Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtp (Exim 4.84_2)
	(envelope-from
 <pgsql-bugs-owner+M47514=pgsql+2Dbugs=arkaria.postgresql.org@postgresql.org>)
	id 1d6HrT-00069e-BH
	for pgsql-bugs@arkaria.postgresql.org; Thu, 04 May 2017 14:36:07 +0000
Received: from localhost ([127.0.0.1] helo=postgresql.org)
	by malur.postgresql.org with smtp (Exim 4.84_2)
	(envelope-from
 <pgsql-bugs-owner+M47514=pgsql+2Dbugs=arkaria.postgresql.org@postgresql.org>)
	id 1d6HrS-0000V1-Tv
	for pgsql-bugs@arkaria.postgresql.org; Thu, 04 May 2017 14:36:06 +0000
Received: from makus.postgresql.org ([2001:4800:1501:1::229])
	by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256)
	(Exim 4.84_2)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1d6HrS-0000S3-7E
	for pgsql-bugs@postgresql.org; Thu, 04 May 2017 14:36:06 +0000
Received: from sss.pgh.pa.us ([66.207.139.130])
	by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256)
	(Exim 4.84_2)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1d6HrP-0001Wc-QO
	for pgsql-bugs@postgresql.org; Thu, 04 May 2017 14:36:05 +0000
Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1])
	by sss.pgh.pa.us (8.14.4/8.14.4) with ESMTP id v44Ea2xJ007894;
	Thu, 4 May 2017 10:36:02 -0400
From: Tom Lane <tgl@sss.pgh.pa.us>
To: darthunix@gmail.com
cc: pgsql-bugs@postgresql.org
Subject: Re: BUG #14641: Segfault on searching KNN using btree_gist
In-reply-to: <20170504072034.24366.57688@wrigleys.postgresql.org>
References: <20170504072034.24366.57688@wrigleys.postgresql.org>
Comments: In-reply-to darthunix@gmail.com
	message dated "Thu, 04 May 2017 07:20:34 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <7892.1493908562.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 04 May 2017 10:36:02 -0400
Message-ID: <7893.1493908562@sss.pgh.pa.us>
X-Pg-Spam-Score: -1.9 (-)
List-Archive: <http://archives.postgresql.org/pgsql-bugs>
List-Help: <mailto:majordomo@postgresql.org?body=help>
List-ID: <pgsql-bugs.postgresql.org>
List-Owner: <mailto:pgsql-bugs-owner@postgresql.org>
List-Post: <mailto:pgsql-bugs@postgresql.org>
List-Subscribe: <mailto:majordomo@postgresql.org?body=sub%20pgsql-bugs>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-bugs>
X-Mailing-List: pgsql-bugs
Precedence: bulk
Sender: pgsql-bugs-owner@postgresql.org

darthunix@gmail.com writes:
> I face a segmentation fault in postgresql when searching KNN using
> multicolumn btree_gist index.

Reproduced here, will look.  Thanks for the report!

Program terminated with signal 11, Segmentation fault.
#0  0x0000000000881052 in GetMemoryChunkContext (pointer=3D0x14d46e8)
    at ../../../../src/include/utils/memutils.h:124
124             AssertArg(MemoryContextIsValid(context));
(gdb) bt
#0  0x0000000000881052 in GetMemoryChunkContext (pointer=3D0x14d46e8)
    at ../../../../src/include/utils/memutils.h:124
#1  pfree (pointer=3D0x14d46e8) at mcxt.c:952
#2  0x00000000004a0492 in getNextNearest (scan=3D0x14709e0,=20
    dir=3D<value optimized out>) at gistget.c:547
#3  gistgettuple (scan=3D0x14709e0, dir=3D<value optimized out>) at gistget=
.c:656
#4  0x00000000004cee63 in index_getnext_tid (scan=3D0x14709e0,=20
    direction=3D<value optimized out>) at indexam.c:541
#5  0x000000000062ffab in IndexOnlyNext (node=3D0x15abcd0)
    at nodeIndexonlyscan.c:116
#6  0x000000000061cc67 in ExecScanFetch (node=3D0x15abcd0,=20
    accessMtd=3D0x62ff30 <IndexOnlyNext>, recheckMtd=3D0x62ff00 <IndexOnlyR=
echeck>)
    at execScan.c:95
#7  ExecScan (node=3D0x15abcd0, accessMtd=3D0x62ff30 <IndexOnlyNext>,=20
    recheckMtd=3D0x62ff00 <IndexOnlyRecheck>) at execScan.c:162
#8  0x000000000061b858 in ExecProcNode (node=3D0x15abcd0) at execProcnode.c=
:459
...
(gdb) f 0
#0  0x0000000000881052 in GetMemoryChunkContext (pointer=3D0x14d46e8)
    at ../../../../src/include/utils/memutils.h:124
124             AssertArg(MemoryContextIsValid(context));
(gdb) p context
$1 =3D (MemoryContext) 0x7f7f7f7f7f7f7f7f
(gdb) x/8x 0x14d46e8
0x14d46e8:      0x7f7f7f7f      0x7f7f7f7f      0x7f7f7f7f      0x7f7f7f7f
0x14d46f8:      0x7f7f7f7f      0x7f7f7f7f      0x7f7f7f7f      0x7f7f7f7f
(gdb) f 2
#2  0x00000000004a0492 in getNextNearest (scan=3D0x14709e0,=20
    dir=3D<value optimized out>) at gistget.c:547
547                     pfree(scan->xs_hitup);

Looks like getNextNearest is trying to pfree an already-pfreed tuple.

			regards, tom lane


--=20
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs