Bug #25476474 SIGNAL 11 AT HA_NDBCLUSTER::EXEC_BULK_UPDATE

A bulk update is executed by reading records and executing a
transaction on the set of records. The transaction is started
while reading the set of records. In this case, the transaction
start fails. The transaction execution code then attempts to
dereference the NULL transaction pointer, which causes a segfault.

The mysql update function does not exit on fatal errors. The
approach is to save all errors, continue execution and evaluate
success/failure after the execution completes. With this approach,
it is not guaranteed that the necessary init work is successfully
completed before calling the bulk update executor. So it is
necessary to have more error-handling in the ndb bulk update
executor.

Fixed by adding some error-handling in the ndb bulk update
executor.

Author: Priyanka Sangam

mysql-test/suite/ndb/r/ndb_err4012.result

@@ -308,3 +308,18 @@ Warning	1297	Got temporary error 4013 'Request timed out in waiting for node fai
 Error	1297	Got temporary error 4013 'Request timed out in waiting for node failure' from NDBCLUSTER
 SET SESSION debug=@save_debug;
 drop table t1;
+# mysqld gets timeout error 4009 while creating transaction for bulk update
+create table t1(id int primary key, val int) engine=ndb;
+insert into t1 values(1,1), (2,2), (3,3), (4,4), (5,5);
+set @save_debug = @@session.debug;
+SET SESSION debug="+d,ndb_start_transaction_fail";
+update t1 set val = 11111 where id > 0;
+ERROR HY000: Got error 4009 'Cluster Failure' from NDBCLUSTER
+show warnings;
+Level	Code	Message
+Warning	1296	Got error 4009 'Cluster Failure' from NDB
+Error	1296	Got error 4009 'Cluster Failure' from NDBCLUSTER
+Warning	1296	Got error 4009 'Cluster Failure' from NDB
+Error	1296	Got error 4009 'Cluster Failure' from NDBCLUSTER
+SET SESSION debug=@save_debug;
+drop table t1;

mysql-test/suite/ndb/t/ndb_err4012.test

@@ -310,3 +310,14 @@ show create table t1;
 show warnings;
 SET SESSION debug=@save_debug;
 drop table t1;
+
+--echo # mysqld gets timeout error 4009 while creating transaction for bulk update
+create table t1(id int primary key, val int) engine=ndb;
+insert into t1 values(1,1), (2,2), (3,3), (4,4), (5,5);
+set @save_debug = @@session.debug;
+SET SESSION debug="+d,ndb_start_transaction_fail";
+--error 1296
+update t1 set val = 11111 where id > 0;
+show warnings;
+SET SESSION debug=@save_debug;
+drop table t1;

sql/ha_ndbcluster.cc

@@ -6063,9 +6063,35 @@ int ha_ndbcluster::exec_bulk_update(uint *dup_key_found)
   DBUG_ENTER("ha_ndbcluster::exec_bulk_update");
   *dup_key_found= 0;
 
+  /* If a fatal error is encountered during an update op, the error
+   * is saved and exec continues. So exec_bulk_update may be called
+   * even when init functions fail. Check for error conditions like
+   * an uninit'ed transaction.
+   */
+  if(unlikely(!m_thd_ndb->trans))
+  {
+    DBUG_PRINT("exit", ("Transaction was not started"));
+    int error = 0;
+    ERR_SET(m_thd_ndb->ndb->getNdbError(), error);
+    DBUG_RETURN(error);
+  }
+
   // m_handler must be NULL or point to _this_ handler instance
   assert(m_thd_ndb->m_handler == NULL || m_thd_ndb->m_handler == this);
 
+  /*
+   * Normal bulk update execution, driven by mysql_update() in sql_update.cc
+   * - read_record calls start_transaction and inits m_thd_ndb->trans.
+   * - ha_bulk_update calls ha_ndbcluster::bulk_update_row().
+   * - ha_ndbcluster::bulk_update_row calls ha_ndbcluster::ndb_update_row().
+   *   with flag is_bulk_update = 1.
+   * - ndb_update_row sets up update, sets various flags and options,
+   *   but does not execute_nocommit() because of batched exec.
+   * - after read_record processes all rows, exec_bulk_update checks for
+   *   rbwr and does an execute_commit() if rbwr enabled. If rbwr is
+   *   enabled, exec_bulk_update does an execute_nocommit().
+   * - if rbwr not enabled, execute_commit() done in ndbcluster_commit().
+   */
   if (m_thd_ndb->m_handler &&
       m_read_before_write_removal_possible)
   {

storage/ndb/src/ndbapi/Ndb.cpp

@@ -1,5 +1,5 @@
 /*
-   Copyright (c) 2003, 2016, Oracle and/or its affiliates. All rights reserved.
+   Copyright (c) 2003, 2017, Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -945,6 +945,15 @@ Ndb::startTransactionLocal(Uint32 aPriority, Uint32 nodeId, Uint32 instance)
   DBUG_ENTER("Ndb::startTransactionLocal");
   DBUG_PRINT("enter", ("nodeid: %d", nodeId));
 
+#ifdef VM_TRACE
+  DBUG_EXECUTE_IF("ndb_start_transaction_fail",
+                  {
+                    /* Cluster failure */
+                    theError.code = 4009;
+                    DBUG_RETURN(0);
+                  };);
+#endif
+
   if(unlikely(theRemainingStartTransactions == 0))
   {
     theError.code = 4006;