commit 77af18b679371d34959a6eb10eb5f0d5e1948054 (origin/5.7-pxc-2537, 5.7-pxc-2537)
Author: Kenn Takara <kenn.takara@percona.com>
Date: Sun May 12 22:14:41 2019 -0700

: Nodes crash after using mysqladmin password command

Issue
The mysqladmin command uses "ALTER USER USER()" to change the password.
This will crash replica nodes since they are running on an applier
thread instead of a client thread (and thus have no SQL user).

Solution
There was a previous patch to have the server reject commands that
use USER()/CURRENT_USER(). However, this will cause the password
command in mysqladmin to fail. This patch adds an option "--use-set-password"
that will force mysqladmin to use "SET PASSWORD" instead of "ALTER USER"
to set the password, thereby bypassing the USER/CURRENT_USER issue.

The original crash is fixed (by blocking user of USER/CURRENT_USER function in command). So the user shouldn't hit the issue/crash.

As far as mysqladmin use-case is concerned, given there is an alternative to execute the same command that works I would recommend asking a user to use the said alternative till upstream fix the original issue.

The current 5.6/5.7 mysqladmin uses ALTER USER USER() to change the password (for versions >= 5.7)

We can change this to SET PASSWORD or SELECT USER()/CURRENT_USER(); ALTER USER <user>@<host> , to avoid statements that replicate with USER/CURRENT_USER.

1. We have fixed this in server to raise an error when it encounters the usage of function like USER/CURRENT_USER. This should take care of returning an error for all clients (including mysqladmin).

2. From escalation notes, I am not sure what fix support is expecting other than this in mysqladmin. Will sync with support.

Eventually, MySQL re-writes the query but TOI replication happens way before this.

So either we need to delay TOI replication for all such use-cases (code pollution) or we execute MySQL flow beforehand as part of TOI.

Latter approach is a way to go but MySQL does N different action (including validation, privilege checks, etc..). So not a simple one and if we initiate it changes will put us bit out of way from upstream (causing eventual conflict issues). So we wanted to wait for upstream to solve it so we all have same flow.