Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-34251

Conditional jump or move depends on uninitialised value in ha_handler_stats::has_stats

Details

    Description

      Discovered this while working on MDEV-34125. Its initial testcase fails like this:

      ==11329== Thread 10:
      		 
      ==11329== Conditional jump or move depends on uninitialised value(s)
      		 
      ==11329==    at 0xFA06FE: ha_handler_stats::has_stats() (ha_handler_stats.h:58)
      		 
      ==11329==    by 0xF86200: MYSQL_QUERY_LOG::write(THD*, long, char const*, unsigned long, unsigned long long, unsigned long long, bool, char const*, unsigned long) (log.cc:3273)
      		 
      ==11329==    by 0xF7F944: Log_to_file_event_handler::log_slow(THD*, my_hrtime_t, char const*, unsigned long, unsigned long long, unsigned long long, bool, char const*, unsigned long) (log.cc:1076)
      		 
      ==11329==    by 0xF80615: LOGGER::slow_log_print(THD*, char const*, unsigned long, unsigned long long) (log.cc:1350)
      		 
      ==11329==    by 0xF91F6B: slow_log_print(THD*, char const*, unsigned int, unsigned long long) (log.cc:6950)
      		 
      ==11329==    by 0xA84E94: log_slow_statement(THD*) (sql_parse.cc:2585)
      		 
      ==11329==    by 0xA848B0: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) (sql_parse.cc:2453)

      This happens for this statement: 

      set long_query_time=0.0, log_slow_verbosity='engine';

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-34125 ANALYZE FORMAT=JSON: r_engine_stats.pages_read_time_ms has wrong scale

          • Major - Major loss of function.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            psergei Sergei Petrunia added a comment - - edited

            The failure happens when accessing THD::handler_stats.

            That variable is NOT initialized by default.

            It is reset in THD::reset_slow_query_state():

               if ((variables.log_slow_verbosity & LOG_SLOW_VERBOSITY_ENGINE))
            		 
                 handler_stats.reset();

            Then, in MYSQL_QUERY_LOG::write(), it is checked:

                 if (unlikely(log_slow_verbosity &
            		 
                              LOG_SLOW_VERBOSITY_ENGINE) &&
            		 
                     thd->handler_stats.has_stats())
            		 
                  {

            Now, consider this scenario of running a statement

            • The statement starts with LOG_SLOW_VERBOSITY_ENGINE flag not set. the values of thd.handler_stats are not cleared.
            • The statement sets LOG_SLOW_VERBOSITY_ENGINE.
            • In, MYSQL_QUERY_LOG::write(), we check thd->handler_stats, that is, read garbage data.
            psergei Sergei Petrunia added a comment - - edited The failure happens when accessing THD::handler_stats . That variable is NOT initialized by default. It is reset in THD::reset_slow_query_state(): if ((variables.log_slow_verbosity & LOG_SLOW_VERBOSITY_ENGINE)) handler_stats.reset(); Then, in MYSQL_QUERY_LOG::write(), it is checked: if (unlikely(log_slow_verbosity & LOG_SLOW_VERBOSITY_ENGINE) && thd->handler_stats.has_stats()) { Now, consider this scenario of running a statement The statement starts with LOG_SLOW_VERBOSITY_ENGINE flag not set. the values of thd.handler_stats are not cleared. The statement sets LOG_SLOW_VERBOSITY_ENGINE. In, MYSQL_QUERY_LOG::write(), we check thd->handler_stats, that is, read garbage data.
            monty Michael Widenius added a comment -

            Fixed by checking handler_stats if it's active instead of
            thd->variables.log_slow_verbosity & LOG_SLOW_VERBOSITY_ENGINE.

            monty Michael Widenius added a comment - Fixed by checking handler_stats if it's active instead of thd->variables.log_slow_verbosity & LOG_SLOW_VERBOSITY_ENGINE.

            People

              monty Michael Widenius
              psergei Sergei Petrunia
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.