Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-22692

MSAN use-of-uninitialized-value in pagecache_fwrite()

    XMLWordPrintable

    Details

      Description

      After I removed the following workaround, I got a number of test failures:

      diff --git a/storage/maria/ma_pagecache.c b/storage/maria/ma_pagecache.c
      index 119b5310f49..12e88f2535c 100644
      --- a/storage/maria/ma_pagecache.c
      +++ b/storage/maria/ma_pagecache.c
      @@ -681,10 +681,6 @@ static my_bool pagecache_fwrite(PAGECACHE *pagecache,
           DBUG_PRINT("error", ("write callback problem"));
           DBUG_RETURN(1);
         }
      -#if __has_feature(memory_sanitizer) /* FIXME: encryption.aria_tiny etc. fail */
      -  /* FIXME: ENGINE=Aria occasionally writes uninitialized data */
      -  __msan_unpoison(args.page, pagecache->block_size);
      -#endif
         res= (int)my_pwrite(filedesc->file, args.page, pagecache->block_size,
                        ((my_off_t) pageno << pagecache->shift), flags);
         (*filedesc->post_write_hook)(res, &args);
      

      An example:

      10.5 d8ea11a33fba12331c98c04ff44c815a662faccb with the above patch

      CURRENT_TEST: encryption.aria_tiny
      mysqltest: At line 10: query 'drop table t1' failed: 2013: Lost connection to MySQL server during query
      Uninitialized bytes in __interceptor_pwrite64 at offset 31 inside [0x725000043818, 8192)
      ==40014==WARNING: MemorySanitizer: use-of-uninitialized-value
          #0 0x5565a0801827 in my_pwrite /mariadb/10.5m/mysys/my_pread.c:159:19
          #1 0x55659ee8e355 in pagecache_fwrite /mariadb/10.5m/storage/maria/ma_pagecache.c:684:13
          #2 0x55659ee9e23c in flush_cached_blocks /mariadb/10.5m/storage/maria/ma_pagecache.c:4745:12
          #3 0x55659ee90bcb in flush_pagecache_blocks_int /mariadb/10.5m/storage/maria/ma_pagecache.c:5041:17
          #4 0x55659ee90bcb in flush_pagecache_blocks_with_filter /mariadb/10.5m/storage/maria/ma_pagecache.c:5156:8
          #5 0x55659ed991d7 in maria_close /mariadb/10.5m/storage/maria/ma_close.c:51:9
          #6 0x55659edbb468 in ha_maria::close() /mariadb/10.5m/storage/maria/ha_maria.cc:1240:10
          #7 0x55659e3432dd in handler::ha_close() /mariadb/10.5m/sql/handler.cc:2975:3
          #8 0x55659db6f30c in closefrm(TABLE*) /mariadb/10.5m/sql/table.cc:4271:24
          #9 0x55659dff35d2 in intern_close_table(TABLE*) /mariadb/10.5m/sql/table_cache.cc:220:3
          #10 0x55659dffff00 in TDC_element::flush_unused(bool) /mariadb/10.5m/sql/table_cache.cc:1292:5
          #11 0x55659dfff2de in tdc_remove_referenced_share(THD*, TABLE_SHARE*) /mariadb/10.5m/sql/table_cache.cc:1004:15
          #12 0x55659e0006e2 in tdc_remove_table(THD*, char const*, char const*) /mariadb/10.5m/sql/table_cache.cc:1061:3
          #13 0x55659da25e25 in mysql_rm_table_no_locks(THD*, TABLE_LIST*, bool, bool, bool, bool, bool, bool) /mariadb/10.5m/sql/sql_table.cc:2481:9
          #14 0x55659da220cc in mysql_rm_table(THD*, TABLE_LIST*, bool, bool, bool, bool) /mariadb/10.5m/sql/sql_table.cc:2137:10
          #15 0x55659d6b6874 in mysql_execute_command(THD*) /mariadb/10.5m/sql/sql_parse.cc:4927:10
          #16 0x55659d6922f5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /mariadb/10.5m/sql/sql_parse.cc:7991:18
          #17 0x55659d682c79 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /mariadb/10.5m/sql/sql_parse.cc:1874:7
          #18 0x55659d6941ba in do_command(THD*) /mariadb/10.5m/sql/sql_parse.cc:1355:17
          #19 0x55659dcb02be in do_handle_one_connection(CONNECT*, bool) /mariadb/10.5m/sql/sql_connect.cc:1411:11
          #20 0x55659dcafaa4 in handle_one_connection /mariadb/10.5m/sql/sql_connect.cc:1313:5
          #21 0x55659f15a277 in pfs_spawn_thread /mariadb/10.5m/storage/perfschema/pfs.cc:2201:3
          #22 0x7fcd55afaf26 in start_thread nptl/pthread_create.c:479:8
          #23 0x7fcd555d931e in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
       
        Memory was marked as uninitialized
          #0 0x55659d14028e in __msan_allocated_memory (/dev/shm/10.5-msan/sql/mariadbd+0x70928e)
          #1 0x5565a07fc1e7 in my_malloc /mariadb/10.5m/mysys/my_malloc.c:111:7
      

      Side note: InnoDB stopped writing anything to data files for dropped tables, in MDEV-15528 and MDEV-21069.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              monty Michael Widenius
              Reporter:
              marko Marko Mäkelä
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: