ASAN heap-use-after-free in _ma_get_status upon concurrent operations with sequence

--let $run= 100

CREATE SEQUENCE s1 ENGINE=Aria;

while ($run)

{

  --connection default

  SELECT NEXTVAL(s1) UNION SELECT NEXTVAL(s1);

  LOCK TABLE s1 READ;

  --connect (con1,localhost,root,,test)

  --send

    SELECT NEXTVAL(s1) ;

  --connect (con2,localhost,root,,test)

  SELECT * FROM s1;

  --connect (con3,localhost,root,,test)

  --send

    FLUSH TABLES;

  --disconnect con2

  --disconnect con1

  --disconnect con3

  --connection default

  UNLOCK TABLES;

  --dec $run

}

DROP SEQUENCE s1;

==28605==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290001182b0 at pc 0x55fd1c701b9e bp 0x7f88f8fdc500 sp 0x7f88f8fdc4f8

READ of size 8 at 0x6290001182b0 thread T6

    #0 0x55fd1c701b9d in _ma_get_status /data/src/10.3/storage/maria/ma_state.c:293

    #1 0x55fd1d33debb in wait_for_lock /data/src/10.3/mysys/thr_lock.c:638

    #2 0x55fd1d33fcad in thr_lock /data/src/10.3/mysys/thr_lock.c:1014

    #3 0x55fd1d34163b in thr_multi_lock /data/src/10.3/mysys/thr_lock.c:1295

    #4 0x55fd1c4f1189 in mysql_lock_tables(THD*, st_mysql_lock*, unsigned int) /data/src/10.3/sql/lock.cc:355

    #5 0x55fd1c4f0c75 in mysql_lock_tables(THD*, TABLE**, unsigned int, unsigned int) /data/src/10.3/sql/lock.cc:304

    #6 0x55fd1b9cfbe7 in lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /data/src/10.3/sql/sql_base.cc:5261

    #7 0x55fd1b9ce307 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5005

    #8 0x55fd1b93f488 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:502

    #9 0x55fd1bb28735 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6469

    #10 0x55fd1bb17579 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3769

    #11 0x55fd1bb31fa0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8092

    #12 0x55fd1bb0c078 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1851

    #13 0x55fd1bb09100 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396

    #14 0x55fd1be7b364 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402

    #15 0x55fd1be7ad70 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #16 0x55fd1c9ad0f7 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862

    #17 0x7f8905a91493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

    #18 0x7f8903e7793e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x6290001182b0 is located 176 bytes inside of 18396-byte region [0x629000118200,0x62900011c9dc)

freed by thread T5 here:

    #0 0x7f8905cfb527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)

    #1 0x55fd1d359b22 in free_memory /data/src/10.3/mysys/safemalloc.c:279

    #2 0x55fd1d359128 in sf_free /data/src/10.3/mysys/safemalloc.c:197

    #3 0x55fd1d329b22 in my_free /data/src/10.3/mysys/my_malloc.c:222

    #4 0x55fd1c89ed6e in maria_close /data/src/10.3/storage/maria/ma_close.c:269

    #5 0x55fd1c7300d9 in ha_maria::close() /data/src/10.3/storage/maria/ha_maria.cc:1275

    #6 0x55fd1d2b793b in ha_sequence::close() /data/src/10.3/sql/ha_sequence.h:135

    #7 0x55fd1c238160 in handler::ha_close() /data/src/10.3/sql/handler.cc:2751

    #8 0x55fd1bdc2370 in closefrm(TABLE*) /data/src/10.3/sql/table.cc:3580

    #9 0x55fd1c026a4c in intern_close_table /data/src/10.3/sql/table_cache.cc:222

    #10 0x55fd1c026cb2 in tc_remove_table /data/src/10.3/sql/table_cache.cc:260

    #11 0x55fd1c027f8e in tc_release_table(TABLE*) /data/src/10.3/sql/table_cache.cc:474

    #12 0x55fd1b9bb389 in close_thread_table(THD*, TABLE**) /data/src/10.3/sql/sql_base.cc:912

    #13 0x55fd1b9baaa8 in close_thread_tables(THD*) /data/src/10.3/sql/sql_base.cc:854

    #14 0x55fd1b9c195f in Locked_tables_list::unlock_locked_tables(THD*) /data/src/10.3/sql/sql_base.cc:2273

    #15 0x55fd1bb1f6db in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:5168

    #16 0x55fd1bb31fa0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8092

    #17 0x55fd1bb0c078 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1851

    #18 0x55fd1bb09100 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396

    #19 0x55fd1be7b364 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402

    #20 0x55fd1be7ad70 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #21 0x55fd1c9ad0f7 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862

    #22 0x7f8905a91493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

previously allocated by thread T5 here:

    #0 0x7f8905cfb73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)

    #1 0x55fd1d358898 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118

    #2 0x55fd1d329215 in my_malloc /data/src/10.3/mysys/my_malloc.c:101

    #3 0x55fd1d306e6a in my_multi_malloc /data/src/10.3/mysys/mulalloc.c:51

    #4 0x55fd1c7cd6ad in maria_clone_internal /data/src/10.3/storage/maria/ma_open.c:117

    #5 0x55fd1c7d6b87 in maria_open /data/src/10.3/storage/maria/ma_open.c:1056

    #6 0x55fd1c72f22c in ha_maria::open(char const*, int, unsigned int) /data/src/10.3/storage/maria/ha_maria.cc:1201

    #7 0x55fd1d2b4164 in ha_sequence::open(char const*, int, unsigned int) /data/src/10.3/sql/ha_sequence.cc:84

    #8 0x55fd1c237266 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.3/sql/handler.cc:2685

    #9 0x55fd1bdc14ae in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.3/sql/table.cc:3482

    #10 0x55fd1b9bf946 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:1975

    #11 0x55fd1b9c7022 in open_and_process_table /data/src/10.3/sql/sql_base.cc:3596

    #12 0x55fd1b9c9a03 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4121

    #13 0x55fd1b9ce21b in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4996

    #14 0x55fd1b93f488 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:502

    #15 0x55fd1bb28735 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6469

    #16 0x55fd1bb17579 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3769

    #17 0x55fd1bb31fa0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8092

    #18 0x55fd1bb0c078 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1851

    #19 0x55fd1bb09100 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396

    #20 0x55fd1be7b364 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402

    #21 0x55fd1be7ad70 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #22 0x55fd1c9ad0f7 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862

    #23 0x7f8905a91493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

Thread T6 created by T0 here:

    #0 0x7f8905ccabba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)

    #1 0x55fd1c9ad6bf in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912

    #2 0x55fd1b873d68 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268

    #3 0x55fd1b889efa in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6572

    #4 0x55fd1b88a5ff in create_new_thread /data/src/10.3/sql/mysqld.cc:6642

    #5 0x55fd1b88b616 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6917

    #6 0x55fd1b8893b7 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6194

    #7 0x55fd1b871def in main /data/src/10.3/sql/main.cc:25

    #8 0x7f8903daf2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

Thread T5 created by T0 here:

    #0 0x7f8905ccabba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)

    #1 0x55fd1c9ad6bf in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912

    #2 0x55fd1b873d68 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268

    #3 0x55fd1b889efa in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6572

    #4 0x55fd1b88a5ff in create_new_thread /data/src/10.3/sql/mysqld.cc:6642

    #5 0x55fd1b88b616 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6917

    #6 0x55fd1b8893b7 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6194

    #7 0x55fd1b871def in main /data/src/10.3/sql/main.cc:25

    #8 0x7f8903daf2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/maria/ma_state.c:293 _ma_get_status

Shadow bytes around the buggy address:

  0x0c528001b000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c528001b010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c528001b020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c528001b030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c528001b040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c528001b050: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd

  0x0c528001b060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c528001b070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c528001b080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c528001b090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c528001b0a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Contiguous container OOB:fc

  ASan internal:           fe

==28605==ABORTING