From: PanBian <bianpan2016@163.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #15540: Use after release in ExecuteTruncateGuts
Date: Sun, 9 Dec 2018 08:56:17 +0800
Message-ID: <20181209005617.GA65607@bp> (raw)
In-Reply-To: <31125.1544198945@sss.pgh.pa.us>
References: <15540-01078812338195c0@postgresql.org>
<31125.1544198945@sss.pgh.pa.us>
On Fri, Dec 07, 2018 at 11:09:05AM -0500, Tom Lane wrote:
> =?utf-8?q?PG_Bug_reporting_form?= <noreply@postgresql.org> writes:
> > The function ExecuteTruncateGuts drops the reference to rel via
> > relation_close when toast_relid is valid. However, after that, rel is passed
> > to pgstat_count_truncate. This may result in a use-after-release bug.
>
> ... and, even more to the point, the truncation stats count is incorrectly
> applied to the toast table not its parent.
>
> > Maybe,
> > rel should be re-declared on the branch that toast_relid is valid.
>
> Yeah, seems like the right way. Will fix.
>
> Are you using a static analyzer to find these? I'm curious how
> you noticed them.
Yes. I write a static analysis tool. It can find functions that release
memory or other resources. Let's call them free-like functions. With such
free-like functions, the tool then performs data flow analysis to find
use-after-free bugs. Of course, we can feed those free-like functions to
other static analyzers such as Coverity. I believe it will work too.
Best regards,
Pan Bian
>
> regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: bianpan2016@163.com, tgl@sss.pgh.pa.us, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #15540: Use after release in ExecuteTruncateGuts
In-Reply-To: <20181209005617.GA65607@bp>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox