Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit3b8981b

Browse files
committed
Fix race in Parallel Hash Join batch cleanup.
With very unlucky timing and parallel_leader_participation off, PHJcould attempt to access per-batch state just as it was being freed.There was code intended to prevent that by checking for a clearedpointer, but it was buggy.Fix, by introducing an extra barrier phase. The new phasePHJ_BUILD_RUNNING means that it's safe to access the per-batch state tofind a batch to help with, and PHJ_BUILD_DONE means that it is too late.The last to detach will free the array of per-batch state as before, butnow it will also atomically advance the phase at the same time, so thatlate attachers can avoid the hazard, without the data race. Thismirrors the way per-batch hash tables are freed (see phasesPHJ_BATCH_PROBING and PHJ_BATCH_DONE).Revealed by a one-off build farm failure, where BarrierAttach() failed asanity check assertion, because the memory had been clobbered bydsa_free().Back-patch to 11, where the code arrived.Reported-by: Michael Paquier <michael@paquier.xyz>Discussion:https://postgr.es/m/20200929061142.GA29096%40paquier.xyz
1 parent3792959 commit3b8981b

File tree

3 files changed

+58
-32
lines changed

3 files changed

+58
-32
lines changed

‎src/backend/executor/nodeHash.c

Lines changed: 32 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -333,14 +333,21 @@ MultiExecParallelHash(HashState *node)
333333
hashtable->nbuckets=pstate->nbuckets;
334334
hashtable->log2_nbuckets=my_log2(hashtable->nbuckets);
335335
hashtable->totalTuples=pstate->total_tuples;
336-
ExecParallelHashEnsureBatchAccessors(hashtable);
336+
337+
/*
338+
* Unless we're completely done and the batch state has been freed, make
339+
* sure we have accessors.
340+
*/
341+
if (BarrierPhase(build_barrier)<PHJ_BUILD_DONE)
342+
ExecParallelHashEnsureBatchAccessors(hashtable);
337343

338344
/*
339345
* The next synchronization point is in ExecHashJoin's HJ_BUILD_HASHTABLE
340-
* case, which will bring the build phase toPHJ_BUILD_DONE (if it isn't
346+
* case, which will bring the build phase toPHJ_BUILD_RUNNING (if it isn't
341347
* there already).
342348
*/
343349
Assert(BarrierPhase(build_barrier)==PHJ_BUILD_HASHING_OUTER||
350+
BarrierPhase(build_barrier)==PHJ_BUILD_RUNNING||
344351
BarrierPhase(build_barrier)==PHJ_BUILD_DONE);
345352
}
346353

@@ -624,7 +631,7 @@ ExecHashTableCreate(HashState *state, List *hashOperators, List *hashCollations,
624631
/*
625632
* The next Parallel Hash synchronization point is in
626633
* MultiExecParallelHash(), which will progress it all the way to
627-
*PHJ_BUILD_DONE. The caller must not return control from this
634+
*PHJ_BUILD_RUNNING. The caller must not return control from this
628635
* executor node between now and then.
629636
*/
630637
}
@@ -3048,14 +3055,11 @@ ExecParallelHashEnsureBatchAccessors(HashJoinTable hashtable)
30483055
}
30493056

30503057
/*
3051-
* It's possible for a backend to start up very late so that the whole
3052-
* join is finished and the shm state for tracking batches has already
3053-
* been freed by ExecHashTableDetach(). In that case we'll just leave
3054-
* hashtable->batches as NULL so that ExecParallelHashJoinNewBatch() gives
3055-
* up early.
3058+
* We should never see a state where the batch-tracking array is freed,
3059+
* because we should have given up sooner if we join when the build barrier
3060+
* has reached the PHJ_BUILD_DONE phase.
30563061
*/
3057-
if (!DsaPointerIsValid(pstate->batches))
3058-
return;
3062+
Assert(DsaPointerIsValid(pstate->batches));
30593063

30603064
/* Use hash join memory context. */
30613065
oldcxt=MemoryContextSwitchTo(hashtable->hashCxt);
@@ -3175,9 +3179,17 @@ ExecHashTableDetachBatch(HashJoinTable hashtable)
31753179
void
31763180
ExecHashTableDetach(HashJoinTablehashtable)
31773181
{
3178-
if (hashtable->parallel_state)
3182+
ParallelHashJoinState*pstate=hashtable->parallel_state;
3183+
3184+
/*
3185+
* If we're involved in a parallel query, we must either have got all the
3186+
* way to PHJ_BUILD_RUNNING, or joined too late and be in PHJ_BUILD_DONE.
3187+
*/
3188+
Assert(!pstate||
3189+
BarrierPhase(&pstate->build_barrier) >=PHJ_BUILD_RUNNING);
3190+
3191+
if (pstate&&BarrierPhase(&pstate->build_barrier)==PHJ_BUILD_RUNNING)
31793192
{
3180-
ParallelHashJoinState*pstate=hashtable->parallel_state;
31813193
inti;
31823194

31833195
/* Make sure any temporary files are closed. */
@@ -3193,17 +3205,22 @@ ExecHashTableDetach(HashJoinTable hashtable)
31933205
}
31943206

31953207
/* If we're last to detach, clean up shared memory. */
3196-
if (BarrierDetach(&pstate->build_barrier))
3208+
if (BarrierArriveAndDetach(&pstate->build_barrier))
31973209
{
3210+
/*
3211+
* Late joining processes will see this state and give up
3212+
* immediately.
3213+
*/
3214+
Assert(BarrierPhase(&pstate->build_barrier)==PHJ_BUILD_DONE);
3215+
31983216
if (DsaPointerIsValid(pstate->batches))
31993217
{
32003218
dsa_free(hashtable->area,pstate->batches);
32013219
pstate->batches=InvalidDsaPointer;
32023220
}
32033221
}
3204-
3205-
hashtable->parallel_state=NULL;
32063222
}
3223+
hashtable->parallel_state=NULL;
32073224
}
32083225

32093226
/*

‎src/backend/executor/nodeHashjoin.c

Lines changed: 24 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,8 @@
4545
* PHJ_BUILD_ALLOCATING -- one sets up the batches and table 0
4646
* PHJ_BUILD_HASHING_INNER -- all hash the inner rel
4747
* PHJ_BUILD_HASHING_OUTER -- (multi-batch only) all hash the outer
48-
* PHJ_BUILD_DONE -- building done, probing can begin
48+
* PHJ_BUILD_RUNNING -- building done, probing can begin
49+
* PHJ_BUILD_DONE -- all work complete, one frees batches
4950
*
5051
* While in the phase PHJ_BUILD_HASHING_INNER a separate pair of barriers may
5152
* be used repeatedly as required to coordinate expansions in the number of
@@ -73,7 +74,7 @@
7374
* batches whenever it encounters them while scanning and probing, which it
7475
* can do because it processes batches in serial order.
7576
*
76-
* OncePHJ_BUILD_DONE is reached, backends then split up and process
77+
* OncePHJ_BUILD_RUNNING is reached, backends then split up and process
7778
* different batches, or gang up and work together on probing batches if there
7879
* aren't enough to go around. For each batch there is a separate barrier
7980
* with the following phases:
@@ -95,11 +96,16 @@
9596
*
9697
* To avoid deadlocks, we never wait for any barrier unless it is known that
9798
* all other backends attached to it are actively executing the node or have
98-
* already arrived. Practically, that means that we never return a tuple
99-
* while attached to a barrier, unless the barrier has reached its final
100-
* state. In the slightly special case of the per-batch barrier, we return
101-
* tuples while in PHJ_BATCH_PROBING phase, but that's OK because we use
102-
* BarrierArriveAndDetach() to advance it to PHJ_BATCH_DONE without waiting.
99+
* finished. Practically, that means that we never emit a tuple while attached
100+
* to a barrier, unless the barrier has reached a phase that means that no
101+
* process will wait on it again. We emit tuples while attached to the build
102+
* barrier in phase PHJ_BUILD_RUNNING, and to a per-batch barrier in phase
103+
* PHJ_BATCH_PROBING. These are advanced to PHJ_BUILD_DONE and PHJ_BATCH_DONE
104+
* respectively without waiting, using BarrierArriveAndDetach(). The last to
105+
* detach receives a different return value so that it knows that it's safe to
106+
* clean up. Any straggler process that attaches after that phase is reached
107+
* will see that it's too late to participate or access the relevant shared
108+
* memory objects.
103109
*
104110
*-------------------------------------------------------------------------
105111
*/
@@ -317,6 +323,7 @@ ExecHashJoinImpl(PlanState *pstate, bool parallel)
317323

318324
build_barrier=&parallel_state->build_barrier;
319325
Assert(BarrierPhase(build_barrier)==PHJ_BUILD_HASHING_OUTER||
326+
BarrierPhase(build_barrier)==PHJ_BUILD_RUNNING||
320327
BarrierPhase(build_barrier)==PHJ_BUILD_DONE);
321328
if (BarrierPhase(build_barrier)==PHJ_BUILD_HASHING_OUTER)
322329
{
@@ -329,9 +336,18 @@ ExecHashJoinImpl(PlanState *pstate, bool parallel)
329336
BarrierArriveAndWait(build_barrier,
330337
WAIT_EVENT_HASH_BUILD_HASH_OUTER);
331338
}
332-
Assert(BarrierPhase(build_barrier)==PHJ_BUILD_DONE);
339+
elseif (BarrierPhase(build_barrier)==PHJ_BUILD_DONE)
340+
{
341+
/*
342+
* If we attached so late that the job is finished and
343+
* the batch state has been freed, we can return
344+
* immediately.
345+
*/
346+
returnNULL;
347+
}
333348

334349
/* Each backend should now select a batch to work on. */
350+
Assert(BarrierPhase(build_barrier)==PHJ_BUILD_RUNNING);
335351
hashtable->curbatch=-1;
336352
node->hj_JoinState=HJ_NEED_NEW_BATCH;
337353

@@ -1090,14 +1106,6 @@ ExecParallelHashJoinNewBatch(HashJoinState *hjstate)
10901106
intstart_batchno;
10911107
intbatchno;
10921108

1093-
/*
1094-
* If we started up so late that the batch tracking array has been freed
1095-
* already by ExecHashTableDetach(), then we are finished. See also
1096-
* ExecParallelHashEnsureBatchAccessors().
1097-
*/
1098-
if (hashtable->batches==NULL)
1099-
return false;
1100-
11011109
/*
11021110
* If we were already attached to a batch, remember not to bother checking
11031111
* it again, and detach from it (possibly freeing the hash table if we are

‎src/include/executor/hashjoin.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,8 @@ typedef struct ParallelHashJoinState
258258
#definePHJ_BUILD_ALLOCATING1
259259
#definePHJ_BUILD_HASHING_INNER2
260260
#definePHJ_BUILD_HASHING_OUTER3
261-
#definePHJ_BUILD_DONE4
261+
#definePHJ_BUILD_RUNNING4
262+
#definePHJ_BUILD_DONE5
262263

263264
/* The phases for probing each batch, used by for batch_barrier. */
264265
#definePHJ_BATCH_ELECTING0

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp