Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
fb9df9efa917...
fb9df9efa9178949b798f66bd67148fa42a1f1db
Rex Johnston
s
fb1ad591ef70...
fb1ad591ef70f170156b667ccb5b41c73d871f32
Marko Mäkelä
MDEV-41318 Incorrect recovery of FILE_CREATE after FILE_RENAME

recv_recovery_from_checkpoint_start(): Before applying any page-level
log records, invoke recv_rename_files() to replay FILE_RENAME records.
In this way, recv_sys_t::recover_deferred() will not overwrite any
old data files that had been renamed before a new file was created.
f49e838d367f...
f49e838d367f2154b3edb43effa99ff9eb0d8602
DerZc
MDEV-40689 Wrong result: BIT_AND/BIT_OR/BIT_XOR in WINDOW functions over a frame containing NULL

BIT_AND, BIT_OR, and BIT_XOR window functions can return incorrect
values as a sliding frame moves past NULL input rows.

Adding a NULL argument leaves the bit-aggregate state unchanged, but
removing that row unconditionally calls remove_as_window() with
val_int()'s value. The removal path therefore changes state for a row
that never contributed to the aggregate.

Evaluate the departing window argument once and retain its unsigned
value. Call remove_as_window() only when the evaluated argument is
non-NULL. Leave the existing incremental window algorithm and non-window
aggregation path in place.

The regression checks all three bit aggregates over ROWS BETWEEN 1
PRECEDING AND CURRENT ROW with interleaved NULL and non-NULL values,
including removal of a real zero and restoration of the neutral values
after the frame becomes all-NULL.

Bug report: https://jira.mariadb.org/browse/MDEV-40689
f33dde1cc59d...
f33dde1cc59d2b981bc3d2b3a67a3afbaa3ac3fd
Oleksandr Byelkin
MDEV-41186 Fix stack-buffer-overflow in make_unique_constraint_name

A multi-byte PERIOD name at the 64-character limit (192 bytes) filled
the name buffer exactly, leaving no room for the '_N' suffix appended
when generating a unique name for the implicit CHECK constraint.

Truncate on a character boundary, but only once a suffix is actually
needed (mirroring make_unique_key_name), so a non-colliding name is
never altered.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
e983fc9e0401...
e983fc9e04011255d862923c138fcb1ef7ccbaae
Rex Johnston
MDEV-41179 MAX_KEY_PARTS ranges in select causing SEGV

When a select containing 32 ranges is made on a table containing a
compound key with 32 parts, the range optimizer can run off the end
of a stack variable, invalidly overwriting subsequent stack variables.

In the struct st_sel_arg_range_seq, we have an array
  RANGE_SEQ_ENTRY stack[MAX_REF_PARTS];

MAX_REF_PARTS is 32.

check_quick_select
  / sel_arg_range_seq_init
    initialises stack[0] as NOT a key part
  / sel_arg_range_seq_next
    iterates through the key parts, adding key part n to stack[n+1]

key part #32 gets referenced by step_down_to(), setting seq->i off the
end of the array.

The above change has exposed an issue with key length calculation
on MS Windows.  The field is a ulong and with all 32 key parts
wanted, we calculate this as (1UL << 32) - 1.  The first part of
the calculation overflows the field.  The result is undefined in C++.

Fix:  change key_part_map to 64 bits long, so it is the same on Linux
and MS Windows.
cce226a317ff...
cce226a317ffc0f64bb7a09ec0c38c0922a74596
Sergei Golubchik
MDEV-39625 plugin/auth_pam/testing/CMakeLists.txt breaks INSTALL_MYSQLTESTDIR= suppression
caec7559552a...
caec7559552a525de43941d36499fe8ec208fa66
Alessandro Vetere
MDEV-39792 InnoDB: ALTER TABLE FORCE triggers assertion "s" in buf_page_get_gen()

When rebuilding a table from ROW_FORMAT=COMPACT or DYNAMIC into
ROW_FORMAT=REDUNDANT, row_merge_buf_add() fetches the full value of an
externally stored (off-page) CHAR column in a multi-byte character set
and pads it to REDUNDANT's fixed local width via
row_merge_buf_redundant_convert(). That helper already dereferences the
BLOB and calls dfield_set_data(), which clears the field's "externally
stored" flag, since the value is now held in full locally.

The "flag externally stored fields" step further down in
row_merge_buf_add() did not know this had happened. It still consulted
the row_ext_t cache built from the original (pre-conversion) record and,
for a column that is not part of the clustered index's unique key,
called dfield_set_ext() again on the very field that had just been
converted, without restoring its data pointer to a valid 20-byte
external reference. row_merge_copy_blobs() would then read the tail of
the padded, space-filled buffer as if it were a BTR_EXTERN_FIELD_REF,
deriving a garbage tablespace id and crashing buf_page_get_gen()'s
fil_space_get() assertion when the alter tried to build the new
clustered index.

Skip the re-flagging step for a field whose "externally stored" flag is
no longer set. row_build() flags every off-page column, and the
row_ext_t cache only holds a subset of those columns, so a field that
is not flagged is either a converted one (already fully local) or one
that the cache does not hold.

With the field no longer re-flagged, the rebuild completes, and the
rebuilt table passes CHECK TABLE with the full column value.

The MDEV-31025 case in innodb.default_row_format_alter failed on
innodb_page_size=4k and 8k: its ROW_FORMAT=REDUNDANT table has eight
utf32 CHAR(255) columns, which CREATE TABLE rejects with
ER_TOO_BIG_ROWSIZE on those page sizes. Derive the number of columns
from the page size, so that the record still exceeds the maximum local
record size and the fixed-length column c is stored externally. The
whole test now passes on every page size.
be759e492e08...
be759e492e08ff943de6e6a806eb690e08b1adb7
Marko Mäkelä
Merge 13.1 into main
bbd31e35723e...
bbd31e35723e2032e2b380437008ca262bf00661
Rex Johnston
MDEV-41179 MAX_KEY_PARTS ranges in select causing SEGV

When a select containing 32 ranges is made on a table containing a
compound key with 32 parts, the range optimizer can run off the end
of a stack variable, invalidly overwriting subsequent stack variables.

In the struct st_sel_arg_range_seq, we have an array
  RANGE_SEQ_ENTRY stack[MAX_REF_PARTS];

MAX_REF_PARTS is 32.

check_quick_select
  / sel_arg_range_seq_init
    initialises stack[0] as NOT a key part
  / sel_arg_range_seq_next
    iterates through the key parts, adding key part n to stack[n+1]

key part #32 gets referenced by step_down_to(), setting seq->i off the
end of the array.

The above change has exposed an issue with key length calculation
on MS Windows.  The field is a ulong and with all 32 key parts
wanted, we calculate this as (1UL << 32) - 1.  The first part of
the calculation overflows the field.  The result is undefined in C++.

Fix:  change key_part_map to 64 bits long, so it is the same on Linux
and MS Windows.
b3c1dd7d53c7...
b3c1dd7d53c7a7efa93c7f07f31595942941ca66
Rex Johnston
MDEV-41179 MAX_KEY_PARTS ranges in select causing SEGV

When a select containing 32 ranges is made on a table containing a
compound key with 32 parts, the range optimizer can run off the end
of a stack variable, invalidly overwriting subsequent stack variables.

In the struct st_sel_arg_range_seq, we have an array
  RANGE_SEQ_ENTRY stack[MAX_REF_PARTS];

MAX_REF_PARTS is 32.

check_quick_select
  / sel_arg_range_seq_init
    initialises stack[0] as NOT a key part
  / sel_arg_range_seq_next
    iterates through the key parts, adding key part n to stack[n+1]

key part #32 gets referenced by step_down_to(), setting seq->i off the
end of the array.

The above change has exposed an issue with key length calculation
on MS Windows.  The field is a ulong and with all 32 key parts
wanted, we calculate this as (1UL << 32) - 1.  The first part of
the calculation overflows the field.  The result is undefined in C++.

Fix:  change key_part_map to 64 bits long, so it is the same on Linux
and MS Windows.
a77e74f00ce1...
a77e74f00ce143f5c95d6d19b2fade20a4d5b7b3
Thirunarayanan Balathandayuthapani
MDEV-28730 fixup: clang -Wunused-but-set-global
9b75da92d55a...
9b75da92d55abec28df928f429ede8b8d03bd0e3
Rex Johnston
MDEV-41179 MAX_KEY_PARTS ranges in select causing SEGV

When a select containing 32 ranges is made on a table containing a
compound key with 32 parts, the range optimizer can run off the end
of a stack variable, invalidly overwriting subsequent stack variables.

In the struct st_sel_arg_range_seq, we have an array
  RANGE_SEQ_ENTRY stack[MAX_REF_PARTS];

MAX_REF_PARTS is 32.

check_quick_select
  / sel_arg_range_seq_init
    initialises stack[0] as NOT a key part
  / sel_arg_range_seq_next
    iterates through the key parts, adding key part n to stack[n+1]

key part #32 gets referenced by step_down_to(), setting seq->i off the
end of the array.

The above change has exposed an issue with key length calculation
on MS Windows.  The field is a ulong and with all 32 key parts
wanted, we calculate this as (1UL << 32) - 1.  The first part of
the calculation overflows the field.  The result is undefined in C++.

Fix:  change key_part_map to 64 bits long, so it is the same on Linux
and MS Windows.
947a45ddfcbf...
947a45ddfcbf2928f685a37aa86bbfd1c4bdd385
Sutou Kouhei
Fix auto directory creation for absolute mroonga_database_path_prefix (#1166)

mkdir_p() tried stat("") and mkdir("") for the leading directory
separator of an absolute path and gave up. So we couldn't create
database directory automatically for absolute
mroonga_database_path_prefix such as "/var/lib/mroonga/".

This also treats EEXIST from mkdir() as success because another process
may create the directory after our stat().

Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
92d917530563...
92d9175305639ea3e0e9d817540fa3d1d1ebde82
Marko Mäkelä
Fix a race between IMPORT TABLESPACE and BACKUP SERVER
8c0c6cec0da4...
8c0c6cec0da4164dd200ce10bf322c56f62135f1
mariadb-PranavTiwari
MDEV-39343- Added support of upgrade info system table and captured in mariadb dump tool.
8116dc049bf8...
8116dc049bf8b98e845c7635ee67ec51713a6b14
Oleksandr Byelkin
MDEV-41258 Crash in Item_func_nextval on prepared re-execution

A table's DEFAULT NEXTVAL(seq) column keeps a per-open TABLE_LIST
describing the sequence table, allocated on that TABLE's own mem_root.
add_internal_tables() cached a matching prelocking entry across
statement re-executions by comparing db.str/table_name.str pointer
identity. If the owning table was closed and reopened between two
executions (FLUSH TABLE, or ordinary table-cache eviction under
concurrent load), those pointers went stale, and pointer-identity
matching also failed to recognize the reopened table's fresh entry as
the same one, leaving a dangling duplicate in the prelocking list that
still got opened and crashed.

Match entries by (owning TABLE_LIST, position in its internal_tables
list) instead, which survives a reopen. Deep-copy db/table_name onto
the statement's own arena once, at entry creation, instead of aliasing
TABLE-owned memory, so they never need refreshing.

Separately, the relink step was gated the same way as trigger/routine
prelocking discovery (has_prelocking_list), which stays true forever
once a statement's prelocking set includes a trigger -- silently
skipping the relink on every execution after the first for any such
statement. Moved it into its own function, called unconditionally per
table from open_and_process_table().

Also clear a stale internal-table entry's linked_table in
TABLE_LIST::reinit_before_use() when its owning table's own open gets
skipped in a given execution, so a later open_table() backlink write
can't land on memory the owner may have already freed.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
8052a1f35b6e...
8052a1f35b6e2fcfba2833220e6f409bf6429d5d
Marko Mäkelä
MDEV-40852 Redundant checkpoint after innodb_log_archive startup

log_t::set_recovered(): Do not unnecessarily set the
circular_recovery_from_sequence_bit_0 flag for innodb_log_archive=ON
format files.

The purpose of the flag is to ensure that an extra checkpoint will be
written when converting the log to innodb_log_archive=OFF format. The
scenario that we want to prevent is that the log originally was in
innodb_log_archive=OFF format and had wrapped around an odd number of
times since the file creation, that is, the sequence bit at the end
of the mini-transactions since the latest checkpoint is 0. After a
conversion to innodb_log_archive=ON format, old records would carry
the sequence bit 0 and new ones the bit 1. This is fine, because the
recovery will ignore the sequence bit; innodb_log_archive=ON files
never wrap around. However, when the log is converted back to
innodb_log_archive=OFF format, we must guarantee that all sequence
bits since the latest checkpoint were written as 1.
7b14da6cd042...
7b14da6cd042ad33fe1039797c5abfcc920770e2
Aleksey Midenkov
MDEV-41157 Follow-up test fix: strip version-dependent charset result

Follow-up to 6c391b92055.

SHOW CREATE DATABASE always appends "/*!40100 DEFAULT CHARACTER SET
... */", but the default charset differs by version (latin1 on 11.4,
utf8mb4 on 11.8+). Strip it instead of matching a specific value,
since it is not the subject for the fix.

Also switch to evalp: same execution, but logs "$var" instead of the
substituted value, so the replace_regex/disable_query_log hacks go away.
751307b6bbeb...
751307b6bbebb462d89ed0193cf70cc5a538f58b
Rex Johnston
MDEV-41179 MAX_KEY_PARTS ranges in select causing SEGV

When a select containing 32 ranges is made on a table containing a
compound key with 32 parts, the range optimizer can run off the end
of a stack variable, invalidly overwriting subsequent stack variables.

In the struct st_sel_arg_range_seq, we have an array
  RANGE_SEQ_ENTRY stack[MAX_REF_PARTS];

MAX_REF_PARTS is 32.

check_quick_select
  / sel_arg_range_seq_init
    initialises stack[0] as NOT a key part
  / sel_arg_range_seq_next
    iterates through the key parts, adding key part n to stack[n+1]

key part #32 gets referenced by step_down_to(), setting seq->i off the
end of the array.

The above change has exposed an issue with key length calculation
on MS Windows.  The field is a ulong and with all 32 key parts
wanted, we calculate this as (1UL << 32) - 1.  The first part of
the calculation overflows the field.  The result is undefined in C++.

Fix:  change key_part_map to 64 bits long, so it is the same on Linux
and MS Windows.
739a5f1699c3...
739a5f1699c39110cdf32410af4f4bcf54f25b6a
Rex Johnston
MDEV-41179 MAX_KEY_PARTS ranges in select causing SEGV

When a select containing 32 ranges is made on a table containing a
compound key with 32 parts, the range optimizer can run off the end
of a stack variable, invalidly overwriting subsequent stack variables.

In the struct st_sel_arg_range_seq, we have an array
  RANGE_SEQ_ENTRY stack[MAX_REF_PARTS];

MAX_REF_PARTS is 32.

check_quick_select
  / sel_arg_range_seq_init
    initialises stack[0] as NOT a key part
  / sel_arg_range_seq_next
    iterates through the key parts, adding key part n to stack[n+1]

key part #32 gets referenced by step_down_to(), setting seq->i off the
end of the array.

The above change has exposed an issue with key length calculation
on MS Windows.  The field is a ulong and with all 32 key parts
wanted, we calculate this as (1UL << 32) - 1.  The first part of
the calculation overflows the field.  The result is undefined in C++.

Fix:  change key_part_map to 64 bits long, so it is the same on Linux
and MS Windows.
729f995a4120...
729f995a4120da73367374da6afd24e52bb90fb4
Vladislav Vaintroub
MDEV-41008: Fix X509 issuer/subject comparison for OpenSSL 3

OpenSSL 3 escapes '/' and '+' in X509_NAME_oneline() output; OpenSSL 1.1
and WolfSSL don't. A REQUIRE ISSUER/SUBJECT grant from one library can
stop matching after switching to another.

Default comparison stays strcmp(). old_mode=X509_LENIENT_COMPARE opts
into falling back to an escape-aware compare, applied to whichever side
the currently-linked library's own escaping affects, at the cost of
reopening the ambiguity a crafted certificate could exploit to
impersonate another identity.

Adds regression tests against a real certificate with an ambiguous CN

Assisted-by: Claude Sonnet 5 <[email protected]>
6afb39b051d3...
6afb39b051d3532af704539339c1496002fa8dd3
Daniel Bartholomew
bump the VERSION
5f9ef1114d22...
5f9ef1114d22c3938cd85bfec3a5b6d341dc76ca
Rex Johnston
MDEV-41179 MAX_KEY_PARTS ranges in select causing SEGV

When a select containing 32 ranges is made on a table containing a
compound key with 32 parts, the range optimizer can run off the end
of a stack variable, invalidly overwriting subsequent stack variables.

In the struct st_sel_arg_range_seq, we have an array
  RANGE_SEQ_ENTRY stack[MAX_REF_PARTS];

MAX_REF_PARTS is 32.

check_quick_select
  / sel_arg_range_seq_init
    initialises stack[0] as NOT a key part
  / sel_arg_range_seq_next
    iterates through the key parts, adding key part n to stack[n+1]

key part #32 gets referenced by step_down_to(), setting seq->i off the
end of the array.

The above change has exposed an issue with key length calculation
on MS Windows.  The field is a ulong and with all 32 key parts
wanted, we calculate this as (1UL << 32) - 1.  The first part of
the calculation overflows the field.  The result is undefined in C++.

Fix:  change key_part_map to 64 bits long, so it is the same on Linux
and MS Windows.
5e0b205d7326...
5e0b205d7326512093662768abf55e34bfa3b87e
Rex Johnston
MDEV-41179 MAX_KEY_PARTS ranges in select causing SEGV

When a select containing 32 ranges is made on a table containing a
compound key with 32 parts, the range optimizer can run off the end
of a stack variable, invalidly overwriting subsequent stack variables.

In the struct st_sel_arg_range_seq, we have an array
  RANGE_SEQ_ENTRY stack[MAX_REF_PARTS];

MAX_REF_PARTS is 32.

check_quick_select
  / sel_arg_range_seq_init
    initialises stack[0] as NOT a key part
  / sel_arg_range_seq_next
    iterates through the key parts, adding key part n to stack[n+1]

key part #32 gets referenced by step_down_to(), setting seq->i off the
end of the array.

The above change has exposed an issue with key length calculation
on MS Windows.  The field is a ulong and with all 32 key parts
wanted, we calculate this as (1UL << 32) - 1.  The first part of
the calculation overflows the field.  The result is undefined in C++.

Fix:  change key_part_map to 64 bits long, so it is the same on Linux
and MS Windows.
57925c1889fc...
57925c1889fcce7c5984683a29f01aa60c758b0f
Marko Mäkelä
fixup! 5d6b8a3178e12a53af30842560fcec22d51d9275
52cba40e2d13...
52cba40e2d13761cc1dd727d91d5305c5689432b
Vladislav Vaintroub
MDEV-41008: Fix X509 issuer/subject comparison for OpenSSL 3

OpenSSL 3 escapes '/' and '+' in X509_NAME_oneline() output; OpenSSL 1.1
and WolfSSL don't. A REQUIRE ISSUER/SUBJECT grant from one library can
stop matching after switching to another.

Default comparison stays strcmp(). old_mode=X509_LENIENT_COMPARE opts
into falling back to an escape-aware compare, applied to whichever side
the currently-linked library's own escaping affects, at the cost of
reopening the ambiguity a crafted certificate could exploit to
impersonate another identity.

Adds regression tests against a real certificate with an ambiguous CN

Assisted-by: Claude Sonnet 5 <[email protected]>
43d0fff36318...
43d0fff3631864bd5f8fabc8719b2a41bf54d11c
Vladislav Vaintroub
MDEV-41008: Fix X509 issuer/subject comparison for OpenSSL 3

OpenSSL 3 escapes '/' and '+' in X509_NAME_oneline() output; OpenSSL 1.1
and WolfSSL don't. A REQUIRE ISSUER/SUBJECT grant from one library can
stop matching after switching to another.

Default comparison stays strcmp(). old_mode=X509_LENIENT_COMPARE opts
into falling back to an escape-aware compare, applied to whichever side
the currently-linked library's own escaping affects, at the cost of
reopening the ambiguity a crafted certificate could exploit to
impersonate another identity.

Adds regression tests against a real certificate with an ambiguous CN

Assisted-by: Claude Sonnet 5 <[email protected]>
41ae07b0d9b1...
41ae07b0d9b1619a00878d5dc2aae7680d4b2bc3
Alessandro Vetere
MDEV-39792 InnoDB: ALTER TABLE FORCE triggers assertion "s" in buf_page_get_gen()

When rebuilding a table into ROW_FORMAT=REDUNDANT, row_merge_buf_add()
fetches the full value of an externally stored (off-page) CHAR/VARCHAR
column and pads it to REDUNDANT's fixed local width via
row_merge_buf_redundant_convert(). That helper already dereferences the
BLOB and calls dfield_set_data(), which clears the field's "externally
stored" flag, since the value is now held in full locally.

The "flag externally stored fields" step further down in
row_merge_buf_add() did not know this had happened. It still consulted
the row_ext_t cache built from the original (pre-conversion) record and,
for a column that is not part of the clustered index's unique key,
called dfield_set_ext() again on the very field that had just been
converted, without restoring its data pointer to a valid 20-byte
external reference. row_merge_copy_blobs() would then read the tail of
the padded, space-filled buffer as if it were a BTR_EXTERN_FIELD_REF,
deriving a garbage tablespace id and crashing buf_page_get_gen()'s
fil_space_get() assertion when the alter tried to build the new
clustered index.

Skip the re-flagging step for a field whose "externally stored" flag is
no longer set. row_build() flags every off-page column, and the
row_ext_t cache only holds a subset of those columns, so a field that
is not flagged is either a converted one (already fully local) or one
that the cache does not hold.

With the field no longer re-flagged, the rebuild completes, and the
rebuilt table passes CHECK TABLE with the full column value.

The MDEV-31025 case in innodb.default_row_format_alter failed on
innodb_page_size=4k and 8k: its ROW_FORMAT=REDUNDANT table has eight
utf32 CHAR(255) columns, which CREATE TABLE rejects with
ER_TOO_BIG_ROWSIZE on those page sizes. Derive the number of columns
from the page size, so that the record still exceeds the maximum local
record size and the fixed-length column c is stored externally. The
whole test now passes on every page size.
34728d9bb6cc...
34728d9bb6cc8036c45ece36aa67d5ad6c602640
Aleksey Midenkov
MDEV-41157 Follow-up test fix: strip version-dependent charset result

Follow-up to 6c391b92055.

SHOW CREATE DATABASE always appends "/*!40100 DEFAULT CHARACTER SET
... */", but the default charset differs by version (latin1 on 11.4,
utf8mb4 on 11.8+). Strip it instead of matching a specific value,
since it is not the subject for the fix.
337a60025416...
337a60025416c278227b0c2fb75707ca0c50e820
Thirunarayanan Balathandayuthapani
MDEV-41207 Acquire metadata locks for recovered transaction

Problem:
=======
A transaction being rolled back during recovery holds LOCK_IX on the
table(not the metadata locks), and the rollback thread holds
a reference on it.

An online ALTER TABLE on that table falls back to acquiring LOCK_S,
which conflicts and fails. prepare_inplace_alter_table_dict()
asserted that the reference count is 1 before checking whether
the table lock was acquired, so the reference still held by the
rollback thread makes the assertion fail.

Solution:
========
recovery_mdl: New class that holds the metadata locks which
trx_resurrect_table_locks() acquires for recovered transactions,
together with the background connection that owns them.
One MDL_ticket is acquired per table and shared by every recovered
transaction that modified the table, with a reference count, so
that the lock is released once the last of those transactions has
been completed.

trx_sys_t::recovery: Pointer to recovery_mdl, wrapped in
std::atomic, next to rw_trx_hash, which trx_t::free() accesses
anyway. Null pointer means that no recovered transaction holds
metadata locks, which is the normal state once recovery is over.

trx_lists_init_at_db_start(): Create recovery_mdl and publish it in
trx_sys.recovery before any metadata lock can be acquired, and
delete it again if no recovered transaction acquired any.

recovery_mdl::release(): Drop the references of a transaction,
releasing each metadata lock whose last reference is dropped.
This is the only place that releases them, so that a transaction
which was rolled back by trx_rollback_recovered(false) will
not keep its locks until shutdown.

trx_t::free(): Release the metadata locks of a recovered
transaction, once it has been completed. A single relaxed load of
trx_sys.recovery is all that an ordinary transaction pays.

trx_recovery_release(): Re-read trx_sys.recovery while holding
trx_recovery_mutex, because the object may have been deleted after
trx_t::free() read the pointer.

trx_recovery_prune_low(): Delete trx_sys.recovery once no recovered
transaction holds metadata locks any longer, so that neither the
locks nor the connection will outlive the recovered transactions.
This is skipped when the caller has a current_thd, such as a user
connection that is completing a transaction which was recovered in
the XA PREPARED state, and during shutdown, because
destroy_background_thd() would clear the current_thd of the caller.

trx_recovery_shutdown(): Destroy trx_sys.recovery, releasing
anything that is left. It is invoked by innodb_shutdown() only,
after trx_sys.close() has freed any recovered transaction that was
left.

prepare_inplace_alter_table_dict(): Remove the acquisition of an
InnoDB table lock for online ADD INDEX when a recovered transaction
holds a lock on the table.
31c38a542df5...
31c38a542df54b2798ef03133f93d747d4c24b6e
Vladislav Vaintroub
MDEV-41008: Fix X509 issuer/subject comparison for OpenSSL 3

OpenSSL 3 escapes '/' and '+' in X509_NAME_oneline() output; OpenSSL 1.1
and WolfSSL don't. A REQUIRE ISSUER/SUBJECT grant from one library can
stop matching after switching to another.

Default comparison stays strcmp(). old_mode=X509_LENIENT_COMPARE opts
into falling back to an escape-aware compare, applied to whichever side
the currently-linked library's own escaping affects, at the cost of
reopening the ambiguity a crafted certificate could exploit to
impersonate another identity.

Adds regression tests against a real certificate with an ambiguous CN

Assisted-by: Claude Sonnet 5 <[email protected]>
30728cb6725e...
30728cb6725e793076a91d1b72865acb07a15bdf
Yuchen Pei
MDEV-40479 [fixup] Better coverage, formatting, etc.
27083d42b32f...
27083d42b32fc0f201682c8eba243dc6851fa9a5
Sergei Golubchik
MDEV-41253 RPM %pre scriptlet unconditionally resets a pre-existing mysql user's home directory to /nonexistent

keep resetting to not writable, but use an existing path
24e1f311c1ca...
24e1f311c1caf83755f46ce7b30580e6a76bcfa4
Thirunarayanan Balathandayuthapani
MDEV-41207 Acquire metadata locks for recovered transaction

Problem:
=======
A transaction being rolled back during recovery holds LOCK_IX on the
table(not the metadata locks), and the rollback thread holds
a reference on it.

An online ALTER TABLE on that table falls back to acquiring LOCK_S,
which conflicts and fails. prepare_inplace_alter_table_dict()
asserted that the reference count is 1 before checking whether
the table lock was acquired, so the reference still held by the
rollback thread makes the assertion fail.

Solution:
========
recovery_mdl: New class that holds the metadata locks which
trx_resurrect_table_locks() acquires for recovered transactions,
together with the background connection that owns them.
One MDL_ticket is acquired per table and shared by every recovered
transaction that modified the table, with a reference count, so
that the lock is released once the last of those transactions has
been completed.

trx_sys_t::recovery: Pointer to recovery_mdl, wrapped in
std::atomic, next to rw_trx_hash, which trx_t::free() accesses
anyway. Null pointer means that no recovered transaction holds
metadata locks, which is the normal state once recovery is over.

trx_lists_init_at_db_start(): Create recovery_mdl and publish it in
trx_sys.recovery before any metadata lock can be acquired, and
delete it again if no recovered transaction acquired any.

recovery_mdl::release(): Drop the references of a transaction,
releasing each metadata lock whose last reference is dropped.
This is the only place that releases them, so that a transaction
which was rolled back by trx_rollback_recovered(false) will
not keep its locks until shutdown.

trx_t::free(): Release the metadata locks of a recovered
transaction, once it has been completed. A single relaxed load of
trx_sys.recovery is all that an ordinary transaction pays.

trx_recovery_release(): Re-read trx_sys.recovery while holding
trx_recovery_mutex, because the object may have been deleted after
trx_t::free() read the pointer.

trx_recovery_prune_low(): Delete trx_sys.recovery once no recovered
transaction holds metadata locks any longer, so that neither the
locks nor the connection will outlive the recovered transactions.
This is skipped when the caller has a current_thd, such as a user
connection that is completing a transaction which was recovered in
the XA PREPARED state, and during shutdown, because
destroy_background_thd() would clear the current_thd of the caller.

trx_recovery_shutdown(): Destroy trx_sys.recovery, releasing
anything that is left. It is invoked by innodb_shutdown() only,
after trx_sys.close() has freed any recovered transaction that was
left.

prepare_inplace_alter_table_dict(): Remove the acquisition of an
InnoDB table lock for online ADD INDEX when a recovered transaction
holds a lock on the table.
219130d8b630...
219130d8b630d4aa04d4fc694dfe096c1b37d4cb
Rex Johnston
MDEV-41179 MAX_KEY_PARTS ranges in select causing SEGV

When a select containing 32 ranges is made on a table containing a
compound key with 32 parts, the range optimizer can run off the end
of a stack variable, invalidly overwriting subsequent stack variables.

In the struct st_sel_arg_range_seq, we have an array
  RANGE_SEQ_ENTRY stack[MAX_REF_PARTS];

MAX_REF_PARTS is 32.

check_quick_select
  / sel_arg_range_seq_init
    initialises stack[0] as NOT a key part
  / sel_arg_range_seq_next
    iterates through the key parts, adding key part n to stack[n+1]

key part #32 gets referenced by step_down_to(), setting seq->i off the
end of the array.

The above change has exposed an issue with key length calculation
on MS Windows.  The field is a ulong and with all 32 key parts
wanted, we calculate this as (1UL << 32) - 1.  The first part of
the calculation overflows the field.  The result is undefined in C++.

Fix:  change key_part_map to 64 bits long, so it is the same on Linux
and MS Windows.
1deb2999337a...
1deb2999337aace0468b5d8a93a294ecdaf86d64
Dave Gosselin
MDEV-31180:  MyISAMMRG Crash on UPDATE of an updateable VIEW

Attach the children of a MERGE table once per statement, and keep the
value of pos_in_table_list for a MERGE table on subsequent executions
of a prepared statement.
157f216d4c28...
157f216d4c2800f9cf9ca0e12299b8f265a34372
Marko Mäkelä
fixup! b387a4a6f9f9b3194a29c1a80c39c983d5dc4fd5
0dc551f9ed0d...
0dc551f9ed0d57c4c2cbcac4aab710e7fc60a944
Sergei Golubchik
workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2390105
0c74f31c169f...
0c74f31c169f32b6d5a06e9ed45da977c5c912a0
Sergei Golubchik
MDEV-39624 storage/connect/CMakeLists.txt: unguarded generator expression variable causes fatal error at cmake generate phase
BuildBot (0.8.9) working for the MariaDB project.
Page built: Tue 29 Sep 2026 01:55:27 (UTC)