PXB-3804 : Detect cyclic FIL_PAGE_NEXT chains in --check-tables with a visited-page set

btr_validate_level() scans a level left to right via FIL_PAGE_NEXT. On a
self-consistent cycle the back-link and bounds checks pass, the key-order check
reports but does not stop, and check-tables runs with trx=nullptr so
trx_is_interrupted() never fires -- so --check-tables hung forever.

Track the pages already visited on the level in a std::unordered_set: a page can
appear only once per level, so revisiting one means the sibling links loop. Only
the page number is recorded, and only when a page becomes the current page (once
per left->right step), so re-reads/re-latches during the scan are never
re-inserted, and the root re-descended for other subtrees is a separate per-level
pass with its own set. Detection is at the first revisit (one loop around).

Test: sibling_link_cycle.

https://perconadev.atlassian.net/browse/PXB-3804

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: satya-bodapati

storage/innobase/btr/btr0btr.cc

@@ -35,6 +35,7 @@ this program; if not, write to the Free Software Foundation, Inc.,
 #include "btr0btr.h"
 
 #include <sys/types.h>
+#include <unordered_set>
 
 #ifndef UNIV_HOTBACKUP
 #include "btr0cur.h"
@@ -4325,9 +4326,33 @@ static bool btr_validate_level(
     seg -= PAGE_BTR_SEG_TOP - PAGE_BTR_SEG_LEAF;
   }
 
+#ifdef XTRABACKUP
+  /* Detect a cyclic FIL_PAGE_NEXT chain on this level. A page can appear only
+     once on a level, so revisiting one means the sibling links loop back.
+     Without this the scan never terminates: on a self-consistent cycle the
+     back-link and bounds checks pass, the key-order check reports but does not
+     stop, and check-tables runs with trx=nullptr so trx_is_interrupted() never
+     fires. Only the page number is stored, and only when a page becomes the
+     current page (once per left->right step) -- re-reads/re-latches of a page
+     during this iteration are never re-inserted, and the root re-descended for
+     other subtrees belongs to a different (per-level) call with its own set. */
+  std::unordered_set<page_no_t> seen_pages;
+#endif /* XTRABACKUP */
+
   do {
     ulint cur_page_no;
     mem_heap_empty(heap);
+#ifdef XTRABACKUP
+    if (!seen_pages.insert(block->page.id.page_no()).second) {
+      btr_validate_report1(index, level, block);
+      ib::error() << "B-tree corruption: page " << block->page.id.page_no()
+                  << " revisited on level " << level << " of index "
+                  << index->name() << " -- FIL_PAGE_NEXT chain forms a cycle";
+      ret = false;
+      right_page_no = FIL_NULL;
+      goto node_ptr_fails;
+    }
+#endif /* XTRABACKUP */
     offsets = offsets2 = nullptr;
     if (!srv_read_only_mode) {
       if (lockout) {

storage/innobase/xtrabackup/test/suites/check_tables/sibling_link_cycle.sh

@@ -0,0 +1,85 @@
+############################################################################
+# PXB-3804 : --check-tables must not hang on a cyclic sibling chain.
+#
+# Theory (Gap 2): btr_validate_level() scans a level left->right via
+# FIL_PAGE_NEXT with NO visited tracking and NO iteration bound. The existing
+# guards do not stop a *consistent, in-bounds* cycle:
+#   * btr_page_no_in_bounds  -> only rejects out-of-tablespace page numbers
+#   * page_is_empty          -> only the all-zero FIL_PAGE_NEXT=0 case
+#   * back-link check        -> only inconsistent prev/next
+#   * key-order check        -> sets ret=false but does NOT stop the loop
+# check-tables passes trx=nullptr, so trx_is_interrupted() never breaks out.
+#
+# Repro: make the two leftmost leaves a closed cycle A<->B:
+#   A.next=B (orig), B.prev=A (orig), and corrupt B.next=A, A.prev=B.
+# The scan starts at A (the descent target), so there is no entry edge whose
+# back-link could be checked, and A.next=B / B.next=A are mutually consistent.
+# Expectation BEFORE fix: infinite loop -> timeout. AFTER fix: the bounded
+# scan reports the cycle and exits non-zero.
+############################################################################
+
+. inc/common.sh
+
+start_server --innodb_file_per_table
+
+mysql test <<'EOF'
+SET SESSION cte_max_recursion_depth = 20000;
+CREATE TABLE t1 (id INT PRIMARY KEY, pad VARCHAR(100));
+INSERT INTO t1
+WITH RECURSIVE seq(n) AS (SELECT 1 UNION ALL SELECT n + 1 FROM seq WHERE n < 5000)
+SELECT n, CONCAT('p', n) FROM seq;
+EOF
+
+xtrabackup --backup --target-dir=$topdir/backup
+xtrabackup --prepare --apply-log-only --target-dir=$topdir/backup
+IBD=$topdir/backup/test/t1.ibd
+
+PAGE_SIZE=$(get_page_size "$IBD")
+
+# leftmost leaf A (FIL_PAGE_PREV == FIL_NULL) and its right sibling B.
+read A B <<< "$(find_leftmost_leaf "$IBD")"
+[ "$A" != "NONE" ] && [ "$B" != "4294967295" ] || \
+  die "need a leftmost leaf with a right sibling (got '$A' '$B')"
+vlog "leftmost leaf A=$A, right sibling B=$B"
+
+#
+# Control: clean backup passes.
+#
+vlog "=== Control: clean --check-tables ==="
+cp -r $topdir/backup $topdir/backup_ctrl
+xtrabackup --prepare --check-tables --target-dir=$topdir/backup_ctrl 2>&1 \
+  | tee $topdir/ctrl.log
+grep -q "All table checks passed" $topdir/ctrl.log || \
+  die "Control: clean backup unexpectedly failed --check-tables"
+vlog "Control passed"
+
+#
+# Negative: close the A<->B cycle (A.prev=B, B.next=A).
+#  FIL_PAGE_PREV offset = 8, FIL_PAGE_NEXT offset = 12 (4 bytes each).
+#
+vlog "=== Negative: make sibling chain a cycle A<->B ==="
+cp -r $topdir/backup $topdir/backup_bad
+CIBD=$topdir/backup_bad/test/t1.ibd
+mach_write_n "$CIBD" "$A" 8  "$B" 4    # A.FIL_PAGE_PREV = B
+mach_write_n "$CIBD" "$B" 12 "$A" 4    # B.FIL_PAGE_NEXT = A
+
+SIZE_BEFORE=$(stat -c %s "$CIBD")
+set +e
+timeout 90 $XB_BIN $XB_ARGS --prepare --check-tables \
+  --innodb-checksum-algorithm=none \
+  --target-dir=$topdir/backup_bad 2>&1 | tee $topdir/bad.log
+RC=${PIPESTATUS[0]}
+set -e
+SIZE_AFTER=$(stat -c %s "$CIBD")
+vlog "check-tables exit code: $RC"
+
+[ "$RC" -ne 124 ] || die "sibling_link_cycle: --check-tables HUNG on a cyclic sibling chain"
+grep -qiE "Assertion failure|got signal|ut_error|ib::fatal triggered" $topdir/bad.log && \
+  die "sibling_link_cycle: --check-tables ABORTED"
+[ "$SIZE_AFTER" = "$SIZE_BEFORE" ] || \
+  die "sibling_link_cycle: .ibd grew during --check-tables ($SIZE_BEFORE -> $SIZE_AFTER)"
+[ "$RC" -ne 0 ] || die "sibling_link_cycle: --check-tables passed a cyclic sibling chain"
+grep -qiE "cycle|too many pages|sibling|Table check failed" $topdir/bad.log || \
+  die "sibling_link_cycle: corruption not reported"
+
+vlog "sibling_link_cycle passed: cyclic sibling chain reported gracefully (rc=$RC)"