Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256)
	(Exim 4.89)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1gVIgj-0008BG-Uq
	for pgsql-bugs@arkaria.postgresql.org; Fri, 07 Dec 2018 16:09:14 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.89)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1gVIgi-0002w5-II
	for pgsql-bugs@arkaria.postgresql.org; Fri, 07 Dec 2018 16:09:12 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256)
	(Exim 4.89)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1gVIgi-0002vy-9D
	for pgsql-bugs@lists.postgresql.org; Fri, 07 Dec 2018 16:09:12 +0000
Received: from sss.pgh.pa.us ([66.207.139.130])
	by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256)
	(Exim 4.89)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1gVIgf-0004Ds-Uq
	for pgsql-bugs@lists.postgresql.org; Fri, 07 Dec 2018 16:09:11 +0000
Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1])
	by sss.pgh.pa.us (8.14.4/8.14.4) with ESMTP id wB7G95Wo031126;
	Fri, 7 Dec 2018 11:09:05 -0500
From: Tom Lane <tgl@sss.pgh.pa.us>
To: bianpan2016@163.com
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #15540: Use after release in ExecuteTruncateGuts
In-reply-to: <15540-01078812338195c0@postgresql.org>
References: <15540-01078812338195c0@postgresql.org>
Comments: In-reply-to =?utf-8?q?PG_Bug_reporting_form?=
 <noreply@postgresql.org>
	message dated "Fri, 07 Dec 2018 10:34:28 +0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <31124.1544198945.1@sss.pgh.pa.us>
Date: Fri, 07 Dec 2018 11:09:05 -0500
Message-ID: <31125.1544198945@sss.pgh.pa.us>
List-Id: <pgsql-bugs.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-bugs@lists.postgresql.org>
List-Owner: <mailto:pgsql-bugs-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-bugs>
Precedence: bulk

=?utf-8?q?PG_Bug_reporting_form?= <noreply@postgresql.org> writes:
> The function ExecuteTruncateGuts drops the reference to rel via
> relation_close when toast_relid is valid. However, after that, rel is passed
> to pgstat_count_truncate. This may result in a use-after-release bug.

... and, even more to the point, the truncation stats count is incorrectly
applied to the toast table not its parent.

> Maybe,
> rel should be re-declared on the branch that toast_relid is valid.

Yeah, seems like the right way.  Will fix.

Are you using a static analyzer to find these?  I'm curious how
you noticed them.

			regards, tom lane