postgres.git / summary / log / commit / refs

commit    4c6b5dd5f5cfaf42f2370f587df7238d5aba48b8
Author:   Richard Guo <rguo@postgresql.org>
Date:     Wed Feb 19 02:05:35 2025 +0000
First released in: 18.0, 13.21, 14.18, 15.13, 16.9, 17.5

    Fix unsafe access to BufferDescriptors
    
    When considering a local buffer, the GetBufferDescriptor() call in
    BufferGetLSNAtomic() would be retrieving a shared buffer with a bad
    buffer ID.  Since the code checks whether the buffer is shared before
    using the retrieved BufferDesc, this issue did not lead to any
    malfunction.  Nonetheless this seems like trouble waiting to happen,
    so fix it by ensuring that GetBufferDescriptor() is only called when
    we know the buffer is shared.
    
    Author: Tender Wang <tndrwang@gmail.com>
    Reviewed-by: Xuneng Zhou <xunengzhou@gmail.com>
    Reviewed-by: Richard Guo <guofenglinux@gmail.com>
    Discussion: https://postgr.es/m/CAHewXNku-o46-9cmUgyv6LkSZ25doDrWq32p=oz9kfD8ovVJMg@mail.gmail.com
    Backpatch-through: 13


 src/backend/storage/buffer/bufmgr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/backend/storage/buffer/bufmgr.c b/src/backend/storage/buffer/bufmgr.c
index e066a3f888f..e007bd46e93 100644
--- a/src/backend/storage/buffer/bufmgr.c
+++ b/src/backend/storage/buffer/bufmgr.c
@@ -3550,8 +3550,8 @@ BufferIsPermanent(Buffer buffer)
 XLogRecPtr
 BufferGetLSNAtomic(Buffer buffer)
 {
-	BufferDesc *bufHdr = GetBufferDescriptor(buffer - 1);
 	char	   *page = BufferGetPage(buffer);
+	BufferDesc *bufHdr;
 	XLogRecPtr	lsn;
 	uint32		buf_state;
 
@@ -3565,6 +3565,7 @@ BufferGetLSNAtomic(Buffer buffer)
 	Assert(BufferIsValid(buffer));
 	Assert(BufferIsPinned(buffer));
 
+	bufHdr = GetBufferDescriptor(buffer - 1);
 	buf_state = LockBufHdr(bufHdr);
 	lsn = PageGetLSN(page);
 	UnlockBufHdr(bufHdr, buf_state);


[parent: 8d0756250313]