ASAN: use-after-poison and heap-use-after-free in ha_discover_table on dummy INSERT query and removing general_log table

SET GLOBAL general_log=ON;

DROP DATABASE mysql;

SET GLOBAL log_output='TABLE';

INSERT INTO dummy;

==3867994==ERROR: AddressSanitizer: use-after-poison on address 0x6290000d7769 at pc 0x55b9e26662f3 bp 0x15104b162e90 sp 0x15104b162e80

2022-09-01 16:38:18 0 [Note] /test/UBASAN_MD010922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld: ready for connections.

Version: '10.11.0-MariaDB-debug'  socket: '/test/UBASAN_MD010922-mariadb-10.11.0-linux-x86_64-dbg/socket.sock'  port: 12676  MariaDB Server

2022-09-01 16:38:20 4 [ERROR] Failed to write to mysql.general_log: Table 'mysql.general_log' doesn't exist

=================================================================

==3867994==ERROR: AddressSanitizer: use-after-poison on address 0x6290000d7769 at pc 0x55b9e26662f3 bp 0x15104b162e90 sp 0x15104b162e80

READ of size 1 at 0x6290000d7769 thread T13

    #0 0x55b9e26662f2 in ha_discover_table(THD*, TABLE_SHARE*) /test/10.11_dbg_san/sql/handler.cc:6133

    #1 0x55b9e17528ff in open_table_def(THD*, TABLE_SHARE*, unsigned int) /test/10.11_dbg_san/sql/table.cc:650

    #2 0x55b9e201d314 in tdc_acquire_share(THD*, TABLE_LIST*, unsigned int, TABLE**) /test/10.11_dbg_san/sql/table_cache.cc:836

    #3 0x55b9e09a3c99 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/10.11_dbg_san/sql/sql_base.cc:2028

    #4 0x55b9e09b221e in open_ltable(THD*, TABLE_LIST*, thr_lock_type, unsigned int) /test/10.11_dbg_san/sql/sql_base.cc:5468

    #5 0x55b9e09f85a8 in open_log_table(THD*, TABLE_LIST*, Open_tables_backup*) /test/10.11_dbg_san/sql/sql_base.cc:9556

    #6 0x55b9e348de91 in Log_to_csv_event_handler::log_general(THD*, my_hrtime_t, char const*, unsigned long, unsigned long long, char const*, unsigned long, char const*, unsigned long, charset_info_st const*) /test/10.11_dbg_san/sql/log.cc:862

    #7 0x55b9e349e08e in LOGGER::general_log_write(THD*, enum_server_command, char const*, unsigned long) /test/10.11_dbg_san/sql/log.cc:1510

    #8 0x55b9e349e3ec in LOGGER::general_log_print(THD*, enum_server_command, char const*, __va_list_tag*) /test/10.11_dbg_san/sql/log.cc:1535

    #9 0x55b9e349e662 in general_log_print(THD*, enum_server_command, char const*, ...) /test/10.11_dbg_san/sql/log.cc:7032

    #10 0x55b9e0e45c52 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_dbg_san/sql/sql_parse.cc:2115

    #11 0x55b9e0e51a70 in do_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1407

    #12 0x55b9e18c2b41 in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1418

    #13 0x55b9e18c532c in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1312

    #14 0x15106e08e608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477

    #15 0x15106d303132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

0x6290000d7769 is located 1385 bytes inside of 16516-byte region [0x6290000d7200,0x6290000db284)

allocated by thread T13 here:

    #0 0x55b9e0463258 in malloc (/test/UBASAN_MD010922-mariadb-10.11.0-linux-x86_64-dbg/bin/mariadbd+0x7ee2258)

    #1 0x55b9e5077ad5 in sf_malloc /test/10.11_dbg_san/mysys/safemalloc.c:126

    #2 0x55b9e5045102 in my_malloc /test/10.11_dbg_san/mysys/my_malloc.c:90

    #3 0x55b9e502306d in root_alloc /test/10.11_dbg_san/mysys/my_alloc.c:66

    #4 0x55b9e5023aa4 in reset_root_defaults /test/10.11_dbg_san/mysys/my_alloc.c:243

    #5 0x55b9e0a590bd in THD::init_for_queries() /test/10.11_dbg_san/sql/sql_class.cc:1385

    #6 0x55b9e18be231 in prepare_new_connection_state(THD*) /test/10.11_dbg_san/sql/sql_connect.cc:1240

    #7 0x55b9e18bfd1d in thd_prepare_connection(THD*) /test/10.11_dbg_san/sql/sql_connect.cc:1333

    #8 0x55b9e18c3862 in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1408

    #9 0x55b9e18c532c in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1312

    #10 0x15106e08e608 in start_thread /build/glibc-SzIz7B/glibc-2.31/np

Thread T13 created by T0 here:

    #0 0x55b9e0390295 in __interceptor_pthread_create (/test/UBASAN_MD010922-mariadb-10.11.0-linux-x86_64-dbg/bin/mariadbd+0x7e0f295)

    #1 0x55b9e04b79d3 in create_thread_to_handle_connection(CONNECT*) /test/10.11_dbg_san/sql/mysqld.cc:6018

    #2 0x55b9e04c9d12 in create_new_thread(CONNECT*) /test/10.11_dbg_san/sql/mysqld.cc:6077

    #3 0x55b9e04ca660 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/10.11_dbg_san/sql/mysqld.cc:6139

    #4 0x55b9e04cbaef in handle_connections_sockets() /test/10.11_dbg_san/sql/mysqld.cc:6263

    #5 0x55b9e04d0463 in mysqld_main(int, char**) /test/10.11_dbg_san/sql/mysqld.cc:5913

    #6 0x55b9e04a481a in main /test/10.11_dbg_san/sql/main.cc:34

    #7 0x15106d208082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: use-after-poison /test/10.11_dbg_san/sql/handler.cc:6133 in ha_discover_table(THD*, TABLE_SHARE*)

Shadow bytes around the buggy address:

  0x0c5280012e90: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280012ea0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280012eb0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280012ec0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280012ed0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

=>0x0c5280012ee0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7[f7]f7 f7

  0x0c5280012ef0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280012f00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280012f10: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280012f20: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5280012f30: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==3867994==ABORTING

Compiled with GCC >=7.5.0 (I use GCC 9.4.0) and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=1:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1