Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit6c0fb94

Browse files
committed
Fix race in dsm_attach() when handles are reused.
DSM handle values can be reused as soon as the underlying shared memoryobject has been destroyed. That means that for a brief moment wemight have two DSM slots with the same handle. While trying to attach,if we encounter a slot with refcnt == 1, meaning that it is currentlybeing destroyed, we should continue our search in case the same handleexists in another slot.The race manifested as a rare "dsa_area could not attach to segment"error, and was more likely in 10 and 11 due to the lack of distinctseed for random() in parallel workers. It was made very unlikely inin master by commit197e4af, and older releases don't usually createnew DSM segments in background workers so it was also unlikely there.This fixes the root cause of bug report #15585, in which the errorcould also sometimes result in a self-deadlock in the error path.It's not yet clear if further changes are needed to avoid that failuremode.Back-patch to 9.4, where dsm.c arrived.Author: Thomas MunroReported-by: Justin Pryzby, Sergei KornilovDiscussion:https://postgr.es/m/20190207014719.GJ29720@telsasoft.comDiscussion:https://postgr.es/m/15585-324ff6a93a18da46@postgresql.org
1 parent8fd3fdd commit6c0fb94

File tree

1 file changed

+8
-10
lines changed
  • src/backend/storage/ipc

1 file changed

+8
-10
lines changed

‎src/backend/storage/ipc/dsm.c

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -569,22 +569,20 @@ dsm_attach(dsm_handle h)
569569
nitems=dsm_control->nitems;
570570
for (i=0;i<nitems;++i)
571571
{
572-
/* If the reference count is 0, the slot is actually unused. */
573-
if (dsm_control->item[i].refcnt==0)
572+
/*
573+
* If the reference count is 0, the slot is actually unused. If the
574+
* reference count is 1, the slot is still in use, but the segment is
575+
* in the process of going away; even if the handle matches, another
576+
* slot may already have started using the same handle value by
577+
* coincidence so we have to keep searching.
578+
*/
579+
if (dsm_control->item[i].refcnt <=1)
574580
continue;
575581

576582
/* If the handle doesn't match, it's not the slot we want. */
577583
if (dsm_control->item[i].handle!=seg->handle)
578584
continue;
579585

580-
/*
581-
* If the reference count is 1, the slot is still in use, but the
582-
* segment is in the process of going away. Treat that as if we
583-
* didn't find a match.
584-
*/
585-
if (dsm_control->item[i].refcnt==1)
586-
break;
587-
588586
/* Otherwise we've found a match. */
589587
dsm_control->item[i].refcnt++;
590588
seg->control_slot=i;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp