MIME-Version: 1.0
References: <aIsQqDZ7x4LAQ6u1@paquier.xyz>
In-Reply-To: <aIsQqDZ7x4LAQ6u1@paquier.xyz>
From: Amit Kapila <amit.kapila16@gmail.com>
Date: Fri, 1 Aug 2025 10:03:14 +0530
Message-ID: 
 <CAA4eK1L8x5CgzShZ2FLW0QLUVqQZxjp9MLpeFbHBqUeN++VEDA@mail.gmail.com>
Subject: Re: Use-after-free in reorderbuffer.c for INSERT ON CONFLICT
To: Michael Paquier <michael@paquier.xyz>
Cc: Postgres bugs <pgsql-bugs@lists.postgresql.org>,
	Masahiko Sawada <sawada.mshk@gmail.com>, Ethan Mertz <ethan.mertz@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: 
 <https://www.postgresql.org/message-id/CAA4eK1L8x5CgzShZ2FLW0QLUVqQZxjp9MLpeFbHBqUeN%2B%2BVEDA%40mail.gmail.com>
Precedence: bulk

On Thu, Jul 31, 2025 at 12:14=E2=80=AFPM Michael Paquier <michael@paquier.x=
yz> wrote:
>
> Ethan Mertz (colleague, in CC) has found a bug in reorderbuffer.c when
> processing a REORDER_BUFFER_CHANGE_INTERNAL_SPEC_CONFIRM change, based
> on the data gathered from a customer issue.  The bug is a
> use-after-free, causing random crashes, that can be summarized like
> that:
...
>
> A simple solution suggested by Ethan would be to use the "prev_lsn"
> guessed from the change at the beginning of the loop, rather than the
> problematic change->lsn.  But that does not seem completely right to
> me because we can switch to "specinsert" as the change to process,
> hence wouldn't we want to call update_progress_txn() based on the LSN
> of the actual change we are looking at?
>

We still won't be able to capture the latest LSN in case of
REORDER_BUFFER_CHANGE_INTERNAL_SPEC_ABORT. IIRC, update_progress_txn
is used to keep the client active so that when many changes are
skipped, the client doesn't timeout. In this case, it seems okay to
use prev_lsn as well.

--=20
With Regards,
Amit Kapila.