NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commit71d02dc

Richard Guo

committed

Fix unsafe access to BufferDescriptors

When considering a local buffer, the GetBufferDescriptor() call inBufferGetLSNAtomic() would be retrieving a shared buffer with a badbuffer ID. Since the code checks whether the buffer is shared beforeusing the retrieved BufferDesc, this issue did not lead to anymalfunction. Nonetheless this seems like trouble waiting to happen,so fix it by ensuring that GetBufferDescriptor() is only called whenwe know the buffer is shared.Author: Tender Wang <tndrwang@gmail.com>Reviewed-by: Xuneng Zhou <xunengzhou@gmail.com>Reviewed-by: Richard Guo <guofenglinux@gmail.com>Discussion:https://postgr.es/m/CAHewXNku-o46-9cmUgyv6LkSZ25doDrWq32p=oz9kfD8ovVJMg@mail.gmail.comBackpatch-through: 13

1 parentc39392e commit71d02dcCopy full SHA for 71d02dc

File tree

1 file changed

-1

lines changed

src/backend/storage/buffer
- bufmgr.c

1 file changed

-1

lines changed

`‎src/backend/storage/buffer/bufmgr.c`

Lines changed: 2 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -3981,8 +3981,8 @@ BufferIsPermanent(Buffer buffer)`
`3981`	`3981`	`XLogRecPtr`
`3982`	`3982`	`BufferGetLSNAtomic(Bufferbuffer)`
`3983`	`3983`	`{`
`3984`		`-BufferDesc*bufHdr=GetBufferDescriptor(buffer-1);`
`3985`	`3984`	`char*page=BufferGetPage(buffer);`
	`3985`	`+BufferDesc*bufHdr;`
`3986`	`3986`	`XLogRecPtrlsn;`
`3987`	`3987`	`uint32buf_state;`
`3988`	`3988`
`@@ -3996,6 +3996,7 @@ BufferGetLSNAtomic(Buffer buffer)`
`3996`	`3996`	`Assert(BufferIsValid(buffer));`
`3997`	`3997`	`Assert(BufferIsPinned(buffer));`
`3998`	`3998`
	`3999`	`+bufHdr=GetBufferDescriptor(buffer-1);`
`3999`	`4000`	`buf_state=LockBufHdr(bufHdr);`
`4000`	`4001`	`lsn=PageGetLSN(page);`
`4001`	`4002`	`UnlockBufHdr(bufHdr,buf_state);`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit71d02dc

File tree

1 file changed

1 file changed

`‎src/backend/storage/buffer/bufmgr.c`

0 commit comments