[MDEV-40302] use-of-uninitialized-value in hp_rec_hashnr - Jira

Details

Type: Bug
Status: Open (View Workflow)
Priority: Critical
Resolution: Unresolved
Affects Version/s: 12.3, 13.0, 13.1
Fix Version/s: 12.3, 13.0
Component/s: Server
Labels:

Bug Category:
Can result in hang or crash
Sprint:
Q3/2026 Server Maintenance

Description

CREATE TABLE t1 (c2 VECTOR(1));

CREATE TABLE t2 (c2 JSON);

INSERT INTO t2 (c2) VALUES (1);

SET SESSION sql_mode='ORACLE';

SELECT * FROM t1 UNION SELECT c2 FROM t2;

Leads to:

CS 12.3.3 8da34620ac3935814cc7f9ba30bb51a6e2070237 (Debug, MSAN, Clang 20.1.8-20250804) Build 07/07/2026
==2002153==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x555557f57dc5 in hp_rec_hashnr /test/12.3_dbg_msan/storage/heap/hp_hash.c:354:3
#1 0x555557f6057d in hp_write_key /test/12.3_dbg_msan/storage/heap/hp_write.c:350:16
#2 0x555557f5ed67 in heap_write /test/12.3_dbg_msan/storage/heap/hp_write.c:52:9
#3 0x555557f4b6e1 in ha_heap::write_row(unsigned char const*) /test/12.3_dbg_msan/storage/heap/ha_heap.cc:296:8
#4 0x55555770f351 in handler::ha_write_tmp_row(unsigned char*) /test/12.3_dbg_msan/sql/sql_class.h:8147:3
#5 0x55555770f351 in select_unit::write_record() /test/12.3_dbg_msan/sql/sql_union.cc:417:7
#6 0x55555770ea13 in select_unit::send_data(List<Item>&) /test/12.3_dbg_msan/sql/sql_union.cc:161:9
#7 0x5555570ba088 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/12.3_dbg_msan/sql/sql_class.cc:3309:11
#8 0x5555574c7920 in end_send(JOIN, st_join_table, bool) /test/12.3_dbg_msan/sql/sql_select.cc:25955:9
#9 0x55555754f1c5 in evaluate_join_record(JOIN, st_join_table, int) /test/12.3_dbg_msan/sql/sql_select.cc:24828:11
#10 0x55555745db0c in sub_select(JOIN, st_join_table, bool) /test/12.3_dbg_msan/sql/sql_select.cc:24595:9
#11 0x5555574d98ca in do_select(JOIN, Procedure) /test/12.3_dbg_msan/sql/sql_select.cc:24106:14
#12 0x5555574d7768 in JOIN::exec_inner() /test/12.3_dbg_msan/sql/sql_select.cc:5125:50
#13 0x5555574d56a3 in JOIN::exec() /test/12.3_dbg_msan/sql/sql_select.cc:4913:8
#14 0x55555745f8fa in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/12.3_dbg_msan/sql/sql_select.cc:5439:21
#15 0x55555771de96 in st_select_lex_unit::exec_inner() /test/12.3_dbg_msan/sql/sql_union.cc:2551:22
#16 0x555557266c98 in mysql_derived_fill(THD, LEX, TABLE_LIST*) /test/12.3_dbg_msan/sql/sql_derived.cc:1353:16
#17 0x55555726894e in mysql_handle_single_derived(LEX, TABLE_LIST, unsigned int) /test/12.3_dbg_msan/sql/sql_derived.cc:235:15
#18 0x55555751faf1 in st_join_table::preread_init() /test/12.3_dbg_msan/sql/sql_select.cc:17063:7
#19 0x55555745d621 in sub_select(JOIN, st_join_table, bool) /test/12.3_dbg_msan/sql/sql_select.cc:24542:49
#20 0x5555574d98ca in do_select(JOIN, Procedure) /test/12.3_dbg_msan/sql/sql_select.cc:24106:14
#21 0x5555574d7768 in JOIN::exec_inner() /test/12.3_dbg_msan/sql/sql_select.cc:5125:50
#22 0x5555574d56a3 in JOIN::exec() /test/12.3_dbg_msan/sql/sql_select.cc:4913:8
#23 0x55555745f8fa in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/12.3_dbg_msan/sql/sql_select.cc:5439:21
#24 0x55555745eecc in handle_select(THD, LEX, select_result*, unsigned long long) /test/12.3_dbg_msan/sql/sql_select.cc:636:10
#25 0x5555573966c7 in execute_sqlcom_select(THD, TABLE_LIST) /test/12.3_dbg_msan/sql/sql_parse.cc:6219:12
#26 0x555557387296 in mysql_execute_command(THD*, bool) /test/12.3_dbg_msan/sql/sql_parse.cc:3992:12
#27 0x55555737b462 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/12.3_dbg_msan/sql/sql_parse.cc:7947:18
#28 0x555557374c47 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/12.3_dbg_msan/sql/sql_parse.cc:1903:7
#29 0x55555737bf1e in do_command(THD*, bool) /test/12.3_dbg_msan/sql/sql_parse.cc:1437:17
#30 0x555557896a4c in do_handle_one_connection(CONNECT*, bool) /test/12.3_dbg_msan/sql/sql_connect.cc:1510:11
#31 0x5555578963e2 in handle_one_connection /test/12.3_dbg_msan/sql/sql_connect.cc:1422:5
#32 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
#33 0x7fffe6929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Uninitialized value was stored to memory at
#0 0x555558a38c68 in MY_HASH_ADD_STR /test/12.3_dbg_msan/strings/strings_def.h:222:7
#1 0x555558a38c68 in my_hash_sort_bin /test/12.3_dbg_msan/strings/ctype-bin.c:306:3

Memory was marked as uninitialized
#0 0x555556756561 in __msan_allocated_memory (/test/MSAN_MD070726-mariadb-12.3.3-linux-x86_64-dbg/bin/mariadbd+0x1202561) (BuildId: d25fe94b7b38eab31f324edc8f2c6ee413d431c3)
#1 0x5555589c86b1 in my_malloc /test/12.3_dbg_msan/mysys/my_malloc.c:117:7

SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/12.3_dbg_msan/storage/heap/hp_hash.c:354:3 in hp_rec_hashnr

grep: /test/MSAN_MD070726-mariadb-12.3.3-linux-x86_64-opt/log/master.err: No such file or directory
grep: /test/MSAN_MD070726-mariadb-12.3.3-linux-x86_64-opt/log/master.err: No such file or directory

Setup:

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:

    -DWITH_MSAN=ON  # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)

Set before execution:

    export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0

MSAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 070726 736edbe77ce5db44ea38347280f77d6a304fa3ae No bug found
CS 10.6 opt 070726 736edbe77ce5db44ea38347280f77d6a304fa3ae No bug found
CS 10.11 dbg 070726 2be9ba2537aa3ff5836b21489cfca6b0f0ccf80a No bug found
CS 10.11 opt 070726 2be9ba2537aa3ff5836b21489cfca6b0f0ccf80a No bug found
CS 11.4 dbg 090726 176589bf19ea6e2261bb3ef57886c13b9c0b6759 No bug found
CS 11.4 opt 090726 176589bf19ea6e2261bb3ef57886c13b9c0b6759 No bug found
CS 11.8 dbg 070726 666b2aca09cb84d59b4ece2185a9200d745cb287 No bug found
CS 11.8 opt 070726 666b2aca09cb84d59b4ece2185a9200d745cb287 No bug found
CS 12.3 dbg 070726 8da34620ac3935814cc7f9ba30bb51a6e2070237 MSAN\|use-of-uninitialized-value\|storage/heap/hp_hash.c\|hp_rec_hashnr\|hp_write_key\|heap_write\|ha_heap::write_row
CS 12.3 opt 070726 8da34620ac3935814cc7f9ba30bb51a6e2070237 MSAN\|use-of-uninitialized-value\|storage/heap/hp_hash.c\|hp_rec_hashnr\|hp_write_key\|heap_write\|ha_heap::write_row
CS 13.0 dbg 070726 172609526b93ac278203607274b70e6b6d8e67fd MSAN\|use-of-uninitialized-value\|storage/heap/hp_hash.c\|hp_rec_hashnr\|hp_write_key\|heap_write\|ha_heap::write_row
CS 13.0 opt 070726 172609526b93ac278203607274b70e6b6d8e67fd MSAN\|use-of-uninitialized-value\|storage/heap/hp_hash.c\|hp_rec_hashnr\|hp_write_key\|heap_write\|ha_heap::write_row
CS 13.1 dbg 070726 fd8cec54af7a9d79749df25ea70dac695b371641 MSAN\|use-of-uninitialized-value\|storage/heap/hp_hash.c\|hp_rec_hashnr\|hp_write_key\|heap_write\|ha_heap::write_row
CS 13.1 opt 070726 fd8cec54af7a9d79749df25ea70dac695b371641 MSAN\|use-of-uninitialized-value\|storage/heap/hp_hash.c\|hp_rec_hashnr\|hp_write_key\|heap_write\|ha_heap::write_row
ES 10.6 dbg 070726 07b87fa33b7263c3b46b1a820474f88803d25a04 No bug found
ES 10.6 opt 070726 07b87fa33b7263c3b46b1a820474f88803d25a04 No bug found
ES 11.4 dbg 070726 89bb238190d313ead3b68e508099974e3728515e MSAN\|use-of-uninitialized-value\|storage/heap/hp_hash.c\|hp_rec_hashnr\|hp_write_key\|heap_write\|ha_heap::write_row
ES 11.4 opt 070726 89bb238190d313ead3b68e508099974e3728515e MSAN\|use-of-uninitialized-value\|storage/heap/hp_hash.c\|hp_rec_hashnr\|hp_write_key\|heap_write\|ha_heap::write_row
ES 11.8 dbg 070726 97386db1d887891fb17e5210536bfe8756bae3cf MSAN\|use-of-uninitialized-value\|storage/heap/hp_hash.c\|hp_rec_hashnr\|hp_write_key\|heap_write\|ha_heap::write_row
ES 11.8 opt 070726 97386db1d887891fb17e5210536bfe8756bae3cf MSAN\|use-of-uninitialized-value\|storage/heap/hp_hash.c\|hp_rec_hashnr\|hp_write_key\|heap_write\|ha_heap::write_row
ES 12.3 dbg 070726 b96de078339ebc1995fd6185bf5433c72fedbdaf MSAN\|use-of-uninitialized-value\|storage/heap/hp_hash.c\|hp_rec_hashnr\|hp_write_key\|heap_write\|ha_heap::write_row
ES 12.3 opt 070726 b96de078339ebc1995fd6185bf5433c72fedbdaf MSAN\|use-of-uninitialized-value\|storage/heap/hp_hash.c\|hp_rec_hashnr\|hp_write_key\|heap_write\|ha_heap::write_row

use-of-uninitialized-value in hp_rec_hashnr

Details

Description

Attachments

Activity

People

Dates

Time Tracking

Git Integration