Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
Sergei Golubchik
MDEV-39673 group_concat ignores max_allowed_packet

GROUP_CONCAT is limited by group_concat_max_len,
but also, as a string function it must respect max_allowed_packet.

Let's introduce THD::gconcat_max_len() helper to simplify checks.

Also:
* make max group_concat_max_len value the same as max max_allowed_packet
* use the same MY_MIN((ulonglong) ..., UINT_MAX32) in
  Item_func_json_objectagg as in Item_func_group_concat
* use overflow-safe type for lengths in Item_func_quote
  (MAX_MAX_ALLOWED_PACKET is 1G so uint cannot overflow yet, but it's
  a fragile assumption)
Vladislav Vaintroub
MDEV-37556 Memory leak in proxy protocol with name resolution enabled

When proxy protocol is used and --skip-name-resolve is not set,
thd_set_peer_addr() is called twice per connection: once for the real TCP peer (in check_connection),
and again for the proxied address (in handle_proxy_header).
Each call invokes ip_to_hostname(), which allocates a hostname string
(unless loopback connection is used) and stores it as
thd->main_security_ctx.host. That code missed to free previously
allocated hostname, which results into memory leak.

This is now fixed. Also added debug-only test to mysql_client_test, which
fakes DNS and IP resolution the same way some perfschema tests do, to
emulate remote TCP connection in MTR.
Jan Lindström
MDEV-40027 : Galera Cluster-peer > Donor command execution

An appropriately privileged user (with SUPER privileges) could
execute shell commands as the uid of the mariadbd process
because the values of the system variable wsrep_sst_auth,
which can be modified at runtime, were not properly
sanitized when used to construct a shell command.

Combined rsync and mariabackup test cases and added
test case for incorrect values for wsrep_sst_auth.
Hemant Dangi
MDEV-39721: wsrep_notify.cc: reject shell-unsafe characters in joiner-supplied member fields

Issue:
wsrep_notify_status() interpolated members[i].name() (the peer's
wsrep_node_name) and members[i].incoming() verbatim into a command
string that is then executed via 'sh -c' by wsp::process. A peer
joining the cluster with shell metacharacters in its wsrep_node_name
or wsrep_node_incoming_address caused arbitrary commands to run on
every cluster member that had wsrep_notify_cmd configured.
MDEV-39413 introduced safe() for the same threat class in the SST
scripts but did not cover the C++ wsrep_notify path.

Solution:
Validate each substituted field against a narrow whitelist before
interpolating. Node name allows alnum and -_. ; node address
additionally allows :[]/ for host:port and [ipv6] forms. On bad
input the notification is skipped with an error log instead of
forwarding the unsafe value to sh -c.
Hemant Dangi
MDEV-39648: wsrep_sst_rsync.sh: apply safe() to joiner-supplied parameters

Issue:
wsrep_sst_rsync.sh interpolated WSREP_SST_OPT_REMOTE_USER and
WSREP_SST_OPT_REMOTE_PSWD verbatim. Because both values originate from
the joiner side of the SST request, a newline in either could splice
an extra directive into the donor-written stunnel.conf (silently
downgrading peer-cert verification) or an extra line into the rsync
magic file. MDEV-39413 had introduced safe() for the same threat class
in wsrep_sst_mariabackup but did not extend it to the rsync script.

Solution:
Routing the rsync interpolations through safe() closes the gap, and
extending safe() to also reject tab and newline ensures multi-line
values cannot survive into a config-file heredoc.
bsrikanth-mariadb
MDEV-21735: Wrong result with prefix indexes using rocksdb

trial run to check the fix
Teemu Ollakka
Add missing notify_state_change() in Wsrep_client_service.

The change was forgotten from previous rebase/wsrep-lib update.
Oleg Smirnov
MDEV-32326 Recursive CTE reference in a scalar subquery must be rejected

A recursive reference to a WITH RECURSIVE table that is reachable only
through a scalar subquery (in particular through a WITH clause nested
inside such a subquery) was not recognized as a subquery reference. As a
result the recursive CTE was wrongly accepted as standard-compliant instead
of being rejected with ER_NOT_STANDARD_COMPLIANT_RECURSIVE, and execution
later dereferenced an uninitialized join_tab for that reference in
st_select_lex_unit::exec_recursive(), crashing the server.

The cause was in With_element::check_dependencies_in_unit(). The flag
marking that we are inside a subquery (in_subq) was updated only after the
unit's own WITH clause had already been analyzed. Hence dependencies
discovered while descending into a WITH clause attached to a scalar
subquery were recorded in top_level_dep_map instead of sq_dep_map, so
contains_sq_with_recursive_reference() failed to report the violation.

The fix: set in_subq from unit->item before processing the unit's WITH
clause, so that dependencies found in nested WITH clauses of a scalar
subquery are correctly attributed to the subquery context.

The expected error for the MDEV-32299 cases in cte_recursive.test changes
accordingly from ER_BAD_FIELD_ERROR to ER_NOT_STANDARD_COMPLIANT_RECURSIVE:
the query is now rejected at dependency analysis for its non-compliant
recursive reference rather than failing later during name resolution. The
test still verifies that no crash occurs.
Pekka Lampio
MDEV-38386 Fix incomplete cleanup in Galera MTR tests failing under --repeat

A number of Galera MTR tests pass on the first run but fail on a second
--repeat iteration, because server, cluster or filesystem state leaks
across runs and the test does not restore a clean starting state.

Fix the cleanup (or force a fresh cluster) in the affected tests. Each
fix was verified with --repeat=2 --force.

1. Stale async-slave GTID position (11 tests)

  RESET SLAVE [ALL] does not clear gtid_slave_pos. As the master does
  RESET MASTER in cleanup, on the next run the slave considers the
  events already applied and skips them, so the replicated tables never
  appear. Clear the position with SET GLOBAL gtid_slave_pos = "".

2. Leftover binlog GTID state from trailing cleanup (1 test)

  Trailing DROP TABLE / mtr.add_suppression statements ran after the
  .inc's reset master and re-populated node_2's binlog. gtid_binlog_state
  keeps the latest seqno per (domain, server_id) pair, so a stray
  0-2-<n> survived into the next run and broke the state comparison.
  Reorder the cleanup and reset node_2's binlog last.

3. Cluster-global, one-time or time-window state (11 tests)

  The wsrep GTID domain seqno is cluster-global and is not reset by
  reset master (nor by a mid-test SST rejoin); error-log contents,
  warning-flood suppression timers and one-time bootstrap behaviour are
  likewise not restored by in-test cleanup. Force a fresh cluster with
  include/force_restart.inc.

4. Leftover filesystem artifacts (1 test)

  mariabackup refuses to back up into a non-empty target directory, so
  the leftover target dirs from the previous run made the backup fail
  silently and the expected log messages never appeared. Remove the
  target directories in cleanup.
Sergei Golubchik
strengthen safe() in wsrep_sst_common, just in case
Marko Mäkelä
MDEV-39344: trx_disconnect_prepared() uses wrong mutex

trx_t::disconnect_prepared(): Replaces trx_disconnect_prepared().
Protect is_recovered, mysql_thd with mutex, to be consistent with
protecting fetch_data_into_cache_low().

This fixes up
commit c0817dac99c28698dfc2b548d89acf1fb41dc32e (MDEV-29575).

Suggested by: Sergey Vojtovich
Thirunarayanan Balathandayuthapani
MDEV-39707 Assertion `lsn != 0' failed in log_write_up_to

Problem:
========
innodb_make_page_dirty(): Unconditionally calls log_write_up_to()
with mtr.commit_lsn() after committing the mini-transaction.
When the mtr produced no redo records when the targeted page
is full of zeroes.

Solution:
========
innodb_make_page_dirty(): Skip log_write_up_to() when
commit_lsn() is zero.
Vladislav Vaintroub
Merge branch '10.11' into MDEV-38369
Sergei Golubchik
MDEV-39676 disallow global.wsrep_sst_donor=NULL again

it crashes in galera.mdev-28433
Dave Gosselin
MDEV-39952:  Skip tests that need mariabackup

Skips tests that require mariabackup if mariabackup was not
built (WITH_MARIABACKUP=OFF).

Backport of the same MTR change from 12.3 but applied to
additional tests.
Sergei Golubchik
MDEV-39581 dynamic column header missing sanity checks
Dave Gosselin
MDEV-38158:  Incorrect query result

When setup_copy_fields() needs to copy a non-aggregate function value,
it doesn't construct an Item_copy directly.  Instead, it calls
Type_handler::create_item_copy, which is a kind of factory.  The base
Type_handler::create_item_copy returns Item_copy_string.  Some type
handlers override it, like timestamp and fixed binary.  However, the
numeric type handlers (e.g., float, double, int, decimal) did not, so
they fell through to that base and got Item_copy_string.

A SELECT that aggregates will copy each non aggregate function value
into a temporary table through an Item_copy object, whose concrete
type is chosen by the create_item_copy method on the value's type
handler.  For numeric types that method returned Item_copy_string,
which stores the value as text.  A FLOAT keeps only FLT_DIG
significant digits as text, too few to reproduce its 24 bit mantissa,
so the copied value differed from the original.  With one row per
group, CAST(c1 AS FLOAT) - MIN(CAST(c1 AS FLOAT)) returned a large
number instead of zero.

Add Item_copy_real with Item_copy_float and Item_copy_double variants
that keep the value as a double, the same way Item_cache_real does, and
let the float and double type handlers create them.  This mirrors the
existing copy items for timestamp and fixed binary types.
Fariha Shaikh
MDEV-39931 Fix main.socket_conflict failure when running as root

The test directly executes $MYSQLD via --exec, bypassing MTR's automatic
--user=root injection. In GitLab CI containers where tests run as root,
mariadbd refuses to start and the test fails.

Skip the test when running as root, matching the existing approach used
by the related main.bad_startup_options test.

All new code of the whole pull request, including one or several files
that are either new files or modified ones, are contributed under the
BSD-new license. I am contributing on behalf of my employer Amazon Web
Services, Inc.
Jan Lindström
MDEV-40056 : Analyze Galera Dynamic Variables Susceptible to RCEs

Fix potential issue with wsrep_node_address by allowing
only correctly constructed address.
Dave Gosselin
MDEV-39397: GROUP_CONCAT of BIT returns decimal, not packed bytes

When DISTINCT or ORDER BY is in play, GROUP_CONCAT builds an
internal temp table and converts BIT arguments to integers so records
can be compared by memcmp.  Calling val_str() on that field
then returned the decimal form ("0", "1", "3") instead of the
packed bit bytes that Field_bit::val_str() emits everywhere else,
including the "plain" GROUP_CONCAT path.

Override get_str_from_field() for Item_func_group_concat to detect
when the argument is BIT, read the value as an integer from the
temp table field, and pack it into (max_length + 7) / 8 bytes,
mirroring Field_bit::val_str().  This makes DISTINCT and ORDER BY
agree with the plain path.

Before this change, BIT fields in group_concat were rendered
as ASCII which was incorrect and produced the wrong result as
described in the ticket.  With this fix, we also update the
existing test cases to wrap BIT columns with '+0' so the recorded
output stays in ASCII format.  Now, with this patch and the test
case from the ticket, MariaDB and MySQL produce identical resultset
of a single row, single column having value 08.

By default, a group_concat including BIT fields on MySQL returns a
hexified value for its resultset whereas MariaDB requires the
hex() function to wrap group_concat for the same result:

Setup:
  create table t1(a bit(2), b varchar(10), c bit);
  insert into t1 values (1, 'a', 0), (0, 'b', 1);

MySQL:
  mysql> select group_concat(a, c) from t1;
  +----------------------------------------+
  | group_concat(a, c)                    |
  +----------------------------------------+
  | 0x01002C0001                          |
  +----------------------------------------+
  1 row in set (0.001 sec)

MariaDB:
  MariaDB [test]> select hex(group_concat(a, c)) from t1;
  +-------------------------+
  | hex(group_concat(a, c)) |
  +-------------------------+
  | 01002C0001              |
  +-------------------------+
  1 row in set (0.001 sec)
Hemant Dangi
MDEV-38843: BF applier failed on a node causing complete Cluster lockup

Issue:
When a BF applier failed to apply a write set and the transaction
rollback returned non-zero, wsrep-lib's apply_write_set() short-circuited
log_dummy_write_set(). That call releases commit order through
commit_order_leave() -- which drives the inconsistency vote -- and
advances the storage engine checkpoint. Skipping it left the seqno stuck
in commit order, so following appliers blocked on commit_order_enter and
the node silently locked the cluster while staying in the primary
component.

Solution:
wsrep-lib now always calls log_dummy_write_set() on the apply-error path,
so the apply error reaches the provider and the node is voted out and
evicted instead of hanging. The rollback result is still folded into ret,
and Wsrep_high_priority_service::rollback() returns its real result again.
Vladislav Vaintroub
MDEV-38369 improve heap allocation performance on Windows with segmentHeap

Use modern segmentHeap heap manager on Windows.

The problem it is solving is severily reduced scalability on concurrent
OLTP benchmarks, due to inherent scalability problems in default NT Heap
implementation.

The benchmarks (see the corresponding ticket) show improvements across
the board, with about 5-10% on low concurrency up to several orders of
magnitude on high concurrency.

Also addressed Gemini and Copilot concerns about correct namespace in
the app manifest XML file - make it the same as in Microsoft examples.
Vladislav Vaintroub
MDEV-40001 my_sync() does not use NtFlushBuffersFileEx()

Copy the logic from Innodb. Use a fallback to FlushFileBuffers(), if
NtFlushBuffersFileEx() fails.

my_winfile.c is renamed to my_winfile.cc, since it is using a C++ feature,
initialization of global variable using non-constant expression.
Exported functions remain extern "C"
Daniel Black
MDEV-39777: Fixed flaky plugins.unix_socket test

The plugins.unix_socket test showed the previous command process.

This occurs as after MDEV-38019 the early result to the client
results in the server side thread lingering for its cleanup.

The subsequent of DROP USER can observer the connection
still in progress and hence outputing a warning.

Used --ping in the peer_cred_test so that on completion, there
is no connection active for the user.
Daniel Bartholomew
bump the VERSION
Thirunarayanan Balathandayuthapani
MDEV-34998 Assertion `n_fields > n_cols || type & 32' failed in dict_index_t::init_change_cols on ALTER

Problem:
=======
During ALTER TABLE with column type modification and index addition,
InnoDB aborts with an assertion failure when processing collation
changes for single-column secondary indexes.

Solution:
========
dict_index_t::init_change_cols(): A single-column prefix secondary
index can have n_cols == n_fields when the column is the same as
the primary key column and undergoes a collation or type change
during ALTER TABLE.
Sergei Golubchik
fix columnstore for new cmake
Sergei Golubchik
MDEV-39658 ASAN crash on invalid proxy_protocol_networks value

max_subnet estimate was off by one.

* only allow address with a known family
  (trips an assert in addr_matches_subnet())
* adjust max_subnet estimate accordinly
sjaakola
fixing regression of galera.MDEV-38073
Kristian Nielsen
Fix inconsistent terminology

Signed-off-by: Kristian Nielsen <[email protected]>
Oleg Smirnov
MDEV-36344: UBSAN Lifo_buffer::have_space_for change

Adjust Lifo_buffer::have_space_for to not lead itself to UBSAN
overflows.
Rex Johnston
MDEV-30073 Wrong result on 2nd execution of PS for query with NOT EXISTS

Summary: Items of type Item_direct_view_ref which are reverted with the
change_item_tree mechanism are involved in permanent optimizer
transformations.  This commit ensures that items involved in these
permanent transformations are created during the first execution
and re-used for subsequent executions.

Queries affected by this bug are numerous, but will always involve
1) 2nd execution of a prepared statement or procedure
2) a permanent transformation, such as a semi-join optimization

Detail:

Consider this run as a prepared statement
SELECT * FROM t1
  WHERE EXISTS
  (
    SELECT dt.a FROM
      (
        SELECT t2a as a, t2b as b FROM t2
      ) dt
      WHERE dt.b = t1a
  )

During name resolution of field dt.b (in the where clause) we end
up calling find_field_in_view()/.../create_view_field().
This is responsible for creating a wrapper around the found Item
(Item_field*)`test`.`t2`.`t2b`
While this Item_direct_view_ref representing 'dt.b' is allocated on
Statement (permanent) memory the change is registered to be reversed
at the end of statement execution.  This is odd and contrary to the
permanent nature of this transformation.

Item::exists2in_processor() is called during the preparation in the
first execution.
We transform the query from
select * from t1 where
exists
(
  select `test`.`t2`.`t2b` from
    (
      select `test`.`t2`.`t2a` AS `a`,`test`.`t2`.`t2b` AS `b` from `test`.`t2`
    ) `dt`
    where `test`.`t2`.`t2b` = `test`.`t1`.`t1a`
    limit 1
)

select * from t1 where
`test`.`t1`.`t1a` in
(
  select `test`.`t2`.`t2b` from
    (
      select `test`.`t2`.`t2a` AS `a`,`test`.`t2`.`t2b` AS `b` from `test`.`t2`
    ) `dt`
    where 1
)

later, the optimizer merges the derived table dt into it's parent

select * from t1 where
`test`.`t1`.`t1a` in
(
  select `test`.`t2`.`t2b` from t2 where 1
)

then this is transformed into a semi-join

select t1.* from t1 semi join t2 on t1a = t2b

At the end of the first execution, the item t2b above is reverted to
dt.b.  During the subsequent name resolution of dt.b, it is resolved
t2a, and the semi-join executed corresponds to

select t1.* from t1 semi join t2 on t1a = t2a

causing a different result set.

Initial Author: Igor Babaev
Reformatted and refactored by: Rex Johnston ([email protected])

Add assert to ensure Item_direct_view_refs are not allocated on
the 2nd execution.
Marko Mäkelä
MDEV-39344: fetch_data_into_cache() clears "is_truncated"

There is a memory limit implemented for the INFORMATION_SCHEMA tables
innodb_trx, innodb_locks, innodb_lock_waits. The predicate
trx_i_s_cache_is_truncated() would never hold in
trx_i_s_common_fill_table() due to a logic bug that had been
introduced in a refactoring.

fetch_data_into_cache(): Shrink the critical section of lock_sys.latch
and do not unconditionally reset cache->is_truncated when leaving the
function. This fixes a correctness regression that had been introduced
back in 2007 by commit 5cbf4e3840491c2d80928641bc0fbb8135e9c201
for the InnoDB Plugin for MySQL 5.1, which later became
the built-in InnoDB in MySQL 5.5 and MariaDB Server 5.5.

Reviewed by: Sergey Vojtovich
Sergei Golubchik
MDEV-39657 ASAN error on malformed WKB point

check data length for Gis_point
Thirunarayanan Balathandayuthapani
MDEV-39706  Assertion `!thd || !coordinator_thd' failed

Problem:
========
  - This assert was introduced in commit
0152c617e80ccf3f33d3ea4b50c17d5f588613b1 (MDEV-39261), which sets
coordinator_thd in clone_oldest_view() and resets it to nullptr in
batch_cleanup() at the end of the batch.
When innodb_trx_purge_view_update_only_debug is enabled, InnoDB fail
to reset coordinator_thd. As a result, InnoDB fails with assert in
next batch

Solution:
========
trx_purge(): Reset coordinator_thd to nullptr when
innodb_trx_purge_view_update_only_debug is enabled.
Dave Gosselin
MDEV-39397: Document and clean up dump_leaf_key

Add a docblock for dump_leaf_key that describes each parameter
and the leaf payload layout, and documents the return values and
side effects.

Sprinkle inline comments through the body to explain the LIMIT and
OFFSET bookkeeping, the dual purpose of result_finalized, why
borrowing table->record[1] as scratch space is safe, the offset
translation for skipped null bytes, and why the blob_storage
truncation flag is cleared after raising ER_CUT_VALUE_GROUP_CONCAT.

Implement other code cleanups, too, like dropping the unused tmp2
String object and rename old_length to starting_len so the cut_max_length
call reads more directly.  Other changes include narrowing loop
variables to the loop scope, move declarations next to their
first use, and replacing the C casts with static_cast.

There should be no behavior changes at this commit.
Marko Mäkelä
MDEV-39344: Fix a TOCTOU race

trx_i_s_possibly_fetch_data_into_cache(): Fetch into the cache and
return whether the cache was truncated. Previously, we checked this
flag without holding any latch.

trx_i_s_cache_start_write(), trx_i_s_cache_end_write(),
trx_i_s_cache_is_truncated(): Remove. These are now part of
trx_i_s_possibly_fetch_data_into_cache().

trx_i_s_cache: Remove. The singleton cache object can be a static object
with no pointer indirection.
Sergei Golubchik
MDEV-39622 OBJECT_INSTANCE_BEGIN in P_S are unstable, difficult to compare

let's show stable values that don't change between runs
Oleksandr Byelkin
Merge branch '10.6' into 10.11
Daniel Black
MDEV-36344: UBSAN DsMrr_impl::dsmrr_init on null ptr

Under SQL_SELECT::test_quick_select there isn't
a mrr buffer. The TRP_RANGE.mrr_buf_size is explictly
sets its size to 0 in get_best_index_intersect.

Rather than hit undefined behaviour in what
eventually results in full_buf being nullptr,
jump the case and go directly to use_default_impl.