1. 16 Sep, 2022 1 commit
    • Marko Mäkelä's avatar
      MDEV-29555 ASAN heap-buffer-overflow in mariabackup.huge_lsn,strict_full_crc32 · 593fdee3
      Marko Mäkelä authored
      recv_scan_log(): Do not dereference the first byte of the log record
      before recv_sys.parse_pmem() (or recv_sys_t::parse_mtr()) returns OK.
      
      In the case of the failure that was analyzed, we had
      recv_sys.offset == recv_sys.len and recv_sys_t::parse_mtr() would return
      PREMATURE_EOF. This would lead us to reading more data and parsing again.
      
      When a memory-mapped interface to the log is being used, that is,
      log_sys.is_pmem() holds, recv_sys.offset cannot point past the
      end of the memory-mapped log_sys.buf[]. This is guaranteed by
      log_sys.calc_lsn_offset().
      
      Thanks to Nayuta Yanagisawa for providing a core dump for analysis.
      593fdee3
  2. 13 Sep, 2022 3 commits
  3. 12 Sep, 2022 2 commits
  4. 09 Sep, 2022 1 commit
    • Andrei's avatar
      MDEV-24660 MYSQL_BIN_LOG::cleanup(): Assertion `b->xid_count == 0' · bc12478a
      Andrei authored
      The shutdown time assert was caused by untimely deactivation of
      the binlog background thread and related structs destruction.
      It could specifically occur when a transaction is replication unsafe
      and has to be completed with a ROLLBACK event in binlog.
      
      This gets fixed with the binlog background thread stop relocation
      to a point and user transactions have been completed.
      A test case is added to binlog.binlog_checkpoint which
      also receives as a bonus a minor correction to reactivate a MDEV-4322 test
      case that originally required a shutdown phase (that ceased to do).
      bc12478a
  5. 08 Sep, 2022 5 commits
    • Nayuta Yanagisawa's avatar
      Merge 10.7 into 10.8 · d95ffd3d
      Nayuta Yanagisawa authored
      d95ffd3d
    • Nayuta Yanagisawa's avatar
      Merge 10.6 into 10.7 · 31334351
      Nayuta Yanagisawa authored
      31334351
    • Nayuta Yanagisawa's avatar
    • Marko Mäkelä's avatar
      MDEV-29440 InnoDB instant ALTER TABLE recovery must use READ UNCOMMITTED · d2e649ae
      Marko Mäkelä authored
      In commit 8f8ba758 (MDEV-27234)
      the data dictionary recovery was changed to use READ COMMITTED
      so that table-rebuild operations (OPTIMIZE TABLE, TRUNCATE TABLE,
      some forms of ALTER TABLE) would be recovered correctly.
      
      However, for operations that avoid a table rebuild thanks to
      being able to instantly ADD, DROP or reorder columns, recovery
      must use the READ UNCOMMITTED isolation level so that changes to
      the hidden metadata record can be rolled back.
      
      We will detect instant operations by detecting uncommitted changes
      to SYS_COLUMNS in case there is no uncommitted change of SYS_TABLES.ID
      for the table. In any table-rebuilding DDL operation, the SYS_TABLES.ID
      (and likely also the table name) will be updated.
      
      As part of rolling back the instant ALTER TABLE operation, after the
      operation on the hidden metadata record has been rolled back, a rollback
      of an INSERT into SYS_COLUMNS in row_undo_ins_remove_clust_rec() will
      invoke trx_t::evict_table() to discard the READ UNCOMMITTED definition
      of the table. After that, subsequent recovery steps will load and use
      the correct table definition.
      
      Reviewed by: Thirunarayanan Balathandayuthapani
      Tested by: Matthias Leich
      d2e649ae
    • Vlad Lesin's avatar
      MDEV-29433 innodb.lock_delete_updated is unstable · 0fa4dd07
      Vlad Lesin authored
      Use suspend thread syncpoint instead of include/wait_condition.inc to
      make sure DELETE created waiting lock before the next UPDATE begins
      locking.
      0fa4dd07
  6. 07 Sep, 2022 14 commits
  7. 06 Sep, 2022 6 commits
  8. 05 Sep, 2022 7 commits
    • Daniel Black's avatar
      MDEV-29443: prevent uring access to galera sst /notify scripts · fd8dbe0d
      Daniel Black authored
      The resources like uring in MariaDB aren't intended for spawned
      processes so we restrict access using the io_uring_ring_dontfork
      liburing library call.
      fd8dbe0d
    • Jan Lindström's avatar
      Merge 10.7 into 10.8 · dee24f31
      Jan Lindström authored
      dee24f31
    • Jan Lindström's avatar
      Merge 10.6 into 10.7 · 5fdbb3a7
      Jan Lindström authored
      5fdbb3a7
    • Jan Lindström's avatar
      Merge 10.5 into 10.6 · 9fefd440
      Jan Lindström authored
      9fefd440
    • Jan Lindström's avatar
      Merge 10.4 into 10.5 · ba987a46
      Jan Lindström authored
      ba987a46
    • Marko Mäkelä's avatar
      Merge 10.5 into 10.6 · 3c7887a8
      Marko Mäkelä authored
      3c7887a8
    • Marko Mäkelä's avatar
      MDEV-29438 Recovery or backup of instant ALTER TABLE is incorrect · 244fdc43
      Marko Mäkelä authored
      This bug was found in MariaDB Server 10.6 thanks to the
      OPT_PAGE_CHECKSUM record that was implemented
      in commit 4179f93d for catching
      this type of recovery failures.
      
      page_cur_insert_rec_low(): If the previous record is the page infimum,
      correctly limit the end of the record. We do not want to copy data from
      the header of the page supremum. This omission caused the incorrect
      recovery of DB_TRX_ID in an instant ALTER TABLE metadata record, because
      part of the DB_TRX_ID was incorrectly copied from the n_owned of the
      page supremum, which in recovery would be updated after the copying,
      but in normal operation would already have been updated at the time the
      common prefix was being determined.
      
      log_phys_t::apply(): If a data page is found to be corrupted, do not
      flag the log corrupted but instead return a new status APPLIED_CORRUPTED
      so that the caller may discard all log for this page. We do not want
      the recovery of unrelated pages to fail in recv_recover_page().
      
      No test case is included, because the known test case would only work
      in 10.6, and even after this fix, it would trigger another bug in
      instant ALTER TABLE crash recovery.
      244fdc43
  9. 03 Sep, 2022 1 commit