[MDEV-32140] Valgrind/MSAN warnings in dynamic_column_update_move_left Created: 2023-09-10  Updated: 2023-09-26  Resolved: 2023-09-26

Status: Closed
Project: MariaDB Server
Component/s: Dynamic Columns
Affects Version/s: 10.4, 10.5, 10.6, 10.10, 10.11, 11.0, 11.1, 11.2
Fix Version/s: 10.4.32, 10.5.23, 10.6.16, 10.10.7, 10.11.6, 11.0.4, 11.1.3

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Oleksandr Byelkin
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-4899 Valgrind warnings (Conditional jump o... Closed

 Description   

The failure is similar to MDEV-4899 which however was filed for 10.3 and was never reproducible on 10.4 (and still isn't).

SELECT COLUMN_GET(COLUMN_ADD(COLUMN_CREATE(1,10),2,NULL,1,NULL),3 AS INTEGER);

10.5 MSAN b08474435f

==3319749==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x556c9b48a02e in dynamic_column_update_move_left /data/src/10.5-msan/mysys/ma_dyncol.c
    #1 0x556c9b48a02e in dynamic_column_update_many_fmt /data/src/10.5-msan/mysys/ma_dyncol.c:3568:11
    #2 0x556c9959b4b1 in Item_func_dyncol_add::val_str(String*) /data/src/10.5-msan/sql/item_strfunc.cc:4752:13
    #3 0x556c9959c56e in Item_dyncol_get::get_dyn_value(THD*, st_dynamic_column_value*, String*) /data/src/10.5-msan/sql/item_strfunc.cc:4848:17
    #4 0x556c9959e42c in Item_dyncol_get::val_int() /data/src/10.5-msan/sql/item_strfunc.cc:4964:7
    #5 0x556c995c5304 in Item_dyncol_get::val_int_signed_typecast() /data/src/10.5-msan/sql/item_strfunc.h:1768:21
    #6 0x556c994c2ff6 in Item_func_signed::val_int() /data/src/10.5-msan/sql/item_func.h:1329:30
    #7 0x556c98e60842 in Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const /data/src/10.5-msan/sql/sql_type.cc:7485:22
    #8 0x556c98e60842 in Type_handler_longlong::Item_send(Item*, Protocol*, st_value*) const /data/src/10.5-msan/sql/sql_type.h:5774:12
    #9 0x556c98179ac2 in Protocol::send_result_set_row(List<Item>*) /data/src/10.5-msan/sql/protocol.cc:1087:15
    #10 0x556c984177db in select_send::send_data(List<Item>&) /data/src/10.5-msan/sql/sql_class.cc:3155:17
    #11 0x556c987696b1 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /data/src/10.5-msan/sql/sql_class.h:5459:12
    #12 0x556c987696b1 in JOIN::exec_inner() /data/src/10.5-msan/sql/sql_select.cc:4470:22
    #13 0x556c98764668 in JOIN::exec() /data/src/10.5-msan/sql/sql_select.cc:4382:3
    #14 0x556c986cdae0 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.5-msan/sql/sql_select.cc:4859:9
    #15 0x556c986cc4f6 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.5-msan/sql/sql_select.cc:450:10
    #16 0x556c986034ce in execute_sqlcom_select(THD*, TABLE_LIST*) /data/src/10.5-msan/sql/sql_parse.cc:6341:12
    #17 0x556c985dd60b in mysql_execute_command(THD*) /data/src/10.5-msan/sql/sql_parse.cc:4018:12
    #18 0x556c985c4937 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5-msan/sql/sql_parse.cc:8118:18
    #19 0x556c985b7f03 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5-msan/sql/sql_parse.cc:1891:7
    #20 0x556c985c68d8 in do_command(THD*) /data/src/10.5-msan/sql/sql_parse.cc:1375:17
    #21 0x556c98bc6c9f in do_handle_one_connection(CONNECT*, bool) /data/src/10.5-msan/sql/sql_connect.cc:1416:11
    #22 0x556c98bc6395 in handle_one_connection /data/src/10.5-msan/sql/sql_connect.cc:1318:5
    #23 0x556c99fdbf9a in pfs_spawn_thread /data/src/10.5-msan/storage/perfschema/pfs.cc:2201:3
    #24 0x7fc4b8a0bfd3 in start_thread nptl/./nptl/pthread_create.c:442:8
    #25 0x7fc4b8a8c5bb in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
 
  Memory was marked as uninitialized
    #0 0x556c980ac53e in __msan_allocated_memory (/mnt8t/src/10.5-msan/sql/mariadbd+0x77a53e)
    #1 0x556c9b422266 in my_malloc /data/src/10.5-msan/mysys/my_malloc.c:114:7
 
SUMMARY: MemorySanitizer: use-of-uninitialized-value /data/src/10.5-msan/mysys/ma_dyncol.c in dynamic_column_update_move_left

10.5 b0847443 valgrind

==3319964== Conditional jump or move depends on uninitialised value(s)
==3319964==    at 0x17C91B7: dynamic_column_update_move_left (ma_dyncol.c:2920)
==3319964==    by 0x17CA995: dynamic_column_update_many_fmt (ma_dyncol.c:3568)
==3319964==    by 0x17C9914: mariadb_dyncol_update_many_num (ma_dyncol.c:3272)
==3319964==    by 0xEDE230: Item_func_dyncol_add::val_str(String*) (item_strfunc.cc:4752)
==3319964==    by 0xEDE75A: Item_dyncol_get::get_dyn_value(THD*, st_dynamic_column_value*, String*) (item_strfunc.cc:4848)
==3319964==    by 0xEDEDCC: Item_dyncol_get::val_int() (item_strfunc.cc:4964)
==3319964==    by 0xEE342B: Item_dyncol_get::val_int_signed_typecast() (item_strfunc.h:1768)
==3319964==    by 0xEA38ED: Item_func_signed::val_int() (item_func.h:1329)
==3319964==    by 0xCDA272: Type_handler::Item_send_longlong(Item*, Protocol*, st_value*) const (sql_type.cc:7485)
==3319964==    by 0xCE8473: Type_handler_longlong::Item_send(Item*, Protocol*, st_value*) const (sql_type.h:5774)
==3319964==    by 0x91ADD1: Item::send(Protocol*, st_value*) (item.h:1068)
==3319964==    by 0x913C41: Protocol::send_result_set_row(List<Item>*) (protocol.cc:1087)
==3319964==    by 0x9D96A8: select_send::send_data(List<Item>&) (sql_class.cc:3155)
==3319964==    by 0xB022F4: select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) (sql_class.h:5459)
==3319964==    by 0xAB37A2: JOIN::exec_inner() (sql_select.cc:4470)
==3319964==    by 0xAB2FFA: JOIN::exec() (sql_select.cc:4382)



 Comments   
Comment by Oleksandr Byelkin [ 2023-09-25 ]

commit 343ef9376f53d446809cf1d5de55232365a1de3e (HEAD -> bb-10.4-MDEV-32140, origin/bb-10.4-MDEV-32140)
Author: Oleksandr Byelkin <sanja@mariadb.com>
Date:   Mon Sep 25 17:14:36 2023 +0200
 
    MDEV-32140: Valgrind/MSAN warnings in dynamic_column_update_move_left
    
    Do not manipulate empty dynamic column, just better return empty dynamic column from the begining.
    (it is also optimisation)

Generated at Thu Feb 08 10:29:08 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.