[MDEV-21413] ASAN heap-use-after-free in ha_maria::info Created: 2020-01-02  Updated: 2023-04-27  Resolved: 2023-04-27

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - Aria
Affects Version/s: 10.1, 10.3
Fix Version/s: N/A

Type: Bug Priority: Minor
Reporter: Elena Stepanova Assignee: Michael Widenius
Resolution: Won't Fix Votes: 0
Labels: not-10.4, not-10.5

Issue Links:
Relates
relates to MDEV-23202 Server crashes in maria_status and/or... Confirmed
relates to MDEV-22829 SIGSEGV in _ma_reset_history on LOCK ... Closed

 Description    

--source include/have_innodb.inc
 
 
 
CREATE TABLE t1 (a INT) ENGINE=InnoDB;
 
INSERT INTO t1 VALUES (1),(2);
 
CREATE TABLE t2 (b INT) ENGINE=Aria;
 
CREATE TABLE t3 (c INT) ENGINE=Aria;
 
INSERT INTO t3 VALUES (1),(2);
 
EXPLAIN SELECT * FROM t1, t2, t3;
 
SHOW TABLE STATUS;
 
 
 
# Cleanup
 
DROP TABLE t1, t2, t3;

10.3 ASAN 02e30069

 
==1693==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000046c30 at pc 0x56522524fe86 bp 0x7ff758352fc0 sp 0x7ff758352fb8
 
READ of size 4 at 0x611000046c30 thread T27
 
    #0 0x56522524fe85 in ha_maria::info(unsigned int) /data/src/10.3/storage/maria/ha_maria.cc:2453
 
    #1 0x565223fa0374 in get_schema_tables_record /data/src/10.3/sql/sql_show.cc:5556
 
    #2 0x565223f98778 in fill_schema_table_by_open /data/src/10.3/sql/sql_show.cc:4657
 
    #3 0x565223f9bee6 in get_all_tables(THD*, TABLE_LIST*, Item*) /data/src/10.3/sql/sql_show.cc:5260
 
    #4 0x565223fcec10 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.3/sql/sql_show.cc:8873
 
    #5 0x565223ebf846 in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4061
 
    #6 0x565223ebdb4f in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3892
 
    #7 0x565223ec102e in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4297
 
    #8 0x565223e9b065 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:370
 
    #9 0x565223e1cda4 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6294
 
    #10 0x565223e0c5a9 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3821
 
    #11 0x565223e25de0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7818
 
    #12 0x565223e00acc in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1856
 
    #13 0x565223dfd9ab in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1401
 
    #14 0x565224173ae4 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #15 0x5652241734ab in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #16 0x5652255dd1f3 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #17 0x7ff76ff374a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
 
    #18 0x7ff76e06bd0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)
 
 
 
0x611000046c30 is located 176 bytes inside of 252-byte region [0x611000046b80,0x611000046c7c)
 
freed by thread T27 here:
 
    #0 0x7ff77020ea10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)
 
    #1 0x56522570de9a in free_memory /data/src/10.3/mysys/safemalloc.c:279
 
    #2 0x56522570d583 in sf_free /data/src/10.3/mysys/safemalloc.c:197
 
    #3 0x5652256df715 in my_free /data/src/10.3/mysys/my_malloc.c:223
 
    #4 0x56522521c593 in _ma_trnman_end_trans_hook /data/src/10.3/storage/maria/ma_state.c:551
 
    #5 0x56522525c050 in trnman_end_trn /data/src/10.3/storage/maria/trnman.c:474
 
    #6 0x5652252d6e2c in ma_commit /data/src/10.3/storage/maria/ma_commit.c:39
 
    #7 0x565225252c86 in ha_maria::implicit_commit(THD*, bool) /data/src/10.3/storage/maria/ha_maria.cc:2854
 
    #8 0x565223e1b383 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6110
 
    #9 0x565223e25de0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7818
 
    #10 0x565223e00acc in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1856
 
    #11 0x565223dfd9ab in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1401
 
    #12 0x565224173ae4 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #13 0x5652241734ab in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #14 0x5652255dd1f3 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #15 0x7ff76ff374a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
 
 
 
previously allocated by thread T27 here:
 
    #0 0x7ff77020ed28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
 
    #1 0x56522570cf9b in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
 
    #2 0x5652256dee24 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
 
    #3 0x5652252194c7 in _ma_setup_live_state /data/src/10.3/storage/maria/ma_state.c:81
 
    #4 0x565225252f83 in ha_maria::implicit_commit(THD*, bool) /data/src/10.3/storage/maria/ha_maria.cc:2893
 
    #5 0x565224503ee8 in ha_commit_trans(THD*, bool) /data/src/10.3/sql/handler.cc:1387
 
    #6 0x5652241a2f89 in trans_commit_stmt(THD*) /data/src/10.3/sql/transaction.cc:505
 
    #7 0x565223e1b353 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6106
 
    #8 0x565223e25de0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7818
 
    #9 0x565223e00acc in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1856
 
    #10 0x565223dfd9ab in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1401
 
    #11 0x565224173ae4 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #12 0x5652241734ab in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #13 0x5652255dd1f3 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #14 0x7ff76ff374a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7ff77017df59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
 
    #1 0x5652255dd62f in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
 
    #2 0x565223b6ab50 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
 
    #3 0x565223b7fe5c in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6600
 
    #4 0x565223b8053f in create_new_thread /data/src/10.3/sql/mysqld.cc:6670
 
    #5 0x565223b81557 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6945
 
    #6 0x565223b7f32c in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6222
 
    #7 0x565223b6926f in main /data/src/10.3/sql/main.cc:25
 
    #8 0x7ff76dfa32e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/maria/ha_maria.cc:2453 in ha_maria::info(unsigned int)
 
Shadow bytes around the buggy address:
 
  0x0c2280000d30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa
 
  0x0c2280000d40: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 
  0x0c2280000d50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c2280000d60: 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fa
 
  0x0c2280000d70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c2280000d80: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd
 
  0x0c2280000d90: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
  0x0c2280000da0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c2280000db0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
 
  0x0c2280000dc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c2280000dd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
==1693==ABORTING

Couldn't reproduce on 10.2 and 10.4.
No obvious problem on a non-ASAN build.
A similar failure happens on 10.1, but it could be because some Aria bugs were only fixed in 10.2+:

10.1 ASAN 359d91aa

 
==1954==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100001f4c0 at pc 0x55cef415a3ec bp 0x7f5f21902710 sp 0x7f5f21902708
 
READ of size 8 at 0x61100001f4c0 thread T23
 
    #0 0x55cef415a3eb in maria_status /data/src/10.1/storage/maria/ma_info.c:45
 
    #1 0x55cef417c2a3 in ha_maria::info(unsigned int) /data/src/10.1/storage/maria/ha_maria.cc:2497
 
    #2 0x55cef417d94f in ha_maria::update_create_info(HA_CREATE_INFO*) /data/src/10.1/storage/maria/ha_maria.cc:2998
 
    #3 0x55cef3947101 in get_schema_tables_record /data/src/10.1/sql/sql_show.cc:5191
 
    #4 0x55cef3927f7b in fill_schema_table_by_open /data/src/10.1/sql/sql_show.cc:4325
 
    #5 0x55cef3967150 in get_all_tables(THD*, TABLE_LIST*, Item*) /data/src/10.1/sql/sql_show.cc:4924
 
    #6 0x55cef396b765 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.1/sql/sql_show.cc:8280
 
    #7 0x55cef3910b0c in JOIN::exec_inner() /data/src/10.1/sql/sql_select.cc:2716
 
    #8 0x55cef3918831 in JOIN::exec() /data/src/10.1/sql/sql_select.cc:2564
 
    #9 0x55cef390b5dc in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.1/sql/sql_select.cc:3501
 
    #10 0x55cef390dbc9 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.1/sql/sql_select.cc:377
 
    #11 0x55cef37dd161 in execute_sqlcom_select /data/src/10.1/sql/sql_parse.cc:5691
 
    #12 0x55cef37f8974 in mysql_execute_command(THD*) /data/src/10.1/sql/sql_parse.cc:3038
 
    #13 0x55cef380f41b in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.1/sql/sql_parse.cc:7209
 
    #14 0x55cef3816753 in dispatch_command(enum_server_command, THD*, char*, unsigned int) /data/src/10.1/sql/sql_parse.cc:1499
 
    #15 0x55cef381b8fa in do_command(THD*) /data/src/10.1/sql/sql_parse.cc:1131
 
    #16 0x55cef3ac0862 in do_handle_one_connection(THD*) /data/src/10.1/sql/sql_connect.cc:1331
 
    #17 0x55cef3ac0e1a in handle_one_connection /data/src/10.1/sql/sql_connect.cc:1242
 
    #18 0x55cef442643a in pfs_spawn_thread /data/src/10.1/storage/perfschema/pfs.cc:1861
 
    #19 0x7f5f36ebb4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
 
    #20 0x7f5f356c9d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)
 
 
 
0x61100001f4c0 is located 128 bytes inside of 252-byte region [0x61100001f440,0x61100001f53c)
 
freed by thread T23 here:
 
    #0 0x7f5f37192a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)
 
    #1 0x55cef4ad0708 in free_memory /data/src/10.1/mysys/safemalloc.c:276
 
 
 
previously allocated by thread T23 here:
 
    #0 0x7f5f37192d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
 
    #1 0x55cef4ad08ac in sf_malloc /data/src/10.1/mysys/safemalloc.c:115
 
    #2 0x55cef4c2da52  (/data/bld/10.1-asan-nightly/bin/mysqld+0x1dcfa52)
 
 
 
Thread T23 created by T0 here:
 
    #0 0x7f5f37101f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
 
    #1 0x55cef4431dbe in spawn_thread_v1 /data/src/10.1/storage/perfschema/pfs.cc:1911
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.1/storage/maria/ma_info.c:45 in maria_status
 
Shadow bytes around the buggy address:
 
  0x0c227fffbe40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c227fffbe50: 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fa
 
  0x0c227fffbe60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c227fffbe70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa
 
  0x0c227fffbe80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
=>0x0c227fffbe90: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd
 
  0x0c227fffbea0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
 
  0x0c227fffbeb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c227fffbec0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c227fffbed0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
  0x0c227fffbee0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
==1954==ABORTING



 Comments   
Comment by Elena Stepanova [ 2021-02-25 ]

Very similar failure, slightly different stack trace. Also 10.3-only:

--source include/have_innodb.inc
 
 
 
CREATE TABLE t1 (a INT) ENGINE=Aria;
 
INSERT INTO t1 VALUES (1);
 
 
 
CREATE TABLE t2 (b INT) ENGINE=Aria;
 
INSERT INTO t2 VALUES (1),(2);
 
 
 
CREATE TABLE t3 (pk INT PRIMARY KEY) ENGINE=InnoDB;
 
INSERT INTO t3 VALUES (3),(4);
 
 
 
 
 
SELECT (SELECT COUNT(*) FROM t2, t3) FROM t1 WHERE a = 42;
 
SELECT * FROM INFORMATION_SCHEMA.KEY_COLUMN_USAGE WHERE CONSTRAINT_SCHEMA = 'test';
 
 
 
# Cleanup
 
DROP TABLE t1, t2, t3;

10.3 3e2afcb3

 
==1323368==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000060db0 at pc 0x55973950bf05 bp 0x7fd05a9b26c0 sp 0x7fd05a9b26b0
 
READ of size 4 at 0x611000060db0 thread T27
 
    #0 0x55973950bf04 in ha_maria::info(unsigned int) /data/src/10.3/storage/maria/ha_maria.cc:2453
 
    #1 0x5597380f59f3 in get_schema_key_column_usage_record /data/src/10.3/sql/sql_show.cc:7166
 
    #2 0x5597380d3977 in fill_schema_table_by_open /data/src/10.3/sql/sql_show.cc:4673
 
    #3 0x5597380d76a4 in get_all_tables(THD*, TABLE_LIST*, Item*) /data/src/10.3/sql/sql_show.cc:5280
 
    #4 0x55973810bf88 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.3/sql/sql_show.cc:8896
 
    #5 0x559737fe7928 in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4088
 
    #6 0x559737fe5a1b in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3919
 
    #7 0x559737fe948c in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4324
 
    #8 0x559737fc0016 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:370
 
    #9 0x559737f31b12 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6317
 
    #10 0x559737f1f61c in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3848
 
    #11 0x559737f3b885 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7841
 
    #12 0x559737f125d5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #13 0x559737f0f10c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #14 0x5597382da395 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #15 0x5597382d9c4f in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #16 0x5597398f5a14 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #17 0x7fd071445608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
    #18 0x7fd07101f292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
 
 
 
0x611000060db0 is located 176 bytes inside of 252-byte region [0x611000060d00,0x611000060dfc)
 
freed by thread T27 here:
 
    #0 0x7fd0719ac7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
 
    #1 0x559739a410b8 in free_memory /data/src/10.3/mysys/safemalloc.c:279
 
    #2 0x559739a40674 in sf_free /data/src/10.3/mysys/safemalloc.c:197
 
    #3 0x559739a0e9ae in my_free /data/src/10.3/mysys/my_malloc.c:223
 
    #4 0x5597394cfe25 in _ma_trnman_end_trans_hook /data/src/10.3/storage/maria/ma_state.c:551
 
    #5 0x55973951968f in trnman_end_trn /data/src/10.3/storage/maria/trnman.c:474
 
    #6 0x5597395a2959 in ma_commit /data/src/10.3/storage/maria/ma_commit.c:39
 
    #7 0x55973950f111 in ha_maria::implicit_commit(THD*, bool) /data/src/10.3/storage/maria/ha_maria.cc:2854
 
    #8 0x559737f2fb20 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6133
 
    #9 0x559737f3b885 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7841
 
    #10 0x559737f125d5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #11 0x559737f0f10c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #12 0x5597382da395 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #13 0x5597382d9c4f in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #14 0x5597398f5a14 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #15 0x7fd071445608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
 
 
previously allocated by thread T27 here:
 
    #0 0x7fd0719acbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
 
    #1 0x559739a40028 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
 
    #2 0x559739a0deb7 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
 
    #3 0x5597394ccaf2 in _ma_setup_live_state /data/src/10.3/storage/maria/ma_state.c:81
 
    #4 0x55973950f410 in ha_maria::implicit_commit(THD*, bool) /data/src/10.3/storage/maria/ha_maria.cc:2893
 
    #5 0x5597386955ae in ha_commit_trans(THD*, bool) /data/src/10.3/sql/handler.cc:1389
 
    #6 0x55973830ddec in trans_commit_stmt(THD*) /data/src/10.3/sql/transaction.cc:505
 
    #7 0x559737f2faf0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6129
 
    #8 0x559737f3b885 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7841
 
    #9 0x559737f125d5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #10 0x559737f0f10c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #11 0x5597382da395 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #12 0x5597382d9c4f in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #13 0x5597398f5a14 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #14 0x7fd071445608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7fd0718d9805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
 
    #1 0x5597398f5e05 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
 
    #2 0x559737c3a15e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x559737c52b51 in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6664
 
    #4 0x559737c532ec in create_new_thread /data/src/10.3/sql/mysqld.cc:6734
 
    #5 0x559737c5447e in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6992
 
    #6 0x559737c51e42 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6286
 
    #7 0x559737c3895c in main /data/src/10.3/sql/main.cc:25
 
    #8 0x7fd070f240b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/maria/ha_maria.cc:2453 in ha_maria::info(unsigned int)
 
Shadow bytes around the buggy address:
 
  0x0c2280004160: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c2280004170: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
  0x0c2280004180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c2280004190: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
 
  0x0c22800041a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c22800041b0: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd
 
  0x0c22800041c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 
  0x0c22800041d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c22800041e0: 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fa
 
  0x0c22800041f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c2280004200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==1323368==ABORTING

Generated at Thu Feb 08 09:06:57 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.