From: Peter Geoghegan <pg@bowt.ie>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: anisimow.d@gmail.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
Subject: Re: BUG #17462: Invalid memory access in heapam_tuple_lock
Date: Mon, 11 Apr 2022 09:48:51 -0700
Message-ID: <CAH2-Wzmxcidt0u4_7pfXZ_ExEOKa_Epb-b3vAcM_D899WAO2rA@mail.gmail.com> (raw)
In-Reply-To: <290412.1649694952@sss.pgh.pa.us>
References: <17462-9c98a0f00df9bd36@postgresql.org>
<286748.1649692519@sss.pgh.pa.us>
<CAH2-Wzmsm4sBXM+bdG_U48sWq8R5XY=fF=ZqnL5vKeqDK4X0bA@mail.gmail.com>
<290412.1649694952@sss.pgh.pa.us>
On Mon, Apr 11, 2022 at 9:35 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> > The other backend's page defragmentation step (from pruning)
> > would render our backend's HeapTuple pointer invalid. Presumably it
> > would just look like an invalid/non-matching xmin in our backend, at
> > the point of control flow that Valgrind complains about
> > (heapam_handler.c:509).
>
> Right, but there are other accesses below, and in any case match
> failure isn't necessarily the right thing.
That's what I meant -- it very likely would have been a match if the
same scenario played out, but without any concurrent pruning. With a
concurrent prune, xmin won't ever be a match (barring a
near-miraculous coincidence). That behavior is definitely wrong, but
also quite subtle (compared to what might happen if we got past the
xmin/xmax check). I think that that explains why it took this long to
notice the bug.
--
Peter Geoghegan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: pg@bowt.ie, tgl@sss.pgh.pa.us, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17462: Invalid memory access in heapam_tuple_lock
In-Reply-To: <CAH2-Wzmxcidt0u4_7pfXZ_ExEOKa_Epb-b3vAcM_D899WAO2rA@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox