[MDEV-40734] use-of-uninitialized-value in create_index(trx_t*, TABLE const*, dict_table_t*, unsigned int) - Jira

Details

Type: Bug
Status: Open (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.6, 10.11, 11.4, 11.8, 12.3, 13.0, 13.1
Fix Version/s: 10.6, 10.11, 11.4, 11.8, 12.3, 13.0
Component/s: Storage Engine - InnoDB
Labels:
- MSAN
- use-of-uninitialized-value

Bug Category:
Can result in hang or crash

Description

  --source include/have_innodb.inc

  --source include/have_debug.inc

  --source include/have_debug_sync.inc

  --disable_query_log

  call mtr.add_suppression("InnoDB: Failed to create FTS index table");

  --enable_query_log

  CREATE TABLE t1 (f1 INT PRIMARY KEY, f2 TEXT) ENGINE=InnoDB;

  INSERT INTO t1 VALUES (1,'foo bar');

  SET @save_dbug= @@GLOBAL.debug_dbug;

  connect (con1,localhost,root,,test);

  # 7 tables are created: the copy of t1, the 5 FTS common tables, FTS INDEX_1

  SET DEBUG_SYNC='create_table SIGNAL parked WAIT_FOR go EXECUTE 7';

  --send ALTER TABLE t1 ADD FULLTEXT INDEX(f2), ALGORITHM=COPY

  connection default;

  # Let the copy of t1 and the 5 FTS common tables be created undisturbed.

  --disable_query_log

  --let $i= 6

  while ($i)

    SET DEBUG_SYNC='now WAIT_FOR parked';

    SET DEBUG_SYNC='now SIGNAL go';

    dec $i;

  --enable_query_log

  # Fail the creation of the first FTS auxiliary index table.

  SET DEBUG_SYNC='now WAIT_FOR parked';

  SET GLOBAL debug_dbug='+d,ib_create_table_fail_out_of_space_ids';

  SET DEBUG_SYNC='now SIGNAL go';

  connection con1;

  --disable_result_log

  --error 0,ER_CANT_CREATE_TABLE

  --reap

  --enable_result_log

  disconnect con1;

  connection default;

  SET GLOBAL debug_dbug= @save_dbug;

  SET DEBUG_SYNC=RESET;

  DROP TABLE t1;

Leads to:

ES 10.6.28-24 fcecb2620f25965723d640decede7c018bcb1dcc (Debug, MSAN, Clang 20.1.8-20250804) Build 01/08/2026
==3226882==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x59103c2204bd in create_index(trx_t, TABLE const, dict_table_t*, unsigned int) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/handler/ha_innodb.cc:10942:3
#1 0x59103c1e4e17 in create_table_info_t::create_table(bool) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/handler/ha_innodb.cc:12858:19
#2 0x59103c1e808b in ha_innobase::create(char const, TABLE, HA_CREATE_INFO, bool, trx_t) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/handler/ha_innodb.cc:13278:17
#3 0x59103acd1a90 in handler::ha_create(char const, TABLE, HA_CREATE_INFO*) /test/msan_slow_src/10.6-es_dbg_msan/sql/handler.cc:5676:14
#4 0x59103acd5d22 in ha_create_table(THD, char const, char const, char const, HA_CREATE_INFO, st_mysql_const_unsigned_lex_string, bool) /test/msan_slow_src/10.6-es_dbg_msan/sql/handler.cc:6151:22
#5 0x59103b9aeb5a in mysql_alter_table(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, HA_CREATE_INFO, TABLE_LIST, Recreate_info, Alter_info, unsigned int, st_order, bool, bool) /test/msan_slow_src/10.6-es_dbg_msan/sql/sql_table.cc:11129:7
#6 0x59103bb92803 in Sql_cmd_alter_table::execute(THD*) /test/msan_slow_src/10.6-es_dbg_msan/sql/sql_alter.cc:685:11
#7 0x59103b6a4ba1 in mysql_execute_command(THD*, bool) /test/msan_slow_src/10.6-es_dbg_msan/sql/sql_parse.cc:6174:26
#8 0x59103b6997e8 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/msan_slow_src/10.6-es_dbg_msan/sql/sql_parse.cc:8228:18
#9 0x59103b693207 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/msan_slow_src/10.6-es_dbg_msan/sql/sql_parse.cc:1918:7
#10 0x59103b69a2f4 in do_command(THD*, bool) /test/msan_slow_src/10.6-es_dbg_msan/sql/sql_parse.cc:1428:17
#11 0x59103bb7a0cc in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/10.6-es_dbg_msan/sql/sql_connect.cc:1393:11
#12 0x59103bb799d9 in handle_one_connection /test/msan_slow_src/10.6-es_dbg_msan/sql/sql_connect.cc:1305:5
#13 0x7ce06ec9cb83 in start_thread nptl/pthread_create.c:447:8
#14 0x7ce06ed29d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Uninitialized value was created by a heap deallocation
#0 0x59103abd1544 in free (/test/MSAN_EMD010826-mariadb-10.6.28-24-linux-x86_64-dbg/bin/mariadbd+0xe85544) (BuildId: 66d7b48f46018aa90d898d2aaba307644d63ef16)
#1 0x59103c4ac934 in mem_heap_free(mem_block_info_t*) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/include/mem0mem.inl:419:3
#2 0x59103c4ac934 in dict_mem_table_free(dict_table_t*) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/dict/dict0mem.cc:231:2
#3 0x59103c2aca5a in dict_sys_t::remove(dict_table_t*, bool, bool) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/dict/dict0dict.cc:1976:2
#4 0x59103c9ab8c0 in row_undo_ins_remove_clust_rec(undo_node_t*) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/row/row0uins.cc:160:15
#5 0x59103c9a8e7f in row_undo_ins(undo_node_t, que_thr_t) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/row/row0uins.cc:614:10
#6 0x59103c9a4f94 in row_undo(undo_node_t, que_thr_t) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/row/row0undo.cc:401:5
#7 0x59103c9a4f94 in row_undo_step(que_thr_t*) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/row/row0undo.cc:442:8
#8 0x59103c80adaf in que_thr_step(que_thr_t*) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/que/que0que.cc:551:9
#9 0x59103c80adaf in que_run_threads_low(que_thr_t*) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/que/que0que.cc:609:25
#10 0x59103c80adaf in que_run_threads(que_thr_t*) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/que/que0que.cc:629:2
#11 0x59103ca4f23b in trx_t::rollback_low(unsigned long const*) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/trx/trx0roll.cc:117:5
#12 0x59103c8e65da in row_create_table_for_mysql(dict_table_t, trx_t) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/row/row0mysql.cc:2092:8
#13 0x59103c25b4b0 in fts_create_one_index_table(trx_t, dict_index_t const, fts_table_t const, mem_block_info_t) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/fts/fts0fts.cc:2041:10
#14 0x59103c25b4b0 in fts_create_index_tables(trx_t, dict_index_t const, unsigned long) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/fts/fts0fts.cc:2101:15
#15 0x59103c8e7332 in row_create_index_for_mysql(dict_index_t, trx_t, unsigned long const*, fil_encryption_t, unsigned int) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/row/row0mysql.cc:2185:10
#16 0x59103c21fd20 in create_index(trx_t, TABLE const, dict_table_t*, unsigned int) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/handler/ha_innodb.cc:10942:3
#17 0x59103c1e4e17 in create_table_info_t::create_table(bool) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/handler/ha_innodb.cc:12858:19
#18 0x59103c1e808b in ha_innobase::create(char const, TABLE, HA_CREATE_INFO, bool, trx_t) /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/handler/ha_innodb.cc:13278:17
#19 0x59103acd1a90 in handler::ha_create(char const, TABLE, HA_CREATE_INFO*) /test/msan_slow_src/10.6-es_dbg_msan/sql/handler.cc:5676:14
#20 0x59103acd5d22 in ha_create_table(THD, char const, char const, char const, HA_CREATE_INFO, st_mysql_const_unsigned_lex_string, bool) /test/msan_slow_src/10.6-es_dbg_msan/sql/handler.cc:6151:22
#21 0x59103b9aeb5a in mysql_alter_table(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, HA_CREATE_INFO, TABLE_LIST, Recreate_info, Alter_info, unsigned int, st_order, bool, bool) /test/msan_slow_src/10.6-es_dbg_msan/sql/sql_table.cc:11129:7
#22 0x59103bb92803 in Sql_cmd_alter_table::execute(THD*) /test/msan_slow_src/10.6-es_dbg_msan/sql/sql_alter.cc:685:11
#23 0x59103b6a4ba1 in mysql_execute_command(THD*, bool) /test/msan_slow_src/10.6-es_dbg_msan/sql/sql_parse.cc:6174:26
#24 0x59103b6997e8 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/msan_slow_src/10.6-es_dbg_msan/sql/sql_parse.cc:8228:18

SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/msan_slow_src/10.6-es_dbg_msan/storage/innobase/handler/ha_innodb.cc:10942:3 in create_index(trx_t, TABLE const, dict_table_t*, unsigned int)

Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 010826 4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe MSAN\|use-of-uninitialized-value\|storage/innobase/handler/ha_innodb.cc\|create_index\|create_table_info_t::create_table\|ha_innobase::create\|handler::ha_create
CS 10.6 opt 010826 4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe Assert: no error log(s) found - exiting
CS 10.11 dbg 010826 1dab253482dd562457c89deb68082fb647572959 MSAN\|use-of-uninitialized-value\|storage/innobase/handler/ha_innodb.cc\|create_index\|create_table_info_t::create_table\|ha_innobase::create\|handler::ha_create
CS 10.11 opt 010826 1dab253482dd562457c89deb68082fb647572959 Assert: no error log(s) found - exiting
CS 11.4 dbg 010826 c57069561c4fe8f72191d4a2a4a829e5b57537dc MSAN\|use-of-uninitialized-value\|storage/innobase/handler/ha_innodb.cc\|create_index\|create_table_info_t::create_table\|ha_innobase::create\|handler::ha_create
CS 11.4 opt 010826 c57069561c4fe8f72191d4a2a4a829e5b57537dc Assert: no error log(s) found - exiting
CS 11.8 dbg 010826 eaca80bf3208fb9657b7304b940a6726b4c86213 MSAN\|use-of-uninitialized-value\|storage/innobase/handler/ha_innodb.cc\|create_index\|create_table_info_t::create_table\|ha_innobase::create\|handler::ha_create
CS 11.8 opt 010826 eaca80bf3208fb9657b7304b940a6726b4c86213 Assert: no error log(s) found - exiting
CS 12.3 dbg 010826 51263b851df7093758e98c7029f091332c1c576f MSAN\|use-of-uninitialized-value\|storage/innobase/handler/ha_innodb.cc\|create_index\|create_table_info_t::create_table\|ha_innobase::create\|handler::ha_create
CS 12.3 opt 010826 51263b851df7093758e98c7029f091332c1c576f Assert: no error log(s) found - exiting
CS 13.0 dbg 010826 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a MSAN\|use-of-uninitialized-value\|storage/innobase/handler/ha_innodb.cc\|create_index\|create_table_info_t::create_table\|ha_innobase::create\|handler::ha_create
CS 13.0 opt 010826 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a Assert: no error log(s) found - exiting
CS 13.1 dbg 010826 548c80aeafb6dd2be64f56e902e921a4052b5fe0 MSAN\|use-of-uninitialized-value\|storage/innobase/handler/ha_innodb.cc\|create_index\|create_table_info_t::create_table\|ha_innobase::create\|handler::ha_create
CS 13.1 opt 010826 548c80aeafb6dd2be64f56e902e921a4052b5fe0 Assert: no error log(s) found - exiting
ES 10.6 dbg 010826 fcecb2620f25965723d640decede7c018bcb1dcc MSAN\|use-of-uninitialized-value\|storage/innobase/handler/ha_innodb.cc\|create_index\|create_table_info_t::create_table\|ha_innobase::create\|handler::ha_create
ES 10.6 opt 010826 fcecb2620f25965723d640decede7c018bcb1dcc Assert: no error log(s) found - exiting
ES 11.4 dbg 010826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 MSAN\|use-of-uninitialized-value\|storage/innobase/handler/ha_innodb.cc\|create_index\|create_table_info_t::create_table\|ha_innobase::create\|handler::ha_create
ES 11.4 opt 010826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 Assert: no error log(s) found - exiting
ES 11.8 dbg 010826 4694e931d10fecf733c34f83ea2146d31b708eb3 MSAN\|use-of-uninitialized-value\|storage/innobase/handler/ha_innodb.cc\|create_index\|create_table_info_t::create_table\|ha_innobase::create\|handler::ha_create
ES 11.8 opt 010826 4694e931d10fecf733c34f83ea2146d31b708eb3 Assert: no error log(s) found - exiting
ES 12.3 dbg 010826 c86ea989a715d9fbe1a5d760939acec22acfc0df MSAN\|use-of-uninitialized-value\|storage/innobase/handler/ha_innodb.cc\|create_index\|create_table_info_t::create_table\|ha_innobase::create\|handler::ha_create
ES 12.3 opt 010826 c86ea989a715d9fbe1a5d760939acec22acfc0df Assert: no error log(s) found - exiting

use-of-uninitialized-value in create_index(trx_t, TABLE const, dict_table_t*, unsigned int)

Details

Description

Attachments

Activity

People

Dates

Time Tracking

Git Integration