[MDEV-40854] use-of-uninitialized-value in ha_federated::end_bulk_insert() - Jira

XML

Word

Printable

Details

Type: Bug
Status: Open (View Workflow)
Priority: Critical
Resolution: Unresolved
Affects Version/s: 10.11, 11.4, 11.8, 12.3, 13.0, 13.1, 10.6.28
Fix Version/s: 10.6(EOL), 10.11, 11.4, 11.8, 12.3, 13.0
Component/s: Storage Engine - Federated
Labels:
- MSAN
- use-of-uninitialized-value

Bug Category:
Can result in hang or crash

Description

INSTALL SONAME 'ha_federated';

CREATE TEMPORARY TABLE t (c INT) CONNECTION='mysql://@//' ENGINE=Federated;

INSERT INTO t VALUES (),();

Leads to:

CS 10.11.19 387e9af8462114215ee8499636e873522c3704c1 (Debug, MSAN, Clang 20.1.8-20250804) Build 12/08/2026
==851408==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7fffe63154ed in ha_federated::end_bulk_insert() /test/msan_slow_src/10.11_dbg_msan/storage/federated/ha_federated.cc:2035:30
#1 0x555556f5f1b9 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/msan_slow_src/10.11_dbg_msan/sql/sql_insert.cc:1258:11
#2 0x55555703bfee in mysql_execute_command(THD*, bool) /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:4656:10
#3 0x55555702792f in mysql_parse(THD, char, unsigned int, Parser_state*) /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:8210:18
#4 0x555557021374 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:1924:7
#5 0x5555570283ee in do_command(THD*, bool) /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:1434:17
#6 0x5555574f6dac in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/10.11_dbg_msan/sql/sql_connect.cc:1486:11
#7 0x5555574f6736 in handle_one_connection /test/msan_slow_src/10.11_dbg_msan/sql/sql_connect.cc:1398:5
#8 0x7fffe689cb83 in start_thread nptl/pthread_create.c:447:8
#9 0x7fffe6929d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Memory was marked as uninitialized
#0 0x555556555511 in __msan_allocated_memory (/test/MSAN_MD120826-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd+0x1001511) (BuildId: 699261969f866721d0b2987df7b3c77503eaf7da)
#1 0x555558557e11 in my_malloc /test/msan_slow_src/10.11_dbg_msan/mysys/my_malloc.c:116:7

SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/msan_slow_src/10.11_dbg_msan/storage/federated/ha_federated.cc:2035:30 in ha_federated::end_bulk_insert()

CS 10.11.19 387e9af8462114215ee8499636e873522c3704c1 (Optimized, MSAN, Clang 20.1.8-20250804) Build 12/08/2026
==851442==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7fffe63161e6 in ha_federated::end_bulk_insert() /test/msan_slow_src/10.11_opt_msan/storage/federated/ha_federated.cc:2035:30
#1 0x555556c70ff7 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/msan_slow_src/10.11_opt_msan/sql/sql_insert.cc:1258:11
#2 0x555556d44738 in mysql_execute_command(THD*, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:4656:10
#3 0x555556d340a5 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:8210:18
#4 0x555556d2e1d9 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:1924:7
#5 0x555556d34c88 in do_command(THD*, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:1434:17
#6 0x5555571a9b0c in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_connect.cc:1486:11
#7 0x5555571a9482 in handle_one_connection /test/msan_slow_src/10.11_opt_msan/sql/sql_connect.cc:1398:5
#8 0x7fffe689cb83 in start_thread nptl/pthread_create.c:447:8
#9 0x7fffe6929d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Memory was marked as uninitialized
#0 0x555556363e31 in __msan_allocated_memory (/test/MSAN_MD120826-mariadb-10.11.19-linux-x86_64-opt/bin/mariadbd+0xe0fe31) (BuildId: 84daf9b40ce6a145f246c382d28763b5940bcf18)
#1 0x555557f00e7e in my_malloc /test/msan_slow_src/10.11_opt_msan/mysys/my_malloc.c:116:7
#2 0x555557ee39b5 in alloc_root /test/msan_slow_src/10.11_opt_msan/mysys/my_alloc.c:288:30
#3 0x7fffe630ec79 in Sql_alloc::operator new(unsigned long, st_mem_root*) /test/msan_slow_src/10.11_opt_msan/sql/sql_alloc.h:37:12
#4 0x7fffe630ec79 in federated_create_handler(handlerton, TABLE_SHARE, st_mem_root*) /test/msan_slow_src/10.11_opt_msan/storage/federated/ha_federated.cc:427:10
#5 0x55555642651e in get_new_handler(TABLE_SHARE, st_mem_root, handlerton*) /test/msan_slow_src/10.11_opt_msan/sql/handler.cc:388:16
#6 0x5555570c8e85 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /test/msan_slow_src/10.11_opt_msan/sql/table.cc:4215:27
#7 0x555557446bc2 in THD::open_temporary_table(TMP_TABLE_SHARE, char const) /test/msan_slow_src/10.11_opt_msan/sql/temporary_tables.cc:1150:7
#8 0x555557445f71 in THD::create_and_open_tmp_table(st_mysql_const_unsigned_lex_string, char const, char const, char const, bool) /test/msan_slow_src/10.11_opt_msan/sql/temporary_tables.cc:74:12
#9 0x555556fed656 in create_table_impl(THD, st_ddl_log_state, st_ddl_log_state, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, DDL_options_st, HA_CREATE_INFO, Alter_info, int, bool, st_key*, unsigned int, st_mysql_const_unsigned_lex_string*) /test/msan_slow_src/10.11_opt_msan/sql/sql_table.cc:4912:24
#10 0x555556febc0f in mysql_create_table_no_lock(THD, st_ddl_log_state, st_ddl_log_state, Table_specification_st, Alter_info, bool, int, TABLE_LIST*) /test/msan_slow_src/10.11_opt_msan/sql/sql_table.cc:5000:8
#11 0x55555702b63e in mysql_create_table(THD, TABLE_LIST, Table_specification_st, Alter_info) /test/msan_slow_src/10.11_opt_msan/sql/sql_table.cc:5247:7
#12 0x555557028424 in Sql_cmd_create_table_like::execute(THD*) /test/msan_slow_src/10.11_opt_msan/sql/sql_table.cc:13275:12
#13 0x555556d3df04 in mysql_execute_command(THD*, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:6190:26
#14 0x555556d340a5 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:8210:18
#15 0x555556d2e1d9 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:1924:7
#16 0x555556d34c88 in do_command(THD*, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:1434:17
#17 0x5555571a9b0c in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_connect.cc:1486:11
#18 0x5555571a9482 in handle_one_connection /test/msan_slow_src/10.11_opt_msan/sql/sql_connect.cc:1398:5
#19 0x7fffe689cb83 in start_thread nptl/pthread_create.c:447:8

SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/msan_slow_src/10.11_opt_msan/storage/federated/ha_federated.cc:2035:30 in ha_federated::end_bulk_insert()

Setup:

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O1 -march=native -mtune=native'" and:

    -DWITH_MSAN=ON  # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)

Set before execution:

    export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0

MSAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 120826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
CS 10.6 opt 120826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
CS 10.11 dbg 120826 387e9af8462114215ee8499636e873522c3704c1 MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
CS 10.11 opt 120826 387e9af8462114215ee8499636e873522c3704c1 MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
CS 11.4 dbg 120826 970492062d91cd606dd3f6f8a52bd51cf746ab4f MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
CS 11.4 opt 120826 970492062d91cd606dd3f6f8a52bd51cf746ab4f MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
CS 11.8 dbg 120826 da0beac410cc761be4ee52b90fded6c7fa2f8947 MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
CS 11.8 opt 120826 da0beac410cc761be4ee52b90fded6c7fa2f8947 MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
CS 12.3 dbg 120826 d646e24f7f7b24dec695d8ebc5471f9b939dff8a MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
CS 12.3 opt 120826 d646e24f7f7b24dec695d8ebc5471f9b939dff8a MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
CS 13.0 dbg 120826 a848493c6fe031f23606144420c1ca1e467cbd81 MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
CS 13.0 opt 120826 a848493c6fe031f23606144420c1ca1e467cbd81 MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
CS 13.1 dbg 120826 f4a85225ea17b2c77c20e761773090a08aa3eceb MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
CS 13.1 opt 120826 f4a85225ea17b2c77c20e761773090a08aa3eceb MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
ES 10.6 dbg 120826 fcecb2620f25965723d640decede7c018bcb1dcc MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
ES 10.6 opt 120826 fcecb2620f25965723d640decede7c018bcb1dcc MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
ES 11.4 dbg 120826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
ES 11.4 opt 120826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
ES 11.8 dbg 120826 4694e931d10fecf733c34f83ea2146d31b708eb3 MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
ES 11.8 opt 120826 4694e931d10fecf733c34f83ea2146d31b708eb3 MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
ES 12.3 dbg 120826 ad4c5eb9b72c990abad2abe3436bb547c88c8981 MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse
ES 12.3 opt 120826 ad4c5eb9b72c990abad2abe3436bb547c88c8981 MSAN\|use-of-uninitialized-value\|storage/federated/ha_federated.cc\|ha_federated::end_bulk_insert\|mysql_insert\|mysql_execute_command\|mysql_parse

Attachments

Activity

People

Assignee:: Aleksey Midenkov

Reporter:: Saahil Alam

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Created:: 2026-08-20 06:48

Updated:: 6 days ago 11:30

Time Tracking

Estimated:

Not Specified

Remaining:

Logged:

0.25d

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.