Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36723

ALTER TABLE tbl_a ADD PARTITION (PARTITION pt2) MSAN uninitalized read

    XMLWordPrintable

Details

    Description

      msan errors on tests spider/bugfix.mdev_29027_original spider/bugfix.mdev_29027
      (after patch in MDEV-35009)

      Both test was same sql statement as below, alter add partition:

      CURRENT_TEST: spider/bugfix.mdev_29027
      mysqltest: At line 20: query 'ALTER TABLE tbl_a ADD PARTITION (PARTITION pt2)' failed: <Unknown> (2026): TLS/SSL error: unexpected eof while reading
       
      The result from queries just before the failure was:
      < snip >
      child2_2
      child2_3
      for child3
      CREATE DATABASE auto_test_local;
      USE auto_test_local;
      CREATE TABLE tbl_a (
      c INT
      ) ENGINE=Spider DEFAULT CHARSET=utf8 PARTITION BY HASH(c) (
      PARTITION pt1
      );
      ALTER TABLE tbl_a ADD PARTITION (PARTITION pt2);
       
      More results from queries before failure can be found in /build/mysql-test/var/8/log/mdev_29027.log
       
       
      Server [mysqld.1.1 - pid: 356727, winpid: 356727, exit: 256] failed during test run
      Server log from this test:
      ----------SERVER LOG START-----------
      $ /build/sql/mariadbd --defaults-group-suffix=.1.1 --defaults-file=/build/mysql-test/var/8/my.cnf --log-output=file --loose-innodb --loose-skip-performance-schema --core-file --loose-debug-sync-timeout=300
      2025-05-02  1:52:38 0 [Warning] Could not increase number of max_open_files to more than 
      ...
      Version: '12.0.1-MariaDB-valgrind-log'  socket: '/build/mysql-test/var/tmp/8/mysqld.1.1.sock'  port: 19180  Source distribution
       
      Uninitialized bytes in MemcmpInterceptorCommon at offset 30 inside [0x7f2d1c4a7280, 35)
      ==356728==WARNING: MemorySanitizer: use-of-uninitialized-value
          #0 0x556b9484edcc in bcmp (/build/sql/mariadbd+0x86edcc) (BuildId: 7a92e6ede9c43c8d707bd46513d7f946a7d126f5)
          #1 0x7f2d18c9de55 in spider_get_partition_info(char const*, unsigned int, TABLE_SHARE const*, partition_info*, partition_element**, partition_element**) /source/storage/spider/spd_table.cc:6986:12
          #2 0x7f2d18c78827 in spider_parse_connect_info(st_spider_share*, TABLE_SHARE*, partition_info*, unsigned int) /source/storage/spider/spd_table.cc:2526:3
          #3 0x7f2d18d3c502 in ha_spider::create(char const*, TABLE*, HA_CREATE_INFO*) /source/storage/spider/ha_spider.cc:6864:20
          #4 0x556b9551827e in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /source/sql/handler.cc:5933:14
          #5 0x556b95c7757d in ha_partition::prepare_new_partition(TABLE*, HA_CREATE_INFO*, handler*, char const*, partition_element*) /source/sql/ha_partition.cc:1732:21
          #6 0x556b95c78ecd in ha_partition::change_partitions(HA_CREATE_INFO*, char const*, unsigned long long*, unsigned long long*, unsigned char const*, unsigned long) /source/sql/ha_partition.cc:2117:13
          #7 0x556b94c7fc80 in mysql_change_partitions(st_lock_param_type*, bool) /source/sql/sql_partition.cc:6161:7
          #8 0x556b94c7dfe2 in fast_alter_partition_table(THD*, TABLE*, Alter_info*, Alter_table_ctx*, HA_CREATE_INFO*, TABLE_LIST*) /source/sql/sql_partition.cc:7849:9
          #9 0x556b94eef4a5 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /source/sql/sql_table.cc:11343:5
          #10 0x556b95095871 in Sql_cmd_alter_table::execute(THD*) /source/sql/sql_alter.cc:695:11
          #11 0x556b94c391ff in mysql_execute_command(THD*, bool) /source/sql/sql_parse.cc:5889:26
          #12 0x556b94c29a8e in mysql_parse(THD*, char*, unsigned int, Parser_state*) /source/sql/sql_parse.cc:7910:18
          #13 0x556b94c22e38 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /source/sql/sql_parse.cc:1905:7
          #14 0x556b94c2ab7a in do_command(THD*, bool) /source/sql/sql_parse.cc:1416:17
          #15 0x556b9507f1ec in do_handle_one_connection(CONNECT*, bool) /source/sql/sql_connect.cc:1415:11
          #16 0x556b9507ec91 in handle_one_connection /source/sql/sql_connect.cc:1327:5
          #17 0x556b95cb97c4 in pfs_spawn_thread /source/storage/perfschema/pfs.cc:2198:3
          #18 0x7f2d226611f4  (/lib/x86_64-linux-gnu/libc.so.6+0x891f4) (BuildId: 79005c16293efa45b441fed45f4f29b138557e9e)
          #19 0x7f2d226e189b  (/lib/x86_64-linux-gnu/libc.so.6+0x10989b) (BuildId: 79005c16293efa45b441fed45f4f29b138557e9e)
       
        Uninitialized value was created by an allocation of 'tmp_name' in the stack frame
          #0 0x7f2d18c9d97c in spider_get_partition_info(char const*, unsigned int, TABLE_SHARE const*, partition_info*, partition_element**, partition_element**) /source/storage/spider/spd_table.cc:6936:3
       
      SUMMARY: MemorySanitizer: use-of-uninitialized-value (/build/sql/mariadbd+0x86edcc) (BuildId: 7a92e6ede9c43c8d707bd46513d7f946a7d126f5) in bcmp
      Exiting
      

      #7  0x00007f179749de56 in spider_get_partition_info (table_name=0x7f179c098f70 "./test/t_spider#P#p1#TMP#", table_name_length=<optimized out>, table_share=table_share@entry=0x71a000030030, 
          part_info=part_info@entry=0x7150000269b0, part_elem=part_elem@entry=0x7f179c097580, sub_elem=sub_elem@entry=0x7f179c097588) at /source/storage/spider/spd_table.cc:6986
      6986	      if (!memcmp(table_name, tmp_name, table_name_length + 1))
      (gdb) info locals
      tmp_name = "./test/t_spider#P#p1\000\000\000\000\370{\t\234\027\177\000\000\000\000\000\000\000\000\000\000\275\330\211\360\304U", '\000' <repeats 18 times>, "\360\205\t\234\027\177\000\000\305\206\006\361\304U\000\000\000\000\b", '\000' <repeats 253 times>...
      

      looks like table_name_length is length of table_name, however temp_name is a shorter string so its end values are uninitialized.

      Attachments

        Issue Links

          Activity

            People

              ycp Yuchen Pei
              danblack Daniel Black
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.