Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40086

[DRAFT}use-of-uninitialized-value in process_dbl_arg

    XMLWordPrintable

Details

    • Can result in unexpected behaviour

    Description

      SET GLOBAL innodb_max_dirty_pages_pct_lwm=28;
      SET GLOBAL innodb_max_dirty_pages_pct=20;
      

      Leads to :-

      CS 10.11.19 b1e62d5e530243456338e44be064952a53062fd5 (Debug, MSAN, Clang 20.1.8-20250804) Build 17/06/2026

       
      ==3170063==WARNING: MemorySanitizer: use-of-uninitialized-value
          #0 0x5b9643b5c16b in process_dbl_arg /test/10.11_dbg_san/strings/my_vsnprintf.c:341:10
          #1 0x5b9643b5c16b in my_vsnprintf_ex /test/10.11_dbg_san/strings/my_vsnprintf.c:743:11
          #2 0x5b96424283bc in push_warning_printf(THD*, Sql_state_errno_level::enum_warning_level, unsigned int, char const*, ...) /test/10.11_dbg_san/sql/sql_error.cc:787:3
          #3 0x5b964303e693 in innodb_max_dirty_pages_pct_update(THD*, st_mysql_sys_var*, void*, void const*) /test/10.11_dbg_san/storage/innobase/handler/ha_innodb.cc:17459:3
          #4 0x5b964258558a in sys_var_pluginvar::global_update(THD*, set_var*) /test/10.11_dbg_san/sql/sql_plugin.cc:3694:3
          #5 0x5b96420e9ab6 in sys_var::update(THD*, set_var*) /test/10.11_dbg_san/sql/set_var.cc:209:12
          #6 0x5b96420eddd2 in set_var::update(THD*) /test/10.11_dbg_san/sql/set_var.cc:868
          #7 0x5b96420ed002 in sql_set_variables(THD*, List<set_var_base>*, bool) /test/10.11_dbg_san/sql/set_var.cc:749:20
          #8 0x5b964250e19d in mysql_execute_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:5209:9
          #9 0x5b9642500d1f in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_dbg_san/sql/sql_parse.cc:8221:18
          #10 0x5b96424fa766 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1924:7
          #11 0x5b96425017e4 in do_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1434:17
          #12 0x5b96429c737c in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1475:11
          #13 0x5b96429c6d17 in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1387:5
          #14 0x7e1ce989caa3 in start_thread nptl/pthread_create.c:447:8
          #15 0x7e1ce9929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
       
        Uninitialized value was stored to memory at
          #0 0x5b9643b5c164 in my_vsnprintf_ex /test/10.11_dbg_san/strings/my_vsnprintf.c:742:10
       
        Uninitialized value was created by an allocation of 'yyvsa' in the stack frame
          #0 0x5b96422c299f in MYSQLparse(THD*) /test/10.11_dbg_san/sql/yy_mariadb.cc:29480:5
       
      SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/10.11_dbg_san/strings/my_vsnprintf.c:341:10 in process_dbl_arg
      Exiting
      260617 15:41:12 [ERROR] /test/MSAN_MD170626-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd got signal 6 ;
      Sorry, we probably made a mistake, and this is a bug.
       
      Your assistance in bug reporting will enable us to fix this for the next release.
      To report this bug, see https://mariadb.com/docs/general-resources/community/community/bug-tracking/reporting-bugs about how to report
      a bug on https://jira.mariadb.org/.
       
      Please include the information from the server start above, to the end of the
      information below.
       
      Server version: 10.11.19-MariaDB-debug source revision: b1e62d5e530243456338e44be064952a53062fd5
       
      The information page at https://mariadb.com/docs/server/reference/product-development/mariadb-fault-finding/how-to-produce-a-full-stack-trace-for-mariadbdcontains instructions to obtain a better version of the backtrace below.
      Following these instructions will help MariaDB developers provide a fix quicker.
       
      Attempting backtrace. Include this in the bug report.
      (note: Retrieving this information may fail)
       
      Thread pointer: 0x72b000126018
      stack_bottom = 0x7e1c1ee02000 thread_stack 0x200000
      /test/MSAN_MD170626-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd(___interceptor_backtrace+0xd6)[0x5b9641a5a776]
      mysys/stacktrace.c:216(my_print_stacktrace)[0x5b9643a17114]
      sql/signal_handler.cc:0(handle_fatal_signal)[0x5b9642004913]
      crtstuff.c:0(SignalHandler(int))[0x5b9641a8e52d]
      libc_sigaction.c:0(__restore_rt)[0x7e1ce9845330]
      nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7e1ce989eb2c]
      posix/raise.c:27(__GI_raise)[0x7e1ce984527e]
      stdlib/abort.c:81(__GI_abort)[0x7e1ce98288ff]
      crtstuff.c:0(__sanitizer::Atexit(void (*)()))[0x5b9641a18060]
      crtstuff.c:0(__sanitizer::Die())[0x5b9641a15dd2]
      /test/MSAN_MD170626-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd(+0xfe2757)[0x5b9641a2d757]
      strings/my_vsnprintf.c:338(my_vsnprintf_ex)[0x5b9643b5c16c]
      sql/sql_error.cc:0(push_warning_printf(THD*, Sql_state_errno_level::enum_warning_level, unsigned int, char const*, ...))[0x5b96424283bd]
      handler/ha_innodb.cc:0(innodb_max_dirty_pages_pct_update(THD*, st_mysql_sys_var*, void*, void const*))[0x5b964303e694]
      sql/sql_plugin.cc:3695(sys_var_pluginvar::global_update(THD*, set_var*))[0x5b964258558b]
      sql/set_var.cc:0(sys_var::update(THD*, set_var*))[0x5b96420e9ab7]
      sql/set_var.cc:868(set_var::update(THD*))[0x5b96420eddd3]
      sql/set_var.cc:749(sql_set_variables(THD*, List<set_var_base>*, bool))[0x5b96420ed003]
      sql/sql_parse.cc:0(mysql_execute_command(THD*, bool))[0x5b964250e19e]
      sql/sql_parse.cc:0(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x5b9642500d20]
      sql/sql_parse.cc:0(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x5b96424fa767]
      sql/sql_parse.cc:1436(do_command(THD*, bool))[0x5b96425017e5]
      sql/sql_connect.cc:1475(do_handle_one_connection(CONNECT*, bool))[0x5b96429c737d]
      sql/sql_connect.cc:0(handle_one_connection)[0x5b96429c6d18]
      nptl/pthread_create.c:447(start_thread)[0x7e1ce989caa4]
      x86_64/clone3.S:80(clone3)[0x7e1ce9929c6c]
       
      Connection ID (thread ID): 4
      Status: NOT_KILLED
      Query (0x70b000005830): SET GLOBAL innodb_max_dirty_pages_pct=20
      
      

      Attachments

        Issue Links

          Activity

            People

              saahil Saahil Alam
              saahil Saahil Alam
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 1.25h
                  1.25h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.