1
0
mirror of https://github.com/MariaDB/server.git synced 2025-08-23 03:54:27 +03:00
Commit Graph

28934 Commits

Author SHA1 Message Date
Olav Sandstaa
e7ad5e36d4 Fix for Bug#14636211 WRONG RESULT (EXTRA ROW) ON A FROM SUBQUERY
WITH A VARIABLE AND ORDER BY
        Bug#16035412 MYSQL SERVER 5.5.29 WRONG SORTING USING COMPLEX INDEX
            
This is a fix for a regression introduced by Bug#12667154:
Bug#12667154 attempted to fix a performance problem with subqueries
that did filesort. For doing filesort, the optimizer creates a quick
select object to use when building the sort index. This quick select
object was deleted after the first call to create_sort_index(). Thus,
for queries where the subquery was executed multiple times, the quick
object was only used for the first execution. For all later executions
of the subquery, filesort used a complete table scan for building the
sort index. The fix for Bug#12667154 tried to fix this by not deleting
the quick object after the first execution of create_sort_index() so
that it would be re-used for building the sort index by the following
executions of the subquery.

This regression introduced in Bug#12667154 is that due to not deleting
the quick select object after building the sort index, the quick
object could in some cases be used also during the second phase of the
execution of the subquery instead of using the created sort
index. This caused wrong results to be returned.

The fix for this issue is to delete the reference to the select object
after it has been used in create_sort_index(). In this way the select 
and quick objects will not be available when doing the second phase
of the execution of the select operation. To ensure that the select
object can be re-used for the following executions of the subquery
we make a copy of the select pointer. This is used for restoring the
select object after the select operation is completed.


mysql-test/suite/innodb/r/innodb_mysql.result:
  Changed explain output: The explain now contains "Using where" since we
  have restored the select pointer after doing the filesort operation.
sql/sql_select.cc:
  Change create_sort_index() so that it always sets the pointer to
  the select object to NULL. This is done in order to avoid that the
  select->quick object can be used when execution the main part of
  the select operation.
sql/sql_select.h:
  New member in JOIN_TAB: saved_select. Used by create_sort_index to
  make a backup copy of the select pointer.
2013-01-15 08:52:38 +01:00
Venkatesh Duggirala
ce7e7a99a0 BUG#11753923-SQL THREAD CRASHES ON DISK FULL
Merging fix from mysql-5.1
2013-01-02 18:32:38 +05:30
Venkatesh Duggirala
3932392030 BUG#11753923-SQL THREAD CRASHES ON DISK FULL
Problem:If Disk becomes full while writing into the binlog,
then the server instance hangs till someone frees the space.
After user frees up the disk space, mysql server crashes
with an assert (m_status != DA_EMPTY)

Analysis: wait_for_free_space is being called in an
infinite loop i.e., server instance will hang until
someone frees up the space. So there is no need to
set status bit in diagnostic area.

Fix: Replace my_error/my_printf_error with
sql_print_warning() which prints the warning in error log.

include/my_sys.h:
  Provision to call sql_print_warning from mysys files
mysys/errors.c:
  Replace my_error/my_printf_error with
  sql_print_warning() which prints the warning in error log.
mysys/my_error.c:
  implementation of my_printf_warning
mysys/my_write.c:
  Adding logic to break infinite loop in the simulation
sql/mysqld.cc:
  Provision to call sql_print_warning from mysys files
2013-01-02 16:31:58 +05:30
Venkatesh Duggirala
f7ab14d762 BUG#14726272- BACKPORT FIX FOR BUG 11746142 TO 5.5 AND 5.1
Merging fix from mysql-5.1
2012-12-28 16:21:07 +05:30
Venkatesh Duggirala
ec70b93e7b BUG#14726272- BACKPORT FIX FOR BUG 11746142 TO 5.5 AND 5.1
Details of BUG#11746142: CALLING MYSQLD WHILE ANOTHER 
INSTANCE IS RUNNING, REMOVES PID FILE
Fix: Before removing the pid file, ensure it was created
by the same process, leave it intact otherwise.

sql/mysqld.cc:
  delete_pid_file() introduced, which checks that the pid file
          belongs to the process before removing it
2012-12-28 16:13:48 +05:30
Mattias Jonsson
544f413df9 merge 2012-12-27 02:43:20 +01:00
Mattias Jonsson
6b7182d9a3 Bug#14589559 Post push fix for valgrind warnings. 2012-12-27 02:27:00 +01:00
Chaithra Gopalareddy
0bb3fb3b3d Merge from 5.1 to 5.5 2012-12-26 20:28:10 +05:30
Chaithra Gopalareddy
fa61c0499a Bug#12347040: MEMORY LEAK IN CONVERT_TZ COULD POSSIBLY CAUSE
DOS ATTACKS
      
Problem:
For detailed description, see Bug#42502. This bug is a duplicate
of Bug#42502. The complete fix for Bug#42502 was not made as
proposed. Hence the bug still persists.
      
Fix:
Make the changes as proposed originally for the bugfix of 42502.
Which is to remove the allocation of the memory before we actually
check for any errors.

sql/tztime.cc:
  Remove the double allocation for tz_info
2012-12-26 20:21:19 +05:30
Chaithra Gopalareddy
777ac1990b Merge from 5.1 2012-12-24 06:42:02 +05:30
Chaithra Gopalareddy
259a5a301c Bug#11757005: UNION CONVERTS UNSIGNED MEDIUMINT AND BIGINT
TO SIGNED
Problem:
When we are joining types (of fields) in case of a union, we usually
upgrade the datatypes to the largest present in the query.
In case of mediumint, it is not happening.
Analysis:
When joined with types LONG and LONGLONG, mediumint should get
upgraded to LONG and LONGLONG respectively.
W.r.t the given query, constant '1' will be created as a LONGLONG
internally and SIGNED flag is enabled. As a result, while combining
types for the field, LONGLONG along with MEDIUMINT gets converted
to LONG first. LONG with MEDIUMINT(of the third select) gets converted
to MEDIUMINT. SIGNED FLAG would be that of the first field's.
As a result, the final result would be SIGNED MEDIUMINT.
Fix:
While joining types, MEDIUMINT with LONGLONG and MEDIUMINT with LONG
is converted to LONGLONG and LONG respectively. Also, made some 
changes for FLOAT and DOUBLE.


sql/field.cc:
  Changed merge types for MEDIUMINT.
2012-12-24 06:39:54 +05:30
Roy Lyseng
96c373c51a Bug#15972635: Incorrect results returned in 32 table join with HAVING
The problem is a shift operation that is not 64-bit safe.
The consequence is that used tables information for a join with 32 tables
or more will be incorrect.

Fixed by adding a type cast in Item_sum::update_used_tables().

Also used the opportunity to fix some other potential bugs by adding an
explicit type-cast to an integer in a left-shift operation.
Some of them were quite harmless, but was fixed in order to get the same
signed-ness as the other operand of the operation it was used in.

sql/item_cmpfunc.cc
  Adjusted signed-ness for some integers in left-shift.

sql/item_subselect.cc
  Added type-cast to nesting_map (which is a 32/64 bit type, so
  potential bug for deeply nested queries).

sql/item_sum.cc
  Added type-cast to nesting_map (32/64-bit type) and table_map
  (64-bit type).

sql/opt_range.cc
  Added type-cast to ulonglong (which is a 64-bit type).

sql/sql_base.cc
  Added type-cast to nesting_map (which is a 32/64-bit type).

sql/sql_select.cc
  Added type-cast to nesting_map (32/64-bit type) and key_part_map
  (64-bit type).

sql/strfunc.cc
  Changed type-cast from longlong to ulonglong, to preserve signed-ness.
2012-12-21 09:53:42 +01:00
prabakaran thirumalai
56db769e10 Bug#14627287 THREAD CACHE - BYPASSES PRIVILEGES
merge from 5.1
2012-12-21 11:07:05 +05:30
prabakaran thirumalai
98aaf18bc7 Bug#14627287 THREAD CACHE - BYPASSES PRIVILEGES
Analysis:
When thread cache is enabled, it does not properly initialize
thd->start_utime when a thread is picked from the thread cache.
This breaks the quota management mechanism. 
THD::time_out_user_resource_limits() resets 
m_user_connect->conn_per_hour to 0 based on thd->start_utime

Fix:
Initialize start_utime when cached thread is reused.

Notes:
Enabled back tests which were disabled because of this issue.
2012-12-21 11:04:49 +05:30
Ahmad Abdullateef
b12fe50226 BUG#14727815 - CRASH IN PTHREAD_RWLOCK_WRLOCK/SRW_UNLOCK
IN QUERY CACHE CODE

DESCRIPTION:
MySQL Server crashes sporadically when Query Caching is on and
the server has high contention among clients. 


ANALYSIS :

Scenario 1:
In Query_cache::move_by_type() when handling RESULT or its related blocks,
Write Lock is acquired on its parent Query block. However the next and prev
pointers are cached in local variables before lock acquisition. In an extremely
high contention scenario there exists a possibility that
Query_cache::append_result_data() is operating on the same query block
and as a consequence might append a new Result block to the end of Result
blocks Linked List of the Query. This would manipulate the next, prev pointers
of the Block being processed in move_by_type(), however the local pointers
still point to previous nodes there by causing Data Corruption leading to crash.

Scenario 2:
In Windows SDK "BOOL" is typedefed as "int" and BOOLEAN is typedefed as
"usigned char". The function pointer definition "srw_bool_func" mistakenly uses 
BOOL instead of BOOLEAN thereby virtually making the function 
my_TryAcquireSRWLockExclusive() always succeed because only the LSB of EAX
has the actual result of the call, however due to type mismatch all bytes of EAX
are used for evaluation. Again during high contention scenarios in 
Query_cache::free_old_query() calls try_lock_writing() on a Query, this call 
always succeeds and the query is freed, even though it is used by some other
thread, in this case Query_cache::send_result_to_client() was using it and the
code causes a crash because it accessed free or reallocated memory.

FIX :

Scenario 1:
The next, prev pointers are now accessed only after Lock acquisition in 
Query_cache::move_by_type().

Scenario 2:
In the definition of "srw_bool_func" BOOL has been replaced with "BOOLEAN"
2012-12-18 22:16:12 +05:30
Ahmad Abdullateef
febe03c2db BUG#14727815 - CRASH IN PTHREAD_RWLOCK_WRLOCK/SRW_UNLOCK
IN QUERY CACHE CODE

DESCRIPTION:
MySQL Server crashes sporadically when Query Caching is on and
the server has high contention among clients. 


ANALYSIS :

Scenario 1:
In Query_cache::move_by_type() when handling RESULT or its related blocks,
Write Lock is acquired on its parent Query block. However the next and prev
pointers are cached in local variables before lock acquisition. In an extremely
high contention scenario there exists a possibility that
Query_cache::append_result_data() is operating on the same query block
and as a consequence might append a new Result block to the end of Result
blocks Linked List of the Query. This would manipulate the next, prev pointers
of the Block being processed in move_by_type(), however the local pointers
still point to previous nodes there by causing Data Corruption leading to crash.

FIX :

Scenario 1:
The next, prev pointers are now accessed only after Lock acquisition in 
Query_cache::move_by_type().
2012-12-18 22:12:56 +05:30
Ramil Kalimullin
0fa867fd91 Fix for BUG#15948580 UPDATE_XML() CRASHES THE SERVER.
Problem: tag's buffer overflow leads to a problem.
Fix: bound check added.


sql/item_xmlfunc.cc:
  Fix for BUG#15948580 UPDATE_XML() CRASHES THE SERVER.
  
    - XML tag/attribute level shouldn't exceed MAX_LEVEL as we use a
  static buffer to store them in the MY_XML_USER_DATA.
2012-12-14 13:55:30 +04:00
Ravinder Thakur
2d16c5bd4b bug#11761752: DO NOT ALLOW USE OF ALTERNATE DATA STREAMS ON NTFS FILESYSTEM.
File names with colon are being disallowed because of the Alternate Data 
Stream (ADS) feature of NTFS that could be misused. ADS allows data to be 
written to alternate streams of a normal file. The data in alternate 
streams cannot be seen by normal tools on Windows (explorer, cmd.exe). As 
a result someone can use this feature to hide large amount of data in 
alternate streams and admins will have no easy way of figuring out the 
files that are using that disk space. The fix also disallows ADS in the 
scenarios where file name is passed as some dynamic variable.

An important thing about the fix is that it DOES NOT disallow ADS file 
names if they are not dynamic (i.e. if the file is created by using some 
option that needs local access to the MySQL server, for example error log
file). The reasoning is that if some MySQL option related to files 
requires access to the local machine (it is not dynamic), then user can very 
well create data in ADS by some other means. This fixes only those scenarios 
which can allow users to create data in ADS over the wire.

File names with colon are being disallowed only on Windows. UNIX 
(Linux in particular) supports NTFS, but it will not be a common 
scenario for someone to configure a NTFS file system to store MySQL 
data on Linux.

Changes in file bug11761752-master.opt are needed due to 
bug number 15937938.
2012-12-13 20:33:44 +05:30
Dmitry Lenev
2e10e7c38e Bug #15954872 "MAKE MDL SUBSYSTEM AND TABLE DEFINITION CACHE
ROBUST AGAINST BUGS IN CALLERS".

Both MDL subsystems and Table Definition Cache code assume 
that callers ensure that names of objects passed to them are 
not longer than NAME_LEN bytes. Unfortunately due to bugs in 
callers this assumption might be broken in some cases. As
result we get nasty bugs causing buffer overruns when we
construct MDL key or TDC key from object names.

This patch makes TDC code more robust against such bugs by 
ensuring that we always checking size of result buffer when
constructing TDC keys. This doesn't free its callers from 
ensuring that both db and table names are shorter than 
NAME_LEN bytes. But at least this steps prevents buffer 
overruns in case of bug in caller, replacing them with less 
harmful behavior.

This is 5.1-only version of patch.

This patch introduces new version of create_table_def_key()
helper function which constructs TDC key without risk of
result buffer overrun. Places in code that construct TDC keys 
were changed to use this function.

Also changed rm_temporary_table() and open_new_frm() functions
to avoid use of "unsafe" strmov() and strxmov() functions and 
use safer strnxmov() instead.
2012-12-11 22:00:51 +04:00
Ramil Kalimullin
5c8cfd717e Auto-merge from mysql-5.1. 2012-12-14 14:01:43 +04:00
Ravinder Thakur
e604bb8a03 Merging from 5.1 to 5.5 for bug#11761752 2012-12-13 20:58:09 +05:30
Dmitry Lenev
4235e46ea2 Bug #15954872 "MAKE MDL SUBSYSTEM AND TABLE DEFINITION CACHE
ROBUST AGAINST BUGS IN CALLERS".

Both MDL subsystems and Table Definition Cache code assume
that callers ensure that names of objects passed to them are
not longer than NAME_LEN bytes. Unfortunately due to bugs in
callers this assumption might be broken in some cases. As
result we get nasty bugs causing buffer overruns when we
construct MDL key or TDC key from object names.

This patch makes MDL and TDC code more robust against such
bugs by ensuring that we always checking size of result
buffer when constructing MDL and TDC keys. This doesn't
free its callers from ensuring that both db and table names
are shorter than NAME_LEN bytes. But at least these steps
prevents buffer overruns in case of bug in caller, replacing
them with less harmful behavior.

This is 5.5-only version of patch.

Changed code of MDL_key::mdl_key_init() to take into account
size of buffer for the key.

Introduced new version of create_table_def_key() helper function
which constructs TDC key without risk of result buffer overrun.
Places in code that construct TDC keys were changed to use this
function.

Also changed rm_temporary_table() and open_new_frm() functions
to avoid use of "unsafe" strmov() and strxmov() functions and
use safer strnxmov() instead.
2012-12-11 22:04:30 +04:00
Harin Vadodaria
aec9ca5da4 Bug#15912213: BUFFER OVERFLOW IN ACL_GET()
Description: A very large database name causes buffer
             overflow in functions acl_get() and
             check_grant_db() in sql_acl.cc. It happens
             due to an unguarded string copy operation.
             This puts required sanity checks before
             copying db string to destination buffer.
2012-12-06 16:53:02 +05:30
Dmitry Shulga
54769c281e This patch fixes bug#14729757 - MY_HASH_SEARCH(&XID_CACHE,
XID_STATE->XID.KEY(),
                                XID_STATE->XID.KEY_LENGTH())==0
  
This bug is a regression of bug#11759534 - 51855: RACE CONDITION
                                           IN XA START.
  
The reason for regression is that the changes that fixes the original
bug wasn't merged from mysql-5.1 into mysql-5.5 and mysql-trunk.
Only null-merge was done for the patch changeset.
  
To incorporate lost changes the manual merge have been done.
  
Additionally the call of trans_rolback() was added into trans_xa_start()
in case if xid_cache_insert is failed() after transaction has been started.
If we don't call trans_rollback() we would never reset the flag
SERVER_STATUS_IN_TRANS in THD::server_status and therefore all subsequent
attempts to execute XA START in the connection where the error was occurred
will be failed since thd->in_active_multi_stmt_transaction() will return
the true every time when trans_xa_start is called.
  
The latest changes were absent in patch for mysql-5.1
2012-12-06 15:59:15 +06:00
Gleb Shchepa
46cfbf35f8 Bug #15948123: SERVER WORKS INCORRECT WITH LONG TABLE ALIASES
Post-push cleanup: removal of unneeded assertions.
2012-12-05 20:41:29 +04:00
Dmitry Lenev
db2a045f0e Merged fix for bug #15954896 "SP, MULTI-TABLE DELETE AND LONG ALIAS"
into 5.5 tree.
2012-12-05 19:50:02 +04:00
Dmitry Lenev
095e8271b7 Bug #15954896 "SP, MULTI-TABLE DELETE AND LONG ALIAS".
Using too long table aliases in stored routines might
have caused server crashes.

Code in sp_head::merge_table_list() which is responsible 
for collecting information about tables used in stored
routine was not aware of the fact that table alias might
have arbitrary length. I.e. it assumed that table alias
can't be longer than NAME_LEN bytes and allocated buffer
for a key identifying table accordingly.

This patch fixes the issue by ensuring that we use
dynamically allocated buffer for table key when table
alias is too long. By default stack based buffer is used
in which NAME_LEN bytes are reserved for table alias.
2012-12-05 19:26:56 +04:00
Gleb Shchepa
70cb820e2d Bug #15948123: SERVER WORKS INCORRECT WITH LONG TABLE ALIASES
Code in MDL subsystem assumes that identifiers of objects can't
be longer than NAME_LEN characters. This assumption was broken
when one tried to construct MDL_key based on table alias, which
can have arbitrary length. Since MDL_key's (and MDL locks) are
not really used for table aliases this patch changes code to
not initialize MDL_key object for table list element representing
aliases.
2012-12-05 16:53:33 +04:00
Shivji Kumar Jha
195e731edb BUG#12359942 - REPLICATION TEST FROM ENGINE SUITE RPL_ROW_UNTIL TIMES OUT
bzr merge 5.1->5.5
2012-12-05 10:24:45 +05:30
Shivji Kumar Jha
055cffb4c8 BUG#12359942 - REPLICATION TEST FROM ENGINE SUITE RPL_ROW_UNTIL TIMES OUT
=== Problem ===
      
The test is dependent on binlog positions and checks
to see if the command 'START SLAVE' functions correctly
with the 'UNTIL' clause added to it. The 'UNTIL' clause
is added to specify that the slave should start and run
until the SQL thread reaches a given point in the master
binary log or in the slave relay log.
      
The test uses hard coded values for MASTER_LOG_POS and
RELAY_LOG_POS, instead of extracting it using
query_get_value() function. There is a test
'rpl.rpl_row_until' which does the similar thing but uses 
query_get_value() function to set the values of
MASTER_LOG_POS/ RELAY_LOG_POS. To be precise,
rpl.rpl_row_until is a modified version of
engines/func.rpl_row_until.test.
      
The use of hard coded values may lead the slave to stop at a position
which may differ from the expected position in the binlog file,
an example being the failure of engines/funcs.rpl_row_until in 
mysql-5.1 given as: 
"query 'select * from t2' failed. Table 'test.t2' doesn't exist".
In this case, the slave actually ran a couple of extra commands
as a result of which the slave first deleted the table and then
ran a select query on table, leading to the above mentioned failure.
      
=== Fix ===
    
1) Fixed the code for failure seen in rpl.rpl_row_until.
   This test was also failing although the symptoms of
   failure were different.
2) Copied the contents from rpl.rpl_row_until into
   into engines/funcs.rpl.rpl_row_until.
3) Updated engines/funcs.rpl_row_until.result accordingly.

mysql-test/suite/engines/funcs/r/rpl_row_until.result:
  modified to accomodate the changes in corresponding
  test file.
mysql-test/suite/engines/funcs/t/disabled.def:
  removed from the list of disabled tests.
mysql-test/suite/engines/funcs/t/rpl_row_until.test:
  fixed rpl.rpl_row_until and copied its content to
  engines/funcs.rpl_row_until. The reason being both
  are same tests but rpl.rpl_row_until is an
  updated version.
mysql-test/suite/rpl/t/disabled.def:
  removed from the list of disabled tests.
sql/sql_repl.cc:
  Added a check to catch an improper combination
  of arguements passed to 'START SLAVE UNTIL'. Earlier,
  START SLAVE UNTIL MASTER_LOG_FILE='master-bin.000001',
  MASTER_LOG_POS=561, RELAY_LOG_POS=12;
  passed. It is now detected and an error is reported.
2012-12-05 10:17:53 +05:30
Mattias Jonsson
4148bec151 merge mysql-5.1 -> mysql-5.5 2012-12-01 09:17:56 +01:00
Mattias Jonsson
63b0cbe396 merge of bug#14589559 to mysql-5.5 2012-12-01 09:12:05 +01:00
Mattias Jonsson
b6249e510b merge of bug#14589559 into mysql-5.1 2012-12-01 09:07:03 +01:00
Libing Song
775b5c0269 Auto Merge 2012-12-01 08:06:45 +08:00
Libing Song
bdfc4dc6c6 Bug#11764602 ASSERTION IN
FORMAT_DESCRIPTION_LOG_EVENT::CALC_SERVER_VERSION_SPLIT

Problem: When reading a Format_description_log_event, it supposes MySQL
version is always valid and DBUG_ASSERTION is used check the version number.
However, user may give a wrong binlog offset, even give a faked binary event
which includes an invalid MySQL version. This will cause server crash.

Fix: The assertions are removed and an error will be reported if MySQL
version in Format_description_log_event is invalid.
2012-12-01 08:04:33 +08:00
Mattias Jonsson
17076f8cd3 bug#14589559: ASSERTION `FILE_ENTRY_BUF[2] == 0' FAILED
IN DEACTIVATE_DDL_LOG_ENTRY

Update of comments according to reviewers request.
2012-11-30 16:17:38 +01:00
Shivji Kumar Jha
07ffa9c767 BUG#12359942 - REPLICATION TEST FROM ENGINE SUITE RPL_ROW_UNTIL TIMES OUT
=== Problem ===

The test is dependent on binlog positions and checks
to see if the command 'START SLAVE' functions correctly
with the 'UNTIL' clause added to it. The 'UNTIL' clause
is added to specify that the slave should start and run
until the SQL thread reaches a given point in the master
binary log or in the slave relay log.

The test uses hard coded values for MASTER_LOG_POS and
RELAY_LOG_POS, instead of extracting it using
query_get_value() function. There is a test
'rpl.rpl_row_until' which does the similar thing but uses 
query_get_value() function to set the values of
MASTER_LOG_POS/ RELAY_LOG_POS. To be precise,
rpl.rpl_row_until is a modified version of
engines/func.rpl_row_until.test.

The use of hard coded values may lead the slave to stop at a position
which may differ from the expected position in the binlog file,
an example being the failure of engines/funcs.rpl_row_until in 
mysql-5.1 given as: 
"query 'select * from t2' failed. Table 'test.t2' doesn't exist".
In this case, the slave actually ran a couple of extra commands
as a result of which the slave first deleted the table and then
ran a select query on table, leading to the above mentioned failure.

=== Fix ===

1) Fixed the code for failure seen in rpl.rpl_row_until.
   This test was also failing although the symptoms of
   failure were different.
2) Copied the contents from rpl.rpl_row_until into
   into engines/funcs.rpl.rpl_row_until.
3) Updated engines/funcs.rpl_row_until.result accordingly.

mysql-test/suite/engines/funcs/r/rpl_row_until.result:
  modified to accomodate the changes in corresponding
  test file.
mysql-test/suite/engines/funcs/t/disabled.def:
  removed from the list of disabled tests.
mysql-test/suite/engines/funcs/t/rpl_row_until.test:
  fixed rpl.rpl_row_until and copied its content to
  engines/funcs.rpl_row_until. The reason being both
  are same tests but rpl.rpl_row_until is an
  updated version.
mysql-test/suite/rpl/t/disabled.def:
  removed from the list of disabled tests.
sql/sql_repl.cc:
  Added a check to catch an improper combination
  of arguements passed to 'START SLAVE UNTIL'. Earlier,
  START SLAVE UNTIL MASTER_LOG_FILE='master-bin.000001',
  MASTER_LOG_POS=561, RELAY_LOG_POS=12;
  passed. It is now detected and an error is reported.
2012-11-30 12:12:33 +05:30
Venkatesh Duggirala
fe4fe4e1cc BUG#15888454: SLAVE CRASHES WHEN DML REQUIRES CONVERSION & TABLE HAS
LESS COLUMNS THAN MASTER

Problem:
========
If DML operation requires a converstion at slave and if slave contains
less number of columns than master, slave is crashing.

Fix:
====
When Slave applies any DML operation, it sees if any of the columns 
requires conversion. If yes, it creates conversion table. 
While creating the coversion table, it should look into the actual number 
of columns required to create the table instead of getting the number
of columns from Master (size()). Columns would have dropped or added
at Slave. So the value should be min(columns@master, columns@slave)

sql/rpl_utility.cc:
  loop through only correct number of columns
2012-11-29 17:33:06 +05:30
Harin Vadodaria
c1f9f122d5 Bug#15912213: BUFFER OVERFLOW IN ACL_GET()
Description: A very large database name causes buffer
             overflow in functions acl_get() and
             check_grant_db() in sql_acl.cc. It happens
             due to an unguarded string copy operation.
             This puts required sanity checks before
             copying db string to destination buffer.
2012-11-29 17:23:23 +05:30
Nuno Carvalho
fb313032a6 BUG#15891524: RLI_FAKE MODE IS NOT UNSET AFTER BINLOG REPLAY
When a binlog is replayed into a server, e.g.:
  $ mysqlbinlog binlog.000001 | mysql
it sets a pseudo slave mode on the client connection in order to server
be able to read binlog events, there is, a format description event is
needed to correctly read following events.
Also this pseudo slave mode applies to the current connection
replication rules that are needed to correctly apply binlog events.

If a binlog dump is sourced on a connection, this pseudo slave mode will
remains after it, what will apply unexpected rules from customer
perspective to following commands.

Added a new SET statement to binlog dump that will unset pseudo slave
mode at the end of dump file.
2012-11-20 12:37:23 +00:00
Mattias Jonsson
6147794445 merge 2012-11-16 13:08:07 +01:00
Nuno Carvalho
16c9c14465 BUG#12669186: AUTOINC VALUE PERSISTENCY BREAKS CERTAIN REPLICATION SCENARIOS
When master and slave have different schemas, in particular different
AUTO_INCREMENT columns, INSERT_ID events logged for a given table on
master may be applied to a different table on slave on SBR, e.g.:
  master has one table (t1) with one auto-inc column and another table
  (t2) without auto-inc column, on slave t1 does not have auto-inc
  column (despite having the same columns) and t2 has a auto-inc
  column. The INSERT_ID that is intended for t1, since t1 on slave
  doesn't have auto-inc column is used on t2, causing consistency
  problems.

To fix this incorrect behaviour, auto-inc interval allocation via
INSERT_ID is made effectively terminated at the end of top-level
statements on slave and binlog replay.
2012-11-14 17:17:14 +00:00
Mattias Jonsson
36ac232d6d manual merge of bug#14845133 mysql-5.1 -> mysql-5.5 2012-11-13 14:47:49 +01:00
Mattias Jonsson
b5ff983ab5 Bug#14845133:
The problem is related to the changes made in bug#13025132.
get_partition_set can do dynamic pruning which limits the partitions
to scan even further. This is not accounted for when setting
the correct start of the preallocated record buffer used in
the priority queue, thus leading to wrong buffer is used
(including wrong preset partitioning id, connected to that buffer).

Solution is to fast forward the buffer pointer to point to the correct
partition record buffer.
2012-11-13 09:21:59 +01:00
Mattias Jonsson
2f3baa743d Bug#14845133:
The problem is related to the changes made in bug#13025132.
get_partition_set can do dynamic pruning which limits the partitions
to scan even further. This is not accounted for when setting
the correct start of the preallocated record buffer used in
the priority queue, thus leading to wrong buffer is used
(including wrong preset partitioning id, connected to that buffer).

Solution is to fast forward the buffer pointer to point to the correct
partition record buffer.
2012-11-13 09:21:59 +01:00
Thayumanavar
5345586680 BUG#14458232 - CRASH IN THD_IS_TRANSACTION_ACTIVE DURING
THREAD POOLING STRESS TEST
PROBLEM:
Connection stress tests which consists of concurrent
kill connections interleaved with mysql ping queries
cause the mysqld server which uses thread pool scheduler
to crash.
FIX:
Killing a connection involves shutdown and close of client
socket and this can cause EPOLLHUP(or EPOLLERR) events to be
to be queued and handled after disarming and cleanup of 
of the connection object (THD) is being done.We disarm the 
the connection by modifying the epoll mask to zero which
ensure no events come and release the ownership of waiting 
thread that collect events and then do the cleanup of THD.
object.As per the linux kernel epoll source code (               
http://lxr.linux.no/linux+*/fs/eventpoll.c#L1771), EPOLLHUP
(or EPOLLERR) can't be masked even if we set EPOLL mask
to zero. So we disarm the connection and thus prevent 
execution of any query processing handler/queueing to 
client ctx. queue by removing the client fd from the epoll        
set via EPOLL_CTL_DEL. Also there is a race condition which
involve the following threads:
1) Thread X executing KILL CONNECTION Y and is in THD::awake
and using mysys_var (holding LOCK_thd_data).
2) Thread Y in tp_process_event executing and is being killed.
3) Thread Z receives KILL flag internally and possible call
the tp_thd_cleanup function which set thread session variable
and changing mysys_var.
The fix for the above race is to set thread session variable
under LOCK_thd_data.
We also do not call THD::awake if we found the thread in the
thread list that is to be killed but it's KILL_CONNECTION flag
set thus avoiding any possible concurrent cleanup. This patch
is approved by Mikael Ronstrom via email review.
2012-11-09 14:54:35 +05:30
Aditya A
29d08621bb Bug#14234028 - CRASH DURING SHUTDOWN WITH BACKGROUND PURGE THREAD
Analysis
 --------- 
 
 my_stat() calls stat() and if the stat() call fails we try to set 
 the variable  my_errno which is actually a thread specific data .
 We try to get the  address of this thread specific data using
 my_pthread_getspecifc(),but for the purge thread we have not defined 
 any thread specific data so it returns null and when dereferencing 
 null we get a segmentation fault.
        init_available_charsets() seen in the core stack is invoked 
 through  pthread_once() .pthread_once is used for one time 
 initialization.Since free_charsets() is called before innodb plugin 
 shutdown ,purge thread calls init_avaliable_charsets() which leads 
 to the crash.

 Fix
 ---
 Call free_charsets() after the innodb plugin shutdown,since purge 
 threads are still using the charsets.
2012-11-08 15:21:02 +05:30
Aditya A
7a8c93e6dd Bug#14234028 - CRASH DURING SHUTDOWN WITH BACKGROUND PURGE THREAD
Analysis
 --------- 
 
 my_stat() calls stat() and if the stat() call fails we try to set 
 the variable  my_errno which is actually a thread specific data .
 We try to get the  address of this thread specific data using
 my_pthread_getspecifc(),but for the purge thread we have not defined 
 any thread specific data so it returns null and when dereferencing 
 null we get a segmentation fault.
        init_available_charsets() seen in the core stack is invoked 
 through  pthread_once() .pthread_once is used for one time 
 initialization.Since free_charsets() is called before innodb plugin 
 shutdown ,purge thread calls init_avaliable_charsets() which leads 
 to the crash.

 Fix
 ---
 Call free_charsets() after the innodb plugin shutdown,since purge 
 threads are still using the charsets.
2012-11-08 15:14:29 +05:30
Praveenkumar Hulakund
d912a758b0 Bug#14466617 - INVALID WRITES AND/OR CRASH WITH USER
VARIABLES 

Analysis:
-------------
After executing the query, new value of the user defined
variables are set in the function "select_dumpvar::send_data".
"select_dumpvar::send_data" first calls function 
"Item_func_set_user_var::save_item_result()". This function
checks the nullness of the Item_field passed as parameter 
to it and saves it. The nullness of item is stored with 
arg[0]'s null_value flag. Then "select_dumpvar::send_data" calls
"Item_func_set_user_var::update()" which notices null 
result that was saved and calls "Item_func_set_user_var::
update_hash". But here null_value is not set and args[0]
is different from that given to function "Item_func_set_user_var::
set_item_result()". This causes "Item_func_set_user_var::
update_hash" function to believe that its getting non-null value.
"user_var_entry::length" set to 0 and hence "user_var_entry::value"
is made to point to extra_area allocated in "user_var_entry".
And "Item_func_set_user_var::update_hash" tries to write
at memory beyond extra_area for result type DECIMAL. Because of 
this invalid write issue is reported by Valgrind.

Before this bug was introduced, we avoided this problem by 
creating "Item_func_set_user_var" object with the same 
Item_field as arg[0] and as parameter to 
Item_func_set_user_var::save_item_result(). But now 
they are refering to different args[0]. Because of this
null_value flag set in parameter Item_field in function
"Item_func_set_user_var::save_item_result()" is not
reflected in "Item_func_set_user_var" object.

Fix:
------------
This issue is reported on versions 5.5.24. Issue does not exists
in 5.5.23, 5.1, 5.6 and trunk.

This issue was introduced by
revid:georgi.kodinov@oracle.com-20120309130449-82e3bs5v3et1x0ef (fix for
bug #12408412), which was pushed into 5.5 and later releases. This patch
has later been reversed in 5.6 and trunk by
revid:norvald.ryeng@oracle.com-20121010135242-xj34gg73h04hrmyh (fix for
bug #14664077). Backported this patch in 5.5 also to fix this issue.


sql/item_func.cc:
  here unsigned value is converted to signed value.
sql/item_func.h:
  last_insert_id() gives an auto_incremented value which can be
  positive only,so defined it as a unsigned longlong sets the
  unsigned_flag to 1.
2012-11-07 19:08:33 +05:30
Aditya A
9e13157b33 Bug#11751825 - OPTIMIZE PARTITION RECREATES FULL TABLE INSTEAD JUST PARTITION
PROBLEM 
-------

optimize on partiton will recreate the whole table 
instead of just partition.

ANALYSIS
--------

At present innodb doesn't support optimize option ,so we do a rebuild of the 
whole table and then call analyze() on the table.Presently for any optimize()
option (on table or partition) we display the following info to the user 

"Table does not support optimize, doing recreate + analyze instead".

FIX
---

It was decided for GA versions(5.1 and 5.5) whenever the user tries to 
optimize a partition(s) we will will display the following info the user

"Table does not support optimize on partitions.
All partitions will be rebuilt and analyzed."

Earlier partitions were not analyzed.Now all partitions  will be analyzed.  

If the user wants to optimize the whole table ,we will display the
previous info to the user. i.e

"Table does not support optimize, doing recreate + analyze instead"

For 5.6+ versions we will raise a new bug to support optimize() options
in innodb.
2012-11-06 18:44:22 +05:30