Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit080ad91

Browse files
committed
Fix dangling smgr_owner pointer when a fake relcache entry is freed.
A fake relcache entry can "own" a SmgrRelation object, like a regularrelcache entry. But when it was free'd, the owner field in SmgrRelationwas not cleared, so it was left pointing to free'd memory.Amazingly this apparently hasn't caused crashes in practice, or we would'veheard about it earlier. Andres found this with Valgrind.Report and fix by Andres Freund, with minor modifications by me. Backpatchto all supported versions.
1 parentc7a186e commit080ad91

File tree

3 files changed

+42
-4
lines changed

3 files changed

+42
-4
lines changed

‎src/backend/access/transam/xlogutils.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -421,6 +421,9 @@ CreateFakeRelcacheEntry(RelFileNode rnode)
421421
void
422422
FreeFakeRelcacheEntry(Relationfakerel)
423423
{
424+
/* make sure the fakerel is not referenced by the SmgrRelation anymore */
425+
if (fakerel->rd_smgr!=NULL)
426+
smgrclearowner(&fakerel->rd_smgr,fakerel->rd_smgr);
424427
pfree(fakerel);
425428
}
426429

‎src/backend/storage/smgr/smgr.c

Lines changed: 38 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ static SMgrRelation first_unowned_reln = NULL;
8686

8787
/* local function prototypes */
8888
staticvoidsmgrshutdown(intcode,Datumarg);
89+
staticvoidadd_to_unowned_list(SMgrRelationreln);
8990
staticvoidremove_from_unowned_list(SMgrRelationreln);
9091

9192

@@ -176,9 +177,8 @@ smgropen(RelFileNode rnode, BackendId backend)
176177
for (forknum=0;forknum <=MAX_FORKNUM;forknum++)
177178
reln->md_fd[forknum]=NULL;
178179

179-
/* place it at head of unowned list (to make smgrsetowner cheap) */
180-
reln->next_unowned_reln=first_unowned_reln;
181-
first_unowned_reln=reln;
180+
/* it has no owner yet */
181+
add_to_unowned_list(reln);
182182
}
183183

184184
returnreln;
@@ -193,7 +193,7 @@ smgropen(RelFileNode rnode, BackendId backend)
193193
void
194194
smgrsetowner(SMgrRelation*owner,SMgrRelationreln)
195195
{
196-
/* We don'tcurrentlysupport "disowning" an SMgrRelation here */
196+
/* We don't support "disowning" an SMgrRelation here, use smgrclearowner */
197197
Assert(owner!=NULL);
198198

199199
/*
@@ -215,6 +215,40 @@ smgrsetowner(SMgrRelation *owner, SMgrRelation reln)
215215
*owner=reln;
216216
}
217217

218+
/*
219+
* smgrclearowner() -- Remove long-lived reference to an SMgrRelation object
220+
* if one exists
221+
*/
222+
void
223+
smgrclearowner(SMgrRelation*owner,SMgrRelationreln)
224+
{
225+
/* Do nothing if the SMgrRelation object is not owned by the owner */
226+
if (reln->smgr_owner!=owner)
227+
return;
228+
229+
/* unset the owner's reference */
230+
*owner=NULL;
231+
232+
/* unset our reference to the owner */
233+
reln->smgr_owner=NULL;
234+
235+
add_to_unowned_list(reln);
236+
}
237+
238+
/*
239+
* add_to_unowned_list -- link an SMgrRelation onto the unowned list
240+
*
241+
* Check remove_from_unowned_list()'s comments for performance
242+
* considerations.
243+
*/
244+
staticvoid
245+
add_to_unowned_list(SMgrRelationreln)
246+
{
247+
/* place it at head of the list (to make smgrsetowner cheap) */
248+
reln->next_unowned_reln=first_unowned_reln;
249+
first_unowned_reln=reln;
250+
}
251+
218252
/*
219253
* remove_from_unowned_list -- unlink an SMgrRelation from the unowned list
220254
*

‎src/include/storage/smgr.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ extern void smgrinit(void);
8282
externSMgrRelationsmgropen(RelFileNodernode,BackendIdbackend);
8383
externboolsmgrexists(SMgrRelationreln,ForkNumberforknum);
8484
externvoidsmgrsetowner(SMgrRelation*owner,SMgrRelationreln);
85+
externvoidsmgrclearowner(SMgrRelation*owner,SMgrRelationreln);
8586
externvoidsmgrclose(SMgrRelationreln);
8687
externvoidsmgrcloseall(void);
8788
externvoidsmgrclosenode(RelFileNodeBackendrnode);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp