You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Michael Paquier 9e0b4b1ab5 Fix use-after-free with INSERT ON CONFLICT changes in reorderbuffer.c ... In ReorderBufferProcessTXN(), used to send the data of a transaction to an output plugin, INSERT ON CONFLICT changes (INTERNAL_SPEC_INSERT) are delayed until a confirmation record arrives (INTERNAL_SPEC_CONFIRM), updating the change being processed. 8c58624df4 has added an extra step after processing a change to update the progress of the transaction, by calling the callback update_progress_txn() based on the LSN stored in a change after a threshold of CHANGES_THRESHOLD (100) is reached. This logic has missed the fact that for an INSERT ON CONFLICT change the data is freed once processed, hence update_progress_txn() could be called pointing to a LSN value that's already been freed. This could result in random crashes, depending on the workload. Per discussion, this issue is fixed by reusing in update_progress_txn() the LSN from the change processed found at the beginning of the loop, meaning that for a INTERNAL_SPEC_CONFIRM change the progress is updated using the LSN of the INTERNAL_SPEC_CONFIRM change, and not the LSN from its INTERNAL_SPEC_INSERT change. This is actually more correct, as we want to update the progress to point to the INTERNAL_SPEC_CONFIRM change. Masahiko Sawada has found a nice trick to reproduce the issue: hardcode CHANGES_THRESHOLD at 1 and run test_decoding (test "ddl" being enough) on an instance running valgrind. The bug has been analyzed by Ethan Mertz, who also originally suggested the solution used in this patch. Issue introduced by 8c58624df4, so backpatch down to v16. Author: Ethan Mertz <ethan.mertz@gmail.com> Co-authored-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Amit Kapila <amit.kapila16@gmail.com> Reviewed-by: Masahiko Sawada <sawada.mshk@gmail.com> Discussion: https://postgr.es/m/aIsQqDZ7x4LAQ6u1@paquier.xyz Backpatch-through: 16		5 months ago
..
backend	Fix use-after-free with INSERT ON CONFLICT changes in reorderbuffer.c	5 months ago
bin	Sort dump objects independent of OIDs, for the 7 holdout object types.	5 months ago
common	With GB18030, prevent SIGSEGV from reading past end of allocation.	8 months ago
fe_utils	In fmtIdEnc(), handle failure of enlargePQExpBuffer().	10 months ago
include	Fix a deadlock during ALTER SUBSCRIPTION ... DROP PUBLICATION.	5 months ago
interfaces	Don't put library-supplied -L/-I switches before user-supplied ones.	5 months ago
makefiles	Optimize pg_popcount() with AVX-512 instructions.	2 years ago
pl	Don't put library-supplied -L/-I switches before user-supplied ones.	5 months ago
port	Make our usage of memset_s() conform strictly to the C11 standard.	7 months ago
template	Remove AIX support	2 years ago
test	Sort dump objects independent of OIDs, for the 7 holdout object types.	5 months ago
timezone	Update time zone data files to tzdata release 2025b.	8 months ago
tools	meson: Flush stdout in testwrap	9 months ago
tutorial	Update copyright for 2024	2 years ago
.gitignore	…
DEVELOPERS	…
Makefile	…
Makefile.global.in	Don't put library-supplied -L/-I switches before user-supplied ones.	5 months ago
Makefile.shlib	Remove AIX support	2 years ago
meson.build	Update copyright for 2024	2 years ago
nls-global.mk	…