- Notifications
You must be signed in to change notification settings - Fork5.2k
Commitec96e88
committed
Fix use-after-free with INSERT ON CONFLICT changes in reorderbuffer.c
In ReorderBufferProcessTXN(), used to send the data of a transaction toan output plugin, INSERT ON CONFLICT changes (INTERNAL_SPEC_INSERT) aredelayed until a confirmation record arrives (INTERNAL_SPEC_CONFIRM),updating the change being processed.8c58624 has added an extra step after processing a change to updatethe progress of the transaction, by calling the callbackupdate_progress_txn() based on the LSN stored in a change after athreshold of CHANGES_THRESHOLD (100) is reached. This logic has missedthe fact that for an INSERT ON CONFLICT change the data is freed onceprocessed, hence update_progress_txn() could be called pointing to a LSNvalue that's already been freed. This could result in random crashes,depending on the workload.Per discussion, this issue is fixed by reusing in update_progress_txn()the LSN from the change processed found at the beginning of the loop,meaning that for a INTERNAL_SPEC_CONFIRM change the progress is updatedusing the LSN of the INTERNAL_SPEC_CONFIRM change, and not the LSN fromits INTERNAL_SPEC_INSERT change. This is actually more correct, as wewant to update the progress to point to the INTERNAL_SPEC_CONFIRMchange.Masahiko Sawada has found a nice trick to reproduce the issue: hardcodeCHANGES_THRESHOLD at 1 and run test_decoding (test "ddl" being enough)on an instance running valgrind. The bug has been analyzed by EthanMertz, who also originally suggested the solution used in this patch.Issue introduced by8c58624, so backpatch down to v16.Author: Ethan Mertz <ethan.mertz@gmail.com>Co-authored-by: Michael Paquier <michael@paquier.xyz>Reviewed-by: Amit Kapila <amit.kapila16@gmail.com>Reviewed-by: Masahiko Sawada <sawada.mshk@gmail.com>Discussion:https://postgr.es/m/aIsQqDZ7x4LAQ6u1@paquier.xyzBackpatch-through: 161 parentb998ce3 commitec96e88
1 file changed
+1
-1
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2480 | 2480 | | |
2481 | 2481 | | |
2482 | 2482 | | |
2483 | | - | |
| 2483 | + | |
2484 | 2484 | | |
2485 | 2485 | | |
2486 | 2486 | | |
| |||
0 commit comments
Comments
(0)