Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit391f08f

Browse files
committed
Fix corruption due to vacuum_defer_cleanup_age underflowing 64bit xids
When vacuum_defer_cleanup_age is bigger than the current xid, including theepoch, the subtraction of vacuum_defer_cleanup_age would lead to a wrappedaround xid. While that normally is not a problem, the subsequent conversion toa 64bit xid results in a 64bit-xid very far into the future. As that xid isused as a horizon to detect whether rows versions are old enough to beremoved, that allows removal of rows that are still visible (i.e. corruption).If vacuum_defer_cleanup_age was never changed from the default, there is nochance of this bug occurring.This bug was introduced indc7420c. A lesser version of it exists in12-13, introduced byfb5344c, affecting only GiST.The 12-13 version of the issue can, in rare cases, lead to pages in a gistindex getting recycled too early, potentially causing index entries to befound multiple times.The fix is fairly simple - don't allow vacuum_defer_cleanup_age to retreatfurther than FirstNormalTransactionId.Patches to make similar bugs easier to find, by adding asserts to the 64bitxid infrastructure, have been proposed, but are not suitable for backpatching.Currently there are no tests for vacuum_defer_cleanup_age. A patch introducinginfrastructure to make writing a test easier has been posted to the list.Reported-by: Michail Nikolaev <michail.nikolaev@gmail.com>Reviewed-by: Matthias van de Meent <boekewurm+postgres@gmail.com>Author: Andres Freund <andres@anarazel.de>Discussion:https://postgr.es/m/20230108002923.cyoser3ttmt63bfn@awork3.anarazel.deBackpatch: 12-, but impact/fix is smaller for 12-13
1 parent76d2177 commit391f08f

File tree

1 file changed

+73
-12
lines changed

1 file changed

+73
-12
lines changed

‎src/backend/storage/ipc/procarray.c

Lines changed: 73 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -366,6 +366,9 @@ static inline void ProcArrayEndTransactionInternal(PGPROC *proc, TransactionId l
366366
staticvoidProcArrayGroupClearXid(PGPROC*proc,TransactionIdlatestXid);
367367
staticvoidMaintainLatestCompletedXid(TransactionIdlatestXid);
368368
staticvoidMaintainLatestCompletedXidRecovery(TransactionIdlatestXid);
369+
staticvoidTransactionIdRetreatSafely(TransactionId*xid,
370+
intretreat_by,
371+
FullTransactionIdrel);
369372

370373
staticinlineFullTransactionIdFullXidRelativeTo(FullTransactionIdrel,
371374
TransactionIdxid);
@@ -1892,17 +1895,35 @@ ComputeXidHorizons(ComputeXidHorizonsResult *h)
18921895
* so guc.c should limit it to no more than the xidStopLimit threshold
18931896
* in varsup.c. Also note that we intentionally don't apply
18941897
* vacuum_defer_cleanup_age on standby servers.
1898+
*
1899+
* Need to use TransactionIdRetreatSafely() instead of open-coding the
1900+
* subtraction, to prevent creating an xid before
1901+
* FirstNormalTransactionId.
18951902
*/
1896-
h->oldest_considered_running=
1897-
TransactionIdRetreatedBy(h->oldest_considered_running,
1898-
vacuum_defer_cleanup_age);
1899-
h->shared_oldest_nonremovable=
1900-
TransactionIdRetreatedBy(h->shared_oldest_nonremovable,
1901-
vacuum_defer_cleanup_age);
1902-
h->data_oldest_nonremovable=
1903-
TransactionIdRetreatedBy(h->data_oldest_nonremovable,
1904-
vacuum_defer_cleanup_age);
1905-
/* defer doesn't apply to temp relations */
1903+
Assert(TransactionIdPrecedesOrEquals(h->oldest_considered_running,
1904+
h->shared_oldest_nonremovable));
1905+
Assert(TransactionIdPrecedesOrEquals(h->shared_oldest_nonremovable,
1906+
h->data_oldest_nonremovable));
1907+
1908+
if (vacuum_defer_cleanup_age>0)
1909+
{
1910+
TransactionIdRetreatSafely(&h->oldest_considered_running,
1911+
vacuum_defer_cleanup_age,
1912+
h->latest_completed);
1913+
TransactionIdRetreatSafely(&h->shared_oldest_nonremovable,
1914+
vacuum_defer_cleanup_age,
1915+
h->latest_completed);
1916+
TransactionIdRetreatSafely(&h->data_oldest_nonremovable,
1917+
vacuum_defer_cleanup_age,
1918+
h->latest_completed);
1919+
/* defer doesn't apply to temp relations */
1920+
1921+
1922+
Assert(TransactionIdPrecedesOrEquals(h->oldest_considered_running,
1923+
h->shared_oldest_nonremovable));
1924+
Assert(TransactionIdPrecedesOrEquals(h->shared_oldest_nonremovable,
1925+
h->data_oldest_nonremovable));
1926+
}
19061927
}
19071928

19081929
/*
@@ -2474,8 +2495,10 @@ GetSnapshotData(Snapshot snapshot)
24742495
oldestfxid=FullXidRelativeTo(latest_completed,oldestxid);
24752496

24762497
/* apply vacuum_defer_cleanup_age */
2477-
def_vis_xid_data=
2478-
TransactionIdRetreatedBy(xmin,vacuum_defer_cleanup_age);
2498+
def_vis_xid_data=xmin;
2499+
TransactionIdRetreatSafely(&def_vis_xid_data,
2500+
vacuum_defer_cleanup_age,
2501+
oldestfxid);
24792502

24802503
/* Check whether there's a replication slot requiring an older xmin. */
24812504
def_vis_xid_data=
@@ -4294,6 +4317,44 @@ GlobalVisCheckRemovableXid(Relation rel, TransactionId xid)
42944317
returnGlobalVisTestIsRemovableXid(state,xid);
42954318
}
42964319

4320+
/*
4321+
* Safely retract *xid by retreat_by, store the result in *xid.
4322+
*
4323+
* Need to be careful to prevent *xid from retreating below
4324+
* FirstNormalTransactionId during epoch 0. This is important to prevent
4325+
* generating xids that cannot be converted to a FullTransactionId without
4326+
* wrapping around.
4327+
*
4328+
* If retreat_by would lead to a too old xid, FirstNormalTransactionId is
4329+
* returned instead.
4330+
*/
4331+
staticvoid
4332+
TransactionIdRetreatSafely(TransactionId*xid,intretreat_by,FullTransactionIdrel)
4333+
{
4334+
TransactionIdoriginal_xid=*xid;
4335+
FullTransactionIdfxid;
4336+
uint64fxid_i;
4337+
4338+
Assert(TransactionIdIsNormal(original_xid));
4339+
Assert(retreat_by >=0);/* relevant GUCs are stored as ints */
4340+
AssertTransactionIdInAllowableRange(original_xid);
4341+
4342+
if (retreat_by==0)
4343+
return;
4344+
4345+
fxid=FullXidRelativeTo(rel,original_xid);
4346+
fxid_i=U64FromFullTransactionId(fxid);
4347+
4348+
if ((fxid_i-FirstNormalTransactionId) <=retreat_by)
4349+
*xid=FirstNormalTransactionId;
4350+
else
4351+
{
4352+
*xid=TransactionIdRetreatedBy(original_xid,retreat_by);
4353+
Assert(TransactionIdIsNormal(*xid));
4354+
Assert(NormalTransactionIdPrecedes(*xid,original_xid));
4355+
}
4356+
}
4357+
42974358
/*
42984359
* Convert a 32 bit transaction id into 64 bit transaction id, by assuming it
42994360
* is within MaxTransactionId / 2 of XidFromFullTransactionId(rel).

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp