[MDEV-29002] ASAN errors in spider_conn_queue_and_merge_loop_check - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL)
Fix Version/s: 10.5.24, 10.6.17, 10.11.7, 11.0.5, 11.1.4, 11.2.3
Component/s: Storage Engine - Spider
Labels:
- ASAN
- memory_corruption

Description

--source plugin/spider/spider/include/init_spider.inc

SET spider_same_server_link= on;

eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT);

CREATE TABLE t (a INT);

CREATE TABLE t1_spider (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't'";

CREATE TABLE t2_spider (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't'";

SELECT * FROM t1_spider, t2_spider;

SELECT table_name, index_name, cardinality FROM INFORMATION_SCHEMA.STATISTICS WHERE table_name IN ('t1_spider','t2_spider');

RENAME TABLE t1_spider TO t3_spider;

SELECT * FROM t3_spider;

# Cleanup

DROP TABLE t3_spider, t2_spider, t;

--source plugin/spider/spider/include/deinit_spider.inc

10.5 a1267724
==3280==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000025b48 at pc 0x7f41c82328e8 bp 0x7f41c8b068b0 sp 0x7f41c8b068a8
WRITE of size 8 at 0x614000025b48 thread T5
#0 0x7f41c82328e7 in spider_conn_queue_and_merge_loop_check(st_spider_conn, st_spider_conn_loop_check) /data/src/10.5/storage/spider/spd_conn.cc:1763:43
#1 0x7f41c822b2e3 in spider_conn_queue_loop_check(st_spider_conn, ha_spider, int) /data/src/10.5/storage/spider/spd_conn.cc:2038:20
#2 0x7f41c822584e in spider_get_conn(st_spider_share, int, char, st_spider_transaction, ha_spider, bool, bool, unsigned int, int*) /data/src/10.5/storage/spider/spd_conn.cc:1373:9
#3 0x7f41c82d6534 in spider_get_share(char const, TABLE, THD, ha_spider, int*) /data/src/10.5/storage/spider/spd_table.cc:5350:13
#4 0x7f41c83b3d36 in ha_spider::open(char const*, int, unsigned int) /data/src/10.5/storage/spider/ha_spider.cc:444:18
#5 0x180128c in handler::ha_open(TABLE, char const, int, unsigned int, st_mem_root, List<String>) /data/src/10.5/sql/handler.cc:3013:7
#6 0x117a570 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /data/src/10.5/sql/table.cc:4322:33
#7 0xada623 in open_table(THD, TABLE_LIST, Open_table_context*) /data/src/10.5/sql/sql_base.cc:2014:12
#8 0xae9aea in open_and_process_table(THD, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy, bool, Open_table_context*) /data/src/10.5/sql/sql_base.cc:3805:14
#9 0xae5777 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:4288:14
#10 0xaf3ab8 in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:5235:7
#11 0xa01153 in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /data/src/10.5/sql/sql_base.h:507:10
#12 0xd3568f in execute_sqlcom_select(THD, TABLE_LIST) /data/src/10.5/sql/sql_parse.cc:6235:14
#13 0xd1ad80 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4005:12
#14 0xd01ae2 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8100:18
#15 0xcf9d4d in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891:7
#16 0xd04374 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375:17
#17 0x12ad9ef in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1418:11
#18 0x12acf73 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312:5
#19 0x23b95f7 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201:3
#20 0x7f41d208bea6 in start_thread nptl/pthread_create.c:477:8
#21 0x7f41d1dc3dee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x614000025b48 is located 264 bytes inside of 436-byte region [0x614000025a40,0x614000025bf4)
freed by thread T5 here:
#0 0x89b3ed in free (/mnt8t/bld/10.5-asan/bin/mariadbd+0x89b3ed)
#1 0x3484847 in free_memory /data/src/10.5/mysys/safemalloc.c:280:3
#2 0x348489d in sf_free /data/src/10.5/mysys/safemalloc.c:198:3
#3 0x343cf38 in my_free /data/src/10.5/mysys/my_malloc.c:211:3
#4 0x7f41c837472c in spider_free_mem(st_spider_transaction, void, unsigned long) /data/src/10.5/storage/spider/spd_malloc.cc:188:3
#5 0x7f41c823261b in spider_conn_queue_and_merge_loop_check(st_spider_conn, st_spider_conn_loop_check) /data/src/10.5/storage/spider/spd_conn.cc:1735:5
#6 0x7f41c822b2e3 in spider_conn_queue_loop_check(st_spider_conn, ha_spider, int) /data/src/10.5/storage/spider/spd_conn.cc:2038:20
#7 0x7f41c822584e in spider_get_conn(st_spider_share, int, char, st_spider_transaction, ha_spider, bool, bool, unsigned int, int*) /data/src/10.5/storage/spider/spd_conn.cc:1373:9
#8 0x7f41c82d6534 in spider_get_share(char const, TABLE, THD, ha_spider, int*) /data/src/10.5/storage/spider/spd_table.cc:5350:13
#9 0x7f41c83b3d36 in ha_spider::open(char const*, int, unsigned int) /data/src/10.5/storage/spider/ha_spider.cc:444:18
#10 0x180128c in handler::ha_open(TABLE, char const, int, unsigned int, st_mem_root, List<String>) /data/src/10.5/sql/handler.cc:3013:7
#11 0x117a570 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /data/src/10.5/sql/table.cc:4322:33
#12 0xada623 in open_table(THD, TABLE_LIST, Open_table_context*) /data/src/10.5/sql/sql_base.cc:2014:12
#13 0xae9aea in open_and_process_table(THD, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy, bool, Open_table_context*) /data/src/10.5/sql/sql_base.cc:3805:14
#14 0xae5777 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:4288:14
#15 0xaf3ab8 in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:5235:7
#16 0xa01153 in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /data/src/10.5/sql/sql_base.h:507:10
#17 0xd3568f in execute_sqlcom_select(THD, TABLE_LIST) /data/src/10.5/sql/sql_parse.cc:6235:14
#18 0xd1ad80 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4005:12
#19 0xd01ae2 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8100:18
#20 0xcf9d4d in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891:7
#21 0xd04374 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375:17
#22 0x12ad9ef in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1418:11
#23 0x12acf73 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312:5
#24 0x23b95f7 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201:3
#25 0x7f41d208bea6 in start_thread nptl/pthread_create.c:477:8

previously allocated by thread T5 here:
#0 0x89b66d in malloc (/mnt8t/bld/10.5-asan/bin/mariadbd+0x89b66d)
#1 0x34837fb in sf_malloc /data/src/10.5/mysys/safemalloc.c:121:34
#2 0x343bb73 in my_malloc /data/src/10.5/mysys/my_malloc.c:90:29
#3 0x7f41c8375440 in spider_bulk_alloc_mem(st_spider_transaction, unsigned int, char const, char const*, unsigned long, unsigned long, ...) /data/src/10.5/storage/spider/spd_malloc.cc:236:29
#4 0x7f41c8231415 in spider_conn_queue_and_merge_loop_check(st_spider_conn, st_spider_conn_loop_check) /data/src/10.5/storage/spider/spd_conn.cc:1679:9
#5 0x7f41c822b2e3 in spider_conn_queue_loop_check(st_spider_conn, ha_spider, int) /data/src/10.5/storage/spider/spd_conn.cc:2038:20
#6 0x7f41c822584e in spider_get_conn(st_spider_share, int, char, st_spider_transaction, ha_spider, bool, bool, unsigned int, int*) /data/src/10.5/storage/spider/spd_conn.cc:1373:9
#7 0x7f41c812b4f7 in spider_check_trx_and_get_conn(THD, ha_spider, bool) /data/src/10.5/storage/spider/spd_trx.cc:3825:15
#8 0x7f41c8467e25 in ha_spider::check_crd() /data/src/10.5/storage/spider/ha_spider.cc:9138:20
#9 0x7f41c8464570 in ha_spider::info(unsigned int) /data/src/10.5/storage/spider/ha_spider.cc:8674:24
#10 0xfd25d3 in get_schema_stat_record(THD, TABLE_LIST, TABLE, bool, st_mysql_const_lex_string const, st_mysql_const_lex_string const*) /data/src/10.5/sql/sql_show.cc:6713:25
#11 0xf9b265 in fill_schema_table_by_open(THD, st_mem_root, bool, TABLE, st_schema_table, st_mysql_const_lex_string, st_mysql_const_lex_string, Open_tables_backup*, bool) /data/src/10.5/sql/sql_show.cc:4682:13
#12 0xf99efc in get_all_tables(THD, TABLE_LIST, Item*) /data/src/10.5/sql/sql_show.cc:5316:17
#13 0xfc1c79 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.5/sql/sql_show.cc:8854:11
#14 0xe8d942 in JOIN::exec_inner() /data/src/10.5/sql/sql_select.cc:4497:7
#15 0xe8aac6 in JOIN::exec() /data/src/10.5/sql/sql_select.cc:4320:3
#16 0xe0685b in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.5/sql/sql_select.cc:4797:9
#17 0xe05482 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:444:10
#18 0xd36648 in execute_sqlcom_select(THD, TABLE_LIST) /data/src/10.5/sql/sql_parse.cc:6314:12
#19 0xd1ad80 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4005:12
#20 0xd01ae2 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8100:18
#21 0xcf9d4d in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891:7
#22 0xd04374 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375:17
#23 0x12ad9ef in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1418:11
#24 0x12acf73 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312:5
#25 0x23b95f7 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201:3
#26 0x7f41d208bea6 in start_thread nptl/pthread_create.c:477:8

Thread T5 created by T0 here:
#0 0x88609a in pthread_create (/mnt8t/bld/10.5-asan/bin/mariadbd+0x88609a)
#1 0x23b9c4c in my_thread_create(unsigned long, pthread_attr_t const, void* ()(void), void*) /data/src/10.5/storage/perfschema/my_thread.h:52:10
#2 0x23b9bd6 in pfs_spawn_thread_v1 /data/src/10.5/storage/perfschema/pfs.cc:2252:15
#3 0x8d4ab2 in inline_mysql_thread_create(unsigned int, unsigned long, pthread_attr_t const, void* ()(void), void*) /data/src/10.5/include/mysql/psi/mysql_thread.h:1323:11
#4 0x8e671f in create_thread_to_handle_connection(CONNECT*) /data/src/10.5/sql/mysqld.cc:6051:19
#5 0x8e704e in create_new_thread(CONNECT*) /data/src/10.5/sql/mysqld.cc:6110:3
#6 0x8e7ab0 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.5/sql/mysqld.cc:6175:5
#7 0x8e49a4 in handle_connections_sockets() /data/src/10.5/sql/mysqld.cc:6302:9
#8 0x8d8c34 in mysqld_main(int, char**) /data/src/10.5/sql/mysqld.cc:5697:3
#9 0x8cdc11 in main /data/src/10.5/sql/main.cc:25:10
#10 0x7f41d1cecd09 in __libc_start_main csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.5/storage/spider/spd_conn.cc:1763:43 in spider_conn_queue_and_merge_loop_check(st_spider_conn, st_spider_conn_loop_check)
Shadow bytes around the buggy address:
0x0c287fffcb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c287fffcb20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c287fffcb30: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa
0x0c287fffcb40: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c287fffcb50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c287fffcb60: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd
0x0c287fffcb70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
0x0c287fffcb80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c287fffcb90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c287fffcba0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c287fffcbb0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc

Couldn't reproduce on 10.4.

Attachments

Issue Links

relates to

MDEV-27902 Spider: Crashes, asserts, hangs, memory corruptions and ASAN heap-use-after-free's

Closed

Activity

Ascending order - Click to sort in descending order

Roel Van de Paar added a comment - 2023-06-06 08:35 - edited

I ran into this issue also

INSTALL PLUGIN Spider SONAME 'ha_spider.so';

CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET'',DATABASE'',USER'',PASSWORD'');

CREATE TABLE t1 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",HOST "srv",TABLE "t"';

CREATE TABLE t2 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",HOST "srv",TABLE "t"';

CREATE TABLE t3 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",HOST "srv",TABLE "t"';

SHOW TABLE STATUS;

Or MTR:

IF (`SELECT NOT(COUNT(*)) FROM information_schema.system_variables WHERE variable_name='have_sanitizer' AND global_value like "%UBSAN%"`)

--skip test needs to be run with UBSAN

--source include/have_innodb.inc

--let $SOCKET= `SELECT @@global.socket`

INSTALL PLUGIN Spider SONAME 'ha_spider.so';

CREATE USER spider@localhost IDENTIFIED BY 'pwd';

GRANT ALL ON test.* TO spider@localhost;

eval CREATE SERVER s FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET "$SOCKET",DATABASE 'test',USER 'spider',PASSWORD 'pwd');

CREATE TABLE t1 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",HOST "srv",TABLE "t"';

CREATE TABLE t2 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",HOST "srv",TABLE "t"';

CREATE TABLE t3 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",HOST "srv",TABLE "t"';

SHOW TABLE STATUS;

Leads to:

11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug, UBASAN)
==2504563==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000085bd8 at pc 0x14564335d760 bp 0x145643f66b60 sp 0x145643f66b50
WRITE of size 8 at 0x612000085bd8 thread T33
#0 0x14564335d75f in spider_conn_queue_and_merge_loop_check(st_spider_conn, st_spider_conn_loop_check) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1184
#1 0x145643360240 in spider_conn_queue_loop_check(st_spider_conn, ha_spider, int) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1430
#2 0x145643380b6f in spider_get_conn(st_spider_share, int, char, st_spider_transaction, ha_spider, bool, bool, int*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:832
#3 0x1456433977cf in spider_share_get_conns(ha_spider, st_spider_share, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:4868
#4 0x14564340505c in spider_init_share(char const, TABLE, THD, ha_spider, int, st_spider_share, TABLE_SHARE*, bool) /test/11.0_dbg_san/storage/spider/spd_table.cc:5138
#5 0x145643406475 in spider_get_share(char const, TABLE, THD, ha_spider, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:5252
#6 0x145643505021 in ha_spider::open(char const*, int, unsigned int) /test/11.0_dbg_san/storage/spider/ha_spider.cc:312
#7 0x55b0cc3c7235 in handler::ha_open(TABLE, char const, int, unsigned int, st_mem_root, List<String>) /test/11.0_dbg_san/sql/handler.cc:3487
#8 0x55b0cb510885 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4540
#9 0x55b0ca85f3e3 in open_table(THD, TABLE_LIST, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178
#10 0x55b0ca876f14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108
#11 0x55b0ca876f14 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595
#12 0x55b0ca87ec14 in open_tables /test/11.0_dbg_san/sql/sql_base.h:266
#13 0x55b0ca87ec14 in open_normal_and_derived_tables(THD, TABLE_LIST, unsigned int, unsigned int) /test/11.0_dbg_san/sql/sql_base.cc:5634
#14 0x55b0ca87f81e in open_tables_only_view_structure(THD, TABLE_LIST, bool) /test/11.0_dbg_san/sql/sql_base.cc:5685
#15 0x55b0cb126ebe in fill_schema_table_by_open /test/11.0_dbg_san/sql/sql_show.cc:4714
#16 0x55b0cb238c13 in get_all_tables(THD, TABLE_LIST, Item*) /test/11.0_dbg_san/sql/sql_show.cc:5385
#17 0x55b0cb240dc4 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.0_dbg_san/sql/sql_show.cc:9060
#18 0x55b0cb0dc83c in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4857
#19 0x55b0cb0e0916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677
#20 0x55b0cb0cf0c1 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.0_dbg_san/sql/sql_select.cc:5158
#21 0x55b0cb0d351c in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616
#22 0x55b0cac45a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279
#23 0x55b0caca6ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
#24 0x55b0cacd6973 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
#25 0x55b0cace6707 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
#26 0x55b0cacf4542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
#27 0x55b0cb6c98b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
#28 0x55b0cb6cadd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
#29 0x145668c94b42 in start_thread nptl/pthread_create.c:442
#30 0x145668d269ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

0x612000085bd8 is located 152 bytes inside of 296-byte region [0x612000085b40,0x612000085c68)
freed by thread T33 here:
#0 0x55b0ca35afe7 in __interceptor_free (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7963fe7)
#1 0x55b0cea72a61 in my_free /test/11.0_dbg_san/mysys/my_malloc.c:213
#2 0x145643452150 in spider_free_mem(st_spider_transaction, void, unsigned long) /test/11.0_dbg_san/storage/spider/spd_malloc.cc:183
#3 0x14564335d3cd in spider_conn_queue_and_merge_loop_check(st_spider_conn, st_spider_conn_loop_check) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1166
#4 0x145643360240 in spider_conn_queue_loop_check(st_spider_conn, ha_spider, int) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1430
#5 0x145643380b6f in spider_get_conn(st_spider_share, int, char, st_spider_transaction, ha_spider, bool, bool, int*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:832
#6 0x1456433977cf in spider_share_get_conns(ha_spider, st_spider_share, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:4868
#7 0x14564340505c in spider_init_share(char const, TABLE, THD, ha_spider, int, st_spider_share, TABLE_SHARE*, bool) /test/11.0_dbg_san/storage/spider/spd_table.cc:5138
#8 0x145643406475 in spider_get_share(char const, TABLE, THD, ha_spider, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:5252
#9 0x145643505021 in ha_spider::open(char const*, int, unsigned int) /test/11.0_dbg_san/storage/spider/ha_spider.cc:312
#10 0x55b0cc3c7235 in handler::ha_open(TABLE, char const, int, unsigned int, st_mem_root, List<String>) /test/11.0_dbg_san/sql/handler.cc:3487
#11 0x55b0cb510885 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4540
#12 0x55b0ca85f3e3 in open_table(THD, TABLE_LIST, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178
#13 0x55b0ca876f14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108
#14 0x55b0ca876f14 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595
#15 0x55b0ca87ec14 in open_tables /test/11.0_dbg_san/sql/sql_base.h:266
#16 0x55b0ca87ec14 in open_normal_and_derived_tables(THD, TABLE_LIST, unsigned int, unsigned int) /test/11.0_dbg_san/sql/sql_base.cc:5634
#17 0x55b0ca87f81e in open_tables_only_view_structure(THD, TABLE_LIST, bool) /test/11.0_dbg_san/sql/sql_base.cc:5685
#18 0x55b0cb126ebe in fill_schema_table_by_open /test/11.0_dbg_san/sql/sql_show.cc:4714
#19 0x55b0cb238c13 in get_all_tables(THD, TABLE_LIST, Item*) /test/11.0_dbg_san/sql/sql_show.cc:5385
#20 0x55b0cb240dc4 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.0_dbg_san/sql/sql_show.cc:9060
#21 0x55b0cb0dc83c in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4857
#22 0x55b0cb0e0916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677
#23 0x55b0cb0cf0c1 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.0_dbg_san/sql/sql_select.cc:5158
#24 0x55b0cb0d351c in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616
#25 0x55b0cac45a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279
#26 0x55b0caca6ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
#27 0x55b0cacd6973 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
#28 0x55b0cace6707 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
#29 0x55b0cacf4542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
#30 0x55b0cb6c98b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
#31 0x55b0cb6cadd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318

previously allocated by thread T33 here:
#0 0x55b0ca35b337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337)
#1 0x55b0cea72703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91
#2 0x145643452583 in spider_bulk_alloc_mem(st_spider_transaction, unsigned int, char const, char const*, unsigned long, unsigned long, ...) /test/11.0_dbg_san/storage/spider/spd_malloc.cc:231
#3 0x14564335c1b5 in spider_conn_queue_and_merge_loop_check(st_spider_conn, st_spider_conn_loop_check) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1119
#4 0x145643360240 in spider_conn_queue_loop_check(st_spider_conn, ha_spider, int) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1430
#5 0x145643380b6f in spider_get_conn(st_spider_share, int, char, st_spider_transaction, ha_spider, bool, bool, int*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:832
#6 0x1456433977cf in spider_share_get_conns(ha_spider, st_spider_share, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:4868
#7 0x14564340505c in spider_init_share(char const, TABLE, THD, ha_spider, int, st_spider_share, TABLE_SHARE*, bool) /test/11.0_dbg_san/storage/spider/spd_table.cc:5138
#8 0x145643406475 in spider_get_share(char const, TABLE, THD, ha_spider, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:5252
#9 0x145643505021 in ha_spider::open(char const*, int, unsigned int) /test/11.0_dbg_san/storage/spider/ha_spider.cc:312
#10 0x55b0cc3c7235 in handler::ha_open(TABLE, char const, int, unsigned int, st_mem_root, List<String>) /test/11.0_dbg_san/sql/handler.cc:3487
#11 0x55b0cb510885 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4540
#12 0x55b0ca85f3e3 in open_table(THD, TABLE_LIST, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178
#13 0x55b0ca876f14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108
#14 0x55b0ca876f14 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595
#15 0x55b0ca87ec14 in open_tables /test/11.0_dbg_san/sql/sql_base.h:266
#16 0x55b0ca87ec14 in open_normal_and_derived_tables(THD, TABLE_LIST, unsigned int, unsigned int) /test/11.0_dbg_san/sql/sql_base.cc:5634
#17 0x55b0ca87f81e in open_tables_only_view_structure(THD, TABLE_LIST, bool) /test/11.0_dbg_san/sql/sql_base.cc:5685
#18 0x55b0cb126ebe in fill_schema_table_by_open /test/11.0_dbg_san/sql/sql_show.cc:4714
#19 0x55b0cb238c13 in get_all_tables(THD, TABLE_LIST, Item*) /test/11.0_dbg_san/sql/sql_show.cc:5385
#20 0x55b0cb240dc4 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.0_dbg_san/sql/sql_show.cc:9060
#21 0x55b0cb0dc83c in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4857
#22 0x55b0cb0e0916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677
#23 0x55b0cb0cf0c1 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.0_dbg_san/sql/sql_select.cc:5158
#24 0x55b0cb0d351c in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616
#25 0x55b0cac45a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279
#26 0x55b0caca6ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
#27 0x55b0cacd6973 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
#28 0x55b0cace6707 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
#29 0x55b0cacf4542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
#30 0x55b0cb6c98b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
#31 0x55b0cb6cadd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318

Thread T33 created by T0 here:
#0 0x55b0ca2ff175 in pthread_create (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7908175)
#1 0x55b0ca3b598b in create_thread_to_handle_connection(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6129
#2 0x55b0ca3c2e67 in create_new_thread(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6191
#3 0x55b0ca3c36e7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_dbg_san/sql/mysqld.cc:6253
#4 0x55b0ca3c4738 in handle_connections_sockets() /test/11.0_dbg_san/sql/mysqld.cc:6377
#5 0x55b0ca3cbee7 in mysqld_main(int, char**) /test/11.0_dbg_san/sql/mysqld.cc:6024
#6 0x55b0ca3a0eca in main /test/11.0_dbg_san/sql/main.cc:34
#7 0x145668c29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free /test/11.0_dbg_san/storage/spider/spd_conn.cc:1184 in spider_conn_queue_and_merge_loop_check(st_spider_conn, st_spider_conn_loop_check)
Shadow bytes around the buggy address:
0x0c2480008b20: 00 00 00 00 00 00 00 00 00 00 00 00 f7 fa fa fa
0x0c2480008b30: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c2480008b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2480008b50: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
0x0c2480008b60: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c2480008b70: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
0x0c2480008b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
0x0c2480008b90: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c2480008ba0: 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00
0x0c2480008bb0: 00 00 00 00 00 00 00 00 00 00 00 00 f7 fa fa fa
0x0c2480008bc0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==2504563==ABORTING

And:

11.1.0 4e5b771e980edfdad5c5414aa62c81d409d585a4 (Debug, UBASAN)
==1000503==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000086358 at pc 0x153e2436a8da bp 0x153e25057bd0 sp 0x153e25057bc0
WRITE of size 8 at 0x612000086358 thread T22
#0 0x153e2436a8d9 in spider_conn_queue_and_merge_loop_check(st_spider_conn, st_spider_conn_loop_check) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1184
#1 0x153e2436d3ba in spider_conn_queue_loop_check(st_spider_conn, ha_spider, int) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1430
#2 0x153e2438dde3 in spider_get_conn(st_spider_share, int, char, st_spider_transaction, ha_spider, bool, bool, int*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:832
#3 0x153e2440f799 in spider_get_share(char const, TABLE, THD, ha_spider, int*) /test/11.1_dbg_san/storage/spider/spd_table.cc:4927
#4 0x153e24515571 in ha_spider::open(char const*, int, unsigned int) /test/11.1_dbg_san/storage/spider/ha_spider.cc:312
#5 0x56523ecffbff in handler::ha_open(TABLE, char const, int, unsigned int, st_mem_root, List<String>) /test/11.1_dbg_san/sql/handler.cc:3472
#6 0x56523ddf4189 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /test/11.1_dbg_san/sql/table.cc:4570
#7 0x56523d146717 in open_table(THD, TABLE_LIST, Open_table_context*) /test/11.1_dbg_san/sql/sql_base.cc:2210
#8 0x56523d15e248 in open_and_process_table /test/11.1_dbg_san/sql/sql_base.cc:4140
#9 0x56523d15e248 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /test/11.1_dbg_san/sql/sql_base.cc:4627
#10 0x56523d165e77 in open_tables /test/11.1_dbg_san/sql/sql_base.h:267
#11 0x56523d165e77 in open_normal_and_derived_tables(THD, TABLE_LIST, unsigned int, unsigned int) /test/11.1_dbg_san/sql/sql_base.cc:5665
#12 0x56523d166a81 in open_tables_only_view_structure(THD, TABLE_LIST, bool) /test/11.1_dbg_san/sql/sql_base.cc:5716
#13 0x56523da08f2a in fill_schema_table_by_open /test/11.1_dbg_san/sql/sql_show.cc:4713
#14 0x56523db1a672 in get_all_tables(THD, TABLE_LIST, Item*) /test/11.1_dbg_san/sql/sql_show.cc:5384
#15 0x56523db22975 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.1_dbg_san/sql/sql_show.cc:9060
#16 0x56523d9be136 in JOIN::exec_inner() /test/11.1_dbg_san/sql/sql_select.cc:4856
#17 0x56523d9c21ec in JOIN::exec() /test/11.1_dbg_san/sql/sql_select.cc:4676
#18 0x56523d9b09a0 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.1_dbg_san/sql/sql_select.cc:5157
#19 0x56523d9b4dfb in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.1_dbg_san/sql/sql_select.cc:611
#20 0x56523d539cee in execute_sqlcom_select /test/11.1_dbg_san/sql/sql_parse.cc:6024
#21 0x56523d59b661 in mysql_execute_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:3944
#22 0x56523d5c65ab in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.1_dbg_san/sql/sql_parse.cc:7760
#23 0x56523d5d6335 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1892
#24 0x56523d5e413a in do_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1405
#25 0x56523dfac265 in do_handle_one_connection(CONNECT*, bool) /test/11.1_dbg_san/sql/sql_connect.cc:1416
#26 0x56523dfad780 in handle_one_connection /test/11.1_dbg_san/sql/sql_connect.cc:1318
#27 0x153e48694b42 in start_thread nptl/pthread_create.c:442
#28 0x153e487269ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

0x612000086358 is located 152 bytes inside of 296-byte region [0x6120000862c0,0x6120000863e8)
freed by thread T22 here:
#0 0x56523cc42fd7 in __interceptor_free (/test/UBASAN_MD120523-mariadb-11.1.0-linux-x86_64-dbg/bin/mariadbd+0x79f6fd7)
#1 0x56524138fa6e in my_free /test/11.1_dbg_san/mysys/my_malloc.c:213
#2 0x153e244626e2 in spider_free_mem(st_spider_transaction, void, unsigned long) /test/11.1_dbg_san/storage/spider/spd_malloc.cc:183
#3 0x153e2436a547 in spider_conn_queue_and_merge_loop_check(st_spider_conn, st_spider_conn_loop_check) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1166
#4 0x153e2436d3ba in spider_conn_queue_loop_check(st_spider_conn, ha_spider, int) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1430
#5 0x153e2438dde3 in spider_get_conn(st_spider_share, int, char, st_spider_transaction, ha_spider, bool, bool, int*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:832
#6 0x153e2440f799 in spider_get_share(char const, TABLE, THD, ha_spider, int*) /test/11.1_dbg_san/storage/spider/spd_table.cc:4927
#7 0x153e24515571 in ha_spider::open(char const*, int, unsigned int) /test/11.1_dbg_san/storage/spider/ha_spider.cc:312
#8 0x56523ecffbff in handler::ha_open(TABLE, char const, int, unsigned int, st_mem_root, List<String>) /test/11.1_dbg_san/sql/handler.cc:3472
#9 0x56523ddf4189 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /test/11.1_dbg_san/sql/table.cc:4570
#10 0x56523d146717 in open_table(THD, TABLE_LIST, Open_table_context*) /test/11.1_dbg_san/sql/sql_base.cc:2210
#11 0x56523d15e248 in open_and_process_table /test/11.1_dbg_san/sql/sql_base.cc:4140
#12 0x56523d15e248 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /test/11.1_dbg_san/sql/sql_base.cc:4627
#13 0x56523d165e77 in open_tables /test/11.1_dbg_san/sql/sql_base.h:267
#14 0x56523d165e77 in open_normal_and_derived_tables(THD, TABLE_LIST, unsigned int, unsigned int) /test/11.1_dbg_san/sql/sql_base.cc:5665
#15 0x56523d166a81 in open_tables_only_view_structure(THD, TABLE_LIST, bool) /test/11.1_dbg_san/sql/sql_base.cc:5716
#16 0x56523da08f2a in fill_schema_table_by_open /test/11.1_dbg_san/sql/sql_show.cc:4713
#17 0x56523db1a672 in get_all_tables(THD, TABLE_LIST, Item*) /test/11.1_dbg_san/sql/sql_show.cc:5384
#18 0x56523db22975 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.1_dbg_san/sql/sql_show.cc:9060
#19 0x56523d9be136 in JOIN::exec_inner() /test/11.1_dbg_san/sql/sql_select.cc:4856
#20 0x56523d9c21ec in JOIN::exec() /test/11.1_dbg_san/sql/sql_select.cc:4676
#21 0x56523d9b09a0 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.1_dbg_san/sql/sql_select.cc:5157
#22 0x56523d9b4dfb in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.1_dbg_san/sql/sql_select.cc:611
#23 0x56523d539cee in execute_sqlcom_select /test/11.1_dbg_san/sql/sql_parse.cc:6024
#24 0x56523d59b661 in mysql_execute_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:3944
#25 0x56523d5c65ab in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.1_dbg_san/sql/sql_parse.cc:7760
#26 0x56523d5d6335 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1892
#27 0x56523d5e413a in do_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1405
#28 0x56523dfac265 in do_handle_one_connection(CONNECT*, bool) /test/11.1_dbg_san/sql/sql_connect.cc:1416
#29 0x56523dfad780 in handle_one_connection /test/11.1_dbg_san/sql/sql_connect.cc:1318
#30 0x153e48694b42 in start_thread nptl/pthread_create.c:442

previously allocated by thread T22 here:
#0 0x56523cc43327 in malloc (/test/UBASAN_MD120523-mariadb-11.1.0-linux-x86_64-dbg/bin/mariadbd+0x79f7327)
#1 0x56524138f710 in my_malloc /test/11.1_dbg_san/mysys/my_malloc.c:91
#2 0x153e24462b15 in spider_bulk_alloc_mem(st_spider_transaction, unsigned int, char const, char const*, unsigned long, unsigned long, ...) /test/11.1_dbg_san/storage/spider/spd_malloc.cc:231
#3 0x153e2436932f in spider_conn_queue_and_merge_loop_check(st_spider_conn, st_spider_conn_loop_check) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1119
#4 0x153e2436d3ba in spider_conn_queue_loop_check(st_spider_conn, ha_spider, int) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1430
#5 0x153e2438dde3 in spider_get_conn(st_spider_share, int, char, st_spider_transaction, ha_spider, bool, bool, int*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:832
#6 0x153e2440f799 in spider_get_share(char const, TABLE, THD, ha_spider, int*) /test/11.1_dbg_san/storage/spider/spd_table.cc:4927
#7 0x153e24515571 in ha_spider::open(char const*, int, unsigned int) /test/11.1_dbg_san/storage/spider/ha_spider.cc:312
#8 0x56523ecffbff in handler::ha_open(TABLE, char const, int, unsigned int, st_mem_root, List<String>) /test/11.1_dbg_san/sql/handler.cc:3472
#9 0x56523ddf4189 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /test/11.1_dbg_san/sql/table.cc:4570
#10 0x56523d146717 in open_table(THD, TABLE_LIST, Open_table_context*) /test/11.1_dbg_san/sql/sql_base.cc:2210
#11 0x56523d15e248 in open_and_process_table /test/11.1_dbg_san/sql/sql_base.cc:4140
#12 0x56523d15e248 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /test/11.1_dbg_san/sql/sql_base.cc:4627
#13 0x56523d165e77 in open_tables /test/11.1_dbg_san/sql/sql_base.h:267
#14 0x56523d165e77 in open_normal_and_derived_tables(THD, TABLE_LIST, unsigned int, unsigned int) /test/11.1_dbg_san/sql/sql_base.cc:5665
#15 0x56523d166a81 in open_tables_only_view_structure(THD, TABLE_LIST, bool) /test/11.1_dbg_san/sql/sql_base.cc:5716
#16 0x56523da08f2a in fill_schema_table_by_open /test/11.1_dbg_san/sql/sql_show.cc:4713
#17 0x56523db1a672 in get_all_tables(THD, TABLE_LIST, Item*) /test/11.1_dbg_san/sql/sql_show.cc:5384
#18 0x56523db22975 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.1_dbg_san/sql/sql_show.cc:9060
#19 0x56523d9be136 in JOIN::exec_inner() /test/11.1_dbg_san/sql/sql_select.cc:4856
#20 0x56523d9c21ec in JOIN::exec() /test/11.1_dbg_san/sql/sql_select.cc:4676
#21 0x56523d9b09a0 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.1_dbg_san/sql/sql_select.cc:5157
#22 0x56523d9b4dfb in handle_select(THD, LEX, select_result*, unsigned long long) /test/11.1_dbg_san/sql/sql_select.cc:611
#23 0x56523d539cee in execute_sqlcom_select /test/11.1_dbg_san/sql/sql_parse.cc:6024
#24 0x56523d59b661 in mysql_execute_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:3944
#25 0x56523d5c65ab in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.1_dbg_san/sql/sql_parse.cc:7760
#26 0x56523d5d6335 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1892
#27 0x56523d5e413a in do_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1405
#28 0x56523dfac265 in do_handle_one_connection(CONNECT*, bool) /test/11.1_dbg_san/sql/sql_connect.cc:1416
#29 0x56523dfad780 in handle_one_connection /test/11.1_dbg_san/sql/sql_connect.cc:1318
#30 0x153e48694b42 in start_thread nptl/pthread_create.c:442

Thread T22 created by T0 here:
#0 0x56523cbe7165 in pthread_create (/test/UBASAN_MD120523-mariadb-11.1.0-linux-x86_64-dbg/bin/mariadbd+0x799b165)
#1 0x56523cc9d66f in create_thread_to_handle_connection(CONNECT*) /test/11.1_dbg_san/sql/mysqld.cc:6134
#2 0x56523ccaac5f in create_new_thread(CONNECT*) /test/11.1_dbg_san/sql/mysqld.cc:6193
#3 0x56523ccab4bb in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.1_dbg_san/sql/mysqld.cc:6255
#4 0x56523ccac50c in handle_connections_sockets() /test/11.1_dbg_san/sql/mysqld.cc:6379
#5 0x56523ccb3c87 in mysqld_main(int, char**) /test/11.1_dbg_san/sql/mysqld.cc:6029
#6 0x56523cc88eba in main /test/11.1_dbg_san/sql/main.cc:34
#7 0x153e48629d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free /test/11.1_dbg_san/storage/spider/spd_conn.cc:1184 in spider_conn_queue_and_merge_loop_check(st_spider_conn, st_spider_conn_loop_check)
Shadow bytes around the buggy address:
0x0c2480008c10: 00 00 00 00 00 00 00 00 00 00 00 00 f7 fa fa fa
0x0c2480008c20: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c2480008c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2480008c40: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
0x0c2480008c50: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c2480008c60: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
0x0c2480008c70: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
0x0c2480008c80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c2480008c90: 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00
0x0c2480008ca0: 00 00 00 00 00 00 00 00 00 00 00 00 f7 fa fa fa
0x0c2480008cb0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1000503==ABORTING

UniqueID's seen across versions/build types (same as above):

ASAN|heap-use-after-free|storage/spider/spd_conn.cc|spider_conn_queue_and_merge_loop_check|spider_conn_queue_loop_check|spider_get_conn|spider_get_share

ASAN|heap-use-after-free|storage/spider/spd_conn.cc|spider_conn_queue_and_merge_loop_check|spider_conn_queue_loop_check|spider_get_conn|spider_share_get_conns

Bug confirmed present in:
MariaDB: 10.5.21 (dbg), 10.5.21 (opt), 10.6.14 (dbg), 10.6.14 (opt), 10.9.7 (opt), 10.10.5 (dbg), 10.10.5 (opt), 10.11.4 (dbg), 10.11.4 (opt), 11.0.2 (dbg), 11.0.2 (opt), 11.1.0 (dbg), 11.1.0 (opt)

Roel Van de Paar added a comment - 2023-06-06 08:35 - edited I ran into this issue also INSTALL PLUGIN Spider SONAME 'ha_spider.so' ; CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '' , DATABASE '' , USER '' , PASSWORD '' ); CREATE TABLE t1 (c INT ) ENGINE=Spider COMMENT= 'WRAPPER "mysql",HOST "srv",TABLE "t"' ; CREATE TABLE t2 (c INT ) ENGINE=Spider COMMENT= 'WRAPPER "mysql",HOST "srv",TABLE "t"' ; CREATE TABLE t3 (c INT ) ENGINE=Spider COMMENT= 'WRAPPER "mysql",HOST "srv",TABLE "t"' ; SHOW TABLE STATUS; Or MTR: IF (` SELECT NOT ( COUNT (*)) FROM information_schema.system_variables WHERE variable_name= 'have_sanitizer' AND global_value like "%UBSAN%" `) { --skip test needs to be run with UBSAN } --source include/have_innodb.inc --let $SOCKET= `SELECT @@global.socket` INSTALL PLUGIN Spider SONAME 'ha_spider.so' ; CREATE USER spider@localhost IDENTIFIED BY 'pwd' ; GRANT ALL ON test.* TO spider@localhost; eval CREATE SERVER s FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET "$SOCKET" , DATABASE 'test' , USER 'spider' , PASSWORD 'pwd' ); CREATE TABLE t1 (c INT ) ENGINE=Spider COMMENT= 'WRAPPER "mysql",HOST "srv",TABLE "t"' ; CREATE TABLE t2 (c INT ) ENGINE=Spider COMMENT= 'WRAPPER "mysql",HOST "srv",TABLE "t"' ; CREATE TABLE t3 (c INT ) ENGINE=Spider COMMENT= 'WRAPPER "mysql",HOST "srv",TABLE "t"' ; SHOW TABLE STATUS; Leads to: 11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug, UBASAN) ==2504563==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000085bd8 at pc 0x14564335d760 bp 0x145643f66b60 sp 0x145643f66b50 WRITE of size 8 at 0x612000085bd8 thread T33 #0 0x14564335d75f in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1184 #1 0x145643360240 in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1430 #2 0x145643380b6f in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, int*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:832 #3 0x1456433977cf in spider_share_get_conns(ha_spider*, st_spider_share*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:4868 #4 0x14564340505c in spider_init_share(char const*, TABLE*, THD*, ha_spider*, int*, st_spider_share*, TABLE_SHARE*, bool) /test/11.0_dbg_san/storage/spider/spd_table.cc:5138 #5 0x145643406475 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:5252 #6 0x145643505021 in ha_spider::open(char const*, int, unsigned int) /test/11.0_dbg_san/storage/spider/ha_spider.cc:312 #7 0x55b0cc3c7235 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.0_dbg_san/sql/handler.cc:3487 #8 0x55b0cb510885 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4540 #9 0x55b0ca85f3e3 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178 #10 0x55b0ca876f14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108 #11 0x55b0ca876f14 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595 #12 0x55b0ca87ec14 in open_tables /test/11.0_dbg_san/sql/sql_base.h:266 #13 0x55b0ca87ec14 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/11.0_dbg_san/sql/sql_base.cc:5634 #14 0x55b0ca87f81e in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /test/11.0_dbg_san/sql/sql_base.cc:5685 #15 0x55b0cb126ebe in fill_schema_table_by_open /test/11.0_dbg_san/sql/sql_show.cc:4714 #16 0x55b0cb238c13 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/11.0_dbg_san/sql/sql_show.cc:5385 #17 0x55b0cb240dc4 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.0_dbg_san/sql/sql_show.cc:9060 #18 0x55b0cb0dc83c in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4857 #19 0x55b0cb0e0916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677 #20 0x55b0cb0cf0c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158 #21 0x55b0cb0d351c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616 #22 0x55b0cac45a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279 #23 0x55b0caca6ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949 #24 0x55b0cacd6973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014 #25 0x55b0cace6707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894 #26 0x55b0cacf4542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407 #27 0x55b0cb6c98b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416 #28 0x55b0cb6cadd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318 #29 0x145668c94b42 in start_thread nptl/pthread_create.c:442 #30 0x145668d269ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff) 0x612000085bd8 is located 152 bytes inside of 296-byte region [0x612000085b40,0x612000085c68) freed by thread T33 here: #0 0x55b0ca35afe7 in __interceptor_free (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7963fe7) #1 0x55b0cea72a61 in my_free /test/11.0_dbg_san/mysys/my_malloc.c:213 #2 0x145643452150 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /test/11.0_dbg_san/storage/spider/spd_malloc.cc:183 #3 0x14564335d3cd in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1166 #4 0x145643360240 in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1430 #5 0x145643380b6f in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, int*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:832 #6 0x1456433977cf in spider_share_get_conns(ha_spider*, st_spider_share*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:4868 #7 0x14564340505c in spider_init_share(char const*, TABLE*, THD*, ha_spider*, int*, st_spider_share*, TABLE_SHARE*, bool) /test/11.0_dbg_san/storage/spider/spd_table.cc:5138 #8 0x145643406475 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:5252 #9 0x145643505021 in ha_spider::open(char const*, int, unsigned int) /test/11.0_dbg_san/storage/spider/ha_spider.cc:312 #10 0x55b0cc3c7235 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.0_dbg_san/sql/handler.cc:3487 #11 0x55b0cb510885 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4540 #12 0x55b0ca85f3e3 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178 #13 0x55b0ca876f14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108 #14 0x55b0ca876f14 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595 #15 0x55b0ca87ec14 in open_tables /test/11.0_dbg_san/sql/sql_base.h:266 #16 0x55b0ca87ec14 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/11.0_dbg_san/sql/sql_base.cc:5634 #17 0x55b0ca87f81e in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /test/11.0_dbg_san/sql/sql_base.cc:5685 #18 0x55b0cb126ebe in fill_schema_table_by_open /test/11.0_dbg_san/sql/sql_show.cc:4714 #19 0x55b0cb238c13 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/11.0_dbg_san/sql/sql_show.cc:5385 #20 0x55b0cb240dc4 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.0_dbg_san/sql/sql_show.cc:9060 #21 0x55b0cb0dc83c in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4857 #22 0x55b0cb0e0916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677 #23 0x55b0cb0cf0c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158 #24 0x55b0cb0d351c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616 #25 0x55b0cac45a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279 #26 0x55b0caca6ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949 #27 0x55b0cacd6973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014 #28 0x55b0cace6707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894 #29 0x55b0cacf4542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407 #30 0x55b0cb6c98b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416 #31 0x55b0cb6cadd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318 previously allocated by thread T33 here: #0 0x55b0ca35b337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337) #1 0x55b0cea72703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91 #2 0x145643452583 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /test/11.0_dbg_san/storage/spider/spd_malloc.cc:231 #3 0x14564335c1b5 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1119 #4 0x145643360240 in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1430 #5 0x145643380b6f in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, int*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:832 #6 0x1456433977cf in spider_share_get_conns(ha_spider*, st_spider_share*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:4868 #7 0x14564340505c in spider_init_share(char const*, TABLE*, THD*, ha_spider*, int*, st_spider_share*, TABLE_SHARE*, bool) /test/11.0_dbg_san/storage/spider/spd_table.cc:5138 #8 0x145643406475 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:5252 #9 0x145643505021 in ha_spider::open(char const*, int, unsigned int) /test/11.0_dbg_san/storage/spider/ha_spider.cc:312 #10 0x55b0cc3c7235 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.0_dbg_san/sql/handler.cc:3487 #11 0x55b0cb510885 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4540 #12 0x55b0ca85f3e3 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178 #13 0x55b0ca876f14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108 #14 0x55b0ca876f14 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595 #15 0x55b0ca87ec14 in open_tables /test/11.0_dbg_san/sql/sql_base.h:266 #16 0x55b0ca87ec14 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/11.0_dbg_san/sql/sql_base.cc:5634 #17 0x55b0ca87f81e in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /test/11.0_dbg_san/sql/sql_base.cc:5685 #18 0x55b0cb126ebe in fill_schema_table_by_open /test/11.0_dbg_san/sql/sql_show.cc:4714 #19 0x55b0cb238c13 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/11.0_dbg_san/sql/sql_show.cc:5385 #20 0x55b0cb240dc4 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.0_dbg_san/sql/sql_show.cc:9060 #21 0x55b0cb0dc83c in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4857 #22 0x55b0cb0e0916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677 #23 0x55b0cb0cf0c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158 #24 0x55b0cb0d351c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616 #25 0x55b0cac45a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279 #26 0x55b0caca6ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949 #27 0x55b0cacd6973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014 #28 0x55b0cace6707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894 #29 0x55b0cacf4542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407 #30 0x55b0cb6c98b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416 #31 0x55b0cb6cadd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318 Thread T33 created by T0 here: #0 0x55b0ca2ff175 in pthread_create (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7908175) #1 0x55b0ca3b598b in create_thread_to_handle_connection(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6129 #2 0x55b0ca3c2e67 in create_new_thread(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6191 #3 0x55b0ca3c36e7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_dbg_san/sql/mysqld.cc:6253 #4 0x55b0ca3c4738 in handle_connections_sockets() /test/11.0_dbg_san/sql/mysqld.cc:6377 #5 0x55b0ca3cbee7 in mysqld_main(int, char**) /test/11.0_dbg_san/sql/mysqld.cc:6024 #6 0x55b0ca3a0eca in main /test/11.0_dbg_san/sql/main.cc:34 #7 0x145668c29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 SUMMARY: AddressSanitizer: heap-use-after-free /test/11.0_dbg_san/storage/spider/spd_conn.cc:1184 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) Shadow bytes around the buggy address: 0x0c2480008b20: 00 00 00 00 00 00 00 00 00 00 00 00 f7 fa fa fa 0x0c2480008b30: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c2480008b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2480008b50: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa 0x0c2480008b60: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c2480008b70: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd 0x0c2480008b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa 0x0c2480008b90: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c2480008ba0: 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 0x0c2480008bb0: 00 00 00 00 00 00 00 00 00 00 00 00 f7 fa fa fa 0x0c2480008bc0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==2504563==ABORTING And: 11.1.0 4e5b771e980edfdad5c5414aa62c81d409d585a4 (Debug, UBASAN) ==1000503==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000086358 at pc 0x153e2436a8da bp 0x153e25057bd0 sp 0x153e25057bc0 WRITE of size 8 at 0x612000086358 thread T22 #0 0x153e2436a8d9 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1184 #1 0x153e2436d3ba in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1430 #2 0x153e2438dde3 in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, int*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:832 #3 0x153e2440f799 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.1_dbg_san/storage/spider/spd_table.cc:4927 #4 0x153e24515571 in ha_spider::open(char const*, int, unsigned int) /test/11.1_dbg_san/storage/spider/ha_spider.cc:312 #5 0x56523ecffbff in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.1_dbg_san/sql/handler.cc:3472 #6 0x56523ddf4189 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.1_dbg_san/sql/table.cc:4570 #7 0x56523d146717 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.1_dbg_san/sql/sql_base.cc:2210 #8 0x56523d15e248 in open_and_process_table /test/11.1_dbg_san/sql/sql_base.cc:4140 #9 0x56523d15e248 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.1_dbg_san/sql/sql_base.cc:4627 #10 0x56523d165e77 in open_tables /test/11.1_dbg_san/sql/sql_base.h:267 #11 0x56523d165e77 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/11.1_dbg_san/sql/sql_base.cc:5665 #12 0x56523d166a81 in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /test/11.1_dbg_san/sql/sql_base.cc:5716 #13 0x56523da08f2a in fill_schema_table_by_open /test/11.1_dbg_san/sql/sql_show.cc:4713 #14 0x56523db1a672 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/11.1_dbg_san/sql/sql_show.cc:5384 #15 0x56523db22975 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.1_dbg_san/sql/sql_show.cc:9060 #16 0x56523d9be136 in JOIN::exec_inner() /test/11.1_dbg_san/sql/sql_select.cc:4856 #17 0x56523d9c21ec in JOIN::exec() /test/11.1_dbg_san/sql/sql_select.cc:4676 #18 0x56523d9b09a0 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.1_dbg_san/sql/sql_select.cc:5157 #19 0x56523d9b4dfb in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.1_dbg_san/sql/sql_select.cc:611 #20 0x56523d539cee in execute_sqlcom_select /test/11.1_dbg_san/sql/sql_parse.cc:6024 #21 0x56523d59b661 in mysql_execute_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:3944 #22 0x56523d5c65ab in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.1_dbg_san/sql/sql_parse.cc:7760 #23 0x56523d5d6335 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1892 #24 0x56523d5e413a in do_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1405 #25 0x56523dfac265 in do_handle_one_connection(CONNECT*, bool) /test/11.1_dbg_san/sql/sql_connect.cc:1416 #26 0x56523dfad780 in handle_one_connection /test/11.1_dbg_san/sql/sql_connect.cc:1318 #27 0x153e48694b42 in start_thread nptl/pthread_create.c:442 #28 0x153e487269ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff) 0x612000086358 is located 152 bytes inside of 296-byte region [0x6120000862c0,0x6120000863e8) freed by thread T22 here: #0 0x56523cc42fd7 in __interceptor_free (/test/UBASAN_MD120523-mariadb-11.1.0-linux-x86_64-dbg/bin/mariadbd+0x79f6fd7) #1 0x56524138fa6e in my_free /test/11.1_dbg_san/mysys/my_malloc.c:213 #2 0x153e244626e2 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /test/11.1_dbg_san/storage/spider/spd_malloc.cc:183 #3 0x153e2436a547 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1166 #4 0x153e2436d3ba in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1430 #5 0x153e2438dde3 in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, int*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:832 #6 0x153e2440f799 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.1_dbg_san/storage/spider/spd_table.cc:4927 #7 0x153e24515571 in ha_spider::open(char const*, int, unsigned int) /test/11.1_dbg_san/storage/spider/ha_spider.cc:312 #8 0x56523ecffbff in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.1_dbg_san/sql/handler.cc:3472 #9 0x56523ddf4189 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.1_dbg_san/sql/table.cc:4570 #10 0x56523d146717 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.1_dbg_san/sql/sql_base.cc:2210 #11 0x56523d15e248 in open_and_process_table /test/11.1_dbg_san/sql/sql_base.cc:4140 #12 0x56523d15e248 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.1_dbg_san/sql/sql_base.cc:4627 #13 0x56523d165e77 in open_tables /test/11.1_dbg_san/sql/sql_base.h:267 #14 0x56523d165e77 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/11.1_dbg_san/sql/sql_base.cc:5665 #15 0x56523d166a81 in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /test/11.1_dbg_san/sql/sql_base.cc:5716 #16 0x56523da08f2a in fill_schema_table_by_open /test/11.1_dbg_san/sql/sql_show.cc:4713 #17 0x56523db1a672 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/11.1_dbg_san/sql/sql_show.cc:5384 #18 0x56523db22975 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.1_dbg_san/sql/sql_show.cc:9060 #19 0x56523d9be136 in JOIN::exec_inner() /test/11.1_dbg_san/sql/sql_select.cc:4856 #20 0x56523d9c21ec in JOIN::exec() /test/11.1_dbg_san/sql/sql_select.cc:4676 #21 0x56523d9b09a0 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.1_dbg_san/sql/sql_select.cc:5157 #22 0x56523d9b4dfb in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.1_dbg_san/sql/sql_select.cc:611 #23 0x56523d539cee in execute_sqlcom_select /test/11.1_dbg_san/sql/sql_parse.cc:6024 #24 0x56523d59b661 in mysql_execute_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:3944 #25 0x56523d5c65ab in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.1_dbg_san/sql/sql_parse.cc:7760 #26 0x56523d5d6335 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1892 #27 0x56523d5e413a in do_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1405 #28 0x56523dfac265 in do_handle_one_connection(CONNECT*, bool) /test/11.1_dbg_san/sql/sql_connect.cc:1416 #29 0x56523dfad780 in handle_one_connection /test/11.1_dbg_san/sql/sql_connect.cc:1318 #30 0x153e48694b42 in start_thread nptl/pthread_create.c:442 previously allocated by thread T22 here: #0 0x56523cc43327 in malloc (/test/UBASAN_MD120523-mariadb-11.1.0-linux-x86_64-dbg/bin/mariadbd+0x79f7327) #1 0x56524138f710 in my_malloc /test/11.1_dbg_san/mysys/my_malloc.c:91 #2 0x153e24462b15 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /test/11.1_dbg_san/storage/spider/spd_malloc.cc:231 #3 0x153e2436932f in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1119 #4 0x153e2436d3ba in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1430 #5 0x153e2438dde3 in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, int*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:832 #6 0x153e2440f799 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.1_dbg_san/storage/spider/spd_table.cc:4927 #7 0x153e24515571 in ha_spider::open(char const*, int, unsigned int) /test/11.1_dbg_san/storage/spider/ha_spider.cc:312 #8 0x56523ecffbff in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.1_dbg_san/sql/handler.cc:3472 #9 0x56523ddf4189 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.1_dbg_san/sql/table.cc:4570 #10 0x56523d146717 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.1_dbg_san/sql/sql_base.cc:2210 #11 0x56523d15e248 in open_and_process_table /test/11.1_dbg_san/sql/sql_base.cc:4140 #12 0x56523d15e248 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.1_dbg_san/sql/sql_base.cc:4627 #13 0x56523d165e77 in open_tables /test/11.1_dbg_san/sql/sql_base.h:267 #14 0x56523d165e77 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/11.1_dbg_san/sql/sql_base.cc:5665 #15 0x56523d166a81 in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /test/11.1_dbg_san/sql/sql_base.cc:5716 #16 0x56523da08f2a in fill_schema_table_by_open /test/11.1_dbg_san/sql/sql_show.cc:4713 #17 0x56523db1a672 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/11.1_dbg_san/sql/sql_show.cc:5384 #18 0x56523db22975 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.1_dbg_san/sql/sql_show.cc:9060 #19 0x56523d9be136 in JOIN::exec_inner() /test/11.1_dbg_san/sql/sql_select.cc:4856 #20 0x56523d9c21ec in JOIN::exec() /test/11.1_dbg_san/sql/sql_select.cc:4676 #21 0x56523d9b09a0 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.1_dbg_san/sql/sql_select.cc:5157 #22 0x56523d9b4dfb in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.1_dbg_san/sql/sql_select.cc:611 #23 0x56523d539cee in execute_sqlcom_select /test/11.1_dbg_san/sql/sql_parse.cc:6024 #24 0x56523d59b661 in mysql_execute_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:3944 #25 0x56523d5c65ab in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.1_dbg_san/sql/sql_parse.cc:7760 #26 0x56523d5d6335 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1892 #27 0x56523d5e413a in do_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1405 #28 0x56523dfac265 in do_handle_one_connection(CONNECT*, bool) /test/11.1_dbg_san/sql/sql_connect.cc:1416 #29 0x56523dfad780 in handle_one_connection /test/11.1_dbg_san/sql/sql_connect.cc:1318 #30 0x153e48694b42 in start_thread nptl/pthread_create.c:442 Thread T22 created by T0 here: #0 0x56523cbe7165 in pthread_create (/test/UBASAN_MD120523-mariadb-11.1.0-linux-x86_64-dbg/bin/mariadbd+0x799b165) #1 0x56523cc9d66f in create_thread_to_handle_connection(CONNECT*) /test/11.1_dbg_san/sql/mysqld.cc:6134 #2 0x56523ccaac5f in create_new_thread(CONNECT*) /test/11.1_dbg_san/sql/mysqld.cc:6193 #3 0x56523ccab4bb in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.1_dbg_san/sql/mysqld.cc:6255 #4 0x56523ccac50c in handle_connections_sockets() /test/11.1_dbg_san/sql/mysqld.cc:6379 #5 0x56523ccb3c87 in mysqld_main(int, char**) /test/11.1_dbg_san/sql/mysqld.cc:6029 #6 0x56523cc88eba in main /test/11.1_dbg_san/sql/main.cc:34 #7 0x153e48629d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 SUMMARY: AddressSanitizer: heap-use-after-free /test/11.1_dbg_san/storage/spider/spd_conn.cc:1184 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) Shadow bytes around the buggy address: 0x0c2480008c10: 00 00 00 00 00 00 00 00 00 00 00 00 f7 fa fa fa 0x0c2480008c20: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c2480008c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2480008c40: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa 0x0c2480008c50: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c2480008c60: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd 0x0c2480008c70: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa 0x0c2480008c80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c2480008c90: 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 0x0c2480008ca0: 00 00 00 00 00 00 00 00 00 00 00 00 f7 fa fa fa 0x0c2480008cb0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==1000503==ABORTING UniqueID's seen across versions/build types (same as above): ASAN|heap-use-after-free|storage/spider/spd_conn.cc|spider_conn_queue_and_merge_loop_check|spider_conn_queue_loop_check|spider_get_conn|spider_get_share ASAN|heap-use-after-free|storage/spider/spd_conn.cc|spider_conn_queue_and_merge_loop_check|spider_conn_queue_loop_check|spider_get_conn|spider_share_get_conns Bug confirmed present in: MariaDB: 10.5.21 (dbg), 10.5.21 (opt), 10.6.14 (dbg), 10.6.14 (opt), 10.9.7 (opt), 10.10.5 (dbg), 10.10.5 (opt), 10.11.4 (dbg), 10.11.4 (opt), 11.0.2 (dbg), 11.0.2 (opt), 11.1.0 (dbg), 11.1.0 (opt)

Yuchen Pei added a comment - 2023-12-15 06:42

Hi holyfoot, ptal thanks:

upstream/bb-10.5-mdev-29002 da5f0dc6209c4a009a32ce4c48dac883c91a19b1

MDEV-29002 Spider: remove SPIDER_CONN::loop_check_meraged_last

The field is assigned but unused, and it causes heap-use-after-free.

For 11.0, see

91a59c0fa11 upstream/bb-11.0-mdev-29002 MDEV-29002 Spider: remove SPIDER_CONN::loop_check_meraged_last

Yuchen Pei added a comment - 2023-12-15 06:42 Hi holyfoot , ptal thanks: upstream/bb-10.5-mdev-29002 da5f0dc6209c4a009a32ce4c48dac883c91a19b1 MDEV-29002 Spider: remove SPIDER_CONN::loop_check_meraged_last The field is assigned but unused, and it causes heap-use-after-free. For 11.0, see 91a59c0fa11 upstream/bb-11.0-mdev-29002 MDEV-29002 Spider: remove SPIDER_CONN::loop_check_meraged_last

Alexey Botchkov added a comment - 2024-01-06 17:34

ok to push.

Alexey Botchkov added a comment - 2024-01-06 17:34 ok to push.

Yuchen Pei added a comment - 2024-01-11 06:14

pushed 7801c6d22dce546e9661be909dd0302000933f0b to 10.5

Yuchen Pei added a comment - 2024-01-11 06:14 pushed 7801c6d22dce546e9661be909dd0302000933f0b to 10.5

People

Assignee:: Yuchen Pei

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 2022-07-01 21:45

Updated:: 2024-01-15 23:41

Resolved:: 2024-01-11 06:14

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server