Details
-
Bug
-
Status: Open (View Workflow)
-
Critical
-
Resolution: Unresolved
-
11.4, 12.3, 13.0
-
Can result in hang or crash
Description
CREATE TABLE t (a INT,b TINYBLOB,KEY(a),KEY(a,b)) ENGINE=Aria PARTITION BY HASH(a) PARTITIONS 2; |
SET optimizer_switch='mrr=on'; |
INSERT INTO t VALUES (2,1),(3,1),(4,1); |
SELECT b FROM t WHERE a>1; |
Leads to:
|
CS 11.4.13 970492062d91cd606dd3f6f8a52bd51cf746ab4f (Debug, MSAN, Clang 20.1.8-20250804) Build 12/08/2026 |
==859912==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x5555585e003e in my_get_ptr /test/msan_slow_src/11.4_dbg_msan/mysys/ptr_cmp.c:234:1
|
#1 0x555557a3a9a1 in ha_maria::rnd_pos(unsigned char*, unsigned char*) /test/msan_slow_src/11.4_dbg_msan/storage/maria/ha_maria.cc:2655:36
|
#2 0x555556670940 in handler::ha_rnd_pos(unsigned char*, unsigned char*) /test/msan_slow_src/11.4_dbg_msan/sql/handler.cc:3823:3
|
#3 0x555557626190 in Mrr_ordered_rndpos_reader::get_next(void**) /test/msan_slow_src/11.4_dbg_msan/sql/multi_range_read.cc:1081:16
|
#4 0x55555762a7bd in DsMrr_impl::dsmrr_next(void**) /test/msan_slow_src/11.4_dbg_msan/sql/multi_range_read.cc:1741:26
|
#5 0x555557b6033e in ha_partition::handle_unordered_scan_next_partition(unsigned char*) /test/msan_slow_src/11.4_dbg_msan/sql/ha_partition.cc:7843:20
|
#6 0x555557b6ae88 in ha_partition::multi_range_read_next(void**) /test/msan_slow_src/11.4_dbg_msan/sql/ha_partition.cc:6923:11
|
#7 0x555556bc8081 in QUICK_RANGE_SELECT::get_next() /test/msan_slow_src/11.4_dbg_msan/sql/opt_range.cc:13324:5
|
#8 0x555556c2062e in rr_quick(READ_RECORD*) /test/msan_slow_src/11.4_dbg_msan/sql/records.cc:402:34
|
#9 0x555557128d5b in sub_select(JOIN*, st_join_table*, bool) /test/msan_slow_src/11.4_dbg_msan/sql/sql_select.cc:24368:12
|
#10 0x5555571a369a in do_select(JOIN*, Procedure*) /test/msan_slow_src/11.4_dbg_msan/sql/sql_select.cc:23882:14
|
#11 0x5555571a1422 in JOIN::exec_inner() /test/msan_slow_src/11.4_dbg_msan/sql/sql_select.cc:5102:50
|
#12 0x55555719f403 in JOIN::exec() /test/msan_slow_src/11.4_dbg_msan/sql/sql_select.cc:4893:8
|
#13 0x55555712acb7 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/msan_slow_src/11.4_dbg_msan/sql/sql_select.cc:5416:21
|
#14 0x55555712a132 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/msan_slow_src/11.4_dbg_msan/sql/sql_select.cc:643:10
|
#15 0x55555706aca1 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/msan_slow_src/11.4_dbg_msan/sql/sql_parse.cc:6222:12
|
#16 0x55555705b35e in mysql_execute_command(THD*, bool) /test/msan_slow_src/11.4_dbg_msan/sql/sql_parse.cc:4010:12
|
#17 0x55555704f7df in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/msan_slow_src/11.4_dbg_msan/sql/sql_parse.cc:7941:18
|
#18 0x5555570491d8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/msan_slow_src/11.4_dbg_msan/sql/sql_parse.cc:1925:7
|
#19 0x55555705029e in do_command(THD*, bool) /test/msan_slow_src/11.4_dbg_msan/sql/sql_parse.cc:1433:17
|
#20 0x5555575382bc in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/11.4_dbg_msan/sql/sql_connect.cc:1508:11
|
#21 0x555557537c56 in handle_one_connection /test/msan_slow_src/11.4_dbg_msan/sql/sql_connect.cc:1420:5
|
#22 0x7fffe689cb83 in start_thread nptl/pthread_create.c:447:8
|
#23 0x7fffe6929d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Memory was marked as uninitialized
|
#0 0x555556584731 in __msan_allocated_memory (/test/MSAN_MD120826-mariadb-11.4.13-linux-x86_64-dbg/bin/mariadbd+0x1030731) (BuildId: 02b9f261387bb3cb7336f0ab1ee2dc209daffe4c)
|
#1 0x5555576279f4 in Lifo_buffer::set_buffer_space(unsigned char*, unsigned char*) /test/msan_slow_src/11.4_dbg_msan/sql/sql_lifo_buffer.h:87:7
|
#2 0x5555576279f4 in DsMrr_impl::dsmrr_init(handler*, st_range_seq_if*, void*, unsigned int, unsigned int, st_handler_buffer*) /test/msan_slow_src/11.4_dbg_msan/sql/multi_range_read.cc:1279:20
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/msan_slow_src/11.4_dbg_msan/mysys/ptr_cmp.c:234:1 in my_get_ptr
|
|
CS 11.4.13 970492062d91cd606dd3f6f8a52bd51cf746ab4f (Optimized, MSAN, Clang 20.1.8-20250804) Build 12/08/2026 |
==859921==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x58f9caf9a0c3 in my_get_ptr /test/msan_slow_src/11.4_opt_msan/mysys/ptr_cmp.c:234:1
|
#1 0x58f9ca69b222 in ha_maria::rnd_pos(unsigned char*, unsigned char*) /test/msan_slow_src/11.4_opt_msan/storage/maria/ha_maria.cc:2655:36
|
#2 0x58f9c946aa62 in handler::ha_rnd_pos(unsigned char*, unsigned char*) /test/msan_slow_src/11.4_opt_msan/sql/handler.cc:3823:3
|
#3 0x58f9ca2ccde4 in Mrr_ordered_rndpos_reader::get_next(void**) /test/msan_slow_src/11.4_opt_msan/sql/multi_range_read.cc:1081:16
|
#4 0x58f9ca2d0b4d in DsMrr_impl::dsmrr_next(void**) /test/msan_slow_src/11.4_opt_msan/sql/multi_range_read.cc:1741:26
|
#5 0x58f9ca7a5e0d in ha_partition::handle_unordered_scan_next_partition(unsigned char*) /test/msan_slow_src/11.4_opt_msan/sql/ha_partition.cc:7843:20
|
#6 0x58f9ca7aefd0 in ha_partition::multi_range_read_next(void**) /test/msan_slow_src/11.4_opt_msan/sql/ha_partition.cc:6923:11
|
#7 0x58f9c993b90b in QUICK_RANGE_SELECT::get_next() /test/msan_slow_src/11.4_opt_msan/sql/opt_range.cc:13324:5
|
#8 0x58f9c998ede3 in rr_quick(READ_RECORD*) /test/msan_slow_src/11.4_opt_msan/sql/records.cc:402:34
|
#9 0x58f9c9e25709 in sub_select(JOIN*, st_join_table*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:24368:12
|
#10 0x58f9c9e9540c in do_select(JOIN*, Procedure*) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:23882:14
|
#11 0x58f9c9e930b1 in JOIN::exec_inner() /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:5102:50
|
#12 0x58f9c9e27ad5 in JOIN::exec() /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:4893:8
|
#13 0x58f9c9e27ad5 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:5416:21
|
#14 0x58f9c9e26aa7 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:643:10
|
#15 0x58f9c9d7642a in execute_sqlcom_select(THD*, TABLE_LIST*) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:6222:12
|
#16 0x58f9c9d6a5e3 in mysql_execute_command(THD*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:4010:12
|
#17 0x58f9c9d60645 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:7941:18
|
#18 0x58f9c9d5a6b2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:1925:7
|
#19 0x58f9c9d61228 in do_command(THD*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:1433:17
|
#20 0x58f9ca1ea85c in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_connect.cc:1508:11
|
#21 0x58f9ca1ea1e2 in handle_one_connection /test/msan_slow_src/11.4_opt_msan/sql/sql_connect.cc:1420:5
|
#22 0x76135cc9cb83 in start_thread nptl/pthread_create.c:447:8
|
#23 0x76135cd29d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Memory was marked as uninitialized
|
#0 0x58f9c9395aa1 in __msan_allocated_memory (/test/MSAN_MD120826-mariadb-11.4.13-linux-x86_64-opt/bin/mariadbd+0xe3eaa1) (BuildId: 0baef9e872924da60123fa7ec121d896a4978ebe)
|
#1 0x58f9ca2cdc28 in Lifo_buffer::set_buffer_space(unsigned char*, unsigned char*) /test/msan_slow_src/11.4_opt_msan/sql/sql_lifo_buffer.h:87:7
|
#2 0x58f9ca2cdc28 in DsMrr_impl::dsmrr_init(handler*, st_range_seq_if*, void*, unsigned int, unsigned int, st_handler_buffer*) /test/msan_slow_src/11.4_opt_msan/sql/multi_range_read.cc:1279:20
|
#3 0x58f9ca6a1f29 in ha_maria::multi_range_read_init(st_range_seq_if*, void*, unsigned int, unsigned int, st_handler_buffer*) /test/msan_slow_src/11.4_opt_msan/storage/maria/ha_maria.cc:4209:17
|
#4 0x58f9ca7ae93f in ha_partition::multi_range_read_init(st_range_seq_if*, void*, unsigned int, unsigned int, st_handler_buffer*) /test/msan_slow_src/11.4_opt_msan/sql/ha_partition.cc:6874:11
|
#5 0x58f9c993b4dc in QUICK_RANGE_SELECT::reset() /test/msan_slow_src/11.4_opt_msan/sql/opt_range.cc:13291:16
|
#6 0x58f9c9e8d3f2 in join_init_read_record(st_join_table*) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:25390:64
|
#7 0x58f9c9e25709 in sub_select(JOIN*, st_join_table*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:24368:12
|
#8 0x58f9c9e9540c in do_select(JOIN*, Procedure*) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:23882:14
|
#9 0x58f9c9e930b1 in JOIN::exec_inner() /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:5102:50
|
#10 0x58f9c9e27ad5 in JOIN::exec() /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:4893:8
|
#11 0x58f9c9e27ad5 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:5416:21
|
#12 0x58f9c9e26aa7 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:643:10
|
#13 0x58f9c9d7642a in execute_sqlcom_select(THD*, TABLE_LIST*) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:6222:12
|
#14 0x58f9c9d6a5e3 in mysql_execute_command(THD*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:4010:12
|
#15 0x58f9c9d60645 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:7941:18
|
#16 0x58f9c9d5a6b2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:1925:7
|
#17 0x58f9c9d61228 in do_command(THD*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:1433:17
|
#18 0x58f9ca1ea85c in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_connect.cc:1508:11
|
#19 0x58f9ca1ea1e2 in handle_one_connection /test/msan_slow_src/11.4_opt_msan/sql/sql_connect.cc:1420:5
|
#20 0x76135cc9cb83 in start_thread nptl/pthread_create.c:447:8
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/msan_slow_src/11.4_opt_msan/mysys/ptr_cmp.c:234:1 in my_get_ptr
|
Setup:
Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O1 -march=native -mtune=native'" and:
|
-DWITH_MSAN=ON # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)
|
Set before execution:
|
export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0
|
|
MSAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 120826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c No bug found
|
CS 10.6 opt 120826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c No bug found
|
CS 10.11 dbg 120826 387e9af8462114215ee8499636e873522c3704c1 No bug found
|
CS 10.11 opt 120826 387e9af8462114215ee8499636e873522c3704c1 No bug found
|
CS 11.4 dbg 120826 970492062d91cd606dd3f6f8a52bd51cf746ab4f MSAN|use-of-uninitialized-value|mysys/ptr_cmp.c|my_get_ptr|ha_maria::rnd_pos|handler::ha_rnd_pos|Mrr_ordered_rndpos_reader::get_next
|
CS 11.4 opt 120826 970492062d91cd606dd3f6f8a52bd51cf746ab4f MSAN|use-of-uninitialized-value|mysys/ptr_cmp.c|my_get_ptr|ha_maria::rnd_pos|handler::ha_rnd_pos|Mrr_ordered_rndpos_reader::get_next
|
CS 11.8 dbg 120826 da0beac410cc761be4ee52b90fded6c7fa2f8947 No bug found
|
CS 11.8 opt 120826 da0beac410cc761be4ee52b90fded6c7fa2f8947 No bug found
|
CS 12.3 dbg 120826 d646e24f7f7b24dec695d8ebc5471f9b939dff8a MSAN|use-of-uninitialized-value|mysys/ptr_cmp.c|my_get_ptr|ha_maria::rnd_pos|handler::ha_rnd_pos|Mrr_ordered_rndpos_reader::get_next
|
CS 12.3 opt 120826 d646e24f7f7b24dec695d8ebc5471f9b939dff8a No bug found
|
CS 13.0 dbg 120826 a848493c6fe031f23606144420c1ca1e467cbd81 MSAN|use-of-uninitialized-value|mysys/ptr_cmp.c|my_get_ptr|ha_maria::rnd_pos|handler::ha_rnd_pos|Mrr_ordered_rndpos_reader::get_next
|
CS 13.0 opt 120826 a848493c6fe031f23606144420c1ca1e467cbd81 No bug found
|
CS 13.1 dbg 120826 f4a85225ea17b2c77c20e761773090a08aa3eceb No bug found
|
CS 13.1 opt 120826 f4a85225ea17b2c77c20e761773090a08aa3eceb No bug found
|
ES 10.6 dbg 120826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
|
ES 10.6 opt 120826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
|
ES 11.4 dbg 120826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.4 opt 120826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.8 dbg 120826 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
|
ES 11.8 opt 120826 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
|
ES 12.3 dbg 120826 ad4c5eb9b72c990abad2abe3436bb547c88c8981 No bug found
|
ES 12.3 opt 120826 ad4c5eb9b72c990abad2abe3436bb547c88c8981 No bug found
|
