From 31534a03d4ff587f50d42431a2be109bba56dfad Mon Sep 17 00:00:00 2001
From: Daniel Black <daniel@mariadb.org>
Date: Mon, 25 May 2026 15:14:22 +1000
Subject: [PATCH] MDEV-33170: ASAN errors upon CONVERT TABLE TO PARTITION with
 query cache

The ALTER TABLE.. CONVERT TABLE TO invalided the table cache of the
previously normal table that was moved and which left the query cache refering
to a removed table by the time it was invalidated after the ALTER.

Let's invalidate the query cache at the beginning of the fast path for
all variants of the ALTER TABLE (partitioning).

This prevents a use after free ASAN error that was previous there when the
query_cache_invalidate was use on the source table that was freed from the
table cache.

Alternates considered:
* A query cache invalidate early CONVERT_IN and leave the
  fast_end_partition invalidate - still results in ASAN assertion.
* A fast_end_partition with an argument to skip QC clear -
  seemed to treat this special ALTER TABLE too specially.
---
 mysql-test/main/partition_alter.result | 12 ++++++++++++
 mysql-test/main/partition_alter.test   | 17 +++++++++++++++++
 sql/sql_partition.cc                   |  4 ++--
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/mysql-test/main/partition_alter.result b/mysql-test/main/partition_alter.result
index c0a59588a3a0e..048f2a5ae4ffe 100644
--- a/mysql-test/main/partition_alter.result
+++ b/mysql-test/main/partition_alter.result
@@ -415,4 +415,16 @@ Level	Code	Message
 Error	1845	ALGORITHM=NOCOPY is not supported for this operation. Try ALGORITHM=INPLACE
 drop table t1par;
 set alter_algorithm=@old_alter_algorithm;
+#
+# MDEV-33170 ASAN errors upon CONVERT TABLE TO PARTITION with query cache
+#
+SET @qcache= @@global.query_cache_type;
+SET GLOBAL query_cache_type= 1;
+CREATE TABLE t (a INT) PARTITION BY LIST (a) (PARTITION p0 VALUES IN (1));
+CREATE TABLE t1 (a INT);
+ALTER TABLE t CONVERT TABLE t1 TO PARTITION pn VALUES IN (2);
+DROP TABLE IF EXISTS t1, t;
+Warnings:
+Note	1051	Unknown table 'test.t1'
+SET GLOBAL query_cache_type= @qcache;
 # End of 10.11 tests
diff --git a/mysql-test/main/partition_alter.test b/mysql-test/main/partition_alter.test
index b5e9defb4b18a..b3d65502558d6 100644
--- a/mysql-test/main/partition_alter.test
+++ b/mysql-test/main/partition_alter.test
@@ -1,5 +1,6 @@
 --source include/have_innodb.inc
 --source include/have_partition.inc
+--source include/have_query_cache.inc
 
 CREATE TABLE `test_data` (
        `hid` bigint(20) unsigned NOT NULL,
@@ -348,4 +349,20 @@ show warnings;
 drop table t1par;
 set alter_algorithm=@old_alter_algorithm;
 
+
+--echo #
+--echo # MDEV-33170 ASAN errors upon CONVERT TABLE TO PARTITION with query cache
+--echo #
+
+SET @qcache= @@global.query_cache_type;
+SET GLOBAL query_cache_type= 1;
+
+CREATE TABLE t (a INT) PARTITION BY LIST (a) (PARTITION p0 VALUES IN (1));
+CREATE TABLE t1 (a INT);
+ALTER TABLE t CONVERT TABLE t1 TO PARTITION pn VALUES IN (2);
+
+# Cleanup
+DROP TABLE IF EXISTS t1, t;
+SET GLOBAL query_cache_type= @qcache;
+
 --echo # End of 10.11 tests
diff --git a/sql/sql_partition.cc b/sql/sql_partition.cc
index bda2282efd465..efaeed530b078 100644
--- a/sql/sql_partition.cc
+++ b/sql/sql_partition.cc
@@ -4631,8 +4631,6 @@ static int fast_end_partition(THD *thd, ulonglong copied,
 
   thd->proc_info="end";
 
-  query_cache_invalidate3(thd, table_list, 0);
-
   my_snprintf(tmp_name, sizeof(tmp_name), ER_THD(thd, ER_INSERT_INFO),
               (ulong) (copied + deleted),
               (ulong) deleted,
@@ -7530,6 +7528,8 @@ uint fast_alter_partition_table(THD *thd, TABLE *table,
   lpt->pack_frm_data= NULL;
   lpt->pack_frm_len= 0;
 
+  query_cache_invalidate3(thd, table_list, 0);
+
   /* Add IF EXISTS to binlog if shared table */
   if (table->file->partition_ht()->flags & HTON_TABLE_MAY_NOT_EXIST_ON_SLAVE)
     thd->variables.option_bits|= OPTION_IF_EXISTS;