Details
-
Bug
-
Status: Open (View Workflow)
-
Critical
-
Resolution: Unresolved
-
10.6, 10.11, 11.4, 11.8, 12.3, 13.0, 13.1
-
Can result in hang or crash
Description
# mysqld options required for replay: --key-buffer-size=12 |
SHOW STATUS;
|
Leads to:
|
CS 13.0.2 84c246ca5387c0611f75097136ff4f4bea092aa3 (Optimized, MSAN, Clang 20.1.8-20250804) Build 16/07/2026 |
==3811442==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x5bd76abc43de in get_one_variable(THD*, st_mysql_show_var const*, enum_var_type, enum_mysql_show_type, system_status_var*, charset_info_st const**, char*, unsigned long*) /test/13.0_opt_msan/sql/sql_show.cc:3913:10
|
#1 0x5bd76abe438c in show_status_array(THD*, char const*, st_mysql_show_var*, enum_var_type, system_status_var*, st_mysql_const_lex_string const&, TABLE*, bool, Item*) /test/13.0_opt_msan/sql/sql_show.cc:4118:14
|
#2 0x5bd76abe3f39 in show_status_array(THD*, char const*, st_mysql_show_var*, enum_var_type, system_status_var*, st_mysql_const_lex_string const&, TABLE*, bool, Item*) /test/13.0_opt_msan/sql/sql_show.cc:4098:7
|
#3 0x5bd76abe610d in fill_status(THD*, TABLE_LIST*, Item*) /test/13.0_opt_msan/sql/sql_show.cc:8937:8
|
#4 0x5bd76abebddc in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/13.0_opt_msan/sql/sql_show.cc:9941:11
|
#5 0x5bd76aadbc7e in JOIN::exec_inner() /test/13.0_opt_msan/sql/sql_select.cc:5086:7
|
#6 0x5bd76aa6e958 in JOIN::exec() /test/13.0_opt_msan/sql/sql_select.cc:4913:8
|
#7 0x5bd76aa6e958 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.0_opt_msan/sql/sql_select.cc:5439:21
|
#8 0x5bd76aa6de8b in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.0_opt_msan/sql/sql_select.cc:636:10
|
#9 0x5bd76a9ba361 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.0_opt_msan/sql/sql_parse.cc:6217:12
|
#10 0x5bd76a9b8738 in execute_show_status(THD*, TABLE_LIST*) /test/13.0_opt_msan/sql/sql_parse.cc:6267:10
|
#11 0x5bd76a9ad988 in mysql_execute_command(THD*, bool) /test/13.0_opt_msan/sql/sql_parse.cc:3909:5
|
#12 0x5bd76a9a2cef in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.0_opt_msan/sql/sql_parse.cc:7945:18
|
#13 0x5bd76a99c745 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.0_opt_msan/sql/sql_parse.cc:1903:7
|
#14 0x5bd76a9a37b4 in do_command(THD*, bool) /test/13.0_opt_msan/sql/sql_parse.cc:1437:17
|
#15 0x5bd76ae5e0ec in do_handle_one_connection(CONNECT*, bool) /test/13.0_opt_msan/sql/sql_connect.cc:1510:11
|
#16 0x5bd76ae5da6e in handle_one_connection /test/13.0_opt_msan/sql/sql_connect.cc:1422:5
|
#17 0x7f6446a9caa3 in start_thread nptl/pthread_create.c:447:8
|
#18 0x7f6446b29c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Uninitialized value was stored to memory at
|
#0 0x5bd76bc379ca in get_simple_key_cache_statistics /test/13.0_opt_msan/mysys/mf_keycache.c:4919:30
|
#1 0x5bd76bc32995 in get_key_cache_statistics /test/13.0_opt_msan/mysys/mf_keycache.c:6501:5
|
#2 0x5bd769f31ad5 in show_default_keycache(THD*, st_mysql_show_var*, void*, system_status_var*, enum_var_type) /test/13.0_opt_msan/sql/mysqld.cc:7722:3
|
#3 0x5bd76abe3e40 in show_status_array(THD*, char const*, st_mysql_show_var*, enum_var_type, system_status_var*, st_mysql_const_lex_string const&, TABLE*, bool, Item*) /test/13.0_opt_msan/sql/sql_show.cc:4092:7
|
#4 0x5bd76abe610d in fill_status(THD*, TABLE_LIST*, Item*) /test/13.0_opt_msan/sql/sql_show.cc:8937:8
|
#5 0x5bd76abebddc in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/13.0_opt_msan/sql/sql_show.cc:9941:11
|
#6 0x5bd76aadbc7e in JOIN::exec_inner() /test/13.0_opt_msan/sql/sql_select.cc:5086:7
|
#7 0x5bd76aa6e958 in JOIN::exec() /test/13.0_opt_msan/sql/sql_select.cc:4913:8
|
#8 0x5bd76aa6e958 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.0_opt_msan/sql/sql_select.cc:5439:21
|
#9 0x5bd76aa6de8b in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.0_opt_msan/sql/sql_select.cc:636:10
|
#10 0x5bd76a9ba361 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.0_opt_msan/sql/sql_parse.cc:6217:12
|
#11 0x5bd76a9b8738 in execute_show_status(THD*, TABLE_LIST*) /test/13.0_opt_msan/sql/sql_parse.cc:6267:10
|
#12 0x5bd76a9ad988 in mysql_execute_command(THD*, bool) /test/13.0_opt_msan/sql/sql_parse.cc:3909:5
|
#13 0x5bd76a9a2cef in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.0_opt_msan/sql/sql_parse.cc:7945:18
|
#14 0x5bd76a99c745 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.0_opt_msan/sql/sql_parse.cc:1903:7
|
#15 0x5bd76a9a37b4 in do_command(THD*, bool) /test/13.0_opt_msan/sql/sql_parse.cc:1437:17
|
#16 0x5bd76ae5e0ec in do_handle_one_connection(CONNECT*, bool) /test/13.0_opt_msan/sql/sql_connect.cc:1510:11
|
#17 0x5bd76ae5da6e in handle_one_connection /test/13.0_opt_msan/sql/sql_connect.cc:1422:5
|
#18 0x7f6446a9caa3 in start_thread nptl/pthread_create.c:447:8
|
|
|
Memory was marked as uninitialized
|
#0 0x5bd769ebc971 in __msan_allocated_memory (/test/MSAN_MD160726-mariadb-13.0.2-linux-x86_64-opt/bin/mariadbd+0xf73971) (BuildId: bffcb5410278badf5fded9e3bc1088973a52dc60)
|
#1 0x5bd76bc7685e in my_malloc /test/13.0_opt_msan/mysys/my_malloc.c:117:7
|
#2 0x5bd76bc31953 in init_key_cache_internal /test/13.0_opt_msan/mysys/mf_keycache.c:5942:36
|
#3 0x5bd76bc316de in init_key_cache /test/13.0_opt_msan/mysys/mf_keycache.c:6038:10
|
#4 0x5bd769fc25d5 in ha_init_key_cache /test/13.0_opt_msan/sql/handler.cc:6868:5
|
#5 0x5bd76a47d5bd in process_key_caches(int (*)(char const*, st_key_cache*, void*), void*) /test/13.0_opt_msan/sql/keycaches.cc:186:12
|
#6 0x5bd769f2942b in init_server_components() /test/13.0_opt_msan/sql/mysqld.cc:5428:3
|
#7 0x5bd769f20e12 in mysqld_main(int, char**) /test/13.0_opt_msan/sql/mysqld.cc:6258:7
|
#8 0x7f6446a2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
|
#9 0x7f6446a2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
|
#10 0x5bd769e7e1a4 in _start (/test/MSAN_MD160726-mariadb-13.0.2-linux-x86_64-opt/bin/mariadbd+0xf351a4) (BuildId: bffcb5410278badf5fded9e3bc1088973a52dc60)
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/13.0_opt_msan/sql/sql_show.cc:3913:10 in get_one_variable(THD*, st_mysql_show_var const*, enum_var_type, enum_mysql_show_type, system_status_var*, charset_info_st const**, char*, unsigned long*)
|
|
CS 13.0.2 84c246ca5387c0611f75097136ff4f4bea092aa3 (Debug, MSAN, Clang 20.1.8-20250804) Build 16/07/2026 |
==3811374==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x5555575e3a80 in get_one_variable(THD*, st_mysql_show_var const*, enum_var_type, enum_mysql_show_type, system_status_var*, charset_info_st const**, char*, unsigned long*) /test/13.0_dbg_msan/sql/sql_show.cc:3913:10
|
#1 0x555557605412 in show_status_array(THD*, char const*, st_mysql_show_var*, enum_var_type, system_status_var*, st_mysql_const_lex_string const&, TABLE*, bool, Item*) /test/13.0_dbg_msan/sql/sql_show.cc:4118:14
|
#2 0x555557604f48 in show_status_array(THD*, char const*, st_mysql_show_var*, enum_var_type, system_status_var*, st_mysql_const_lex_string const&, TABLE*, bool, Item*) /test/13.0_dbg_msan/sql/sql_show.cc:4098:7
|
#3 0x5555576066cd in fill_status(THD*, TABLE_LIST*, Item*) /test/13.0_dbg_msan/sql/sql_show.cc:8937:8
|
#4 0x55555760c3b9 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/13.0_dbg_msan/sql/sql_show.cc:9941:11
|
#5 0x5555574e851f in JOIN::exec_inner() /test/13.0_dbg_msan/sql/sql_select.cc:5086:7
|
#6 0x5555574e67c3 in JOIN::exec() /test/13.0_dbg_msan/sql/sql_select.cc:4913:8
|
#7 0x55555747097a in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.0_dbg_msan/sql/sql_select.cc:5439:21
|
#8 0x55555746ff4c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.0_dbg_msan/sql/sql_select.cc:636:10
|
#9 0x5555573a7071 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.0_dbg_msan/sql/sql_parse.cc:6217:12
|
#10 0x5555573a5403 in execute_show_status(THD*, TABLE_LIST*) /test/13.0_dbg_msan/sql/sql_parse.cc:6267:10
|
#11 0x555557398523 in mysql_execute_command(THD*, bool) /test/13.0_dbg_msan/sql/sql_parse.cc:3909:5
|
#12 0x55555738bc82 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.0_dbg_msan/sql/sql_parse.cc:7945:18
|
#13 0x555557385467 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.0_dbg_msan/sql/sql_parse.cc:1903:7
|
#14 0x55555738c73e in do_command(THD*, bool) /test/13.0_dbg_msan/sql/sql_parse.cc:1437:17
|
#15 0x5555578ad43c in do_handle_one_connection(CONNECT*, bool) /test/13.0_dbg_msan/sql/sql_connect.cc:1510:11
|
#16 0x5555578acdd2 in handle_one_connection /test/13.0_dbg_msan/sql/sql_connect.cc:1422:5
|
#17 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
|
#18 0x7fffe6929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Uninitialized value was stored to memory at
|
#0 0x5555589e337f in get_simple_key_cache_statistics /test/13.0_dbg_msan/mysys/mf_keycache.c:4919:30
|
|
|
Memory was marked as uninitialized
|
#0 0x55555675fd41 in __msan_allocated_memory (/test/MSAN_MD160726-mariadb-13.0.2-linux-x86_64-dbg/bin/mariadbd+0x120bd41) (BuildId: cbd247a7c6c29113b29ae49befea3721a8d8acf5)
|
#1 0x555558a1a911 in my_malloc /test/13.0_dbg_msan/mysys/my_malloc.c:117:7
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/13.0_dbg_msan/sql/sql_show.cc:3913:10 in get_one_variable(THD*, st_mysql_show_var const*, enum_var_type, enum_mysql_show_type, system_status_var*, charset_info_st const**, char*, unsigned long*)
|
Setup:
Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O2 -march=native -mtune=native'" and:
|
-DWITH_MSAN=ON # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)
|
Set before execution:
|
export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0
|
|
MSAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 170726 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
CS 10.6 opt 170726 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
CS 10.11 dbg 170726 50faece416f0642b57a515d546f20cefd9062379 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
CS 10.11 opt 170726 50faece416f0642b57a515d546f20cefd9062379 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
CS 11.4 dbg 200726 17fe060a549d2bfa56f6efb82456b20146ac569f MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
CS 11.4 opt 200726 17fe060a549d2bfa56f6efb82456b20146ac569f MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
CS 11.8 dbg 170726 bf58d4cb5fccd4078ec91c065a2de86be3b46281 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
CS 11.8 opt 170726 bf58d4cb5fccd4078ec91c065a2de86be3b46281 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
CS 12.3 dbg 160726 f9d797f1ccb8bbdbad0b50005644f29cd6125a6c MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
CS 12.3 opt 160726 f9d797f1ccb8bbdbad0b50005644f29cd6125a6c MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
CS 13.0 dbg 160726 84c246ca5387c0611f75097136ff4f4bea092aa3 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
CS 13.0 opt 160726 84c246ca5387c0611f75097136ff4f4bea092aa3 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
CS 13.1 dbg 160726 7322a6656a5357b4574b7413493c76ba2fc41f84 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
CS 13.1 opt 160726 7322a6656a5357b4574b7413493c76ba2fc41f84 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
ES 10.6 dbg 170726 fcecb2620f25965723d640decede7c018bcb1dcc MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
ES 10.6 opt 170726 fcecb2620f25965723d640decede7c018bcb1dcc MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
ES 11.4 dbg 170726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
ES 11.4 opt 170726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
ES 11.8 dbg 170726 4694e931d10fecf733c34f83ea2146d31b708eb3 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
ES 11.8 opt 170726 4694e931d10fecf733c34f83ea2146d31b708eb3 MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
ES 12.3 dbg 160726 9d8abb61e913bec023cd8caeccad4b42717151cb MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
ES 12.3 opt 160726 9d8abb61e913bec023cd8caeccad4b42717151cb MSAN|use-of-uninitialized-value|sql/sql_show.cc|get_one_variable|show_status_array|show_status_array|fill_status
|
