Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
ef472a61adc3...
ef472a61adc32828d5416af9251ba6e0c5f39c14
Lawrin Novitsky
ODBC-497 Adding infer to the Github Actions workflow
ee74a71df6d7...
ee74a71df6d7583df778916dc35b0bb4f778f454
Sergei Golubchik
mariadb-test: don't use strlen/strend, support lines with embedded \0

add a test
ec4853f72f09...
ec4853f72f093cdfcacec4177ee0a10fcb369926
Sergei Golubchik
MDEV-39689 update the test
e46da1ca8857...
e46da1ca8857dfa5f79e219ea1f7db817fd0b947
Oleksandr Byelkin
Merge fix
e3d62d4e78fd...
e3d62d4e78fd4941cef3f5053e6a50d0b32d740e
Sergei Golubchik
MDEV-40629 environment injection via wsrep bootstrap in the service file

* don't create mariadb-wsrep-new-cluster in the mariadbd-writable path,
  the server should not be able to poison the environment with OUTFILE.
  Create it in /run
* As in /run it must be deleted by root, let galera_new_cluster delete
  it, not the service
* wsrep-start-position cannot be created by root, so avoid a file
  for it at all

Assisted-By: Claude:claude-5-opus
da0beac410cc...
da0beac410cc761be4ee52b90fded6c7fa2f8947
Ahmad
MDEV-39858: Reloading COSINE metric index from disk degrades search recall due to abs2 quantization noise

When a vector is created in-memory using FVector::create() during normal inserts, its squared magnitude (abs2) under the COSINE metric is hardcoded to 0.5f.

However, when the index is reloaded from disk (after a server restart, FLUSH TABLES, or ALTER TABLE), the index uses FVectorNode::load_from_record(). This method reads the stored scale and quantized int16 coordinates from the database record, and runs postprocess(). Inside postprocess(), abs2 is dynamically recomputed using floating-point math:
abs2 = subabs2 + scale * scale * dot_product(d, d, vec_len) / 2;

Because the coordinates stored on disk are quantized int16 values, this recalculation introduces rounding noise.

This affects high dimensions datasets, and it is increasing as M increases.

Added hardcoded abs2=0.5 to FVectorNode::load_from_record and removed postprocess()
d8bb2d50c1c4...
d8bb2d50c1c4eb356e349defc04b3ec83223de0c
drrtuy
fix: hardening against unknown SQL injection vectors running DuckDB.
d842d6e994a8...
d842d6e994a8b0d67c280bf785a11357d6b316a2
forkfun
on rpm: don't set mysql user's $HOME to datadir

useradd set --home to %{mysqldatadir}, matching datadir.
Set --home to /nonexistent (as in deb)
cc64459f1c09...
cc64459f1c09274ceb19250d6c8867fc1f3df631
Oleksandr Byelkin
Merge branch 'bb-10.11-release' into bb-11.4-release
c920fcf4789c...
c920fcf4789c1e918dbdd45e341d941f02743312
Oleksandr Byelkin
Merge branch '11.4' into bb-11.4-release
c5a9149a901a...
c5a9149a901a6fc0039b431c72d29558c31e2575
Rex Johnston
MDEV-39499 squashme
bc424fcf2a10...
bc424fcf2a101a1ddcdd232c18f0cb86a3251ca4
Arcadiy Ivanov
MDEV-40634 Const MEMORY table's BLOB outlives the lock protecting it

A single-row table is read once during optimization and its row kept in
`record[0]` for the rest of the statement.  `JOIN::optimize_stage2()`
then releases the lock on every const table, on the premise stated in
its own comment: *"It's safe to ignore result code as all tables where
opened for read only."*

That premise assumes a read leaves a **copy** of the row behind.  MEMORY
with a blob does not.  `hp_read_blobs()` answers the read by pointing
`record[0]` at the blob data inside `HP_SHARE` rather than copying it,
so from the moment the lock is dropped another connection is free to
overwrite, free or recycle those bytes -- and the statement goes on
reading them.  The result is a const table whose value changes in the
middle of the statement using it, and a read of freed memory.

Let a caller that keeps reading a row after the unlock ask for such
tables to be left alone.  `GET_LOCK_SKIP_ZERO_COPY_ROWS` drops them
from the lock set `get_lock_data()` builds, exactly as
`GET_LOCK_SKIP_SEQUENCES` already does, and the const-table unlock in
`JOIN::optimize_stage2()` passes it.

Which tables those are is for the engine to say rather than for the
lock layer to infer.  The 64-bit `table_flags()` space is full, so a
second word `table_flags2()` carries the first such property,
`HA2_CANNOT_ACCESS_ROWDATA_AFTER_UNLOCK`, and `ha_heap::open()`
raises it for any table that has a blob.

The skip has to be opt-in rather than a rule.  `mysql_lock_remove()`
also reaches `mysql_unlock_some_tables()`, and there the unlock is
permanent and must not be skipped.

A MEMORY blob const table now stays read-locked for the whole statement
and blocks writers, which is the price every non-const MEMORY table
already pays.

The regression test parks the reader with `GET_LOCK()` rather than with
a stored function.  A stored function puts the statement into prelocked
mode, and the const-table unlock is skipped entirely in that mode, so
the code path under test would never run.

The gate that parks it is taken with `--disable_ps2_protocol` in force.
`--ps-protocol` executes every complete `SELECT` twice and compares the
two result sets, and `GET_LOCK()` is recursive, so a doubled
acquisition would outlive the single `RELEASE_LOCK()` that opens the
gate again.
ba8034e47325...
ba8034e473253a0e6745241fcd91644f188a6a6f
Brandon Nesterenko
MDEV-40648 (Regression): Mismatched Event Length can Corrupt Slave Relay Log
b82153efed4c...
b82153efed4c74085e70e52b30d952dd7881d8fa
Dave Gosselin
Clarify NULL handling comment in next_min()
b41e88430d38...
b41e88430d384761dc9f9b0e3b693bc70750b7b5
Marko Mäkelä
MDEV-40667 Infinite loop on SET GLOBAL innodb_log_archive=ON

log_t::set_archive(): Always invoke buf_flush_wait(wait_lsn, false)
on the latest sampled get_lsn(), so that if a checkpoint is
possible, one will be executed.
b369925f6855...
b369925f6855d3e1f0ebcf453492724b99fda6f8
Sergei Golubchik
MDEV-40637 CONNECT crashes on double(255,50) in DOS table

cap the length correctly
ad4403f13a08...
ad4403f13a08870a23e84e41b5fc3f4771864005
Oleksandr Byelkin
Merge branch 'bb-11.4-release' into bb-11.8-release
9c6d0cee6ee7...
9c6d0cee6ee7269ade5556cec005eaad621ae1c3
Oleksandr Byelkin
Merge branch '10.6' into bb-10.11-release
9b4f6932ed67...
9b4f6932ed676bc956f7570328b9da0f113e4651
drrtuy
fix: resolve SQL injection imposed by lexer semantics difference b/w
MariaDB and DuckDB.
940b8daa5132...
940b8daa5132a8e8ba661f499659eb9ddf4722ed
Sergei Golubchik
cleanup: encryption.filekeys_encfile_badfile

combine all tests for wrong FILE: values into one test
add a test for a wrong key.
75833f9cedba...
75833f9cedba9593075314adc5947962eaedfd4b
Marko Mäkelä
MDEV-40667 Infinite loop on SET GLOBAL innodb_log_archive=ON
69ce9cbcc2d8...
69ce9cbcc2d8443777895ea808aba62dd5a568a2
Sergei Golubchik
MDEV-40658 file_key_management crash on empty FILE: file
65d4e16e79f0...
65d4e16e79f094ae5b9fc884a9ac57dc1c6e4854
Dave Gosselin
MDEV-25964:  Unexpected bypass of lock

When an uncommitted transaction inserts rows into a table and
another statement locks rows in the same table (SELECT ... FOR UPDATE)
while computing a MIN or MAX, then:
  1. In a Debug build, the server aborts on an assertion
  2. In a Release build, the server returns wrong results
These errors occur because, while reading a group of rows for computing
a MAX, the transaction timeout error was swallowed.

Under the scenario described above and captured in the new test at this
commit, QUICK_GROUP_MIN_MAX_SELECT::next_max() emits a lock timeout error
during QUICK_GROUP_MIN_MAX_SELECT::get_next() but the error was suppressed
if we computed a MIN.

The InnoDB storage engine has an unwritten convention that after it has
returned a fatal error (which is any error except HA_ERR_END_OF_FILE
or HA_ERR_KEY_NOT_FOUND), then the SQL layer should not try to make
any further reads.  This is because InnoDB might have rolled back
the current transaction already.  So in the case of an error, return
immediately from QUICK_GROUP_MIN_MAX_SELECT::get_next().
62c417f72ef1...
62c417f72ef1af66659dcffff29fbe0c4554bfe3
Sergei Golubchik
mariadb-test: don't use strlen/strend, support lines with embedded \0

add a test
5c80e650e958...
5c80e650e9584ed43d8a4581f5d8f19128ab4f43
Oleksandr Byelkin
Merge branch '10.11' into bb-10.11-release
574ba66b2d6c...
574ba66b2d6c5d71db83d416677876e9b592858e
Sergei Golubchik
MDEV-40362 fix test

followup for f277eefa424
54987abc8bcb...
54987abc8bcb90497136d4ad1d55ce2e3ce301e2
Brandon Nesterenko
MDEV-40648: Mismatched Event Length can Corrupt Slave Relay Log

A slave stops with a relay log read failure when its master sends an
event whose header declares a length other than the number of bytes the
event arrived in. The file and position the slave reports for that
failure are not where the problem is. A master that logs no checksum
does not stop the slave at all. Such a master can make the slave run one
statement twice, leaving the slave's data holding a row the master's
binary log never carried. A "malicious" master can already send whatever
events it likes, so what this defeats is comparing a slave's applied
stream against the master's binary log.

The slave IO thread reads each event from the master as one network
packet, and writes that packet into the relay log unchanged, using the
packet's own length. Every later reader of that relay log frames the
events by a different length: the one each event's header declares at
EVENT_LEN_OFFSET. A master writing an event sets the two to the same
value. Log_event::read_log_event(), which parses the events that
queue_event() does not construct itself, checks only that the packet
reaches EVENT_LEN_OFFSET, and never compares the declared length with
the length of the packet.

queue_event() never compared the two lengths either. An event declaring
fewer bytes than the packet held reached the relay log with the extra
bytes behind the event. The SQL thread framed its next read from inside
the previous event. Where the master had placed a complete event in
those extra bytes, and no checksum covered the packet, the SQL thread
applied that second event.

This patch adds validation to ensure the lengths are equal. An event
whose lengths disagree will stop the IO thread with
ER_SLAVE_FATAL_ERROR, and the relay log will never receive the event.

Reviewed-by: TODO
Signed-off-by: Brandon Nesterenko <[email protected]>
43565b932e52...
43565b932e52fcecea6587db9bb1ec6af1292f63
Sergei Golubchik
MDEV-40636 CSV crashes on DELETE

chain_size is the number of tina_set elements, not number of bytes

Assisted-By: Claude:claude-5-opus
3b7d66c4d622...
3b7d66c4d6220b60f888b127fbd47fdd55daffe0
Daniel Black
MDEV-40630: stunnel as Deb/RPM recommends for rsync sst

stunnel has been a component used by the rsync SST mechanism of galera
but has never been listed as a package dependency.

Since MDEV-28233 corrected a unencrypted fallback in the the case of
stunnel being absent, we add stunnel as a recommendation for Debian and
RPM packages.
38cb10a7c80d...
38cb10a7c80dd86e33f30491f733c846f5c32f48
Teemu Ollakka
crash in wsrep_provider_options_init() with wsrep provider plugin

wsrep_provider_plugin_init() marked wsrep_provider_options read only
by mutating the sys_var's flags directly, instead of going through the
sys_var layer. Since MDEV-40341 move_allocated_sysvars_to_root() moves
the value of every read only global string sysvar into the read only
memroot and clears the ALLOCATED flag. wsrep_provider_options_init()
then called my_free() on memroot memory, which aborted on the garbage
allocation header.

Remove the flag mutation instead of working around its effects.
wsrep_provider_options stays a normal read-write variable and is kept
in sync with the provider whenever a plugin sysvar changes.

SET on wsrep_provider_options is still rejected while the
wsrep-provider plugin is loaded, via the existing
wsrep_provider_options_check() function. Its error message now states
the real reason instead of "is a read only variable", which was
misleading: the variable is not statically read only, and
information_schema correctly reports READ_ONLY=NO for it.
36a37c641096...
36a37c641096aac335184d11a817adc978a80e6f
forkfun
MDEV-38472 Assertion in Diagnostics_area::set_error_status on UPDATE...LIMIT DEFAULT

Binding DEFAULT to a LIMIT ? placeholder via EXECUTE ... USING is never
rejected at bind time. unit->set_limit() later evaluates it and sets
ER_INVALID_DEFAULT_PARAM in the Diagnostics_area, but SQLCOM_UPDATE (and
SQLCOM_UPDATE_MULTI, SQLCOM_INSERT_SELECT/REPLACE_SELECT) proceeded into
open_tables() regardless. A concurrent metadata change (e.g. ALTER TABLE
FORCE) then triggers Reprepare_observer::report_error(), which tries to
set ER_NEED_REPREPARE on an already-set DA and hits the assert.

Add the same thd->is_error() check after unit->set_limit() (as in
SQLCOM_DELETE), aborting before open_tables() is reached.
367efd5674fc...
367efd5674fc67821078af2aea0675c9089114f7
Daniel Black
MDEV-31808 crash upon altering table with NEXTVAL for default under exclusive lock

A segfault in mysql_lock_merge waa the result of a null argument
when called from open_and_lock_internal_tables. As the argument
was null there was no lock to merge and thd->lock was already in place,
so no futher action is required in open_and_lock_internal_tables.

After passing the previous correctly on open_table of the
sequence used in the table, we get to the checking the thd->open_table
list where tdc is flushed. This puts the open_table into an error
condition to reopen all tables. When we are just opening a sequence,
this condition isn't one we want to fail on.
3596ef3b74ac...
3596ef3b74acd8b973d3714391ea08f9475607b3
Oleksandr Byelkin
Merge branch '10.11' into bb-10.11-release
25408dd2ad5b...
25408dd2ad5b14f063d8543cd2340579e7761f7a
Sergei Golubchik
MDEV-40670 qc_info OOB read if query contains \0

qc_info cannot parse query cache key, this cannot be done
without changing query cache key format.

let's limit the (possibly incorrect) db_length to make sure
it does not extend beyond the key end, this way there will be no
OOB reads and no information leak.
1dfb716d4c5a...
1dfb716d4c5a2802bb02c5c1a11852d8e5bb18a4
Oleksandr Byelkin
Merge branch 'bb-11.8-release' into bb-12.3-release
16ddaf82e246...
16ddaf82e24605aedbb543bf2dd39312553c7661
aleksei.bukhalov
docs: add public dataset tutorials for the DuckDB engine

Add two step-by-step tutorials:

- NYC Taxi Trips: load TLC Parquet via run_in_duckdb() + read_parquet(),
  keep the zone lookup in InnoDB, then join the two engines in a plain
  SELECT. Follows the structure of the ClickHouse taxi tutorial.

- OWID CO2 Emissions: load a commit-pinned CSV revision, run
  aggregations and a LAG() window function.

Both tutorials point at security-model.md before telling the reader to
enable duckdb_allow_run_in_duckdb, and both note that ordinary
INSERT/UPDATE/DELETE also work on ENGINE=DuckDB tables so that
run_in_duckdb() does not look like the only write path.

Also documents TIMESTAMPDIFF in mariadb-duckdb-incompatibilities.md and
adds a tutorials section to the README.

Every SQL block and every expected output was extracted from the
markdown, executed, and compared cell by cell on MariaDB 11.4.13 built
from this branch; both data sets are pinned so results stay
reproducible.
0931994096b8...
0931994096b84ecc9ffc8eb3517c7e09e6e8631e
Sergei Golubchik
MDEV-40670 qc_info OOB read if query contains \0

qc_info cannot parse query cache key, this cannot be done
without changing query cache key format.

let's limit the (possibly incorrect) db_length to make sure
it does not extend beyond the db name end, this way there will be no
OOB reads and no information leak.
039bf58a74c8...
039bf58a74c83617534635fadf685f8ff7a35fb3
Alexander Barkov
MDEV-39587 Package-wide TYPE for variable declarations

SET sql_mode=ORACLE;
DELIMITER $$
CREATE OR REPLACE PACKAGE pkg AS
  -- Declare a package public data type
  TYPE varchar_array IS TABLE OF VARCHAR(2000) INDEX BY INTEGER;
END;
$$
DELIMITER ;
DELIMITER $$

CREATE OR REPLACE PROCEDURE p1 AS
  v pkg.varchar_array; -- Use the package public data type
BEGIN
  v(0):='test';
  SELECT v(0);
END;
$$
DELIMITER ;

Note, the change is done only for sql_mode=ORACLE, because the TYPE
declaration is not available for the default mode.

Where package-wide types are available
--------------------------------------
- Variabe list type:
    DECLARE var pkg1.type1;

- RETURN type for a package routine:
    CREATE FUNCTION .. RETURN pkg1.type1 ...

- Parameter type for a package routine:
    PROCEDURE p1(param1 pkg1.type1);

- Assoc array element type:
    TYPE assoc1_t IS TABLE OF pkg1.type1 ...

- REF CURSOR RETURN type:
    TYPE cur1_t IS REF CURSOR RETURN pkg1.type1;

Change details
--------------

- Adding a member Lex_length_and_dec_st::m_foreign_module_type
  It's set to true when the data type was initialized from a TYPE
  in foreign routine (e.g. in PACKAGE spec).
  It's needed to prevent use of qualified identifiers in public contexts,
  i.e. in schema public routine parameter types and schema publuc function
  RETURN types.
  Adding a helper method sp_head::check_applicability() which prevents
  use of qualified types in public context.

- Adding a helper method sp_head::raise_unknown_data_type().

- Adding methods LEX::set_field_type_typedef_package_spec() for
  2-step and 3-step qualified indentifiers.
  It's used in field_type_all_with_typedefs which covers cases:
  - Variabe list type        : DECLARE var pkg1.type1;
  - RETURN type              : CREATE FUNCTION .. RETURN pkg1.type1 ...
  - Parameter type          : PROCEDURE p1(param1 pkg1.type1);
  - Assoc array element type : TYPE assoc1_t IS TABLE OF pkg1.type1 ...

- Adding a method LEX::declare_type_ref_cursor_return_typedef().
  It handles cases when a new TYPE REF CURSOR RETURN is declared,
  for both for qualified RETURN types and non-qualified RETURN types:
  - TYPE cur0_t IS REF CURSOR RETURN rec1_t;
  - TYPE cur0_t IS REF CURSOR RETURN pkg1.rec1_t;
  - TYPE cur0_t IS REF CURSOR RETURN db1.pkg1.rec1_t;

  The code was moved from LEX::declare_type_ref_cursor() into
  LEX::declare_type_ref_cursor_return_typedef() and extended
  to cover qualified RETURN types.

- Adding a method Sql_path::find_package_spec_type().
  It iterates through all schemas specified in @@path and searches
  for the given type in the given package.

- Adding a helper method sp_pcontext::type_defs_add_ref_cursor()
  to reuse the code.

- Adding a new method sp_package::get_typedef() to search
  for TYPE definitions in PACKAGE specifications.

- Adding a new method sp_head::get_typedef_package_spec()
  to search for TYPE definitions used by a PROCEDURE or FUNCTION.

- Adding a helper method
    Sp_handler::sp_cache_routine_reentrant_suppress_errors
  Adding a method Sp_handler::find_package_spec().
02a8d47e0e4c...
02a8d47e0e4c8fae16716b19db3bebce2b6cbf81
drrtuy
fix: MDEV-40386 disable MTR tests for MSAN builds b/c MSAN build is unstable.
021bd9024dcd...
021bd9024dcdda8b281d2694985199f1b68dea69
Oleksandr Byelkin
Merge fix
BuildBot (0.8.9) working for the MariaDB project.
Page built: Fri 07 Aug 2026 21:55:35 (UTC)