Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit1711882

Browse files
committed
Fix transient clobbering of shared buffers during WAL replay.
RestoreBkpBlocks was in the habit of zeroing and refilling the targetbuffer; which was perfectly safe when the code was written, but is unsafeduring Hot Standby operation. The reason is that we have coding rulesthat allow backends to continue accessing a tuple in a heap relation whileholding only a pin on its buffer. Such a backend could see transientlyzeroed data, if WAL replay had occasion to change other data on the page.This has been shown to be the cause of bug #6425 from Duncan Rance (whodeserves kudos for developing a sufficiently-reproducible test case) aswell as Bridget Frey's re-report of bug #6200. It most likely explains theoriginal report as well, though we don't yet have confirmation of that.To fix, change the code so that only bytes that are supposed to change willchange, even transiently. This actually saves cycles in RestoreBkpBlocks,since it's not writing the same bytes twice.Also fix seq_redo, which has the same disease, though it has to work a bitharder to meet the requirement.So far as I can tell, no other WAL replay routines have this type of bug.In particular, the index-related replay routines, which would certainly bebroken if they had to meet the same standard, are not at risk because wedo not have coding rules that allow access to an index page when notholding a buffer lock on it.Back-patch to 9.0 where Hot Standby was added.
1 parentee68a44 commit1711882

File tree

2 files changed

+24
-9
lines changed

2 files changed

+24
-9
lines changed

‎src/backend/access/transam/xlog.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3716,9 +3716,9 @@ RestoreBkpBlocks(XLogRecPtr lsn, XLogRecord *record, bool cleanup)
37163716
}
37173717
else
37183718
{
3719-
/* must zero-fill the hole */
3720-
MemSet((char*)page,0,BLCKSZ);
37213719
memcpy((char*)page,blk,bkpb.hole_offset);
3720+
/* must zero-fill the hole */
3721+
MemSet((char*)page+bkpb.hole_offset,0,bkpb.hole_length);
37223722
memcpy((char*)page+ (bkpb.hole_offset+bkpb.hole_length),
37233723
blk+bkpb.hole_offset,
37243724
BLCKSZ- (bkpb.hole_offset+bkpb.hole_length));

‎src/backend/commands/sequence.c

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1521,6 +1521,7 @@ seq_redo(XLogRecPtr lsn, XLogRecord *record)
15211521
uint8info=record->xl_info& ~XLR_INFO_MASK;
15221522
Bufferbuffer;
15231523
Pagepage;
1524+
Pagelocalpage;
15241525
char*item;
15251526
Sizeitemsz;
15261527
xl_seq_rec*xlrec= (xl_seq_rec*)XLogRecGetData(record);
@@ -1536,23 +1537,37 @@ seq_redo(XLogRecPtr lsn, XLogRecord *record)
15361537
Assert(BufferIsValid(buffer));
15371538
page= (Page)BufferGetPage(buffer);
15381539

1539-
/* Always reinit the page and reinstall the magic number */
1540-
/* See comments in DefineSequence */
1541-
PageInit((Page)page,BufferGetPageSize(buffer),sizeof(sequence_magic));
1542-
sm= (sequence_magic*)PageGetSpecialPointer(page);
1540+
/*
1541+
* We must always reinit the page and reinstall the magic number (see
1542+
* comments in fill_seq_with_data). However, since this WAL record type
1543+
* is also used for updating sequences, it's possible that a hot-standby
1544+
* backend is examining the page concurrently; so we mustn't transiently
1545+
* trash the buffer. The solution is to build the correct new page
1546+
* contents in local workspace and then memcpy into the buffer. Then
1547+
* only bytes that are supposed to change will change, even transiently.
1548+
* We must palloc the local page for alignment reasons.
1549+
*/
1550+
localpage= (Page)palloc(BufferGetPageSize(buffer));
1551+
1552+
PageInit(localpage,BufferGetPageSize(buffer),sizeof(sequence_magic));
1553+
sm= (sequence_magic*)PageGetSpecialPointer(localpage);
15431554
sm->magic=SEQ_MAGIC;
15441555

15451556
item= (char*)xlrec+sizeof(xl_seq_rec);
15461557
itemsz=record->xl_len-sizeof(xl_seq_rec);
15471558
itemsz=MAXALIGN(itemsz);
1548-
if (PageAddItem(page, (Item)item,itemsz,
1559+
if (PageAddItem(localpage, (Item)item,itemsz,
15491560
FirstOffsetNumber, false, false)==InvalidOffsetNumber)
15501561
elog(PANIC,"seq_redo: failed to add item to page");
15511562

1552-
PageSetLSN(page,lsn);
1553-
PageSetTLI(page,ThisTimeLineID);
1563+
PageSetLSN(localpage,lsn);
1564+
PageSetTLI(localpage,ThisTimeLineID);
1565+
1566+
memcpy(page,localpage,BufferGetPageSize(buffer));
15541567
MarkBufferDirty(buffer);
15551568
UnlockReleaseBuffer(buffer);
1569+
1570+
pfree(localpage);
15561571
}
15571572

15581573
void

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp