Commit Graph

29299 Commits

Author SHA1 Message Date
Nisha Gopalakrishnan
be901b60ae Bug#26390632: CREATE TABLE CAN CAUSE MYSQL TO EXIT.
Analysis
========
CREATE TABLE of InnoDB table with a partition name
which exceeds the path limit can cause the server
to exit.

During the preparation of the partition name,
there was no check to identify whether the complete
path name for partition exceeds the max supported
path length, causing the server to exit during
subsequent processing.

Fix
===
During the preparation of partition name, check and report
an error if the partition path name exceeds the maximum path
name limit.

This is a 5.5 patch.
2017-08-23 12:59:38 +05:30
Tor Didriksen
ebd96c3149 Bug#19875294 ASSERTION `SRC' FAILED IN MY_STRNXFRM_UNICODE (SIG 6 -STRINGS/CTYPE-UTF8.C:5151)
Backport from 5.7 to 5.5 Field_set::val_str()
should return String("", 0, cs) rather than String(NULL, 0, cs)
2017-08-23 07:32:49 +02:00
Venkatesh Duggirala
d75f8a1742 Bug#24763131 LOCAL-INFILE DEFAULT SHOULD BE DISABLED
Problem & Analysis: Slave's Receiver thread, Applier thread and worker
    threads are created with LOCAL-INFILE option enabled. As the document
    says https://dev.mysql.com/doc/refman/5.7/en/load-data-local.html,
    there are some issues if a thread enables local infile.
    This flag should be enabled with care. But for the above mentioned
    internal threads, server is enabling it at the time of creation.

Fix: Further analysis on the code shows that none of threads really
    need this flag to be enabled at any time as Slave never executes
    "LOAD DATA LOCAL INFILE" after reading it from Relay log.
    Applier thread removes "LOCAL" before start executing the query.
2017-08-23 09:16:12 +05:30
Sreeharsha Ramanavarapu
c34f2e518a Bug #24595639: INCORRECT BEHAVIOR IN QUERY WITH UNION AND
GROUP BY

Issue 1:
--------
This problem occurs in the following conditions:
1) A UNION is present in the subquery of select list and
   handles multiple columns.
2) Query has a GROUP BY.

A temporary table is created to handle the UNION.
Item_field objects are based on the expressions of the
result of the UNION (ie. the fake_select_lex). While
checking validity of the columns in the GROUP BY list, the
columns of the temporary table are checked in
Item_ident::local_column. But the Item_field objects
created for the temporary table don't have information like
the Name_resolution_context that they belong to or whether
they are dependent on an outer query. Since these members
are null, incorrect behavior is caused.

This can happen when such Item objects are cached to apply
the IN-to-EXISTS transform for Item_row.

Solution to Issue 1:
--------------------
Context information of the first select in the UNION will
be assigned to the new Item_field objects.


Issue 2:
--------
This problem occurs in the following conditions:
1) A UNION is present in the subquery of select list.
2) A column in the UNION's first SELECT refers to a table
   in the outer-query making it a dependent union.
3) GROUP BY column refers to the outer-referencing column.

While resolving the select list with an outer-reference, an
Item_outer_ref object is created to handle the
outer-query's GROUP BY list. The Item_outer_ref object
replaces the Item_field object in the item tree.
Item_outer_ref::fix_fields will be called only while fixing
the inner references of the outer query.

Before resolving the outer-query, an Item_type_holder
object needs to be created to handle the UNION. But as
explained above, the Item_outer_ref object has not been
fixed yet. Having a fixed Item object is a pre-condition
for creating an Item_type_holder.

Solution to Issue 2:
--------------------
Use the reference (real_item()) of an Item_outer_ref object
instead of the object itself while creating an
Item_type_holder.
2017-05-24 08:50:05 +05:30
Shishir Jaiswal
8c7e9aab05 Bug#16212207 - LOAD XML INFILE PERFORMANCE WITH INDENTED
XML

Post-push fix for build failure on Linux machine
sles11-x86-64bit
2017-05-23 10:22:33 +05:30
Shishir Jaiswal
3b562dcf6e Bug#16212207 - LOAD XML INFILE PERFORMANCE WITH INDENTED
XML

DESCRIPTION
===========
LOAD XML INFILE performance becomes painfully slow if the
tags' value has any space(s) in between them. They're
usually kept intentionally for indentation purpose.

ANALYSIS
========
The extra spaces are calling clear_level() many a times
which is having overhead of clearing taglist etc. This can
be avoided altogether by skipping all such spaces.

FIX
===
Trim all the starting whitespaces from the value before
passing it to read_value()
2017-05-16 13:48:52 +05:30
Nisha Gopalakrishnan
3c6c0ebc6a BUG#25250768: WRITING ON A READ_ONLY=ON SERVER WITHOUT SUPER
PRIVILEGE.

Backport from mysql-5.7 to mysql-5.5 and mysql-5.6.

BUG#13969578: TEMPORARY TABLE IN A DATABASE ON A READ-ONLY
                  INSTANCE CAN BE OVERWRITTEN

Analysis:
========

Creation or modification of a persistent table by a non-super user
is NOT ALLOWED in read_only mode. Only TEMPORARY tables are allowed
to be created or modified in read_only mode. But the creation of
a persistent table was being allowed when a temporary table of
the same name existed.

The routine which denies updating a non-temporary table in a
read_only mode does not handle the case of creation of a regular
table when a temporary table of the same exists.

Fix:
===
Handled the condition where an attempt is made to create a persistent
table having the same name as that of the temporary table. Hence
the creation of a persistent table by a non-super user when a
temporary table of the same exists is denied under read_only mode.
2017-04-07 13:20:19 +05:30
Karthik Kamath
fc4c53c288 BUG#24807826: UINT3KORR SHOULD STOP READING FOUR INSTEAD OF
THREE BYTES ON X86

Post push fix for resolving main.archive test failure in valgrind.
2017-03-10 22:34:38 +05:30
Karthik Kamath
af84921d26 BUG#24807826: UINT3KORR SHOULD STOP READING FOUR INSTEAD OF
THREE BYTES ON X86

Analysis:
=========
The macro uint3korr reads 4 bytes of data instead of 3 on
on x86 machines.

Multiple definitions were created for this macro for
optimization in WIN32. The idea was to optimize reading of
3 byte ints by reading an ordinary int and masking away the
unused byte. However this is an undefined behavior. It will
be an issue unless users are aware of allocating an extra
byte for using this macro.

Fix:
====
Removing the definition which reads 4 bytes of data. The
only definition of this macro would now read just 3 bytes
of data thus prohibiting the usage of an extra byte.

Note:
=====
This is a backport of Patches #5 and #6 for Bug#17922198.
2017-03-09 14:57:20 +05:30
Sujatha Sivakumar
e619295e1b Bug#24901077: RESET SLAVE ALL DOES NOT ALWAYS RESET SLAVE
Description:
============
If you have a relay log index file that has ended up with
some relay log files that do not exists, then RESET SLAVE
ALL is not enough to get back to a clean state.

Analysis:
=========
In the bug scenario slave server is in stopped state and
some of the relay logs got deleted but the relay log index
file is not updated.

During slave server restart replication initialization fails
as some of the required relay logs are missing. User
executes RESET SLAVE/RESET SLAVE ALL command to start a
clean slave. As per the documentation RESET SLAVE command
clears the master info and relay log info repositories,
deletes all the relay log files, and starts a new relay log
file. But in a scenario where the slave server's
Relay_log_info object is not initialized slave will not
purge the existing relay logs. Hence the index file still
remains in a bad state. Users will not be able to start
the slave unless these files are cleared.

Fix:
===
RESET SLAVE/RESET SLAVE ALL commands should do the cleanup
even in a scenario where Relay_log_info object
initialization failed.

Backported a flag named 'error_on_rli_init_info' which is
required to identify slave's Relay_log_info object
initialization failure. This flag exists in MySQL-5.6
onwards as part of BUG#14021292 fix.

During RESET SLAVE/RESET SLAVE ALL execution this flag
indicates the Relay_log_info initialization failure.
In such a case open the relay log index/relay log files
and do the required clean up.
2017-02-28 10:00:51 +05:30
Dyre Tjeldvoll
7849a27cfb Bug#25514146: DB_NAME IS IGNORED WHEN CREATING TABLE WITH DATA DIRECTORY
Problem: CREATE TABLE using a fully qualified name with INDEX DIR/DATA DIR
option reports an error when the current database is not SET.

check_access() was incorrectly called with NULL as the database
argument in a situation where the database name was not needed for
the particular privilege being checked. This will cause the current
database to be used, or an error to be reported if there is no current
database.

Fix: Call check_access() with any_db as the database argument in this situation.
2017-02-23 14:48:25 +01:00
Ajo Robert
b21a0212e4 Bug#23195404 EXCESSIVE MEMORY CAN BE USED BY THE QUOTE()
STRING FUNCTION

Fix:
=======
Added code in QUOTE string function to honor max_allowed_packet.
2017-02-23 18:27:09 +05:30
Thayumanavar S
35809da207 WL#10287 - Backport WL#7195 to MySQL - 5.5
This is backport of WL#7195 to MySQL-5.5. In 5.5, we
offload connection authentication from the acceptor
thread to tp worker threads.

Connection authentication happens in the acceptor thread that
accepts the connection for thread pool plugin. Connection authentication
involves exchanging packets with client and disk I/O
which is time consuming. This can cause other client
connections to starve and wait in the queue possibly increasing the
connect latency and decreasing throughput. In the worst case, some
connections could be dropped. n addition, SSL handshakes are quite
expensive and can stall connections in the accept queue.

This patch offloads connection authentication when thread pool
plugin is used for client connection. Each thread group
shall have a queue of connection_context objects, which represents
new connections that need to be processed by thread group threads.
The connection context is composed of THD object & list pointers
for intrusive queue implementation. Whenever a new connection
arrives, connection context object is created and added to the
queue. A new connect handler thread is created or woken up to handle
the authentication task. The worker thread loop is modified to
process connection events on connect handler threads in addition to
checking for query processing events. The initial number of connect
handler threads is one per thread group and it is restricted to
a maximum of 4 threads per thread group.
2017-01-30 03:16:09 +01:00
Sreeharsha Ramanavarapu
30a59a8d78 Bug #24595937: INCORRECT BEHAVIOR WHEN LOADING DATA TO VIEW
Issue:
------
While using the LOAD statement to insert data into an
updateable view, the check to verify whether a column
is actually updatable is missing.

Solution for 5.5 and 5.6:
-------------------------
For a view whose column-list in specified in the LOAD
command, this check is not performed. This fix adds the
check.

This is a partial backport of Bug#21097485.

Solution for 5.7 and trunk:
---------------------------
For a view whose column-list is specified in the LOAD
command, this check is already performed. This fix adds the
same check when no column-list is specified.
2016-12-13 16:41:05 +05:30
Georgi Kodinov
dafbdc788a Bug #25111907: XML TEST FAILS WITH UNDEFINED BEHAVIOR
The XML parser position stack for each level is with a fixed depth.
So a bounds check was done to ensure that this depth is not exceeded.
But it was off by one (i.e. the size of the array was a valid index).
Fixed by decreasing the allowable depth by one to match the maximum
number of elements in the position stack.
2016-12-05 15:56:47 +02:00
Arun Kuruvila
3a37745ca0 2016-11-28 11:55:36 +05:30
Dyre Tjeldvoll
e541c41481 Bug#25092566: CREATE TABLE WITH DATA DIRECTORY CLAUSE DOES NOT REQUIRE SPECIAL
PRIVILEGES

Require FILE privilege when creating tables using external data directory or
index directory.
2016-11-24 09:57:54 +01:00
Karthik Kamath
a63185e863 BUG#24437124: POSSIBLE BUFFER OVERFLOW ON CREATE TABLE
ANALYSIS:
=========
'CREATE TABLE' query with a large value for 'CONNECTION'
string reports an incorrect error.

The length of connection string is stored in .frm in two
bytes (max value= 65535). When the string length exceeds
the max value, the length is truncated to fit the two
bytes limit. Further processing leads to reading only a
part of the string as the length stored is incorrect. The
remaining part of the string is treated as engine type and
hence results in an error.

FIX:
====
We are now restricting the connection string length to 1024.
An appropriate error is reported if the length crosses this
limit.

NOTE:
=====
The 'PASSWORD' table option is documented as unused and
processed within a dead code. Hence it will not cause
similar issue with large strings.
2016-11-10 15:11:57 +05:30
Thayumanavar S
c3cf7f47f0 BUG#24487120 - SLAVE'S SLAVE_SQL_RUNNING IS STOPPED DURING
LOAD DATA AT MASTER.

Revert "BUG#23080148 - BACKPORT BUG 14653594 AND BUG 20683959 TO"

This reverts commit 1d31f5b3090d129382b50b95512f2f79305715a1.
The commit causes replication incompatibility between minor revisions
and based on discussion with Srinivasarao, the patch is reverted.
2016-10-28 14:45:03 +02:00
Karthik Kamath
1492127728 BUG#23499695: MYSQL SERVER NORMAL SHUTDOWN WITH TIME STAMP
700101

ANALYSIS:
=========
To set the time 'start_time' of query in THD, current time
is obtained by calling 'gettimeofday()'. On Solaris
platform, due to some system level issues, time obtained is
invalid i.e. its either greater than 2038 (max signed value
to hold microseconds since 1970) or 1970 (0 microseconds
since 1970). In these cases, validation checks infer that
the 'start_time' is invalid and mysql server initiates the
shutdown process. But the reason for shutdown is not logged.

FIX:
====
We are now logging appropriate message when shutdown is
triggered in the above mentioned scenarios. Now, even if
the initial validation checks infer that the 'start_time'
is invalid, server shutdown is not initiated immediately.
Before initiating the server shutdown, the process of
setting 'start_time' and validating it is reiterated (for
max 5 times). If correct time is obtained in these 5
iterations then server continues to run.
2016-10-13 14:48:45 +05:30
Arun Kuruvila
ac143744a9 Bug#24707666: DEFAULT SETTING FOR SECURE-FILE-PRIV SHOULD BE
RESTRICTED IN ALL GA RELEASES

Back port of WL#6782 to 5.5 and 5.6. This also includes
back port of Bug#20771331, Bug#20741572 and Bug#20770671.
Bug#24695274 and Bug#24679907 are also handled along with
this.
2016-09-28 15:52:05 +05:30
Kailasnath Nagarkar
91ddaff991 Bug #24489302 : ZEROFILL CAUSE MEMORY-CORRUPTION AND CRASH
ISSUE: Heap corruption occurs and hence mysql server
       terminates abnormally in String variable destructor
       when ZEROFILL is used for a column.
       Though the abnormal termination is observed in the
       String destructor, heap corruption occurs at earlier
       stage when function Field_num::prepend_zeros() is called.
       This function, prepends zeros to the actual data and
       works on entire field length. Since the allocated memory
       could be less than the field length, heap corruption occurs.
       Later, when String destructor tries to free heap, the server
       terminates abnormally since the heap is corrupt.



SOLUTION: In Field_num::prepend_zeros() function, if allocated memory
          is less than the field length, re-allocate memory enough to
          hold field length size data.
2016-09-02 15:13:52 +05:30
Arun Kuruvila
aeab9d6b41 Bug#23303391: HANDLE_FATAL_SIGNAL (SIG=11) IN ALLOC_QUERY
USING CHARACTER-SET-SERVER=UTF16

This is a backport of Bug#15985752 to mysql-5.5
2016-08-29 11:41:50 +05:30
Kailasnath Nagarkar
97fad8518b Bug #23303485 : HANDLE_FATAL_SIGNAL (SIG=11) IN
SUBSELECT_UNION_ENGINE::NO_ROWS

This patch is specific for mysql-5.5

ISSUE: When max_join_size is used and union query
       results in evaluation of tuples greater than
       max_join_size, the join object is not created,
       and is set to NULL.
       However, this join object is further dereferenced
       by union logic to determine if query resulted in
       any number of rows being returned.
       Since, the object is NULL, it results in
       program terminating abnormally.

SOLUTION: Added check to verify if join object is created.
          If join object is created, it will be used to
          determine if query resulted in any number of rows.
          Else, when join object is not created, we return
          'false' indicating that there were no rows for the
          query.
2016-08-26 11:11:27 +05:30
Jon Olav Hauglid
55a2babcef Bug#24400628: DEBUG ASSETION KICKS IN WHEN LONG SUBPARTITION NAME
IS USED IN CREATE TABLE

The problem was that using a very long subpartition name could
lead to the server exiting abnormally.

This patch fixes the problem by reporting ER_TOO_LONG_IDENT
if a name with more than 64 characters are used as partition
and subpartition name.
2016-08-24 15:42:14 +02:00
Sivert Sorumgard
8dc642112c Bug#24388753: PRIVILEGE ESCALATION USING MYSQLD_SAFE
[This is the 5.5/5.6 version of the bugfix].

The problem was that it was possible to write log files ending
in .ini/.cnf that later could be parsed as an options file.
This made it possible for users to specify startup options
without the permissions to do so.

This patch fixes the problem by disallowing general query log
and slow query log to be written to files ending in .ini and .cnf.
2016-08-24 13:41:08 +02:00
Chaithra Gopalareddy
0248fb2e8a Bug #23135667: CRASH AFTER DEEPLY NESTED BUILD_EQUAL_ITEMS_FOR_COND
Problem:
When build_equal_items_for_cond gets called for a big query
recursively, the specified thread_stack_size exceeds. But
optimizer does not handle this condition. As a result, server
exits.

Solution:
Check if we exceed specified stack size and if yes exit
gracefully by throwing an error.
2016-08-18 09:56:48 +05:30
Kailasnath Nagarkar
194776ce00 Bug #19984392 : MEDIUMINT: STACK BUFFER OVERFLOW IN PROTOCOL_TEXT::STORE_LONG
Reverting the patch due to some issues.
2016-08-04 12:49:50 +05:30
Kailasnath Nagarkar
322afb2c0a Bug #19984392 : MEDIUMINT: STACK BUFFER OVERFLOW IN PROTOCOL_TEXT::STORE_LONG
ISSUE: Queries with mediumint as column when operated with
long long type of data results in buffer overflow in
store_long function.

The merging rule specified for (MYSQL_TYPE_LONGLONG
MYSQL_TYPE_INT24) is MYSQL_TYPE_LONG. Due to this store_long
function was getting called which resulted in buffer overflow.

SOLUTION:
The correct merging rule for (MYSQL_TYPE_LONGLONG,
MYSQL_TYPE_INT24) should be MYSQL_TYPE_LONGLONG.
So, instead of function store_long, function store_longlong
is called which correctly handles the type MYSQL_TYPE_LONGLONG.

External Bug #23645238 is a duplicate of this issue.
2016-08-03 12:54:58 +05:30
Sreeharsha Ramanavarapu
8bb95e9a97 Bug #24380263: INCORRECT BEHAVIOR WITH PARAMETER AND
DERIVED TABLE IN JOIN

ISSUE:
------
This problem occurs under the following conditions:
1) A parameter is used in the select-list of a derived table.
2) The derived table is part of a JOIN.

SOLUTION:
---------
When a derived table is materialized, a temporary table is
created. This temporary table creates a field each for the
items in the select-list of the derived table. This set of
fields is later used to setup the join.

Currently no field is created in the temporary table if a
parameter is used in the select-list.

Create a field for the parameter. By default Item_param's
result type in a prepared statement is set to
STRING_RESULT. This can change during the execute phase
depending on the user variable. But since the execute phase
creates its own temporary table, it will be handled
separately.

This is a backport of the fix for BUG#22392374.
2016-08-03 09:58:36 +05:30
Neha Kumari
a63a250d40 BUG#23509275 :DBUG_PRINT in THD::decide_logging_format prints incorrectly, access out-of-bound
Problem:
In debug builds, there is a chance that an out-of-bounds
read is performed when tables are locked in
LTM_PRELOCKED_UNDER_LOCK_TABLES mode. It can happen because
the debug code uses enum values as index for an array of
mode descriptions, but it only takes into consideration 3
out of 4 of the enum values.

Fix:
This patch fixes it by implementing a getter for the enum which
returns a string representation of the enum,
effectively removing the out-of-bounds read.

Moreover, it also fixes the lock mode descriptions that
would be print out in debug builds.
2016-07-25 20:34:20 +05:30
Thayumanavar S
2674cf91c5 BUG#23703568 - IS CLIENT LIBRARY SUPPOSED TO RETRY EINTR INDEFINITELY OR NOT
Commit#ebd24626ca38e7fa1e3da2acdcf88540be70fabe obsoleted the THREAD and
THREAD_SAFE_CLIENT preprocessor symbols. This is not removed in the
sql/net_serv.cc thereby the code that retries on EINTR became dead code.
Remove the THREAD_SAFE_CLIENT preprocessor directive form sql/net_serv.cc.
Also check errno for EINTR only if there is an error in preceding read call.
2016-07-25 07:43:16 +02:00
Arun Kuruvila
fd31eea949 Bug #23295288: HANDLE_FATAL_SIGNAL (SIG=11) IN
GET_SERVER_FROM_TABLE_TO_CACHE

Description:- Server received SIG11 in the function,
"get_server_from_table_to_cache()".

Analysis:- Defining a server with a blank name is not
handled properly.

Fix:- Modified "get_server_from_table_to_cache()" to
take care of blank server name.
2016-07-22 13:15:32 +05:30
Sreeharsha Ramanavarapu
ac460e584d Bug #23280699: MYSQLD GOT SIGNAL 11 IN IS_NULL ON SELECT
FROM I_S

Issue:
------
There is a difference in the field type created when the
following DDLs are used:

1) CREATE TABLE t0 AS SELECT NULL;
2) CREATE TABLE t0 AS SELECT GREATEST(NULL,NULL);

The first statement creates field of type Field_string and
the second one creates a field of type Field_null.

This creates a problem when the query mentioned in this bug
is used. Since the null_ptr is calculated differently for
Field_null.

Solution:
---------
When there is a function returning null in the select list
as mentioned above, the field should be of type
Field_string.

This was fixed in 5.6+ as part of Bug#14021323. This is a
backport to mysql-5.5.

An incorrect comment in innodb_bug54044.test has been
corrected in all versions.
2016-07-22 07:33:43 +05:30
Chaithra Gopalareddy
54e887b2fe Bug#23280059: ITEM_ROW::ILLEGAL_METHOD_CALL(CONST CHAR*):
ASSERTION `0' FAILED ON SELECT AREA

Problem:
Optimizer tries to get the points to calculate area without
checking the return value of uint4korr for 0 "points". As a
result server exits.

Solution:
Check the return value from uint4korr().
2016-07-19 08:03:09 +05:30
Thayumanavar S
9f7288e2e0 BUG#23080148 - BACKPORT BUG 14653594 AND BUG 20683959 TO
MYSQL-5.5

The bug asks for a backport of bug#1463594 and bug#20682959. This
is required because of the fact that if replication is enabled, master
transaction can commit whereas slave can't commit due to not exact
'enviroment'. This manifestation is seen in bug#22024200.
2016-06-20 11:35:43 +05:30
Sreeharsha Ramanavarapu
115f08284d Bug #23279858: MYSQLD GOT SIGNAL 11 ON SIMPLE SELECT
NAME_CONST QUERY

ISSUE:
------
Using NAME_CONST with a non-constant negated expression as
value can result in incorrect behavior.

SOLUTION:
---------
The problem can be avoided by checking whether the argument
is a constant value.

The fix is a backport of Bug#12735545.
2016-05-24 07:44:21 +05:30
Karthik Kamath
90b9c957ba BUG#21142859: FUNCTION UPDATING A VIEW FAILS TO FIND TABLE
THAT ACTUALLY EXISTS

ANALYSIS:
=========
Stored functions updating a view where the view table has a
trigger defined that updates another table, fails reporting
an error that the table doesn't exist.

If there is a trigger defined on a table, a variable
'trg_event_map' will be set to a non-zero value after the
parsed tree creation. This indicates what triggers we need to
pre-load for the TABLE_LIST when opening an associated table.

During the prelocking phase, the variable 'trg_event_map'
will not be set for the view table. This value will be set
after the processing of triggers defined on the table. During
the processing of sub-statements, 'locked_tables_mode' will be
set to 'LTM_PRELOCKED' which denotes that further locking
of tables/functions cannot be done. This results in the other
table not being locked and thus further processing results in
an error getting reported.

FIX:
====
During the prelocking of view, the value of 'trg_event_map'
of the view is copied to 'trg_event_map' of the next table
in the TABLE_LIST. This results in the locking of tables
associated with the trigger as well.
2016-05-18 11:07:29 +05:30
Sujatha Sivakumar
df7ecf64f5 Bug#23251517: SEMISYNC REPLICATION HANGING
Revert following bug fix:

Bug#20685029: SLAVE IO THREAD SHOULD STOP WHEN DISK IS
FULL
Bug#21753696: MAKE SHOW SLAVE STATUS NON BLOCKING IF IO
THREAD WAITS FOR DISK SPACE

This fix results in a deadlock between slave IO thread
and SQL thread.
2016-05-13 16:42:45 +05:30
Sujatha Sivakumar
818b3a9123 Bug#12818255: READ-ONLY OPTION DOES NOT ALLOW
INSERTS/UPDATES ON TEMPORARY TABLES
Bug#14294223: CHANGES NOT ALLOWED TO TEMPORARY TABLES ON
READ-ONLY SERVERS

Problem:
========
Running 5.5.14 in read only we can create temporary tables
but can not insert or update records in the table. When we
try we get Error 1290 : The MySQL server is running with the
--read-only option so it cannot execute this statement.

Analysis:
=========
This bug is very specific to binlog being enabled and
binlog-format being stmt/mixed. Standalone server without
binlog enabled or with row based binlog-mode works fine.

How standalone server and row based replication work:
=====================================================
Standalone server and row based replication mark the
transactions as read_write only when they are modifying
non temporary tables as part of their current transaction.

Because of this when code enters commit phase it checks
if a transaction is read_write or not. If the transaction
is read_write and global read only mode is enabled those
transaction will fail with 'server is read only mode'
error.

In the case of statement based mode at the time of writing
to binary log a binlog handler is created and it is always
marked as read_write. In case of temporary tables even
though the engine did not mark the transaction as read_write
but the new transaction that is started by binlog handler is
considered as read_write.

Hence in this case when code enters commit phase it finds
one handler which has a read_write transaction even when
we are modifying temporary table. This causes the server
to throw an error when global read-only mode is enabled.

Fix:
====
At the time of commit in "ha_commit_trans" if a read_write
transaction is found, we should check if this transaction is
coming from a handler other than binlog_handler. This will
ensure that there is a genuine read_write transaction being
sent by the engine apart from binlog_handler and only then
it should be blocked.
2016-05-04 14:06:45 +05:30
Nisha Gopalakrishnan
3b6f9aac02 BUG#23135731: INSERT WITH DUPLICATE KEY UPDATE REPORTS
INCORRECT ERROR.

Analysis
========
INSERT with DUPLICATE KEY UPDATE and REPLACE on a table
where foreign key constraint is defined fails with an
incorrect 'duplicate entry' error rather than foreign
key constraint violation error.

As part of the bug fix for BUG#22037930, a new flag
'HA_CHECK_FK_ERROR' was added while checking for non fatal
errors to manage FK errors based on the 'IGNORE' flag. For
INSERT with DUPLICATE KEY UPDATE and REPLACE queries, the
foreign key constraint violation error was marked as non-fatal,
even though IGNORE was not set. Hence it continued with the
duplicate key processing resulting in an incorrect error.

Fix:
===
Foreign key violation errors are treated as non fatal only when
the IGNORE is not set in the above mentioned queries. Hence reports
the appropriate foreign key violation error.
2016-04-22 10:25:16 +05:30
Karthik Kamath
fbf44eed3c BUG#22286421: NULL POINTER DEREFERENCE
ANALYSIS:
=========
A LEX_STRING structure pointer is processed during the
validation of a stored program name. During this processing,
there is a possibility of null pointer dereference.

FIX:
====
check_routine_name() is invoked by the parser by supplying a
non-empty string as the SP name. To avoid any potential calls
to check_routine_name() with NULL value, a debug assert has
been added to catch such cases.
2016-04-19 14:49:27 +05:30
Sujatha Sivakumar
3a8f43bec7 Bug#22897202: RPL_IO_THD_WAIT_FOR_DISK_SPACE HAS OCCASIONAL
FAILURES

Analysis:
=========
Test script is not ensuring that "assert_grep.inc" should be
called only after 'Disk is full' error is written to the
error log.

Test checks for "Queueing master event to the relay log"
state. But this state is set before invoking 'queue_event'.
Actual 'Disk is full' error happens at a very lower level.
It can happen that we might even reset the debug point
before even the actual disk full simulation occurs and the
"Disk is full" message will never appear in the error log.

In order to guarentee that we must have some mechanism where
in after we write "Disk is full" error messge into the error
log we must signal the test to execute SSS and then reset
the debug point. So that test is deterministic.

Fix:
===
Added debug sync point to make script deterministic.
2016-04-19 11:44:34 +05:30
Sreeharsha Ramanavarapu
767bab4abe Bug #18740222: CRASH IN GET_INTERVAL_INFO WITH WEIRDO
INTERVALS

ISSUE:
------
Some string functions return one or a combination of the
parameters as their result. Here the resultant string's
charset could be incorrectly set to that of the chosen
parameter.

This results in incorrect behavior when an ascii string is
expected.

SOLUTION:
---------
Since an ascii string is expected, val_str_ascii should
explicitly convert the string.

Part of the fix is a backport of Bug#22340858 for mysql-5.5
and mysql-5.6.
2016-03-03 06:42:12 +05:30
Sujatha Sivakumar
8361151765 Bug#20685029: SLAVE IO THREAD SHOULD STOP WHEN DISK IS
FULL
Bug#21753696: MAKE SHOW SLAVE STATUS NON BLOCKING IF IO
THREAD WAITS FOR DISK SPACE

Problem:
========
Currently SHOW SLAVE STATUS blocks if IO thread waits for
disk space. This makes automation tools verifying
server health block on taking relevant action. Finally this
will create SHOW SLAVE STATUS piles.

Analysis:
=========
SHOW SLAVE STATUS hangs on mi->data_lock if relay log write
is waiting for free disk space while holding mi->data_lock.
mi->data_lock is needed to protect the format description
event (mi->format_description_event) which is accessed by
the clients running FLUSH LOGS and slave IO thread. Note
relay log writes don't need to be protected by
mi->data_lock, LOCK_log is used to protect relay log between
IO and SQL thread (see MYSQL_BIN_LOG::append_event). The
code takes mi->data_lock to protect
mi->format_description_event during relay log rotate which
might get triggered right after relay log write.

Fix:
====
Release the data_lock just for the duration of writing into
relay log.

Made change to ensure the following lock order is maintained
to avoid deadlocks.

data_lock, LOCK_log

data_lock is held during relay log rotations to protect
the description event.
2016-03-01 12:29:51 +05:30
Venkatesh Duggirala
bb32ac1d9b BUG#17018343 SLAVE CRASHES WHEN APPLYING ROW-BASED BINLOG ENTRIES IN CASCADING
REPLICATION

Problem: In RBR mode, merge table updates are not successfully applied on a cascading
replication.

Analysis & Fix: Every type of row event is preceded by one or more table_map_log_events
that gives the information about all the tables that are involved in the row
event. Server maintains the list in RPL_TABLE_LIST and it goes through all the
tables and checks for the compatibility between master and slave. Before
checking for the compatibility, it calls 'open_tables()' which takes the list
of all tables that needs to be locked and opened. In RBR, because of the
Table_map_log_event , we already have all the tables including base tables in
the list. But the open_tables() which is generic call takes care of appending
base tables if the list contains merge tables. There is an assumption in the
current replication layer logic that these tables (TABLE_LIST type objects) are always
added in the end of the list. Replication layer maintains the count of
tables(tables_to_lock_count) that needs to be verified for compatibility check
and runs through only those many tables from the list and rest of the objects
in linked list can be skipped. But this assumption is wrong.
open_tables()->..->add_children_to_list() adds base tables to the list immediately
after seeing the merge table in the list.

For eg: If the list passed to open_tables() is t1->t2->t3 where t3 is merge
table (and t1 and t2 are base tables), it adds t1'->t2' to the list after t3.
New table list looks like t1->t2->t3->t1'->t2'. It looks like it added at the
end of the list but that is not correct. If the list passed to open_tables()
is t3->t1->t2 where t3 is merge table (and t1 and t2 are base tables), the new
prepared list will be t3->t1'->t2'->t1->t2. Where t1' and t2' are of
TABLE_LIST objects which were added by add_children_to_list() call and replication
layer should not look into them. Here tables_to_lock_count  will not help as the
objects are added in between the list.

Fix: After investigating add_children_list() logic (which is called from open_tables()),
there is no flag/logic in it to skip adding the children to the list even if the
children are already included in the table list. Hence to fix the issue, a
logic should be added in the replication layer to skip children in the list by
checking whether  'parent_l' is non-null or not. If it is children, we will skip 'compatibility'
check for that table.

Also this patch is not removing 'tables_to_lock_count' logic for the performance issues
if there are any children at the end of the list, those can be easily skipped directly by
stopping the loop with tables_to_lock_count check.
2016-03-01 11:58:45 +05:30
Venkatesh Duggirala
29cc2c2883 BUG#20574550 MAIN.MERGE TEST CASE FAILS IF BINLOG_FORMAT=ROW
The main.merge test case was failing when tested using row based
binlog format.

While analyzing the issue it was found the following issues:

a) The server is calling binlog related code even when a statement will
   not be binlogged;
b) The child table list was not present into table structure by the time
   to generate the create table statement;
c) The tables in the child table list will not be opened yet when
   generating table create info using row based replication;
d) CREATE TABLE LIKE TEMP_TABLE does not preserve original table storage
   engine when using row based replication;

This patch addressed all above issues.

@ sql/sql_class.h

Added a function to determine if the binary log is disabled to
  the current session. This is related with issue (a) above.

@ sql/sql_table.cc

Added code to skip binary logging related code if the statement
  will not be binlogged. This is related with issue (a) above.

Added code to add the children to the query list of the table that
  will have its CREATE TABLE generated. This is related with issue (b)
  above.

Added code to force the storage engine to be generated into the
  CREATE TABLE. This is related with issue (d) above.

@ storage/myisammrg/ha_myisammrg.cc

Added a test to skip a table getting info about a child table if the
  child table is not opened. This is related to issue (c) above.
2016-02-26 09:01:49 +05:30
Arun Kuruvila
447eaa5bc0 2016-02-23 11:54:59 +05:30
Nisha Gopalakrishnan
d9c541cb1b BUG#22037930: INSERT IGNORE FAILS TO IGNORE FOREIGN KEY
CONSTRAINT.

Analysis
=======

INSERT and UPDATE operations using the IGNORE keyword which
causes FOREIGN KEY constraint violations reports an error
despite using the IGNORE keyword.

Foreign key violation errors were not ignored and reported
as errors instead of warnings even when IGNORE was set.

Fix
===
Added code to ignore the foreign key violation errors and
report them as warnings when the IGNORE keyword is used.
2016-02-11 14:20:50 +05:30
Sreeharsha Ramanavarapu
718c787912 Bug #18823979: PS: UCS2 + CASE WHEN THEN ELSE CRASH IN
ITEM_PARAM::SAFE_CHARSET_CONVERTER

ISSUE:
------
Charset conversion on a null parameter is not handled
correctly.

SOLUTION:
---------
Item_param's charset converter does not handle the case
where it might have to deal with a null value. This is
fine for other charset converters since the value is not
supplied to them at runtime.

The fix is to check if the parameter is now set to null and
return an Item_null object. Also, there is no need to
initialize Item_param's cnvitem in the constructor to a
string. This can be done in
ITEM_PARAM::SAFE_CHARSET_CONVERTER itself.

Members of Item_param, cnvbuf and cnvstr, have been removed
and cnvitem has been made a local variable in
ITEM_PARAM::SAFE_CHARSET_CONVERTER.
2016-01-29 08:29:06 +05:30