2 files changed, 97 insertions, 0 deletions

diff --git a/meta-oe/recipes-dbs/mysql/mariadb.inc b/meta-oe/recipes-dbs/mysql/mariadb.inc
index fde5fefd6a..27b5c46fa1 100644
--- a/meta-oe/recipes-dbs/mysql/mariadb.inc
+++ b/meta-oe/recipes-dbs/mysql/mariadb.inc
@@ -33,6 +33,7 @@ SRC_URI = "https://archive.mariadb.org/${BP}/source/${BP}.tar.gz \
            file://CVE-2024-21096-0003.patch \
            file://CVE-2024-21096-0004.patch \
            file://CVE-2024-21096-0005.patch \
+           file://CVE-2025-21490.patch \
           "
 SRC_URI:append:libc-musl = " file://ppc-remove-glibc-dep.patch"
 
diff --git a/meta-oe/recipes-dbs/mysql/mariadb/CVE-2025-21490.patch b/meta-oe/recipes-dbs/mysql/mariadb/CVE-2025-21490.patch
new file mode 100644
index 0000000000..9c96f70313
--- /dev/null
+++ b/meta-oe/recipes-dbs/mysql/mariadb/CVE-2025-21490.patch
@@ -0,0 +1,96 @@
+From 82310f926b7c6547f25dd80e4edf3f38b22913e5 Mon Sep 17 00:00:00 2001
+From: Marko Mäkelä <marko.makela@mariadb.com>
+Date: Wed, 22 Jan 2025 17:22:07 +0200
+Subject: [PATCH] MDEV-29182 Assertion fld->field_no < table->n_v_def failed on
+ cascade
+
+row_ins_cascade_calc_update_vec(): Skip any virtual columns in the
+update vector of the parent table.
+
+Based on mysql/mysql-server@0ac176453bfef7fb1fdfa70af74618c32910181c
+
+Reviewed by: Debarun Banerjee
+
+CVE: CVE-2025-21490
+
+Upstream-Status: Backport [https://github.com/MariaDB/server/commit/82310f926b7c6547f25dd80e4edf3f38b22913e5]
+
+Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
+---
+ mysql-test/suite/innodb/r/foreign_key.result | 17 +++++++++++++++++
+ mysql-test/suite/innodb/t/foreign_key.test   | 15 +++++++++++++++
+ storage/innobase/row/row0ins.cc              |  4 +++-
+ 3 files changed, 35 insertions(+), 1 deletion(-)
+
+diff --git a/mysql-test/suite/innodb/r/foreign_key.result b/mysql-test/suite/innodb/r/foreign_key.result
+index acf021db..6348e7a1 100644
+--- a/mysql-test/suite/innodb/r/foreign_key.result
++++ b/mysql-test/suite/innodb/r/foreign_key.result
+@@ -982,6 +982,23 @@ t2 CREATE TABLE `t2` (
+   CONSTRAINT `t2_ibfk_1` FOREIGN KEY (`a`) REFERENCES `t1` (`a`)
+ ) ENGINE=InnoDB DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci
+ drop tables t2, t1;
++#
++# MDEV-29182 Assertion fld->field_no < table->n_v_def failed on cascade
++#
++CREATE TABLE t1(a INT PRIMARY KEY, b VARCHAR(3), c INT AS (LENGTH(b)) VIRTUAL,
++INDEX(c)) ENGINE=InnoDB;
++CREATE TABLE t2(a INT REFERENCES t1(a) ON UPDATE CASCADE,
++b INT GENERATED ALWAYS AS(a) VIRTUAL, INDEX(b)) ENGINE=InnoDB;
++INSERT INTO t1 SET a=1,b='fu';
++INSERT INTO t2 SET a=1;
++UPDATE t1 SET a=2,b='bar';
++SELECT * FROM t1;
++a      b       c
++2      bar     3
++SELECT * FROM t2;
++a      b
++2      2
++DROP TABLE t2,t1;
+ # End of 10.5 tests
+ #
+ # MDEV-26554 Table-rebuilding DDL on parent table causes crash
+diff --git a/mysql-test/suite/innodb/t/foreign_key.test b/mysql-test/suite/innodb/t/foreign_key.test
+index 4b047ea4..45205cce 100644
+--- a/mysql-test/suite/innodb/t/foreign_key.test
++++ b/mysql-test/suite/innodb/t/foreign_key.test
+@@ -1007,6 +1007,21 @@ alter table t2 add foreign key(a) references t1;
+ show create table t2;
+ drop tables t2, t1;
+ 
++
++--echo #
++--echo # MDEV-29182 Assertion fld->field_no < table->n_v_def failed on cascade
++--echo #
++CREATE TABLE t1(a INT PRIMARY KEY, b VARCHAR(3), c INT AS (LENGTH(b)) VIRTUAL,
++                INDEX(c)) ENGINE=InnoDB;
++CREATE TABLE t2(a INT REFERENCES t1(a) ON UPDATE CASCADE,
++                b INT GENERATED ALWAYS AS(a) VIRTUAL, INDEX(b)) ENGINE=InnoDB;
++INSERT INTO t1 SET a=1,b='fu';
++INSERT INTO t2 SET a=1;
++UPDATE t1 SET a=2,b='bar';
++SELECT * FROM t1;
++SELECT * FROM t2;
++DROP TABLE t2,t1;
++
+ --echo # End of 10.5 tests
+ 
+ --echo #
+diff --git a/storage/innobase/row/row0ins.cc b/storage/innobase/row/row0ins.cc
+index 8385bcae..0d8ae8aa 100644
+--- a/storage/innobase/row/row0ins.cc
++++ b/storage/innobase/row/row0ins.cc
+@@ -483,7 +483,9 @@ row_ins_cascade_calc_update_vec(
+                        const upd_field_t*      parent_ufield
+                                = &parent_update->fields[j];
+ 
+-                       if (parent_ufield->field_no == parent_field_no) {
++                       if (parent_ufield->field_no == parent_field_no
++                           && !(parent_ufield->new_val.type.prtype
++                                & DATA_VIRTUAL)) {
+ 
+                                ulint                   min_size;
+                                const dict_col_t*       col;
+-- 
+2.40.0
+