Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-39661

LSAN Detectable memory leak in XXH_malloc upon SHUTDOWN

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Critical
    • Resolution: Unresolved
    • N/A
    • 13.1
    • None
    • None

    Description

      SELECT XXH32(NULL);
      		 
      SELECT XXH3(NULL);

      Leads to:

      MDEV-38180 CS 13.0.1 6defa5de6edf78921a1982112699f56bff9eb6a5 (Optimized, UBASAN, Clang 21.1.3-20250923) Build 19/05/2026

      		 
      2026-05-19  9:29:21 0 [Note] /test/MDEV-38180_UBASAN_MD190526-mariadb-13.0.1-linux-x86_64-opt/bin/mariadbd (initiated by: root[root] @ localhost [127.0.0.1]): Normal shutdown
      		 
      2026-05-19  9:29:21 0 [Note] /test/MDEV-38180_UBASAN_MD190526-mariadb-13.0.1-linux-x86_64-opt/bin/mariadbd: Shutdown complete
      		 
       
      		 
      =================================================================
      		 
      ==3267113==ERROR: LeakSanitizer: detected memory leaks
      		 
       
      		 
      Direct leak of 640 byte(s) in 1 object(s) allocated from:
      		 
          #0 0x621ab01f5158 in malloc (/test/MDEV-38180_UBASAN_MD190526-mariadb-13.0.1-linux-x86_64-opt/bin/mariadbd+0x37fc158) (BuildId: ac2b437bef4b41539faed7b9a35b454d27b1fcac)
      		 
          #1 0x621ab38a3715 in XXH_malloc /test/13.0_opt_san/strings/../mysys/xxhash.h:2384:56
      		 
          #2 0x621ab38a3715 in XXH_alignedMalloc /test/13.0_opt_san/strings/../mysys/xxhash.h:6244:33
      		 
          #3 0x621ab38a3715 in XXH3_createState /test/13.0_opt_san/strings/../mysys/xxhash.h:6293:48
      		 
          #4 0x621ab38a3715 in my_hasher_xxh3 /test/13.0_opt_san/strings/hasher-xxh.c:98:16
      		 
          #5 0x621ab064f679 in Item_func_xxh3::val_int() /test/13.0_opt_san/sql/item_strfunc.cc:4617:17
      		 
          #6 0x621ab1f5aeba in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/13.0_opt_san/sql/sql_type.cc:7706:22
      		 
          #7 0x621ab0bd9398 in Protocol::send_result_set_row(List<Item>*) /test/13.0_opt_san/sql/protocol.cc:1358:15
      		 
          #8 0x621ab0eb6e2b in select_send::send_data(List<Item>&) /test/13.0_opt_san/sql/sql_class.cc:3411:17
      		 
          #9 0x621ab0eb5cc1 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/13.0_opt_san/sql/sql_class.cc:3309:11
      		 
          #10 0x621ab156c73a in JOIN::exec_inner() /test/13.0_opt_san/sql/sql_select.cc:4996:22
      		 
          #11 0x621ab156acca in JOIN::exec() /test/13.0_opt_san/sql/sql_select.cc:4913:8
      		 
          #12 0x621ab14c23ad in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.0_opt_san/sql/sql_select.cc:5439:21
      		 
          #13 0x621ab14c0875 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.0_opt_san/sql/sql_select.cc:636:10
      		 
          #14 0x621ab13627e1 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.0_opt_san/sql/sql_parse.cc:6214:12
      		 
          #15 0x621ab1345aac in mysql_execute_command(THD*, bool) /test/13.0_opt_san/sql/sql_parse.cc:3988:12
      		 
          #16 0x621ab1327c99 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.0_opt_san/sql/sql_parse.cc:7942:18
      		 
          #17 0x621ab131f217 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.0_opt_san/sql/sql_parse.cc:1898:7
      		 
          #18 0x621ab1329e6e in do_command(THD*, bool) /test/13.0_opt_san/sql/sql_parse.cc:1432:17
      		 
          #19 0x621ab1ba55ac in do_handle_one_connection(CONNECT*, bool) /test/13.0_opt_san/sql/sql_connect.cc:1503:11
      		 
          #20 0x621ab1ba4f8d in handle_one_connection /test/13.0_opt_san/sql/sql_connect.cc:1415:5
      		 
          #21 0x621ab2658075 in pfs_spawn_thread /test/13.0_opt_san/storage/perfschema/pfs.cc:2198:3
      		 
          #22 0x621ab01f29da in asan_thread_start(void*) crtstuff.c
      		 
       
      		 
      Direct leak of 48 byte(s) in 1 object(s) allocated from:
      		 
          #0 0x621ab01f5158 in malloc (/test/MDEV-38180_UBASAN_MD190526-mariadb-13.0.1-linux-x86_64-opt/bin/mariadbd+0x37fc158) (BuildId: ac2b437bef4b41539faed7b9a35b454d27b1fcac)
      		 
          #1 0x621ab38a2afb in XXH_malloc /test/13.0_opt_san/strings/../mysys/xxhash.h:2384:56
      		 
          #2 0x621ab38a2afb in XXH32_createState /test/13.0_opt_san/strings/../mysys/xxhash.h:3205:28
      		 
          #3 0x621ab38a2afb in my_hasher_xxh32 /test/13.0_opt_san/strings/hasher-xxh.c:55:16
      		 
          #4 0x621ab064f199 in Item_func_xxh32::val_int() /test/13.0_opt_san/sql/item_strfunc.cc:4600:17
      		 
          #5 0x621ab1f5ac69 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /test/13.0_opt_san/sql/sql_type.cc:7697:22
      		 
          #6 0x621ab0bd9398 in Protocol::send_result_set_row(List<Item>*) /test/13.0_opt_san/sql/protocol.cc:1358:15
      		 
          #7 0x621ab0eb6e2b in select_send::send_data(List<Item>&) /test/13.0_opt_san/sql/sql_class.cc:3411:17
      		 
          #8 0x621ab0eb5cc1 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/13.0_opt_san/sql/sql_class.cc:3309:11
      		 
          #9 0x621ab156c73a in JOIN::exec_inner() /test/13.0_opt_san/sql/sql_select.cc:4996:22
      		 
          #10 0x621ab156acca in JOIN::exec() /test/13.0_opt_san/sql/sql_select.cc:4913:8
      		 
          #11 0x621ab14c23ad in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.0_opt_san/sql/sql_select.cc:5439:21
      		 
          #12 0x621ab14c0875 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.0_opt_san/sql/sql_select.cc:636:10
      		 
          #13 0x621ab13627e1 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.0_opt_san/sql/sql_parse.cc:6214:12
      		 
          #14 0x621ab1345aac in mysql_execute_command(THD*, bool) /test/13.0_opt_san/sql/sql_parse.cc:3988:12
      		 
          #15 0x621ab1327c99 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.0_opt_san/sql/sql_parse.cc:7942:18
      		 
          #16 0x621ab131f217 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.0_opt_san/sql/sql_parse.cc:1898:7
      		 
          #17 0x621ab1329e6e in do_command(THD*, bool) /test/13.0_opt_san/sql/sql_parse.cc:1432:17
      		 
          #18 0x621ab1ba55ac in do_handle_one_connection(CONNECT*, bool) /test/13.0_opt_san/sql/sql_connect.cc:1503:11
      		 
          #19 0x621ab1ba4f8d in handle_one_connection /test/13.0_opt_san/sql/sql_connect.cc:1415:5
      		 
          #20 0x621ab2658075 in pfs_spawn_thread /test/13.0_opt_san/storage/perfschema/pfs.cc:2198:3
      		 
          #21 0x621ab01f29da in asan_thread_start(void*) crtstuff.c
      		 
       
      		 
      SUMMARY: AddressSanitizer: 688 byte(s) leaked in 2 allocation(s).
      		 
      260519  9:29:35 [ERROR] /test/MDEV-38180_UBASAN_MD190526-mariadb-13.0.1-linux-x86_64-opt/bin/mariadbd got signal 6 ;
      		 
      Sorry, we probably made a mistake, and this is a bug.
      		 
       
      		 
      Your assistance in bug reporting will enable us to fix this for the next release.
      		 
      To report this bug, see https://mariadb.com/kb/en/reporting-bugs about how to report
      		 
      a bug on https://jira.mariadb.org/.
      		 
       
      		 
      Please include the information from the server start above, to the end of the
      		 
      information below.
      		 
       
      		 
      Server version: 13.0.1-MariaDB-asan-log source revision: 6defa5de6edf78921a1982112699f56bff9eb6a5
      		 
       
      		 
      The information page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/
      		 
      contains instructions to obtain a better version of the backtrace below.
      		 
      Following these instructions will help MariaDB developers provide a fix quicker.
      		 
       
      		 
      Attempting backtrace. Include this in the bug report.
      		 
      (note: Retrieving this information may fail)
      		 
       
      		 
      Thread pointer: 0x0
      		 
      stack_bottom = 0x0 thread_stack 0xb00000

      MDEV-38180 CS 13.0.1 6defa5de6edf78921a1982112699f56bff9eb6a5 (Debug, UBASAN, Clang 21.1.3-20250923) Build 19/05/2026

      		 
      2026-05-19  9:29:39 0 [Note] /test/MDEV-38180_UBASAN_MD190526-mariadb-13.0.1-linux-x86_64-dbg/bin/mariadbd (initiated by: root[root] @ localhost [127.0.0.1]): Normal shutdown
      		 
      2026-05-19  9:29:39 0 [Note] Debug sync points hit:                   5926
      		 
      2026-05-19  9:29:39 0 [Note] Debug sync points executed:              0
      		 
      2026-05-19  9:29:39 0 [Note] Debug sync points max active per thread: 0
      		 
      2026-05-19  9:29:39 0 [Note] /test/MDEV-38180_UBASAN_MD190526-mariadb-13.0.1-linux-x86_64-dbg/bin/mariadbd: Shutdown complete
      		 
       
      		 
      =================================================================
      		 
      ==3267333==ERROR: LeakSanitizer: detected memory leaks
      		 
       
      		 
      Direct leak of 640 byte(s) in 1 object(s) allocated from:
      		 
          #0 0x62d59b1c9638 in malloc (/test/MDEV-38180_UBASAN_MD190526-mariadb-13.0.1-linux-x86_64-dbg/bin/mariadbd+0x4164638) (BuildId: cd39043106c5c4bbe824744ab74448c680e7bd6c)
      		 
          #1 0x62d59e786225 in XXH_malloc /test/13.0_dbg_san/strings/../mysys/xxhash.h:2384:56
      		 
          #2 0x62d59e786225 in XXH_alignedMalloc /test/13.0_dbg_san/strings/../mysys/xxhash.h:6244:33
      		 
          #3 0x62d59e786225 in XXH3_createState /test/13.0_dbg_san/strings/../mysys/xxhash.h:6293:48
      		 
          #4 0x62d59e786225 in my_hasher_xxh3 /test/13.0_dbg_san/strings/hasher-xxh.c:98:16
      		 
          #5 0x62d59b63bb45 in Item_func_xxh3::val_int() /test/13.0_dbg_san/sql/item_strfunc.cc:4617:17
      		 
          #6 0x62d59ceb6b2a in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /test/13.0_dbg_san/sql/sql_type.cc:7706:22
      		 
          #7 0x62d59bbaf238 in Protocol::send_result_set_row(List<Item>*) /test/13.0_dbg_san/sql/protocol.cc:1358:15
      		 
          #8 0x62d59be7b238 in select_send::send_data(List<Item>&) /test/13.0_dbg_san/sql/sql_class.cc:3411:17
      		 
          #9 0x62d59be7a32b in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/13.0_dbg_san/sql/sql_class.cc:3309:11
      		 
          #10 0x62d59c51856e in JOIN::exec_inner() /test/13.0_dbg_san/sql/sql_select.cc:4996:22
      		 
          #11 0x62d59c5168b8 in JOIN::exec() /test/13.0_dbg_san/sql/sql_select.cc:4913:8
      		 
          #12 0x62d59c472b59 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.0_dbg_san/sql/sql_select.cc:5439:21
      		 
          #13 0x62d59c47188a in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.0_dbg_san/sql/sql_select.cc:636:10
      		 
          #14 0x62d59c316ad4 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.0_dbg_san/sql/sql_parse.cc:6214:12
      		 
          #15 0x62d59c301615 in mysql_execute_command(THD*, bool) /test/13.0_dbg_san/sql/sql_parse.cc:3988:12
      		 
          #16 0x62d59c2db2bd in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.0_dbg_san/sql/sql_parse.cc:7942:18
      		 
          #17 0x62d59c2d308e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.0_dbg_san/sql/sql_parse.cc:1898:7
      		 
          #18 0x62d59c2dd664 in do_command(THD*, bool) /test/13.0_dbg_san/sql/sql_parse.cc:1432:17
      		 
          #19 0x62d59cb1868c in do_handle_one_connection(CONNECT*, bool) /test/13.0_dbg_san/sql/sql_connect.cc:1503:11
      		 
          #20 0x62d59cb18195 in handle_one_connection /test/13.0_dbg_san/sql/sql_connect.cc:1415:5
      		 
          #21 0x62d59b1c6eba in asan_thread_start(void*) crtstuff.c
      		 
       
      		 
      Direct leak of 48 byte(s) in 1 object(s) allocated from:
      		 
          #0 0x62d59b1c9638 in malloc (/test/MDEV-38180_UBASAN_MD190526-mariadb-13.0.1-linux-x86_64-dbg/bin/mariadbd+0x4164638) (BuildId: cd39043106c5c4bbe824744ab74448c680e7bd6c)
      		 
          #1 0x62d59e7855cb in XXH_malloc /test/13.0_dbg_san/strings/../mysys/xxhash.h:2384:56
      		 
          #2 0x62d59e7855cb in XXH32_createState /test/13.0_dbg_san/strings/../mysys/xxhash.h:3205:28
      		 
          #3 0x62d59e7855cb in my_hasher_xxh32 /test/13.0_dbg_san/strings/hasher-xxh.c:55:16
      		 
          #4 0x62d59b63b545 in Item_func_xxh32::val_int() /test/13.0_dbg_san/sql/item_strfunc.cc:4600:17
      		 
          #5 0x62d59ceb6919 in Type_handler::Item_send_long(Item*, Protocol*, st_value*) const /test/13.0_dbg_san/sql/sql_type.cc:7697:22
      		 
          #6 0x62d59bbaf238 in Protocol::send_result_set_row(List<Item>*) /test/13.0_dbg_san/sql/protocol.cc:1358:15
      		 
          #7 0x62d59be7b238 in select_send::send_data(List<Item>&) /test/13.0_dbg_san/sql/sql_class.cc:3411:17
      		 
          #8 0x62d59be7a32b in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/13.0_dbg_san/sql/sql_class.cc:3309:11
      		 
          #9 0x62d59c51856e in JOIN::exec_inner() /test/13.0_dbg_san/sql/sql_select.cc:4996:22
      		 
          #10 0x62d59c5168b8 in JOIN::exec() /test/13.0_dbg_san/sql/sql_select.cc:4913:8
      		 
          #11 0x62d59c472b59 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.0_dbg_san/sql/sql_select.cc:5439:21
      		 
          #12 0x62d59c47188a in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.0_dbg_san/sql/sql_select.cc:636:10
      		 
          #13 0x62d59c316ad4 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.0_dbg_san/sql/sql_parse.cc:6214:12
      		 
          #14 0x62d59c301615 in mysql_execute_command(THD*, bool) /test/13.0_dbg_san/sql/sql_parse.cc:3988:12
      		 
          #15 0x62d59c2db2bd in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.0_dbg_san/sql/sql_parse.cc:7942:18
      		 
          #16 0x62d59c2d308e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.0_dbg_san/sql/sql_parse.cc:1898:7
      		 
          #17 0x62d59c2dd664 in do_command(THD*, bool) /test/13.0_dbg_san/sql/sql_parse.cc:1432:17
      		 
          #18 0x62d59cb1868c in do_handle_one_connection(CONNECT*, bool) /test/13.0_dbg_san/sql/sql_connect.cc:1503:11
      		 
          #19 0x62d59cb18195 in handle_one_connection /test/13.0_dbg_san/sql/sql_connect.cc:1415:5
      		 
          #20 0x62d59b1c6eba in asan_thread_start(void*) crtstuff.c
      		 
       
      		 
      SUMMARY: AddressSanitizer: 688 byte(s) leaked in 2 allocation(s).
      		 
      260519  9:29:53 [ERROR] /test/MDEV-38180_UBASAN_MD190526-mariadb-13.0.1-linux-x86_64-dbg/bin/mariadbd got signal 6 ;
      		 
      Sorry, we probably made a mistake, and this is a bug.
      		 
       
      		 
      Your assistance in bug reporting will enable us to fix this for the next release.
      		 
      To report this bug, see https://mariadb.com/kb/en/reporting-bugs about how to report
      		 
      a bug on https://jira.mariadb.org/.
      		 
       
      		 
      Please include the information from the server start above, to the end of the
      		 
      information below.
      		 
       
      		 
      Server version: 13.0.1-MariaDB-asan-debug-log source revision: 6defa5de6edf78921a1982112699f56bff9eb6a5
      		 
       
      		 
      The information page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/
      		 
      contains instructions to obtain a better version of the backtrace below.
      		 
      Following these instructions will help MariaDB developers provide a fix quicker.
      		 
       
      		 
      Attempting backtrace. Include this in the bug report.
      		 
      (note: Retrieving this information may fail)
      		 
       
      		 
      Thread pointer: 0x0
      		 
      stack_bottom = 0x0 thread_stack 0xb00000

      Attachments

        Issue Links

          is caused by

          New Feature - A new feature of the product, which has yet to be developed. MDEV-38180 Add XXH hash function

          • Critical - Crashes, loss of data, severe memory leak.
          • In Testing

          Activity

            People

              Roel Roel Van de Paar
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.