MDEV-28473 field_ref_zero is not initialized in xtrabackup_prepare_func()

The solution is to initialize field_ref_zero in main_low() before
xtrabackup_backup_func() and xtrabackup_prepare_func() calls.

extra/mariabackup/xtrabackup.cc

@@ -51,6 +51,7 @@ Street, Fifth Floor, Boston, MA 02110-1335 USA
 #include <my_getopt.h>
 #include <mysql_com.h>
 #include <my_default.h>
+#include <scope.h>
 #include <sql_class.h>
 
 #include <fcntl.h>
@@ -4511,13 +4512,6 @@ static bool xtrabackup_backup_func()
 	}
 
 
-	if (auto b = aligned_malloc(UNIV_PAGE_SIZE_MAX, 4096)) {
-		field_ref_zero = static_cast<byte*>(
-			memset_aligned<4096>(b, 0, UNIV_PAGE_SIZE_MAX));
-	} else {
-		goto fail;
-	}
-
         {
 	/* definition from recv_recovery_from_checkpoint_start() */
 	ulint		max_cp_field;
@@ -4534,10 +4528,6 @@ static bool xtrabackup_backup_func()
 		msg("Error: cannot read redo log header");
 unlock_and_fail:
 		mysql_mutex_unlock(&log_sys.mutex);
-free_and_fail:
-		aligned_free(const_cast<byte*>(field_ref_zero));
-		field_ref_zero = nullptr;
-		goto fail;
 	}
 
 	if (log_sys.log.format == 0) {
@@ -4563,7 +4553,7 @@ static bool xtrabackup_backup_func()
 	xtrabackup_init_datasinks();
 
 	if (!select_history()) {
-		goto free_and_fail;
+		goto fail;
 	}
 
 	/* open the log file */
@@ -4572,7 +4562,7 @@ static bool xtrabackup_backup_func()
 	if (dst_log_file == NULL) {
 		msg("Error: failed to open the target stream for '%s'.",
 		    LOG_FILE_NAME);
-		goto free_and_fail;
+		goto fail;
 	}
 
 	/* label it */
@@ -4610,7 +4600,7 @@ static bool xtrabackup_backup_func()
 	if (ds_write(dst_log_file, log_hdr_buf, LOG_FILE_HDR_SIZE)) {
 		msg("error: write to logfile failed");
 		aligned_free(log_hdr_buf);
-		goto free_and_fail;
+		goto fail;
 	}
 
 	aligned_free(log_hdr_buf);
@@ -4631,7 +4621,7 @@ static bool xtrabackup_backup_func()
 		    " error %s.", ut_strerr(err));
 fail_before_log_copying_thread_start:
 		log_copying_running = false;
-		goto free_and_fail;
+		goto fail;
 	}
 
 	/* copy log file by current position */
@@ -4648,7 +4638,7 @@ static bool xtrabackup_backup_func()
 
 	/* FLUSH CHANGED_PAGE_BITMAPS call */
 	if (!flush_changed_page_bitmaps()) {
-		goto free_and_fail;
+		goto fail;
 	}
 
 	ut_a(xtrabackup_parallel > 0);
@@ -4670,7 +4660,7 @@ static bool xtrabackup_backup_func()
 	datafiles_iter_t *it = datafiles_iter_new();
 	if (it == NULL) {
 		msg("mariabackup: Error: datafiles_iter_new() failed.");
-		goto free_and_fail;
+		goto fail;
 	}
 
 	/* Create data copying threads */
@@ -4725,9 +4715,6 @@ static bool xtrabackup_backup_func()
 	if (opt_log_innodb_page_corruption)
 		ok = corrupted_pages.print_to_file(MB_CORRUPTED_PAGES_FILE);
 
-	aligned_free(const_cast<byte*>(field_ref_zero));
-	field_ref_zero = nullptr;
-
 	if (!ok) {
 		goto fail;
 	}
@@ -6932,6 +6919,20 @@ static int main_low(char** argv)
 		}
 	}
 
+	ut_ad(!field_ref_zero);
+	if (auto b = aligned_malloc(UNIV_PAGE_SIZE_MAX, 4096)) {
+		field_ref_zero = static_cast<byte*>(
+			memset_aligned<4096>(b, 0, UNIV_PAGE_SIZE_MAX));
+	} else {
+		msg("Can't allocate memory for field_ref_zero");
+		return EXIT_FAILURE;
+	}
+
+	auto _ = make_scope_exit([]() {
+		aligned_free(const_cast<byte*>(field_ref_zero));
+		field_ref_zero = nullptr;
+		});
+
 	/* --backup */
 	if (xtrabackup_backup && !xtrabackup_backup_func()) {
 		return(EXIT_FAILURE);

mysql-test/suite/mariabackup/incremental_backup.test

@@ -8,11 +8,20 @@ if (`select @@max_binlog_stmt_cache_size = 4294963200 and @@innodb_page_size = 6
 
 call mtr.add_suppression("InnoDB: New log files created");
 
+let $test_comp=`select @@innodb_page_size < 32768`;
 let basedir=$MYSQLTEST_VARDIR/tmp/backup;
 let incremental_dir=$MYSQLTEST_VARDIR/tmp/backup_inc1;
 
 CREATE TABLE t_aria(i INT) ENGINE ARIA;
 CREATE TABLE t(i INT PRIMARY KEY) ENGINE INNODB;
+if ($test_comp) {
+  # If MDEV-28474 is not fixed, backup preparing will crash with SIGSEGV.
+  --disable_query_log
+  --disable_result_log
+  CREATE TABLE t_comp(i INT PRIMARY KEY) ENGINE INNODB ROW_FORMAT=COMPRESSED;
+  --enable_query_log
+  --enable_result_log
+}
 BEGIN;
 INSERT INTO t VALUES(2);
 connect (con1,localhost,root,,);
@@ -96,6 +105,13 @@ let $targetdir=$basedir;
 
 SELECT * FROM t;
 DROP TABLE t;
+if ($test_comp) {
+  --disable_query_log
+  --disable_result_log
+  DROP TABLE t_comp;
+  --enable_query_log
+  --enable_result_log
+}
 DROP TABLE t_aria;
 
 # Cleanup

storage/innobase/buf/buf0buf.cc

@@ -1346,15 +1346,19 @@ bool buf_pool_t::create()
   ut_ad(srv_buf_pool_size > 0);
   ut_ad(!resizing);
   ut_ad(!chunks_old);
-  ut_ad(!field_ref_zero);
+  /* mariabackup loads tablespaces, and it requires field_ref_zero to be
+  allocated before innodb initialization */
+  ut_ad(srv_operation >= SRV_OPERATION_RESTORE || !field_ref_zero);
 
   NUMA_MEMPOLICY_INTERLEAVE_IN_SCOPE;
 
-  if (auto b= aligned_malloc(UNIV_PAGE_SIZE_MAX, 4096))
-    field_ref_zero= static_cast<const byte*>
-      (memset_aligned<4096>(b, 0, UNIV_PAGE_SIZE_MAX));
-  else
-    return true;
+  if (!field_ref_zero) {
+    if (auto b= aligned_malloc(UNIV_PAGE_SIZE_MAX, 4096))
+      field_ref_zero= static_cast<const byte*>
+        (memset_aligned<4096>(b, 0, UNIV_PAGE_SIZE_MAX));
+    else
+      return true;
+  }
 
   chunk_t::map_reg= UT_NEW_NOKEY(chunk_t::map());