postgres.git / summary / log / commit / refs

commit    43276abc6f7e497bfca2277b9e04585fcd6c25c5
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Thu Nov 02 16:54:23 2017 +0000
First released in: 11.0, 9.5.10, 9.6.6, 10.1

    Fix corner-case errors in brin_doupdate().
    
    In some cases the BRIN code releases lock on an index page, and later
    re-acquires lock and tries to check that the tuple it was working on is
    still there.  That check was a couple bricks shy of a load.  It didn't
    consider that the page might have turned into a "revmap" page.  (The
    samepage code path doesn't call brin_getinsertbuffer(), so it isn't
    protected by the checks for revmap status there.)  It also didn't check
    whether the tuple offset was now off the end of the linepointer array.
    Since commit 24992c6db the latter case is pretty common, but at least
    in principle it could have occurred before that.  The net result is
    that concurrent updates of a BRIN index could fail with errors like
    "invalid index offnum" or "inconsistent range map".
    
    Per report from Tomas Vondra.  Back-patch to 9.5, since this code is
    substantially the same in all versions containing BRIN.
    
    Discussion: https://postgr.es/m/10d2b9f9-f427-03b8-8ad9-6af4ecacbee9@2ndquadrant.com


 src/backend/access/brin/brin_pageops.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/backend/access/brin/brin_pageops.c b/src/backend/access/brin/brin_pageops.c
index 7e692df98fe..a5f832cbac2 100644
--- a/src/backend/access/brin/brin_pageops.c
+++ b/src/backend/access/brin/brin_pageops.c
@@ -113,9 +113,15 @@ brin_doupdate(Relation idxrel, BlockNumber pagesPerRange,
 
 	/*
 	 * Check that the old tuple wasn't updated concurrently: it might have
-	 * moved someplace else entirely ...
+	 * moved someplace else entirely, and for that matter the whole page
+	 * might've become a revmap page.  Note that in the first two cases
+	 * checked here, the "oldlp" we just calculated is garbage; but
+	 * PageGetItemId() is simple enough that it was safe to do that
+	 * calculation anyway.
 	 */
-	if (!ItemIdIsNormal(oldlp))
+	if (!BRIN_IS_REGULAR_PAGE(oldpage) ||
+		oldoff > PageGetMaxOffsetNumber(oldpage) ||
+		!ItemIdIsNormal(oldlp))
 	{
 		LockBuffer(oldbuf, BUFFER_LOCK_UNLOCK);
 


[parent: b3888b60d3f0]