WL#6391: Post-push fix.

Make sure we catch creation of tables like 'mysql.innodb_index_stats'.
Must add explicit check for the sql comcode, since the meta data lock
is not set to 'exclusive' at the point where this is checked during
parsing.

Author: ssorumgard

mysql-test/r/dd_table_access.result

@@ -46,6 +46,8 @@ CREATE TABLE mysql.version (i INTEGER);
 ERROR HY000: Access to system table 'mysql.version' is rejected.
 CREATE TABLE new_tab LIKE mysql.version;
 ERROR HY000: Access to system table 'mysql.version' is rejected.
+CREATE TABLE new_tab SELECT * FROM mysql.version;
+ERROR HY000: Access to system table 'mysql.version' is rejected.
 ALTER TABLE mysql.version ADD COLUMN (new_col INTEGER);
 ERROR HY000: Access to system table 'mysql.version' is rejected.
 TRUNCATE TABLE mysql.version;
@@ -125,6 +127,8 @@ CREATE TABLE version (i INTEGER);
 ERROR HY000: Access to system table 'mysql.version' is rejected.
 CREATE TABLE new_tab LIKE version;
 ERROR HY000: Access to system table 'mysql.version' is rejected.
+CREATE TABLE new_tab SELECT * FROM version;
+ERROR HY000: Access to system table 'mysql.version' is rejected.
 ALTER TABLE version ADD COLUMN (new_col INTEGER);
 ERROR HY000: Access to system table 'mysql.version' is rejected.
 TRUNCATE TABLE version;
@@ -204,6 +208,8 @@ CREATE TABLE mysql.indexes (i INTEGER);
 ERROR HY000: Access to system table 'mysql.indexes' is rejected.
 CREATE TABLE new_tab LIKE mysql.indexes;
 ERROR HY000: Access to system table 'mysql.indexes' is rejected.
+CREATE TABLE new_tab SELECT * FROM mysql.indexes;
+ERROR HY000: Access to system table 'mysql.indexes' is rejected.
 ALTER TABLE mysql.indexes ADD COLUMN (new_col INTEGER);
 ERROR HY000: Access to system table 'mysql.indexes' is rejected.
 TRUNCATE TABLE mysql.indexes;
@@ -283,6 +289,8 @@ CREATE TABLE indexes (i INTEGER);
 ERROR HY000: Access to system table 'mysql.indexes' is rejected.
 CREATE TABLE new_tab LIKE indexes;
 ERROR HY000: Access to system table 'mysql.indexes' is rejected.
+CREATE TABLE new_tab SELECT * FROM indexes;
+ERROR HY000: Access to system table 'mysql.indexes' is rejected.
 ALTER TABLE indexes ADD COLUMN (new_col INTEGER);
 ERROR HY000: Access to system table 'mysql.indexes' is rejected.
 TRUNCATE TABLE indexes;
@@ -342,9 +350,27 @@ UPDATE mysql.innodb_index_stats SET stat_description='Updated';
 SELECT stat_description FROM mysql.innodb_index_stats LIMIT 1;
 stat_description
 Updated
-# Check that we may not DROP mysql.innodb_index_stats.
+# Check that we may not DROP or CREATE mysql.innodb_index_stats.
 DROP TABLE mysql.innodb_index_stats;
 ERROR HY000: Access to system table 'mysql.innodb_index_stats' is rejected.
+CREATE TABLE mysql.innodb_index_stats(i INTEGER);
+ERROR HY000: Access to system table 'mysql.innodb_index_stats' is rejected.
+# Check that we may CREATE FROM mysql.innodb_index_stats.
+CREATE TABLE t1 SELECT * FROM mysql.innodb_index_stats;
+DROP TABLE t1;
+# Check that we may CREATE LIKE mysql.innodb_index_stats.
+CREATE TABLE t1 LIKE mysql.innodb_index_stats;
+DROP TABLE t1;
+# Check access from stored programs.
+CREATE PROCEDURE ddse_access() CREATE TABLE mysql.innodb_index_stats(i INTEGER);
+ERROR HY000: Access to system table 'mysql.innodb_index_stats' is rejected.
+CREATE PROCEDURE ddse_access() DROP TABLE mysql.innodb_index_stats(i INTEGER);
+ERROR HY000: Access to system table 'mysql.innodb_index_stats' is rejected.
+# Check access from prepared statements.
+PREPARE ps FROM 'CREATE TABLE mysql.innodb_index_stats(i INTEGER)';;
+ERROR HY000: Access to system table 'mysql.innodb_index_stats' is rejected.
+PREPARE ps FROM 'DROP TABLE mysql.innodb_index_stats';;
+ERROR HY000: Access to system table 'mysql.innodb_index_stats' is rejected.
 # But ALTER and CHECK is allowed.
 ALTER TABLE mysql.innodb_index_stats COMMENT 'Altered';
 SELECT TABLE_NAME, TABLE_COMMENT FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME='innodb_index_stats';

mysql-test/t/dd_table_access.test

@@ -43,9 +43,31 @@ if (!$TABLE)
   UPDATE mysql.innodb_index_stats SET stat_description='Updated';
   SELECT stat_description FROM mysql.innodb_index_stats LIMIT 1;
 
-  --echo # Check that we may not DROP mysql.innodb_index_stats.
+  --echo # Check that we may not DROP or CREATE mysql.innodb_index_stats.
   --error ER_NO_SYSTEM_TABLE_ACCESS
   DROP TABLE mysql.innodb_index_stats;
+  --error ER_NO_SYSTEM_TABLE_ACCESS
+  CREATE TABLE mysql.innodb_index_stats(i INTEGER);
+
+  --echo # Check that we may CREATE FROM mysql.innodb_index_stats.
+  CREATE TABLE t1 SELECT * FROM mysql.innodb_index_stats;
+  DROP TABLE t1;
+
+  --echo # Check that we may CREATE LIKE mysql.innodb_index_stats.
+  CREATE TABLE t1 LIKE mysql.innodb_index_stats;
+  DROP TABLE t1;
+
+  --echo # Check access from stored programs.
+  --error ER_NO_SYSTEM_TABLE_ACCESS
+  CREATE PROCEDURE ddse_access() CREATE TABLE mysql.innodb_index_stats(i INTEGER);
+  --error ER_NO_SYSTEM_TABLE_ACCESS
+  CREATE PROCEDURE ddse_access() DROP TABLE mysql.innodb_index_stats(i INTEGER);
+
+  --echo # Check access from prepared statements.
+  --error ER_NO_SYSTEM_TABLE_ACCESS
+  --eval PREPARE ps FROM 'CREATE TABLE mysql.innodb_index_stats(i INTEGER)';
+  --error ER_NO_SYSTEM_TABLE_ACCESS
+  --eval PREPARE ps FROM 'DROP TABLE mysql.innodb_index_stats';
 
   --echo # But ALTER and CHECK is allowed.
   ALTER TABLE mysql.innodb_index_stats COMMENT 'Altered';
@@ -89,6 +111,8 @@ if (!$TABLE)
 --error ER_NO_SYSTEM_TABLE_ACCESS
 --eval CREATE TABLE new_tab LIKE $TABLE
 --error ER_NO_SYSTEM_TABLE_ACCESS
+--eval CREATE TABLE new_tab SELECT * FROM $TABLE
+--error ER_NO_SYSTEM_TABLE_ACCESS
 --eval ALTER TABLE $TABLE ADD COLUMN (new_col INTEGER)
 --error ER_NO_SYSTEM_TABLE_ACCESS
 --eval TRUNCATE TABLE $TABLE

mysql-test/t/mysqldump.test

@@ -1425,9 +1425,9 @@ insert into u1 values (4);
 create view v1 (c1) as select * from t1;
 
 # Backup should not fail for Bug#21527. Flush priviliges test begins.
-# TODO: Allow dump/restore of innodb_index_stats/innodb_table_stats
-# See Bug#22655287
---exec $MYSQL_DUMP --skip-comments --add-drop-table --flush-privileges --ignore-table=mysql.general_log --ignore-table=mysql.slow_log --ignore-table=mysql.innodb_index_stats --ignore-table=mysql.innodb_table_stats --databases mysqldump_myDB mysql > $MYSQLTEST_VARDIR/tmp/bug21527.sql
+# TODO (Bug#22655287): mysqldump should skip the innodb_*_stats tables.
+# Restoring the dump will cause errors (see below).
+--exec $MYSQL_DUMP --skip-comments --add-drop-table --flush-privileges --ignore-table=mysql.general_log --ignore-table=mysql.slow_log --databases mysqldump_myDB mysql > $MYSQLTEST_VARDIR/tmp/bug21527.sql
 
 # Clean up
 connection root;
@@ -1445,7 +1445,11 @@ flush privileges;
 --echo # Restore. Flush Privileges test ends.
 --echo #
 
---exec $MYSQL < $MYSQLTEST_VARDIR/tmp/bug21527.sql
+# TODO (Bug#22655287): mysqldump should skip the innodb_*_stats tables.
+# Restoring the dump will cause errors. Using '--force' will ignore
+# errors and allow the dump to be restored. Fixing Bug#22655287 should
+# allow the command below to succeed without '--force'.
+--exec $MYSQL --force < $MYSQLTEST_VARDIR/tmp/bug21527.sql
 
 # Do as a user
 connection user1;

sql/sql_parse.cc

@@ -5701,18 +5701,22 @@ TABLE_LIST *SELECT_LEX::add_table_to_list(THD *thd,
   // for the DDSE tables, since this is expected by the upgrade
   // client. We must also allow DDL access for the initialize thread,
   // since this thread is creating the I_S views.
+  // Note that at this point, the mdl request for CREATE TABLE is still
+  // MDL_SHARED, so we must explicitly check for SQLCOM_CREATE_TABLE.
   const dd::Dictionary *dictionary= dd::get_dictionary();
   if (dictionary && !dictionary->is_dd_table_access_allowed(
              thd->is_dd_system_thread() || thd->is_initialize_system_thread(),
-             ptr->mdl_request.is_ddl_or_lock_tables_lock_request() &&
-               lex->sql_command != SQLCOM_CHECK &&
-               lex->sql_command != SQLCOM_ALTER_TABLE,
+             (ptr->mdl_request.is_ddl_or_lock_tables_lock_request() ||
+              (lex->sql_command == SQLCOM_CREATE_TABLE &&
+               ptr == lex->query_tables)) &&
+              lex->sql_command != SQLCOM_CHECK &&
+              lex->sql_command != SQLCOM_ALTER_TABLE,
              ptr->db, ptr->db_length, ptr->table_name))
   {
     // TODO: Allow access to 'st_spatial_reference_systems' until
     // dedicated DDL statements for adding reference systems are
     // implemented.
-    //  We must allow creation of the system views even for non-system
+    // We must allow creation of the system views even for non-system
     // threads since this is expected by the mysql_upgrade utility.
     if (!(lex->sql_command == SQLCOM_CREATE_VIEW &&
           dd::get_dictionary()->is_system_view_name(