[MDEV-29901] Valgrind/MSAN unitialized value errors in my_b_write / create_sort_index Created: 2022-10-27  Updated: 2023-11-28

Status: Open
Project: MariaDB Server
Component/s: Server
Affects Version/s: 10.5, 10.6, 10.7, 10.8, 10.9, 10.10
Fix Version/s: 10.5, 10.6

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Oleksandr Byelkin
Resolution: Unresolved Votes: 0
Labels: None


 Description   

--source include/have_sequence.inc
--source include/have_innodb.inc
 
CREATE TABLE t (a CHAR(150), b TIME) ENGINE=InnoDB CHARACTER SET utf32;
INSERT INTO t SELECT NULL, NULL FROM seq_1_to_53;
SELECT b FROM t GROUP BY b WITH ROLLUP;
 
# Cleanup
DROP TABLE t;

10.5 e29fb956 with Valgrind

==518412== Uninitialised byte(s) found during client check request
==518412==    at 0xDB27E9: my_b_write (my_sys.h:512)
==518412==    by 0xDB6441: write_keys(Sort_param*, SORT_INFO*, unsigned int, st_io_cache*, st_io_cache*) (filesort.cc:1071)
==518412==    by 0xDB5ECC: find_all_keys(THD*, Sort_param*, SQL_SELECT*, SORT_INFO*, st_io_cache*, st_io_cache*, Bounded_queue<unsigned char, unsigned char>*, unsigned long long*) (filesort.cc:956)
==518412==    by 0xDB3D4E: filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) (filesort.cc:352)
==518412==    by 0xAD5D96: create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) (sql_select.cc:24249)
==518412==    by 0xACFE11: st_join_table::sort_table() (sql_select.cc:21969)
==518412==    by 0xACF9EC: join_init_read_record(st_join_table*) (sql_select.cc:21908)
==518412==    by 0xACD657: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:20963)
==518412==    by 0xACCA8C: do_select(JOIN*, Procedure*) (sql_select.cc:20498)
==518412==    by 0xA9FA9F: JOIN::exec_inner() (sql_select.cc:4560)
==518412==    by 0xA9EB9E: JOIN::exec() (sql_select.cc:4340)
==518412==    by 0xAA03FA: mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:4817)
==518412==    by 0xA8FA46: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:444)
==518412==    by 0xA51B59: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:6315)
==518412==    by 0xA48E14: mysql_execute_command(THD*) (sql_parse.cc:4006)
==518412==    by 0xA56A2F: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:8103)
==518412==  Address 0x1510b2b5 is 437 bytes inside a block of size 856 alloc'd
==518412==    at 0x483877F: malloc (vg_replace_malloc.c:307)
==518412==    by 0x170924C: my_malloc (my_malloc.c:90)
==518412==    by 0x10091CA: Filesort_buffer::alloc_sort_buffer(unsigned int, unsigned int) (filesort_utils.cc:136)
==518412==    by 0xDBC373: SORT_INFO::alloc_sort_buffer(unsigned int, unsigned int) (filesort.h:160)
==518412==    by 0xDB3B34: filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) (filesort.cc:318)
==518412==    by 0xAD5D96: create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) (sql_select.cc:24249)
==518412==    by 0xACFE11: st_join_table::sort_table() (sql_select.cc:21969)
==518412==    by 0xACF9EC: join_init_read_record(st_join_table*) (sql_select.cc:21908)
==518412==    by 0xACD657: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:20963)
==518412==    by 0xACCA8C: do_select(JOIN*, Procedure*) (sql_select.cc:20498)
==518412==    by 0xA9FA9F: JOIN::exec_inner() (sql_select.cc:4560)
==518412==    by 0xA9EB9E: JOIN::exec() (sql_select.cc:4340)
==518412==    by 0xAA03FA: mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:4817)
==518412==    by 0xA8FA46: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:444)
==518412==    by 0xA51B59: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:6315)
==518412==    by 0xA48E14: mysql_execute_command(THD*) (sql_parse.cc:4006)
==518412== Uninitialised byte(s) found during client check request
==518412==    at 0xDB27E9: my_b_write (my_sys.h:512)
==518412==    by 0xDB6441: write_keys(Sort_param*, SORT_INFO*, unsigned int, st_io_cache*, st_io_cache*) (filesort.cc:1071)
==518412==    by 0xDB612F: find_all_keys(THD*, Sort_param*, SQL_SELECT*, SORT_INFO*, st_io_cache*, st_io_cache*, Bounded_queue<unsigned char, unsigned char>*, unsigned long long*) (filesort.cc:1005)
==518412==    by 0xDB3D4E: filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) (filesort.cc:352)
==518412==    by 0xAD5D96: create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) (sql_select.cc:24249)
==518412==    by 0xACFE11: st_join_table::sort_table() (sql_select.cc:21969)
==518412==    by 0xACF9EC: join_init_read_record(st_join_table*) (sql_select.cc:21908)
==518412==    by 0xACD657: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:20963)
==518412==    by 0xACCA8C: do_select(JOIN*, Procedure*) (sql_select.cc:20498)
==518412==    by 0xA9FA9F: JOIN::exec_inner() (sql_select.cc:4560)
==518412==    by 0xA9EB9E: JOIN::exec() (sql_select.cc:4340)
==518412==    by 0xAA03FA: mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:4817)
==518412==    by 0xA8FA46: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:444)
==518412==    by 0xA51B59: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:6315)
==518412==    by 0xA48E14: mysql_execute_command(THD*) (sql_parse.cc:4006)
==518412==    by 0xA56A2F: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:8103)
==518412==  Address 0x1510b11d is 29 bytes inside a block of size 856 alloc'd
==518412==    at 0x483877F: malloc (vg_replace_malloc.c:307)
==518412==    by 0x170924C: my_malloc (my_malloc.c:90)
==518412==    by 0x10091CA: Filesort_buffer::alloc_sort_buffer(unsigned int, unsigned int) (filesort_utils.cc:136)
==518412==    by 0xDBC373: SORT_INFO::alloc_sort_buffer(unsigned int, unsigned int) (filesort.h:160)
==518412==    by 0xDB3B34: filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) (filesort.cc:318)
==518412==    by 0xAD5D96: create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) (sql_select.cc:24249)
==518412==    by 0xACFE11: st_join_table::sort_table() (sql_select.cc:21969)
==518412==    by 0xACF9EC: join_init_read_record(st_join_table*) (sql_select.cc:21908)
==518412==    by 0xACD657: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:20963)
==518412==    by 0xACCA8C: do_select(JOIN*, Procedure*) (sql_select.cc:20498)
==518412==    by 0xA9FA9F: JOIN::exec_inner() (sql_select.cc:4560)
==518412==    by 0xA9EB9E: JOIN::exec() (sql_select.cc:4340)
==518412==    by 0xAA03FA: mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:4817)
==518412==    by 0xA8FA46: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:444)
==518412==    by 0xA51B59: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:6315)
==518412==    by 0xA48E14: mysql_execute_command(THD*) (sql_parse.cc:4006)
==518412== Syscall param write(buf) points to uninitialised byte(s)
==518412==    at 0x4D7CFEF: __libc_write (write.c:26)
==518412==    by 0x4D7CFEF: write (write.c:24)
==518412==    by 0x17105E7: my_write (my_write.c:49)
==518412==    by 0x16E03E7: inline_mysql_file_write (mysql_file.h:1176)
==518412==    by 0x16E3A21: _my_b_cache_write (mf_iocache.c:1526)
==518412==    by 0x16E4480: my_b_flush_io_cache (mf_iocache.c:1727)
==518412==    by 0xDB4155: filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) (filesort.cc:417)
==518412==    by 0xAD5D96: create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) (sql_select.cc:24249)
==518412==    by 0xACFE11: st_join_table::sort_table() (sql_select.cc:21969)
==518412==    by 0xACF9EC: join_init_read_record(st_join_table*) (sql_select.cc:21908)
==518412==    by 0xACD657: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:20963)
==518412==    by 0xACCA8C: do_select(JOIN*, Procedure*) (sql_select.cc:20498)
==518412==    by 0xA9FA9F: JOIN::exec_inner() (sql_select.cc:4560)
==518412==    by 0xA9EB9E: JOIN::exec() (sql_select.cc:4340)
==518412==    by 0xAA03FA: mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:4817)
==518412==    by 0xA8FA46: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:444)
==518412==    by 0xA51B59: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:6315)
==518412==  Address 0x15a0a05d is 29 bytes inside a block of size 65,560 alloc'd
==518412==    at 0x483877F: malloc (vg_replace_malloc.c:307)
==518412==    by 0x170924C: my_malloc (my_malloc.c:90)
==518412==    by 0x16E0EB9: init_io_cache_ext (mf_iocache.c:248)
==518412==    by 0x16E115D: init_io_cache (mf_iocache.c:301)
==518412==    by 0x16DE42B: open_cached_file (mf_cache.c:45)
==518412==    by 0xDB6334: write_keys(Sort_param*, SORT_INFO*, unsigned int, st_io_cache*, st_io_cache*) (filesort.cc:1054)
==518412==    by 0xDB5ECC: find_all_keys(THD*, Sort_param*, SQL_SELECT*, SORT_INFO*, st_io_cache*, st_io_cache*, Bounded_queue<unsigned char, unsigned char>*, unsigned long long*) (filesort.cc:956)
==518412==    by 0xDB3D4E: filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) (filesort.cc:352)
==518412==    by 0xAD5D96: create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) (sql_select.cc:24249)
==518412==    by 0xACFE11: st_join_table::sort_table() (sql_select.cc:21969)
==518412==    by 0xACF9EC: join_init_read_record(st_join_table*) (sql_select.cc:21908)
==518412==    by 0xACD657: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:20963)
==518412==    by 0xACCA8C: do_select(JOIN*, Procedure*) (sql_select.cc:20498)
==518412==    by 0xA9FA9F: JOIN::exec_inner() (sql_select.cc:4560)
==518412==    by 0xA9EB9E: JOIN::exec() (sql_select.cc:4340)
==518412==    by 0xAA03FA: mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:4817)

10.6 b7fe6179e82 with MSAN

==516960==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x55acfbacc253 in my_b_write(st_io_cache*, unsigned char const*, unsigned long) /data/bld/10.6-msan/include/my_sys.h:524:3
    #1 0x55acfbacc253 in write_keys(Sort_param*, SORT_INFO*, unsigned int, st_io_cache*, st_io_cache*) /data/bld/10.6-msan/sql/filesort.cc:1085:9
    #2 0x55acfbaacc84 in find_all_keys(THD*, Sort_param*, SQL_SELECT*, SORT_INFO*, st_io_cache*, st_io_cache*, Bounded_queue<unsigned char, unsigned char>*, unsigned long long*) /data/bld/10.6-msan/sql/filesort.cc:969:15
    #3 0x55acfbaacc84 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/bld/10.6-msan/sql/filesort.cc:357:13
    #4 0x55acfb03165e in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /data/bld/10.6-msan/sql/sql_select.cc:24621:14
    #5 0x55acfb030542 in st_join_table::sort_table() /data/bld/10.6-msan/sql/sql_select.cc:22302:7
    #6 0x55acfaf95a01 in join_init_read_record(st_join_table*) /data/bld/10.6-msan/sql/sql_select.cc:22241:29
    #7 0x55acfaf016bd in sub_select(JOIN*, st_join_table*, bool) /data/bld/10.6-msan/sql/sql_select.cc:21288:12
    #8 0x55acfafa07df in do_select(JOIN*, Procedure*) /data/bld/10.6-msan/sql/sql_select.cc:20836:14
    #9 0x55acfafa07df in JOIN::exec_inner() /data/bld/10.6-msan/sql/sql_select.cc:4784:50
    #10 0x55acfaf9c3c8 in JOIN::exec() /data/bld/10.6-msan/sql/sql_select.cc:4562:3
    #11 0x55acfaf048b0 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/10.6-msan/sql/sql_select.cc:5041:9
    #12 0x55acfaf032ab in handle_select(THD*, LEX*, select_result*, unsigned long) /data/bld/10.6-msan/sql/sql_select.cc:554:10
    #13 0x55acfae3c6fa in execute_sqlcom_select(THD*, TABLE_LIST*) /data/bld/10.6-msan/sql/sql_parse.cc:6256:12
    #14 0x55acfae16bcd in mysql_execute_command(THD*, bool) /data/bld/10.6-msan/sql/sql_parse.cc:3946:12
    #15 0x55acfadfde0a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/10.6-msan/sql/sql_parse.cc:8016:18
    #16 0x55acfadf2872 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/10.6-msan/sql/sql_parse.cc:1896:7
    #17 0x55acfae00212 in do_command(THD*, bool) /data/bld/10.6-msan/sql/sql_parse.cc:1409:17
    #18 0x55acfb410944 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.6-msan/sql/sql_connect.cc:1416:11
    #19 0x55acfb40fff5 in handle_one_connection /data/bld/10.6-msan/sql/sql_connect.cc:1318:5
    #20 0x55acfc84cc7a in pfs_spawn_thread /data/bld/10.6-msan/storage/perfschema/pfs.cc:2201:3
    #21 0x7f9798fe0ea6 in start_thread nptl/pthread_create.c:477:8
    #22 0x7f9798cecaee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
 
  Memory was marked as uninitialized
    #0 0x55acfa8f457e in __msan_allocated_memory (/mnt8t/bld/10.6-msan/sql/mariadbd+0x75a57e)
    #1 0x55acfdb70576 in my_malloc /data/bld/10.6-msan/mysys/my_malloc.c:113:7
 
SUMMARY: MemorySanitizer: use-of-uninitialized-value /data/bld/10.6-msan/include/my_sys.h:524:3 in my_b_write(st_io_cache*, unsigned char const*, unsigned long)
Exiting


Generated at Thu Feb 08 10:12:08 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.