[MDEV-22071] MSAN use-of-uninitialized-value in build_frm_image() Created: 2020-03-28  Updated: 2020-05-14  Resolved: 2020-05-14

Status: Closed
Project: MariaDB Server
Component/s: Data Definition - Create Table, GIS, Tests
Affects Version/s: 10.2, 10.3, 10.4, 10.5
Fix Version/s: 10.5.3, 10.2.33, 10.3.24, 10.4.14

Type: Bug Priority: Major
Reporter: Marko Mäkelä Assignee: Michael Widenius
Resolution: Fixed Votes: 0
Labels: MSAN, undefined, valgrind

Issue Links:
Relates
relates to MDEV-20377 Make WITH_MSAN more usable Closed

 Description   

An InnoDB test fails with MSAN. This seems pretty serious, because we could be writing uninitialized data to an .frm file:

10.5 6be56dd1c8a37eb98f4b7bc1507ca5991a2a1f61

 
CURRENT_TEST: innodb.innodb-online-alter-gis
 
mysqltest: At line 29: query 'ALTER TABLE t1 ADD COLUMN b LINESTRING DEFAULT POINT(1,1)' failed with wrong errno 2013: 'Lost connection to MySQL server during query', instead of 1366...
 
…
 
----------SERVER LOG START-----------
 
==1438499==WARNING: MemorySanitizer: use-of-uninitialized-value
 
    #0 0x55b800771577 in Binary_string::c_ptr() /mariadb/10.5m/sql/sql_string.h:606:9
 
    #1 0x55b800771577 in Field_geom::store(char const*, unsigned long, charset_info_st const*) /mariadb/10.5m/sql/sql_type_geom.cc:875:13
 
    #2 0x55b800bf16e7 in Item::save_str_in_field(Field*, bool) /mariadb/10.5m/sql/item.cc:6527:21
 
    #3 0x55b800bf28ab in Item::save_in_field(Field*, bool) /mariadb/10.5m/sql/item.cc:6565:30
 
    #4 0x55b800a95bae in Field_blob::make_empty_rec_store_default_value(THD*, Item*) /mariadb/10.5m/sql/field.cc:8782:18
 
    #5 0x55b8003ead07 in make_empty_rec_store_default(THD*, Field*, Virtual_column_info*) /mariadb/10.5m/sql/unireg.cc:1096:19
 
    #6 0x55b8003ead07 in make_empty_rec(THD*, unsigned char*, unsigned int, List<Create_field>&, unsigned int, unsigned long) /mariadb/10.5m/sql/unireg.cc:1171:12
 
    #7 0x55b8003ead07 in build_frm_image(THD*, st_mysql_const_lex_string const&, HA_CREATE_INFO*, List<Create_field>&, unsigned int, st_key*, handler*) /mariadb/10.5m/sql/unireg.cc:534:7
 
    #8 0x55b8002385e2 in mysql_create_frm_image(THD*, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, HA_CREATE_INFO*, Alter_info*, int, st_key**, unsigned int*, st_mysql_const_unsigned_lex_string*) /mariadb/10.5m/sql/sql_table.cc:4870:9
 
    #9 0x55b80023d7da in create_table_impl(THD*, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, char const*, DDL_options_st, HA_CREATE_INFO*, Alter_info*, int, bool*, st_key**, unsigned int*, st_mysql_const_unsigned_lex_string*) /mariadb/10.5m/sql/sql_table.cc:5120:11
 
    #10 0x55b80026b736 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /mariadb/10.5m/sql/sql_table.cc:10214:10
 
    #11 0x55b8004cfb11 in Sql_cmd_alter_table::execute(THD*) /mariadb/10.5m/sql/sql_alter.cc:522:11
 
    #12 0x55b7ffeac1d1 in mysql_execute_command(THD*) /mariadb/10.5m/sql/sql_parse.cc:5908:26
 
    #13 0x55b7ffe9417e in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /mariadb/10.5m/sql/sql_parse.cc:7953:18
 
    #14 0x55b7ffe86543 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /mariadb/10.5m/sql/sql_parse.cc:1839:7
 
    #15 0x55b7ffe96c74 in do_command(THD*) /mariadb/10.5m/sql/sql_parse.cc:1358:17
 
    #16 0x55b8004af6fb in do_handle_one_connection(CONNECT*, bool) /mariadb/10.5m/sql/sql_connect.cc:1422:11
 
    #17 0x55b8004aed66 in handle_one_connection /mariadb/10.5m/sql/sql_connect.cc:1319:5
 
    #18 0x55b801949287 in pfs_spawn_thread /mariadb/10.5m/storage/perfschema/pfs.cc:2201:3
 
    #19 0x7f28135d5f26 in start_thread /build/glibc-WZtAaN/glibc-2.30/nptl/pthread_create.c:479:8
 
    #20 0x7f28130b42ee in clone /build/glibc-WZtAaN/glibc-2.30/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
 
 
 
  Memory was marked as uninitialized
 
    #0 0x55b7ff9413ae in __msan_allocated_memory (/dev/shm/10.5m/sql/mariadbd+0x6fe3ae)
 
    #1 0x55b802fe5f75 in my_malloc /mariadb/10.5m/mysys/my_malloc.c:111:7



 Comments   
Comment by Elena Stepanova [ 2020-04-14 ]

Also with Valgrind, reproducible on 10.2-10.5, not reproducible on 10.1.

$ perl ./mtr main.gis --valgrind

10.2 e40ed0e8

 
==25192== Thread 6:
 
==25192== Conditional jump or move depends on uninitialised value(s)
 
==25192==    at 0x671A6B: String::c_ptr() (sql_string.h:213)
 
==25192==    by 0x962EC7: Field_geom::store(char const*, unsigned int, charset_info_st const*) (field.cc:8858)
 
==25192==    by 0x9A1293: Item::save_in_field(Field*, bool) (item.cc:6420)
 
==25192==    by 0x68851B: fill_record(THD*, TABLE*, Field**, List<Item>&, bool, bool) (sql_base.cc:8300)
 
==25192==    by 0x688695: fill_record_n_invoke_before_triggers(THD*, TABLE*, Field**, List<Item>&, bool, trg_event_type) (sql_base.cc:8348)
 
==25192==    by 0x6C8513: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:1010)
 
==25192==    by 0x6F0031: mysql_execute_command(THD*) (sql_parse.cc:4166)
 
==25192==    by 0x6FB7D7: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:7739)
 
==25192==    by 0x6E9B31: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1831)
 
==25192==    by 0x6E8482: do_command(THD*) (sql_parse.cc:1384)
 
==25192==    by 0x8431D8: do_handle_one_connection(CONNECT*) (sql_connect.cc:1336)
 
==25192==    by 0x842F43: handle_one_connection (sql_connect.cc:1241)
 
==25192==    by 0x10B6B17: pfs_spawn_thread (pfs.cc:1869)
 
==25192==    by 0x4E3F4A3: start_thread (pthread_create.c:456)
 
==25192==    by 0x6D4BD0E: clone (clone.S:97)

Comment by Michael Widenius [ 2020-05-14 ]

This was fixed as part of a earlier bug fix in 10 on April 18th.
commit 48eda61cd41725498908308e0004897f10dd7307

Comment by Marko Mäkelä [ 2020-05-14 ]

I confirm that it has been fixed:

mariadb-10.5.3

 
innodb.innodb-online-alter-gis 'innodb'  [ pass ]    168

Generated at Thu Feb 08 09:11:58 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.