==3166715==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e0000229dc at pc 0x7f99290bc3c5 bp 0x7f9929e81b10 sp 0x7f9929e81b08
|
READ of size 4 at 0x61e0000229dc thread T29
|
#0 0x7f99290bc3c4 in ha_spider::external_lock(THD*, int) /data/bld/10.4-asan/storage/spider/ha_spider.cc:1394
|
#1 0x55cca107672e in handler::ha_external_lock(THD*, int) /data/bld/10.4-asan/sql/handler.cc:6562
|
#2 0x55cca136d094 in unlock_external /data/bld/10.4-asan/sql/lock.cc:713
|
#3 0x55cca136aadd in mysql_unlock_tables(THD*, st_mysql_lock*, bool) /data/bld/10.4-asan/sql/lock.cc:434
|
#4 0x55cca136a921 in mysql_unlock_tables(THD*, st_mysql_lock*) /data/bld/10.4-asan/sql/lock.cc:418
|
#5 0x55cca070225a in close_thread_tables(THD*) /data/bld/10.4-asan/sql/sql_base.cc:1027
|
#6 0x55cca08ae916 in mysql_execute_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:6329
|
#7 0x55cca08b9a6a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:8060
|
#8 0x55cca088fae1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:1857
|
#9 0x55cca088c650 in do_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:1378
|
#10 0x55cca0c92d14 in do_handle_one_connection(CONNECT*) /data/bld/10.4-asan/sql/sql_connect.cc:1419
|
#11 0x55cca0c9262b in handle_one_connection /data/bld/10.4-asan/sql/sql_connect.cc:1323
|
#12 0x7f993d0a8043 in start_thread nptl/pthread_create.c:442
|
#13 0x7f993d12861b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
|
|
0x61e0000229dc is located 348 bytes inside of 2632-byte region [0x61e000022880,0x61e0000232c8)
|
freed by thread T29 here:
|
#0 0x7f993d6b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
|
#1 0x55cca2433b71 in my_free /data/bld/10.4-asan/mysys/my_malloc.c:222
|
#2 0x7f992908b10c in spider_free_mem(st_spider_transaction*, void*, unsigned long) /data/bld/10.4-asan/storage/spider/spd_malloc.cc:188
|
#3 0x7f9928fbe276 in spider_free_conn(st_spider_conn*) /data/bld/10.4-asan/storage/spider/spd_conn.cc:1261
|
#4 0x7f9928fb7691 in spider_free_conn_from_trx(st_spider_transaction*, st_spider_conn*, bool, bool, int*) /data/bld/10.4-asan/storage/spider/spd_conn.cc:315
|
#5 0x7f9928f00488 in spider_free_trx_conn(st_spider_transaction*, bool) /data/bld/10.4-asan/storage/spider/spd_trx.cc:117
|
#6 0x7f9928f1b407 in spider_commit(handlerton*, THD*, bool) /data/bld/10.4-asan/storage/spider/spd_trx.cc:3439
|
#7 0x55cca1050516 in commit_one_phase_2 /data/bld/10.4-asan/sql/handler.cc:1835
|
#8 0x55cca1050243 in ha_commit_one_phase(THD*, bool) /data/bld/10.4-asan/sql/handler.cc:1814
|
#9 0x55cca104e92d in ha_commit_trans(THD*, bool) /data/bld/10.4-asan/sql/handler.cc:1620
|
#10 0x55cca0cd015c in trans_commit_stmt(THD*) /data/bld/10.4-asan/sql/transaction.cc:437
|
#11 0x55cca08ae8d7 in mysql_execute_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:6322
|
#12 0x55cca08b9a6a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:8060
|
#13 0x55cca088fae1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:1857
|
#14 0x55cca088c650 in do_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:1378
|
#15 0x55cca0c92d14 in do_handle_one_connection(CONNECT*) /data/bld/10.4-asan/sql/sql_connect.cc:1419
|
#16 0x55cca0c9262b in handle_one_connection /data/bld/10.4-asan/sql/sql_connect.cc:1323
|
#17 0x7f993d0a8043 in start_thread nptl/pthread_create.c:442
|
|
previously allocated by thread T29 here:
|
#0 0x7f993d6b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
|
#1 0x55cca2432fd2 in my_malloc /data/bld/10.4-asan/mysys/my_malloc.c:101
|
#2 0x7f992908b814 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /data/bld/10.4-asan/storage/spider/spd_malloc.cc:236
|
#3 0x7f9928fb82cd in spider_create_conn(st_spider_share*, ha_spider*, int, int, unsigned int, int*) /data/bld/10.4-asan/storage/spider/spd_conn.cc:478
|
#4 0x7f9928fbd167 in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/bld/10.4-asan/storage/spider/spd_conn.cc:1087
|
#5 0x7f9929021200 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /data/bld/10.4-asan/storage/spider/spd_table.cc:4836
|
#6 0x7f99290b0c81 in ha_spider::open(char const*, int, unsigned int) /data/bld/10.4-asan/storage/spider/ha_spider.cc:360
|
#7 0x55cca1057b03 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/bld/10.4-asan/sql/handler.cc:2824
|
#8 0x55cca0bc2b59 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/bld/10.4-asan/sql/table.cc:4137
|
#9 0x55cca0707df9 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/bld/10.4-asan/sql/sql_base.cc:2114
|
#10 0x55cca071144f in open_and_process_table /data/bld/10.4-asan/sql/sql_base.cc:3915
|
#11 0x55cca0713f0b in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/bld/10.4-asan/sql/sql_base.cc:4397
|
#12 0x55cca0719026 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/bld/10.4-asan/sql/sql_base.cc:5344
|
#13 0x55cca0672da3 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/bld/10.4-asan/sql/sql_base.h:503
|
#14 0x55cca08afcfb in execute_sqlcom_select /data/bld/10.4-asan/sql/sql_parse.cc:6442
|
#15 0x55cca089db41 in mysql_execute_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:3978
|
#16 0x55cca08b9a6a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:8060
|
#17 0x55cca088fae1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:1857
|
#18 0x55cca088c650 in do_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:1378
|
#19 0x55cca0c92d14 in do_handle_one_connection(CONNECT*) /data/bld/10.4-asan/sql/sql_connect.cc:1419
|
#20 0x55cca0c9262b in handle_one_connection /data/bld/10.4-asan/sql/sql_connect.cc:1323
|
#21 0x7f993d0a8043 in start_thread nptl/pthread_create.c:442
|
|
Thread T29 created by T0 here:
|
#0 0x7f993d649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
|
#1 0x55cca2493a28 in spawn_thread_noop /data/bld/10.4-asan/mysys/psi_noop.c:187
|
#2 0x55cca0593f89 in inline_mysql_thread_create /data/bld/10.4-asan/include/mysql/psi/mysql_thread.h:1275
|
#3 0x55cca05ab714 in create_thread_to_handle_connection(CONNECT*) /data/bld/10.4-asan/sql/mysqld.cc:6296
|
#4 0x55cca05abe5f in create_new_thread(CONNECT*) /data/bld/10.4-asan/sql/mysqld.cc:6366
|
#5 0x55cca05ac32d in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/10.4-asan/sql/mysqld.cc:6464
|
#6 0x55cca05ad1d9 in handle_connections_sockets() /data/bld/10.4-asan/sql/mysqld.cc:6622
|
#7 0x55cca05aae77 in mysqld_main(int, char**) /data/bld/10.4-asan/sql/mysqld.cc:5954
|
#8 0x55cca05920b8 in main /data/bld/10.4-asan/sql/main.cc:25
|
#9 0x7f993d0461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
|
SUMMARY: AddressSanitizer: heap-use-after-free /data/bld/10.4-asan/storage/spider/ha_spider.cc:1394 in ha_spider::external_lock(THD*, int)
|
Shadow bytes around the buggy address:
|
0x0c3c7fffc4e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
0x0c3c7fffc4f0: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c3c7fffc500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c3c7fffc510: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3c7fffc520: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
=>0x0c3c7fffc530: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
|
0x0c3c7fffc540: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3c7fffc550: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3c7fffc560: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3c7fffc570: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3c7fffc580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
==3166715==ABORTING
|