postgres.git / summary / log / commit / refs

commit    4aea5589106bdaa949e45e8ae6a7e49204a460f6
Author:   David Rowley <drowley@postgresql.org>
Date:     Fri Aug 29 12:51:39 2025 +0000
First released in: 15.15, 16.11, 17.7, 18.0

    Fix possible use after free in expand_partitioned_rtentry()
    
    It's possible that if the only live partition is concurrently dropped
    and try_table_open() fails, that the bms_del_member() will pfree the
    live_parts Bitmapset.  Since the bms_del_member() call does not assign
    the result back to the live_parts local variable, the while loop could
    segfault as that variable would still reference the pfree'd Bitmapset.
    
    Backpatch to 15. 52f3de874 was backpatched to 14, but there's no
    bms_del_member() there due to live_parts not yet existing in RelOptInfo in
    that version.  Technically there's no bug in version 15 as
    bms_del_member() didn't pfree when the set became empty prior to
    00b41463c (from v16).  Applied to v15 anyway to keep the code similar and
    to avoid the bad coding pattern.
    
    Author: Bernd Reiß <bd_reiss@gmx.at>
    Reviewed-by: David Rowley <dgrowleyml@gmail.com>
    Discussion: https://postgr.es/m/6b88f27a-c45c-4826-8e37-d61a04d90182@gmx.at
    Backpatch-through: 15


 src/backend/optimizer/util/inherit.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/backend/optimizer/util/inherit.c b/src/backend/optimizer/util/inherit.c
index 17e51cd75d7..246749309c4 100644
--- a/src/backend/optimizer/util/inherit.c
+++ b/src/backend/optimizer/util/inherit.c
@@ -322,7 +322,6 @@ expand_partitioned_rtentry(PlannerInfo *root, RelOptInfo *relinfo,
 						   PlanRowMark *top_parentrc, LOCKMODE lockmode)
 {
 	PartitionDesc partdesc;
-	Bitmapset  *live_parts;
 	int			num_live_parts;
 	int			i;
 
@@ -356,10 +355,10 @@ expand_partitioned_rtentry(PlannerInfo *root, RelOptInfo *relinfo,
 	 * that survive pruning.  Below, we will initialize child objects for the
 	 * surviving partitions.
 	 */
-	relinfo->live_parts = live_parts = prune_append_rel_partitions(relinfo);
+	relinfo->live_parts = prune_append_rel_partitions(relinfo);
 
 	/* Expand simple_rel_array and friends to hold child objects. */
-	num_live_parts = bms_num_members(live_parts);
+	num_live_parts = bms_num_members(relinfo->live_parts);
 	if (num_live_parts > 0)
 		expand_planner_arrays(root, num_live_parts);
 
@@ -378,7 +377,7 @@ expand_partitioned_rtentry(PlannerInfo *root, RelOptInfo *relinfo,
 	 * table itself, because it's not going to be scanned.
 	 */
 	i = -1;
-	while ((i = bms_next_member(live_parts, i)) >= 0)
+	while ((i = bms_next_member(relinfo->live_parts, i)) >= 0)
 	{
 		Oid			childOID = partdesc->oids[i];
 		Relation	childrel;


[parent: 3eea4dc2c7cf]