[MDEV-29002] ASAN errors in spider_conn_queue_and_merge_loop_check Created: 2022-07-01  Updated: 2024-01-15  Resolved: 2024-01-11

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - Spider
Affects Version/s: 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11, 11.0, 11.1
Fix Version/s: 10.5.24, 10.6.17, 10.11.7, 11.0.5, 11.1.4, 11.2.3

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Yuchen Pei
Resolution: Fixed Votes: 0
Labels: ASAN, memory_corruption

Issue Links:
Relates
relates to MDEV-27902 Spider: Crashes, asserts, hangs, corr... Stalled

 Description    

--source plugin/spider/spider/include/init_spider.inc
 
 
 
SET spider_same_server_link= on;
 
eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT);
 
 
 
CREATE TABLE t (a INT);
 
CREATE TABLE t1_spider (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't'";
 
CREATE TABLE t2_spider (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't'";
 
SELECT * FROM t1_spider, t2_spider;
 
SELECT table_name, index_name, cardinality FROM INFORMATION_SCHEMA.STATISTICS WHERE table_name IN ('t1_spider','t2_spider');
 
RENAME TABLE t1_spider TO t3_spider;
 
SELECT * FROM t3_spider;
 
 
 
# Cleanup
 
DROP TABLE t3_spider, t2_spider, t;
 
 
 
--source plugin/spider/spider/include/deinit_spider.inc

10.5 a1267724

 
==3280==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000025b48 at pc 0x7f41c82328e8 bp 0x7f41c8b068b0 sp 0x7f41c8b068a8
 
WRITE of size 8 at 0x614000025b48 thread T5
 
    #0 0x7f41c82328e7 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /data/src/10.5/storage/spider/spd_conn.cc:1763:43
 
    #1 0x7f41c822b2e3 in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /data/src/10.5/storage/spider/spd_conn.cc:2038:20
 
    #2 0x7f41c822584e in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/src/10.5/storage/spider/spd_conn.cc:1373:9
 
    #3 0x7f41c82d6534 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /data/src/10.5/storage/spider/spd_table.cc:5350:13
 
    #4 0x7f41c83b3d36 in ha_spider::open(char const*, int, unsigned int) /data/src/10.5/storage/spider/ha_spider.cc:444:18
 
    #5 0x180128c in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.5/sql/handler.cc:3013:7
 
    #6 0x117a570 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.5/sql/table.cc:4322:33
 
    #7 0xada623 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.5/sql/sql_base.cc:2014:12
 
    #8 0xae9aea in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /data/src/10.5/sql/sql_base.cc:3805:14
 
    #9 0xae5777 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:4288:14
 
    #10 0xaf3ab8 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:5235:7
 
    #11 0xa01153 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.5/sql/sql_base.h:507:10
 
    #12 0xd3568f in execute_sqlcom_select(THD*, TABLE_LIST*) /data/src/10.5/sql/sql_parse.cc:6235:14
 
    #13 0xd1ad80 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4005:12
 
    #14 0xd01ae2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8100:18
 
    #15 0xcf9d4d in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891:7
 
    #16 0xd04374 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375:17
 
    #17 0x12ad9ef in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1418:11
 
    #18 0x12acf73 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312:5
 
    #19 0x23b95f7 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201:3
 
    #20 0x7f41d208bea6 in start_thread nptl/pthread_create.c:477:8
 
    #21 0x7f41d1dc3dee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
 
 
 
0x614000025b48 is located 264 bytes inside of 436-byte region [0x614000025a40,0x614000025bf4)
 
freed by thread T5 here:
 
    #0 0x89b3ed in free (/mnt8t/bld/10.5-asan/bin/mariadbd+0x89b3ed)
 
    #1 0x3484847 in free_memory /data/src/10.5/mysys/safemalloc.c:280:3
 
    #2 0x348489d in sf_free /data/src/10.5/mysys/safemalloc.c:198:3
 
    #3 0x343cf38 in my_free /data/src/10.5/mysys/my_malloc.c:211:3
 
    #4 0x7f41c837472c in spider_free_mem(st_spider_transaction*, void*, unsigned long) /data/src/10.5/storage/spider/spd_malloc.cc:188:3
 
    #5 0x7f41c823261b in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /data/src/10.5/storage/spider/spd_conn.cc:1735:5
 
    #6 0x7f41c822b2e3 in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /data/src/10.5/storage/spider/spd_conn.cc:2038:20
 
    #7 0x7f41c822584e in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/src/10.5/storage/spider/spd_conn.cc:1373:9
 
    #8 0x7f41c82d6534 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /data/src/10.5/storage/spider/spd_table.cc:5350:13
 
    #9 0x7f41c83b3d36 in ha_spider::open(char const*, int, unsigned int) /data/src/10.5/storage/spider/ha_spider.cc:444:18
 
    #10 0x180128c in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.5/sql/handler.cc:3013:7
 
    #11 0x117a570 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.5/sql/table.cc:4322:33
 
    #12 0xada623 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.5/sql/sql_base.cc:2014:12
 
    #13 0xae9aea in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /data/src/10.5/sql/sql_base.cc:3805:14
 
    #14 0xae5777 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:4288:14
 
    #15 0xaf3ab8 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:5235:7
 
    #16 0xa01153 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.5/sql/sql_base.h:507:10
 
    #17 0xd3568f in execute_sqlcom_select(THD*, TABLE_LIST*) /data/src/10.5/sql/sql_parse.cc:6235:14
 
    #18 0xd1ad80 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4005:12
 
    #19 0xd01ae2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8100:18
 
    #20 0xcf9d4d in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891:7
 
    #21 0xd04374 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375:17
 
    #22 0x12ad9ef in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1418:11
 
    #23 0x12acf73 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312:5
 
    #24 0x23b95f7 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201:3
 
    #25 0x7f41d208bea6 in start_thread nptl/pthread_create.c:477:8
 
 
 
previously allocated by thread T5 here:
 
    #0 0x89b66d in malloc (/mnt8t/bld/10.5-asan/bin/mariadbd+0x89b66d)
 
    #1 0x34837fb in sf_malloc /data/src/10.5/mysys/safemalloc.c:121:34
 
    #2 0x343bb73 in my_malloc /data/src/10.5/mysys/my_malloc.c:90:29
 
    #3 0x7f41c8375440 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /data/src/10.5/storage/spider/spd_malloc.cc:236:29
 
    #4 0x7f41c8231415 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /data/src/10.5/storage/spider/spd_conn.cc:1679:9
 
    #5 0x7f41c822b2e3 in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /data/src/10.5/storage/spider/spd_conn.cc:2038:20
 
    #6 0x7f41c822584e in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/src/10.5/storage/spider/spd_conn.cc:1373:9
 
    #7 0x7f41c812b4f7 in spider_check_trx_and_get_conn(THD*, ha_spider*, bool) /data/src/10.5/storage/spider/spd_trx.cc:3825:15
 
    #8 0x7f41c8467e25 in ha_spider::check_crd() /data/src/10.5/storage/spider/ha_spider.cc:9138:20
 
    #9 0x7f41c8464570 in ha_spider::info(unsigned int) /data/src/10.5/storage/spider/ha_spider.cc:8674:24
 
    #10 0xfd25d3 in get_schema_stat_record(THD*, TABLE_LIST*, TABLE*, bool, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*) /data/src/10.5/sql/sql_show.cc:6713:25
 
    #11 0xf9b265 in fill_schema_table_by_open(THD*, st_mem_root*, bool, TABLE*, st_schema_table*, st_mysql_const_lex_string*, st_mysql_const_lex_string*, Open_tables_backup*, bool) /data/src/10.5/sql/sql_show.cc:4682:13
 
    #12 0xf99efc in get_all_tables(THD*, TABLE_LIST*, Item*) /data/src/10.5/sql/sql_show.cc:5316:17
 
    #13 0xfc1c79 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.5/sql/sql_show.cc:8854:11
 
    #14 0xe8d942 in JOIN::exec_inner() /data/src/10.5/sql/sql_select.cc:4497:7
 
    #15 0xe8aac6 in JOIN::exec() /data/src/10.5/sql/sql_select.cc:4320:3
 
    #16 0xe0685b in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.5/sql/sql_select.cc:4797:9
 
    #17 0xe05482 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:444:10
 
    #18 0xd36648 in execute_sqlcom_select(THD*, TABLE_LIST*) /data/src/10.5/sql/sql_parse.cc:6314:12
 
    #19 0xd1ad80 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4005:12
 
    #20 0xd01ae2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8100:18
 
    #21 0xcf9d4d in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891:7
 
    #22 0xd04374 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375:17
 
    #23 0x12ad9ef in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1418:11
 
    #24 0x12acf73 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312:5
 
    #25 0x23b95f7 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201:3
 
    #26 0x7f41d208bea6 in start_thread nptl/pthread_create.c:477:8
 
 
 
Thread T5 created by T0 here:
 
    #0 0x88609a in pthread_create (/mnt8t/bld/10.5-asan/bin/mariadbd+0x88609a)
 
    #1 0x23b9c4c in my_thread_create(unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.5/storage/perfschema/my_thread.h:52:10
 
    #2 0x23b9bd6 in pfs_spawn_thread_v1 /data/src/10.5/storage/perfschema/pfs.cc:2252:15
 
    #3 0x8d4ab2 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.5/include/mysql/psi/mysql_thread.h:1323:11
 
    #4 0x8e671f in create_thread_to_handle_connection(CONNECT*) /data/src/10.5/sql/mysqld.cc:6051:19
 
    #5 0x8e704e in create_new_thread(CONNECT*) /data/src/10.5/sql/mysqld.cc:6110:3
 
    #6 0x8e7ab0 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.5/sql/mysqld.cc:6175:5
 
    #7 0x8e49a4 in handle_connections_sockets() /data/src/10.5/sql/mysqld.cc:6302:9
 
    #8 0x8d8c34 in mysqld_main(int, char**) /data/src/10.5/sql/mysqld.cc:5697:3
 
    #9 0x8cdc11 in main /data/src/10.5/sql/main.cc:25:10
 
    #10 0x7f41d1cecd09 in __libc_start_main csu/../csu/libc-start.c:308:16
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.5/storage/spider/spd_conn.cc:1763:43 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*)
 
Shadow bytes around the buggy address:
 
  0x0c287fffcb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c287fffcb20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c287fffcb30: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa
 
  0x0c287fffcb40: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
  0x0c287fffcb50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c287fffcb60: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd
 
  0x0c287fffcb70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
 
  0x0c287fffcb80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
  0x0c287fffcb90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c287fffcba0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c287fffcbb0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc

Couldn't reproduce on 10.4.

 Comments   
Comment by Roel Van de Paar [ 2023-06-06 ]

I ran into this issue also

INSTALL PLUGIN Spider SONAME 'ha_spider.so';
 
CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET'',DATABASE'',USER'',PASSWORD'');
 
CREATE TABLE t1 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",HOST "srv",TABLE "t"';
 
CREATE TABLE t2 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",HOST "srv",TABLE "t"';
 
CREATE TABLE t3 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",HOST "srv",TABLE "t"';
 
SHOW TABLE STATUS;

Or MTR:

IF (`SELECT NOT(COUNT(*)) FROM information_schema.system_variables WHERE variable_name='have_sanitizer' AND global_value like "%UBSAN%"`)
 
{
 
--skip test needs to be run with UBSAN
 
}
 
--source include/have_innodb.inc
 
--let $SOCKET= `SELECT @@global.socket`
 
INSTALL PLUGIN Spider SONAME 'ha_spider.so';
 
CREATE USER spider@localhost IDENTIFIED BY 'pwd';
 
GRANT ALL ON test.* TO spider@localhost;
 
eval CREATE SERVER s FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET "$SOCKET",DATABASE 'test',USER 'spider',PASSWORD 'pwd');
 
CREATE TABLE t1 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",HOST "srv",TABLE "t"';
 
CREATE TABLE t2 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",HOST "srv",TABLE "t"';
 
CREATE TABLE t3 (c INT) ENGINE=Spider COMMENT='WRAPPER "mysql",HOST "srv",TABLE "t"';
 
SHOW TABLE STATUS;

Leads to:

11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug, UBASAN)

 
==2504563==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000085bd8 at pc 0x14564335d760 bp 0x145643f66b60 sp 0x145643f66b50
 
WRITE of size 8 at 0x612000085bd8 thread T33
 
    #0 0x14564335d75f in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1184
 
    #1 0x145643360240 in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1430
 
    #2 0x145643380b6f in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, int*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:832
 
    #3 0x1456433977cf in spider_share_get_conns(ha_spider*, st_spider_share*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:4868
 
    #4 0x14564340505c in spider_init_share(char const*, TABLE*, THD*, ha_spider*, int*, st_spider_share*, TABLE_SHARE*, bool) /test/11.0_dbg_san/storage/spider/spd_table.cc:5138
 
    #5 0x145643406475 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:5252
 
    #6 0x145643505021 in ha_spider::open(char const*, int, unsigned int) /test/11.0_dbg_san/storage/spider/ha_spider.cc:312
 
    #7 0x55b0cc3c7235 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.0_dbg_san/sql/handler.cc:3487
 
    #8 0x55b0cb510885 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4540
 
    #9 0x55b0ca85f3e3 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178
 
    #10 0x55b0ca876f14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108
 
    #11 0x55b0ca876f14 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595
 
    #12 0x55b0ca87ec14 in open_tables /test/11.0_dbg_san/sql/sql_base.h:266
 
    #13 0x55b0ca87ec14 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/11.0_dbg_san/sql/sql_base.cc:5634
 
    #14 0x55b0ca87f81e in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /test/11.0_dbg_san/sql/sql_base.cc:5685
 
    #15 0x55b0cb126ebe in fill_schema_table_by_open /test/11.0_dbg_san/sql/sql_show.cc:4714
 
    #16 0x55b0cb238c13 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/11.0_dbg_san/sql/sql_show.cc:5385
 
    #17 0x55b0cb240dc4 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.0_dbg_san/sql/sql_show.cc:9060
 
    #18 0x55b0cb0dc83c in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4857
 
    #19 0x55b0cb0e0916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677
 
    #20 0x55b0cb0cf0c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158
 
    #21 0x55b0cb0d351c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616
 
    #22 0x55b0cac45a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279
 
    #23 0x55b0caca6ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
 
    #24 0x55b0cacd6973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
 
    #25 0x55b0cace6707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
 
    #26 0x55b0cacf4542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
 
    #27 0x55b0cb6c98b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
 
    #28 0x55b0cb6cadd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
 
    #29 0x145668c94b42 in start_thread nptl/pthread_create.c:442
 
    #30 0x145668d269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
 
 
 
0x612000085bd8 is located 152 bytes inside of 296-byte region [0x612000085b40,0x612000085c68)
 
freed by thread T33 here:
 
    #0 0x55b0ca35afe7 in __interceptor_free (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7963fe7)
 
    #1 0x55b0cea72a61 in my_free /test/11.0_dbg_san/mysys/my_malloc.c:213
 
    #2 0x145643452150 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /test/11.0_dbg_san/storage/spider/spd_malloc.cc:183
 
    #3 0x14564335d3cd in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1166
 
    #4 0x145643360240 in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1430
 
    #5 0x145643380b6f in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, int*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:832
 
    #6 0x1456433977cf in spider_share_get_conns(ha_spider*, st_spider_share*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:4868
 
    #7 0x14564340505c in spider_init_share(char const*, TABLE*, THD*, ha_spider*, int*, st_spider_share*, TABLE_SHARE*, bool) /test/11.0_dbg_san/storage/spider/spd_table.cc:5138
 
    #8 0x145643406475 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:5252
 
    #9 0x145643505021 in ha_spider::open(char const*, int, unsigned int) /test/11.0_dbg_san/storage/spider/ha_spider.cc:312
 
    #10 0x55b0cc3c7235 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.0_dbg_san/sql/handler.cc:3487
 
    #11 0x55b0cb510885 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4540
 
    #12 0x55b0ca85f3e3 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178
 
    #13 0x55b0ca876f14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108
 
    #14 0x55b0ca876f14 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595
 
    #15 0x55b0ca87ec14 in open_tables /test/11.0_dbg_san/sql/sql_base.h:266
 
    #16 0x55b0ca87ec14 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/11.0_dbg_san/sql/sql_base.cc:5634
 
    #17 0x55b0ca87f81e in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /test/11.0_dbg_san/sql/sql_base.cc:5685
 
    #18 0x55b0cb126ebe in fill_schema_table_by_open /test/11.0_dbg_san/sql/sql_show.cc:4714
 
    #19 0x55b0cb238c13 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/11.0_dbg_san/sql/sql_show.cc:5385
 
    #20 0x55b0cb240dc4 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.0_dbg_san/sql/sql_show.cc:9060
 
    #21 0x55b0cb0dc83c in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4857
 
    #22 0x55b0cb0e0916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677
 
    #23 0x55b0cb0cf0c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158
 
    #24 0x55b0cb0d351c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616
 
    #25 0x55b0cac45a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279
 
    #26 0x55b0caca6ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
 
    #27 0x55b0cacd6973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
 
    #28 0x55b0cace6707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
 
    #29 0x55b0cacf4542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
 
    #30 0x55b0cb6c98b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
 
    #31 0x55b0cb6cadd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
 
 
 
previously allocated by thread T33 here:
 
    #0 0x55b0ca35b337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337)
 
    #1 0x55b0cea72703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91
 
    #2 0x145643452583 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /test/11.0_dbg_san/storage/spider/spd_malloc.cc:231
 
    #3 0x14564335c1b5 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1119
 
    #4 0x145643360240 in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /test/11.0_dbg_san/storage/spider/spd_conn.cc:1430
 
    #5 0x145643380b6f in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, int*) /test/11.0_dbg_san/storage/spider/spd_conn.cc:832
 
    #6 0x1456433977cf in spider_share_get_conns(ha_spider*, st_spider_share*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:4868
 
    #7 0x14564340505c in spider_init_share(char const*, TABLE*, THD*, ha_spider*, int*, st_spider_share*, TABLE_SHARE*, bool) /test/11.0_dbg_san/storage/spider/spd_table.cc:5138
 
    #8 0x145643406475 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.0_dbg_san/storage/spider/spd_table.cc:5252
 
    #9 0x145643505021 in ha_spider::open(char const*, int, unsigned int) /test/11.0_dbg_san/storage/spider/ha_spider.cc:312
 
    #10 0x55b0cc3c7235 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.0_dbg_san/sql/handler.cc:3487
 
    #11 0x55b0cb510885 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4540
 
    #12 0x55b0ca85f3e3 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178
 
    #13 0x55b0ca876f14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108
 
    #14 0x55b0ca876f14 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595
 
    #15 0x55b0ca87ec14 in open_tables /test/11.0_dbg_san/sql/sql_base.h:266
 
    #16 0x55b0ca87ec14 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/11.0_dbg_san/sql/sql_base.cc:5634
 
    #17 0x55b0ca87f81e in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /test/11.0_dbg_san/sql/sql_base.cc:5685
 
    #18 0x55b0cb126ebe in fill_schema_table_by_open /test/11.0_dbg_san/sql/sql_show.cc:4714
 
    #19 0x55b0cb238c13 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/11.0_dbg_san/sql/sql_show.cc:5385
 
    #20 0x55b0cb240dc4 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.0_dbg_san/sql/sql_show.cc:9060
 
    #21 0x55b0cb0dc83c in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4857
 
    #22 0x55b0cb0e0916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677
 
    #23 0x55b0cb0cf0c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158
 
    #24 0x55b0cb0d351c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616
 
    #25 0x55b0cac45a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279
 
    #26 0x55b0caca6ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
 
    #27 0x55b0cacd6973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
 
    #28 0x55b0cace6707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
 
    #29 0x55b0cacf4542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
 
    #30 0x55b0cb6c98b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
 
    #31 0x55b0cb6cadd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
 
 
 
Thread T33 created by T0 here:
 
    #0 0x55b0ca2ff175 in pthread_create (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7908175)
 
    #1 0x55b0ca3b598b in create_thread_to_handle_connection(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6129
 
    #2 0x55b0ca3c2e67 in create_new_thread(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6191
 
    #3 0x55b0ca3c36e7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_dbg_san/sql/mysqld.cc:6253
 
    #4 0x55b0ca3c4738 in handle_connections_sockets() /test/11.0_dbg_san/sql/mysqld.cc:6377
 
    #5 0x55b0ca3cbee7 in mysqld_main(int, char**) /test/11.0_dbg_san/sql/mysqld.cc:6024
 
    #6 0x55b0ca3a0eca in main /test/11.0_dbg_san/sql/main.cc:34
 
    #7 0x145668c29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /test/11.0_dbg_san/storage/spider/spd_conn.cc:1184 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*)
 
Shadow bytes around the buggy address:
 
  0x0c2480008b20: 00 00 00 00 00 00 00 00 00 00 00 00 f7 fa fa fa
 
  0x0c2480008b30: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 
  0x0c2480008b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c2480008b50: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
 
  0x0c2480008b60: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
=>0x0c2480008b70: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
 
  0x0c2480008b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
 
  0x0c2480008b90: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 
  0x0c2480008ba0: 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00
 
  0x0c2480008bb0: 00 00 00 00 00 00 00 00 00 00 00 00 f7 fa fa fa
 
  0x0c2480008bc0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==2504563==ABORTING

And:

11.1.0 4e5b771e980edfdad5c5414aa62c81d409d585a4 (Debug, UBASAN)

 
==1000503==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000086358 at pc 0x153e2436a8da bp 0x153e25057bd0 sp 0x153e25057bc0
 
WRITE of size 8 at 0x612000086358 thread T22
 
    #0 0x153e2436a8d9 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1184
 
    #1 0x153e2436d3ba in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1430
 
    #2 0x153e2438dde3 in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, int*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:832
 
    #3 0x153e2440f799 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.1_dbg_san/storage/spider/spd_table.cc:4927
 
    #4 0x153e24515571 in ha_spider::open(char const*, int, unsigned int) /test/11.1_dbg_san/storage/spider/ha_spider.cc:312
 
    #5 0x56523ecffbff in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.1_dbg_san/sql/handler.cc:3472
 
    #6 0x56523ddf4189 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.1_dbg_san/sql/table.cc:4570
 
    #7 0x56523d146717 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.1_dbg_san/sql/sql_base.cc:2210
 
    #8 0x56523d15e248 in open_and_process_table /test/11.1_dbg_san/sql/sql_base.cc:4140
 
    #9 0x56523d15e248 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.1_dbg_san/sql/sql_base.cc:4627
 
    #10 0x56523d165e77 in open_tables /test/11.1_dbg_san/sql/sql_base.h:267
 
    #11 0x56523d165e77 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/11.1_dbg_san/sql/sql_base.cc:5665
 
    #12 0x56523d166a81 in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /test/11.1_dbg_san/sql/sql_base.cc:5716
 
    #13 0x56523da08f2a in fill_schema_table_by_open /test/11.1_dbg_san/sql/sql_show.cc:4713
 
    #14 0x56523db1a672 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/11.1_dbg_san/sql/sql_show.cc:5384
 
    #15 0x56523db22975 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.1_dbg_san/sql/sql_show.cc:9060
 
    #16 0x56523d9be136 in JOIN::exec_inner() /test/11.1_dbg_san/sql/sql_select.cc:4856
 
    #17 0x56523d9c21ec in JOIN::exec() /test/11.1_dbg_san/sql/sql_select.cc:4676
 
    #18 0x56523d9b09a0 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.1_dbg_san/sql/sql_select.cc:5157
 
    #19 0x56523d9b4dfb in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.1_dbg_san/sql/sql_select.cc:611
 
    #20 0x56523d539cee in execute_sqlcom_select /test/11.1_dbg_san/sql/sql_parse.cc:6024
 
    #21 0x56523d59b661 in mysql_execute_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:3944
 
    #22 0x56523d5c65ab in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.1_dbg_san/sql/sql_parse.cc:7760
 
    #23 0x56523d5d6335 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1892
 
    #24 0x56523d5e413a in do_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1405
 
    #25 0x56523dfac265 in do_handle_one_connection(CONNECT*, bool) /test/11.1_dbg_san/sql/sql_connect.cc:1416
 
    #26 0x56523dfad780 in handle_one_connection /test/11.1_dbg_san/sql/sql_connect.cc:1318
 
    #27 0x153e48694b42 in start_thread nptl/pthread_create.c:442
 
    #28 0x153e487269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
 
 
 
0x612000086358 is located 152 bytes inside of 296-byte region [0x6120000862c0,0x6120000863e8)
 
freed by thread T22 here:
 
    #0 0x56523cc42fd7 in __interceptor_free (/test/UBASAN_MD120523-mariadb-11.1.0-linux-x86_64-dbg/bin/mariadbd+0x79f6fd7)
 
    #1 0x56524138fa6e in my_free /test/11.1_dbg_san/mysys/my_malloc.c:213
 
    #2 0x153e244626e2 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /test/11.1_dbg_san/storage/spider/spd_malloc.cc:183
 
    #3 0x153e2436a547 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1166
 
    #4 0x153e2436d3ba in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1430
 
    #5 0x153e2438dde3 in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, int*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:832
 
    #6 0x153e2440f799 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.1_dbg_san/storage/spider/spd_table.cc:4927
 
    #7 0x153e24515571 in ha_spider::open(char const*, int, unsigned int) /test/11.1_dbg_san/storage/spider/ha_spider.cc:312
 
    #8 0x56523ecffbff in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.1_dbg_san/sql/handler.cc:3472
 
    #9 0x56523ddf4189 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.1_dbg_san/sql/table.cc:4570
 
    #10 0x56523d146717 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.1_dbg_san/sql/sql_base.cc:2210
 
    #11 0x56523d15e248 in open_and_process_table /test/11.1_dbg_san/sql/sql_base.cc:4140
 
    #12 0x56523d15e248 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.1_dbg_san/sql/sql_base.cc:4627
 
    #13 0x56523d165e77 in open_tables /test/11.1_dbg_san/sql/sql_base.h:267
 
    #14 0x56523d165e77 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/11.1_dbg_san/sql/sql_base.cc:5665
 
    #15 0x56523d166a81 in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /test/11.1_dbg_san/sql/sql_base.cc:5716
 
    #16 0x56523da08f2a in fill_schema_table_by_open /test/11.1_dbg_san/sql/sql_show.cc:4713
 
    #17 0x56523db1a672 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/11.1_dbg_san/sql/sql_show.cc:5384
 
    #18 0x56523db22975 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.1_dbg_san/sql/sql_show.cc:9060
 
    #19 0x56523d9be136 in JOIN::exec_inner() /test/11.1_dbg_san/sql/sql_select.cc:4856
 
    #20 0x56523d9c21ec in JOIN::exec() /test/11.1_dbg_san/sql/sql_select.cc:4676
 
    #21 0x56523d9b09a0 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.1_dbg_san/sql/sql_select.cc:5157
 
    #22 0x56523d9b4dfb in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.1_dbg_san/sql/sql_select.cc:611
 
    #23 0x56523d539cee in execute_sqlcom_select /test/11.1_dbg_san/sql/sql_parse.cc:6024
 
    #24 0x56523d59b661 in mysql_execute_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:3944
 
    #25 0x56523d5c65ab in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.1_dbg_san/sql/sql_parse.cc:7760
 
    #26 0x56523d5d6335 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1892
 
    #27 0x56523d5e413a in do_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1405
 
    #28 0x56523dfac265 in do_handle_one_connection(CONNECT*, bool) /test/11.1_dbg_san/sql/sql_connect.cc:1416
 
    #29 0x56523dfad780 in handle_one_connection /test/11.1_dbg_san/sql/sql_connect.cc:1318
 
    #30 0x153e48694b42 in start_thread nptl/pthread_create.c:442
 
 
 
previously allocated by thread T22 here:
 
    #0 0x56523cc43327 in malloc (/test/UBASAN_MD120523-mariadb-11.1.0-linux-x86_64-dbg/bin/mariadbd+0x79f7327)
 
    #1 0x56524138f710 in my_malloc /test/11.1_dbg_san/mysys/my_malloc.c:91
 
    #2 0x153e24462b15 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /test/11.1_dbg_san/storage/spider/spd_malloc.cc:231
 
    #3 0x153e2436932f in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1119
 
    #4 0x153e2436d3ba in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /test/11.1_dbg_san/storage/spider/spd_conn.cc:1430
 
    #5 0x153e2438dde3 in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, int*) /test/11.1_dbg_san/storage/spider/spd_conn.cc:832
 
    #6 0x153e2440f799 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /test/11.1_dbg_san/storage/spider/spd_table.cc:4927
 
    #7 0x153e24515571 in ha_spider::open(char const*, int, unsigned int) /test/11.1_dbg_san/storage/spider/ha_spider.cc:312
 
    #8 0x56523ecffbff in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.1_dbg_san/sql/handler.cc:3472
 
    #9 0x56523ddf4189 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.1_dbg_san/sql/table.cc:4570
 
    #10 0x56523d146717 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.1_dbg_san/sql/sql_base.cc:2210
 
    #11 0x56523d15e248 in open_and_process_table /test/11.1_dbg_san/sql/sql_base.cc:4140
 
    #12 0x56523d15e248 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.1_dbg_san/sql/sql_base.cc:4627
 
    #13 0x56523d165e77 in open_tables /test/11.1_dbg_san/sql/sql_base.h:267
 
    #14 0x56523d165e77 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/11.1_dbg_san/sql/sql_base.cc:5665
 
    #15 0x56523d166a81 in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /test/11.1_dbg_san/sql/sql_base.cc:5716
 
    #16 0x56523da08f2a in fill_schema_table_by_open /test/11.1_dbg_san/sql/sql_show.cc:4713
 
    #17 0x56523db1a672 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/11.1_dbg_san/sql/sql_show.cc:5384
 
    #18 0x56523db22975 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/11.1_dbg_san/sql/sql_show.cc:9060
 
    #19 0x56523d9be136 in JOIN::exec_inner() /test/11.1_dbg_san/sql/sql_select.cc:4856
 
    #20 0x56523d9c21ec in JOIN::exec() /test/11.1_dbg_san/sql/sql_select.cc:4676
 
    #21 0x56523d9b09a0 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.1_dbg_san/sql/sql_select.cc:5157
 
    #22 0x56523d9b4dfb in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.1_dbg_san/sql/sql_select.cc:611
 
    #23 0x56523d539cee in execute_sqlcom_select /test/11.1_dbg_san/sql/sql_parse.cc:6024
 
    #24 0x56523d59b661 in mysql_execute_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:3944
 
    #25 0x56523d5c65ab in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.1_dbg_san/sql/sql_parse.cc:7760
 
    #26 0x56523d5d6335 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1892
 
    #27 0x56523d5e413a in do_command(THD*, bool) /test/11.1_dbg_san/sql/sql_parse.cc:1405
 
    #28 0x56523dfac265 in do_handle_one_connection(CONNECT*, bool) /test/11.1_dbg_san/sql/sql_connect.cc:1416
 
    #29 0x56523dfad780 in handle_one_connection /test/11.1_dbg_san/sql/sql_connect.cc:1318
 
    #30 0x153e48694b42 in start_thread nptl/pthread_create.c:442
 
 
 
Thread T22 created by T0 here:
 
    #0 0x56523cbe7165 in pthread_create (/test/UBASAN_MD120523-mariadb-11.1.0-linux-x86_64-dbg/bin/mariadbd+0x799b165)
 
    #1 0x56523cc9d66f in create_thread_to_handle_connection(CONNECT*) /test/11.1_dbg_san/sql/mysqld.cc:6134
 
    #2 0x56523ccaac5f in create_new_thread(CONNECT*) /test/11.1_dbg_san/sql/mysqld.cc:6193
 
    #3 0x56523ccab4bb in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.1_dbg_san/sql/mysqld.cc:6255
 
    #4 0x56523ccac50c in handle_connections_sockets() /test/11.1_dbg_san/sql/mysqld.cc:6379
 
    #5 0x56523ccb3c87 in mysqld_main(int, char**) /test/11.1_dbg_san/sql/mysqld.cc:6029
 
    #6 0x56523cc88eba in main /test/11.1_dbg_san/sql/main.cc:34
 
    #7 0x153e48629d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /test/11.1_dbg_san/storage/spider/spd_conn.cc:1184 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*)
 
Shadow bytes around the buggy address:
 
  0x0c2480008c10: 00 00 00 00 00 00 00 00 00 00 00 00 f7 fa fa fa
 
  0x0c2480008c20: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 
  0x0c2480008c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c2480008c40: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
 
  0x0c2480008c50: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
 
=>0x0c2480008c60: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
 
  0x0c2480008c70: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
 
  0x0c2480008c80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 
  0x0c2480008c90: 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00
 
  0x0c2480008ca0: 00 00 00 00 00 00 00 00 00 00 00 00 f7 fa fa fa
 
  0x0c2480008cb0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==1000503==ABORTING

UniqueID's seen across versions/build types (same as above):

ASAN|heap-use-after-free|storage/spider/spd_conn.cc|spider_conn_queue_and_merge_loop_check|spider_conn_queue_loop_check|spider_get_conn|spider_get_share
 
ASAN|heap-use-after-free|storage/spider/spd_conn.cc|spider_conn_queue_and_merge_loop_check|spider_conn_queue_loop_check|spider_get_conn|spider_share_get_conns

Bug confirmed present in:
MariaDB: 10.5.21 (dbg), 10.5.21 (opt), 10.6.14 (dbg), 10.6.14 (opt), 10.9.7 (opt), 10.10.5 (dbg), 10.10.5 (opt), 10.11.4 (dbg), 10.11.4 (opt), 11.0.2 (dbg), 11.0.2 (opt), 11.1.0 (dbg), 11.1.0 (opt)

Comment by Yuchen Pei [ 2023-12-15 ]

Hi holyfoot, ptal thanks:

upstream/bb-10.5-mdev-29002 da5f0dc6209c4a009a32ce4c48dac883c91a19b1
 
MDEV-29002 Spider: remove SPIDER_CONN::loop_check_meraged_last
 
 
 
The field is assigned but unused, and it causes heap-use-after-free.

For 11.0, see

91a59c0fa11 upstream/bb-11.0-mdev-29002 MDEV-29002 Spider: remove SPIDER_CONN::loop_check_meraged_last

Comment by Alexey Botchkov [ 2024-01-06 ]

ok to push.

Comment by Yuchen Pei [ 2024-01-11 ]

pushed 7801c6d22dce546e9661be909dd0302000933f0b to 10.5

Generated at Thu Feb 08 10:05:07 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.