[MDEV-40338] use-of-uninitialized-value in subselect_uniquesubquery_engine::no_rows() - Jira

Details

Type: Bug
Status: Open (View Workflow)
Priority: Critical
Resolution: Unresolved
Affects Version/s: 11.4, 11.8, 12.3, 13.0, 13.1
Fix Version/s: 11.4, 11.8, 12.3, 13.0
Component/s: Optimizer
Labels:

Bug Category:
Can result in hang or crash
Sprint:
Q4/2026 Server Maintenance

Description

CREATE TABLE t2 (c1 INT,INDEX(c1));

CREATE TABLE t1 (c1 INT);

INSERT INTO t2 SET c1=999;

SELECT GREATEST(EXP(c1),(SELECT 1 FROM t1) IN (SELECT c1 FROM t2)) FROM t2;

Leads to:

CS 12.3.3 8da34620ac3935814cc7f9ba30bb51a6e2070237 (Optimized, MSAN, Clang 20.1.8-20250804) Build 07/07/2026
==3479866==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x5e61235f1490 in subselect_uniquesubquery_engine::no_rows() /test/12.3_opt_msan/sql/item_subselect.h:1053:29
#1 0x5e6123034c0b in Item_in_optimizer::val_bool() /test/12.3_opt_msan/sql/item_cmpfunc.cc:1782:32
#2 0x5e6122eb672e in Item_cache_bool::cache_value() /test/12.3_opt_msan/sql/item.cc:11064:19
#3 0x5e6122eaa744 in Item_cache_wrapper::cache() /test/12.3_opt_msan/sql/item.cc:9576:15
#4 0x5e6122eaa744 in Item_cache_wrapper::val_real() /test/12.3_opt_msan/sql/item.cc:9657:3
#5 0x5e6122f0a2ca in Item_func_min_max::val_real_native() /test/12.3_opt_msan/sql/item_func.cc:3077:28
#6 0x5e6123ecea15 in Type_handler::Item_send_double(Item, Protocol, st_value*) const /test/12.3_opt_msan/sql/sql_type.cc:7675:20
#7 0x5e6123ecea15 in Type_handler_double::Item_send(Item, Protocol, st_value*) const /test/12.3_opt_msan/sql/sql_type.h:6397:12
#8 0x5e612334cce5 in Protocol::send_result_set_row(List<Item>*) /test/12.3_opt_msan/sql/protocol.cc:1358:15
#9 0x5e6123500c75 in select_send::send_data(List<Item>&) /test/12.3_opt_msan/sql/sql_class.cc:3411:17
#10 0x5e61235005dd in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/12.3_opt_msan/sql/sql_class.cc:3309:11
#11 0x5e61238be7ae in end_send(JOIN, st_join_table, bool) /test/12.3_opt_msan/sql/sql_select.cc:25955:9
#12 0x5e612393a19d in evaluate_join_record(JOIN, st_join_table, int) /test/12.3_opt_msan/sql/sql_select.cc:24828:11
#13 0x5e612385d253 in sub_select(JOIN, st_join_table, bool) /test/12.3_opt_msan/sql/sql_select.cc:24595:9
#14 0x5e61238ceb43 in do_select(JOIN, Procedure) /test/12.3_opt_msan/sql/sql_select.cc:24106:14
#15 0x5e61238cc804 in JOIN::exec_inner() /test/12.3_opt_msan/sql/sql_select.cc:5125:50
#16 0x5e612385f058 in JOIN::exec() /test/12.3_opt_msan/sql/sql_select.cc:4913:8
#17 0x5e612385f058 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/12.3_opt_msan/sql/sql_select.cc:5439:21
#18 0x5e612385e58b in handle_select(THD, LEX, select_result*, unsigned long long) /test/12.3_opt_msan/sql/sql_select.cc:636:10
#19 0x5e61237aaece in execute_sqlcom_select(THD, TABLE_LIST) /test/12.3_opt_msan/sql/sql_parse.cc:6219:12
#20 0x5e612379e07b in mysql_execute_command(THD*, bool) /test/12.3_opt_msan/sql/sql_parse.cc:3992:12
#21 0x5e612379394f in mysql_parse(THD, char, unsigned int, Parser_state*) /test/12.3_opt_msan/sql/sql_parse.cc:7947:18
#22 0x5e612378d3a5 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/12.3_opt_msan/sql/sql_parse.cc:1903:7
#23 0x5e6123794414 in do_command(THD*, bool) /test/12.3_opt_msan/sql/sql_parse.cc:1437:17
#24 0x5e6123c4ae0c in do_handle_one_connection(CONNECT*, bool) /test/12.3_opt_msan/sql/sql_connect.cc:1510:11
#25 0x5e6123c4a78e in handle_one_connection /test/12.3_opt_msan/sql/sql_connect.cc:1422:5
#26 0x7673f809caa3 in start_thread nptl/pthread_create.c:447:8
#27 0x7673f8129c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Memory was marked as uninitialized
#0 0x5e6122cb1dc1 in __msan_allocated_memory (/test/MSAN_MD070726-mariadb-12.3.3-linux-x86_64-opt/bin/mariadbd+0xf6edc1) (BuildId: 6c281adb384bb4520eea334d62b111c38389c696)
#1 0x5e6124a4151e in my_malloc /test/12.3_opt_msan/mysys/my_malloc.c:117:7
#2 0x5e6124a22138 in alloc_root /test/12.3_opt_msan/mysys/my_alloc.c:294:30
#3 0x5e61233100f8 in Sql_alloc::operator new(unsigned long) /test/12.3_opt_msan/sql/sql_alloc.h:28:12
#4 0x5e6123d75ff3 in rewrite_to_index_subquery_engine(JOIN*) /test/12.3_opt_msan/sql/opt_subselect.cc:5802:7
#5 0x5e612388228a in JOIN::optimize_stage2() /test/12.3_opt_msan/sql/sql_select.cc:3404:13
#6 0x5e612387bdf9 in JOIN::optimize_inner() /test/12.3_opt_msan/sql/sql_select.cc:2789:9
#7 0x5e61238778a7 in JOIN::optimize() /test/12.3_opt_msan/sql/sql_select.cc:2016:10
#8 0x5e61236fba51 in st_select_lex::optimize_unflattened_subqueries(bool) /test/12.3_opt_msan/sql/sql_lex.cc:5156:31
#9 0x5e6123d774dc in st_select_lex::optimize_constant_subqueries() /test/12.3_opt_msan/sql/opt_subselect.cc:5949:8
#10 0x5e612387986c in JOIN::optimize_inner() /test/12.3_opt_msan/sql/sql_select.cc:2395:19
#11 0x5e61238778a7 in JOIN::optimize() /test/12.3_opt_msan/sql/sql_select.cc:2016:10
#12 0x5e612385ea64 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/12.3_opt_msan/sql/sql_select.cc:5425:19
#13 0x5e612385e58b in handle_select(THD, LEX, select_result*, unsigned long long) /test/12.3_opt_msan/sql/sql_select.cc:636:10
#14 0x5e61237aaece in execute_sqlcom_select(THD, TABLE_LIST) /test/12.3_opt_msan/sql/sql_parse.cc:6219:12
#15 0x5e612379e07b in mysql_execute_command(THD*, bool) /test/12.3_opt_msan/sql/sql_parse.cc:3992:12
#16 0x5e612379394f in mysql_parse(THD, char, unsigned int, Parser_state*) /test/12.3_opt_msan/sql/sql_parse.cc:7947:18
#17 0x5e612378d3a5 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/12.3_opt_msan/sql/sql_parse.cc:1903:7
#18 0x5e6123794414 in do_command(THD*, bool) /test/12.3_opt_msan/sql/sql_parse.cc:1437:17
#19 0x5e6123c4ae0c in do_handle_one_connection(CONNECT*, bool) /test/12.3_opt_msan/sql/sql_connect.cc:1510:11

SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/12.3_opt_msan/sql/item_subselect.h:1053:29 in subselect_uniquesubquery_engine::no_rows()

Setup:

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:

    -DWITH_MSAN=ON  # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)

Set before execution:

    export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0

MSAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 070726 736edbe77ce5db44ea38347280f77d6a304fa3ae No bug found
CS 10.6 opt 070726 736edbe77ce5db44ea38347280f77d6a304fa3ae No bug found
CS 10.11 dbg 070726 2be9ba2537aa3ff5836b21489cfca6b0f0ccf80a No bug found
CS 10.11 opt 070726 2be9ba2537aa3ff5836b21489cfca6b0f0ccf80a No bug found
CS 11.4 dbg 090726 176589bf19ea6e2261bb3ef57886c13b9c0b6759 MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
CS 11.4 opt 090726 176589bf19ea6e2261bb3ef57886c13b9c0b6759 MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
CS 11.8 dbg 070726 666b2aca09cb84d59b4ece2185a9200d745cb287 MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
CS 11.8 opt 070726 666b2aca09cb84d59b4ece2185a9200d745cb287 MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
CS 12.3 dbg 070726 8da34620ac3935814cc7f9ba30bb51a6e2070237 MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
CS 12.3 opt 070726 8da34620ac3935814cc7f9ba30bb51a6e2070237 MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
CS 13.0 dbg 070726 172609526b93ac278203607274b70e6b6d8e67fd MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
CS 13.0 opt 070726 172609526b93ac278203607274b70e6b6d8e67fd MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
CS 13.1 dbg 070726 fd8cec54af7a9d79749df25ea70dac695b371641 MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
CS 13.1 opt 070726 fd8cec54af7a9d79749df25ea70dac695b371641 MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
ES 10.6 dbg 070726 07b87fa33b7263c3b46b1a820474f88803d25a04 No bug found
ES 10.6 opt 070726 07b87fa33b7263c3b46b1a820474f88803d25a04 No bug found
ES 11.4 dbg 070726 89bb238190d313ead3b68e508099974e3728515e MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
ES 11.4 opt 070726 89bb238190d313ead3b68e508099974e3728515e MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
ES 11.8 dbg 070726 97386db1d887891fb17e5210536bfe8756bae3cf MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
ES 11.8 opt 070726 97386db1d887891fb17e5210536bfe8756bae3cf MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
ES 12.3 dbg 070726 b96de078339ebc1995fd6185bf5433c72fedbdaf MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache
ES 12.3 opt 070726 b96de078339ebc1995fd6185bf5433c72fedbdaf MSAN\|use-of-uninitialized-value\|sql/item_subselect.h\|subselect_uniquesubquery_engine::no_rows\|Item_in_optimizer::val_bool\|Item_cache_bool::cache_value\|Item_cache_wrapper::cache

use-of-uninitialized-value in subselect_uniquesubquery_engine::no_rows()

Details

Description

Attachments

Activity

People

Dates

Time Tracking

Git Integration