Console View

Categories: connectors experimental galera main

Legend:

Passed

Failed

Warnings

Failed Again

Running

Exception

Offline

No data

connectors

experimental

galera

main

f9cc1a94235a...

f9cc1a94235ad83c16b85eaa9d9997853054478d

bsrikanth-mariadb

srikanth.bondalapati@mariadb.com

MDEV-39405: store the necessary plugin-engines optimizer costs

store the necessary plugin-engines optimizer costs that are used by the query
into the context, so that the replay server uses the same while computing
query cost

e7d1202da30b...

e7d1202da30b7707185dc9b55af4693d1e3e4f60

Sergei Golubchik

serg@mariadb.org

Merge branch '11.4' into 11.8

e69fadc959eb...

e69fadc959eb32f1f200e495947f784fd7f4c82b

Sergei Golubchik

serg@mariadb.org

MDEV-39581 dynamic column header missing sanity checks

e4bdee5a0d68...

e4bdee5a0d681b96073d0c005109058f0979ee34

Daniel Black

daniel@mariadb.org

MDEV-36453 UBSAN: main.mysqltest - runtime error: null pointer

..passed as argument 2, which is declared to never be null
(dynstr_append_mem).

dynstr_append_mem, uses memcpy to append to the string which in the glibc
library is declared to not take null string as the src. Defensively we
declare dynstr_append_mem to not take a null argument too.

mariadb-test, to prevent it calling dynstr_append_mem with a null
mtr variable value, one that hasn't been initialized, we return an
error if the value is null. The result of this is the $6 in the test
case is never assigned a value and would error.

With this resolved, strchr, if the string isn't found, a null pointer is
returned. UBSAN will complain both about incrementing a pointer beyond
the boundary, and also incrementing if it is null.

d37e50c6d04c...

d37e50c6d04c7c27362f1668ae86fa592b94fb23

Oleksandr Byelkin

sanja@mariadb.com

fix long name on view protocol

d0501281ecb0...

d0501281ecb025b0d3ccf72b2d7e3e9473705f35

Sergei Golubchik

serg@mariadb.org

MDEV-39481 ASAN error on malformed WKB polygon

let's make is difficult for wkb and len to desync

cd6fa4b310af...

cd6fa4b310afe9dfd50c1e16223e7d23d31f8b54

Sergei Golubchik

serg@mariadb.org

MDEV-39564 One-byte OOB write in PROXY protocol v1 header parser

cbf32fbe82cb...

cbf32fbe82cbbf95fc43aaebc617f9d970192d25

Jan Lindström

jan.lindstrom@mariadb.com

MDEV-39662 : Wrong results sent to client after BF abort

This issue is regression caused by MDEV-38019 Send ok packet
to client earlier.

BF aborts may be detected very late in command exectution,
somewhere near the end of do_command(). If the ok packet has
already been sent and BF abort is detected very late, this
could cause the protocol packets becoming out of sync.

This is a result of reverting order of releasing MDL and
sending ok packet to the client. If it happens in the
opposite order than before, there will remain some time
window where the select is complete and MDL locks still
held. DROP hits that time window, causing a BF abort,
and extra error packet gets injected into client-server
communication stream.

Fixed by not sending ok packet to client earlier
in wsrep case.

There is a repeatable test case that shows failure
if ok packet is sent client earlier by using
debug sync point. However, this fix skips sending ok
packet earlier causing also skipping the sync
point. Therefore, test case is not usable.

Test case galera_sr.mysql-wsrep-features#8 was failing
because of this regression but it is sporadic.

Co-Authored by : Teemu Ollakka <[email protected]>

c674a323bd90...

c674a323bd907ca58b72995a294cd4169e31b884

sjaakola

seppo.jaakola@mariadb.com

trigger ci

bedacb3eeb94...

bedacb3eeb94a04e35633580f8423c010338bc34

Oleksandr Byelkin

sanja@mariadb.com

new CC 3.3

b74f39db60f7...

b74f39db60f79a22f0f1d614d30565fea8e70c76

Daniel Black

daniel@mariadb.org

MDEV-35545 UBSAN Gis_geometry_collection::init_from_opresult

From the UBSAN error:

sql/spatial.cc:3364:10: runtime error: applying non-zero offset 1 to null pointer

In Gis_geometry_collection::init_from_opresult, a pointer argument
was being treated as a counter for the Special case of
GEOMETRYCOLLECTION EMPTY. The memory location was never accessed.

Rather than use points to count and return a difference at the end, the
code is replace to use g_len_total as a counter. This gets a 1 value for
the GEOMETRYCOLLECTION EMPTY case and no ointer undefined behaviours
occur.

As other init_from_opresult functions return uint both g_len and
result use that type.

b66db0f23bd2...

b66db0f23bd253bfdcd8f475b017d49f36d05d9f

Marko Mäkelä

marko.makela@mariadb.com

MDEV-32115: Log checkpoint race with wsrep_sst_method=rsync

Galera snapshot transfer (SST) using the default wsrep_sst_method=rsync
is prone to creating corrupted snapshots. The probability for this is
rather low and might only affect installations that include
ENGINE=InnoDB tables that contain FULLTEXT INDEX.

The function sst_disable_innodb_writes() aims to disable all InnoDB writes
during the time a snapshot transfer (SST) is in progress using the
default wsrep_sst_method=rsync.

The logic based on invoking log_make_checkpoint() almost works, except
for two things: We failed to ensure that fts_optimize_callback() has
stopped executing, and we did not block updates of the log checkpoint
header.

log_checkpoint_low(): Assert that writes to the log are allowed.

buf_flush_page_cleaner(): Do not try to advance the checkpoint while
wsrep_sst_method=rsync is in progress. This prevents the assertion
in log_checkpoint_low() from failing.

fts_optimize_pause(), fts_optimize_resume(): Pause and resume the
fts_optimize_callback().

sst_disable_innodb_writes(): Disable all background writers
before initiating the log checkpoint.

fts_optimize_callback(): Assert that wsrep_sst_method=rsync is not
active, and remove the previous incorrect attempt at fixing this race.

b49416476797...

b494164767979072713fdeccc175ce3b3f5b1983

Oleksandr Byelkin

sanja@mariadb.com

Merge branch '11.8' into 11.8 release

b067340c34cb...

b067340c34cb9cd481cace18717f6afc66226209

Oleksandr Byelkin

sanja@mariadb.com

Fix after merge test (default charset changed)

a89c10421d6f...

a89c10421d6f443c090b80ea47c855f0235661c7

Oleksandr Byelkin

sanja@mariadb.com

Merge branch '11.4' into 11.8

a41072d7d222...

a41072d7d222329c4ced14672d6d02244af5c769

Andrei Elkin

andrei.elkin@pp.inet.fi

MDEV-36025 Parallel slave concurrent BACKUP MDL locking with ongoing backup..

The problem the patch tackles is that the binlogging parallel slave
can expose prepared state of transactions to the backup process.
That is the latter can enroll such transactions, typically waiting for
prior commits - in other words *undecided* (of whether they are going
to commit at all - sic!), into backup image.

The technical possibility of that owes to earlier deadlocks fixes in this area
that made the parallel slave worker to re-acquire its BACKUP MDL within
the wait-for-prior commit phase (which is post- engine prepare) one.

Note the --skip-log-bin or --log-slave-update=OFF parallel slave is
not vulnerable to the exposure of its prepared transactions.

The fixes this patch provides make sure the backup image contains only
transactions that are (binlog-order) committed, while
parallel slave does not deadlock (MDEV-23586).

The principal part of the fixes implements leapfrogging of a waiting
"high-priority" BACKUP MDL by a slave parallel worker which is
exemplified in the following. First mind about notations:

here (as elsewhere in the patch) `Fn` group commit followers
indexed by the gtid seq-no `n`; `F|xyz` indicates the execution
status (timing) of the MDL request. `B` - stands for backup
thread; `Si,Xk` are BACKUP share and exclusive MDL sequenced by
`i,k` that are logical times of the MDL acquisition; The
semi-column separates the granted head of the lock queue from the
waiters.

The queue below is the BACKUP MDL queue.

| which initially is
|
| [Initial Queue State]
| GRANTED ; WAITING QUEUE
| ----------------------------------
| S1(F2) ; X2(B)
|
| Next it receives
| <- Incoming Request: S3(L1)
| the scheduler having the following context
| [Scheduler Evaluation]
| Requestor: L1 (gtid_sub_id = 1)
| Holder : F2 (gtid_sub_id = 2)
| Condition: holder->gtid_sub_id > requestor->gtid_sub_id (2 > 1) -> TRUE!
| Action : ignore_mdl_priority = true. L1 bypasses the waiting X2 lock.
|
| decides where to place it
|
| [Final Queue State]
| GRANTED ; WAITING QUEUE
| ----------------------------------
| S1(F2), S3(L1) ; X2(B)

| so it chooses to team up L1,F2 correctly. Any next S4(F_n), where n > 2
| won't be granted which means F_n will wait for the backup completion.
| Like this
|
| [Final Queue State]
| GRANTED ; WAITING QUEUE
| ----------------------------------
| S1(F2), S3(L1) ; X2(B),S4(F3)

The decision to allow S3 leapfrog X2 requires the current lock holder
F2 to have a greater gtid_sub_id (2 > 1).

To implement this scheduling policy requires the following modifications.

P1 sql/mdl.h
The new method determines whether a BACKUP lock requester is a teammate
of a group that can share the MDL lock and that there exists at least
on granted member of the group.

+MDL_request::bool (*is_teammate_callback)(const THD*, const THD*);

P2. sql/log.cc
dismantling of mdl_context.{release,acquire}_lock() in the parallel worker
wait-for-prior commit

P3. sql/handler.cc

setting the P1 MDL_request::is_teammate_callback to the slave parallel worker
as hint to try acquiring the MDL lock by team membership.

P4. sql/rpl_rli.cc
defines the teammate callback for the parallel slave.

+rpl_group_info::ignore_mdl_priority

P5. sql/handler.cc
Logics of "careful" release of the MDL lock could not be streamlined.
The failed parallel slave worker still has to abide with the former policy of
``` as there is extra replication
book-keeping to be done before rolling back and allowing a conflicting
transaction to continue (MDEV-7458).``` [ha_commit_trans].

For that reason of MDEV-7458 the BACKUP MDL request's memory is now allocated
for the worker in THD::st_transaction::mem_root. Also guards are deployed to not let
the mem-root be be cleaned too early, before the lock gets released. It can be
released fast to follow with transaction->cleanup() for
not failing trx:s.
Failing to commit parallel workers defer that to Relay_log_info::cleanup_context()
from where now ha_rollback_trans() will make it.

Aslo necessary changes are caused by to the gtid implicit statement's design.

1. sql/sql_class.cc
Removed earlier backup-on-parallel-slave bugfixes of MDEV-23586.
The parallel worker does not release anymore BACKUP MDL at its wait-for-prior
commit stage.

2. sql/sql_lex.h, sql/sql_base.cc, sql/rpl_gtid.cc
Has to be introduced
+#define TL_OPTION_GTID_TABLE_SLAVE 64

as a part of a method to find out (see open_table() hunk) at
executing record_gtid() by implicit GTID statement that its
BACKUP MDL lock (however it is necessary - it is not challenged
here) needs the ignore-priority hint. Note this hint applies for granting
a "special" S' share locked not yet the commit time ha_commit_trans()'s
MDL_BACKUP_COMMIT (denoted as S) lock, which is going to be requested later.

Let's exemplify it on the following diagrams, calling S' a sort of
shared lock, compatible with with S of the commit time.

*Without* the teammate hint the request for S'3(F2) at record_gtid() time

S1(F3|wait_for_prior_commit); X2(B) <- S'3(F2|record_gtid)

would end up to wait behind X2

S1; /* waiting */ X2, S'3

and we'd be regress back to hang/deadlock of earlier bugs: F3 would not be
awaken by F2 who is blocked by B.

Tested with extended set of parallel slave with backup scenarios.

This commit must require more and extensive testing and may cause
followup amendments, through review comments as well.

Co-authored-with: [email protected].

9cb70f0220ff...

9cb70f0220ffbd717efd0fb63831aa6f9497199e

Oleksandr Byelkin

sanja@mariadb.com

Merge branch '11.4' into 11.8

97642a1353bb...

97642a1353bb69dc5f1ba2c6c91b4bd26b77386e

Daniel Black

daniel@mariadb.org

MDEV-26814: UBSAN: offset to nullptr in JSON_ARRAY_INSERT

SELECT JSON_ARRAY_INSERT (0,NULL,1); triggered a UBSAN error.
Specification of JSON_ARRAY_INSERT should return NULL if any arguments
are null.

SQL NULL, aka Item_null::val_str will return a nullptr so check this and
then return a NULL value.

902d05a22a75...

902d05a22a754ceb79669c6a9ecb37399282c17a

Rucha Deodhar

rucha.deodhar@mariadb.com

MDEV-39213: json range syntax crash

Analysis:
When json is being parsed, the step decreases without a out-of-bound check
resulting in failure.
Fix:
Before decreasing the step, check if it will result into out of bound.

8f434a13a78f...

8f434a13a78f5c5bfb4cb906e455876a1a172480

Daniel Black

daniel@mariadb.org

MDEV-36451: blackhole float-cast-overflow

As UBSAN error, the attempt of evaluating a best_acess_path in the
optimizer was using -nan as its worst_seeks value. This didn't cast to
an integer for a rows estimate value resulting in the UBSAN error.

The blackhole engine had a worst_seeks derived from read_time (same
value). This was derived in the default handler::scan_time as
stats.data_file_length / stats.block_size expression where both where 0.

Corrected this by giving the default handler::scan_time an implementation
that just returns 0 for the case where stats.block_size was 0, to avoid
returning a NaN values for all storage engines that leave their
stats block_size as 0, including the backhole.

83ba0123af38...

83ba0123af382701cf339f9596f722ec085f1bf8

ayush-jha123

kumarayushjha123@gmail.com

MDEV-38010: Master & relay log info files ignore trailing garbage in numeric lines

This patch fixes an issue where Int_IO_CACHE::from_chars stops parsing at the
first invalid character but fails to consume the remainder of the line. This
caused trailing garbage on a numeric field (like Master_Port) to be interpreted
as the value for the subsequent field.

The fix introduces a strict validation helper is_string_blank_or_empty which
ensures that only whitespace or control characters follow the parsed numeric
value. The init_*_from_file functions now zero-initialize variables, perform
error checking immediately after string conversion, and safely reject files with
trailing garbage.

The test master_info_numeric_validation has been updated to use --move_file
for robust backup and restoration of the master.info file.

821e6c788c01...

821e6c788c01b34579a6b5c2a16229e56a17efb5

Sergei Golubchik

serg@mariadb.org

proxy protocol v2: fix a harmless typo

according to the rfc, the length is 2 bytes,
but the max length is 226 and there's a validity
check for length <= 240.

7efbb0d0b267...

7efbb0d0b267a9548d58574179bac056a173931f

Daniel Black

daniel@mariadb.org

MDEV-38913: pam_mariadb_mtr.so installation path change

This reverts the effect of MDEV-21654 and includes
pam_mariadb_mtr in the mariadb-test-data Deb package.

This allows our CI systems to run tests on the
pam implementation on Debian systems.

As the pam configuration can include a full path,
we've change the installation of the pam module
pam_mariadb_mtr.so to under the /usr/lib*/plugins/test_pam_modules
directory and configured the pam configuration file,
suite/plugins/pam/mariadb_mtr, to include the
full path to pam_mariadb_mtr.so.

7b8ce800968d...

7b8ce800968d97509fa278a635c8fc70c5178e24

Jan Lindström

jan.lindstrom@mariadb.com

Fix test failure on galera_sst_mariabackup_encrypt_with_key_server

Galera mariabackup SST when it fails could also print error like
WSREP_SST: [ERROR] Removing /tmp/tmp.SQCXmWb7TI/mariadb_backup_galera_info file due to signal

Test case intentionally uses parameter that causes mariabacup
SST to fail. Add suppression for message about removing
mariadb_backcup_galera_info file.

773a474f7f1a...

773a474f7f1ab4e19b07e1dc5dca2fa6b7cfddde

Sergei Golubchik

serg@mariadb.org

MDEV-39657 ASAN error on malformed WKB point

check data length for Gis_point

7598e4e95d2c...

7598e4e95d2c7217f09b4c406484e0e52d0a6a24

Oleksandr Byelkin

sanja@mariadb.com

Merge branch '10.11' into 11.4

6f692942eea9...

6f692942eea9525b788489e2df68b7eb9294b818

Sergei Golubchik

serg@mariadb.org

MDEV-39565 missing filename check in mariadb-backup --decompress

check for tablename-safe characters in backed up table files

6b79d98fc000...

6b79d98fc000960f3d64f3ad7791fefbaa102c1d

Alexey Botchkov

holyfoot@askmonty.org

MDEV-39653 AddressSanitizer: heap-use-after-free in my_mb_wc_latin1/../Field_xmltype::store after invalid xml.

The Field_blob::store can affect the 'from' argument so it can't be used
after it.

6828ff7390a6...

6828ff7390a6e46155343be2e8a1443b52b208b5

Oleksandr Byelkin

sanja@mariadb.com

Merge branch '10.6' into 10.11

551c980587fd...

551c980587fd286c43dfbefc5efe35550093d932

Varun Deep Saini

deepsainivarun@gmail.com

MDEV-35548: Fix out-of-bounds array access in json_get_path_start

json_get_path_start() set p->last_step to p->steps - 1, creating a
pointer before the beginning of the steps[] array. This is undefined
behavior flagged by UBSAN as "index -1 out of bounds for type
json_path_step_t[32]".

Use NULL as the sentinel value instead, and check for NULL in
json_get_path_next() rather than comparing against p->steps.

Backport to 10.6 of commit 4f546897b87144f4219094c5a852d766d5a46b74.

Additional test case from Rucha Deodhar

Signed-off-by: Varun Deep Saini <[email protected]>
Signed-off-by: Varun Deep Saini <[email protected]>

4c33c5e48e31...

4c33c5e48e31cdbf8c71a91e121eb65bf6ef285a

Brandon Nesterenko

brandon.nesterenko@mariadb.com

MDEV-39660 Replica Crashes on Malformed Partial_rows_log_event

If the first Partial_rows_log_event in a group provides an
original_event_size that is smaller than the actual size of the
underlying Rows_log_event, the slave will not allocate enough memory
to hold the actual Rows_log_event content, but still try to copy
that much memory, resulting in the slave crashing.

This patch adds validation checking for this condition, and will error
with code ER_PARTIAL_ROWS_LOG_EVENT_BAD_STREAM when detected.

Additionally:

* A new validation is added to ensure that the slave supports
re-constructing the size of the original event on the master (i.e. if
repliating from a 64-bit to a 32-bit system). A new test is added to
show the error message is correct. Note that the error code used here is
ER_OUTOFMEMORY, and that isn't exactly correct; but the actual error
isn't practical enough to warrant its own new error code.

* The error message for ER_PARTIAL_ROWS_LOG_EVENT_BAD_STREAM
is generalized to better support various types of broken streams. The
previous message was hard-coded to be about detecting out-of-sequence
fragments. The new message is updated to allow general "found %s" and
"expected %s" conditions.

Signed-off-by: Brandon Nesterenko <[email protected]>

3d57e8fde2ec...

3d57e8fde2eccb89a6d62527839d7873d5a4569b

Sergei Golubchik

serg@mariadb.org

MDEV-39658 ASAN crash on invalid proxy_protocol_networks value

max_subnet estimate was off by one.

* only allow address with a known family
(trips an assert in addr_matches_subnet())
* adjust max_subnet estimate accordinly

3d2ae78f843e...

3d2ae78f843ed1b5ba715439014aa7bbd1eceaa3

Dave Gosselin

dave.gosselin@mariadb.com

MDEV-39494: UBSAN error on division by zero.

An incorrectly backported test from 11.x revealed an UBSAN error in 10.11, so
fix that problem by preventing a division-by-zero from happening.

Remove the other incorrectly backported tests and relabel the retained test
in terms of the current ticket.

3afab2dc4cb2...

3afab2dc4cb2a4ee1392c7dc705c2bef3d753253

Sergei Golubchik

serg@mariadb.org

MDEV-39673 group_concat ignores max_allowed_packet

GROUP_CONCAT is limited by group_concat_max_len,
but also, as a string function it must respect max_allowed_packet.

Let's introduce THD::gconcat_max_len() helper to simplify checks.

Also:
* make max group_concat_max_len value the same as max max_allowed_packet
* use the same MY_MIN((ulonglong) ..., UINT_MAX32) in
Item_func_json_objectagg as in Item_func_group_concat
* use overflow-safe type for lengths in Item_func_quote
(MAX_MAX_ALLOWED_PACKET is 1G so uint cannot overflow yet, but it's
a fragile assumption)

32327e572bbd...

32327e572bbdfee6a2c2c60b4d37d3d1a0d61e3b

Sergei Golubchik

serg@mariadb.org