Merge branch '10.11' into 11.4

client/mysqltest.cc

@@ -10895,7 +10895,7 @@ void append_stmt_result(DYNAMIC_STRING *ds, MYSQL_STMT *stmt,
   my_bind= (MYSQL_BIND*) my_malloc(PSI_NOT_INSTRUMENTED, num_fields * sizeof(MYSQL_BIND),
                                    MYF(MY_WME|MY_FAE|MY_ZEROFILL));
   length= (ulong*) my_malloc(PSI_NOT_INSTRUMENTED, num_fields * sizeof(ulong),
-                             MYF(MY_WME|MY_FAE));
+                             MYF(MY_WME|MY_FAE|MY_ZEROFILL));
   is_null= (my_bool*) my_malloc(PSI_NOT_INSTRUMENTED, num_fields * sizeof(my_bool),
                                 MYF(MY_WME|MY_FAE));
 

cmake/pcre.cmake

@@ -65,8 +65,8 @@ MACRO(BUNDLE_PCRE2)
   ExternalProject_Add(
     pcre2
     PREFIX   "${dir}"
-    URL "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.47/pcre2-10.47.zip"
-    URL_MD5 7906aec38f872b74f1b925122dde9069
+    URL "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.49/pcre2-10.49.zip"
+    URL_MD5 11e0345ad037d7b3f9342aa3251ac4a7
     INSTALL_COMMAND ""
     CMAKE_ARGS
       "-DCMAKE_WARN_DEPRECATED=FALSE"

extra/wolfssl/CMakeLists.txt

@@ -99,6 +99,7 @@ if(WOLFSSL_INTELASM)
   if(MSVC_INTEL)
     target_sources(wolfssl PRIVATE
       ${WOLFCRYPT_SRCDIR}/aes_asm.asm
+      ${WOLFCRYPT_SRCDIR}/aes_x86_64_asm.asm
       ${WOLFCRYPT_SRCDIR}/aes_gcm_asm.asm
       ${WOLFCRYPT_SRCDIR}/sp_x86_64_asm.asm
     )
@@ -110,6 +111,7 @@ if(WOLFSSL_INTELASM)
     set(USE_INTEL_SPEEDUP 1)
     target_sources(wolfssl PRIVATE
       ${WOLFCRYPT_SRCDIR}/aes_asm.S
+      ${WOLFCRYPT_SRCDIR}/aes_x86_64_asm.S
       ${WOLFCRYPT_SRCDIR}/aes_gcm_asm.S
       ${WOLFCRYPT_SRCDIR}/chacha_asm.S
       ${WOLFCRYPT_SRCDIR}/poly1305_asm.S
@@ -119,7 +121,8 @@ if(WOLFSSL_INTELASM)
     )
     target_compile_options(wolfssl PRIVATE -maes -msse4.2 -mpclmul)
     # Workaround 5.5.4 bug (user_settings.h not included into aes_asm.S)
-    set_property(SOURCE ${WOLFCRYPT_SRCDIR}/aes_asm.S APPEND PROPERTY COMPILE_OPTIONS "-DWOLFSSL_X86_64_BUILD")
+    set_property(SOURCE ${WOLFCRYPT_SRCDIR}/aes_asm.S
+      ${WOLFCRYPT_SRCDIR}/aes_x86_64_asm.S APPEND PROPERTY COMPILE_OPTIONS "-DWOLFSSL_X86_64_BUILD")
   endif()
 endif()
 

mysql-test/main/charset_client_win_utf8mb4.test

@@ -13,9 +13,18 @@ if(!`select $MTR_PARALLEL = 1`)
 # This is important for backward compatibility
 
 # Emulate creating password in an interactive client session, with older clients
-# which communicates with the server using with something like cp850
+# which communicates with the server using with something like cp850.
+# Do not use chcp: the console codepage is shared by all parallel mtr workers.
+# 0x81 is 'ü' in cp850.
 
-exec chcp 850 > NUL && echo CREATE USER 'u' IDENTIFIED by 'ü' | $MYSQL --default-character-set=cp850;
+--perl
+open(F, '>', "$ENV{MYSQL_TMP_DIR}/create_user_cp850.sql") or die;
+binmode F;
+print F "CREATE USER 'u' IDENTIFIED BY '\x81';\n";
+close F;
+EOF
+--exec $MYSQL --default-character-set=cp850 < $MYSQL_TMP_DIR/create_user_cp850.sql
+--remove_file $MYSQL_TMP_DIR/create_user_cp850.sql
 
 
 # Can't connect with UTF8

mysql-test/main/func_time.result

@@ -6443,4 +6443,10 @@ Warning	1292	Incorrect time value: '9430886' for column `test`.`t1`.`c2` at row
 Warning	1292	Incorrect time value: '9430816' for column `test`.`t1`.`c1` at row 2
 Warning	1292	Incorrect time value: '9430816' for column `test`.`t1`.`c2` at row 2
 drop table t1;
+#
+# MDEV-40616: MSAN - use-of-uninitialized-value in extract_date_time()
+#
+DO STR_TO_DATE(1, '%#');
+DO STR_TO_DATE(LOWER('q'), '%@');
+DO STR_TO_DATE(LOWER('.'), '%.');
 # End of 10.11 tests

mysql-test/main/func_time.test

@@ -3287,4 +3287,12 @@ insert into t1 values (9430886, 9430886), (9430816, 9430816);
 select cast(c1 as time), cast(c2 as time) from t1;
 drop table t1;
 
+--echo #
+--echo # MDEV-40616: MSAN - use-of-uninitialized-value in extract_date_time()
+--echo #
+
+DO STR_TO_DATE(1, '%#');
+DO STR_TO_DATE(LOWER('q'), '%@');
+DO STR_TO_DATE(LOWER('.'), '%.');
+
 --echo # End of 10.11 tests

mysql-test/main/view_grant.result

@@ -2093,3 +2093,43 @@ drop user 'root
 definer_host=localhost
 suid=1'@localhost;
 # End of 10.6 tests
+#
+# MDEV-22374: VIEW with security definer require FILE privilege from
+# definer not invoker in case of INTO OUTFILE
+#
+create user test@localhost;
+grant select on test.* to test@localhost;
+create table t1 (a int);
+insert into t1 values (1),(2);
+create definer=test@localhost sql security definer view v1 as select * from t1;
+# FILE privilege should be checked for the invoker, not the view definer
+select * into outfile 'MYSQLTEST_VARDIR/tmp/mdev22374.txt' from t1;
+select * from v1;
+a
+1
+2
+select * into outfile 'MYSQLTEST_VARDIR/tmp/mdev22374.txt' from (select count(*) from v1) as dv1;
+select * into outfile 'MYSQLTEST_VARDIR/tmp/mdev22374.txt' from (select * from v1) as dv1;
+select * into outfile 'MYSQLTEST_VARDIR/tmp/mdev22374.txt' from v1;
+drop view v1;
+# Invoker without FILE privilege can not use the definer's one
+create definer=root@localhost sql security definer view v1 as select * from t1;
+connect con1, localhost, test;
+select * into outfile 'MYSQLTEST_VARDIR/tmp/mdev22374.txt' from t1;
+ERROR 42000: Access denied; you need (at least one of) the FILE privilege(s) for this operation
+select * from v1;
+a
+1
+2
+select * into outfile 'MYSQLTEST_VARDIR/tmp/mdev22374.txt' from (select count(*) from v1) as dv1;
+ERROR 42000: Access denied; you need (at least one of) the FILE privilege(s) for this operation
+select * into outfile 'MYSQLTEST_VARDIR/tmp/mdev22374.txt' from (select * from v1) as dv1;
+ERROR 42000: Access denied; you need (at least one of) the FILE privilege(s) for this operation
+select * into outfile 'MYSQLTEST_VARDIR/tmp/mdev22374.txt' from v1;
+ERROR 42000: Access denied; you need (at least one of) the FILE privilege(s) for this operation
+disconnect con1;
+connection default;
+drop view v1;
+drop table t1;
+drop user test@localhost;
+# End of 10.11 tests

mysql-test/main/view_grant.test

@@ -2347,5 +2347,57 @@ suid=1'@localhost;
 
 --echo # End of 10.6 tests
 
+--echo #
+--echo # MDEV-22374: VIEW with security definer require FILE privilege from
+--echo # definer not invoker in case of INTO OUTFILE
+--echo #
+
+create user test@localhost;
+grant select on test.* to test@localhost;
+create table t1 (a int);
+insert into t1 values (1),(2);
+create definer=test@localhost sql security definer view v1 as select * from t1;
+
+--echo # FILE privilege should be checked for the invoker, not the view definer
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+--eval select * into outfile '$MYSQLTEST_VARDIR/tmp/mdev22374.txt' from t1
+--remove_file $MYSQLTEST_VARDIR/tmp/mdev22374.txt
+select * from v1;
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+--eval select * into outfile '$MYSQLTEST_VARDIR/tmp/mdev22374.txt' from (select count(*) from v1) as dv1
+--remove_file $MYSQLTEST_VARDIR/tmp/mdev22374.txt
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+--eval select * into outfile '$MYSQLTEST_VARDIR/tmp/mdev22374.txt' from (select * from v1) as dv1
+--remove_file $MYSQLTEST_VARDIR/tmp/mdev22374.txt
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+--eval select * into outfile '$MYSQLTEST_VARDIR/tmp/mdev22374.txt' from v1
+--remove_file $MYSQLTEST_VARDIR/tmp/mdev22374.txt
+drop view v1;
+
+--echo # Invoker without FILE privilege can not use the definer's one
+create definer=root@localhost sql security definer view v1 as select * from t1;
+connect con1, localhost, test;
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+--error ER_SPECIFIC_ACCESS_DENIED_ERROR
+--eval select * into outfile '$MYSQLTEST_VARDIR/tmp/mdev22374.txt' from t1
+select * from v1;
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+--error ER_SPECIFIC_ACCESS_DENIED_ERROR
+--eval select * into outfile '$MYSQLTEST_VARDIR/tmp/mdev22374.txt' from (select count(*) from v1) as dv1
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+--error ER_SPECIFIC_ACCESS_DENIED_ERROR
+--eval select * into outfile '$MYSQLTEST_VARDIR/tmp/mdev22374.txt' from (select * from v1) as dv1
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+--error ER_SPECIFIC_ACCESS_DENIED_ERROR
+--eval select * into outfile '$MYSQLTEST_VARDIR/tmp/mdev22374.txt' from v1
+disconnect con1;
+connection default;
+
+drop view v1;
+drop table t1;
+drop user test@localhost;
+
+--echo # End of 10.11 tests
+
 # Wait till we reached the initial number of concurrent sessions
 --source include/wait_until_count_sessions.inc

mysql-test/suite/galera/r/MDEV-40727.result

@@ -0,0 +1,42 @@
+connection node_2;
+connection node_1;
+connection node_1;
+connection node_2;
+# Take node_2 down first: a per-table DATA/INDEX DIRECTORY names an
+# absolute host path, and mtr runs both nodes on the same host, so
+# creating the tables while node_2 is a live cluster member would
+# replicate the same CREATE TABLE to node_2 and make it race node_1
+# for the same external path. Node_2 must only ever receive these
+# tables as SST-transferred files, not as replicated DDL.
+connection node_2;
+connection node_1;
+CALL mtr.add_suppression("InnoDB: File .* was not found");
+CREATE TABLE t_aria (f1 INT PRIMARY KEY, f2 VARCHAR(100))
+ENGINE=Aria
+DATA DIRECTORY='MYSQLTEST_VARDIR/tmp/MDEV-40727_aria_data'
+     INDEX DIRECTORY='MYSQLTEST_VARDIR/tmp/MDEV-40727_aria_index';
+CREATE TABLE t_innodb (f1 INT PRIMARY KEY, f2 VARCHAR(100))
+ENGINE=InnoDB
+DATA DIRECTORY='MYSQLTEST_VARDIR/tmp/MDEV-40727_innodb_data';
+INSERT INTO t_aria VALUES (1, 'aria_row_1'), (2, 'aria_row_2');
+INSERT INTO t_innodb VALUES (1, 'innodb_row_1'), (2, 'innodb_row_2');
+# Clean node_2's data directory so that a restart forces a full SST.
+connection node_2;
+SET SESSION wsrep_sync_wait = 15;
+# Check that every table in database test, not only t_aria and
+# t_innodb, has identical content on node_2 after the SST.
+connection node_1;
+connection node_2;
+connection node_1;
+connection node_2;
+connection node_1;
+connection node_2;
+connection node_2;
+# Confirm the donor's rsync SST script flushed the filesystems
+# holding the Aria and InnoDB per-table directories, not only the
+# data directory itself.
+FOUND 1 /Synced filesystem: MYSQLTEST_VARDIR/tmp/MDEV-40727_aria_data/ in mysqld.1.err
+FOUND 1 /Synced filesystem: MYSQLTEST_VARDIR/tmp/MDEV-40727_aria_index/ in mysqld.1.err
+FOUND 1 /Synced filesystem: MYSQLTEST_VARDIR/tmp/MDEV-40727_innodb_data/test/ in mysqld.1.err
+connection node_1;
+DROP TABLE t_aria, t_innodb;

mysql-test/suite/galera/t/MDEV-40727.cnf

@@ -0,0 +1,10 @@
+!include ../galera_2nodes.cnf
+
+[mysqld]
+wsrep_sst_method=rsync
+
+[mysqld.1]
+wsrep_provider_options='repl.causal_read_timeout=PT90S;base_port=@mysqld.1.#galera_port;evs.suspect_timeout=PT10S;evs.inactive_timeout=PT30S;evs.install_timeout=PT15S;pc.wait_prim_timeout=PT60S;gcache.size=10M'
+
+[mysqld.2]
+wsrep_provider_options='repl.causal_read_timeout=PT90S;base_port=@mysqld.2.#galera_port;evs.suspect_timeout=PT10S;evs.inactive_timeout=PT30S;evs.install_timeout=PT15S;pc.wait_prim_timeout=PT60S;gcache.size=10M'

mysql-test/suite/galera/t/MDEV-40727.test

@@ -0,0 +1,142 @@
+--source include/big_test.inc
+--source include/galera_cluster.inc
+--source include/have_innodb.inc
+--source include/have_aria.inc
+
+#
+# MDEV-40727 rsync SST donor stalls in a whole-host sync()
+#
+# The rsync SST donor flushes, to disk, every filesystem that the
+# transfer reads from, before the transfer starts. That flush must
+# also reach a filesystem holding a table placed outside the data
+# directory by a per-table DATA DIRECTORY or INDEX DIRECTORY option.
+# MyISAM and Aria place an OS symlink to the table file one level
+# below the database directory; InnoDB instead leaves a small '.isl'
+# file next to the tablespace, holding the real path as plain text -
+# no OS symlink at all. This test forces a full SST and checks the
+# donor's log for both cases.
+#
+# The per-database-directory transfer also needs to dereference these
+# symlinks (--copy-links, not --links): the rsync daemon on the joiner
+# cannot recreate an absolute symlink target as-is, so a MyISAM or
+# Aria table placed by DATA DIRECTORY or INDEX DIRECTORY would
+# otherwise come out unreadable after every rsync SST. This test
+# checksums every table in database test on both nodes after the SST
+# to check that all of them, not only t_aria and t_innodb, transferred
+# with identical content.
+#
+
+--let $aria_data_dir = $MYSQLTEST_VARDIR/tmp/MDEV-40727_aria_data
+--let $aria_index_dir = $MYSQLTEST_VARDIR/tmp/MDEV-40727_aria_index
+--let $innodb_data_dir = $MYSQLTEST_VARDIR/tmp/MDEV-40727_innodb_data
+
+--let $node_1=node_1
+--let $node_2=node_2
+--source include/auto_increment_offset_save.inc
+
+--echo # Take node_2 down first: a per-table DATA/INDEX DIRECTORY names an
+--echo # absolute host path, and mtr runs both nodes on the same host, so
+--echo # creating the tables while node_2 is a live cluster member would
+--echo # replicate the same CREATE TABLE to node_2 and make it race node_1
+--echo # for the same external path. Node_2 must only ever receive these
+--echo # tables as SST-transferred files, not as replicated DDL.
+
+--connection node_2
+--source include/shutdown_mysqld.inc
+
+--connection node_1
+--let $wait_condition = SELECT VARIABLE_VALUE = 1 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_cluster_size'
+--source include/wait_condition.inc
+
+# Dropping a table whose tablespace lives under a per-table DATA
+# DIRECTORY logs this message; it is not a query failure.
+CALL mtr.add_suppression("InnoDB: File .* was not found");
+
+--exec rm -rf $aria_data_dir $aria_index_dir $innodb_data_dir
+--exec mkdir -p $aria_data_dir $aria_index_dir $innodb_data_dir
+
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+eval CREATE TABLE t_aria (f1 INT PRIMARY KEY, f2 VARCHAR(100))
+     ENGINE=Aria
+     DATA DIRECTORY='$aria_data_dir'
+     INDEX DIRECTORY='$aria_index_dir';
+
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+eval CREATE TABLE t_innodb (f1 INT PRIMARY KEY, f2 VARCHAR(100))
+     ENGINE=InnoDB
+     DATA DIRECTORY='$innodb_data_dir';
+
+INSERT INTO t_aria VALUES (1, 'aria_row_1'), (2, 'aria_row_2');
+INSERT INTO t_innodb VALUES (1, 'innodb_row_1'), (2, 'innodb_row_2');
+
+--echo # Clean node_2's data directory so that a restart forces a full SST.
+--remove_files_wildcard $MYSQLTEST_VARDIR/mysqld.2/data/mtr
+--remove_files_wildcard $MYSQLTEST_VARDIR/mysqld.2/data/performance_schema
+--remove_files_wildcard $MYSQLTEST_VARDIR/mysqld.2/data/test
+--remove_files_wildcard $MYSQLTEST_VARDIR/mysqld.2/data/mysql
+--remove_files_wildcard $MYSQLTEST_VARDIR/mysqld.2/data
+
+--connection node_2
+--source include/start_mysqld.inc
+
+--let $wait_condition = SELECT VARIABLE_VALUE = 2 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_cluster_size'
+--source include/wait_condition.inc
+
+SET SESSION wsrep_sync_wait = 15;
+
+--echo # Check that every table in database test, not only t_aria and
+--echo # t_innodb, has identical content on node_2 after the SST.
+
+--connection node_1
+--let $n_tables_node1 = `SELECT COUNT(*) FROM information_schema.tables WHERE table_schema = 'test'`
+
+--connection node_2
+--let $n_tables_node2 = `SELECT COUNT(*) FROM information_schema.tables WHERE table_schema = 'test'`
+
+if ($n_tables_node1 != $n_tables_node2)
+{
+  --die Database test has a different number of tables on node_1 and node_2 after SST
+}
+
+--let $ctr = 1
+while ($ctr <= $n_tables_node1)
+{
+  --connection node_1
+  --let $tbl = query_get_value(SELECT table_name FROM information_schema.tables WHERE table_schema = 'test' ORDER BY table_name, table_name, $ctr)
+  --let $checksum_node1 = query_get_value(CHECKSUM TABLE test.$tbl, Checksum, 1)
+
+  --connection node_2
+  --let $checksum_node2 = query_get_value(CHECKSUM TABLE test.$tbl, Checksum, 1)
+
+  if ($checksum_node1 != $checksum_node2)
+  {
+    --die Table test.$tbl differs between node_1 and node_2 after SST
+  }
+  --inc $ctr
+}
+
+--connection node_2
+
+--echo # Confirm the donor's rsync SST script flushed the filesystems
+--echo # holding the Aria and InnoDB per-table directories, not only the
+--echo # data directory itself.
+
+--let SEARCH_FILE = $MYSQLTEST_VARDIR/log/mysqld.1.err
+--let SEARCH_PATTERN = Synced filesystem: $aria_data_dir
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+--source include/search_pattern_in_file.inc
+
+--let SEARCH_PATTERN = Synced filesystem: $aria_index_dir
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+--source include/search_pattern_in_file.inc
+
+--let SEARCH_PATTERN = Synced filesystem: $innodb_data_dir/test
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+--source include/search_pattern_in_file.inc
+
+--connection node_1
+DROP TABLE t_aria, t_innodb;
+
+--exec rm -rf $aria_data_dir $aria_index_dir $innodb_data_dir
+
+--source include/auto_increment_offset_restore.inc

scripts/wsrep_sst_rsync.sh

@@ -171,11 +171,121 @@ check_pid_and_port()
     check_pid "$pid_file" && [ "$CHECK_PID" -eq "$pid" ]
 }
 
+# Resolves a directory to its physical path, with symlinks expanded.
+# A relative path is interpreted against the data directory, which is
+# how the server itself resolves these options. Prints nothing when the
+# directory cannot be reached.
+resolve_dir()
+{
+    case "$1" in
+    /*) (cd -P "$1" 2>/dev/null && pwd -P) || : ;;
+    *)  (cd -P "$DATA_DIR" 2>/dev/null && \
+         cd -P "$1" 2>/dev/null && pwd -P) || : ;;
+    esac
+}
+
+# Flushes the filesystems that hold the files to be transferred.
+# A bare 'sync' flushes every mounted filesystem on the host and can
+# block for minutes on I/O unrelated to the SST, while the donor holds
+# the global read lock. 'sync -f' is limited to a single filesystem,
+# but it is not available on every platform.
+sync_filesystems()
+{
+    local NL=$'\n'
+    local data_fs candidates synced dir path target isl
+
+    # 'sync -f' (syncfs) is a GNU coreutils extension. The Darwin and
+    # FreeBSD 'sync' ignores its operands, flushes everything and still
+    # exits with zero status, so a functional probe alone cannot detect
+    # it and every call below would become a whole-host sync - worse
+    # than the single sync being replaced. Gate on the platform first.
+    if [ "$OS" != 'Linux' ]; then
+        sync
+        return
+    fi
+
+    # The data directory itself may be a symlink. Resolve it to the
+    # physical path.
+    data_fs=$(resolve_dir "$DATA_DIR")
+    [ -n "$data_fs" ] || data_fs="$DATA_DIR"
+
+    if ! sync -f "$data_fs" 2>/dev/null; then
+        sync
+        return
+    fi
+
+    # The InnoDB and Aria directories are resolved by create_dirs() and
+    # default to the data directory, but each of them may be placed on
+    # a filesystem of its own, and the transfer reads from all of them.
+    # Binlogs may likewise reside elsewhere: a relative binlog path is
+    # taken relative to the data directory, but it can still escape it
+    # or be a mount point of its own.
+    candidates="$ib_home_dir$NL$ib_log_dir$NL$ib_undo_dir$NL$ar_log_dir"
+    candidates="$candidates$NL$binlog_dir$NL"
+
+    # Database directories may be symlinks to other filesystems, and so
+    # may an individual table file placed one level deeper by a
+    # per-table DATA DIRECTORY or INDEX DIRECTORY (MyISAM, Aria). The
+    # transfer follows both, so flush them as well.
+    candidates="$candidates$(find "$data_fs" -mindepth 1 -maxdepth 2 \
+                                  -type l 2>/dev/null || :)$NL"
+
+    # InnoDB's per-table DATA DIRECTORY does not create an OS symlink:
+    # it leaves a small '.isl' file next to the tablespace, holding the
+    # real file's path as plain text. Flush the filesystem it names too.
+    while IFS= read -r isl; do
+        [ -n "$isl" ] || continue
+        target=$(sed -e '1q' -e 's/[[:space:]]*$//' "$isl" 2>/dev/null) || continue
+        [ -n "$target" ] || continue
+        candidates="$candidates$(dirname "$target")$NL"
+    done <<< "$(find "$data_fs" -mindepth 2 -maxdepth 2 -type f \
+                     -name '*.isl' 2>/dev/null || :)"
+
+    # Paths already flushed, newline delimited on both sides so that a
+    # membership test cannot match a partial path component.
+    synced="$NL$data_fs$NL"
+
+    while IFS= read -r dir; do
+        [ -n "$dir" ] || continue
+        if [ -L "$dir" ]; then
+            # readlink -f gives the physical path whether the link
+            # points to a directory (a symlinked database directory)
+            # or to a file (a symlinked per-table data/index file);
+            # 'cd -P', which resolve_dir() relies on, only works for
+            # the former.
+            target=$(readlink -f "$dir" 2>/dev/null) || continue
+            [ -e "$target" ] || continue
+            if [ -d "$target" ]; then
+                path=$target
+            else
+                path=$(dirname "$target")
+            fi
+        else
+            # resolve_dir() prints nothing unless the path is a
+            # reachable directory, so it doubles as the existence
+            # check. Testing $dir directly would resolve a relative
+            # path against the current directory rather than against
+            # the data directory.
+            path=$(resolve_dir "$dir")
+        fi
+        [ -n "$path" ] || continue
+        case "$synced" in
+        *"$NL$path$NL"*) continue ;;
+        esac
+        sync -f "$path" || :
+        wsrep_log_info "Synced filesystem: $path"
+        synced="$synced$path$NL"
+    done <<< "$candidates"
+}
+
 get_binlog
 
 if [ -n "$WSREP_SST_OPT_BINLOG" ]; then
     binlog_dir=$(dirname "$WSREP_SST_OPT_BINLOG")
     binlog_base=$(basename "$WSREP_SST_OPT_BINLOG")
+else
+    binlog_dir=""
+    binlog_base=""
 fi
 
 BINLOG_TAR_FILE="$DATA_DIR/wsrep_sst_binlog.tar"
@@ -383,7 +493,7 @@ EOF
         STATE=$(cat "$FLUSHED")
         rm "$FLUSHED"
 
-        sync
+        sync_filesystems
 
         wsrep_log_info "Tables flushed"
 
@@ -621,11 +731,19 @@ FILTER="-f '- /lost+found'
         findopt='-L'
         [ "$OS" = 'FreeBSD' ] && findopt="$findopt -E"
 
+        # --copy-links, not --links: a per-table DATA DIRECTORY or INDEX
+        # DIRECTORY (MyISAM, Aria) places a real OS symlink here, and
+        # the rsync daemon on the joiner cannot recreate an absolute
+        # symlink target as-is (with 'use chroot = no', it either
+        # rewrites the target into a dangling '/rsyncd-munged/...'
+        # path, or, with symlink munging turned off, still drops the
+        # target's leading '/'). Dereferencing the symlink and copying
+        # the file it points to avoids depending on either behavior.
         find $findopt . -maxdepth 1 -mindepth 1 -type d -not -name 'lost+found' \
              -not -name '.zfs' -not -name .snapshot -print0 \
              | xargs -I{} -0 -P $backup_threads \
              rsync ${STUNNEL:+--rsh="$STUNNEL"} \
-             --owner --group --perms --links --specials --ignore-times \
+             --owner --group --perms --copy-links --specials --ignore-times \
              --inplace --recursive --delete --quiet $WHOLE_FILE_OPT \
              -f '- $ib_home_dir/ib_lru_dump' \
              -f '- $ib_home_dir/ibdata*' \

sql/item_timefunc.cc

@@ -337,15 +337,15 @@ static bool extract_date_time(THD *thd, DATE_TIME_FORMAT *format,
 
         /* Conversion specifiers that match classes of characters */
       case '.':
-	while (my_ispunct(cs, *val) && val != val_end)
+	while (val < val_end && my_ispunct(cs, *val))
 	  val++;
 	break;
       case '@':
-	while (my_isalpha(cs, *val) && val != val_end)
+	while (val < val_end && my_isalpha(cs, *val))
 	  val++;
 	break;
       case '#':
-	while (my_isdigit(cs, *val) && val != val_end)
+	while (val < val_end && my_isdigit(cs, *val))
 	  val++;
 	break;
       default:

sql/mysqld.cc

@@ -6045,6 +6045,7 @@ int mysqld_main(int argc, char **argv)
   my_report_svc_status(SERVICE_START_PENDING, NO_ERROR, slow_start_timeout);
 #endif
 
+  vio_check_ssl_init();
   if (init_server_components())
     unireg_abort(1);
 

win/packaging/heidisql.cmake

@@ -1,4 +1,4 @@
-SET(HEIDISQL_VERSION "12.20")
+SET(HEIDISQL_VERSION "12.21")
 SET(HEIDISQL_BASE_NAME "HeidiSQL_${HEIDISQL_VERSION}_64_Portable")
 SET(HEIDISQL_ZIP "${HEIDISQL_BASE_NAME}.zip")
 SET(HEIDISQL_URL "https://github.com/HeidiSQL/HeidiSQL/releases/download/v${HEIDISQL_VERSION}/${HEIDISQL_ZIP}")
@@ -7,7 +7,7 @@ SET(HEIDISQL_DOWNLOAD_DIR ${THIRD_PARTY_DOWNLOAD_LOCATION}/${HEIDISQL_BASE_NAME}
 MAKE_DIRECTORY(${HEIDISQL_DOWNLOAD_DIR})
 MESSAGE(STATUS "Downloading ${HEIDISQL_URL} to ${HEIDISQL_DOWNLOAD_DIR}/${HEIDISQL_ZIP}")
 FILE(DOWNLOAD ${HEIDISQL_URL} ${HEIDISQL_DOWNLOAD_DIR}/${HEIDISQL_ZIP} TIMEOUT 300
-  SHOW_PROGRESS EXPECTED_HASH SHA256=d84742736e4508c206c28c58018bbd934319c941dc9d68ff4673737a3f4df731)
+  SHOW_PROGRESS EXPECTED_HASH SHA256=fecb76a69e29a53ea05b1d57fc2f7b7aaed5b8f889556c6eca545e2a800df1ab)
 EXECUTE_PROCESS(COMMAND ${CMAKE_COMMAND} -E chdir ${HEIDISQL_DOWNLOAD_DIR}
   ${CMAKE_COMMAND} -E tar xfz ${HEIDISQL_DOWNLOAD_DIR}/${HEIDISQL_ZIP})