Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.6
-
Can result in hang or crash
Description
CREATE OR REPLACE TABLE mysql.procs_priv (a INT); |
INSERT INTO mysql.procs_priv VALUES (); |
DROP USER u0; |
Leads to:
|
CS 10.6.28 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 (Optimized, MSAN, Clang 20.1.8-20250804) Build 17/07/2026 |
==940993==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x5ffa276251b9 in handle_grant_table(THD*, Grant_table_base const&, enum_acl_tables, bool, LEX_USER*, LEX_USER*) /test/10.6_opt_msan/sql/sql_acl.cc:10375:24
|
#1 0x5ffa27601739 in handle_grant_data(THD*, Grant_tables&, bool, LEX_USER*, LEX_USER*) /test/10.6_opt_msan/sql/sql_acl.cc:10848:15
|
#2 0x5ffa276024d7 in mysql_drop_user(THD*, List<LEX_USER>&, bool) /test/10.6_opt_msan/sql/sql_acl.cc:11224:14
|
#3 0x5ffa27903481 in mysql_execute_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:5507:16
|
#4 0x5ffa278f8d95 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6_opt_msan/sql/sql_parse.cc:8199:18
|
#5 0x5ffa278f2e4b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1911:7
|
#6 0x5ffa278f9988 in do_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1421:17
|
#7 0x5ffa27d92b0c in do_handle_one_connection(CONNECT*, bool) /test/10.6_opt_msan/sql/sql_connect.cc:1393:11
|
#8 0x5ffa27d92432 in handle_one_connection /test/10.6_opt_msan/sql/sql_connect.cc:1305:5
|
#9 0x77e3e3a9caa3 in start_thread nptl/pthread_create.c:447:8
|
#10 0x77e3e3b29c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Uninitialized value was stored to memory at
|
#0 0x5ffa276251b2 in handle_grant_table(THD*, Grant_table_base const&, enum_acl_tables, bool, LEX_USER*, LEX_USER*) /test/10.6_opt_msan/sql/sql_acl.cc:10287:22
|
#1 0x5ffa27601739 in handle_grant_data(THD*, Grant_tables&, bool, LEX_USER*, LEX_USER*) /test/10.6_opt_msan/sql/sql_acl.cc:10848:15
|
#2 0x5ffa276024d7 in mysql_drop_user(THD*, List<LEX_USER>&, bool) /test/10.6_opt_msan/sql/sql_acl.cc:11224:14
|
#3 0x5ffa27903481 in mysql_execute_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:5507:16
|
#4 0x5ffa278f8d95 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6_opt_msan/sql/sql_parse.cc:8199:18
|
#5 0x5ffa278f2e4b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1911:7
|
#6 0x5ffa278f9988 in do_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1421:17
|
#7 0x5ffa27d92b0c in do_handle_one_connection(CONNECT*, bool) /test/10.6_opt_msan/sql/sql_connect.cc:1393:11
|
#8 0x5ffa27d92432 in handle_one_connection /test/10.6_opt_msan/sql/sql_connect.cc:1305:5
|
#9 0x77e3e3a9caa3 in start_thread nptl/pthread_create.c:447:8
|
|
|
Uninitialized value was created by a heap allocation
|
#0 0x5ffa26f11dd6 in malloc (/test/MSAN_MD170726-mariadb-10.6.28-linux-x86_64-opt/bin/mariadbd+0xcf4dd6) (BuildId: c54cd201b0905cfceb6742c33d28a95089229adb)
|
#1 0x5ffa28b7dc32 in my_malloc /test/10.6_opt_msan/mysys/my_malloc.c:91:29
|
#2 0x5ffa28b5f75a in alloc_root /test/10.6_opt_msan/mysys/my_alloc.c:196:28
|
#3 0x5ffa26fdf021 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/10.6_opt_msan/sql/handler.cc:3537:25
|
#4 0x5ffa27ca8ebd in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/10.6_opt_msan/sql/table.cc:4499:33
|
#5 0x5ffa27648fea in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/10.6_opt_msan/sql/sql_base.cc:2129:12
|
#6 0x5ffa27650d7b in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /test/10.6_opt_msan/sql/sql_base.cc:3943:14
|
#7 0x5ffa27650d7b in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/10.6_opt_msan/sql/sql_base.cc:4427:14
|
#8 0x5ffa27658569 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/10.6_opt_msan/sql/sql_base.cc:5432:7
|
#9 0x5ffa2782f86d in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/10.6_opt_msan/sql/sql_base.h:517:10
|
#10 0x5ffa2782f86d in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.6_opt_msan/sql/sql_insert.cc:765:9
|
#11 0x5ffa27908cab in mysql_execute_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:4633:10
|
#12 0x5ffa278f8d95 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6_opt_msan/sql/sql_parse.cc:8199:18
|
#13 0x5ffa278f2e4b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1911:7
|
#14 0x5ffa278f9988 in do_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1421:17
|
#15 0x5ffa27d92b0c in do_handle_one_connection(CONNECT*, bool) /test/10.6_opt_msan/sql/sql_connect.cc:1393:11
|
#16 0x5ffa27d92432 in handle_one_connection /test/10.6_opt_msan/sql/sql_connect.cc:1305:5
|
#17 0x77e3e3a9caa3 in start_thread nptl/pthread_create.c:447:8
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/10.6_opt_msan/sql/sql_acl.cc:10375:24 in handle_grant_table(THD*, Grant_table_base const&, enum_acl_tables, bool, LEX_USER*, LEX_USER*)
|
|
CS 10.6.28 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 (Debug, MSAN, Clang 20.1.8-20250804) Build 17/07/2026 |
==940957==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x555556b671c9 in handle_grant_table(THD*, Grant_table_base const&, enum_acl_tables, bool, LEX_USER*, LEX_USER*) /test/10.6_dbg_msan/sql/sql_acl.cc:10375:24
|
#1 0x555556b442f8 in handle_grant_data(THD*, Grant_tables&, bool, LEX_USER*, LEX_USER*) /test/10.6_dbg_msan/sql/sql_acl.cc:10848:15
|
#2 0x555556b45392 in mysql_drop_user(THD*, List<LEX_USER>&, bool) /test/10.6_dbg_msan/sql/sql_acl.cc:11224:14
|
#3 0x555556e6c2d9 in mysql_execute_command(THD*, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:5507:16
|
#4 0x555556e602c8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6_dbg_msan/sql/sql_parse.cc:8199:18
|
#5 0x555556e59cee in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:1911:7
|
#6 0x555556e60dd4 in do_command(THD*, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:1421:17
|
#7 0x5555573321ec in do_handle_one_connection(CONNECT*, bool) /test/10.6_dbg_msan/sql/sql_connect.cc:1393:11
|
#8 0x555557331af9 in handle_one_connection /test/10.6_dbg_msan/sql/sql_connect.cc:1305:5
|
#9 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
|
#10 0x7fffe6929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Uninitialized value was created by a heap allocation
|
#0 0x5555563aa006 in malloc (/test/MSAN_MD170726-mariadb-10.6.28-linux-x86_64-dbg/bin/mariadbd+0xe56006) (BuildId: 4011ad30767736203cf12c5ae5c14a6940a07c5f)
|
#1 0x55555836b53c in my_malloc /test/10.6_dbg_msan/mysys/my_malloc.c:91:29
|
#2 0x55555834801c in alloc_root /test/10.6_dbg_msan/mysys/my_alloc.c:196:28
|
#3 0x555558348752 in multi_alloc_root /test/10.6_dbg_msan/mysys/my_alloc.c:332:24
|
#4 0x5555572375e7 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/10.6_dbg_msan/sql/table.cc:4284:8
|
#5 0x555556b8b944 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/10.6_dbg_msan/sql/sql_base.cc:2129:12
|
#6 0x555556b947a9 in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /test/10.6_dbg_msan/sql/sql_base.cc:3943:14
|
#7 0x555556b947a9 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/10.6_dbg_msan/sql/sql_base.cc:4427:14
|
#8 0x555556b9c85c in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/10.6_dbg_msan/sql/sql_base.cc:5432:7
|
#9 0x555556d93fe5 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/10.6_dbg_msan/sql/sql_base.h:517:10
|
#10 0x555556d93fe5 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.6_dbg_msan/sql/sql_insert.cc:765:9
|
#11 0x555556e7420e in mysql_execute_command(THD*, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:4633:10
|
#12 0x555556e602c8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6_dbg_msan/sql/sql_parse.cc:8199:18
|
#13 0x555556e59cee in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:1911:7
|
#14 0x555556e60dd4 in do_command(THD*, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:1421:17
|
#15 0x5555573321ec in do_handle_one_connection(CONNECT*, bool) /test/10.6_dbg_msan/sql/sql_connect.cc:1393:11
|
#16 0x555557331af9 in handle_one_connection /test/10.6_dbg_msan/sql/sql_connect.cc:1305:5
|
#17 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/10.6_dbg_msan/sql/sql_acl.cc:10375:24 in handle_grant_table(THD*, Grant_table_base const&, enum_acl_tables, bool, LEX_USER*, LEX_USER*)
|
Setup:
Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O2 -march=native -mtune=native'" and:
|
-DWITH_MSAN=ON # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)
|
Set before execution:
|
export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0
|
|
MSAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 170726 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 MSAN|use-of-uninitialized-value|sql/sql_acl.cc|handle_grant_table|handle_grant_data|mysql_drop_user|mysql_execute_command
|
CS 10.6 opt 170726 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 MSAN|use-of-uninitialized-value|sql/sql_acl.cc|handle_grant_table|handle_grant_data|mysql_drop_user|mysql_execute_command
|
CS 10.11 dbg 170726 50faece416f0642b57a515d546f20cefd9062379 MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
CS 10.11 opt 170726 50faece416f0642b57a515d546f20cefd9062379 MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
CS 11.4 dbg 200726 17fe060a549d2bfa56f6efb82456b20146ac569f MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
CS 11.4 opt 200726 17fe060a549d2bfa56f6efb82456b20146ac569f MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
CS 11.8 dbg 170726 bf58d4cb5fccd4078ec91c065a2de86be3b46281 MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
CS 11.8 opt 170726 bf58d4cb5fccd4078ec91c065a2de86be3b46281 MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
CS 12.3 dbg 160726 f9d797f1ccb8bbdbad0b50005644f29cd6125a6c MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
CS 12.3 opt 160726 f9d797f1ccb8bbdbad0b50005644f29cd6125a6c MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
CS 13.0 dbg 160726 84c246ca5387c0611f75097136ff4f4bea092aa3 MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
CS 13.0 opt 160726 84c246ca5387c0611f75097136ff4f4bea092aa3 MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
CS 13.1 dbg 160726 7322a6656a5357b4574b7413493c76ba2fc41f84 MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
CS 13.1 opt 160726 7322a6656a5357b4574b7413493c76ba2fc41f84 MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
ES 10.6 dbg 170726 fcecb2620f25965723d640decede7c018bcb1dcc MSAN|use-of-uninitialized-value|sql/sql_acl.cc|handle_grant_table|handle_grant_data|mysql_drop_user|mysql_execute_command
|
ES 10.6 opt 170726 fcecb2620f25965723d640decede7c018bcb1dcc MSAN|use-of-uninitialized-value|sql/sql_acl.cc|handle_grant_table|handle_grant_data|mysql_drop_user|mysql_execute_command
|
ES 11.4 dbg 170726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
ES 11.4 opt 170726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
ES 11.8 dbg 170726 4694e931d10fecf733c34f83ea2146d31b708eb3 MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
ES 11.8 opt 170726 4694e931d10fecf733c34f83ea2146d31b708eb3 MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
ES 12.3 dbg 160726 9d8abb61e913bec023cd8caeccad4b42717151cb MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
ES 12.3 opt 160726 9d8abb61e913bec023cd8caeccad4b42717151cb MARIADBD_ERROR|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
|
