SIGSEGV in spider_db_unlock_tables and ASAN: heap-use-after-free in ha_spider::lock_tables on INSERT

INSTALL PLUGIN Spider SONAME 'ha_spider.so';

CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE'',USER'',PASSWORD'');

CREATE TABLE t1 (c1 INT) ENGINE=InnoDB;

CREATE TABLE t2 (c1 INT) ENGINE=Spider COMMENT='WRAPPER "mysql",SRV "srv",TABLE "t1"';

CREATE TABLE t3 (c1 INT,c2 INT) ENGINE=Spider;

SELECT * FROM t2;

SELECT * FROM t3;

LOCK TABLES t2 WRITE;

ALTER TABLE t2 CHANGE c1 c1 DOUBLE;

INSERT INTO t3 VALUES (1);

Core was generated by `/test/MD190624-mariadb-11.2.5-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x000014b3100840c6 in spider_db_unlock_tables (spider=spider@entry=0x14b2e41dcd10, link_idx=link_idx@entry=0)at /test/11.2_dbg/storage/spider/spd_db_conn.cc:1282

[Current thread is 1 (LWP 4093349)]

(gdb) bt

#0  0x000014b3100840c6 in spider_db_unlock_tables (spider=spider@entry=0x14b2e41dcd10, link_idx=link_idx@entry=0)at /test/11.2_dbg/storage/spider/spd_db_conn.cc:1282

#1  0x000014b3100eca19 in ha_spider::lock_tables (this=this@entry=0x14b2e41dcd10)at /test/11.2_dbg/storage/spider/ha_spider.cc:11983

#2  0x000014b3100eccd9 in ha_spider::external_lock (this=0x14b2e41dcd10, thd=<optimized out>, lock_type=2)at /test/11.2_dbg/storage/spider/ha_spider.cc:919

#3  0x000056224a4bf899 in handler::ha_external_lock (this=0x14b2e41dcd10, thd=thd@entry=0x14b2e4000d58, lock_type=lock_type@entry=2)at /test/11.2_dbg/sql/handler.cc:7427

#4  0x000056224a620d0e in handler::ha_external_unlock (thd=0x14b2e4000d58, this=<optimized out>) at /test/11.2_dbg/sql/handler.h:3527

#5  unlock_external (thd=thd@entry=0x14b2e4000d58, table=0x14b2e4014e50, count=<optimized out>) at /test/11.2_dbg/sql/lock.cc:744

#6  0x000056224a620efe in mysql_unlock_tables (thd=0x14b2e4000d58, sql_lock=0x14b2e4014e20, free_lock=<optimized out>)at /test/11.2_dbg/sql/lock.cc:435

#7  0x000056224a621513 in mysql_unlock_tables (thd=thd@entry=0x14b2e4000d58, sql_lock=<optimized out>) at /test/11.2_dbg/sql/lock.cc:418

#8  0x000056224a11d37d in close_thread_tables (thd=thd@entry=0x14b2e4000d58)at /test/11.2_dbg/sql/sql_base.cc:976

#9  0x000056224a11d60a in close_thread_tables_for_query (thd=thd@entry=0x14b2e4000d58) at /test/11.2_dbg/sql/sql_base.cc:797

#10 0x000056224a1a8e37 in mysql_execute_command (thd=thd@entry=0x14b2e4000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_dbg/sql/sql_parse.cc:5966

#11 0x000056224a1aa010 in mysql_parse (thd=thd@entry=0x14b2e4000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14b32409e2e0)at /test/11.2_dbg/sql/sql_parse.cc:7920

#12 0x000056224a1ac3d3 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14b2e4000d58, packet=packet@entry=0x14b2e400b2f9 "INSERT INTO t3 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true)at /test/11.2_dbg/sql/sql_class.h:247

#13 0x000056224a1ae76c in do_command (thd=0x14b2e4000d58, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1407

#14 0x000056224a315c49 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x56224d51d908, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1439

#15 0x000056224a315f3e in handle_one_connection (arg=arg@entry=0x56224d51d908)at /test/11.2_dbg/sql/sql_connect.cc:1341

#16 0x000056224a76852c in pfs_spawn_thread (arg=0x56224d4805e8)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201

#17 0x000014b327a97ada in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:444

#18 0x000014b327b2847c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

==205432==ERROR: AddressSanitizer: heap-use-after-free on address 0x61f0000a03ec at pc 0x14c59b502845 bp 0x14c59ca5e640 sp 0x14c59ca5e630

READ of size 4 at 0x61f0000a03ec thread T28

    #0 0x14c59b502844 in ha_spider::lock_tables() /test/10.5_dbg_san/storage/spider/ha_spider.cc:14859

    #1 0x14c59b505652 in ha_spider::external_lock(THD*, int) /test/10.5_dbg_san/storage/spider/ha_spider.cc:1115

    #2 0x5637f37cb7ae in handler::ha_external_lock(THD*, int) /test/10.5_dbg_san/sql/handler.cc:6853

    #3 0x5637f440a96a in handler::ha_external_unlock(THD*) /test/10.5_dbg_san/sql/handler.h:3392

    #4 0x5637f440a96a in unlock_external /test/10.5_dbg_san/sql/lock.cc:730

    #5 0x5637f440b89d in mysql_unlock_tables(THD*, st_mysql_lock*, bool) /test/10.5_dbg_san/sql/lock.cc:435

    #6 0x5637f440ddee in mysql_unlock_tables(THD*, st_mysql_lock*) /test/10.5_dbg_san/sql/lock.cc:418

    #7 0x5637f1dcd515 in close_thread_tables(THD*) /test/10.5_dbg_san/sql/sql_base.cc:930

    #8 0x5637f220f6fc in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:6233

    #9 0x5637f2216ce9 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8221

    #10 0x5637f2227084 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1892

    #11 0x5637f223583a in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1376

    #12 0x5637f2b29735 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1417

    #13 0x5637f2b2ac50 in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1319

    #14 0x14c5c2897ad9 in start_thread nptl/pthread_create.c:444

    #15 0x14c5c292847b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x61f0000a03ec is located 364 bytes inside of 3112-byte region [0x61f0000a0280,0x61f0000a0ea8)

freed by thread T28 here:

    #0 0x5637f1a18fc7 in __interceptor_free (/test/UBASAN_MD150724-mariadb-10.5.26-linux-x86_64-dbg/bin/mariadbd+0x84effc7)

    #1 0x5637f645812f in my_free /test/10.5_dbg_san/mysys/my_malloc.c:213

    #2 0x14c59b41d316 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /test/10.5_dbg_san/storage/spider/spd_malloc.cc:183

    #3 0x14c59b348980 in spider_free_conn(st_spider_conn*) /test/10.5_dbg_san/storage/spider/spd_conn.cc:905

    #4 0x14c59b36835c in spider_free_conn_from_trx(st_spider_transaction*, st_spider_conn*, bool, bool, int*) /test/10.5_dbg_san/storage/spider/spd_conn.cc:393

    #5 0x14c59b25357e in spider_free_trx_conn(st_spider_transaction*, bool) /test/10.5_dbg_san/storage/spider/spd_trx.cc:122

    #6 0x14c59b26948e in spider_rollback(handlerton*, THD*, bool) /test/10.5_dbg_san/storage/spider/spd_trx.cc:3317

    #7 0x5637f37760d2 in ha_rollback_trans(THD*, bool) /test/10.5_dbg_san/sql/handler.cc:2158

    #8 0x5637f2bbabbb in trans_rollback_stmt(THD*) /test/10.5_dbg_san/sql/transaction.cc:535

    #9 0x5637f220ead8 in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:6220

    #10 0x5637f2216ce9 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8221

    #11 0x5637f2227084 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1892

    #12 0x5637f223583a in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1376

    #13 0x5637f2b29735 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1417

    #14 0x5637f2b2ac50 in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1319

    #15 0x14c5c2897ad9 in start_thread nptl/pthread_create.c:444

previously allocated by thread T28 here:

    #0 0x5637f1a19317 in malloc (/test/UBASAN_MD150724-mariadb-10.5.26-linux-x86_64-dbg/bin/mariadbd+0x84f0317)

    #1 0x5637f6457dd1 in my_malloc /test/10.5_dbg_san/mysys/my_malloc.c:91

    #2 0x14c59b41d749 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /test/10.5_dbg_san/storage/spider/spd_malloc.cc:231

    #3 0x14c59b35dd54 in spider_create_conn(st_spider_share*, ha_spider*, int, int, unsigned int, int*) /test/10.5_dbg_san/storage/spider/spd_conn.cc:434

    #4 0x14c59b36438c in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /test/10.5_dbg_san/storage/spider/spd_conn.cc:798

    #5 0x14c59b3d004c in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/10.5_dbg_san/storage/spider/spd_table.cc:4711

    #6 0x14c59b4d2710 in ha_spider::open(char const*, int, unsigned int) /test/10.5_dbg_san/storage/spider/ha_spider.cc:397

    #7 0x5637f378575d in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/10.5_dbg_san/sql/handler.cc:3103

    #8 0x5637f297d659 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/10.5_dbg_san/sql/table.cc:4319

    #9 0x5637f1ddc095 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/10.5_dbg_san/sql/sql_base.cc:2024

    #10 0x5637f1df0675 in open_and_process_table /test/10.5_dbg_san/sql/sql_base.cc:3819

    #11 0x5637f1df0675 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/10.5_dbg_san/sql/sql_base.cc:4303

    #12 0x5637f1df8fd7 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/10.5_dbg_san/sql/sql_base.cc:5250

    #13 0x5637f2180e9d in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/10.5_dbg_san/sql/sql_base.h:509

    #14 0x5637f2180e9d in execute_sqlcom_select /test/10.5_dbg_san/sql/sql_parse.cc:6346

    #15 0x5637f21e865f in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:4030

    #16 0x5637f2216ce9 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8221

    #17 0x5637f2227084 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1892

    #18 0x5637f223583a in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1376

    #19 0x5637f2b29735 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1417

    #20 0x5637f2b2ac50 in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1319

    #21 0x14c5c2897ad9 in start_thread nptl/pthread_create.c:444

Thread T28 created by T0 here:

    #0 0x5637f19bd135 in pthread_create (/test/UBASAN_MD150724-mariadb-10.5.26-linux-x86_64-dbg/bin/mariadbd+0x8494135)

    #1 0x5637f1a73d12 in create_thread_to_handle_connection(CONNECT*) /test/10.5_dbg_san/sql/mysqld.cc:6108

    #2 0x5637f1a7f72a in create_new_thread(CONNECT*) /test/10.5_dbg_san/sql/mysqld.cc:6167

    #3 0x5637f1a7fe52 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/10.5_dbg_san/sql/mysqld.cc:6232

    #4 0x5637f1a80cd4 in handle_connections_sockets() /test/10.5_dbg_san/sql/mysqld.cc:6359

    #5 0x5637f1a87a7b in mysqld_main(int, char**) /test/10.5_dbg_san/sql/mysqld.cc:5754

    #6 0x5637f1a5eeba in main /test/10.5_dbg_san/sql/main.cc:25

    #7 0x14c5c28280cf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free /test/10.5_dbg_san/storage/spider/ha_spider.cc:14859 in ha_spider::lock_tables()

Shadow bytes around the buggy address:

  0x0c3e8000c020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c3e8000c030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c3e8000c040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c3e8000c050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3e8000c060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c3e8000c070: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd

  0x0c3e8000c080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3e8000c090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3e8000c0a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3e8000c0b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3e8000c0c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==205432==ABORTING