MIME-Version: 1.0
References: <19508-e5f188183279219b@postgresql.org>
In-Reply-To: <19508-e5f188183279219b@postgresql.org>
From: Fujii Masao <masao.fujii@gmail.com>
Date: Fri, 5 Jun 2026 12:18:49 +0900
Message-ID: 
 <CAHGQGwGaC8RNeVP3A4_R1OcHJ-DrXgr2HH2UEYrt-Ueu516Gng@mail.gmail.com>
Subject: Re: BUG #19508: pg_buffercache_pages() crashes the backend with an
 incompatible caller-supplied record definition
To: n.kalinin@postgrespro.ru, pgsql-bugs@lists.postgresql.org
Content-Type: multipart/mixed; boundary="0000000000005001ef0653791f7e"
Archived-At: 
 <https://www.postgresql.org/message-id/CAHGQGwGaC8RNeVP3A4_R1OcHJ-DrXgr2HH2UEYrt-Ueu516Gng%40mail.gmail.com>
Precedence: bulk

--0000000000005001ef0653791f7e
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Jun 5, 2026 at 12:49=E2=80=AFAM PG Bug reporting form
<noreply@postgresql.org> wrote:
>
> The following bug has been logged on the website:
>
> Bug reference:      19508
> Logged by:          Nikita Kalinin
> Email address:      n.kalinin@postgrespro.ru
> PostgreSQL version: 19beta1
> Operating system:   Fedora 44
> Description:
>
> Hello,
>
> It appears that pg_buffercache_pages() trusts a caller-supplied record
> descriptor without verifying that the declared column types match the act=
ual
> values returned by the function.
>
> The crash is reproducible on the current master branch with a fresh clust=
er
> after installing the extension:

Thanks for the report! I could reproduce this as well.


> git blame points to the following commit:
>
> commit 257c8231bf97a77378f6fedb826b1243f0a41612 (HEAD)
> Author: Heikki Linnakangas <heikki.linnakangas@iki.fi>
> Date:   Tue Apr 7 16:04:48 2026 +0300
>
>     Modernize and optimize pg_buffercache_pages()

Commit 257c8231bf9 changed pg_buffercache_pages() to materialize rows direc=
tly
into a tuplestore. As a result, the function started using the caller-suppl=
ied
RECORD descriptor as rsinfo->setDesc, so a mismatched column definition lis=
t
could cause tuplestore_putvalues() to interpret returned Datums with incorr=
ect
types.

Before that change, pg_buffercache_pages() exposed its actual tuple descrip=
tor
to the executor, allowing the executor's existing rowtype checks to reject
incompatible definitions with a normal error.

The attached patch restores that behavior while keeping the materialized-SR=
F
implementation. Thoughts?

Regards,

--=20
Fujii Masao

--0000000000005001ef0653791f7e
Content-Type: application/octet-stream;
	name="v1-0001-pg_buffercache-restore-rowtype-verification-in-pg.patch"
Content-Disposition: attachment;
	filename="v1-0001-pg_buffercache-restore-rowtype-verification-in-pg.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mq0cu95u0>
X-Attachment-Id: f_mq0cu95u0

RnJvbSA1NTMyMDQ0MWE2ODYyYjRlZTE3YjhhZjgxYmUxN2EyNzgzYzAyMWU4IE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiAibWFzYW8uZnVqaWkiIDxtYXNhby5mdWppaUBtYXNhby5mdWpp
aeKAmXMtTWFjQm9vay1Qcm8+CkRhdGU6IEZyaSwgNSBKdW4gMjAyNiAxMDozNzoxMiArMDkwMApT
dWJqZWN0OiBbUEFUQ0ggdjFdIHBnX2J1ZmZlcmNhY2hlOiByZXN0b3JlIHJvd3R5cGUgdmVyaWZp
Y2F0aW9uIGluCiBwZ19idWZmZXJjYWNoZV9wYWdlcygpCgpDb21taXQgMjU3YzgyMzFiZjkgY2hh
bmdlZCBwZ19idWZmZXJjYWNoZV9wYWdlcygpIHRvIG1hdGVyaWFsaXplIGl0cyBvdXRwdXQKZGly
ZWN0bHkgaW50byBhIHR1cGxlc3RvcmUuIEFzIGEgcmVzdWx0LCB0aGUgZnVuY3Rpb24gZW5kZWQg
dXAgdHJ1c3RpbmcKYSBjYWxsZXItc3VwcGxpZWQgUkVDT1JEIGRlc2NyaXB0b3JzLiBUaGF0IGNv
dWxkIGxlYWQgdG8gY3Jhc2hlcwppZiB0aGUgc3VwcGxpZWQgcm93IGRlZmluaXRpb24gZGlkIG5v
dCBtYXRjaCB0aGUgYWN0dWFsIHJldHVybmVkIHZhbHVlcywKZm9yIGV4YW1wbGUgYnkgcGFzc2lu
ZyBib29sIERhdHVtcyB0byB0dXBsZXN0b3JlX3B1dHZhbHVlcygpIHdpdGgKYW4gaW5jb21wYXRp
YmxlIGRlc2NyaXB0b3IuCgpGaXggdGhpcyBieSBjb25zdHJ1Y3RpbmcgdGhlIGNvcnJlY3QgdHVw
bGUgZGVzY3JpcHRvciBmb3IKcGdfYnVmZmVyY2FjaGVfcGFnZXMoKSBhbmQgYXNzaWduaW5nIGl0
IHRvCnJzaW5mby0+c2V0RGVzYyBhZnRlciBJbml0TWF0ZXJpYWxpemVkU1JGKCkuIFRoaXMgcmVz
dG9yZXMgdGhlIGV4ZWN1dG9yJ3MKdHVwbGVkZXNjX21hdGNoKCkgdmVyaWZpY2F0aW9uLCBzbyBp
bmNvbXBhdGlibGUgY2FsbGVyLXN1cHBsaWVkCnJvdyBkZWZpbml0aW9ucyBhcmUgcmVqZWN0ZWQg
d2l0aCBhbiBlcnJvciwgYXMgYmVmb3JlIGNvbW1pdCAyNTdjODIzMWJmOS4KLS0tCiAuLi4vZXhw
ZWN0ZWQvcGdfYnVmZmVyY2FjaGUub3V0ICAgICAgICAgICAgICAgfCAgOCArKysKIGNvbnRyaWIv
cGdfYnVmZmVyY2FjaGUvcGdfYnVmZmVyY2FjaGVfcGFnZXMuYyB8IDUxICsrKysrKysrKysrKysr
KysrKysKIGNvbnRyaWIvcGdfYnVmZmVyY2FjaGUvc3FsL3BnX2J1ZmZlcmNhY2hlLnNxbCB8ICA2
ICsrKwogMyBmaWxlcyBjaGFuZ2VkLCA2NSBpbnNlcnRpb25zKCspCgpkaWZmIC0tZ2l0IGEvY29u
dHJpYi9wZ19idWZmZXJjYWNoZS9leHBlY3RlZC9wZ19idWZmZXJjYWNoZS5vdXQgYi9jb250cmli
L3BnX2J1ZmZlcmNhY2hlL2V4cGVjdGVkL3BnX2J1ZmZlcmNhY2hlLm91dAppbmRleCA4ODZkZWE3
NzBmNi4uYzUyYTg0OTFmZjkgMTAwNjQ0Ci0tLSBhL2NvbnRyaWIvcGdfYnVmZmVyY2FjaGUvZXhw
ZWN0ZWQvcGdfYnVmZmVyY2FjaGUub3V0CisrKyBiL2NvbnRyaWIvcGdfYnVmZmVyY2FjaGUvZXhw
ZWN0ZWQvcGdfYnVmZmVyY2FjaGUub3V0CkBAIC03Myw2ICs3MywxNCBAQCBTRUxFQ1QgY291bnQo
KikgPiAwIEZST00gcGdfYnVmZmVyY2FjaGVfdXNhZ2VfY291bnRzKCk7CiAgdAogKDEgcm93KQog
CitTRUxFQ1QgKgorRlJPTSBwZ19idWZmZXJjYWNoZV9wYWdlcygpIEFTIHAKKwkoYnVmZmVyaWQg
aW50ZWdlciwgcmVsZmlsZW5vZGUgb2lkLCByZWx0YWJsZXNwYWNlIG9pZCwgcmVsZGF0YWJhc2Ug
b2lkLAorCSByZWxmb3JrbnVtYmVyIHNtYWxsaW50LCByZWxibG9ja251bWJlciBiaWdpbnQsIGlz
ZGlydHkgdGV4dCwKKwkgdXNhZ2Vjb3VudCBzbWFsbGludCkKK0xJTUlUIDE7CitFUlJPUjogIGZ1
bmN0aW9uIHJldHVybiByb3cgYW5kIHF1ZXJ5LXNwZWNpZmllZCByZXR1cm4gcm93IGRvIG5vdCBt
YXRjaAorREVUQUlMOiAgUmV0dXJuZWQgdHlwZSBib29sZWFuIGF0IG9yZGluYWwgcG9zaXRpb24g
NywgYnV0IHF1ZXJ5IGV4cGVjdHMgdGV4dC4KIFJFU0VUIHJvbGU7CiAtLS0tLS0KIC0tLS0gVGVz
dCBwZ19idWZmZXJjYWNoZV9ldmljdCogYW5kIHBnX2J1ZmZlcmNhY2hlX21hcmtfZGlydHkqIGZ1
bmN0aW9ucwpkaWZmIC0tZ2l0IGEvY29udHJpYi9wZ19idWZmZXJjYWNoZS9wZ19idWZmZXJjYWNo
ZV9wYWdlcy5jIGIvY29udHJpYi9wZ19idWZmZXJjYWNoZS9wZ19idWZmZXJjYWNoZV9wYWdlcy5j
CmluZGV4IGJmMmU2Yzk3MjIwLi4zNGM5YjkzOTMxMyAxMDA2NDQKLS0tIGEvY29udHJpYi9wZ19i
dWZmZXJjYWNoZS9wZ19idWZmZXJjYWNoZV9wYWdlcy5jCisrKyBiL2NvbnRyaWIvcGdfYnVmZmVy
Y2FjaGUvcGdfYnVmZmVyY2FjaGVfcGFnZXMuYwpAQCAtNTksNiArNTksOCBAQCB0eXBlZGVmIHN0
cnVjdAogCUJ1ZmZlckNhY2hlT3NQYWdlc1JlYyAqcmVjb3JkOwogfSBCdWZmZXJDYWNoZU9zUGFn
ZXNDb250ZXh0OwogCitzdGF0aWMgVHVwbGVEZXNjIGJ1aWxkX2J1ZmZlcmNhY2hlX3BhZ2VzX3R1
cGxlZGVzYyhpbnQgbmF0dHMpOworCiAKIC8qCiAgKiBGdW5jdGlvbiByZXR1cm5pbmcgZGF0YSBm
cm9tIHRoZSBzaGFyZWQgYnVmZmVyIGNhY2hlIC0gYnVmZmVyIG51bWJlciwKQEAgLTg2LDYgKzg4
LDggQEAgcGdfYnVmZmVyY2FjaGVfcGFnZXMoUEdfRlVOQ1RJT05fQVJHUykKIHsKIAlSZXR1cm5T
ZXRJbmZvICpyc2luZm8gPSAoUmV0dXJuU2V0SW5mbyAqKSBmY2luZm8tPnJlc3VsdGluZm87CiAJ
VHVwbGVEZXNjCWV4cGVjdGVkX3R1cGxlZGVzYzsKKwlUdXBsZURlc2MJYWN0dWFsX3R1cGxlZGVz
YzsKKwlNZW1vcnlDb250ZXh0IG9sZGNvbnRleHQ7CiAJaW50CQkJaTsKIAogCS8qCkBAIC0xMDUs
NiArMTA5LDIxIEBAIHBnX2J1ZmZlcmNhY2hlX3BhZ2VzKFBHX0ZVTkNUSU9OX0FSR1MpCiAKIAlJ
bml0TWF0ZXJpYWxpemVkU1JGKGZjaW5mbywgMCk7CiAKKwlvbGRjb250ZXh0ID0gTWVtb3J5Q29u
dGV4dFN3aXRjaFRvKHJzaW5mby0+ZWNvbnRleHQtPmVjeHRfcGVyX3F1ZXJ5X21lbW9yeSk7CisJ
YWN0dWFsX3R1cGxlZGVzYyA9IGJ1aWxkX2J1ZmZlcmNhY2hlX3BhZ2VzX3R1cGxlZGVzYyhleHBl
Y3RlZF90dXBsZWRlc2MtPm5hdHRzKTsKKwlNZW1vcnlDb250ZXh0U3dpdGNoVG8ob2xkY29udGV4
dCk7CisKKwkvKgorCSAqIE92ZXJyaWRlIHRoZSBjYWxsZXItc3VwcGxpZWQgZGVzY3JpcHRvciB3
aXRoIHRoZSB0dXBsZSBkZXNjcmlwdG9yIHRoYXQKKwkgKiBtYXRjaGVzIHRoZSB2YWx1ZXMgd2Ug
YWN0dWFsbHkgcmV0dXJuLCBzbyBleGVjdXRvci1zaWRlCisJICogdHVwbGVkZXNjX21hdGNoKCkg
Y2FuIHZlcmlmeSB0aGUgY2FsbGVyJ3Mgcm93IGRlZmluaXRpb24uCisJICoKKwkgKiBEbyBub3Qg
ZnJlZSB0aGUgcHJldmlvdXMgcnNpbmZvLT5zZXREZXNjIGhlcmU6IGZvciBSRUNPUkQgcmVzdWx0
cyBpdAorCSAqIGNhbiBhbGlhcyByc2luZm8tPmV4cGVjdGVkRGVzYywgd2hpY2ggdGhlIGV4ZWN1
dG9yIHN0aWxsIG5lZWRzIHRvCisJICogcmVmZXJlbmNlLgorCSAqLworCXJzaW5mby0+c2V0RGVz
YyA9IGFjdHVhbF90dXBsZWRlc2M7CisKIAkvKgogCSAqIFNjYW4gdGhyb3VnaCBhbGwgdGhlIGJ1
ZmZlcnMsIGFkZGluZyBvbmUgcm93IGZvciBlYWNoIG9mIHRoZSBidWZmZXJzIHRvCiAJICogdGhl
IHR1cGxlc3RvcmUuCkBAIC0yMDUsNiArMjI0LDM4IEBAIHBnX2J1ZmZlcmNhY2hlX3BhZ2VzKFBH
X0ZVTkNUSU9OX0FSR1MpCiAJcmV0dXJuIChEYXR1bSkgMDsKIH0KIAorc3RhdGljIFR1cGxlRGVz
YworYnVpbGRfYnVmZmVyY2FjaGVfcGFnZXNfdHVwbGVkZXNjKGludCBuYXR0cykKK3sKKwlUdXBs
ZURlc2MJdHVwbGVkZXNjOworCisJdHVwbGVkZXNjID0gQ3JlYXRlVGVtcGxhdGVUdXBsZURlc2Mo
bmF0dHMpOworCVR1cGxlRGVzY0luaXRFbnRyeSh0dXBsZWRlc2MsIChBdHRyTnVtYmVyKSAxLCAi
YnVmZmVyaWQiLAorCQkJCQkgICBJTlQ0T0lELCAtMSwgMCk7CisJVHVwbGVEZXNjSW5pdEVudHJ5
KHR1cGxlZGVzYywgKEF0dHJOdW1iZXIpIDIsICJyZWxmaWxlbm9kZSIsCisJCQkJCSAgIE9JRE9J
RCwgLTEsIDApOworCVR1cGxlRGVzY0luaXRFbnRyeSh0dXBsZWRlc2MsIChBdHRyTnVtYmVyKSAz
LCAicmVsdGFibGVzcGFjZSIsCisJCQkJCSAgIE9JRE9JRCwgLTEsIDApOworCVR1cGxlRGVzY0lu
aXRFbnRyeSh0dXBsZWRlc2MsIChBdHRyTnVtYmVyKSA0LCAicmVsZGF0YWJhc2UiLAorCQkJCQkg
ICBPSURPSUQsIC0xLCAwKTsKKwlUdXBsZURlc2NJbml0RW50cnkodHVwbGVkZXNjLCAoQXR0ck51
bWJlcikgNSwgInJlbGZvcmtudW1iZXIiLAorCQkJCQkgICBJTlQyT0lELCAtMSwgMCk7CisJVHVw
bGVEZXNjSW5pdEVudHJ5KHR1cGxlZGVzYywgKEF0dHJOdW1iZXIpIDYsICJyZWxibG9ja251bWJl
ciIsCisJCQkJCSAgIElOVDhPSUQsIC0xLCAwKTsKKwlUdXBsZURlc2NJbml0RW50cnkodHVwbGVk
ZXNjLCAoQXR0ck51bWJlcikgNywgImlzZGlydHkiLAorCQkJCQkgICBCT09MT0lELCAtMSwgMCk7
CisJVHVwbGVEZXNjSW5pdEVudHJ5KHR1cGxlZGVzYywgKEF0dHJOdW1iZXIpIDgsICJ1c2FnZV9j
b3VudCIsCisJCQkJCSAgIElOVDJPSUQsIC0xLCAwKTsKKworCWlmIChuYXR0cyA9PSBOVU1fQlVG
RkVSQ0FDSEVfUEFHRVNfRUxFTSkKKwkJVHVwbGVEZXNjSW5pdEVudHJ5KHR1cGxlZGVzYywgKEF0
dHJOdW1iZXIpIDksICJwaW5uaW5nX2JhY2tlbmRzIiwKKwkJCQkJCSAgIElOVDRPSUQsIC0xLCAw
KTsKKworCVR1cGxlRGVzY0ZpbmFsaXplKHR1cGxlZGVzYyk7CisKKwlyZXR1cm4gQmxlc3NUdXBs
ZURlc2ModHVwbGVkZXNjKTsKK30KKwogLyoKICAqIElucXVpcmUgYWJvdXQgT1MgcGFnZXMgbWFw
cGluZ3MgZm9yIHNoYXJlZCBidWZmZXJzLCB3aXRoIE5VTUEgaW5mb3JtYXRpb24sCiAgKiBvcHRp
b25hbGx5LgpkaWZmIC0tZ2l0IGEvY29udHJpYi9wZ19idWZmZXJjYWNoZS9zcWwvcGdfYnVmZmVy
Y2FjaGUuc3FsIGIvY29udHJpYi9wZ19idWZmZXJjYWNoZS9zcWwvcGdfYnVmZmVyY2FjaGUuc3Fs
CmluZGV4IDEyN2Q2MDQ5MDVjLi5iZTg5YjVmNWEzYSAxMDA2NDQKLS0tIGEvY29udHJpYi9wZ19i
dWZmZXJjYWNoZS9zcWwvcGdfYnVmZmVyY2FjaGUuc3FsCisrKyBiL2NvbnRyaWIvcGdfYnVmZmVy
Y2FjaGUvc3FsL3BnX2J1ZmZlcmNhY2hlLnNxbApAQCAtMzQsNiArMzQsMTIgQEAgU0VMRUNUIGNv
dW50KCopID4gMCBGUk9NIHBnX2J1ZmZlcmNhY2hlOwogU0VMRUNUIGNvdW50KCopID4gMCBGUk9N
IHBnX2J1ZmZlcmNhY2hlX29zX3BhZ2VzOwogU0VMRUNUIGJ1ZmZlcnNfdXNlZCArIGJ1ZmZlcnNf
dW51c2VkID4gMCBGUk9NIHBnX2J1ZmZlcmNhY2hlX3N1bW1hcnkoKTsKIFNFTEVDVCBjb3VudCgq
KSA+IDAgRlJPTSBwZ19idWZmZXJjYWNoZV91c2FnZV9jb3VudHMoKTsKK1NFTEVDVCAqCitGUk9N
IHBnX2J1ZmZlcmNhY2hlX3BhZ2VzKCkgQVMgcAorCShidWZmZXJpZCBpbnRlZ2VyLCByZWxmaWxl
bm9kZSBvaWQsIHJlbHRhYmxlc3BhY2Ugb2lkLCByZWxkYXRhYmFzZSBvaWQsCisJIHJlbGZvcmtu
dW1iZXIgc21hbGxpbnQsIHJlbGJsb2NrbnVtYmVyIGJpZ2ludCwgaXNkaXJ0eSB0ZXh0LAorCSB1
c2FnZWNvdW50IHNtYWxsaW50KQorTElNSVQgMTsKIFJFU0VUIHJvbGU7CiAKIAotLSAKMi41My4w
Cgo=
--0000000000005001ef0653791f7e--