[MDEV-40402] use-of-uninitialized-value in reload_acl_and_cache(THD*, unsigned long long, TABLE_LIST*, int*) - Jira

Details

Type: Bug
Status: Open (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.6, 10.11, 11.4, 11.8, 12.3, 13.0, 13.1
Fix Version/s: 10.6, 10.11, 11.4, 11.8, 12.3, 13.0
Component/s: None
Labels:
- MSAN
- use-of-uninitialized-value

Bug Category:
Can result in hang or crash

Description

CREATE PROCEDURE p() FLUSH MASTER;

CALL p();

Leads to:

CS 13.0.2 172609526b93ac278203607274b70e6b6d8e67fd (Debug, MSAN, Clang 20.1.8-20250804) Build 07/07/2026
==740674==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x55555795765d in reload_acl_and_cache(THD, unsigned long long, TABLE_LIST, int*) /test/13.0_dbg_msan/sql/sql_reload.cc:413:9
#1 0x55555739cbcd in mysql_execute_command(THD*, bool) /test/13.0_dbg_msan/sql/sql_parse.cc:5397:10
#2 0x555557af85f1 in sp_instr_stmt::exec_core(THD, unsigned int) /test/13.0_dbg_msan/sql/sp_instr.cc:1281:12
#3 0x555557af0de0 in sp_lex_keeper::reset_lex_and_exec_core(THD, unsigned int, bool, sp_instr*, bool) /test/13.0_dbg_msan/sql/sp_instr.cc:420:17
#4 0x555557af243b in sp_lex_keeper::validate_lex_and_exec_core(THD, unsigned int, bool, sp_lex_instr*) /test/13.0_dbg_msan/sql/sp_instr.cc:599:14
#5 0x555557af6b68 in sp_instr_stmt::execute(THD, unsigned int) /test/13.0_dbg_msan/sql/sp_instr.cc:1183:25
#6 0x555556f54366 in sp_head::execute(THD*, bool) /test/13.0_dbg_msan/sql/sp_head.cc:1332:20
#7 0x555556f5961c in sp_head::execute_procedure(THD, List<Item>) /test/13.0_dbg_msan/sql/sp_head.cc:2369:5
#8 0x5555573942b0 in do_execute_sp(THD, sp_head) /test/13.0_dbg_msan/sql/sql_parse.cc:3084:16
#9 0x555557393743 in Sql_cmd_call::execute(THD*) /test/13.0_dbg_msan/sql/sql_parse.cc:3322:9
#10 0x555557397a6f in mysql_execute_command(THD*, bool) /test/13.0_dbg_msan/sql/sql_parse.cc:5905:26
#11 0x55555738bc82 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/13.0_dbg_msan/sql/sql_parse.cc:7945:18
#12 0x555557385467 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/13.0_dbg_msan/sql/sql_parse.cc:1903:7
#13 0x55555738c73e in do_command(THD*, bool) /test/13.0_dbg_msan/sql/sql_parse.cc:1437:17
#14 0x5555578ad43c in do_handle_one_connection(CONNECT*, bool) /test/13.0_dbg_msan/sql/sql_connect.cc:1510:11
#15 0x5555578acdd2 in handle_one_connection /test/13.0_dbg_msan/sql/sql_connect.cc:1422:5
#16 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
#17 0x7fffe6929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Uninitialized value was stored to memory at
#0 0x555557957656 in reload_acl_and_cache(THD, unsigned long long, TABLE_LIST, int*) /test/13.0_dbg_msan/sql/sql_reload.cc:413:46

Memory was marked as uninitialized
#0 0x55555675fd41 in __msan_allocated_memory (/test/MSAN_MD070726-mariadb-13.0.2-linux-x86_64-dbg/bin/mariadbd+0x120bd41) (BuildId: 773dbaeefa0b5ff2ade9bf2f687a75dc5cee9c33)
#1 0x555558a1a911 in my_malloc /test/13.0_dbg_msan/mysys/my_malloc.c:117:7

SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/13.0_dbg_msan/sql/sql_reload.cc:413:9 in reload_acl_and_cache(THD, unsigned long long, TABLE_LIST, int*)

Setup:

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:

    -DWITH_MSAN=ON  # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)

Set before execution:

    export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0

MSAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 070726 736edbe77ce5db44ea38347280f77d6a304fa3ae MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
CS 10.6 opt 070726 736edbe77ce5db44ea38347280f77d6a304fa3ae MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
CS 10.11 dbg 070726 2be9ba2537aa3ff5836b21489cfca6b0f0ccf80a MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
CS 10.11 opt 070726 2be9ba2537aa3ff5836b21489cfca6b0f0ccf80a MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
CS 11.4 dbg 090726 176589bf19ea6e2261bb3ef57886c13b9c0b6759 MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
CS 11.4 opt 090726 176589bf19ea6e2261bb3ef57886c13b9c0b6759 MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
CS 11.8 dbg 070726 666b2aca09cb84d59b4ece2185a9200d745cb287 MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
CS 11.8 opt 070726 666b2aca09cb84d59b4ece2185a9200d745cb287 MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
CS 12.3 dbg 070726 8da34620ac3935814cc7f9ba30bb51a6e2070237 MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
CS 12.3 opt 070726 8da34620ac3935814cc7f9ba30bb51a6e2070237 MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
CS 13.0 dbg 070726 172609526b93ac278203607274b70e6b6d8e67fd MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
CS 13.0 opt 070726 172609526b93ac278203607274b70e6b6d8e67fd MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
CS 13.1 dbg 070726 fd8cec54af7a9d79749df25ea70dac695b371641 MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
CS 13.1 opt 070726 fd8cec54af7a9d79749df25ea70dac695b371641 MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
ES 10.6 dbg 070726 07b87fa33b7263c3b46b1a820474f88803d25a04 MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
ES 10.6 opt 070726 07b87fa33b7263c3b46b1a820474f88803d25a04 MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
ES 11.4 dbg 070726 89bb238190d313ead3b68e508099974e3728515e MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
ES 11.4 opt 070726 89bb238190d313ead3b68e508099974e3728515e MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
ES 11.8 dbg 070726 97386db1d887891fb17e5210536bfe8756bae3cf MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
ES 11.8 opt 070726 97386db1d887891fb17e5210536bfe8756bae3cf MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
ES 12.3 dbg 070726 b96de078339ebc1995fd6185bf5433c72fedbdaf MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core
ES 12.3 opt 070726 b96de078339ebc1995fd6185bf5433c72fedbdaf MSAN\|use-of-uninitialized-value\|sql/sql_reload.cc\|reload_acl_and_cache\|mysql_execute_command\|sp_instr_stmt::exec_core\|sp_lex_keeper::reset_lex_and_exec_core

use-of-uninitialized-value in reload_acl_and_cache(THD, unsigned long long, TABLE_LIST, int*)

Details

Description

Attachments

Activity

People

Dates

Time Tracking

Git Integration