GitLab

           locks on the table

Fixing the partitioning specifics after TRUNCATE TABLE in
bug-42643 was fixed.

Reorganize of code to decrease the size of the giant switch
in mysql_execute_command, and to prepare for future parser
reengineering. Moved code into Sql_statement objects.

Updated patch according to davi's review comments.

libmysqld/CMakeLists.txt:
  Added new files.
libmysqld/Makefile.am:
  Added new files.
mysql-test/r/not_partition.result:
  now returning error on partitioning commands
  if partitioning is not enabled.
mysql-test/r/partition_disabled.result:
  There is no partition handlerton, so it cannot
  find the specified engine in the .frm file.
mysql-test/r/partition_truncate.result:
  Updated test results.
mysql-test/suite/parts/inc/partition_mgm.inc:
  Added check that TRUNCATE PARTITION does not delete on failure.
mysql-test/suite/parts/r/partition_debug_sync_innodb.result:
  updated results.
mysql-test/suite/parts/r/p...

                        
After BUG#36649, warnings for sub-statements are cleared when a 
new sub-statement is started. This is problematic since it suppresses
warnings for unsafe statements in some cases. It is important that we
always give a warning to the client, because the user needs to know
when there is a risk that the slave goes out of sync.
                        
We fixed the problem by generating warning messages for unsafe statements
while returning from a stored procedure, function, trigger or while
executing a top level statement.
                        
We also started checking unsafeness when both performance and log tables are
used. This is necessary after the performance schema which does a distinction
between performance and log tables.

mysql-test/extra/rpl_tests/create_recursive_construct.inc:
  Changed the order of the calls in the procedure because the code
  that checks if a warning message is printed out expects that the
  first statement gives an warning what is not the case for INSERT
  INTO ta$CRC_ARG_level VALUES (47);
mysql-test/suite/binlog/r/binlog_stm_unsafe_warning.result:
  Updated the result file.
mysql-test/suite/binlog/r/binlog_unsafe.result:
  There are several changes here:
          
  (1) - Changed the CREATE PROCEDURE $CRC.
                                  
  (2) - The procedure $CRC was failing and the content of the binlog
        was being printed out, after fix (1) the failure disappeared.
                                  
  (3) - The warning message for unsafeness due to auto-increment collumns was
        changed.
                                  
  (4) - The warning message for unsafeness due to VERSION(), RAND() was changed.
mysql-test/suite/binlog/t/binlog_stm_unsafe_warning.test:
  Tested filters.
mysql-test/suite/binlog/t/binlog_unsafe.test:
  Reenabled the test case binlog_unsafe.
mysql-test/suite/binlog/t/disabled.def:
  Reenabled the test case binlog_unsafe.
mysql-test/suite/rpl/r/rpl_begin_commit_rollback.result:
  Updated the result file.
mysql-test/suite/rpl/r/rpl_non_direct_stm_mixing_engines.result:
  Updated the result file.
mysql-test/suite/rpl/r/rpl_stm_auto_increment_bug33029.result:
  Updated the result file.
sql/sql_class.cc:
  Moved the stmt_accessed_table_flag variable and related information to the
  LEX as we need the variable reset after each statement even inside a stored
  procedure, what did not happen if the information was in the THD.
          
  Changed the routine in the THD::binlog_query that prints the warning
  messages to avoid trying to print them when inside a stored procedure,
  function or trigger.
                          
  Checked for unsafeness when both performance and log tables where used.
  After the introduction of the performance schema, we need to check both.

/*![:version:] Query Code */, where [:version:] is a sequence of 5 
digits representing the mysql server version(e.g /*!50200 ... */),
is a special comment that the query in it can be executed on those 
servers whose versions are larger than the version appearing in the 
comment. It leads to a security issue when slave's version is larger 
than master's. A malicious user can improve his privileges on slaves. 
Because slave SQL thread is running with SUPER privileges, so it can
execute queries that he/she does not have privileges on master.

This bug is fixed with the logic below: 
- To replace '!' with ' ' in the magic comments which are not applied on
  master. So they become common comments and will not be applied on slave.

- Example:
  'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /*!99999 ,(3)*/
  will be binlogged as
  'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /* 99999 ,(3)*/

mysql-test/suite/rpl/t/rpl_conditional_comments.test:
  Test the patch for this bug.
sql/mysql_priv.h:
  Rename inBuf as rawBuf and remove the const limitation.
sql/sql_lex.cc:
  To replace '!' with ' ' in the magic comments which are not applied on
  master.
sql/sql_lex.h:
  Remove the const limitation on parameter buff, as it can be modified in the function since
  this patch.
  Add member function yyUnput for Lex_input_stream. It set a character back the query buff.
sql/sql_parse.cc:
  Rename inBuf as rawBuf and remove the const limitation.
sql/sql_partition.cc:
  Remove the const limitation on parameter part_buff, as it can be modified in the function since
  this patch.
sql/sql_partition.h:
  Remove the const limitation on parameter part_buff, as it can be modified in the function since
  this patch.
sql/table.h:
  Remove the const limitation on variable partition_info, as it can be modified since
  this patch.

to be more descriptive.

This patch also fixes Bug#55452 "SET PASSWORD is
replicated twice in RBR mode".

The goal of this patch is to remove the release of 
metadata locks from close_thread_tables().
This is necessary to not mistakenly release
the locks in the course of a multi-step
operation that involves multiple close_thread_tables()
or close_tables_for_reopen().

On the same token, move statement commit outside 
close_thread_tables().

Other cleanups:
Cleanup COM_FIELD_LIST.
Don't call close_thread_tables() in COM_SHUTDOWN -- there
are no open tables there that can be closed (we leave
the locked tables mode in THD destructor, and this
close_thread_tables() won't leave it anyway).

Make open_and_lock_tables() and open_and_lock_tables_derived()
call close_thread_tables() upon failure.
Remove the calls to close_thread_tables() that are now
unnecessary.

Simplify the back off condition in Open_table_context.

Streamline metadata lock handling in LOCK TABLES 
implementation.

Add as...

Remove unused macros or macro which are always defined.

include/my_global.h:
  Remove unused macros and move macros which aren't used globally.

Remove code that has been disabled for a long time.

Fix warnings flagged by the new warning option -Wunused-but-set-variable
that was added to GCC 4.6 and that is enabled by -Wunused and -Wall. The
option causes a warning whenever a local variable is assigned to but is
later unused. It also warns about meaningless pointer dereferences.

client/mysql.cc:
  Meaningless pointer dereferences.
client/mysql_upgrade.c:
  Check whether reading from the file succeeded.
extra/comp_err.c:
  Unused.
extra/yassl/src/yassl_imp.cpp:
  Skip instead of reading data that is discarded.
include/my_pthread.h:
  Variable is only used in debug builds.
include/mysys_err.h:
  Add new error messages.
mysys/errors.c:
  Add new error message for permission related functions.
mysys/mf_iocache.c:
  Variable is only checked under THREAD.
mysys/my_copy.c:
  Raise a error if chmod or chown fails.
mysys/my_redel.c:
  Raise a error if chmod or chown fails.
regex/engine.c:
  Use a equivalent variable for the assert.
server-tools/instance-manager/instance_options.cc:
  Unused.
sql/field.cc:
  Unused.
sql/item.cc:
  Unused.
sql/log.cc:
  Do not ignore the return value of freopen: only set buffer if
  reopening succeeds.
  
  Adjust doxygen comment to the right function.
  
  Pass message lenght to log function.
sql/mysqld.cc:
  Do not ignore the return value of freopen: only set buffer if
  reopening succeeds.
sql/partition_info.cc:
  Unused.
sql/slave.cc:
  No need to set pointer to the address of '\0'.
sql/spatial.cc:
  Unused. Left for historical purposes.
sql/sql_acl.cc:
  Unused.
sql/sql_base.cc:
  Pointers are always set to the same variables.
sql/sql_parse.cc:
  End statement if reading fails.
  
  Store the buffer after it has actually been updated.
sql/sql_repl.cc:
  No need to set pointer to the address of '\0'.
sql/sql_show.cc:
  Put variable under the same ifdef block.
sql/udf_example.c:
  Set null pointer flag appropriately.
storage/csv/ha_tina.cc:
  Meaningless dereferences.
storage/example/ha_example.cc:
  Return the error since it's available.
storage/myisam/mi_locking.c:
  Remove unused and dead code.

Essentially, the problem is that safemalloc is excruciatingly
slow as it checks all allocated blocks for overrun at each
memory management primitive, yielding a almost exponential
slowdown for the memory management functions (malloc, realloc,
free). The overrun check basically consists of verifying some
bytes of a block for certain magic keys, which catches some
simple forms of overrun. Another minor problem is violation
of aliasing rules and that its own internal list of blocks
is prone to corruption.

Another issue with safemalloc is rather the maintenance cost
as the tool has a significant impact on the server code.
Given the magnitude of memory debuggers available nowadays,
especially those that are provided with the platform malloc
implementation, maintenance of a in-house and largely obsolete
memory debugger becomes a burden that is not worth the effort
due to its slowness and lack of support for detecting more
common forms of heap corruption.

Since there are third-party tools that can provide the same
functionality at a lower or comparable performance cost, the
solution is to simply remove safemalloc. Third-party tools
can provide the same functionality at a lower or comparable
performance cost. 

The removal of safemalloc also allows a simplification of the
malloc wrappers, removing quite a bit of kludge: redefinition
of my_malloc, my_free and the removal of the unused second
argument of my_free. Since free() always check whether the
supplied pointer is null, redudant checks are also removed.

Also, this patch adds unit testing for my_malloc and moves
my_realloc implementation into the same file as the other
memory allocation primitives.

client/mysqldump.c:
  Pass my_free directly as its signature is compatible with the
  callback type -- which wasn't the case for free_table_ent.

           table immediately after

The problem was that rows inserted in a table by one connection was
not immediately visible if another connection queried the table,
even if the insert had committed.

The reason for the problem was that the server sent a status reply
to the client before it actually did the commit. Therefore it was
possible to get an OK from the server before the changes were made
permanent and visible to other connections.

This patch fixes the problem by not sending status messages to the
server until any changes made have been committed. No test case added
as reproducing the error requires very specific timing betweeen the
server and two or more clients.

This patch also fixes the following (duplicate) bugs:
Bug #29334 pseudo-finished SHOW GLOBAL STATUS
Bug #36618 myisam insert not immediately visible to select from another client
Bug #45864 insert on one connection, immediate query on another produces no result
Bug #51329 Inserts from one connection not immediately visible in second
           connection
Bug #41516 Assertion fails when error returned from
           handler::external_lock(thd, F_UNLCK)

DROP USER 
RENAME USER CURRENT_USER() ...
GRANT ... TO CURRENT_USER()
REVOKE ... FROM CURRENT_USER()
ALTER DEFINER = CURRENT_USER() EVENTbut, When these statements are binlogged, CURRENT_USER() just is binlogged
as 'CURRENT_USER()', it is not expanded to the real user name. When slave 
executes the log event, 'CURRENT_USER()' is expand to the user of slave 
SQL thread, but SQL thread's user name always NULL. This breaks the replication.

After this patch, session's user will be written into query log events 
if these statements call CURREN_USER() or 'ALTER EVENT' does not assign a definer.


mysql-test/include/diff_tables.inc:
  Expend its abilities.
  Now it can diff not only in sessions of 'master' and 'slave', but 
  other sessions as well.
sql/log_event.cc:
  session's user will be written into Query_log_event, if is_current_user_used() is TRUE.
  On slave SQL thread, Only thd->invoker is written into Query_log_event,
  if it exists.
sql/sql_acl.cc:
  On slave SQL thread, grantor should copy from thd->invoker, if it exists
sql/sql_class.h:
  On slave SQL thread, thd->invoker is used to store the applying event's
  invoker.

DATABASE with open HANDLER"

Remove LOCK_create_db, database name locks, and use metadata locks instead.
This exposes CREATE/DROP/ALTER DATABASE statements to the graph-based
deadlock detector in MDL, and paves the way for a safe, deadlock-free
implementation of RENAME DATABASE.

Database DDL statements will now take exclusive metadata locks on
the database name, while table/view/routine DDL statements take
intention exclusive locks on the database name. This prevents race
conditions between database DDL and table/view/routine DDL.
(e.g. DROP DATABASE with concurrent CREATE/ALTER/DROP TABLE)

By adding database name locks, this patch implements
WL#4450 "DDL locking: CREATE/DROP DATABASE must use database locks" and
WL#4985 "DDL locking: namespace/hierarchical locks".

The patch also changes code to use init_one_table() where appropriate.
The new lock_table_names() function requires TABLE_LIST::db_length to
be set correctly, and this is taken care of by init_one_table().

This patch also adds a simple template to help work with 
the mysys HASH data structure.

Most of the patch was written by Konstantin Osipov.

BUG#54872 MBR: replication failure caused by using tmp table inside transaction 
      
Changed criteria to classify a statement as unsafe in order to reduce the
number of spurious warnings. So a statement is classified as unsafe when
there is on-going transaction at any point of the execution if:

1. The mixed statement is about to update a transactional table and
a non-transactional table.

2. The mixed statement is about to update a temporary transactional
table and a non-transactional table.
      
3. The mixed statement is about to update a transactional table and
read from a non-transactional table.

4. The mixed statement is about to update a temporary transactional
table and read from a non-transactional table.

5. The mixed statement is about to update a non-transactional table
and read from a transactional table when the isolation level is
lower than repeatable read.

After updating a transactional table if:

6. The mixed statement is about to update a non-transactional table
and read from a temporary transactional table.
 
7. The mixed statement is about to update a non-transactional table
 and read from a temporary transactional table.

8. The mixed statement is about to update a non-transactionala table
   and read from a temporary non-transactional table.
     
9. The mixed statement is about to update a temporary non-transactional
table and update a non-transactional table.
     
10. The mixed statement is about to update a temporary non-transactional
table and read from a non-transactional table.
     
11. A statement is about to update a non-transactional table and the
option variables.binlog_direct_non_trans_update is OFF.

The reason for this is that locks acquired may not protected a concurrent
transaction of interfering in the current execution and by consequence in
the result. So the patch reduced the number of spurious unsafe warnings.

Besides we fixed a regression caused by BUG#51894, which makes temporary
tables to go into the trx-cache if there is an on-going transaction. In
MIXED mode, the patch for BUG#51894 ignores that the trx-cache may have
updates to temporary non-transactional tables that must be written to the
binary log while rolling back the transaction.
      
So we fix this problem by writing the content of the trx-cache to the
binary log while rolling back a transaction if a non-transactional
temporary table was updated and the binary logging format is MIXED.

concurrently execute the statement XA START 'x', then mysqld
server could crash.

sql/sql_class.cc:
  xid_cache_insert: added checking for element in cache before
  insert it, return TRUE if such element already exists.
sql/sql_parse.cc:
  mysql_execute_command modified:
  * sequence of calls to xid_cache_search(..)/xid_cache_insert(...)
  replaced by call to xid_cache_insert(...) in alternative
  'case SQLCOM_XA_START:'
  * added comment to alternative 'case SQLCOM_XA_COMMIT:'.

DROP USER 
RENAME USER CURRENT_USER() ...
GRANT ... TO CURRENT_USER()
REVOKE ... FROM CURRENT_USER()
ALTER DEFINER = CURRENT_USER() EVENTbut, When these statements are binlogged, CURRENT_USER() just is binlogged
as 'CURRENT_USER()', it is not expanded to the real user name. When slave 
executes the log event, 'CURRENT_USER()' is expand to the user of slave 
SQL thread, but SQL thread's user name always NULL. This breaks the replication.

After this patch, session's user will be written into query log events 
if these statements call CURREN_USER() or 'ALTER EVENT' does not assign a definer.


mysql-test/include/diff_tables.inc:
  Expend its abilities.
  Now it can diff not only in sessions of 'master' and 'slave', but 
  other sessions as well.
mysql-test/include/rpl_diff_tables.inc:
  Diff the same table between master and slaves.
sql/log_event.cc:
  session's user will be written into Query_log_event, if is_current_user_used() is TRUE.
  On slave SQL thread, Only thd->variables.current_user is written into Query_log_event,
  if it exists.
sql/sql_acl.cc:
  On slave SQL thread, grantor should copy from thd->variables.current_user, if it exists
sql/sql_class.h:
  On slave SQL thread, thd->variables.current_user is used to store the applying event's
  invoker.

> ------------------------------------------------------------
> revno: 3367 [merge]
> revision-id: joro@sun.com-20100504140328-srxf3c088j2twnq6
> parent: kristofer.pettersson@sun.com-20100503172109-f9hracq5pqsaomb1
> parent: joro@sun.com-20100503151651-nakknn8amrapmdp7
> committer: Georgi Kodinov <joro@sun.com>
> branch nick: B53371-5.1-bugteam
> timestamp: Tue 2010-05-04 17:03:28 +0300
> message:
>   Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
>   
>   This is the 5.1 merge and extension of the fix.
>   The server was happily accepting paths in table name in all places a table
>   name is accepted (e.g. a SELECT). This allowed all users that have some 
>   privilege over some database to read all tables in all databases in all
>   mysql server instances that the server file system has access to.
>   Fixed by :
>   1. making sure no path elements are allowed in quoted table name when
>   constructing the path (note that the path symbols are still valid in table names
>   when they're properly escaped by the server).
>   2. checking the #mysql50# prefixed names the same way they're checked for
>   path elements in mysql-5.0.
> ------------------------------------------------------------
> Use --include-merges or -n0 to see merged revisions.

> ------------------------------------------------------------
> revno: 1810.3987.13
> revision-id: ramil@mysql.com-20100429044232-f0pkyx8fnpszf142
> parent: alexey.kopytov@sun.com-20100426200600-op06qy98llzpzgl1
> committer: Ramil Kalimullin <ramil@mysql.com>
> branch nick: b53237-5.0-bugteam
> timestamp: Thu 2010-04-29 08:42:32 +0400
> message:
>   Fix for bug #53237: mysql_list_fields/COM_FIELD_LIST stack smashing
>   
>   Problem: "COM_FIELD_LIST is an old command of the MySQL server, before there was real move to only
>   SQL. Seems that the data sent to COM_FIELD_LIST( mysql_list_fields() function) is not
>   checked for sanity. By sending long data for the table a buffer is overflown, which can
>   be used deliberately to include code that harms".
>   
>   Fix: check incoming data length.

The patch did not apply cleanly:
- Line numbers are completely off, roughly it is 2030 -> 1313
- What is called "pend" in the patch, is "arg_end" in the source.

            strict aliasing violations.

One somewhat major source of strict-aliasing violations and
related warnings is the SQL_LIST structure. For example,
consider its member function `link_in_list` which takes
a pointer to pointer of type T (any type) as a pointer to
pointer to unsigned char. Dereferencing this pointer, which
is done to reset the next field, violates strict-aliasing
rules and might cause problems for surrounding code that
uses the next field of the object being added to the list.

The solution is to use templates to parametrize the SQL_LIST
structure in order to deference the pointers with compatible
types. As a side bonus, it becomes possible to remove quite
a few casts related to acessing data members of SQL_LIST.

sql/handler.h:
  Use the appropriate template type argument.
sql/item.cc:
  Remove now-unnecessary cast.
sql/item_subselect.cc:
  Remove now-unnecessary casts.
sql/item_sum.cc:
  Use the appropriate template type argument.
  Remove now-unnecessary cast.
sql/mysql_priv.h:
  Move SQL_LIST structure to sql_list.h
  Use the appropriate template type argument.
sql/sp.cc:
  Remove now-unnecessary casts.
sql/sql_delete.cc:
  Use the appropriate template type argument.
  Remove now-unnecessary casts.
sql/sql_derived.cc:
  Remove now-unnecessary casts.
sql/sql_lex.cc:
  Remove now-unnecessary casts.
sql/sql_lex.h:
  SQL_LIST now takes a template type argument which must
  match the type of the elements of the list. Use forward
  declaration when the type is not available, it is used
  in pointers anyway.
sql/sql_list.h:
  Rename SQL_LIST to SQL_I_List. The template parameter is
  the type of object that is stored in the list.
sql/sql_olap.cc:
  Remove now-unnecessary casts.
sql/sql_parse.cc:
  Remove now-unnecessary casts.
sql/sql_prepare.cc:
  Remove now-unnecessary casts.
sql/sql_select.cc:
  Remove now-unnecessary casts.
sql/sql_show.cc:
  Remove now-unnecessary casts.
sql/sql_table.cc:
  Remove now-unnecessary casts.
sql/sql_trigger.cc:
  Remove now-unnecessary casts.
sql/sql_union.cc:
  Remove now-unnecessary casts.
sql/sql_update.cc:
  Remove now-unnecessary casts.
sql/sql_view.cc:
  Remove now-unnecessary casts.
sql/sql_yacc.yy:
  Remove now-unnecessary casts.
storage/myisammrg/ha_myisammrg.cc:
  Remove now-unnecessary casts.

make tdc_refresh_version an 
atomic counter".
Backport the trivial changes from mysql-trunk-iplus.

when an out-of-supported-range date is detected.

            
Some of the server implementations don't support dates later
than 2038 due to the internal time type being 32 bit.
Added checks so that the server will refuse dates that cannot
be handled by either throwing an error when setting date at 
runtime or by refusing to start or shutting down the server if 
the system date cannot be stored in my_time_t.

errors
            
In the fix of BUG#39934 in 5.1-rep+3, errors are generated when
binlog_format=row and a statement modifies a table restricted to
statement-logging (ER_BINLOG_ROW_MODE_AND_STMT_ENGINE); or if
binlog_format=statement and a statement modifies a table restricted to
row-logging (ER_BINLOG_STMT_MODE_AND_ROW_ENGINE).
            
However, some DDL statements that lock tables (e.g. ALTER TABLE,
CREATE INDEX and CREATE TRIGGER) were causing spurious errors,
although no row might be inserted into the binary log.
            
To fix the problem, we tagged statements that may generate
rows into the binary log and thence the warning messages are
only printed out when the appropriate conditions hold and rows
might be changed.

sql/log_event.cc:
  Reorganized the Query_log_event's constructor based on the
  CF_CAN_GENERATE_ROW_EVENTS flag and as such any statement
  that has the associated flag should go through a cache
  before being written to the binary log.
sql/share/errmsg-utf8.txt:
  Improved the error message ER_BINLOG_UNSAFE_MIXED_STATEMENT according to Paul's
  suggestion.
sql/sql_class.cc:
  Created a hook to be used by innodb that checks if a statement
  may write rows to the binary log. In other words, if it has
  the CF_CAN_GENERATE_ROW_EVENTS flag associated.
sql/sql_class.h:
  Defined the CF_CAN_GENERATE_ROW_EVENTS flag.
sql/sql_parse.cc:
  Updated the sql_command_flags and added a function to check the 
  CF_CAN_GENERATE_ROW_EVENTS.
sql/sql_parse.h:
  Added a function to check the CF_CAN_GENERATE_ROW_EVENTS.
storage/innobase/handler/ha_innodb.cc:
  Added a call to the hook thd_generates_rows().
storage/innobase/handler/ha_innodb.h:
  Defined an external reference to the hook thd_generates_rows().

breaks
      
When a "CREATE TEMPORARY TABLE SELECT * FROM" was executed the OPTION_KEEP_LOG was
not set into the thd->variables.option_bits. For that reason, if the transaction
had updated only transactional engines and was rolled back at the end (.e.g due to
a deadlock) the changes were not written to the binary log, including the creation
of the temporary table.
      
To fix the problem, we have set the OPTION_KEEP_LOG into the
thd->variables.option_bits when a "CREATE TEMPORARY TABLE
SELECT * FROM" is executed.

The problem was that TRUNCATE TABLE didn't take a exclusive
lock on a table if it resorted to truncating via delete of
all rows in the table. Specifically for InnoDB tables, this
could break proper isolation as InnoDB ends up aborting some
granted locks when truncating a table.

The solution is to take a exclusive metadata lock before
TRUNCATE TABLE can proceed. This guarantees that no other
transaction is using the table.

Incompatible change: Truncate via delete no longer fails
if sql_safe_updates is activated (this was a undocumented
side effect).

libmysqld/CMakeLists.txt:
  Add new files to the build list.
libmysqld/Makefile.am:
  Add new files to the build list.
mysql-test/extra/binlog_tests/binlog_truncate.test:
  Add test case for Bug#42643
mysql-test/include/mix1.inc:
  Update test case as TRUNCATE TABLE now grabs a exclusive lock.
  Ensure that TRUNCATE waits for granted locks on the table.
mysql-test/suite/binlog/t/binlog_truncate_innodb.test:
  As with other data modifying statements, TRUNCATE is still not
  possible in a transaction with isolation level READ COMMITTED
  or READ UNCOMMITED. It would be possible to implement so, but
  it is not worth the effort.
mysql-test/suite/binlog/t/binlog_truncate_myisam.test:
  Test under different binlog formats.
mysql-test/suite/binlog/t/disabled.def:
  Re-enable test case.
mysql-test/t/innodb_bug38231.test:
  Truncate no longer works with row-level locks.
mysql-test/t/mdl_sync.test:
  Ensure that a acquired lock is not given up due to a conflict.
mysql-test/t/partition_innodb_semi_consistent.test:
  End transaction as to release metadata locks.
mysql-test/t/truncate.test:
  A metadata lock is now taken before the object is verified.
sql/CMakeLists.txt:
  Add new files to the build list.
sql/Makefile.am:
  Add new files to the build list.
sql/datadict.cc:
  Introduce a new file specific for data dictionary operations.
sql/datadict.h:
  Add header file.
sql/sql_base.cc:
  Rename data dictionary function.
sql/sql_bitmap.h:
  Include dependency.
sql/sql_delete.cc:
  Move away from relying on mysql_delete() to delete all rows of
  a table. Thus, move any bits related to truncate to sql_truncate.cc
sql/sql_delete.h:
  Remove parameter.
sql/sql_parse.cc:
  Add protection against the global read lock -- a intention
  exclusive lock can be acquired in the truncate path.
sql/sql_show.cc:
  Add sync point for testing scenarios where a pending flush
  is ignored.
sql/sql_truncate.cc:
  Acquire a shared metadata lock before accessing table metadata.
  Upgrade the lock to a exclusive one if the table can be re-created.
  Rework binlog rules to better reflect the requirements.
sql/sql_yacc.yy:
  Set appropriate lock types for table to be truncated.
sql/table.h:
  Move to data dictionary header.

Problem: one with SELECT privilege on some table may dump other table
performing COM_TABLE_DUMP command due to missed check of the table name.

Fix: check the table name.


sql/sql_parse.cc:
  Fix for bug #53907: Table dump command can be abused to dump arbitrary tables.
    - check given table name performing COM_TABLE_DUMP command.
tests/mysql_client_test.c:
  Fix for bug #53907: Table dump command can be abused to dump arbitrary tables.
    - test case.

This fixes a recently introduced regression, where a variable is
not defined for the embedded server. Although the embedded server
is not supported in 5.0, make it at least compile.

transactional SELECT and ALTER TABLE ... REBUILD PARTITION".

The goal of this patch is to decouple type of metadata
lock acquired for table by open_tables() from type of
table-level lock to be acquired on it.

To achieve this we change approach to how we determine what
type of metadata lock should be acquired on table to be open.
Now instead of inferring it at open_tables() time from flags
and type of table-level lock we rely on that type of metadata
lock is properly set at parsing time and is not changed
further.

sql/ha_ndbcluster.cc:
  Now one needs to properly initialize table list element's
  MDL_request object before calling mysql_rm_table_part2().
sql/lock.cc:
  lock_table_names() no longer initializes table list elements'
  MDL_request objects. Now proper initialization of these
  requests is a responsibility of the caller.
sql/lock.h:
  Removed MYSQL_OPEN_TAKE_UPGRADABLE_MDL flag which became
  unnecessary. Thanks to the fact that we don't reset type of
  requests for metadata locks between re-executions we now can
  figure out that upgradable locks are requested by simply
  looking at their type which were set in the parser. As result
  this flag became redundant.
sql/mdl.h:
  Added version of new operator which simplifies allocation of
  MDL_request objects on a MEM_ROOT.
sql/sp_head.cc:
  Added comment explaining why it is OK to infer type of
  metadata lock to request from type of table-level lock
  for prelocking.
  Added enum_mdl_type argument to sp_add_to_query_tables()
  to simplify its usage in trigger implementation.
sql/sp_head.h:
  Added enum_mdl_type argument to sp_add_to_query_tables()
  to simplify its usage in trigger implementation.
sql/sql_base.cc:
  - open_table_get_mdl_lock():
    Preserve type of MDL_request for table list element which
    was set in the parser by creating MDL_request objects on
    memory root if MYSQL_OPEN_FORCE_SHARED_MDL or
    MYSQL_OPEN_FORCE_SHARED_HIGH_PRIO_MDL flag were specified.
    Thanks to this and to the fact that we no longer reset
    type of requests for metadata locks between re-executions
    we no longer need to acquire exclusive metadata lock on
    table to be created in a special way. This lock is acquired
    by code handling acquiring of upgradable locks.
    Also changed signature/calling convention for this function
    to simplify its usage.
  - Accordingly special lock strategy for table list elements
    which was used for such locks became unnecessary and was
    removed. Other strategies were renamed.
  - Since we no longer have guarantee that MDL_request object
    which were not satisfied due to lock conflict belongs to
    table list element Open_table_context class and its methods
    were extended to remember pointer to MDL_request which has
    caused problem at request_backoff_action() time and use it
    in recover_from_failed_open(). Similar approach is used
    for cases when problem from which we need to recover is
    not related to MDL but to the table itself. In this case
    we store pointer to the element of table list.
  - Changed open_tables()/open_tables_check_upgradable_mdl()/
    open_tables_acquire_upgradable_mdl() not to rely on
    MYSQL_OPEN_TAKE_UPGRADABLE_MDL flag to understand when
    upgradable metadata locks should be acquired and not to
    infer type of MDL lock from type of table-level lock.
    Instead we assume that type of MDL to be acquired was set
    in the parser (we can do this as type of MDL_request is
    no longer reset between re-executions).
sql/sql_class.h:
  Since we no longer have guarantee that MDL_request object
  which were not satisfied due to lock conflict belongs to
  table list element Open_table_context class and its methods
  were extended to remember pointer to MDL_request which has
  caused problem at request_backoff_action() time and use it
  in recover_from_failed_open(). Similar approach is used
  for cases when problem from which we need to recover is
  not related to MDL but to the table itself. In this case
  we store pointer to the element of table list.
sql/sql_db.cc:
  Now one needs to properly initialize table list element's
  MDL_request object before calling mysql_rm_table_part2()
  or mysql_rename_tables().
sql/sql_lex.cc:
  st_select_lex/st_select_lex_node::add_table_to_list() method
  now has argument which allows specify type of metadata lock
  to be requested for table list element being added.
sql/sql_lex.h:
  - st_select_lex/st_select_lex_node::add_table_to_list()
    method now has argument which specifies type of metadata
    lock to be requested for table list element being added.
    This allows to explicitly set type of MDL lock to be
    acquired for a DDL statement in parser. It is also more
    future-proof than inferring type of MDL request from type
    of table-level lock.
  - Added Yacc_state::m_mdl_type member which specifies which
    type of metadata lock should be requested for tables to be
    added to table list by a grammar rule in cases when the same
    rule is used in several statements requiring different kinds
    of metadata locks.
sql/sql_parse.cc:
  - st_select_lex::add_table_to_list() method now has argument
    which specifies type of metadata lock to be requested for
    table list element being added. This allows to explicitly
    set type of MDL lock to be acquired for a DDL statement in
    parser. It is also more future-proof than inferring type of
    MDL request from type of table-level lock.
  - EXCLUSIVE_DOWNGRADABLE_MDL lock strategy has a new name -
    OTLS_DOWNGRADE_IF_EXISTS.
  - Adjusted LOCK TABLES implementation to the fact that we no
    longer infer type of metadata lock to be acquired from table
    level lock and that type of MDL request is set at parsing.
    And thus MYSQL_OPEN_TAKE_UPGRADABLE_MDL flag became
    unnecessary.
sql/sql_prepare.cc:
  TABLE_LIST's lock strategy SHARED_MDL was renamed to OTLS_NONE
  as now it means that metadata lock should not be changed during
  call to open_table() (if it has been already acquired) and is
  also used for exclusive metadata lock.
sql/sql_show.cc:
  st_select_lex::add_table_to_list() method now has argument
  which specifies type of metadata lock to be requested for
  table list element being added.
sql/sql_table.cc:
  - Adjusted mysql_admin_table()'s code to the fact that
    open_tables() no longer determines what kind of metadata
    lock should be obtained basing on type of table-level
    lock and flags. Instead type of metadata lock for table
    to be open should be set before calling open_tables().
  - Changed mysql_alter_table() code to the facts:
    a) that now it is responsibility of caller to properly
    initalize MDL_request in table list elements before calling
    lock_table_names()
    b) and that MYSQL_OPEN_TAKE_UPGRADABLE_MDL is no longer
    necessary since type of metadata lock to be obtained
    at open_tables() time is set during parsing.
  - Changed code of mysql_recreate_table() to properly set
    type of metadata and table-level lock to be obtained
    by mysql_alter_table() which it calls.
sql/sql_trigger.cc:
  Instead of relying on MYSQL_OPEN_TAKE_UPGRADABLE_MDL flag to
  force open_tables() to take an upgradable lock we now specify
  exact type of lock to be taken when constructing table list
  element for table to be open for CREATE/DROP TRIGGER.
sql/sql_view.cc:
  We no longer use TABLE_LIST::EXCLUSIVE_MDL strategy to force
  open_tables() to take an exclusive metadata lock on view to
  be created. Instead we rely on parser setting proper type of
  metadata lock to request and open_tables() acquiring it.
  This became possible thanks to the fact that we no longer
  reset type of MDL_request between statement re-executions.
sql/sql_yacc.yy:
  Instead of inferring type of MDL_request for table to be
  open from type of table-level lock and flags passed to
  open_tables() we now explicitly specify them at parsing.
  This became possible thanks to the fact that we no longer
  reset type of MDL_request between statement re-executions.
  In future this should allow to decouple type of metadata
  lock from type of table-level lock.
  The only exception to this approach is statements implemented
  through mysql_admin_table() which re-uses same table list
  element several times with different types of table-level
  and metadata locks.
  We now also properly initialize MDL_request objects for table
  list elements which are later passed to lock_table_names()
  function.
sql/table.cc:
  Do not reset type of MDL_request between statement
  re-executions. This became unnecessesary as we no longer
  change type of MDL_request residing in table list element.
  In its turn this change allows to set type of MDL_request
  only once - at parsing time.
sql/table.h:
  Got rid of TABLE_LIST::EXCLUSIVE_MDL lock strategy.
  Now we can specify that we need to acquire exclusive lock
  on table to be processed by open_tables() through setting
  an appropriate type of MDL_request at parsing time (this
  became possible thanks to the fact that we no longer reset
  types of MDL_request's belonging to table list elements
  between statement re-execution).
  Strategy SHARED_MDL was renamed to OTLS_NONE as now it
  means that metadata lock should not be changed during call
  to open_table() (if it has been already acquired) and is
  also used for exclusive metadata lock.
  Strategy EXCLUSIVE_DOWNGRADABLE_MDL was renamed to
  OTLS_DOWNGRADE_IF_EXISTS.

            Item_hex_string::Item_hex_string

The status of memory allocation in the Lex_input_stream (called
from the Parser_state constructor) was not checked which led to
a parser crash in case of the out-of-memory error.

The solution is to introduce new init() member function in
Parser_state and Lex_input_stream so that status of memory
allocation can be returned to the caller.

mysql-test/r/error_simulation.result:
  Added a test case for bug #42064.
mysql-test/t/error_simulation.test:
  Added a test case for bug #42064.
mysys/my_alloc.c:
  Added error injection code for the regression test.
mysys/my_malloc.c:
  Added error injection code for the regression test.
mysys/safemalloc.c:
  Added error injection code for the regression test.
sql/event_data_objects.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures.
sql/mysqld.cc:
  Added error injection code for the regression test.
sql/sp.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures.
sql/sql_lex.cc:
  Moved memory allocation from constructor to the separate init()
  member function.
  Added error injection code for the regression test.
sql/sql_lex.h:
  Moved memory allocation from constructor to the separate init()
  member function.
sql/sql_parse.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures.
sql/sql_partition.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures.
sql/sql_prepare.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures.
sql/sql_trigger.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures.
sql/sql_view.cc:
  Use the new init() member function of Parser_state and check
  its return value to handle memory allocation failures..
sql/thr_malloc.cc:
  Added error injection code for the regression test.

This patch fixes two problems described as follows:

1 - If there is an on-going transaction and a temporary table is created or
dropped, any failed statement that follows the "create" or "drop commands"
triggers a rollback and by consequence the slave will go out sync because
the binary log will have a wrong sequence of events.

To fix the problem, we changed the expression that evaluates when the
cache should be flushed after either the rollback of a statment or
transaction.

2 - When a "CREATE TEMPORARY TABLE SELECT * FROM" was executed the
OPTION_KEEP_LOG was not set into the thd->options. For that reason, if
the transaction had updated only transactional engines and was rolled
back at the end (.e.g due to a deadlock) the changes were not written
to the binary log, including the creation of the temporary table.
      
To fix the problem, we have set the OPTION_KEEP_LOG into the thd->options
when a "CREATE TEMPORARY TABLE SELECT * FROM" is executed.

sql/log.cc:
  Reorganized the code based on the following functions:
  
  - bool ending_trans(const THD* thd, const bool all);
  - bool trans_has_updated_non_trans_table(const THD* thd);
  - bool trans_has_no_stmt_committed(const THD* thd, const bool all);
  - bool stmt_has_updated_non_trans_table(const THD* thd);
sql/log.h:
  Added functions to organize the code in log.cc.
sql/log_event.cc:
  Removed the OPTION_KEEP_LOG since it must be used only when
  creating and dropping temporary tables.
sql/log_event_old.cc:
  Removed the OPTION_KEEP_LOG since it must be used only when
  creating and dropping temporary tables.
sql/sql_parse.cc:
  When a "CREATE TEMPORARY TABLE SELECT * FROM" was executed the
  OPTION_KEEP_LOG was not set into the thd->options.
        
  To fix the problem, we have set the OPTION_KEEP_LOG into the
  thd->options when a "CREATE TEMPORARY TABLE SELECT * FROM"
  is executed.

multiquery packet).

Background:

  - a query can contain multiple SQL statements;

  - the server frees resources allocated to process a query when the
    whole query is handled. In other words, resources allocated to process
    one SQL statement from a multi-statement query are freed when all SQL
    statements are handled.

The problem was that the parser allocated a buffer of size of the whole
query for each SQL statement in a multi-statement query. Thus, if a query
had many SQL-statements (so, the query was long), but each SQL statement
was short, ther parser tried to allocate huge amount of memory (number of
small SQL statements * length of the whole query).

The memory was allocated for a so-called "cpp buffer", which is intended to
store pre-processed SQL statement -- SQL text without version specific
comments.

The fix is to allocate memory for the "cpp buffer" once for all SQL
statements (once for a query).

for ALTER TABLE, LOAD DATA).

ROW_COUNT is now assigned according to the following rules:

  - In my_ok():
    - for DML statements: to the number of affected rows;
    - for DDL statements: to 0.

  - In my_eof(): to -1 to indicate that there was a result set.

    We derive this semantics from the JDBC specification, where int
    java.sql.Statement.getUpdateCount() is defined to (sic) "return the
    current result as an update count; if the result is a ResultSet
    object or there are no more results, -1 is returned".

  - In my_error(): to -1 to be compatible with the MySQL C API and
    MySQL ODBC driver.

  - For SIGNAL statements: to 0 per WL#2110 specification. Zero is used
    since that's the "default" value of ROW_COUNT in the diagnostics area.

sql/protocol.cc:
  Fix a typo.
sql/sql_class.h:
  - Introduce THD::get_row_count_func() / THD::set_row_count_func();
  - Remove the CF_HAS_ROW_COUNT define
sql/sql_parse.cc:
  CF_HAS_ROW_COUNT was eliminated.

      
MySQL handles the join syntax "JOIN ... USING( field1,
... )" and natural joins by building the same parse tree as
a corresponding join with an "ON t1.field1 = t2.field1 ..."
expression would produce. This parse tree was not cleaned up
properly in the following scenario. If a thread tries to
lock some tables and finds that the tables were dropped and
re-created while waiting for the lock, it cleans up column
references in the statement by means a per-statement free
list. But if the statement was part of a stored procedure,
column references on the stored procedure's free list
weren't cleaned up and thus contained pointers to freed
objects.
      
Fixed by adding a call to clean up the current prepared
statement's free list.

This is a backport from MySQL 5.1

Bug#20837 Apparent change of isolation level during transaction,
Bug#46527 COMMIT AND CHAIN RELEASE does not make sense,
Bug#53343 completion_type=1, COMMIT/ROLLBACK AND CHAIN don't 
preserve the isolation level
Bug#53346 completion_type has strange effect in a stored 
procedure/prepared statement

Make thd->tx_isolation mean strictly "current transaction 
isolation level"
Make thd->variables.tx_isolation mean "current session isolation
level".
The current transaction isolation level is now established
at transaction start. If there was a SET TRANSACTION
ISOLATION LEVEL statement, the value is taken from it.
Otherwise, the session value is used.
A change in a session value, made while a transaction is active,
whereas still allowed, no longer has any effect on the
current transaction isolation level. This is an incompatible
change.
A change in a session isolation level, made while there is
no active transaction, overrides SET TRANSACTION statement,
if there was any.
Changed the impelmentation to not look at @@session.completion_type
in the parser, and thus fixed Bug#53346.
Changed the parser to not allow AND NO CHAIN RELEASE,
and thus fixed Bug#46527.
Changed the transaction API to take the current transaction
isolation level into account:
- BEGIN/COMMIT now do preserve the current transaction
isolation level if chaining is on.
- implicit commit, XA COMMIT or XA ROLLBACK or autocommit don't.

thd->in_multi_stmt_transaction() and thd->active_transaction().


include/mysql_com.h:
  Comment SERVER_STATUS_IN_TRANS flag.
sql/ha_ndbcluster.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
sql/handler.cc:
  Add comments.
sql/log.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
sql/log_event.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
sql/sql_base.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
sql/sql_cache.cc:
  Rename: thd->active_transaction() ->
  thd->in_active_multi_stmt_transaction().
sql/sql_class.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
sql/sql_class.h:
  Rename and comment two transaction processing- related methods.
sql/sql_parse.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
  Rename: thd->active_transaction() ->
  thd->in_active_multi_stmt_transaction().
sql/sql_prepare.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
sql/sql_rename.cc:
  Rename: thd->active_transaction() ->
  thd->in_active_multi_stmt_transaction().
sql/sql_table.cc:
  Rename: thd->active_transaction() ->
  thd->in_active_multi_stmt_transaction().
sql/sys_vars.cc:
  Rename: thd->active_transaction() ->
  thd->in_active_multi_stmt_transaction().
sql/transaction.cc:
  Rename: thd->in_multi_stmt_transaction() -> 
  thd->in_multi_stmt_transaction_mode().
  Rename: thd->active_transaction() ->
  thd->in_active_multi_stmt_transaction().

revno: 2861
committer: Georgi Kodinov <joro@sun.com>
branch nick: B53371-5.0-bugteam
timestamp: Mon 2010-05-03 18:16:51 +0300
message:
  Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
  
  The server was not checking the supplied to COM_FIELD_LIST table name
  for validity and compliance to acceptable table names standards.
  Fixed by checking the table name for compliance similar to how it's 
  normally checked by the parser and returning an error message if 
  it's not compliant.

The server was not checking the supplied to COM_FIELD_LIST table name
for validity and compliance to acceptable table names standards.
Fixed by checking the table name for compliance similar to how it's 
normally checked by the parser and returning an error message if 
it's not compliant.

The server could be tricked to read packets indefinitely if it
received a packet larger than the maximum size of one packet.
This problem is aggravated by the fact that it can be triggered
before authentication.

The solution is to no skip big packets for non-authenticated
sessions. If a big packet is sent before a session is authen-
ticated, a error is returned and the connection is closed.

include/mysql_com.h:
  Add skip flag. Only used in server builds.
sql/net_serv.cc:
  Control whether big packets can be skipped.

Problem: "COM_FIELD_LIST is an old command of the MySQL server, before there was real move to only
SQL. Seems that the data sent to COM_FIELD_LIST( mysql_list_fields() function) is not
checked for sanity. By sending long data for the table a buffer is overflown, which can
be used deliberately to include code that harms".

Fix: check incoming data length.


sql/sql_parse.cc:
  Fix for bug #53237: mysql_list_fields/COM_FIELD_LIST stack smashing
    - check incoming mysql_list_fields() table name arg length.