Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Fixed
-
10.2.2, 10.2(EOL), 10.3(EOL), 10.4(EOL)
Description
In MDEV-30009 we reproduced and analyzed a data corruption scenario that has affected some users and customers.
The scenario is as follows (adapting from MDEV-32044):
- The InnoDB change buffer was enabled, and some INSERT operations for page 0x60bb were buffered in the past. This was the default until the change buffer was disabled by default in
MDEV-27734. - DROP INDEX was executed on this index while buffered changes existed. The entries in the change buffer became stale at this point. This is how Heikki Tuuri designed it; he was a friend of lazy execution at that time.
- CREATE INDEX or ALTER TABLE…ADD INDEX was executed on the table, using a server version this bug had not been fixed. Page 0x60bb was allocated for this index. Heikki Tuuri’s design was such that any stale change buffer entries would be removed at the time when a page is reallocated for something else. This was missed by those who implemented and reviewed an optimization of InnoDB ALTER TABLE in MySQL 5.7, which was applied to MariaDB 10.2.2 without any review.
- (the rest is different from
MDEV-32044): Some changes were buffered for the newly created index page 0x60bb. - At some later point, the stale change buffer entries were wrongly applied to the page 0x60bb in addition to the newly written entries. This would corrupt the secondary index and could cause a crash on change buffer merge, typically due to an unexpected page overflow.
Notes:
- Before
MDEV-19514was implemented in 10.5, a change buffer merge could happen at any point of time, even when the affected table was not being accessed by higher-level operations. - Before
MDEV-13542and some related changes were implemented in MariaDB Server 10.6, corruption detected during change buffer merge would lead to a crash. This would also happen during CHECK TABLE. (See MDEV-28349.)
The bug in index creation is that ibuf_set_bitmap_for_bulk_load() would fail to invoke ibuf_delete_recs() to remove any stale buffered entries for the page that is being reused for the being-created secondary index. When MDEV-30009 was fixed in MariaDB Server 10.5.19 and later, we forgot to fix this in older major versions of MariaDB Server.
This ticket is about porting the fix of ibuf_set_bitmap_for_bulk_load() to MariaDB Server 10.4.
Attachments
Issue Links
- relates to
-
MDEV-20934 Infinite loop on innodb_fast_shutdown=0 with inconsistent change buffer
- Closed
-
MDEV-29694 Remove the InnoDB change buffer
- Closed
-
MDEV-30009 InnoDB shutdown hangs when the change buffer is corrupted
- Closed
-
MDEV-32044 Mariadb crash after upgrading to 11.0.3: Failing assertion: local_len >= BTR_EXTERN_FIELD_REF_SIZE
- Closed