[MDEV-28998] ASAN errors in spider_fields::free_conn_holder or spider_create_group_by_handler Created: 2022-07-01  Updated: 2023-10-20  Resolved: 2023-10-13

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - Spider
Affects Version/s: 10.3, 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11, 11.0
Fix Version/s: 10.4.32, 10.5.23, 10.6.16, 10.10.7, 10.11.6, 11.0.4, 11.1.3

Type: Bug Priority: Critical
Reporter: Elena Stepanova Assignee: Yuchen Pei
Resolution: Fixed Votes: 0
Labels: ASAN, memory_corruption, spider-gbh

Issue Links:
Relates
relates to MDEV-32238 Add a switch to disable spider group ... Closed

 Description    

--source plugin/spider/spider/include/init_spider.inc
 
 
 
SET spider_same_server_link = on;
 
eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT);
 
 
 
CREATE TABLE t1 (a INT);
 
INSERT INTO t1 VALUES (1),(2);
 
CREATE TABLE t1_SPIDER (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't1'";
 
 
 
CREATE TABLE t2 AS SELECT a FROM t1_SPIDER;
 
 
 
# Cleanup
 
DROP TABLE t2, t1_SPIDER, t1;
 
 
 
--source plugin/spider/spider/include/deinit_spider.inc

10.3 e34f8781

 
==4139841==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e00001ea10 at pc 0x7f7105e0a505 bp 0x7f7106159190 sp 0x7f7106159188
 
WRITE of size 8 at 0x61e00001ea10 thread T5
 
    #0 0x7f7105e0a504 in spider_fields::free_conn_holder(spider_conn_holder*) /data/src/10.3/storage/spider/spd_group_by_handler.cc:862:54
 
    #1 0x7f7105e09e62 in spider_fields::~spider_fields() /data/src/10.3/storage/spider/spd_group_by_handler.cc:95:7
 
    #2 0x7f7105e0a7ab in spider_fields::~spider_fields() /data/src/10.3/storage/spider/spd_group_by_handler.cc:61:1
 
    #3 0x7f7105e1e710 in spider_group_by_handler::~spider_group_by_handler() /data/src/10.3/storage/spider/spd_group_by_handler.cc:1190:3
 
    #4 0x7f7105e1e8ab in spider_group_by_handler::~spider_group_by_handler() /data/src/10.3/storage/spider/spd_group_by_handler.cc:1188:1
 
    #5 0xd6ce31 in Pushdown_query::~Pushdown_query() /data/src/10.3/sql/sql_select.h:2469:23
 
    #6 0xcc89a1 in JOIN::cleanup(bool) /data/src/10.3/sql/sql_select.cc:13243:5
 
    #7 0xcc753f in JOIN::destroy() /data/src/10.3/sql/sql_select.cc:4177:3
 
    #8 0xef3d42 in st_select_lex::cleanup() /data/src/10.3/sql/sql_union.cc:2102:18
 
    #9 0xc328f1 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4366:29
 
    #10 0xc312d4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372:10
 
    #11 0xea3fc3 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11400:20
 
    #12 0xb6a0e0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075:26
 
    #13 0xb42226 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870:18
 
    #14 0xb32dac in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
 
    #15 0xb3c0ac in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
 
    #16 0x10813d6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
 
    #17 0x1080aa3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
 
    #18 0x2e93861 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
 
    #19 0x7f7110c8fea6 in start_thread nptl/pthread_create.c:477:8
 
    #20 0x7f7110b9adee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
 
 
 
0x61e00001ea10 is located 2448 bytes inside of 2628-byte region [0x61e00001e080,0x61e00001eac4)
 
freed by thread T5 here:
 
    #0 0x71c53d in free (/mnt8t/bld/10.3-asan/bin/mysqld+0x71c53d)
 
    #1 0x306d1c7 in free_memory /data/src/10.3/mysys/safemalloc.c:279:3
 
    #2 0x306d21d in sf_free /data/src/10.3/mysys/safemalloc.c:197:3
 
    #3 0x30252cf in my_free /data/src/10.3/mysys/my_malloc.c:223:5
 
    #4 0x7f7105bb854c in spider_free_mem(st_spider_transaction*, void*, unsigned long) /data/src/10.3/storage/spider/spd_malloc.cc:187:3
 
    #5 0x7f7105a7a1c1 in spider_free_conn(st_spider_conn*) /data/src/10.3/storage/spider/spd_conn.cc:1246:3
 
    #6 0x7f7105a79679 in spider_free_conn_from_trx(st_spider_transaction*, st_spider_conn*, bool, bool, int*) /data/src/10.3/storage/spider/spd_conn.cc:309:9
 
    #7 0x7f710596ecd0 in spider_free_trx_conn(st_spider_transaction*, bool) /data/src/10.3/storage/spider/spd_trx.cc:116:9
 
    #8 0x7f710599b02f in spider_commit(handlerton*, THD*, bool) /data/src/10.3/storage/spider/spd_trx.cc:3454:5
 
    #9 0x15a85a0 in commit_one_phase_2(THD*, bool, THD_TRANS*, bool) /data/src/10.3/sql/handler.cc:1658:17
 
    #10 0x15a8e56 in ha_commit_one_phase(THD*, bool) /data/src/10.3/sql/handler.cc:1638:8
 
    #11 0x15a6926 in ha_commit_trans(THD*, bool) /data/src/10.3/sql/handler.cc:1500:12
 
    #12 0x10c6e19 in trans_commit_stmt(THD*) /data/src/10.3/sql/transaction.cc:506:10
 
    #13 0xaa1c85 in select_create::send_eof() /data/src/10.3/sql/sql_insert.cc:4760:5
 
    #14 0xe08373 in Pushdown_query::execute(JOIN*) /data/src/10.3/sql/group_by_handler.cc:126:50
 
    #15 0xcc52d4 in do_select(JOIN*, Procedure*) /data/src/10.3/sql/sql_select.cc:19331:36
 
    #16 0xcc28a5 in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4151:50
 
    #17 0xcbf33e in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3945:3
 
    #18 0xc326ec in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4354:9
 
    #19 0xc312d4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372:10
 
    #20 0xea3fc3 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11400:20
 
    #21 0xb6a0e0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075:26
 
    #22 0xb42226 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870:18
 
    #23 0xb32dac in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
 
    #24 0xb3c0ac in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
 
    #25 0x10813d6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
 
    #26 0x1080aa3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
 
    #27 0x2e93861 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
 
    #28 0x7f7110c8fea6 in start_thread nptl/pthread_create.c:477:8
 
 
 
previously allocated by thread T5 here:
 
    #0 0x71c7bd in malloc (/mnt8t/bld/10.3-asan/bin/mysqld+0x71c7bd)
 
    #1 0x306c180 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118:28
 
    #2 0x3024d4f in my_malloc /data/src/10.3/mysys/my_malloc.c:101:10
 
    #3 0x7f7105bb925e in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /data/src/10.3/storage/spider/spd_malloc.cc:235:29
 
    #4 0x7f7105a7b8bd in spider_create_conn(st_spider_share*, ha_spider*, int, int, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:472:7
 
    #5 0x7f7105a829fb in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:1074:20
 
    #6 0x7f7105b2632c in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /data/src/10.3/storage/spider/spd_table.cc:5020:13
 
    #7 0x7f7105bf1b45 in ha_spider::open(char const*, int, unsigned int) /data/src/10.3/storage/spider/ha_spider.cc:359:8
 
    #8 0x15b2873 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.3/sql/handler.cc:2778:7
 
    #9 0xf6ae58 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.3/sql/table.cc:3690:33
 
    #10 0x94ca65 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:2004:12
 
    #11 0x95a7d5 in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /data/src/10.3/sql/sql_base.cc:3731:14
 
    #12 0x956531 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4206:14
 
    #13 0x963998 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5146:7
 
    #14 0xeaf50f in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:495:10
 
    #15 0xea3957 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11348:10
 
    #16 0xb6a0e0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075:26
 
    #17 0xb42226 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870:18
 
    #18 0xb32dac in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
 
    #19 0xb3c0ac in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
 
    #20 0x10813d6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
 
    #21 0x1080aa3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
 
    #22 0x2e93861 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
 
    #23 0x7f7110c8fea6 in start_thread nptl/pthread_create.c:477:8
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7071ea in pthread_create (/mnt8t/bld/10.3-asan/bin/mysqld+0x7071ea)
 
    #1 0x2e99b09 in spawn_thread_v1(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.3/storage/perfschema/pfs.cc:1919:15
 
    #2 0x757a1a in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.3/include/mysql/psi/mysql_thread.h:1275:11
 
    #3 0x769453 in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6668:15
 
    #4 0x76ac4a in create_new_thread(CONNECT*) /data/src/10.3/sql/mysqld.cc:6738:3
 
    #5 0x7689cd in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6996:9
 
    #6 0x75b3de in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6290:3
 
    #7 0x74ed61 in main /data/src/10.3/sql/main.cc:25:10
 
    #8 0x7f7110ac3d09 in __libc_start_main csu/../csu/libc-start.c:308:16
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/spider/spd_group_by_handler.cc:862:54 in spider_fields::free_conn_holder(spider_conn_holder*)
 
Shadow bytes around the buggy address:
 
  0x0c3c7fffbcf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3c7fffbd00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3c7fffbd10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3c7fffbd20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3c7fffbd30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c3c7fffbd40: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3c7fffbd50: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
 
  0x0c3c7fffbd60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3c7fffbd70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3c7fffbd80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3c7fffbd90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==4139841==ABORTING

Same test case, only t2 already exists; very different stack trace:

--source plugin/spider/spider/include/init_spider.inc
 
 
 
SET spider_same_server_link = on;
 
eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT);
 
 
 
CREATE TABLE t1 (a INT);
 
INSERT INTO t1 VALUES (1),(2);
 
CREATE TABLE t1_SPIDER (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't1'";
 
 
 
CREATE TABLE t2 (x INT);
 
CREATE OR REPLACE TABLE t2 AS SELECT a FROM t1_SPIDER;
 
 
 
# Cleanup
 
DROP TABLE t2, t1_SPIDER, t1;
 
 
 
--source plugin/spider/spider/include/deinit_spider.inc

10.3 63137022

 
==620941==ERROR: AddressSanitizer: heap-use-after-free on address 0x61c00004d95c at pc 0x7f5a73caf99f bp 0x7f5a73eefd20 sp 0x7f5a73eefd18
 
READ of size 4 at 0x61c00004d95c thread T5
 
    #0 0x7f5a73caf99e in spider_create_group_by_handler(THD*, Query*) /data/src/10.3/storage/spider/spd_group_by_handler.cc:1964
 
    #1 0x55c848e0d039 in JOIN::make_aggr_tables_info() /data/src/10.3/sql/sql_select.cc:2927
 
    #2 0x55c848e2c971 in JOIN::optimize_stage2() /data/src/10.3/sql/sql_select.cc:2697
 
    #3 0x55c848e367da in JOIN::optimize_inner() /data/src/10.3/sql/sql_select.cc:2003
 
    #4 0x55c848e3d741 in JOIN::optimize() /data/src/10.3/sql/sql_select.cc:1519
 
    #5 0x55c848e45b58 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4340
 
    #6 0x55c848e465ff in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372
 
    #7 0x55c848f0cd96 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11399
 
    #8 0x55c848cf3526 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075
 
    #9 0x55c848d045d7 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870
 
    #10 0x55c848d09119 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #11 0x55c848d0eebd in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #12 0x55c84902cc36 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #13 0x55c84902d49a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #14 0x55c84a2730f4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #15 0x7f5a7e910ea6 in start_thread nptl/pthread_create.c:477
 
    #16 0x7f5a7e840dee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfddee)
 
 
 
0x61c00004d95c is located 220 bytes inside of 1880-byte region [0x61c00004d880,0x61c00004dfd8)
 
freed by thread T5 here:
 
    #0 0x7f5a7f1b2b6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123
 
    #1 0x7f5a73be9811 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /data/src/10.3/storage/spider/spd_malloc.cc:187
 
    #2 0x7f5a73b4ebf0 in spider_free_conn(st_spider_conn*) /data/src/10.3/storage/spider/spd_conn.cc:1246
 
    #3 0x7f5a73b4f28f in spider_free_conn_from_trx(st_spider_transaction*, st_spider_conn*, bool, bool, int*) /data/src/10.3/storage/spider/spd_conn.cc:286
 
    #4 0x7f5a73ae5293 in spider_free_trx_conn(st_spider_transaction*, bool) /data/src/10.3/storage/spider/spd_trx.cc:116
 
    #5 0x7f5a73af5152 in spider_rollback(handlerton*, THD*, bool) /data/src/10.3/storage/spider/spd_trx.cc:3527
 
    #6 0x55c8493415d2 in ha_rollback_trans(THD*, bool) /data/src/10.3/sql/handler.cc:1765
 
    #7 0x55c8490595ba in trans_rollback_stmt(THD*) /data/src/10.3/sql/transaction.cc:569
 
    #8 0x55c848f07aee in create_table_impl /data/src/10.3/sql/sql_table.cc:5025
 
    #9 0x55c848f0889b in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /data/src/10.3/sql/sql_table.cc:5239
 
    #10 0x55c848c53d30 in select_create::create_table_from_items(THD*, List<Item>*, st_mysql_lock**, TABLEOP_HOOKS*) /data/src/10.3/sql/sql_insert.cc:4352
 
    #11 0x55c848c54a97 in select_create::prepare(List<Item>&, st_select_lex_unit*) /data/src/10.3/sql/sql_insert.cc:4543
 
    #12 0x55c848e03c0b in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /data/src/10.3/sql/sql_select.cc:1407
 
    #13 0x55c848e45b41 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4332
 
    #14 0x55c848e465ff in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372
 
    #15 0x55c848f0cd96 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11399
 
    #16 0x55c848cf3526 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075
 
    #17 0x55c848d045d7 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870
 
    #18 0x55c848d09119 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #19 0x55c848d0eebd in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #20 0x55c84902cc36 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #21 0x55c84902d49a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #22 0x55c84a2730f4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #23 0x7f5a7e910ea6 in start_thread nptl/pthread_create.c:477
 
 
 
previously allocated by thread T5 here:
 
    #0 0x7f5a7f1b2e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
 
    #1 0x55c84a344462 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
 
    #2 0x7f5a73be9b3b in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /data/src/10.3/storage/spider/spd_malloc.cc:235
 
    #3 0x7f5a73b612d6 in spider_create_conn(st_spider_share*, ha_spider*, int, int, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:472
 
    #4 0x7f5a73b6689e in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:1074
 
    #5 0x7f5a73bb9662 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /data/src/10.3/storage/spider/spd_table.cc:5020
 
    #6 0x7f5a73c05504 in ha_spider::open(char const*, int, unsigned int) /data/src/10.3/storage/spider/ha_spider.cc:359
 
    #7 0x55c84934692f in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.3/sql/handler.cc:2778
 
    #8 0x55c848f9df74 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.3/sql/table.cc:3690
 
    #9 0x55c848bacd8f in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:2004
 
    #10 0x55c848bb5eb9 in open_and_process_table /data/src/10.3/sql/sql_base.cc:3731
 
    #11 0x55c848bb5eb9 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4206
 
    #12 0x55c848bb7b9e in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5146
 
    #13 0x55c848f0ca66 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:495
 
    #14 0x55c848f0ca66 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11347
 
    #15 0x55c848cf3526 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075
 
    #16 0x55c848d045d7 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870
 
    #17 0x55c848d09119 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
 
    #18 0x55c848d0eebd in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
 
    #19 0x55c84902cc36 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
 
    #20 0x55c84902d49a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #21 0x55c84a2730f4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
 
    #22 0x7f5a7e910ea6 in start_thread nptl/pthread_create.c:477
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7f5a7f15e2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
 
    #1 0x55c84a27774a in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
 
    #2 0x55c848a9bf3b in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x55c848a9bf3b in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6668
 
    #4 0x55c848aac24d in create_new_thread /data/src/10.3/sql/mysqld.cc:6738
 
    #5 0x55c848aac24d in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6996
 
    #6 0x55c848aae1f5 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6290
 
    #7 0x7f5a7e769d09 in __libc_start_main ../csu/libc-start.c:308
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/spider/spd_group_by_handler.cc:1964 in spider_create_group_by_handler(THD*, Query*)
 
Shadow bytes around the buggy address:
 
  0x0c3880001ad0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3880001ae0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3880001af0: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3880001b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3880001b10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c3880001b20: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
 
  0x0c3880001b30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3880001b40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3880001b50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3880001b60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3880001b70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==620941==ABORTING

This one also crashes on a non-ASAN build.

 Comments   
Comment by Roel Van de Paar [ 2023-05-20 ]

I ran into this one as well

--source include/have_innodb.inc
 
--let $SOCKET= `SELECT @@global.socket`
 
INSTALL PLUGIN Spider SONAME 'ha_spider.so';
 
CREATE USER spider@localhost IDENTIFIED BY 'pwd';
 
GRANT ALL ON test.* TO spider@localhost;
 
eval CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET "$SOCKET",DATABASE 'test',USER 'spider',PASSWORD 'pwd');
 
CREATE TABLE t0 (c INT KEY,c1 BLOB,c2 TEXT) ENGINE=InnoDB;
 
CREATE TABLE t1 (c INT KEY,c1 BLOB,c2 TEXT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t0"';
 
CREATE TABLE t2 SELECT * FROM t1;

Leads to:

11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug, UBASAN)

 
==3990238==ERROR: AddressSanitizer: heap-use-after-free on address 0x61f000014c10 at pc 0x14b4cf66be86 bp 0x14b4d0201e10 sp 0x14b4d0201e00
 
WRITE of size 8 at 0x61f000014c10 thread T20
 
    #0 0x14b4cf66be85 in spider_fields::free_conn_holder(spider_conn_holder*) /test/11.0_dbg_san/storage/spider/spd_group_by_handler.cc:858
 
    #1 0x14b4cf66cc9a in spider_fields::~spider_fields() /test/11.0_dbg_san/storage/spider/spd_group_by_handler.cc:91
 
    #2 0x14b4cf66ce6e in spider_fields::~spider_fields() /test/11.0_dbg_san/storage/spider/spd_group_by_handler.cc:95
 
    #3 0x14b4cf664b02 in spider_group_by_handler::~spider_group_by_handler() /test/11.0_dbg_san/storage/spider/spd_group_by_handler.cc:1185
 
    #4 0x14b4cf664cce in spider_group_by_handler::~spider_group_by_handler() /test/11.0_dbg_san/storage/spider/spd_group_by_handler.cc:1187
 
    #5 0x55abb27e5302 in Pushdown_query::~Pushdown_query() /test/11.0_dbg_san/sql/sql_select.h:2589
 
    #6 0x55abb27e5302 in JOIN::cleanup(bool) /test/11.0_dbg_san/sql/sql_select.cc:16224
 
    #7 0x55abb27e5cde in JOIN::destroy() /test/11.0_dbg_san/sql/sql_select.cc:4929
 
    #8 0x55abb2b66033 in st_select_lex::cleanup() /test/11.0_dbg_san/sql/sql_union.cc:2798
 
    #9 0x55abb2833685 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5177
 
    #10 0x55abb283451c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616
 
    #11 0x55abb2ab7896 in Sql_cmd_create_table_like::execute(THD*) /test/11.0_dbg_san/sql/sql_table.cc:12435
 
    #12 0x55abb242e054 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:6015
 
    #13 0x55abb2437973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
 
    #14 0x55abb2447707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
 
    #15 0x55abb2455542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
 
    #16 0x55abb2e2a8b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
 
    #17 0x55abb2e2bdd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
 
    #18 0x14b4da494b42 in start_thread nptl/pthread_create.c:442
 
    #19 0x14b4da5269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
 
 
 
0x61f000014c10 is located 2448 bytes inside of 3336-byte region [0x61f000014280,0x61f000014f88)
 
freed by thread T20 here:
 
    #0 0x55abb1abbfe7 in __interceptor_free (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7963fe7)
 
    #1 0x55abb61d3a61 in my_free /test/11.0_dbg_san/mysys/my_malloc.c:213
 
    #2 0x14b4cf452150 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /test/11.0_dbg_san/storage/spider/spd_malloc.cc:183
 
    #3 0x14b4cf36464b in spider_free_conn(st_spider_conn*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:860
 
    #4 0x14b4cf3830d5 in spider_free_conn_from_trx(st_spider_transaction*, st_spider_conn*, bool, bool, int*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:372
 
    #5 0x14b4cf2764da in spider_free_trx_conn(st_spider_transaction*, bool) /test/11.0_dbg_san/storage/spider/spd_trx.cc:114
 
    #6 0x14b4cf28e073 in spider_commit(handlerton*, THD*, bool) /test/11.0_dbg_san/storage/spider/spd_trx.cc:3236
 
    #7 0x55abb3b1cd21 in commit_one_phase_2 /test/11.0_dbg_san/sql/handler.cc:2138
 
    #8 0x55abb3b1d7f1 in ha_commit_one_phase(THD*, bool) /test/11.0_dbg_san/sql/handler.cc:2091
 
    #9 0x55abb3b9631e in ha_commit_trans(THD*, bool) /test/11.0_dbg_san/sql/handler.cc:1885
 
    #10 0x55abb2ec05ec in trans_commit_stmt(THD*) /test/11.0_dbg_san/sql/transaction.cc:472
 
    #11 0x55abb21d9df3 in select_create::send_eof() /test/11.0_dbg_san/sql/sql_insert.cc:5135
 
    #12 0x55abb29b6c72 in Pushdown_query::execute(JOIN*) /test/11.0_dbg_san/sql/group_by_handler.cc:129
 
    #13 0x55abb283e68f in do_select /test/11.0_dbg_san/sql/sql_select.cc:22665
 
    #14 0x55abb283e68f in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4900
 
    #15 0x55abb2841916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677
 
    #16 0x55abb28300c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158
 
    #17 0x55abb283451c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616
 
    #18 0x55abb2ab7896 in Sql_cmd_create_table_like::execute(THD*) /test/11.0_dbg_san/sql/sql_table.cc:12435
 
    #19 0x55abb242e054 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:6015
 
    #20 0x55abb2437973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
 
    #21 0x55abb2447707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
 
    #22 0x55abb2455542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
 
    #23 0x55abb2e2a8b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
 
    #24 0x55abb2e2bdd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
 
    #25 0x14b4da494b42 in start_thread nptl/pthread_create.c:442
 
 
 
previously allocated by thread T20 here:
 
    #0 0x55abb1abc337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337)
 
    #1 0x55abb61d3703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91
 
    #2 0x14b4cf452583 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /test/11.0_dbg_san/storage/spider/spd_malloc.cc:231
 
    #3 0x14b4cf37840c in spider_create_conn(st_spider_share*, ha_spider*, int, int, int*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:412
 
    #4 0x14b4cf37f18a in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, int*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:767
 
    #5 0x14b4cf3977cf in spider_share_get_conns(ha_spider*, st_spider_share*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:4868
 
    #6 0x14b4cf40505c in spider_init_share(char const*, TABLE*, THD*, ha_spider*, int*, st_spider_share*, TABLE_SHARE*, bool) /test/11.0_dbg_san/storage/spider/spd_table.cc:5138
 
    #7 0x14b4cf406475 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:5252
 
    #8 0x14b4cf505021 in ha_spider::open(char const*, int, unsigned int) /test/11.0_dbg_san/storage/spider/ha_spider.cc:312
 
    #9 0x55abb3b28235 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.0_dbg_san/sql/handler.cc:3487
 
    #10 0x55abb2c71885 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4540
 
    #11 0x55abb1fc03e3 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178
 
    #12 0x55abb1fd7f14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108
 
    #13 0x55abb1fd7f14 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595
 
    #14 0x55abb1fdedbe in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:5570
 
    #15 0x55abb2ab5ebc in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int) /test/11.0_dbg_san/sql/sql_base.h:502
 
    #16 0x55abb2ab5ebc in Sql_cmd_create_table_like::execute(THD*) /test/11.0_dbg_san/sql/sql_table.cc:12384
 
    #17 0x55abb242e054 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:6015
 
    #18 0x55abb2437973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
 
    #19 0x55abb2447707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
 
    #20 0x55abb2455542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
 
    #21 0x55abb2e2a8b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
 
    #22 0x55abb2e2bdd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
 
    #23 0x14b4da494b42 in start_thread nptl/pthread_create.c:442
 
 
 
Thread T20 created by T0 here:
 
    #0 0x55abb1a60175 in pthread_create (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7908175)
 
    #1 0x55abb1b1698b in create_thread_to_handle_connection(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6129
 
    #2 0x55abb1b23e67 in create_new_thread(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6191
 
    #3 0x55abb1b246e7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_dbg_san/sql/mysqld.cc:6253
 
    #4 0x55abb1b25738 in handle_connections_sockets() /test/11.0_dbg_san/sql/mysqld.cc:6377
 
    #5 0x55abb1b2cee7 in mysqld_main(int, char**) /test/11.0_dbg_san/sql/mysqld.cc:6024
 
    #6 0x55abb1b01eca in main /test/11.0_dbg_san/sql/main.cc:34
 
    #7 0x14b4da429d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /test/11.0_dbg_san/storage/spider/spd_group_by_handler.cc:858 in spider_fields::free_conn_holder(spider_conn_holder*)
 
Shadow bytes around the buggy address:
 
  0x0c3e7fffa930: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3e7fffa940: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3e7fffa950: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3e7fffa960: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3e7fffa970: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c3e7fffa980: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3e7fffa990: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3e7fffa9a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3e7fffa9b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3e7fffa9c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3e7fffa9d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==3990238==ABORTING
 
230520 14:29:58 [ERROR] mysqld got signal 6 ;

Comment by Yuchen Pei [ 2023-09-22 ]

mtr case

--disable_query_log
 
--disable_result_log
 
--source ../../t/test_init.inc
 
--enable_result_log
 
--enable_query_log
 
evalp CREATE SERVER s FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'root');
 
 
 
CREATE TABLE t1 (a INT);
 
INSERT INTO t1 VALUES (1),(2);
 
CREATE TABLE t1_SPIDER (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't1'";
 
 
 
CREATE TABLE t2 AS SELECT a FROM t1_SPIDER;
 
 
 
# Cleanup
 
DROP TABLE t2, t1_SPIDER, t1;
 
drop server s;
 
 
 
--disable_query_log
 
--disable_result_log
 
--source ../../t/test_deinit.inc
 
--enable_result_log
 
--enable_query_log

Comment by Yuchen Pei [ 2023-09-28 ]

Hi holyfoot, ptal thanks

commit 363598fd28ed13ec850e126bb3a208c55e1cd145 (bb-11.0-ycp-mdev-28998)
 
Author: Yuchen Pei <ycp@mariadb.com>
 
Date:   Thu Sep 28 16:16:06 2023 +1000
 
 
 
    MDEV-28998 remove a known reference to a SPIDER_CONN when it is freed

10.4 patch: 8a12656e9d14cb06cc250a153a23bac0545e9d13

Comment by Alexey Botchkov [ 2023-10-10 ]

ok to push.

Comment by Yuchen Pei [ 2023-10-13 ]

Thanks for the review.

Pushed 5c6fceec769296a52b52fcd6d34394029950094c to 10.4.

Conflicts and solutions:
10.6->10.10: 008f29e77c37273cd151e8244a868e2de545750f (caused by 50784c88694098a583e7483489a01df0dafa4522 MDEV-32238 adding the same test with a workaround)

Generated at Thu Feb 08 10:05:05 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.