From: Amit Kapila <amit.kapila16@gmail.com>
To: Michael Paquier <michael@paquier.xyz>
Cc: Postgres bugs <pgsql-bugs@lists.postgresql.org>
Cc: Masahiko Sawada <sawada.mshk@gmail.com>
Cc: Ethan Mertz <ethan.mertz@gmail.com>
Subject: Re: Use-after-free in reorderbuffer.c for INSERT ON CONFLICT
Date: Fri, 1 Aug 2025 10:03:14 +0530
Message-ID: <CAA4eK1L8x5CgzShZ2FLW0QLUVqQZxjp9MLpeFbHBqUeN++VEDA@mail.gmail.com> (raw)
In-Reply-To: <aIsQqDZ7x4LAQ6u1@paquier.xyz>
References: <aIsQqDZ7x4LAQ6u1@paquier.xyz>
On Thu, Jul 31, 2025 at 12:14 PM Michael Paquier <michael@paquier.xyz> wrote:
>
> Ethan Mertz (colleague, in CC) has found a bug in reorderbuffer.c when
> processing a REORDER_BUFFER_CHANGE_INTERNAL_SPEC_CONFIRM change, based
> on the data gathered from a customer issue. The bug is a
> use-after-free, causing random crashes, that can be summarized like
> that:
...
>
> A simple solution suggested by Ethan would be to use the "prev_lsn"
> guessed from the change at the beginning of the loop, rather than the
> problematic change->lsn. But that does not seem completely right to
> me because we can switch to "specinsert" as the change to process,
> hence wouldn't we want to call update_progress_txn() based on the LSN
> of the actual change we are looking at?
>
We still won't be able to capture the latest LSN in case of
REORDER_BUFFER_CHANGE_INTERNAL_SPEC_ABORT. IIRC, update_progress_txn
is used to keep the client active so that when many changes are
skipped, the client doesn't timeout. In this case, it seems okay to
use prev_lsn as well.
--
With Regards,
Amit Kapila.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: amit.kapila16@gmail.com, michael@paquier.xyz, pgsql-bugs@lists.postgresql.org, sawada.mshk@gmail.com, ethan.mertz@gmail.com
Subject: Re: Use-after-free in reorderbuffer.c for INSERT ON CONFLICT
In-Reply-To: <CAA4eK1L8x5CgzShZ2FLW0QLUVqQZxjp9MLpeFbHBqUeN++VEDA@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox