Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pnjNF-0006Ko-Gh for pgsql-bugs@arkaria.postgresql.org; Sat, 15 Apr 2023 17:07:41 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1pnjNE-0002Wi-EO for pgsql-bugs@arkaria.postgresql.org; Sat, 15 Apr 2023 17:07:40 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pmzwr-0004cX-81 for pgsql-bugs@lists.postgresql.org; Thu, 13 Apr 2023 16:37:25 +0000 Received: from azure-sdnproxy.icoremail.net ([52.229.205.26]) by magus.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1pmzwl-002fwl-0A for pgsql-bugs@lists.postgresql.org; Thu, 13 Apr 2023 16:37:24 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mails.tsinghua.edu.cn; s=dkim; h=Received:From:To:Cc:Subject: Date:Message-ID:MIME-Version:Content-Type:Content-Language: Thread-Index; bh=7Mvx77+o40GyIlGesOBEUupBgicop+YAjwkPVKk2Yts=; b=WCHfkFaNJVgqniARpQk+fKCCoObGBb3HRLabifgXogFjWBbJZzlPbxR1/WP1qx u4Rrod/QL3AppSVHyTjs+xAqtMZAX2Dw5IuFen3P7cp8NcP/j+Rv4FqFMaRDBnW2 f73bzCZBNqwBRTEmFKh0jdMVi6Ou86eHpHw5D3Y49+l9M= Received: from LAPTOPJPQFQS7K (unknown [183.172.66.176]) by web3 (Coremail) with SMTP id ygQGZQBn6164LzhkCj0dEw--.62020S2; Fri, 14 Apr 2023 00:37:12 +0800 (CST) From: To: Cc: , Subject: =?us-ascii?Q?4._PostgreSQL_Server_Subprocess_Went_down_at_function_'pg=5F?= =?us-ascii?Q?detoast=5Fdatum'?= Date: Fri, 14 Apr 2023 00:37:14 +0800 Message-ID: <009c01d96e26$3436f5d0$9ca4e170$@mails.tsinghua.edu.cn> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_009D_01D96E69.425B2030" X-Mailer: Microsoft Outlook 16.0 Content-Language: zh-cn Thread-Index: AdluJgd4CNDHfH41TuuYJntFrkXhyA== X-CM-TRANSID: ygQGZQBn6164LzhkCj0dEw--.62020S2 X-Coremail-Antispam: 1UD129KBjvJXoWxur4fAF1xAr4xJrW3Cr1xZrb_yoW5Xw15pF nrGwn0yr4UXw18Ar4jg39rXwsYyayDJry3Kr18ta93Xay5tr9F9a42kFW2gF98uw47Gr1Y 93WjvayI9a1qkw7anT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUHSb7Iv0xC_Cr1lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2F7IY1VAKz4vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xII jxv20xvEc7CjxVAFwI0_Cr1j6rxdM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I 8E87Iv6xkF7I0E14v26rxl6s0DM2vYz4IE04k24VAvwVAKI4IrM2AIxVAIcxkEcVAq07x2 0xvEncxIr21l5I8CrVAYj202j2C_Wr0_Ar1l5I8CrVAqjxCE14ACF2xKxwAqx4xG64kEw2 xG04xIwI0_Gr0_Xr1l5I8CrVCF0I0E4I0vr24lYx0E2Ix0cI8IcVAFwI0_Jrv_JF1lYx0E x4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwAKzV CY07xG64k0F24l7480Y4vEI4kI2Ix0rVAqx4xJMxkIecxEwVAFwVWUMxAIw28IcxkI7VAK I48JMxC20s026xCaFVCjc4AY6r1j6r4UMxCIbckI1I0E14v26r1Y6r17MI8I3I0E5I8CrV AFwI0_JrI_JrWlx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUXVWUAwCI c40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267 AKxVWUJVW8JwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_ Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZEXa7IUn7CzJ UUUUU== X-CM-SenderInfo: him2jjo6pdxz3vow2x5qjk3toohg3hdfq/ List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk This is a multipart message in MIME format. ------=_NextPart_000_009D_01D96E69.425B2030 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Description: PostgreSQL Server Subprocess Went down at function 'pg_detoast_datum' PostgreSQL Server Version: PostgreSQL 15.2 on x86_64-pc-linux-gnu, compiled by Ubuntu clang version 12.0.1, 64-bit Discoverer: Jingzhou Fu, Jie Liang and Zhiyong Wu in WingTecher Lab of Tsinghua University and Shuimuyulin ltd Email address: fjz22@mails.tsinghua.edu.cn , wuzy21@mails.tsinghua.edu.cn , ljiee@mail.tsinghua.edu.cn Way to Reproduce with Docker (write the poc content into file PoC.sql): ```bash docker container rm some-postgres -f docker run --name some-postgres -p 5432:5432 -e POSTGRES_PASSWORD=mysecretpassword -d postgres:15.2 sleep 5 # wait the server start . docker exec -i some-postgres psql --user=postgres < PoC.sql # Output: # server closed the connection unexpectedly # This probably means the server terminated abnormally # before or while processing the request. # connection to server was lost ``` PoC: ```sql create function parent(cstring) returns parent strict immutable language internal as 'int8in'; create function a(parent) returns cstring strict immutable language internal as 'int8out'; CREATE TYPE parent ( internallength = variable, input = parent, output = a, alignment = int4 ); CREATE domain child as int not null check (value > 0); create table grandchild (part int8 primary key, b child, c child); explain (costs off) select * from grandchild where part = part and part = '42'::parent; ``` Backtrace: ``` #0 0x1cc6f79 (pg_detoast_datum+0x49) #1 0xaeeffc (coerce_type+0xc5c) #2 0xaeda7e (coerce_to_target_type+0x41e) #3 0xb1603f (transformTypeCast+0x63f) #4 0xb10786 (transformExprRecurse+0x2f6) #5 0xb170cf (transformAExprOp+0xa7f) #6 0xb1081d (transformExprRecurse+0x38d) #7 0xb1b8ad (transformBoolExpr+0x5ed) #8 0xb109a5 (transformExprRecurse+0x515) #9 0xb1042a (transformExpr+0xba) #10 0xad56c6 (transformWhereClause+0x46) #11 0xa2484e (transformSelectStmt+0x85e) #12 0xa1c6ee (transformStmt+0x22e) #13 0xa1cd10 (transformOptionalSelectInto+0x390) #14 0xa2c931 (transformExplainStmt+0x51) #15 0xa1c761 (transformStmt+0x2a1) #16 0xa1cd10 (transformOptionalSelectInto+0x390) #17 0xa1be4e (transformTopLevelStmt+0x4e) #18 0xa1bd6b (parse_analyze_fixedparams+0xcb) #19 0x16e14b7 (pg_analyze_and_rewrite_fixedparams+0x97) #20 0x16e922a (exec_simple_query+0x99a) #21 0x16e7a63 (PostgresMain+0x1523) #22 0x144c17b (BackendRun+0xbb) #23 0x144ad85 (BackendStartup+0x525) #24 0x14481e6 (ServerLoop+0x616) #25 0x1443e0f (PostmasterMain+0x30cf) #26 0x106ebf2 (main+0x5a2) #27 0x7f5bf768c083 (__libc_start_main+0xf3) #28 0x49fc0e (_start+0x2e) ``` ------=_NextPart_000_009D_01D96E69.425B2030 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Description: = PostgreSQL Server Subprocess Went down at function = ‘pg_detoast_datum’

PostgreSQL = Server Version: PostgreSQL 15.2 on x86_64-pc-linux-gnu, compiled by = Ubuntu clang version 12.0.1, 64-bit

Discoverer: = Jingzhou Fu, Jie Liang and Zhiyong Wu in WingTecher Lab of Tsinghua = University and Shuimuyulin ltd

Email = address: fjz22@mails.tsinghua.edu.cn  ,   wuzy21@mails.tsinghua.edu.cn&n= bsp; ,  = ljiee@mail.tsinghua.edu.cn

 

Way to = Reproduce with Docker (write the poc content into file = PoC.sql):

```bash<= /o:p>

docker = container rm some-postgres -f

docker run = --name some-postgres -p 5432:5432 -e = POSTGRES_PASSWORD=3Dmysecretpassword -d = postgres:15.2

 

sleep 5 # = wait the server start …

 

docker exec = -i some-postgres psql --user=3Dpostgres < = PoC.sql

 

# = Output:

# =   server closed the connection = unexpectedly

# =          This probably = means the server terminated abnormally

# =          before or while = processing the request.

# =   connection to server was lost

```

 

PoC:

```sql

create = function parent(cstring) returns parent

  = strict immutable language internal as 'int8in';

create = function a(parent) returns cstring

  = strict immutable language internal as 'int8out';

CREATE TYPE = parent (

   = internallength =3D variable,

   = input =3D parent,

   = output =3D a,

   = alignment =3D int4

);=

CREATE = domain child as int not null check (value > = 0);

create table = grandchild (part int8 primary key, b child, c = child);

explain = (costs off)

  = select * from grandchild where part =3D part and part =3D = '42'::parent;

```

 

Backtrace:

```

#0 0x1cc6f79 = (pg_detoast_datum+0x49)

#1 0xaeeffc = (coerce_type+0xc5c)

#2 0xaeda7e = (coerce_to_target_type+0x41e)

#3 0xb1603f = (transformTypeCast+0x63f)

#4 0xb10786 = (transformExprRecurse+0x2f6)

#5 0xb170cf = (transformAExprOp+0xa7f)

#6 0xb1081d = (transformExprRecurse+0x38d)

#7 0xb1b8ad = (transformBoolExpr+0x5ed)

#8 0xb109a5 = (transformExprRecurse+0x515)

#9 0xb1042a = (transformExpr+0xba)

#10 0xad56c6 = (transformWhereClause+0x46)

#11 0xa2484e = (transformSelectStmt+0x85e)

#12 0xa1c6ee = (transformStmt+0x22e)

#13 0xa1cd10 = (transformOptionalSelectInto+0x390)

#14 0xa2c931 = (transformExplainStmt+0x51)

#15 0xa1c761 = (transformStmt+0x2a1)

#16 0xa1cd10 = (transformOptionalSelectInto+0x390)

#17 0xa1be4e = (transformTopLevelStmt+0x4e)

#18 0xa1bd6b = (parse_analyze_fixedparams+0xcb)

#19 = 0x16e14b7 = (pg_analyze_and_rewrite_fixedparams+0x97)

#20 = 0x16e922a (exec_simple_query+0x99a)

#21 = 0x16e7a63 (PostgresMain+0x1523)

#22 = 0x144c17b (BackendRun+0xbb)

#23 = 0x144ad85 (BackendStartup+0x525)

#24 = 0x14481e6 (ServerLoop+0x616)

#25 = 0x1443e0f (PostmasterMain+0x30cf)

#26 = 0x106ebf2 (main+0x5a2)

#27 = 0x7f5bf768c083 (__libc_start_main+0xf3)

#28 0x49fc0e = (_start+0x2e)

```

 

------=_NextPart_000_009D_01D96E69.425B2030--