Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
Sergei Golubchik
UBSAN: sql/table.h:237:16: runtime error: load of value 4, which is not a valid value for type 'bool'

the warning was about uninitialized `bool in_field_list`
let's initialize the whole ORDER when it's allocated.
drrtuy
fix: fix stack size warning.
Aleksey Midenkov
WITHOUT_ABI_CHECK followup

Followup for b337e14440b as info_src takes time too.
info_src does not make much sense without ABI check.
forkfun
Merge branch '11.4' into '11.8'
Sergei Golubchik
MDEV-37951 SHOW TABLES allows users with only GRANT OPTION privilege to read all table names in the database "mysql"

WITH GRANT OPTION is not a privilege in the standard sense,
so whenever INFORMATION_SCHEMA visibility dictates "any privilege"
this does not include WITH GRANT OPTION, even though GRANT_ACL
is a privilege in MariaDB.

Assisted-By: Claude:claude-4.6-sonnet
Sergei Golubchik
fix sporadic galera test failures

* query @@datadir before audit is enabled, not directly before reading
  the log. just in case cat gets the log before SELECT is flushed.
* wait for a table to be dropped
Sergei Golubchik
apply reasonable limits to initid.max_length as provided by UDF

UDF can set max_length incorrectly, e.g. to 2138 for an integer.
let's cap UDF-provided value by a type-specific limit.
Daniel Black
MDEV-35738 mariadb build -fsanitize=pointer-compare

invalid pointer pairs are when the length/memory of one string are
intermixed with another.

For comp_err, the end null pointer was compared to soffset within
my_strtoll10. As we didn't need the end position a NULL arg option
was compatble.

For uca-dump, Address Sanitizer raises invalid pointer pair because
argv options (opt) don't have an obvious correlation of having a start
at opt_X.length, even though the lstrncmp makes this true.

The DBUG_ASSERTS of strmov (added MDEV-11752) where incompatible with
pointer-compare. Replaced strmov with static inline version in
m_string.h using memmove that allows overlaps, and being inline allows
the uneeded parts of the implementation to be optimized away.
Daniel Black
MDEV-40488 disable connect.odbc_sqlite3 test on ASAN

Leak appears in libltdl which is opened by the unixodbc
driver. There doesn't appear to any mishandling at the
ODBC level of the connect storage engine.
Sergei Golubchik
MDEV-36147 MariaDB cannot open page-compressed InnoDB tables at startup if innodb_compression_algorithm other than zlib is specified

When innodb_compression_algorithm is set to a non-zlib algorithm (e.g.
lz4) and the provider plugin is loaded from mysql.plugin rather than
command line, InnoDB failed to start because it checked for the provider
at plugin initialization time, before plugin_load() reads mysql.plugin.

Fix:
* InnoDB returns HA_ERR_RETRY_INIT when the compression provider is
  missing.
* In sql_plugin.cc, the retry loop is changed to not reap until
  mysql.plugin has been loaded

Assisted-By: Claude:claude-4.6-sonnet
Aleksey Midenkov
MDEV-39063 Server crashes at Item_func_lastval and Item_func_setval with CTE alias

Pure aliases are not handled properly by Item_func_lastval::val_int()
and Item_func_setval::val_int().

This is followup fix for MDEV-33985 where it missed similar cases for
LASTVAL() and SETVAL().

add_table_to_list() does not create MDL request for pure aliases,
i.e. when there is no table_list->db set or TL_OPTION_ALIAS was
set. When the expression is not inside CTE the case with empty db is
handled by:

  else if (!lex->with_cte_resolution && lex->copy_db_to(&db))
    DBUG_RETURN(0);

So, table_list gets current database name and the query is failed with
ER_NO_SUCH_TABLE error.

The fix adds the case of is_pure_alias() check for val_int() methods
and fails it with ER_NOT_SEQUENCE2 error.

Note: semantics for TL_OPTION_ALIAS cannot be based on empty db, only
parser can set TL_OPTION_ALIAS as resolve_references_to_cte() relies
on TL_OPTION_ALIAS after copy_db_to().
drrtuy
fix: extra try-catch during plugin init.
Sergei Golubchik
MDEV-37840 Server crashes when executing FLUSH PRIVILEGES after starting with skip-grant-tables and creating mysql.host table

hash_filo's mutex was lazily initialized in clear(), but grant_reload()
locks acl_cache->lock without first calling clear(). With
--skip-grant-tables, acl_cache is created but clear() is never called
(acl_reload() skips it on error), leaving the mutex uninitialized.

Fix: initialize the mutex eagerly in the hash_filo constructor and
remove the now-redundant init flag.

Assisted-By: Claude:claude-4.6-sonnet
Georg Richter
Fix OOB read in init_read_hdr() via dynamic column header validation

In mariadb_dyncol.c, init_read_hdr() computed header pointer offsets
and hdr->data_size without validating that the sum of fixed_hdr,
header_size, and nmpool_size fit within str->length.

Crafted dynamic column blobs with invalid metadata could push pointer
offsets past the buffer bounds or cause unsigned integer underflow on
hdr->data_size, leading to out-of-bounds reads in downstream functions.

Add bounds check in init_read_hdr() to ensure header offsets do not
exceed total buffer length, matching mariadb_dyncol_check().

Reported-by: AISLE Research
ParadoxV5
Test for MDEV-39788

MDEV-39788 found that the recent refactor on the `main` (now 12.3)
branch missed the (inconsistent) detail that, unlike `relay-log.info`,
`master.info`’s line count _includes_ the line-count line itself.

This commit extends and simplifies the test
`rpl.rpl_read_new_relay_log_info` to `main.rpl_new_info` so it
* Checks this detail to remind future changes of this type of mistake.
* Covers `@@master_info` as well.
* Covers the refactor’s buggy format as a downgrade/revert test.

While here, this commit also includes a new-format version
of MDEV-38020’s test to double as the value read check.

Reviewed-by: Brandon Nesterenko <[email protected]>
forkfun
MDEV-39522 Query with UNION fails in Oracle sql_mode with ER_BAD_FIELD_ERROR/ER_UNKNOWN_TABLE

MDEV-37325 unconditionally wrapped union subqueries in derived tables,
breaking name resolution of outer-scope/correlated references inside
the unions (producing ER_UNKNOWN_TABLE errors).

Delay the wrap until a following operator has a different linkage.
In Oracle mode all set operators share one priority and bind
left-to-right, so wrapping the accumulated prefix on each operator
change enforces it. This also corrects the row multiplicity of mixed
set operations toward left-to-right order.

create_priority_nest(): when the nest covers the whole prefix, point
the wrapper's first_nested at itself. Cut the prefix with
cut_next() before wrapping and re-register it on the outer unit;

Aleksey Midenkov:

In Oracle mode optimize_bag_operation() returns early, so union_distinct is
never recomputed and the stale value reaches execution.
Register the wrapper first, then run fix_distinct(): reset_distinct() now
scans the new outer chain (the wrapper alone) and correctly leaves
union_distinct NULL; a following DISTINCT operand re-establishes it.
Sergei Golubchik
MDEV-23486 RBR can bypass secure_timestamp=YES

Add tests for system versioning.
INSERT is fixed, but UPDATE is still broken.
Sergei Golubchik
MDEV-40413 ALTER TABLE ... CONVERT ... PARTITION doesn't encode partition names

CONVERT ... PARTITION passed user-specified partition names to
create_partition_name() with translate=FALSE, so names needing
filename escaping (e.g. `foo-bar`) didn't match the on-disk file.
Pass TRUE to encode them.
Kristian Nielsen
MDEV-35691: Invalid access, use-after-free, on rli->description_event_for_exec

This commit rewrites the rpl_master_has_bug() mechanism to solve a problem
with invalid memory access. The rpl_master_has_bug() mechanism detects
certain bugs depending on the master version, and uses that to enable
specific work-arounds on the slave. The problem was that
rpl_master_has_bug() accessed Relay_log_info::description_event_for_exec
that is not valid to access from concurrent parallel replication worker
threads, only from the SQL driver thread. Thus it could use the wrong event
or access invalid/freed memory.

This patch instead computes a bitmask of detected bugs when the SQL driver
thread processes the format description event, and reads that bitmask with
an atomic load from the worker threads. The bitmask of bugs can only change
when the master restarts with a new version, and we do not replicate events
concurrently across a format description event from a master restart. Thus,
the bitmask is safe to read concurrently from the Relay_log_info object
without locking.

This also avoids an expensive match of each entry in the bug list against
the master server version done for every single call to
rpl_master_has_bug(), which could be quite expensive when done eg. per field
in row events as in Field_string::compatible_field_size().

Also remove redundant conditional in table_def::compatible_with().

Thanks to Andrei Elkin for the idea to safely read the bitmask
concurrently from the Relay_log_info.

Reviewed-by: Andrei Elkin <[email protected]>
Signed-off-by: Kristian Nielsen <[email protected]>
Sergei Golubchik
MDEV-24598 Duplicate CHECK constraint names are allowed

Field CHECK constraints always have the name of the corresponding field.
Table-level CHECK constraint can be arbitrary named and can have
the name of the field with a CHECK constraint.

Detect this and throw ER_DUP_CONSTRAINT_NAME.

Special treatment for auto-generated constraint names
(CONSTRAINT_1, etc) they can match a field name too - this is not
an error, just auto-generate a different name.

Assisted-By: Claude:claude-4.6-sonnet
Sergei Golubchik
MDEV-23486 RBR can bypass secure_timestamp=YES

fix TIMESTAMP DEFAULT NOW() and ON UPDATE NOW()

Caveat: rbr cannot work without an index - if the slave overwrites
timestamp columns, before-image won't match in full, this is expected.
Daniel Black
MDEV-40414 Server crash in Charset::charset upon JSON operations

JSON_EQUALS didn't check that ::val_str() of its arguments
where not-null before attempting to test their equality.

JSON_OVERLAPS also ensure that ::val_json() isn't null.
Sergei Golubchik
cleanup: get_item_copy<>(item)

make get_item_copy<T>(item) return T* not a generic Item*
helps to avoid casts when a copy needs to be fixed before returning.
Sergei Golubchik
MDEV-26910 mysqld_multi starts same instance multiple times with the risk to crash database

a group name may be present in a file more than once.
use hash to deduplicate.
Sergei Golubchik
MDEV-25813 ASAN errors in err_conv / field_unpack upon multi-UPDATE causing ER_DUP_ENTRY

InnoDB always frees allocated in record[0] blobs even
when reading into record[1].
Let's read into record[0] for consistency.
Daniel Black
Remove no_valgrind_without_big.inc from *C* include dir

The identical file is in mysql-test/include where it is used.
drrtuy
fix: MDEV-40452 ASAN builds complain about enourmous stack consumption b/c of the reference pointer used for stack usage calculations.
Georg Richter
CONC-847: Fix Out-of-Bounds read in unpack_fields() on malformed metadata

When processing field metadata packets, unpack_fields() was assuming
the 12-byte binary metadata block (prefixed by a 1-byte length indicator)
was fully present in the packet payload. On truncated or malformed field
definition packets, this led to unchecked memory reads past the end o
the row buffer.

Fix this by validating the remaining length in row->length against the
13-byte envelope requirement (1-byte length prefix + 12-byte binary block)
before unpacking field attributes. If the packet is truncated, set
CR_MALFORMED_PACKET and abort processing cleanly.

Also add a unit test (test_conc847) to verify that malformed field packet
metadata returns CR_MALFORMED_PACKET without memory corruption or ASan
violations.
Aleksey Midenkov
MDEV-38854 Assertion table->vers_write fails upon ODKU into table with versioned column

In MDEV-25644 vers_check_update() sets vers_write to false in case it
returns false. It is ok for UPDATE but is not correct for ODKU is bulk
insert requires vers_write on next tuple.

The fix return vers_write value back when vers_check_update() and
related vers_insert_history_row() are done in ODKU.
drrtuy
fix: clean DeltaAppender after at rollback or disconnect.
Mohammad Tafzeel Shams
MDEV-39800: Assertion `!(mode & 2048U) || (mode & 512U) || is_supremum' failed

ISSUE:

Lock bypassing optimization allows an X-lock request to skip
waiting locks when the requesting transaction already holds an
S-lock on the same record. This optimization is designed for
regular B-tree record locks that use heap-number-based conflict
detection.

Spatial index predicate locks use different semantics. They
perform MBR (Minimum Bounding Rectangle) overlap checks for
conflict detection and must not participate in bypass
optimization.

The assertion failure occurred because predicate insert
intention locks is not considered inside lock bypass code,
which assumed all insert intention locks must be either gap
locks or on the supremum record (MDEV-34877).

ut_ad(!(insert_intention) || (gap) || is_supremum)

Additionally, predicate locks could incorrectly enable
bypass_mode because the existing checks did not explicitly
exclude LOCK_PREDICATE locks.

FIX:

- lock_t::is_predicate(): Add a helper to identify spatial
  index locks.

- lock_t::can_be_bypassed(): Return false for predicate
  locks.

- lock_rec_has_to_wait_in_queue(): Update the assertion to
  allow predicate insert intention locks. Also add a
  !is_predicate() check to bypass_mode calculation.

- lock_rec_queue_validate_bypass(): Add an early return to
  skip bypass validation for predicate locks.
drrtuy
chore: renaming, extra docs and bump DuckDB to gamma.
Sergei Golubchik
MDEV-40425 handlersocket crashes on read with huge number of fields

* fix handlersocket to unlink it's THD, this apparently was broken
  for years
* add a check for fldnum
* add a first ever handlersocket test
forkfun
Merge branch '11.8' into '12.3'
rusher
[misc] permit CI to continue even when some error occurs
Sergei Golubchik
MDEV-31024 Server crash / ASAN use-after-poison in Binary_string::free_buffer / Item_func_sformat::~Item_func_sformat

re-allocate Item_func_sformat::val_arg in shallow_copy()
to keep it in the same memroot as the item.
drrtuy
chore: DuckDB build.sh exposes build with ASAN flag.
forkfun
Merge branch '10.11' into '11.4'
Daniel Black
MDEV-39113 MSAN/ADDR addr2line stack resolver detrimental

MSAN/ASAN test environment, the addr2line was so high in memory
utilization that it was the pick of the OOM killer to resolve the OOM
situation. Once this occurred there wasn't a saved core or gdb backtrace
of the core to resolve the issue.

To resolve this, make stack-trace default to 0 (off) for the addr2line
base implementation under memory sanitizer and address sanitizer.

MariaDB-backup also forces the enabling of stack-trace. Disabling this
unconditionally reduces the risk of a user operational impact if a
lengthy stack trace starting in a mariadb-backup critical locked period.

The mysqld--help test now excludes the stack-trace as its result is
environment dependant. The "Defaults to..." output for suppressed
variables, currently only stack-trace, is excluded.

Since thread-stack is an excluded varable, the ubsan/asan exclusions
from commits dfa6fba9595a and dfa6fba9595a aren't required.
Mohammad Tafzeel Shams
MDEV-40504: Fix memory leak in mariabackup incremental copy

ibx_copy_incremental_over_full() : Replace die() with
proper error handling to avoid memory leaks when RocksDB
backup directory operations fail.