Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40352

[DRAFT] use-of-uninitialized-value in rec_get_status(unsigned char const*)

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      CS 11.4.13 40de612592e1c99f3c2132b5e19fdcf663ba9936 (Debug, MSAN, Clang 20.1.8-20250804) Build 12/07/2026

                                                                                                                                                                               
       
      # 2026-07-13T01:27:29 [3976659] | SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/11.4_dbg_msan/storage/innobase/include/rem0rec.h:253:2 in rec_get_status(unsigned char const*)
      

      StackTrace

      # 2026-07-13T01:27:29 [3976659] | ==3979671==WARNING: MemorySanitizer: use-of-uninitialized-value
      # 2026-07-13T01:27:29 [3976659] |     #0 0x5555581ef024 in rec_get_status(unsigned char const*) /test/11.4_dbg_msan/storage/innobase/include/rem0rec.h:253:2
      # 2026-07-13T01:27:29 [3976659] |     #1 0x5555581ef024 in rec_get_offsets_func(unsigned char const*, dict_index_t const*, unsigned short*, unsigned long, unsigned long, char const*, unsigned int, mem_block_info_t**) /test/11.4_dbg_msan/storage/innobase/rem/rem0rec.cc:842:11
      # 2026-07-13T01:27:29 [3976659] |     #2 0x555557e8e7a2 in btr_search_hash_table_validate(THD*, unsigned long) /test/11.4_dbg_msan/storage/innobase/btr/btr0sea.cc:2137:14
      # 2026-07-13T01:27:29 [3976659] |     #3 0x555557e8e7a2 in btr_search_validate(THD*) /test/11.4_dbg_msan/storage/innobase/btr/btr0sea.cc:2224:10
      # 2026-07-13T01:27:29 [3976659] |     #4 0x555557bdd833 in ha_innobase::check(THD*, st_ha_check_opt*) /test/11.4_dbg_msan/storage/innobase/handler/ha_innodb.cc:15428:10
      # 2026-07-13T01:27:29 [3976659] |     #5 0x5555566778b9 in handler::ha_check(THD*, st_ha_check_opt*) /test/11.4_dbg_msan/sql/handler.cc:5383:7
      # 2026-07-13T01:27:29 [3976659] |     #6 0x55555755f6d1 in mysql_admin_table(THD*, TABLE_LIST*, st_ha_check_opt*, st_mysql_const_lex_string const*, thr_lock_type, bool, bool, unsigned int, int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), int (handler::*)(THD*, st_ha_check_opt*), int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), bool) /test/11.4_dbg_msan/sql/sql_admin.cc:918:21
      # 2026-07-13T01:27:29 [3976659] |     #7 0x555557563995 in Sql_cmd_check_table::execute(THD*) /test/11.4_dbg_msan/sql/sql_admin.cc:1619:8
      # 2026-07-13T01:27:29 [3976659] |     #8 0x5555570508d6 in mysql_execute_command(THD*, bool) /test/11.4_dbg_msan/sql/sql_parse.cc:5914:26
      # 2026-07-13T01:27:29 [3976659] |     #9 0x555557044e9f in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.4_dbg_msan/sql/sql_parse.cc:7943:18
      # 2026-07-13T01:27:29 [3976659] |     #10 0x55555703e898 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.4_dbg_msan/sql/sql_parse.cc:1925:7                                      # 2026-07-13T01:27:29 [3976659] |     #11 0x55555704595e in do_command(THD*, bool) /test/11.4_dbg_msan/sql/sql_parse.cc:1433:17
      # 2026-07-13T01:27:29 [3976659] |     #12 0x55555752c7ec in do_handle_one_connection(CONNECT*, bool) /test/11.4_dbg_msan/sql/sql_connect.cc:1504:11
      # 2026-07-13T01:27:29 [3976659] |     #13 0x55555752c186 in handle_one_connection /test/11.4_dbg_msan/sql/sql_connect.cc:1416:5
      # 2026-07-13T01:27:29 [3976659] |     #14 0x7ffff709caa3 in start_thread nptl/pthread_create.c:447:8
      # 2026-07-13T01:27:29 [3976659] |     #15 0x7ffff7129c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      # 2026-07-13T01:27:29 [3976659] | 
      # 2026-07-13T01:27:29 [3976659] |   Uninitialized value was stored to memory at
      # 2026-07-13T01:27:29 [3976659] |     #0 0x5555581ef01d in rec_get_status(unsigned char const*) /test/11.4_dbg_msan/storage/innobase/include/rem0rec.h:252:14
      # 2026-07-13T01:27:29 [3976659] |     #1 0x5555581ef01d in rec_get_offsets_func(unsigned char const*, dict_index_t const*, unsigned short*, unsigned long, unsigned long, char const*, unsigned int, mem_block_info_t**) /test/11.4_dbg_msan/storage/innobase/rem/rem0rec.cc:842:11
      # 2026-07-13T01:27:29 [3976659] | 
      # 2026-07-13T01:27:29 [3976659] |   Memory was marked as uninitialized
      # 2026-07-13T01:27:29 [3976659] |     #0 0x55555657e581 in __msan_allocated_memory (/data/Server_bin/MSAN_MD120726-mariadb-11.4.13-linux-x86_64-dbg/bin/mariadbd+0x102a581) (BuildId: 091c4ed560cb05f6554dd4707d515631ef957662)
      # 2026-07-13T01:27:29 [3976659] |     #1 0x555557e77ae6 in buf_LRU_block_remove_hashed(buf_page_t*, page_id_t, buf_pool_t::hash_chain&, bool) /test/11.4_dbg_msan/storage/innobase/buf/buf0lru.cc:1114:3
      # 2026-07-13T01:27:29 [3976659] |                                                                                                                                                                                   # 2026-07-13T01:27:29 [3976659] | SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/11.4_dbg_msan/storage/innobase/include/rem0rec.h:253:2 in rec_get_status(unsigned char const*)
      

      RQG setup

      # $RQG_HOME/rqg.pl \
      # --gendata=conf/mariadb/table_stress.zz \
      # --gendata_sql=conf/mariadb/table_stress.sql \
      # --grammar=conf/mariadb/table_stress_innodb.yy \
      # --redefine=conf/mariadb/redefine_ai_blob_offpage.yy \
      # --mysqld=--loose-innodb_lock_schedule_algorithm=fcfs \
      # --mysqld=--loose-idle_write_transaction_timeout=0 \                                                                                                                                                               # --mysqld=--loose-idle_transaction_timeout=0 \
      # --mysqld=--loose-idle_readonly_transaction_timeout=0 \
      # --mysqld=--connect_timeout=60 \
      # --mysqld=--interactive_timeout=28800 \
      # --mysqld=--slave_net_timeout=60 \
      # --mysqld=--net_read_timeout=30 \
      # --mysqld=--net_write_timeout=60 \
      # --mysqld=--loose-table_lock_wait_timeout=50 \
      # --mysqld=--wait_timeout=28800 \
      # --no_mask \
      # --queries=10000000 \
      # --seed=random \
      # --reporters=None \
      # --reporters=ErrorLog \
      # --reporters=Deadlock \
      # --validators=None \
      # --mysqld=--log_output=none \
      # --mysqld=--log_bin_trust_function_creators=1 \
      # --mysqld=--loose-debug_assert_on_not_freed_memory=0 \
      # --engine=InnoDB \
      # --restart_timeout=240 \
      # --mysqld=--plugin-load-add=file_key_management.so \
      # --mysqld=--loose-file-key-management-filename=$RQG_HOME/conf/mariadb/encryption_keys.txt \
      # --mysqld=--plugin-load-add=provider_lzo.so \
      # --mysqld=--plugin-load-add=provider_bzip2.so \
      # --mysqld=--plugin-load-add=provider_lzma.so \
      # --mysqld=--plugin-load-add=provider_snappy.so \
      # --mysqld=--plugin-load-add=provider_lz4.so \
      # --mysqld=--loose-innodb_compression_level=1 \
      # --duration=300 \
      # --mysqld=--loose-innodb_fatal_semaphore_wait_threshold=300 \
      # --mysqld=--loose-innodb_data_file_path=ibdata1:1M:autoextend:autoshrink \
      # --mysqld=--lock-wait-timeout=15 \
      # --mysqld=--innodb-lock-wait-timeout=10 \
      # --mysqld=--sql_mode=STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION \
      # --mysqld=--loose-innodb_read_only_compressed=OFF \
      # --mysqld=--loose-innodb-sync-debug \
      # --mysqld=--innodb_stats_persistent=on \
      # --mysqld=--innodb_adaptive_hash_index=on \
      # --mysqld=--innodb_sort_buffer_size=65536 \
      # --mysqld=--innodb_random_read_ahead=ON \
      # --mysqld=--innodb_read_ahead_threshold=0 \
      # --mysqld=--loose-innodb_evict_tables_on_commit_debug=on \
      # --mysqld=--loose-max-statement-time=30 \
      # --threads=33 \
      # --rr= \
      # --mysqld=--innodb_use_native_aio=1 \
      # --mysqld=--innodb_undo_log_truncate=OFF \
      # --mysqld=--innodb_rollback_on_timeout=ON \
      # --mysqld=--innodb_page_size=64K \
      # --mysqld=--innodb-buffer-pool-size=256M \
      # --vardir_type=slow \
      # --no_mask \
      # --batch \
      # --basedir1=/Server_bin/MSAN_MD120726-mariadb-11.4.13-linux-x86_64-dbg \
      # --basedir2=/Server_bin/MSAN_MD120726-mariadb-11.4.13-linux-x86_64-dbg \
      # --script_debug=_nix_ \
      # --major_runid=1783929705 \
      # --minor_runid=91
      

      Core dump is present at SDP:-
      /data/results/1783929705/TBR-2459

      Attachments

        Activity

          People

            saahil Saahil Alam
            saahil Saahil Alam
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 0.25d
                0.25d

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.