Commit graph

203,393 commits

Author SHA1 Message Date
Monty
ffb9f88fcc MDEV-38683 SIGSEGV (dbg), SIGABRT or ER_EMPTY_QUERY when using ROWS EXAMINED with log_output=TABLE
The bug was that thd->lex->limit_rows_examined_cnt was not reset after
queries. It is reset in lex_start() at the start of the next query
execution.
This causes general_log_write(), which is called before lex_start(), to
exceed the limit. The effect is a crash or the next query would not be
executed.

Fixed by resetting limit_rows_examined_cnt at end of query.
2026-02-04 14:37:36 +02:00
Marko Mäkelä
0f29955349 Merge 10.11 into 11.4 2026-02-04 13:41:52 +02:00
Marko Mäkelä
5b4ee2840a MDEV-25039 fixup: cmake -DPLUGIN_PERFSCHEMA=NO 2026-02-04 13:10:48 +02:00
Marko Mäkelä
771c704058 MDEV-38748: Merge recv_recovery_read_checkpoint() to srv_start() 2026-02-04 11:36:42 +02:00
Marko Mäkelä
4152ee12ea MDEV-38730 innodb_log_file_mmap=ON does not work on AMD64, ARMv8, POWER
log_mmap(): If the MAP_SYNC|MAP_SHARED_VALIDATE operation (PMEM)
failed and the path is not in /dev/shm (which we treat as PMEM),
proceed to try regular MAP_SHARED read-only mapping. This allows
somewhat more efficient crash recovery, basically with an I/O
buffer that is not limited by innodb_log_buffer_size.

Reviewed by: Thirunarayanan Balathandayuthapani
2026-02-04 10:15:05 +02:00
Jan Lindström
81cf4fc4d6 MDEV-38399 : Galera test failure on galera_fk_truncate
Make sure that auto_increment_increment and auto_increment_offset
values are what test expects.
2026-02-03 15:19:33 +02:00
Alexander Barkov
ae5c8bfe76 MDEV-38698 mysql_upgrade does not fix charset and collation for mysql.user
In case if the view mysql.user was created (e.g. in 10.6) with a
pre- 18edb0959f server with an unexpected
character_set_client or collation_connection, e.g.
utf8mb3 and utf8mb3_general_ci, mysql_upgrade did not fix it to the
expected latin1 and latin1_swedish_ci.

Since 11.8 this could often lead to "Illegax mix of collations" errors
when querying mysql.user, because since 11.8 the default collation for
utf8mb3 is utf8mb3_uca1400_ai_ci, according to the default
@@character_set_collations. For consistency, it's better to fix the
problem starting from 11.4.

For example:

MariaDB [test]> select user,host,is_role from
    -> mysql.user where is_role='N';
ERROR 1267 (HY000): Illegal mix of collations (utf8mb3_general_ci,COERCIBLE)
                    and (utf8mb3_uca1400_ai_ci,COERCIBLE) for operation '='

Fixing mariadb_system_tables_fix.sql to drop the view if it has non-standard
character set or collations, so it gets recreated again correctly by
the CREATE statement in mariadb_system_tables.sql
2026-02-02 09:42:23 +04:00
Sergei Golubchik
054a893f16 Merge branch '10.11' into 11.4 mariadb-11.4.10 2026-01-31 11:45:10 +01:00
Brandon Nesterenko
3218602d31 MDEV-25039: MDL BF-BF conflict because of foreign key mariadb-10.11.16
Fix rpl suite tests added by MDEV-25039.

rpl_foreign_key_lock_table_insert.test is removed altogether because it
is unclear what the purpose of the test is. The changes of the patch
were done on the slave, yet all operations in the test were done on the
master. Nothing different could happen on the slave because it is
configured to be serial, so all transactions would run sequentially
anyway, and no validations were performed.

rpl_foreign_key_ddl_insert.test was renamed to
rpl_row_foreign_key_mdl.test and the test itself was re-written to be
a minimal test case to ensure that MDL locking behavior is different
pre- and post- patch. A few problems with the original test:
 * No foreign-key locking was done on the slave because the table
   engine was not InnoDB.
 * rpl_fk_ddl.inc had inconsistent validation checking. I.e., the child
   query validation checks were done on the master (which is incorrect)
   and because the slave was configured to be serial, the two
   transactions could not run concurrently on the slave anyway.
2026-01-31 11:42:12 +01:00
Hemant Dangi
d5db6c1daa MDL BF-BF conflict on ALTER and INSERT with multi-level foreign key parents
Issue:
On galera write node INSERT statements does not acquire MDL locks on it's all child
tables and thereby wsrep certification keys are also added for limited tables, but
on applier nodes it does acquire MDL locks for all child tables. This can result
into MDL BF-BF conflict on applier node when transactions referring to parent and
child tables are executed concurrently. For example:

Tables with foreign keys: t1<-t2<-t3<-t4
Conflicting transactions: INSERT t1 and DROP TABLE t4

Wsrep certification keys taken on write node:
- for INSERT t1: t1 and t2
- for DROP TABLE t4: t4

On applier node MDL BF-BF conflict happened between two transaction because
MDL locks on t1, t2, t3 and t4 were taken for INSERT t1, which conflicted
with MDL lock on t4 taken by DROP TABLE t4.
The Wsrep certification keys helps in resolving this MDL BF-BF conflict by
prioritizing and scheduling concurrent transactions. But to generate Wsrep
certification keys it needs to open and take MDL locks on all the child tables.

On applier nodes Write_rows event is implicitly a REPLACE, deleting all conflicting
rows which can cause cascading FK actions and locks on foreign key children tables.

Solution:
For Galera applier nodes the Write_rows event is considered pure INSERT
which will never cause cascading FK actions and locks on foreign key children tables.
2026-01-31 11:42:12 +01:00
Sergei Golubchik
4802bfe4f9 MDEV-38710 Assertion is_lock_owner on error returning from auto-create in mysql_admin_table
don't auto-add new partitions if we're already at TIMESTAMP_MAX_VALUE
2026-01-31 11:42:12 +01:00
Sergei Golubchik
a2b62fe572 MDEV-38246 aria_read index failed on encrypted database during backup
Skip an all-zero pages in the index file.
They can happen normally if the ma_checkpoint_background
thread flushes some later page first (e.g. page 50 before page 48).

Also:
* don't do alloca() in a loop
* correct the check in ma_crypt_index_post_read_hook(),
  the page can be completely full
* compilation failure in ma_open.c:1289:
  comparison is always false due to limited range of data type
2026-01-31 11:41:23 +01:00
Monty
a9e353e84f MDEV-38246 aria_read index failed on encrypted database during backup
The backup of encrypted Aria tables was not supported.
Added support for this. One complication is that the page checksum is
for the not encrypted page. To be able to verify the checksum I have to
temporarly decrypt the page.
In the backup we store the encrypted pages.

Other things:
- Fixed some (not critical) memory leaks in mariabackup
2026-01-29 20:53:42 +01:00
Sergei Golubchik
40f7084661 Merge branch '10.11' into 11.4 2026-01-28 21:52:18 +01:00
Sergei Golubchik
b29d3779e4 Merge branch '10.6' into 10.11 2026-01-28 14:22:20 +01:00
Marko Mäkelä
7614f8fb5d MDEV-38589: SELECT unnecessarily waits for log write
The design of "binlog group commit" involves carrying some state across
transaction boundaries. This includes trx_t::commit_lsn, which keeps track
of how much write-ahead log needs to be written. Unfortunately, this
field was not reset in a commit where a log write was elided. That would
cause an unnecessary wait in a subsequent read-only transaction that
happened to reuse the same transaction object.

trx_deregister_from_2pc(): Reset trx->commit_lsn so that
an earlier write that was executed in the same client connection
will not result in an unnecessary wait during a subsequent read
operation.

trx_commit_complete_for_mysql(): Unless we are inside a binlog
group commit, reset trx->commit_lsn.

unlock_and_close_files(): Reset trx->commit_lsn after durably
writing the log, and remove a redundant log write call from some
callers.

trx_t::rollback_finish(): Clear commit_lsn, because a rolled-back
transaction will not need to be durably written.

trx_t::clear_and_free(): Wrapper function to suppress a debug check
in trx_t::free().

Also, remove some redundant ut_ad(!trx->will_lock) that will be checked
in trx_t::free().

Reviewed by: Vladislav Vaintroub
2026-01-28 13:24:09 +02:00
Yuchen Pei
8070033e47
MDEV-36230 Fix SERVER port field bound check
The Port field in the system table mysql.servers has type INT,
which translates to Field_long.

During parsing it is parsed as ulong_num, and in this patch we add
bound checks there.
2026-01-28 16:23:05 +11:00
Sergei Golubchik
05e6c9d42d MDEV-32317 fix the test for --view mariadb-10.6.25 2026-01-27 22:41:09 +01:00
bsrikanth-mariadb
6f2a99589b MDEV-35815: use-after-poison_in_get_hash_symbol
In find_field_in_view(), we call field_it.create_item() which
creates item on a statement mem_root.
Then we set its name. Make sure the name is allocated on a statement
mem_root, too.
2026-01-27 22:17:41 +02:00
Aleksey Midenkov
eba938f9eb MDEV-37275 Cannot remove default value of NOT NULL column
Run-time has semantics duplication in unireg_check, default_value and
flags, so all three must be in sync before FRM creation. Special
unireg_check values for temporal field types was introduced by
32b28f9298 WL#1266 "Separate auto-set logic from TIMESTAMP type."
2026-01-27 19:02:16 +03:00
Aleksey Midenkov
8906e6a214 MDEV-32317 ref_ptrs exhaust on multiple ORDER by func from winfunc
Each ORDER and WHERE slot may generate split, see code like this:

  if ((item->with_sum_func() && item->type() != Item::SUM_FUNC_ITEM) ||
    item->with_window_func())
  item->split_sum_func(thd, ref_ptrs, all_fields, SPLIT_SUM_SELECT);

Such kind of code is done in JOIN::prepare(), setup_order(),
setup_fields(), setup_group() and split_sum_func2() itself.

Since we are at the phase of ref_ptrs allocation, items are not fixed
yet and we cannot calculate precisely how much ref_ptrs is needed. We
can estimate at most how much is needed. In the worst case each window
function generates split on each ORDER BY field, GROUP BY field and
WHERE field, so the counts of these should be multiplied by window
funcs count.

As the split can be done in both setup_without_group() and
JOIN::prepare() simultaneously, the factor of window funcs should be
multiplied by 2.

The similar case may be with inner sumfunc items as of the condition

  item->with_sum_func() && item->type() != Item::SUM_FUNC_ITEM

but factor of these is harder to predict at the stage of unfixed
items.
2026-01-27 16:19:46 +01:00
bsrikanth-mariadb
dc28140c89 MDEV-31255: Crash with fulltext search subquery in explain delete/update
ft_handler isn't getting initialized for subqueries inside explain
delete/update queries. However, ft_handler is accessed inside ha_ft_read(),
and is the reason for NULL pointer exception.
This is not the case with non-explain delete/update queries, as
well as explain/non-explain select queries.

Follow the approach the SELECT statements are using in
JOIN::optimize_constant_subqueries(): remove SELECT_DESCRIBE
flag when invoking optimization of constant subqueries.

Single-table UPDATE/DELETEs have SELECT_LEX but don't have JOIN.
So, we make optimize_constant_subqueries() not to be a member
of JOIN class, and instead move it to SELECT_LEX, and then
invoke it from single-table UPDATE/DELETE as well as for SELECT queries.
2026-01-27 16:42:41 +05:30
Thirunarayanan Balathandayuthapani
5b6ad325d2 MDEV-38667 Assertion in diagnostics area on DDL stats timeout
Reason:
======
 During InnoDB DDL, statistics updation fails due to lock wait
timeout and calls push_warning_printf() to generate warnings
but then returns success, causing the SQL layer
to attempt calling set_ok_status() when the diagnostics area
is already set.

Solution:
=========
By temporarily setting abort_on_warning to false around operations
that prevents warning to error escalation and restore the original
setting after calling HA_EXTRA_END_ALTER_COPY for alter operation.
2026-01-27 13:51:32 +05:30
Sergei Golubchik
12578d8a69 MDEV-38604 fix SP execution too 2026-01-26 23:15:34 +01:00
Rucha Deodhar
ca39e66060 MDEV-38620: Server crashes in setup_returning_fields upon 2nd execution
of multi-table-styled DELETE from a view

Analysis:
The item_list of builtin_select stores the fields that are there in the
RETURNING clause.
During the "EXECUTE" command, a "dummy item" is added into the item_list
of the select_lex(builtin_select) representing DELETE during
Sql_cmd_delete::precheck(). This snippet that adds a dummy item is added
because columnstore needs for temporary table. Results are put into a
temporary table and to create a temporary table we need to know what
columns are there which we get from the select_lex->item_list.
As a result, the item_list now has an item even when there is not really
RETURNING clause, resulting in execution of the setup_returning_fields()
when it should have exited already.

Fix:
Instead of checking whether builint_select's item_list is empty to
determine whether there is RETURNING clause, use a flag.
2026-01-26 23:32:38 +05:30
Yuchen Pei
2c2a418591 MDEV-38327 Do not use rowid filter in ref_to_range when the range method is index merge
Index merge and rowid filter should not be used together, however,
even if index merge is not chosen earlier in best_access_path, it may
be chosen again in make_join_select, inside ref_to_range. Therefore
this patch ensures that rowid filter is not used when index merge is
chosen there.
2026-01-26 14:50:23 +02:00
Yuchen Pei
6229192647 MDEV-38327 Minor optimizer comment cleanups and refactoring
factor out common index merge checks of quick select types
2026-01-26 14:50:23 +02:00
Oleksandr Byelkin
308ed52fb0 columnstore 25.10.3 2026-01-26 13:36:39 +01:00
Marko Mäkelä
9f28e7be59 MDEV-23298 fixup: have_perfschema.inc 2026-01-26 12:23:49 +02:00
Sergei Golubchik
c0acc3cc8f MDEV-38209 REFERENCES permission on particular schema is sometimes ignored
some I_S tables require "any non-SELECT privilege on the table".
If only SELECT was granted on the global level and something non-SELECT
on the schema level, then we need to check schema level privileges
explicitly, because check_grant() doesn't do that and get_all_tables()
doesn't look deeper if SELECT is present on the global level.
2026-01-26 10:01:31 +01:00
Sergei Golubchik
7b9d3a4df6 MDEV-38654 Assertion `str[strlen(str)-1] != '\n'' failed upon federated discovery error
relax the assert, allowing '\n' at the end if the string is exactly
MYSQL_ERRMSG_SIZE-1 bytes long. It likely doesn't end with '\n' but
was truncated at the middle.

also, use MYSQL_ERRMSG_SIZE in my_error.c not a separate define
that must be "kept in sync"
2026-01-26 10:01:31 +01:00
Sergei Golubchik
d7702e0b0f MDEV-37481 empty value inserted if BEFORE trigger and ENUM NOT NULL field
must use field->make_empty_rec_reset() for resetting a field
to its type default value. ENUM is historically weird.
2026-01-26 10:01:31 +01:00
Sergei Golubchik
387de3d5b8 cleanup: remove unused argument 2026-01-26 10:01:31 +01:00
Sergei Golubchik
ac49387199 MDEV-37506 Assertion if FLUSH PRIVILEGES is interrupted in --skip-grant-tables
* fail acl_load() if it was killed, this will cause all privileges to
  be reset to their original pre-load values.
* only increment grant_version if privileges were, in fact, updated
2026-01-26 10:01:31 +01:00
Sergei Golubchik
71d4cae866 MDEV-37503 UBSAN: downcast Item_func_plus to Item_field invalid in sql_prepare.cc:1516
use reinterpret_cast to silence UBSAN.
add a debug check to make sure the wrong value is never used.
2026-01-26 10:01:31 +01:00
Sergei Golubchik
7e14749d96 MDEV-37341 Assertion failures null_ptr < ptr' and ptr - null_ptr <= (int)table->s->rec_buff_length' with BEFORE trigger and UPDATE
in SIMULTANEOUS_ASSIGNMENT there is no need to switch value items
to new nullable copies of table Field's - they must refer to old
values in the row, which can never be null anyway.

skipping this redundant step simplifies moving field to record[1]
and back in fill_record()
2026-01-26 10:01:31 +01:00
Sergei Golubchik
b930eef317 MDEV-37326 Assertion failure upon update on versioned partitioned table with long unique under READ COMMITTED
if ha_partition::position() is asked for a position of a closed partition,
don't ask the underlying engine, just set the partition number.

in fact, the partition is open and can be perfectly used, the assert
is over-zealous. but in the future it might be actually closed.
2026-01-26 10:01:31 +01:00
Sergei Golubchik
387fe5ecc3 MDEV-36787 Error 153: No savepoint with that name upon ROLLBACK TO SAVEPOINT, assertion failure
1. InnoDB should return HA_ERR_ROLLBACK if it aborts a transaction internally
2. the server should recognize it and perform an automatic rollback
2026-01-26 10:01:31 +01:00
Sergei Golubchik
d08fd6343e MDEV-38506 fix the test
followup for 11f228cbb2
2026-01-26 10:01:31 +01:00
Daniel Black
5688678ff4 MDEV-37615: Clang based static analysis false postive reports on UNINIT_VAR
Clang upstream bug https://github.com/llvm/llvm-project/issues/173210
shows that a "int x=x" construct will in the intermediate representation
have code to read from x. With this generated sanitizer=undefined and
static analyzers will all see the uninitialized read and write.

Because clang has a stronger implementation of following paths to
uninitialized variables, "#define UNINIT_VAR(x) x" is the which
is what our release binaries use is the ideal path for this compiler.

Clang based compilers with error during compilation if any
uninitialized behaviour is detected at compile time because of
0c80ddb519.

Corrects MDEV-36542 - 6fd57f478f.
2026-01-25 12:59:56 +11:00
Sergey Vojtovich
4b81180589 MDEV-38076 - main.mdev375 fails sporadically
Test was affected by incompletely closed preceding connections.

Wait for preceding connections to decrement Threads_connected
before testing ER_CON_COUNT_ERROR condition.
2026-01-23 23:36:56 +04:00
Sergey Vojtovich
b5dbf22657 MDEV-38471 - funcs_1.processlist_val_no_prot fails sporadically
Test output was affected by incompletely closed preceding connections.

Wait for connections to leave I_S.PROCESSLIST before issuing
SHOW PROCESSLIST.

Also fixes similar failures in funcs_1.processlist_val_ps.
2026-01-23 20:49:53 +04:00
gkodinov
76fc1861ca MDEV-38642: Missing Null terminator in the definition of mysqldump's --system typelib
There was a missing NULL element terminator for --system's type
library definition.

This was causing a crash in find_type_eol when e.g. an incomplete
value was passed to --system where it keeps iterating until it
 finds the NULL as a typelib element.

Fixed by appending a NullS to the definition.
Test case added.
2026-01-23 15:27:56 +01:00
Sergei Golubchik
b6d0e23d76 MDEV-38365 SHA2 auth plugin crash on large packets
use my_safe_alloca() as the key_len comes directly from the client

Reported by Pavel Kohout, Aisle Research, www.aisle.com
2026-01-23 14:31:12 +01:00
Sergei Golubchik
4ff94f212d MDEV-38532 followup
include private server headers into libmariadbd-dev,
where plugin server headers already were.
Not in libmariadb-dev. It's different from RPMs, but
RPMs don't have a dedicated embedded devel package.
2026-01-23 14:31:12 +01:00
Aleksey Midenkov
b68f878fdc MDEV-36876 Crash during the Item_subselect::init - outer_select is NULL
Comparison between vector and scalar is invalid (ER_OPERAND_COLUMNS)
and handled by the parser. The problem is outer_context is missing
because relink_hack() cannot recover it due to
!builtin_select.first_inner_unit() condition. This condition was set
by previous relink hack called for previous expression some(select 1).

Since there can be arbitrary number of such expressions there seems to
be no point in such a limitation. MTR test do not fail without that
condition, so the fix proposes to remove it.
2026-01-23 14:48:57 +03:00
Aleksey Midenkov
6fcd87ba4d MDEV-33985 Server crashes at Item_func_nextval::val_int
Pure aliases are not handled properly by Item_func_nextval::val_int().

add_table_to_list() does not create MDL request for pure aliases,
i.e. when there is no table_list->db set or TL_OPTION_ALIAS was
set. When the expression is not inside CTE the case with empty db is
handled by:

  else if (!lex->with_cte_resolution && lex->copy_db_to(&db))
    DBUG_RETURN(0);

So, table_list gets current database name and the query is failed with
ER_NO_SUCH_TABLE error.

The fix adds the case of is_pure_alias() for
Item_func_nextval::val_int() and fails it with ER_NOT_SEQUENCE2 error.

Note: semantics for TL_OPTION_ALIAS cannot be based on empty db, only
parser can set TL_OPTION_ALIAS as resolve_references_to_cte() relies
on TL_OPTION_ALIAS after copy_db_to().
2026-01-23 14:48:24 +03:00
Aleksey Midenkov
5597f877fe MDEV-33289 INTERVAL partitioning by system time does not work close to the end of timestamp range
1. Fix empty part_elem->id in prep_alter_part_table().

   On auto-create newly added partition has id 0. It came from
   set_up_default_partitions() for new part_info
   (thd->work_part_info). vers_update_el_ids() can work only with
   unassigned ids (UINT_MAX32), so we assign it explicitly on pushing
   into tab_part_info.

2. If range value is out of TIMESTAMP_MAX_VALUE set it to
   TIMESTAMP_MAX_VALUE, but only if the history partition is the last
   one, otherwise push ER_DATA_OUT_OF_RANGE. Error is to create
   multiple out-of-range partitions (e.g. with PARTITIONS clause in
   CREATE TABLE).
2026-01-23 14:42:25 +03:00
Aleksey Midenkov
3b07a44a23 MDEV-32724 Segmentation fault due to Deep Recursion in table.cc and sql_lex.cc
Recursive CTE wrongly detected anchor because inner non-recursive CTE
wrongly assigned with-element table to itself due to inner-outer name
clash.
2026-01-23 14:40:42 +03:00
Aleksey Midenkov
7a88776dc1 MDEV-28650 Server crashes in Item_func_nextval::val_int after select from view
default_used was missing as view is parsed on its own
lex. extend_table_list() decides maybe_need_prelocking based on
default_used and prelocking_strategy->handle_table() was skipped for
view, so internal_tables was not updated (they could be stale from
previous statement).
2026-01-23 14:25:06 +03:00