[MDEV-22692] MSAN use-of-uninitialized-value in pagecache_fwrite() Created: 2020-05-25  Updated: 2020-06-08  Resolved: 2020-06-08

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - Aria
Affects Version/s: 10.5
Fix Version/s: N/A

Type: Bug Priority: Minor
Reporter: Marko Mäkelä Assignee: Michael Widenius
Resolution: Incomplete Votes: 0
Labels: MSAN

Issue Links:
Blocks
blocks MDEV-20377 Make WITH_MSAN more usable Closed

 Description   

After I removed the following workaround, I got a number of test failures:

diff --git a/storage/maria/ma_pagecache.c b/storage/maria/ma_pagecache.c
index 119b5310f49..12e88f2535c 100644
--- a/storage/maria/ma_pagecache.c
+++ b/storage/maria/ma_pagecache.c
@@ -681,10 +681,6 @@ static my_bool pagecache_fwrite(PAGECACHE *pagecache,
     DBUG_PRINT("error", ("write callback problem"));
     DBUG_RETURN(1);
   }
-#if __has_feature(memory_sanitizer) /* FIXME: encryption.aria_tiny etc. fail */
-  /* FIXME: ENGINE=Aria occasionally writes uninitialized data */
-  __msan_unpoison(args.page, pagecache->block_size);
-#endif
   res= (int)my_pwrite(filedesc->file, args.page, pagecache->block_size,
                  ((my_off_t) pageno << pagecache->shift), flags);
   (*filedesc->post_write_hook)(res, &args);

An example:

10.5 d8ea11a33fba12331c98c04ff44c815a662faccb with the above patch

CURRENT_TEST: encryption.aria_tiny
mysqltest: At line 10: query 'drop table t1' failed: 2013: Lost connection to MySQL server during query
Uninitialized bytes in __interceptor_pwrite64 at offset 31 inside [0x725000043818, 8192)
==40014==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x5565a0801827 in my_pwrite /mariadb/10.5m/mysys/my_pread.c:159:19
    #1 0x55659ee8e355 in pagecache_fwrite /mariadb/10.5m/storage/maria/ma_pagecache.c:684:13
    #2 0x55659ee9e23c in flush_cached_blocks /mariadb/10.5m/storage/maria/ma_pagecache.c:4745:12
    #3 0x55659ee90bcb in flush_pagecache_blocks_int /mariadb/10.5m/storage/maria/ma_pagecache.c:5041:17
    #4 0x55659ee90bcb in flush_pagecache_blocks_with_filter /mariadb/10.5m/storage/maria/ma_pagecache.c:5156:8
    #5 0x55659ed991d7 in maria_close /mariadb/10.5m/storage/maria/ma_close.c:51:9
    #6 0x55659edbb468 in ha_maria::close() /mariadb/10.5m/storage/maria/ha_maria.cc:1240:10
    #7 0x55659e3432dd in handler::ha_close() /mariadb/10.5m/sql/handler.cc:2975:3
    #8 0x55659db6f30c in closefrm(TABLE*) /mariadb/10.5m/sql/table.cc:4271:24
    #9 0x55659dff35d2 in intern_close_table(TABLE*) /mariadb/10.5m/sql/table_cache.cc:220:3
    #10 0x55659dffff00 in TDC_element::flush_unused(bool) /mariadb/10.5m/sql/table_cache.cc:1292:5
    #11 0x55659dfff2de in tdc_remove_referenced_share(THD*, TABLE_SHARE*) /mariadb/10.5m/sql/table_cache.cc:1004:15
    #12 0x55659e0006e2 in tdc_remove_table(THD*, char const*, char const*) /mariadb/10.5m/sql/table_cache.cc:1061:3
    #13 0x55659da25e25 in mysql_rm_table_no_locks(THD*, TABLE_LIST*, bool, bool, bool, bool, bool, bool) /mariadb/10.5m/sql/sql_table.cc:2481:9
    #14 0x55659da220cc in mysql_rm_table(THD*, TABLE_LIST*, bool, bool, bool, bool) /mariadb/10.5m/sql/sql_table.cc:2137:10
    #15 0x55659d6b6874 in mysql_execute_command(THD*) /mariadb/10.5m/sql/sql_parse.cc:4927:10
    #16 0x55659d6922f5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /mariadb/10.5m/sql/sql_parse.cc:7991:18
    #17 0x55659d682c79 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /mariadb/10.5m/sql/sql_parse.cc:1874:7
    #18 0x55659d6941ba in do_command(THD*) /mariadb/10.5m/sql/sql_parse.cc:1355:17
    #19 0x55659dcb02be in do_handle_one_connection(CONNECT*, bool) /mariadb/10.5m/sql/sql_connect.cc:1411:11
    #20 0x55659dcafaa4 in handle_one_connection /mariadb/10.5m/sql/sql_connect.cc:1313:5
    #21 0x55659f15a277 in pfs_spawn_thread /mariadb/10.5m/storage/perfschema/pfs.cc:2201:3
    #22 0x7fcd55afaf26 in start_thread nptl/pthread_create.c:479:8
    #23 0x7fcd555d931e in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
 
  Memory was marked as uninitialized
    #0 0x55659d14028e in __msan_allocated_memory (/dev/shm/10.5-msan/sql/mariadbd+0x70928e)
    #1 0x5565a07fc1e7 in my_malloc /mariadb/10.5m/mysys/my_malloc.c:111:7

Side note: InnoDB stopped writing anything to data files for dropped tables, in MDEV-15528 and MDEV-21069.



 Comments   
Comment by Michael Widenius [ 2020-06-02 ]

Aria flushes the table at this point as it can't know if the table will be truly dropped or not.
(The server can fail or the connection killed before we reach drop table)

Did you run the above test with a server compiled with HAVE_valgrind ?
If not, the test is not that relevant as we only zero pages if the above define is done.

Generated at Thu Feb 08 09:16:43 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.