Content-Type: multipart/mixed;
 boundary=8d48e7367705b5a8026706d3d1c6a27d46cd2154b0f6be54d85c6ef3bcc6
Mime-Version: 1.0
Date: Tue, 09 Jun 2026 19:25:55 -0300
Message-Id: <DJ4VE1MCA80G.1AG5OOFGIWCI0@gmail.com>
Subject: Re: Autoprewarm workers terminated due to a segmentation fault
From: "Matheus Alcantara" <matheusssilv97@gmail.com>
To: "Tomas Vondra" <tomas@vondra.me>, "Glauber Batista"
 <glauberrbatista@gmail.com>, <pgsql-bugs@lists.postgresql.org>
References: 
 <CAO+_mTQgQyTYwDh=U8iTnsDmOGyWsZJjUV31SmEYwmw6_xY6Bw@mail.gmail.com>
 <DJ4TOYZGE7M8.1U3BNIRMQVXQX@gmail.com>
 <f4c7fe76-6b98-4d92-a090-2ba8184b8997@vondra.me>
In-Reply-To: <f4c7fe76-6b98-4d92-a090-2ba8184b8997@vondra.me>
Archived-At: 
 <https://www.postgresql.org/message-id/DJ4VE1MCA80G.1AG5OOFGIWCI0%40gmail.com>
Precedence: bulk

--8d48e7367705b5a8026706d3d1c6a27d46cd2154b0f6be54d85c6ef3bcc6
Content-Type: multipart/alternative;
 boundary=d25fbc43a4271520a54e8c500b0040a6e11678fb9c4b876a1e255b33371d

--d25fbc43a4271520a54e8c500b0040a6e11678fb9c4b876a1e255b33371d
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Type: text/plain; charset=UTF-8

On Tue Jun 9, 2026 at 6:44 PM -03, Tomas Vondra wrote:
> So how does it get advanced past the prewarm_stop_idx? I've been unable
> to reproduce it locally, maybe it's platform-specific. The original
> report was from ARM, are you on ARM too, Matheus?
>

Yes, I'm also on ARM. I also set pg_prewarm.autoprewarm_interval=3D10s on
postgresql.conf, not sure if it make more easier to reproduce.

> But AFAIK the code may not account for read stream callback updating the
> pos to prewarm_stop_idx? The callback may end with (p->pos =3D
> apw_state->prewarm_stop_idx), and that seems to be past the end of the
> array.
>

Yes, this is my understanding.

> That'd mean the proposed check is generally the correct way to fix this.
> TBH it's not clear to me why this needs to set the *next* entry at the
> end of the loop. Well, it does that so that the loop condition can use
> 'blk', but that seems a bit fragile / confusing, and no one noticed the
> issue.
>
> Maybe this would be a better way to write the while loop?
>
>     while (i < apw_state->prewarm_stop_idx)
>     {
>         blk =3D block_info[i];
>
>         if (blk.tablespace !=3D tablespace ||
>             blk.filenumber !=3D filenumber)
>             break;
>
>         ...
>     }
>
>

Is attached patch what are you sugesting? If yes, I agree that looks
better, it's more safe and easier to understand.

--
Matheus Alcantara
EDB: https://www.enterprisedb.com

--d25fbc43a4271520a54e8c500b0040a6e11678fb9c4b876a1e255b33371d--

--8d48e7367705b5a8026706d3d1c6a27d46cd2154b0f6be54d85c6ef3bcc6
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename=v2-0001-Fix-out-of-bounds-access-in-autoprewarm-worker.patch
Content-Type: text/plain; charset=utf-8;
 name=v2-0001-Fix-out-of-bounds-access-in-autoprewarm-worker.patch

RnJvbSBlYmY1Mjk2MDI2YjZmMDdmYjMwODIxZWUwNjAzZmZmMjQ4MTcwMDFiIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBNYXRoZXVzIEFsY2FudGFyYSA8bXRocy5kZXZAcG0ubWU+CkRh
dGU6IFR1ZSwgOSBKdW4gMjAyNiAxNzo1OToyMCAtMDMwMApTdWJqZWN0OiBbUEFUQ0ggdjJdIEZp
eCBvdXQtb2YtYm91bmRzIGFjY2VzcyBpbiBhdXRvcHJld2FybSB3b3JrZXIKClRoZSByZWFkIHN0
cmVhbSBjYWxsYmFjayBhcHdfcmVhZF9zdHJlYW1fbmV4dF9ibG9jaygpIGFkdmFuY2VzIHAtPnBv
cwp0aHJvdWdoIHRoZSBibG9ja19pbmZvIGFycmF5LiBXaGVuIHByb2Nlc3NpbmcgdGhlIGxhc3Qg
YmxvY2ssIGl0CmluY3JlbWVudHMgcC0+cG9zIHRvIHByZXdhcm1fc3RvcF9pZHggYmVmb3JlIHJl
dHVybmluZy4gVGhlIGNhbGxiYWNrCml0c2VsZiBpcyBzYWZlIGJlY2F1c2UgaXQgY2hlY2tzIGJv
dW5kcyBiZWZvcmUgYWNjZXNzaW5nIHRoZSBhcnJheS4KCkhvd2V2ZXIsIHRoZSBjYWxsZXIgYXNz
aWduZWQgYmxrIGZyb20gYmxvY2tfaW5mb1tpXSBhdCB0aGUgZW5kIG9mIHRoZQpsb29wIGJvZHks
IGJlZm9yZSB0aGUgbG9vcCBjb25kaXRpb24gd2FzIHJlLWV2YWx1YXRlZC4gV2hlbiBpIGVxdWFs
ZWQKcHJld2FybV9zdG9wX2lkeCwgdGhpcyBhY2Nlc3NlZCBtZW1vcnkgYmV5b25kIHRoZSBhbGxv
Y2F0ZWQgRFNNIHNlZ21lbnQsCmNhdXNpbmcgYSBzZWdmYXVsdC4KClJlc3RydWN0dXJlIHRoZSBs
b29wIHRvIGNoZWNrIGJvdW5kcyBhdCB0aGUgdG9wIGFuZCBhc3NpZ24gYmxrIGF0IHRoZQpiZWdp
bm5pbmcgb2YgdGhlIGxvb3AgYm9keSwgd2hlcmUgaXQgaXMgYWx3YXlzIHNhZmUuIFRoaXMgYXZv
aWRzIHRoZQpuZWVkIGZvciBhbiBleHBsaWNpdCBib3VuZHMgY2hlY2sgYXQgdGhlIGVuZC4KCkF1
dGhvcjogTWF0aGV1cyBBbGNhbnRhcmEgPG10aHMuZGV2QHBtLm1lPgpSZXBvcnRlZC1ieTogR2xh
dWJlciBCYXRpc3RhIDxnbGF1YmVycmJhdGlzdGFAZ21haWwuY29tPgpEaXNjdXNzaW9uOiBodHRw
czovL3d3dy5wb3N0Z3Jlc3FsLm9yZy9tZXNzYWdlLWlkL0NBTyUyQl9tVFFnUXlUWXdEaCUzRFU4
aVRuc0RtT0d5V3NaSmpVVjMxU21FWXdtdzZfeFk2QnclNDBtYWlsLmdtYWlsLmNvbQotLS0KIGNv
bnRyaWIvcGdfcHJld2FybS9hdXRvcHJld2FybS5jIHwgMTYgKysrKysrKysrKystLS0tLQogMSBm
aWxlIGNoYW5nZWQsIDExIGluc2VydGlvbnMoKyksIDUgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0
IGEvY29udHJpYi9wZ19wcmV3YXJtL2F1dG9wcmV3YXJtLmMgYi9jb250cmliL3BnX3ByZXdhcm0v
YXV0b3ByZXdhcm0uYwppbmRleCBiYTBiYzhlNmQ0YS4uZjM1NjliMTJkMTEgMTAwNjQ0Ci0tLSBh
L2NvbnRyaWIvcGdfcHJld2FybS9hdXRvcHJld2FybS5jCisrKyBiL2NvbnRyaWIvcGdfcHJld2Fy
bS9hdXRvcHJld2FybS5jCkBAIC01NzIsMTYgKzU3MiwyMyBAQCBhdXRvcHJld2FybV9kYXRhYmFz
ZV9tYWluKERhdHVtIG1haW5fYXJnKQogCQkgKiB2YWxpZCBmb3JrcyBvciBydW4gb3V0IG9mIG9w
dGlvbnMsIHdlJ2xsIGNsb3NlIHRoZSByZWxhdGlvbiBhbmQKIAkJICogbW92ZSBvbi4KIAkJICov
Ci0JCXdoaWxlIChpIDwgYXB3X3N0YXRlLT5wcmV3YXJtX3N0b3BfaWR4ICYmCi0JCQkgICBibGsu
dGFibGVzcGFjZSA9PSB0YWJsZXNwYWNlICYmCi0JCQkgICBibGsuZmlsZW51bWJlciA9PSBmaWxl
bnVtYmVyKQorCQl3aGlsZSAoaSA8IGFwd19zdGF0ZS0+cHJld2FybV9zdG9wX2lkeCkKIAkJewot
CQkJRm9ya051bWJlcglmb3JrbnVtID0gYmxrLmZvcmtudW07CisJCQlGb3JrTnVtYmVyCWZvcmtu
dW07CiAJCQlCbG9ja051bWJlciBuYmxvY2tzOwogCQkJc3RydWN0IEF1dG9QcmV3YXJtUmVhZFN0
cmVhbURhdGEgcDsKIAkJCVJlYWRTdHJlYW0gKnN0cmVhbTsKIAkJCUJ1ZmZlcgkJYnVmOwogCisJ
CQlibGsgPSBibG9ja19pbmZvW2ldOworCisJCQkvKiBTdG9wIHdoZW4gd2UgcmVhY2ggYSBkaWZm
ZXJlbnQgcmVsYXRpb24uICovCisJCQlpZiAoYmxrLnRhYmxlc3BhY2UgIT0gdGFibGVzcGFjZSB8
fAorCQkJCWJsay5maWxlbnVtYmVyICE9IGZpbGVudW1iZXIpCisJCQkJYnJlYWs7CisKKwkJCWZv
cmtudW0gPSBibGsuZm9ya251bTsKKwogCQkJLyoKIAkJCSAqIHNtZ3JleGlzdHMgaXMgbm90IHNh
ZmUgZm9yIGlsbGVnYWwgZm9ya251bSwgaGVuY2UgY2hlY2sgd2hldGhlcgogCQkJICogdGhlIHBh
c3NlZCBmb3JrbnVtIGlzIHZhbGlkIGJlZm9yZSB1c2luZyBpdCBpbiBzbWdyZXhpc3RzLgpAQCAt
NjQ1LDcgKzY1Miw2IEBAIGF1dG9wcmV3YXJtX2RhdGFiYXNlX21haW4oRGF0dW0gbWFpbl9hcmcp
CiAKIAkJCS8qIEFkdmFuY2UgaSBwYXN0IGFsbCB0aGUgYmxvY2tzIGp1c3QgcHJld2FybWVkLiAq
LwogCQkJaSA9IHAucG9zOwotCQkJYmxrID0gYmxvY2tfaW5mb1tpXTsKIAkJfQogCiAJCXJlbGF0
aW9uX2Nsb3NlKHJlbCwgQWNjZXNzU2hhcmVMb2NrKTsKLS0gCjIuNTAuMSAoQXBwbGUgR2l0LTE1
NSkKCg==
--8d48e7367705b5a8026706d3d1c6a27d46cd2154b0f6be54d85c6ef3bcc6--