==1135105==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e000015f70 at pc 0x7f9322cb6e48 bp 0x7f93235d1d60 sp 0x7f93235d1d50

READ of size 4 at 0x61e000015f70 thread T28

    #0 0x7f9322cb6e47 in spider_db_direct_delete(ha_spider*, TABLE*, unsigned long long*) /home/nayuta_mariadb/repo/mariadb-server/10.4/storage/spider/spd_db_conn.cc:8282

    #1 0x7f9322e692fa in ha_spider::direct_delete_rows(unsigned long long*) /home/nayuta_mariadb/repo/mariadb-server/10.4/storage/spider/ha_spider.cc:11329

    #2 0x55bc241677d4 in handler::ha_direct_delete_rows(unsigned long long*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/handler.cc:6995

    #3 0x55bc245ca5d2 in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_delete.cc:654

    #4 0x55bc2397db0b in mysql_execute_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_parse.cc:4797

    #5 0x55bc23993fc1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_parse.cc:7995

    #6 0x55bc2396a052 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_parse.cc:1857

    #7 0x55bc23966ad7 in do_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_parse.cc:1378

    #8 0x55bc23d6ce41 in do_handle_one_connection(CONNECT*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_connect.cc:1420

    #9 0x55bc23d6c5be in handle_one_connection /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_connect.cc:1316

    #10 0x7f933ac7bb42  (/lib/x86_64-linux-gnu/libc.so.6+0x94b42)

    #11 0x7f933ad0cbb3 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x125bb3)

0x61e000015f70 is located 752 bytes inside of 2568-byte region [0x61e000015c80,0x61e000016688)

freed by thread T28 here:

    #0 0x7f933b3db517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127

    #1 0x55bc255b088b in my_free /home/nayuta_mariadb/repo/mariadb-server/10.4/mysys/my_malloc.c:222

    #2 0x7f9322dd061b in spider_free_mem(st_spider_transaction*, void*, unsigned long) /home/nayuta_mariadb/repo/mariadb-server/10.4/storage/spider/spd_malloc.cc:188

    #3 0x7f9322cf8856 in spider_free_conn(st_spider_conn*) /home/nayuta_mariadb/repo/mariadb-server/10.4/storage/spider/spd_conn.cc:1252

    #4 0x7f9322cf1d51 in spider_free_conn_from_trx(st_spider_transaction*, st_spider_conn*, bool, bool, int*) /home/nayuta_mariadb/repo/mariadb-server/10.4/storage/spider/spd_conn.cc:315

    #5 0x7f9322c325d3 in spider_free_trx_conn(st_spider_transaction*, bool) /home/nayuta_mariadb/repo/mariadb-server/10.4/storage/spider/spd_trx.cc:117

    #6 0x7f9322c4f41d in spider_commit(handlerton*, THD*, bool) /home/nayuta_mariadb/repo/mariadb-server/10.4/storage/spider/spd_trx.cc:3491

    #7 0x55bc2413aca3 in commit_one_phase_2 /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/handler.cc:1831

    #8 0x55bc2413a9b1 in ha_commit_one_phase(THD*, bool) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/handler.cc:1810

    #9 0x55bc241390a2 in ha_commit_trans(THD*, bool) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/handler.cc:1616

    #10 0x55bc23da9994 in trans_commit_stmt(THD*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/transaction.cc:437

    #11 0x55bc23988aed in mysql_execute_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_parse.cc:6250

    #12 0x55bc23993fc1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_parse.cc:7995

    #13 0x55bc2396a052 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_parse.cc:1857

    #14 0x55bc23966ad7 in do_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_parse.cc:1378

    #15 0x55bc23d6ce41 in do_handle_one_connection(CONNECT*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_connect.cc:1420

    #16 0x55bc23d6c5be in handle_one_connection /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_connect.cc:1316

    #17 0x7f933ac7bb42  (/lib/x86_64-linux-gnu/libc.so.6+0x94b42)

previously allocated by thread T28 here:

    #0 0x7f933b3db867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145

    #1 0x55bc255afc8c in my_malloc /home/nayuta_mariadb/repo/mariadb-server/10.4/mysys/my_malloc.c:101

    #2 0x7f9322dd0d7f in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /home/nayuta_mariadb/repo/mariadb-server/10.4/storage/spider/spd_malloc.cc:236

    #3 0x7f9322cf29a7 in spider_create_conn(st_spider_share*, ha_spider*, int, int, unsigned int, int*) /home/nayuta_mariadb/repo/mariadb-server/10.4/storage/spider/spd_conn.cc:478

    #4 0x7f9322cf7783 in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /home/nayuta_mariadb/repo/mariadb-server/10.4/storage/spider/spd_conn.cc:1080

    #5 0x7f9322d67779 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /home/nayuta_mariadb/repo/mariadb-server/10.4/storage/spider/spd_table.cc:5583

    #6 0x7f9322df7cad in ha_spider::open(char const*, int, unsigned int) /home/nayuta_mariadb/repo/mariadb-server/10.4/storage/spider/ha_spider.cc:360

    #7 0x55bc24142477 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/handler.cc:2811

    #8 0x55bc23c99d74 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/table.cc:4096

    #9 0x55bc237dba3f in open_table(THD*, TABLE_LIST*, Open_table_context*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_base.cc:2108

    #10 0x55bc237e547c in open_and_process_table /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_base.cc:3907

    #11 0x55bc237e8067 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_base.cc:4388

    #12 0x55bc237ed397 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_base.cc:5335

    #13 0x55bc237453e5 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_base.h:503

    #14 0x55bc2397cb05 in mysql_execute_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_parse.cc:4677

    #15 0x55bc23993fc1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_parse.cc:7995

    #16 0x55bc2396a052 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_parse.cc:1857

    #17 0x55bc23966ad7 in do_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_parse.cc:1378

    #18 0x55bc23d6ce41 in do_handle_one_connection(CONNECT*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_connect.cc:1420

    #19 0x55bc23d6c5be in handle_one_connection /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/sql_connect.cc:1316

    #20 0x7f933ac7bb42  (/lib/x86_64-linux-gnu/libc.so.6+0x94b42)

Thread T28 created by T0 here:

    #0 0x7f933b37f685 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:216

    #1 0x55bc256131f9 in spawn_thread_noop /home/nayuta_mariadb/repo/mariadb-server/10.4/mysys/psi_noop.c:187

    #2 0x55bc23661e3f in inline_mysql_thread_create /home/nayuta_mariadb/repo/mariadb-server/10.4/include/mysql/psi/mysql_thread.h:1275

    #3 0x55bc2367a508 in create_thread_to_handle_connection(CONNECT*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/mysqld.cc:6282

    #4 0x55bc2367acbd in create_new_thread(CONNECT*) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/mysqld.cc:6352

    #5 0x55bc2367b1ac in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/mysqld.cc:6450

    #6 0x55bc2367c07a in handle_connections_sockets() /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/mysqld.cc:6608

    #7 0x55bc23679bc2 in mysqld_main(int, char**) /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/mysqld.cc:5940

    #8 0x55bc2366008c in main /home/nayuta_mariadb/repo/mariadb-server/10.4/sql/main.cc:25

    #9 0x7f933ac10d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)

SUMMARY: AddressSanitizer: heap-use-after-free /home/nayuta_mariadb/repo/mariadb-server/10.4/storage/spider/spd_db_conn.cc:8282 in spider_db_direct_delete(ha_spider*, TABLE*, unsigned long long*)

Shadow bytes around the buggy address:

  0x0c3c7fffab90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3c7fffaba0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3c7fffabb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3c7fffabc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3c7fffabd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c3c7fffabe0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd

  0x0c3c7fffabf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3c7fffac00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3c7fffac10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3c7fffac20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3c7fffac30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==1135105==ABORTING

--echo #

--echo # MDEV-28683 Spider: SIGSEGV in spider_db_direct_delete, SIGSEGV in spider_db_connect, ASAN: heap-use-after-free in spider_db_direct_delete

--echo #

--disable_query_log

--disable_result_log

--source ../../t/test_init.inc

--enable_result_log

--enable_query_log

CREATE TABLE t (c INT) ENGINE=Spider;

--error ER_CONNECT_TO_FOREIGN_DATA_SOURCE

SELECT * FROM t;

# in 11.0: 1429, in 10.4: 12701

--error ER_CONNECT_TO_FOREIGN_DATA_SOURCE,12701

INSERT INTO t (SELECT 1 FROM t);

LOCK TABLES t WRITE CONCURRENT;

--error ER_CONNECT_TO_FOREIGN_DATA_SOURCE

DELETE FROM t;

UNLOCK TABLES;

DROP TABLE t;

--disable_query_log

--disable_result_log

--source ../../t/test_deinit.inc

--enable_result_log

--enable_query_log

--echo #

--echo # end of test mdev_28683

--echo #