ASAN heap-use-after-free in spider_link_get_key on LOCK TABLES

INSTALL PLUGIN Spider SONAME 'ha_spider.so';

CREATE SERVER s FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET'',DATABASE'',USER'',PASSWORD'');

CREATE TABLE t1 (c INT) ENGINE=Spider;

CREATE TABLE t2 (c INT) ENGINE=Spider COMMENT="WRAPPER 'mysql',srv 's',TABLE 't1'";

LOCK TABLES t1 WRITE,t2 WRITE;

TRUNCATE t2;

LOCK TABLES t2 AS o WRITE;

==675445==ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000165c8 at pc 0x1482e898ad97 bp 0x1482e9586040 sp 0x1482e9586030

READ of size 8 at 0x6070000165c8 thread T12

    #0 0x1482e898ad96 in spider_link_get_key(st_spider_link_for_hash*, unsigned long*, char) /test/11.0_dbg_san/storage/spider/spd_table.cc:406

    #1 0x56101d0357eb in my_hash_key /test/11.0_dbg_san/mysys/hash.c:197

    #2 0x56101d0357eb in hashcmp /test/11.0_dbg_san/mysys/hash.c:380

    #3 0x56101d03640e in my_hash_first_from_hash_value /test/11.0_dbg_san/mysys/hash.c:291

    #4 0x56101d0365c2 in my_hash_search_using_hash_value /test/11.0_dbg_san/mysys/hash.c:245

    #5 0x1482e8bb1f4d in spider_mbase_handler::append_lock_tables_list(st_spider_conn*, int, int*) /test/11.0_dbg_san/storage/spider/spd_db_mysql.cc:13050

    #6 0x1482e8b2eb9d in ha_spider::append_lock_tables_list() /test/11.0_dbg_san/storage/spider/ha_spider.cc:12024

    #7 0x1482e8b32395 in ha_spider::store_lock(THD*, st_thr_lock_data**, thr_lock_type) /test/11.0_dbg_san/storage/spider/ha_spider.cc:759

    #8 0x56101b829d08 in get_lock_data(THD*, TABLE**, unsigned int, unsigned int) /test/11.0_dbg_san/sql/lock.cc:826

    #9 0x56101b82b36a in mysql_lock_tables(THD*, TABLE**, unsigned int, unsigned int) /test/11.0_dbg_san/sql/lock.cc:301

    #10 0x561018e911de in lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/11.0_dbg_san/sql/sql_base.cc:5819

    #11 0x5610192782d2 in lock_tables_open_and_lock_tables /test/11.0_dbg_san/sql/sql_parse.cc:2961

    #12 0x5610192f1e17 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:5142

    #13 0x5610192f5973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014

    #14 0x561019305707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894

    #15 0x561019313542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407

    #16 0x561019ce88b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416

    #17 0x561019ce9dd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318

    #18 0x14830b694b42 in start_thread nptl/pthread_create.c:442

    #19 0x14830b7269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

0x6070000165c8 is located 56 bytes inside of 80-byte region [0x607000016590,0x6070000165e0)

freed by thread T12 here:

    #0 0x561018979fe7 in __interceptor_free (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7963fe7)

    #1 0x56101d091a61 in my_free /test/11.0_dbg_san/mysys/my_malloc.c:213

    #2 0x1482e8a52150 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /test/11.0_dbg_san/storage/spider/spd_malloc.cc:183

    #3 0x1482e8bc4299 in spider_mbase_handler::~spider_mbase_handler() /test/11.0_dbg_san/storage/spider/spd_db_mysql.cc:8529

    #4 0x1482e8bc4dce in spider_mysql_handler::~spider_mysql_handler() /test/11.0_dbg_san/storage/spider/spd_db_mysql.cc:8540

    #5 0x1482e8bc4e46 in spider_mysql_handler::~spider_mysql_handler() /test/11.0_dbg_san/storage/spider/spd_db_mysql.cc:8540

    #6 0x1482e8a9ac5b in ha_spider::close() /test/11.0_dbg_san/storage/spider/ha_spider.cc:516

    #7 0x56101a9e585b in handler::ha_close() /test/11.0_dbg_san/sql/handler.cc:3571

    #8 0x561019aef686 in closefrm(TABLE*) /test/11.0_dbg_san/sql/table.cc:4644

    #9 0x56101a40834c in intern_close_table /test/11.0_dbg_san/sql/table_cache.cc:225

    #10 0x56101a40d1b6 in TDC_element::flush_unused(bool) /test/11.0_dbg_san/sql/table_cache.cc:1298

    #11 0x56101a40d48a in tdc_remove_referenced_share(THD*, TABLE_SHARE*) /test/11.0_dbg_san/sql/table_cache.cc:1009

    #12 0x561019e1ae2b in Sql_cmd_truncate_table::lock_table(THD*, TABLE_LIST*, bool*) /test/11.0_dbg_san/sql/sql_truncate.cc:372

    #13 0x561019e1b6aa in Sql_cmd_truncate_table::truncate_table(THD*, TABLE_LIST*) /test/11.0_dbg_san/sql/sql_truncate.cc:482

    #14 0x561019e1cf3e in Sql_cmd_truncate_table::execute(THD*) /test/11.0_dbg_san/sql/sql_truncate.cc:573

    #15 0x5610192ec054 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:6015

    #16 0x5610192f5973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014

    #17 0x561019305707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894

    #18 0x561019313542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407

    #19 0x561019ce88b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416

    #20 0x561019ce9dd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318

    #21 0x14830b694b42 in start_thread nptl/pthread_create.c:442

previously allocated by thread T12 here:

    #0 0x56101897a337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337)

    #1 0x56101d091703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91

    #2 0x1482e8a52583 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /test/11.0_dbg_san/storage/spider/spd_malloc.cc:231

    #3 0x1482e8b785f6 in spider_mbase_handler::init() /test/11.0_dbg_san/storage/spider/spd_db_mysql.cc:8586

    #4 0x1482e8996d3a in spider_share_init_spider_dbton_handlers(ha_spider*, st_spider_share*) /test/11.0_dbg_san/storage/spider/spd_table.cc:4835

    #5 0x1482e8a04fec in spider_init_share(char const*, TABLE*, THD*, ha_spider*, int*, st_spider_share*, TABLE_SHARE*, bool) /test/11.0_dbg_san/storage/spider/spd_table.cc:5131

    #6 0x1482e8a06475 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:5252

    #7 0x1482e8b05021 in ha_spider::open(char const*, int, unsigned int) /test/11.0_dbg_san/storage/spider/ha_spider.cc:312

    #8 0x56101a9e6235 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.0_dbg_san/sql/handler.cc:3487

    #9 0x561019b2f885 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4540

    #10 0x561018e7e3e3 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178

    #11 0x561018e95f14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108

    #12 0x561018e95f14 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595

    #13 0x56101927804c in open_tables /test/11.0_dbg_san/sql/sql_base.h:266

    #14 0x56101927804c in lock_tables_open_and_lock_tables /test/11.0_dbg_san/sql/sql_parse.cc:2865

    #15 0x5610192f1e17 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:5142

    #16 0x5610192f5973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014

    #17 0x561019305707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894

    #18 0x561019313542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407

    #19 0x561019ce88b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416

    #20 0x561019ce9dd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318

    #21 0x14830b694b42 in start_thread nptl/pthread_create.c:442

Thread T12 created by T0 here:

    #0 0x56101891e175 in pthread_create (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7908175)

    #1 0x5610189d498b in create_thread_to_handle_connection(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6129

    #2 0x5610189e1e67 in create_new_thread(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6191

    #3 0x5610189e26e7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_dbg_san/sql/mysqld.cc:6253

    #4 0x5610189e3738 in handle_connections_sockets() /test/11.0_dbg_san/sql/mysqld.cc:6377

    #5 0x5610189eaee7 in mysqld_main(int, char**) /test/11.0_dbg_san/sql/mysqld.cc:6024

    #6 0x5610189bfeca in main /test/11.0_dbg_san/sql/main.cc:34

    #7 0x14830b629d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free /test/11.0_dbg_san/storage/spider/spd_table.cc:406 in spider_link_get_key(st_spider_link_for_hash*, unsigned long*, char)

Shadow bytes around the buggy address:

  0x0c0e7fffac60: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00

  0x0c0e7fffac70: 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 00 00

  0x0c0e7fffac80: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00

  0x0c0e7fffac90: 00 00 fa fa fa fa fd fd fd fd fd fd fd fd fd fd

  0x0c0e7fffaca0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fa fa

=>0x0c0e7fffacb0: fa fa fd fd fd fd fd fd fd[fd]fd fd fa fa fa fa

  0x0c0e7fffacc0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fd fd

  0x0c0e7fffacd0: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd

  0x0c0e7ffface0: fd fd fd fd fd fa fa fa fa fa fd fd fd fd fd fd

  0x0c0e7fffacf0: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c0e7fffad00: fd fd fa fa fa fa fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==675445==ABORTING

230527 16:51:01 [ERROR] mysqld got signal 6 ;

Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1