不太像bug
+++再仔细检查，发现是开发写的sql有问题
+++改了sql，再次执行，已经OK
SQL> SELECT *
  2    FROM (SELECT row_.*, ROWNUM rownum_
  3            FROM (SELECT name
  4                    FROM kyds_user
  5                   WHERE batch = '2013' 
  6   AND status != 0 
 AND name like '"%q" || UTL_INADDR.get_host_address((select CHR(126)||CHR(39)||global_name||CHR(39)||CHR(126) from global_name where rownum=1))'
  8    and '1'='1%'  
  9   and area like '2%' 
 10   order by createTime DESC ) 
 11  row_ where rownum <= 20) 
 12  where rownum_ > 0;

no rows selected

SQL> SELECT *
  2    FROM (SELECT row_.*, ROWNUM rownum_
  3            FROM (SELECT name
  4                    FROM kyds_user
  5                   WHERE batch = '2013' 
  6   AND status != 0 
  7   AND name like '"%q" || UTL_INADDR.get_host_address((select CHR(126)||CHR(39)||global_name||CHR(39)||CHR(126) from global_name where rownum=1))'
  8  --  and '1'='1%'  
  9   and area like '2%' 
 10   order by createTime DESC ) 
 11  row_ where rownum <= 20) 
 12  where rownum_ > 0;

no rows selected