AddressSanitizer: heap-use-after-free in _ma_block_start_trans

 AddressSanitizer: heap-use-after-free on address 0x6110000ac678 at pc 0x561f50abe91e bp 0x7f7e94634f00 sp 0x7f7e94634ef0

WRITE of size 56 at 0x6110000ac678 thread T32

    #0 0x561f50abe91d in _ma_block_start_trans /git/10.4/storage/maria/ma_state.c:679

    #1 0x561f516b7df0 in thr_multi_lock /git/10.4/mysys/thr_lock.c:1318

    #2 0x561f508afcd9 in mysql_lock_tables(THD*, st_mysql_lock*, unsigned int) /git/10.4/sql/lock.cc:352

    #3 0x561f508af8b9 in mysql_lock_tables(THD*, TABLE**, unsigned int, unsigned int) /git/10.4/sql/lock.cc:304

    #4 0x561f4fdd50c5 in lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /git/10.4/sql/sql_base.cc:5264

    #5 0x561f4fdd3888 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /git/10.4/sql/sql_base.cc:5009

    #6 0x561f4fd4d086 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /git/10.4/sql/sql_base.h:504

==21790==AddressSanitizer: while reporting a bug found another one. Ignoring.

    #7 0x561f4ff2dfd1 in execute_sqlcom_select /git/10.4/sql/sql_parse.cc:6475

    #8 0x561f4ff1d0e5 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:3773

    #9 0x561f4ff36f30 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8091

    #10 0x561f4ff11e2d in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1851

    #11 0x561f4ff0efc5 in do_command(THD*) /git/10.4/sql/sql_parse.cc:1396

    #12 0x561f50263e36 in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402

    #13 0x561f50263813 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308

    #14 0x7f7ec36106b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

    #15 0x7f7ec2aa541c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

0x6110000ac678 is located 184 bytes inside of 252-byte region [0x6110000ac5c0,0x6110000ac6bc)

freed by thread T32 here:

    #0 0x7f7ec486f2ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)

    #1 0x561f516cf700 in free_memory /git/10.4/mysys/safemalloc.c:279

    #2 0x561f516ced8a in sf_free /git/10.4/mysys/safemalloc.c:197

    #3 0x561f516a1181 in my_free /git/10.4/mysys/my_malloc.c:221

    #4 0x561f50abdb9d in _ma_trnman_end_trans_hook /git/10.4/storage/maria/ma_state.c:552

    #5 0x561f50aff681 in trnman_end_trn /git/10.4/storage/maria/trnman.c:475

    #6 0x561f50b76cb4 in ma_commit /git/10.4/storage/maria/ma_commit.c:39

    #7 0x561f50af44df in ha_maria::external_lock(THD*, int) /git/10.4/storage/maria/ha_maria.cc:2841

    #8 0x561f5061d889 in handler::ha_external_lock(THD*, int) /git/10.4/sql/handler.cc:6163

    #9 0x561f508b2b13 in unlock_external /git/10.4/sql/lock.cc:713

    #10 0x561f508b0fde in mysql_unlock_read_tables(THD*, st_mysql_lock*) /git/10.4/sql/lock.cc:489

    #11 0x561f50006b6d in JOIN::join_free() /git/10.4/sql/sql_select.cc:12821

    #12 0x561f5002e6af in do_select /git/10.4/sql/sql_select.cc:18949

    #13 0x561f4ffccc74 in JOIN::exec_inner() /git/10.4/sql/sql_select.cc:4082

    #14 0x561f4ffca9b9 in JOIN::exec() /git/10.4/sql/sql_select.cc:3876

    #15 0x561f4ffcdd44 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /git/10.4/sql/sql_select.cc:4281

    #16 0x561f4ffa8294 in handle_select(THD*, LEX*, select_result*, unsigned long) /git/10.4/sql/sql_select.cc:385

    #17 0x561f4ff2e98b in execute_sqlcom_select /git/10.4/sql/sql_parse.cc:6554

    #18 0x561f4ff1d0e5 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:3773

    #19 0x561f4ff36f30 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8091

    #20 0x561f4ff11e2d in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1851

    #21 0x561f4ff0efc5 in do_command(THD*) /git/10.4/sql/sql_parse.cc:1396

    #22 0x561f50263e36 in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402

    #23 0x561f50263813 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308

    #24 0x7f7ec36106b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

previously allocated by thread T32 here:

    #0 0x7f7ec486f602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)

    #1 0x561f516ce75b in sf_malloc /git/10.4/mysys/safemalloc.c:118

    #2 0x561f516a08fe in my_malloc /git/10.4/mysys/my_malloc.c:101

    #3 0x561f50abab1d in _ma_setup_live_state /git/10.4/storage/maria/ma_state.c:82

    #4 0x561f50abe808 in _ma_block_start_trans /git/10.4/storage/maria/ma_state.c:663

    #5 0x561f516b7df0 in thr_multi_lock /git/10.4/mysys/thr_lock.c:1318

    #6 0x561f508afcd9 in mysql_lock_tables(THD*, st_mysql_lock*, unsigned int) /git/10.4/sql/lock.cc:352

    #7 0x561f508af8b9 in mysql_lock_tables(THD*, TABLE**, unsigned int, unsigned int) /git/10.4/sql/lock.cc:304

    #8 0x561f4fdd50c5 in lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /git/10.4/sql/sql_base.cc:5264

    #9 0x561f4fdd3888 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /git/10.4/sql/sql_base.cc:5009

    #10 0x561f4fd4d086 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /git/10.4/sql/sql_base.h:504

    #11 0x561f4ff2dfd1 in execute_sqlcom_select /git/10.4/sql/sql_parse.cc:6475

    #12 0x561f4ff1d0e5 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:3773

    #13 0x561f4ff36f30 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8091

    #14 0x561f4ff11e2d in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1851

    #15 0x561f4ff0efc5 in do_command(THD*) /git/10.4/sql/sql_parse.cc:1396

    #16 0x561f50263e36 in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402

    #17 0x561f50263813 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308

    #18 0x7f7ec36106b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Thread T32 created by T0 here:

    #0 0x7f7ec480d253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)

    #1 0x561f516f8f64 in spawn_thread_noop /git/10.4/mysys/psi_noop.c:187

    #2 0x561f4fc880e4 in inline_mysql_thread_create /git/10.4/include/mysql/psi/mysql_thread.h:1268

    #3 0x561f4fc9d2c2 in create_thread_to_handle_connection(CONNECT*) /git/10.4/sql/mysqld.cc:6330

    #4 0x561f4fc9d9c2 in create_new_thread(CONNECT*) /git/10.4/sql/mysqld.cc:6400

    #5 0x561f4fc9dd4d in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /git/10.4/sql/mysqld.cc:6517

    #6 0x561f4fc9e9ca in handle_connections_sockets() /git/10.4/sql/mysqld.cc:6682

    #7 0x561f4fc9c782 in mysqld_main(int, char**) /git/10.4/sql/mysqld.cc:5952

    #8 0x561f4fc8680f in main /git/10.4/sql/main.cc:25

    #9 0x7f7ec29be82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-use-after-free /git/10.4/storage/maria/ma_state.c:679 _ma_block_start_trans

Shadow bytes around the buggy address:

  0x0c228000d870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c228000d880: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa

  0x0c228000d890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c228000d8a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa

  0x0c228000d8b0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

=>0x0c228000d8c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]

  0x0c228000d8d0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa

  0x0c228000d8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c228000d8f0: 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa

  0x0c228000d900: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c228000d910: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

==21790==ABORTING

perl ./runall-new.pl --no-mask --seed=time --duration=500 --queries=10M --reporter=Backtrace,ErrorLog,Deadlock --validator=TransformerNoComparator --transformer=ConvertSubqueriesToViews,ConvertTablesToDerived,Count,DisableIndexes,DisableOptimizations,Distinct,EnableOptimizations,ExecuteAsCTE,ExecuteAsDeleteReturning,ExecuteAsDerived,ExecuteAsExcept,ExecuteAsExecuteImmediate,ExecuteAsInsertSelect,ExecuteAsIntersect,ExecuteAsSelectItem,ExecuteAsUnion,ExecuteAsUpdateDelete,ExecuteAsView,ExecuteAsWhereSubquery,Having,InlineSubqueries,InlineVirtualColumns,LimitRowsExamined,OrderBy,StraightJoin,ExecuteAsPreparedTwice,ExecuteAsTrigger,ExecuteAsSPTwice,ExecuteAsFunctionTwice --mysqld=--log_output=FILE --querytimeout=30 --redefine=conf/mariadb/versioning.yy --vcols --views=TEMPTABLE --grammar=conf/mariadb/instant_add.yy --gendata=conf/optimizer/blobs.zz --engine=Aria --mysqld=--default-storage-engine=Aria --threads=4 --mysqld=--big-tables --mysqld=--query_cache_size=1M --mysqld=--query_cache_type=1 --basedir1=/git/10.4 --vardir1=/1