ASAN heap-use-after-free in ha_maria::store_lock

CREATE TABLE t1 (a INT, b INT) ENGINE=Aria ROW_FORMAT FIXED;

LOCK TABLE t1 as tt WRITE, t1 WRITE CONCURRENT;

ALTER TABLE t1 DROP b;

ALTER TABLE t1 CHANGE COLUMN IF EXISTS c d INT;

# Cleanup

UNLOCK TABLES;

DROP TABLE t1;

==8844==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290000eb290 at pc 0x55641f732002 bp 0x7fad428d0af0 sp 0x7fad428d0ae8

READ of size 8 at 0x6290000eb290 thread T5

    #0 0x55641f732001 in ha_maria::store_lock(THD*, st_thr_lock_data**, thr_lock_type) /data/src/10.3/storage/maria/ha_maria.cc:3008

    #1 0x55641f4e99b1 in get_lock_data(THD*, TABLE**, unsigned int, unsigned int) /data/src/10.3/sql/lock.cc:793

    #2 0x55641f4e54a9 in mysql_lock_tables(THD*, TABLE**, unsigned int, unsigned int) /data/src/10.3/sql/lock.cc:301

    #3 0x55641e9b0f28 in Locked_tables_list::reopen_tables(THD*, bool) /data/src/10.3/sql/sql_base.cc:2521

    #4 0x55641eb15be3 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6315

    #5 0x55641eb208df in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8091

    #6 0x55641eafaa07 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1857

    #7 0x55641eaf7a5d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1403

    #8 0x55641ee6b5c5 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402

    #9 0x55641ee6afd1 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #10 0x55641f9a1c61 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862

    #11 0x7fad4f0ed493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

    #12 0x7fad4d2bb93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x6290000eb290 is located 144 bytes inside of 18396-byte region [0x6290000eb200,0x6290000ef9dc)

freed by thread T5 here:

    #0 0x7fad4f357527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)

    #1 0x556420354021 in free_memory /data/src/10.3/mysys/safemalloc.c:279

    #2 0x556420353627 in sf_free /data/src/10.3/mysys/safemalloc.c:197

    #3 0x556420324070 in my_free /data/src/10.3/mysys/my_malloc.c:223

    #4 0x55641f8938b4 in maria_close /data/src/10.3/storage/maria/ma_close.c:258

    #5 0x55641f724bb5 in ha_maria::close() /data/src/10.3/storage/maria/ha_maria.cc:1275

    #6 0x55641f22b9a4 in handler::ha_close() /data/src/10.3/sql/handler.cc:2799

    #7 0x55641edb16d8 in closefrm(TABLE*) /data/src/10.3/sql/table.cc:3593

    #8 0x55641f019381 in intern_close_table /data/src/10.3/sql/table_cache.cc:222

    #9 0x55641f0195e7 in tc_remove_table /data/src/10.3/sql/table_cache.cc:260

    #10 0x55641f01a8c3 in tc_release_table(TABLE*) /data/src/10.3/sql/table_cache.cc:474

    #11 0x55641e9a982f in close_thread_table(THD*, TABLE**) /data/src/10.3/sql/sql_base.cc:912

    #12 0x55641e9a82c4 in close_all_tables_for_name(THD*, TABLE_SHARE*, ha_extra_function, TABLE*) /data/src/10.3/sql/sql_base.cc:680

    #13 0x55641e9b0aa1 in Locked_tables_list::reopen_tables(THD*, bool) /data/src/10.3/sql/sql_base.cc:2484

    #14 0x55641eb15be3 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6315

    #15 0x55641eb208df in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8091

    #16 0x55641eafaa07 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1857

    #17 0x55641eaf7a5d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1403

    #18 0x55641ee6b5c5 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402

    #19 0x55641ee6afd1 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #20 0x55641f9a1c61 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862

    #21 0x7fad4f0ed493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

previously allocated by thread T5 here:

    #0 0x7fad4f35773f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)

    #1 0x556420352d97 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118

    #2 0x556420323692 in my_malloc /data/src/10.3/mysys/my_malloc.c:101

    #3 0x556420300ed3 in my_multi_malloc /data/src/10.3/mysys/mulalloc.c:51

    #4 0x55641f7c2231 in maria_clone_internal /data/src/10.3/storage/maria/ma_open.c:117

    #5 0x55641f7cb70b in maria_open /data/src/10.3/storage/maria/ma_open.c:1056

    #6 0x55641f723d06 in ha_maria::open(char const*, int, unsigned int) /data/src/10.3/storage/maria/ha_maria.cc:1201

    #7 0x55641f22aaaa in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.3/sql/handler.cc:2733

    #8 0x55641edb0816 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.3/sql/table.cc:3495

    #9 0x55641e9addec in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:1975

    #10 0x55641e9b0ba7 in Locked_tables_list::reopen_tables(THD*, bool) /data/src/10.3/sql/sql_base.cc:2494

    #11 0x55641ed3089f in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:10077

    #12 0x55641ee7a513 in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:494

    #13 0x55641eb15a50 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6285

    #14 0x55641eb208df in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8091

    #15 0x55641eafaa07 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1857

    #16 0x55641eaf7a5d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1403

    #17 0x55641ee6b5c5 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402

    #18 0x55641ee6afd1 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #19 0x55641f9a1c61 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862

    #20 0x7fad4f0ed493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

Thread T5 created by T0 here:

    #0 0x7fad4f326bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)

    #1 0x55641f9a2229 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912

    #2 0x55641e863318 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268

    #3 0x55641e878cae in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6589

    #4 0x55641e8793b3 in create_new_thread /data/src/10.3/sql/mysqld.cc:6659

    #5 0x55641e87a3ca in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6934

    #6 0x55641e87816b in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6211

    #7 0x55641e86139f in main /data/src/10.3/sql/main.cc:25

    #8 0x7fad4d1f32b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/maria/ha_maria.cc:3008 ha_maria::store_lock(THD*, st_thr_lock_data**, thr_lock_type)

Shadow bytes around the buggy address:

  0x0c5280015600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c5280015610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c5280015620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c5280015630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c5280015640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c5280015650: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c5280015660: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c5280015670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c5280015680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c5280015690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c52800156a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Contiguous container OOB:fc

  ASan internal:           fe

==8844==ABORTING