Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
Sergei Golubchik
CONNECT: more FILE and secure_file_priv checks in udfs

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
MDEV-41458 Assertion `n > 0 && n < SINUSES_CALCULATED*2+1' failed in get_n_sincos()

With tiny *ex and *ey the sum of squares underflows and q becomes inf,
use hypot() which is under- and overflow safe.

Also, fix ab/(d*d) divison, for good measure
Sergei Golubchik
CONNECT: udfs crash on long filename

namely, json_get_item, jsonget_string, json_set_item, jbin_set_item,
bson_get_item, bsonget_string, bson_set_item

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
MDEV-41622 INSERT crashes on deeply nested GeometryCollection

- get_data_size() and init_from_wkb() return their error values on
  stack overrun, not a valid-looking length
- add stack checks to the remaining recursive GeometryCollection
  methods: wkt, json, mbr, area, length, dimension, store_shapes
- test non-GEOMETRY column and SELECT paths

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
MDEV-41641 CONNECT REST can bypass FILE protection

only allow http and https schemes for REST
Sergei Golubchik
MDEV-41801 "performance_schema" is compared case-sensitively in the engine, case-insensitively elsewhere

With lower_case_table_names=0 the performance_schema engine discovered
its tables only under the exact name, while ACL checks, is_perfschema_db()
and mariadb-dump matched the name case-insensitively. A database named,
for example, PERFORMANCE_SCHEMA was an ordinary database that got
performance_schema access rules.

Compare the name case-insensitively in the engine too.

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
cleanup: CONNECT rest.test

no need to run the same CREATE TABLE twice, first to check if it works
and then to test its result
bsrikanth-mariadb
MDEV-41862: Syntax error with DELETE and IN in FederatedX pushdown

A single-table DELETE with an IN subquery on the same table, pushed
down to FederatedX, failed on the remote server with a syntax error:

  DELETE FROM t3 WHERE a IN (SELECT a FROM t3 WHERE a < 3);

The target table of a single-table DELETE is not in top_join_list, so
the list is empty. st_select_lex::print() printed it as
"delete  from  using dual where ...".

Fix: in st_select_lex::print() use top_join_list only when it is not
empty, and otherwise print the tables from leaf_tables. For DELETE that
branch emits the "from " keyword. UPDATE is unchanged.

As a side effect, EXPLAIN EXTENDED of a single-table DELETE no longer
shows the dummy "using dual" and prints "delete from `t` where ...".
A DELETE through a view now prints the view instead of its base table.
Update the affected results (explain_non_select,
myisam_explain_non_select_all, opt_hints, opt_hints_index, opt_trace,
versioning.delete_history).

Add a test to federatedx_pushdown_upd_del that pushes down DELETE (also
with ORDER BY ... LIMIT and as a prepared statement) and UPDATE with an
IN subquery on the same table, and checks both the resulting data and
the statements received by the remote server in its general log.
Sergei Golubchik
cleanup: CONNECT tests
Marko Mäkelä
MDEV-41395 fil_space_t::create() may release fil_system.mutex

If fil_space_t::create() ends up releasing fil_system.mutex for
invoking fil_crypt_threads_signal(), another thread may grab
fil_system.mutex and find a tablespace that contains no data files.
Let us fix this race condition and remove some checks that now
are redundant.

fil_space_t::create(): Do not invoke fil_crypt_threads_init();
let the caller do that. During database startup, before
fil_crypt_threads_init() has been invoked, there is no point to
invoke this function; the encryption queues will be properly
set up for the tablespaces that have been opened by that time.

fil_ibd_create(): Invoke fil_crypt_threads_signal() after
releasing fil_system.mutex.

fil_crypt_threads_signal(): Check that fil_crypt_threads_init()
has been called. The function dict_table_open_on_name() will be
invoked during early server startup.

dict_table_open_on_name(): Invoke fil_crypt_threads_init()
at the end if the table was loaded into the cache and the
tablespace likely as well. This should be the main code path
through which old tablespaces are opened via SQL.

We will not invoke fil_crypt_threads_init() in
dict_load_table_on_id() or dict_sys.load_table(); it will instead
be invoked at a higher level, typically when a table definition is
first loaded by name, in dict_table_open_on_name().

buf_dump_load_func(): After the non-first buf_load(), invoke
fil_crypt_threads_signal() in order to start the encryption
of any newly loaded tablespaces.

drop_garbage_tables_after_restore(), wsrep_append_foreign_key(),
ha_innobase::create(), ha_innobase::truncate(),
row_rename_table_for_mysql(), i_s_sys_tables_fill_table(),
i_s_sys_tables_fill_table_stats(): Invoke fil_crypt_threads_signal()
in case some tablespace metadata was loaded.

row_import_cleanup(): Invoke fil_crypt_threads_signal() to register
the imported tablespace.

i_s_sys_tablespaces_fill_table(), fil_system_t::find(),
Datafile::validate_first_page(), fil_space_t::name(),
fil_space_t::read_page0(), fil_space_t::prepare_acquired(),
fil_space_t::try_to_close(), fil_crypt_default_encrypt_tables_fill(),
fil_system_t::default_encrypt_next(): Remove a now-redundant check
for a tablespace that contains no files.

(cherry picked from commit 8214825d675167a13f9dabaebf11674d21a26339)
Sergei Golubchik
MDEV-41808 repeated CTE references keep reparsing exponentially on time and memory

Every reference to a CTE after the first re-parses its specification and
recursively resolves the references inside the clone, so a chain of CTEs
each referencing the previous one twice expands to 2^N re-parses from
linear-size SQL, exhausting CPU and memory at parse time.

Bound the number of specification clones per statement.

Assisted-by: Claude:claude-opus-4-8
Sergei Golubchik
MDEV-41803 mariadb-binlog --raw takes the output file name from Rotate events without checking it

mariadb-binlog --raw appended the file name from a Rotate event to the
--result-file prefix, so a malicious server could make it write files
outside that directory.

Reject a Rotate event file name with a directory component - a
legitimate server only puts a bare file name in the Rotate event

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
MDEV-41496 OOB write with RPAD() crash and multi-byte charsets and uservar

Item's charset is metadata, it's known at fix_fields and does not
change later. User variables can violate this invariant if they're
changed and used in the same query.

Let's always wrap such variables in Item_func_conv_charset()
to make sure the caller always gets the same fixed charset, no matter
what the actual variable value is.

Variables that aren't changed in the same query do not get this
unnecessary conversion.

Note that in --ps the charset might resolve differently. This is not a
bug, querying and modifying a user variable in the same query is a
documented UB. But both in nm and in ps both arguments of RPAD() always
have the same charset, so the result is internally consistent and
there's no OOB access.
Oleksandr Byelkin
Merge branch '10.11' into 11.4
Sergei Golubchik
cleanup: CONNECT use a local HTTP server in connect.rest

The test depended on an external site, so it was slow and unreliable.
Serve std_data/bios.json from a forked perl server instead.

Assisted-by: Claude:claude-opus-5-5
Mohammad Tafzeel Shams
MDEV-37467: InnoDB Instant ALTER TABLE is not crash safe

The hidden metadata record of instant ALTER TABLE was not written
crash-safely, and recovery could fail to roll it back. These are
independent problems.

First, the metadata record may include externally stored BLOB
metadata. The existing BLOB storage path in
btr_store_big_rec_extern_fields() writes the clustered index record
first, with zero BLOB pointers, and only fills in the BLOB pointers
afterwards. If the server is killed after the mini-transaction that
wrote the (incomplete) metadata record was durably committed, but
before the BLOB pointers were written, the table could become
inaccessible on recovery.

Make metadata BLOB storage crash-safe by writing the BLOB pages and
computing their pointers before the metadata record itself is
inserted or updated, so that the record is always written with
complete BLOB pointers. If the server is killed before the metadata
record is written, the already-written BLOB pages are merely
orphaned, which is safe.

Second, trx_undo_report_row_operation() writes the undo log record in
a mini-transaction of its own, which is committed before the
mini-transaction that writes the metadata record. Because
innobase_instant_try() had already updated SYS_COLUMNS and SYS_TABLES
in earlier mini-transactions, a kill in between left a durable undo
log record for the table while the metadata record was unchanged. On
recovery, trx_resurrect_table_locks() would then load the table
definition before the incomplete transaction was rolled back. The
data dictionary described the table as it would be after the
operation, while the metadata record still described it as it was
before, and btr_cur_instant_init() failed on that disagreement.

Write the undo log record of the metadata record in the same
mini-transaction that inserts or updates the record, so that the two
cannot be separated by a crash: until that mini-transaction is
committed, neither of them is durable.

An undo log record is never split between pages. If the DEFAULT
values of the columns being added are large enough that the undo log
record for updating the metadata record would not fit on one page,
innobase_instant_try() would fail. Determine this before the operation
starts, so that it can be performed by another algorithm instead.

Third, the table definition that recovery loads need not correspond to
the metadata record. dict_load_table_one() reads the committed version
of the SYS_TABLES record, and escalates to READ UNCOMMITTED only when
it finds a SYS_COLUMNS record that was written by a transaction that is
still active. The number of SYS_COLUMNS records that dict_load_columns()
reads is derived from SYS_TABLES.N_COLS, which was read from the
committed version. The record of a column that the operation appended is
located after that many records, so it is never read and the operation
goes unnoticed. Only an instant ALTER TABLE that merely appends columns
can escape this way: ADD COLUMN ... FIRST, DROP COLUMN and column
reordering rewrite the SYS_COLUMNS records of already existing columns.

Load the committed table definition first, and the uncommitted one only
if btr_cur_instant_init() reports that the committed definition does not
describe the metadata record. Reading the uncommitted definition
unconditionally would be wrong in the opposite case: if the operation
had not updated the metadata record yet, the definition would describe
columns that the record does not comprise, and btr_cur_instant_init()
would request the default value of a column that does not have one.

Fourth, the rollback writes a metadata record that comprises fewer
fields than the table definition describes, because
btr_cur_trim_alter_metadata() shortens it to the number of fields that
it comprised before the operation. That number determines the size of
the null flag bitmap, and hence the position of the array of field
lengths. rec_init_offsets_comp_ordinary() derives it from the record,
while the two functions that write the record derived it from the table
definition and asserted that the two agree.

- btr_store_big_rec_metadata():
  New function to store the off-page columns of a metadata record
  ahead of time. Each BLOB page is allocated and linked in its own
  mini-transaction, and the resulting BLOB pointers are written
  directly into the (heap-resident) index entry. On failure, it frees
  any pages it already allocated and resets the pointers to zero.

- btr_free_big_rec_metadata():
  New helper to free the BLOB pages written by
  btr_store_big_rec_metadata() and reset the entry's BLOB pointers
  to zero, used both on failure inside that function and by its
  callers when the metadata record ends up not being written.

- row_ins_clust_index_entry_low():
  For a metadata entry that needs external storage, convert it to a
  big record and call btr_store_big_rec_metadata() (with
  log_free_check() allowed, since no latches are held yet) before
  inserting the record. On failure, free the metadata BLOBs and
  convert the entry back.

- btr_cur_pessimistic_update():
  When updating a metadata record that requires external storage,
  call btr_store_big_rec_metadata() (without log_free_check(),
  since index and page latches are held) before modifying the record,
  and free the temporary big_rec vector via btr_free_big_rec_metadata()
  or dtuple_big_rec_free() on the various failure/success paths.

- btr_cur_optimistic_insert():
  Remove the special-cased jump to convert_big_rec for metadata
  entries, since their BLOBs are now always stored ahead of time by
  the caller; assert that a metadata entry never needs external
  storage at this point.

- innobase_instant_try():
  Since btr_cur_pessimistic_update() now stores metadata BLOBs
  before updating the record, big_rec is always NULL here; assert
  this instead of calling btr_store_big_rec_extern_fields().

- trx_undo_report_row_operation():
  New parameter caller_mtr. If it is specified, the undo log record
  is written in that mini-transaction, which is never committed or
  restarted here. An undo log page is added within the same
  mini-transaction if the record does not fit on the current one. A
  temporary table never uses the caller's mini-transaction, because
  that would require changing its logging mode. All other callers
  pass NULL and are unaffected.
  Encapsulate the parameters that describe the row change
  (clust_entry, update, cmpl_info, rec, offsets) in the new type
  trx_undo_row_op, which of the fields are set depends on the
  operation, which the type documents.

- btr_cur_ins_lock_and_undo(), btr_cur_upd_lock_and_undo():
  For an instant ALTER TABLE metadata record, pass the
  mini-transaction that is going to insert or modify the record.

- trx_undo_max_rec_size():
  New function to determine the maximum size of an undo log record,
  that is, the space available on an empty undo log page.

- ha_innobase::check_if_supported_inplace_alter():
  Refuse ALGORITHM=INSTANT if the metadata record already exists and
  the undo log record for updating it would exceed
  trx_undo_max_rec_size(). trx_undo_page_report_modify() stores the
  DEFAULT value of each column that is being added in that record in
  full, inline. No such limit applies when the metadata record is
  being inserted, because trx_undo_page_report_insert() writes
  TRX_UNDO_INSERT_METADATA and no field data.

- dict_load_table_one():
  Load the committed table definition first, and the uncommitted one
  only if btr_cur_instant_init() reports that the committed definition
  does not describe the clustered index metadata record.
  dict_load_columns() cannot detect this, because the number of
  SYS_COLUMNS records that it reads is derived from SYS_TABLES.N_COLS,
  and a column that the operation appended is located after that many
  records. A table that an uncommitted transaction is rebuilding is
  excluded, because the committed definition is the one that
  corresponds to its clustered index.

- btr_cur_instant_init(), btr_cur_instant_init_low():
  Determine the number of fields of the metadata record in the same way
  as rec_init_offsets_comp_ordinary() does, and refuse the table if it
  disagrees with the table definition. rec_get_offsets() would otherwise
  request the default value of a column that does not have one. New
  parameter quiet for a caller that is going to try another table
  definition, so that an attempt which is not the final one is not
  reported. Mark the table as unreadable on these failures, like the
  other ones in that function do, because dict_load_table_one() asserts
  that a readable table is not corrupted.

- dict_sys_tables_rec_read():
  Store the fields that are read in the new type dict_sys_tables_rec,
  instead of in separate output parameters. A caller that does not want
  a delete-marked record to be reported as not found used to indicate
  that by specifying trx_id as nullptr; that is now the parameter
  skip_deleted.

- trx_undo_add_page():
  Correct the documented restriction on the mini-transaction of the
  caller.

- rec_get_converted_size_comp_prefix_low(),
  rec_convert_dtuple_to_rec_comp():
  For a record that includes a metadata BLOB, determine the number of
  nullable fields from the tuple, by way of
  dict_index_t::get_n_nullable(), and not from
  dict_index_t::n_nullable. This is what
  rec_init_offsets_comp_ordinary() does, and it is equivalent for a
  tuple that comprises all fields of the index. Relax the assertions
  that required the tuple to comprise all of them.

- Added test in innodb.instant_alter and innodb.instant_alter_crash
  to test normal working of INSTANT ALTER, crash safety and full table.
Marko Mäkelä
MDEV-14992/MDEV-38362/MDEV-39092 BACKUP SERVER

The following SQL statements will be introduced:

BACKUP SERVER TO '/path/to/directory' [ 1 CONCURRENT ];
BACKUP SERVER WITH [ 1 CONCURRENT ] 'command';

In place of the 1, any positive number of threads may be specified.
For the first variant, '/path/to' must exist and '/path/to/directory'
must not exist; that is where the backup will be written to.

For BACKUP SERVER WITH, the string mariadb-backup-
will be prepended to the specified command and quoted.
Path separators or quotes are not allowed in command.
We expect the mariadb-backup-command to be in the
search PATH of the mariadbd process.
For now, we distribute no such script or program;
the user has to write one, something like this:

zstdmt|exec ssh [email protected] "exec cat > $1.tar.zstd"

The standard input of that command will be in a format compatible with
GNU tar --format=oldgnu (and also BSD tar variants that are also part of
Microsoft Windows and Apple macOS). The command is expected to optionally
compress and encrypt the stream and redirect it to a file on a local or
a remote server. The BACKUP SERVER WITH will append an additional argument,
a positive base-ten number in ASCII, starting with 1, to identify the
current thread. In this way, there can be multiple concurrent streams.
The InnoDB write-ahead log will be streamed near the end, because
the stream format requires the file sizes to be declared upfront.

In BACKUP SERVER TO ... 2 CONCURRENT or more, one thread will be
responsible for copying the InnoDB write-ahead log from the beginning
of the backup, running InnoDB_backup::log_track(). Other files will be
copied by other threads.

Note: In single-threaded BACKUP SERVER TO, the parameter
innodb_log_recovery_start that is written out to backup.cnf is
STRICTLY NECESSARY TO AVOID CORRUPTION during recovery! By default,
InnoDB crash recovery starts from the latest available log
checkpoint. However, for restoring a backup, recovery must start from
the checkpoint that was the latest when the backup was
started. Starting recovery from a possible later checkpoint will
result in a corrupted database!

The backup or the first stream will contain a file backup.cnf, which
includes parameters needed for restoring the backup. Currently,
these are innodb_log_recovery_start and innodb_log_recovery_target.
If innodb_log_recovery_target>0, InnoDB will be in read-only mode,
not allowing any writes to persistent files other than via the log
application.

To restore a streaming backup made with BACKUP SERVER WITH, an empty
directory needs to be created and all streams be extracted there using
the standard tar utility of the operating system, optionally after
undoing any encryption or compression that had been added by the
backup command. Then, the backup is prepared or MariaDB server started
up on the extracted directory, similar to as if the BACKUP SERVER TO
statement had been used.

The following will be implemented separately:

MDEV-39061 mariadb-backup compatible wrapper script for BACKUP SERVER
MDEV-40163 Partial backup and restore
MDEV-39091 Back up ENGINE=RocksDB
MDEV-40333 Concurrent DDL for Aria tables in BACKUP SERVER
MDEV-39987 Improve BACKUP SERVER performance for ENGINE=Aria

The implementation introduces a basic multi-threaded driver
Sql_cmd_backup, storage engine interfaces, and basic copying of the
storage engines InnoDB, Aria, MyISAM, MERGE (MyISAM), Archive, CSV.

backup_target: A structured data type to represent a target directory.
On Microsoft Windows, we must use directory paths because there is
no variant of CopyFileEx() that would work on file handles.

backup_sink: Wraps a per-thread output stream as well as storage
engine specific context. The member "id" identifies the thread,
between 0 and CONCURRENT-1.

backup_context: Process-wide BACKUP SERVER context.
Handles the directory traversal and copying of
files for built-in storage engines that do not
implement this backup interface.

backup_target_stage: Wrap backup_context.

backup_target_stage::step(),
backup_context::step(): Process a file
from a directory scan, or by invoking
handlerton::backup_step().

handlerton::backup_file(): Check if a file should be
included in the backup. Implemented for ENGINE=Aria
in maria_backup_file().

handlerton::backup_start(), handlerton::backup_end(): Invoked at the
start or end of a backup phase, in the thread that executes a
BACKUP SERVER statement.

handlerton::backup_step(): A backup step that can be invoked from
multiple threads concurrently, between the execution of the corresponding
handlerton::backup_start() and handlerton::backup_end() of the same
phase.

copy_entire_file(): A file copying service for POSIX systems.

clone_file_range(): A wrapper for Linux FICLONERANGE, which
may fail and thus require a fallback to backup::copy().

backup::copy(): A partial or sparse file-copying service.
Note: On Linux we never invoke sendfile(2) for
copying between files, nor copy_file_range(2) for copying
large files, because can be much slower than the alternatives.

backup::copy_or_stream(): Copy or stream a file.

backup_stream_append_plain(): A wrapper of backup::append(), which is
the streaming equivalent of backup::copy().

backup_stream_zeropad(): Zero-pad the last tar block if needed.

backup_stream_append_async(): A variant of backup_stream_append_plain()
where the source file region is guaranteed to be immutable after the
call returns. Zero-copy Linux sendfile(2) is inherently risky for copying
data files that may be modified in place, because it could introduce
a race condition between a page write that runs concurrently with a
child process that is reading the data from the pipe. This could be
improved with io_uring later.

pread_write(): Allocate a buffer of up to 4 MiB.
This is the "slow path" of copying or streaming files.
For InnoDB data files, BACKUP SERVER TO invokes this on output that
has been opened in unbuffered I/O (O_DIRECT) mode, to avoid polluting
the Linux file system cache (block cache). For the InnoDB log,
regular buffered I/O performed best in our tests.

maria_backup_start(): The entry point for ENGINE=Aria.
Currently, the directory traversal is single-threaded and a memory hog.
This is to be improved in MDEV-39987. The Aria log and data file
copying were implemented by Michael 'Monty' Widenius and
Alessandro Vetere.

InnoDB_backup::init(): Wait for a possible previous BACKUP SERVER
operation to reach the very end of InnoDB_backup::context::cleanup()
so that the context can be safely reused.

InnoDB_backup::queue: Collection of tablespace IDs and payload sizes
at the start of the backup, and the log_sys.first_lsn of log files
that have to be included in the backup. If any data file is created or
extended while the backup is executing, we must have the corresponding
write-ahead-log entries that we are copying since the latest
checkpoint that was completed when the backup started. If any
tablespaces are deleted during the backup, we may or may not copy
them, and the application of a FILE_DELETE record will remove them.
Similarly, applying FILE_RENAME or FILE_CREATE records will rename or
create files during recovery as needed.

InnoDB_backup::context::tracked: Log file queue for the dedicated
log-copying task InnoDB_backup::log_track().

innodb_backup_log_tracking(): Determine if log-tracking backup is
active, which blocks concurrent changes of innodb_log_file_buffering
and innodb_log_file_write_through.

log_sys.backup: Whether BACKUP SERVER is in progress. The purpose of this
is to make BACKUP SERVER prevent the concurrent execution of
SET GLOBAL innodb_log_archive=OFF or SET GLOBAL innodb_log_file_size
when innodb_log_archive=OFF.

log_sys.archived_checkpoint: Keep track of the earliest available
checkpoint, corresponding to log_sys.archived_lsn. This reflects
SET GLOBAL innodb_log_recovery_start (which is settable now), for
incremental backup.

fil_system.have_all_spaces: Whether all tablespace metadata is guaranteed
to be known. To speed up startup, InnoDB does not normally open
all tablespace files.

fil_space_t::create_lsn: Change to Atomic_relaxed and use this to
indicate tablespace creation LSN, in addition to indicate undo
tablespace rebuild LSN.

fil_space_t::backup_end: The first page number that is not being backed up
(by default 0, to indicate that no backup is in progress).

fil_space_t::BACKUP_BATCH_SIZE: The number of preceding pages that will be
covered by fil_space_t::backup_end. This is the unit of "page range locking"
during InnoDB backup.

fil_node_t::backup_name: A snapshot of the file name, sampled in
InnoDB_backup::init(). For backing up any files that were created before
the backup start checkpoint LSN, these names will be written to the backup.
On restore, the files will be renamed or deleted as needed, by
applying FILE_RENAME or FILE_DELETE records.

fil_node_t::rename(), fil_node_t::set_backup_name(),
fil_node_t::get_backup_name(), fil_node_t::~fil_node_t(),
fil_node_t::clear_backup_name(): Deal with fil_node_t::backup_name.

buf_page_t::write_fix_try(), buf_page_t::write_unfix_try(): Try to set
or unset a fake "write fix" on a page, to prevent concurrent flush()
during a backup batch. The atomic operations may run concurrently with
set_reinit() and set_freed(). The fake "write fix" does not prevent
any concurrent read or write of the page data in the buffer pool; it
only blocks writes to the underlying data file.

buf_page_t::flush(): Atomically test and set write fix, and
skip the operation if the fake "write fix" was set.

buf_page_t::set_freed(), buf_page_t::set_reinit(): Employ a
compare-and-exchange loop to accommodate for the "write fix".

innodb_backup_batch_wait(): Look up any pages that we are about to
back up. For any dirty pages, invoke buf_page_t::write_fix_try() to
try to set a fake "write fix" lock-free. If the page is currently
write-fixed between buf_page_t::flush() and
buf_page_t::write_complete(), acquire and release a page U-latch to
wait for the conflicting write to complete.

InnoDB_backup::backup_batch_start(),
InnoDB_backup::backup_batch_stop(): Adjust fil_space_t::backup_end and
fake "write fix" of dirty pages to protect the copying of a range of
pages from the underlying file.

InnoDB_backup::commit(): Enqueue the remaining log to be copied.

InnoDB_backup::checkpoint_complete(): If backup is running and
commit() has not been called, add each completed innodb_archive_log=ON
file to the queue. Else, skip or delete, as appropriate.

InnoDB_backup::archive_create(), innodb_backup_archive_create():
Hook for log_t::archive_create().

log_t::backup_start(): If we were running with innodb_log_archive=ON,
ensure that the latest file is a valid recovery starting point.
That is, wait for the latest log checkpoint to be within the file.

buf_flush_list_space(): Check for concurrent backup before writing each
page. This is inefficient, but this function may be invoked from multiple
threads concurrently, and it cannot be changed easily, especially for
fil_crypt_thread().

fil_ibd_create(): Set fil_space_t::create_lsn after the file has been
created.

dict_load_tablespaces(): Determine the size of each file if
upgrade==true. Backup depends on that.

buf_dblwr_t::begin(), buf_dblwr_t::end(), buf_dblwr_t::size():
Accessors to allow BACKUP SERVER to skip the contents of the
doublewrite buffer in the system tablespace. It is only useful for
crash recovery in case a data page had been incompletely written by
the time the server was killed. If the server is killed during a
backup, the backup will be incomplete and unusable anyway.
Furthermore, the page range locking makes page writes and backup
mutually exclusive.

Tested by: Matthias Leich
Tested by: Saahil Alam
Reviewed by: Thirunarayanan Balathandayuthapani
Reviewed by: Marko Mäkelä (the ENGINE=Aria part)
Co-authored by: Michael 'Monty' Widenius, Alessandro Vetere
Sergei Golubchik
MDEV-41648 sequence permissions aren't checked in LOAD DATA
Miroslav Rajcic
Bug#39905057: MySQL ExtractValue unclosed CDATA length underflow causes mysqld heap overflow / crash

Problem:
========
The XML scanner reports an unterminated <![CDATA[ section as a valid
CDATA token. Its end pointer remains at the opening delimiter, while
the parser unconditionally removes the opening and closing delimiters.

This underflows the value length. ExtractValue() can subsequently pass
that length to String::append(), causing a heap overwrite and mysqld
crash.

Root Cause:
===========
my_xml_scan() only sets the token end when it finds ]]>, but
my_xml_parse() assumes every CDATA token is complete.

Solution:
=========
Detect EOF before the CDATA terminator and return a parse error before
calling the XML value handler.

Add an ExtractValue() regression test verifying that unterminated CDATA
is rejected with a warning.

Change-Id: I142bafd9ddea185f6b2e87a80af4894f10168291

Fixes MDEV-39571, MDEV-41407
Daniel Black
MDEV-41870: segfault on bootstrap (SLES 15.7)

SLES 15.7 earlier had a liburing 2.1 version. MariaDB
packages are build with the version bumped 2.9. As ABI
incompatable elements are compiled into MariaDB because
of inlined functions, we need to explictly bump the
dependency to include the 2.9 version of liburing.

This is for both the server, and mariadb-backup if configured.
Sergei Golubchik
MDEV-41841 OOB read on loose index scan of MIN/MAX with IS [NOT] NULL

QUICK_GROUP_MIN_MAX_SELECT::add_range built the QUICK_RANGE key by
copying min_max_arg_len bytes straight from the SEL_ARG value, which
for an IS [NOT] NULL bound points at the 20-byte is_null_string; a
MIN/MAX column wider than that read past the static buffer.

Build the key image through SEL_ARG::store_min()/store_max() as
every other caller does: they synthesize a full-width NULL key and
never copy from is_null_string, which is sized for memcmp only.

Assisted-by: Claude:claude-opus-4-8
Sergei Golubchik
MDEV-41804 deeply nested ROWs crash

add check_stack_overrun()
Sergei Golubchik
Item_param::set_param_time and Item_param::set_param_datetime OOB read

Item_param::set_param_time and Item_param::set_param_datetime could
potentially read 4 bytes beyond the value end of the corrupted packet
Oleksandr Byelkin
Merge branch '11.4' into 11.8
Sergei Golubchik
CONNECT: reset vptr before writing an object to a file

pointers make no sense there
Sergei Golubchik
CONNECT: json_bson_file_priv test fails in MSAN

1.
the fix for MDEV-41613 added the first ever test for jfile_bjson().
this UDF allocates structures on the heap and dumps them to a file
with fwrite(). Structures may have padding, bytes in padding stay
not initialized and MSAN gets unhappy when they're fwritten.

Let's clear the allocated memory area for file-writing UDFs

2.
jbin_set_item sends BSON structure as blob in the result set.
So this structure must not have uninitialized bytes either.
Oleksandr Byelkin
Fix false "Thread stack overrun" in local connection queries under ASAN

Problem: send_command() for a mysql_real_connect_local() connection with
its own THD set thd->thread_stack to the address of a local variable.
With ASAN use-after-return detection that variable lives on a fake heap
stack, so check_stack_overrun() computed a bogus stack usage and failed
the query; password_reuse_check then sporadically rejected the first
GRANT on amd64-ubasan-clang-22 builders.

Fix: add THD::set_thread_stack(), which takes the real stack start of the
current OS thread from my_get_stack_bounds(), and use it there and in
THD::store_globals(). Remove the thread_stack= &local hints that were
always overwritten by store_globals() anyway.
password_reuse_check.test now shows the plugin's warnings if the first
GRANT is rejected.

Assisted-by: Claude:claude-opus-5-5
Oleksandr Byelkin
Merge branch '12.3' into 13.1
Sergei Golubchik
CONNECT: fix NULL handling for jfile_bjson/jfile_convert/bfile_bjson/bfile_convert

to be consistent with other functions

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
CONNECT: jfile_bjson/jfile_convert/bfile_bjson/bfile_convert crash on lrecl=NULL

tests for
* constant NULL
* not constant NULL
* not constant not NULL

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
MDEV-41822 mariadb-binlog ASAN crash on corrupted binlog

1. verify that the null bitmap length doesn't overshoot row event end
2. pass the buffer length to calc_field_size(), so that it'd never read
  beyond the end
Oleksandr Byelkin
Merge branch '11.8' into 12.3
Sergei Golubchik
CONNECT: json_bson_file_priv test fails in --cursor

udf should set max_length large enough to fit the error message
Sergei Golubchik
UndefinedBehaviorSanitizer: nullptr-with-nonzero-offset rdb_datadic.cc:558
Sergei Golubchik
cleanup: undefined function declarations
Sergei Golubchik
update C/C
Sergei Golubchik
fix RPAD(), LPAD() and INSERT() not to mangle its arguments

they used to overwrite the charset of their arguments, this is
incorrect and led to wrong results
Sergei Golubchik
MDEV-41613 CONNECT jfile_convert crashes on invalid file

Assisted-by: Claude:claude-opus-5-5
Sergei Golubchik
MDEV-41608 some CONNECT jfile/bfile udfs ignore FILE and secure_file_priv

also they should all have maybe_null=true
Sergei Golubchik
CONNECT: rest test fails on Windows with a different error message

Fix Xcurl:

* on linux: wait for the correct (!) child to exit, don't ignore
  its failures (Windows code didn't - this was the reason for a
  different error message)
* drop the redundant linux-only check "does curl exist?", let it
  fail as on Windows, when curl is executed (also that branch
  was missing one pclose())
* use _exit() not exit() - see `man vfork`
* rephrase awkward message