[MDEV-40528] use-of-uninitialized-value in handle_grant_table on DROP USER - Jira

XML

Word

Printable

Details

Type: Bug
Status: Open (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.6
Fix Version/s: 10.6
Component/s: Authentication and Privilege System, Server
Labels:
- MSAN
- use-of-uninitialized-value

Bug Category:
Can result in hang or crash

Description

CREATE OR REPLACE TABLE mysql.procs_priv (a INT);

INSERT INTO mysql.procs_priv VALUES ();

DROP USER u0;

Leads to:

CS 10.6.28 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 (Optimized, MSAN, Clang 20.1.8-20250804) Build 17/07/2026
==940993==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x5ffa276251b9 in handle_grant_table(THD, Grant_table_base const&, enum_acl_tables, bool, LEX_USER, LEX_USER*) /test/10.6_opt_msan/sql/sql_acl.cc:10375:24
#1 0x5ffa27601739 in handle_grant_data(THD, Grant_tables&, bool, LEX_USER, LEX_USER*) /test/10.6_opt_msan/sql/sql_acl.cc:10848:15
#2 0x5ffa276024d7 in mysql_drop_user(THD*, List<LEX_USER>&, bool) /test/10.6_opt_msan/sql/sql_acl.cc:11224:14
#3 0x5ffa27903481 in mysql_execute_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:5507:16
#4 0x5ffa278f8d95 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/10.6_opt_msan/sql/sql_parse.cc:8199:18
#5 0x5ffa278f2e4b in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1911:7
#6 0x5ffa278f9988 in do_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1421:17
#7 0x5ffa27d92b0c in do_handle_one_connection(CONNECT*, bool) /test/10.6_opt_msan/sql/sql_connect.cc:1393:11
#8 0x5ffa27d92432 in handle_one_connection /test/10.6_opt_msan/sql/sql_connect.cc:1305:5
#9 0x77e3e3a9caa3 in start_thread nptl/pthread_create.c:447:8
#10 0x77e3e3b29c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Uninitialized value was stored to memory at
#0 0x5ffa276251b2 in handle_grant_table(THD, Grant_table_base const&, enum_acl_tables, bool, LEX_USER, LEX_USER*) /test/10.6_opt_msan/sql/sql_acl.cc:10287:22
#1 0x5ffa27601739 in handle_grant_data(THD, Grant_tables&, bool, LEX_USER, LEX_USER*) /test/10.6_opt_msan/sql/sql_acl.cc:10848:15
#2 0x5ffa276024d7 in mysql_drop_user(THD*, List<LEX_USER>&, bool) /test/10.6_opt_msan/sql/sql_acl.cc:11224:14
#3 0x5ffa27903481 in mysql_execute_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:5507:16
#4 0x5ffa278f8d95 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/10.6_opt_msan/sql/sql_parse.cc:8199:18
#5 0x5ffa278f2e4b in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1911:7
#6 0x5ffa278f9988 in do_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1421:17
#7 0x5ffa27d92b0c in do_handle_one_connection(CONNECT*, bool) /test/10.6_opt_msan/sql/sql_connect.cc:1393:11
#8 0x5ffa27d92432 in handle_one_connection /test/10.6_opt_msan/sql/sql_connect.cc:1305:5
#9 0x77e3e3a9caa3 in start_thread nptl/pthread_create.c:447:8

Uninitialized value was created by a heap allocation
#0 0x5ffa26f11dd6 in malloc (/test/MSAN_MD170726-mariadb-10.6.28-linux-x86_64-opt/bin/mariadbd+0xcf4dd6) (BuildId: c54cd201b0905cfceb6742c33d28a95089229adb)
#1 0x5ffa28b7dc32 in my_malloc /test/10.6_opt_msan/mysys/my_malloc.c:91:29
#2 0x5ffa28b5f75a in alloc_root /test/10.6_opt_msan/mysys/my_alloc.c:196:28
#3 0x5ffa26fdf021 in handler::ha_open(TABLE, char const, int, unsigned int, st_mem_root, List<String>) /test/10.6_opt_msan/sql/handler.cc:3537:25
#4 0x5ffa27ca8ebd in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /test/10.6_opt_msan/sql/table.cc:4499:33
#5 0x5ffa27648fea in open_table(THD, TABLE_LIST, Open_table_context*) /test/10.6_opt_msan/sql/sql_base.cc:2129:12
#6 0x5ffa27650d7b in open_and_process_table(THD, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy, bool, Open_table_context*) /test/10.6_opt_msan/sql/sql_base.cc:3943:14
#7 0x5ffa27650d7b in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /test/10.6_opt_msan/sql/sql_base.cc:4427:14
#8 0x5ffa27658569 in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /test/10.6_opt_msan/sql/sql_base.cc:5432:7
#9 0x5ffa2782f86d in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /test/10.6_opt_msan/sql/sql_base.h:517:10
#10 0x5ffa2782f86d in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.6_opt_msan/sql/sql_insert.cc:765:9
#11 0x5ffa27908cab in mysql_execute_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:4633:10
#12 0x5ffa278f8d95 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/10.6_opt_msan/sql/sql_parse.cc:8199:18
#13 0x5ffa278f2e4b in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1911:7
#14 0x5ffa278f9988 in do_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1421:17
#15 0x5ffa27d92b0c in do_handle_one_connection(CONNECT*, bool) /test/10.6_opt_msan/sql/sql_connect.cc:1393:11
#16 0x5ffa27d92432 in handle_one_connection /test/10.6_opt_msan/sql/sql_connect.cc:1305:5
#17 0x77e3e3a9caa3 in start_thread nptl/pthread_create.c:447:8

SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/10.6_opt_msan/sql/sql_acl.cc:10375:24 in handle_grant_table(THD, Grant_table_base const&, enum_acl_tables, bool, LEX_USER, LEX_USER*)

CS 10.6.28 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 (Debug, MSAN, Clang 20.1.8-20250804) Build 17/07/2026
==940957==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x555556b671c9 in handle_grant_table(THD, Grant_table_base const&, enum_acl_tables, bool, LEX_USER, LEX_USER*) /test/10.6_dbg_msan/sql/sql_acl.cc:10375:24
#1 0x555556b442f8 in handle_grant_data(THD, Grant_tables&, bool, LEX_USER, LEX_USER*) /test/10.6_dbg_msan/sql/sql_acl.cc:10848:15
#2 0x555556b45392 in mysql_drop_user(THD*, List<LEX_USER>&, bool) /test/10.6_dbg_msan/sql/sql_acl.cc:11224:14
#3 0x555556e6c2d9 in mysql_execute_command(THD*, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:5507:16
#4 0x555556e602c8 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/10.6_dbg_msan/sql/sql_parse.cc:8199:18
#5 0x555556e59cee in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:1911:7
#6 0x555556e60dd4 in do_command(THD*, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:1421:17
#7 0x5555573321ec in do_handle_one_connection(CONNECT*, bool) /test/10.6_dbg_msan/sql/sql_connect.cc:1393:11
#8 0x555557331af9 in handle_one_connection /test/10.6_dbg_msan/sql/sql_connect.cc:1305:5
#9 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
#10 0x7fffe6929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Uninitialized value was created by a heap allocation
#0 0x5555563aa006 in malloc (/test/MSAN_MD170726-mariadb-10.6.28-linux-x86_64-dbg/bin/mariadbd+0xe56006) (BuildId: 4011ad30767736203cf12c5ae5c14a6940a07c5f)
#1 0x55555836b53c in my_malloc /test/10.6_dbg_msan/mysys/my_malloc.c:91:29
#2 0x55555834801c in alloc_root /test/10.6_dbg_msan/mysys/my_alloc.c:196:28
#3 0x555558348752 in multi_alloc_root /test/10.6_dbg_msan/mysys/my_alloc.c:332:24
#4 0x5555572375e7 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /test/10.6_dbg_msan/sql/table.cc:4284:8
#5 0x555556b8b944 in open_table(THD, TABLE_LIST, Open_table_context*) /test/10.6_dbg_msan/sql/sql_base.cc:2129:12
#6 0x555556b947a9 in open_and_process_table(THD, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy, bool, Open_table_context*) /test/10.6_dbg_msan/sql/sql_base.cc:3943:14
#7 0x555556b947a9 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /test/10.6_dbg_msan/sql/sql_base.cc:4427:14
#8 0x555556b9c85c in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /test/10.6_dbg_msan/sql/sql_base.cc:5432:7
#9 0x555556d93fe5 in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /test/10.6_dbg_msan/sql/sql_base.h:517:10
#10 0x555556d93fe5 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.6_dbg_msan/sql/sql_insert.cc:765:9
#11 0x555556e7420e in mysql_execute_command(THD*, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:4633:10
#12 0x555556e602c8 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/10.6_dbg_msan/sql/sql_parse.cc:8199:18
#13 0x555556e59cee in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:1911:7
#14 0x555556e60dd4 in do_command(THD*, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:1421:17
#15 0x5555573321ec in do_handle_one_connection(CONNECT*, bool) /test/10.6_dbg_msan/sql/sql_connect.cc:1393:11
#16 0x555557331af9 in handle_one_connection /test/10.6_dbg_msan/sql/sql_connect.cc:1305:5
#17 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8

SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/10.6_dbg_msan/sql/sql_acl.cc:10375:24 in handle_grant_table(THD, Grant_table_base const&, enum_acl_tables, bool, LEX_USER, LEX_USER*)

Setup:

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O2 -march=native -mtune=native'" and:

    -DWITH_MSAN=ON  # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)

Set before execution:

    export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0

MSAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 170726 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 MSAN\|use-of-uninitialized-value\|sql/sql_acl.cc\|handle_grant_table\|handle_grant_data\|mysql_drop_user\|mysql_execute_command
CS 10.6 opt 170726 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 MSAN\|use-of-uninitialized-value\|sql/sql_acl.cc\|handle_grant_table\|handle_grant_data\|mysql_drop_user\|mysql_execute_command
CS 10.11 dbg 170726 50faece416f0642b57a515d546f20cefd9062379 MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
CS 10.11 opt 170726 50faece416f0642b57a515d546f20cefd9062379 MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
CS 11.4 dbg 200726 17fe060a549d2bfa56f6efb82456b20146ac569f MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
CS 11.4 opt 200726 17fe060a549d2bfa56f6efb82456b20146ac569f MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
CS 11.8 dbg 170726 bf58d4cb5fccd4078ec91c065a2de86be3b46281 MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
CS 11.8 opt 170726 bf58d4cb5fccd4078ec91c065a2de86be3b46281 MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
CS 12.3 dbg 160726 f9d797f1ccb8bbdbad0b50005644f29cd6125a6c MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
CS 12.3 opt 160726 f9d797f1ccb8bbdbad0b50005644f29cd6125a6c MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
CS 13.0 dbg 160726 84c246ca5387c0611f75097136ff4f4bea092aa3 MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
CS 13.0 opt 160726 84c246ca5387c0611f75097136ff4f4bea092aa3 MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
CS 13.1 dbg 160726 7322a6656a5357b4574b7413493c76ba2fc41f84 MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
CS 13.1 opt 160726 7322a6656a5357b4574b7413493c76ba2fc41f84 MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
ES 10.6 dbg 170726 fcecb2620f25965723d640decede7c018bcb1dcc MSAN\|use-of-uninitialized-value\|sql/sql_acl.cc\|handle_grant_table\|handle_grant_data\|mysql_drop_user\|mysql_execute_command
ES 10.6 opt 170726 fcecb2620f25965723d640decede7c018bcb1dcc MSAN\|use-of-uninitialized-value\|sql/sql_acl.cc\|handle_grant_table\|handle_grant_data\|mysql_drop_user\|mysql_execute_command
ES 11.4 dbg 170726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
ES 11.4 opt 170726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
ES 11.8 dbg 170726 4694e931d10fecf733c34f83ea2146d31b708eb3 MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
ES 11.8 opt 170726 4694e931d10fecf733c34f83ea2146d31b708eb3 MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
ES 12.3 dbg 160726 9d8abb61e913bec023cd8caeccad4b42717151cb MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted
ES 12.3 opt 160726 9d8abb61e913bec023cd8caeccad4b42717151cb MARIADBD_ERROR\|mariadbd: Cannot load from mysql.procs_priv. The table is probably corrupted

Attachments

Activity

People

Assignee:: Sergei Golubchik

Reporter:: Saahil Alam

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2026-07-27 07:15

Updated:: 2026-07-30 02:47

Time Tracking

Estimated:

Not Specified

Remaining:

Logged:

1.7h

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.