MIME-Version: 1.0
References: <17462-9c98a0f00df9bd36@postgresql.org>
 <286748.1649692519@sss.pgh.pa.us>
 <CAH2-Wzmsm4sBXM+bdG_U48sWq8R5XY=fF=ZqnL5vKeqDK4X0bA@mail.gmail.com>
 <290412.1649694952@sss.pgh.pa.us>
In-Reply-To: <290412.1649694952@sss.pgh.pa.us>
From: Peter Geoghegan <pg@bowt.ie>
Date: Mon, 11 Apr 2022 09:48:51 -0700
Message-ID: 
 <CAH2-Wzmxcidt0u4_7pfXZ_ExEOKa_Epb-b3vAcM_D899WAO2rA@mail.gmail.com>
Subject: Re: BUG #17462: Invalid memory access in heapam_tuple_lock
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: anisimow.d@gmail.com,
	PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: 
 <https://www.postgresql.org/message-id/CAH2-Wzmxcidt0u4_7pfXZ_ExEOKa_Epb-b3vAcM_D899WAO2rA%40mail.gmail.com>
Precedence: bulk

On Mon, Apr 11, 2022 at 9:35 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> > The other backend's page defragmentation step (from pruning)
> > would render our backend's HeapTuple pointer invalid. Presumably it
> > would just look like an invalid/non-matching xmin in our backend, at
> > the point of control flow that Valgrind complains about
> > (heapam_handler.c:509).
>
> Right, but there are other accesses below, and in any case match
> failure isn't necessarily the right thing.

That's what I meant -- it very likely would have been a match if the
same scenario played out, but without any concurrent pruning. With a
concurrent prune, xmin won't ever be a match (barring a
near-miraculous coincidence). That behavior is definitely wrong, but
also quite subtle (compared to what might happen if we got past the
xmin/xmax check). I think that that explains why it took this long to
notice the bug.

-- 
Peter Geoghegan