Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wvE6Q-0019Jh-27 for pgsql-bugs@arkaria.postgresql.org; Sat, 15 Aug 2026 13:07:11 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wvE6M-00430O-30 for pgsql-bugs@arkaria.postgresql.org; Sat, 15 Aug 2026 13:07:08 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wvE6M-00430G-0P for pgsql-bugs@lists.postgresql.org; Sat, 15 Aug 2026 13:07:07 +0000 Received: from mail-ed1-x534.google.com ([2a00:1450:4864:20::534]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.98.2) (envelope-from ) id 1wvE6G-00000000krC-287v for pgsql-bugs@lists.postgresql.org; Sat, 15 Aug 2026 13:07:05 +0000 Received: by mail-ed1-x534.google.com with SMTP id 4fb4d7f45d1cf-6a0a4a17f91so2826749a12.1 for ; Sat, 15 Aug 2026 06:07:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=garret-ru.20251104.gappssmtp.com; s=20251104; t=1786799217; x=1787404017; darn=lists.postgresql.org; h=subject:from:to:content-language:user-agent:mime-version:date :message-id:content-type:from:to:cc:subject:date:message-id:reply-to :content-type; bh=CKr+D4M4ZDS64B9JBSexypiWpuHuqSMiJEPeu6XSnaI=; b=ZDaN9Jnxy7VkP3keWo8UkAuUs+bgK1il88I9UCoV1xpDMQvxj2k+m/PPv37f8ACZKZ XL3EU0o3TjGJ8ZmIg38NjNDu6jwq0yUuSMtId9TwqWMmO/HTwAYGCvt0thnhgnIRwf0/ lJRjSkN2gXqo4HlRhWknnyxYJTyVtprv8A3ZF4itOHCu1s1R0kqYr2KwRRddwxFcJTeL X4fztsun7WZ9NntGH7Gmm3+0eocG2G7KXJcjMoB1EnuiSfC14yLsQTsMVZ8twqGC2QUS 14WjvB6gFTSvFynk9ayDB+HSw+UDLWBK7GH0SwsrIKoIgXS60zRUN9SiwNl0ZE9/mpea hPHw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786799217; x=1787404017; h=subject:from:to:content-language:user-agent:mime-version:date :message-id:content-type:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=CKr+D4M4ZDS64B9JBSexypiWpuHuqSMiJEPeu6XSnaI=; b=ZoaK8Z6XFLclns0f9K57AIhmvjKBJVgrbruJgAzV4JAy8/XJtEtLya1APKHEGbk5g5 VOpHLjOku8zYivpRyXVpywz/kTFbCuLoZBXhqKlrTQsNh3snlIArI0hsTew0Le689Okv T57v62H9CQcpPSd+GpvvvTK6+bJI/kYlxnG63r7Zm2oOUr12wH7Bdt+YCnHaMXMvKxnt zrxQjXErIONKf2aLp0G7T0sLRGUzzf7lKJZ8nNFLVYsyZzWz4U4hCDxsT8VCfjORQNu/ ID7ANEdZ9lC2YkAELbim3aPuLoZmhrHluUCcYeeP6nKzuq28FOfs6CctLC299O99TGmb snlA== X-Gm-Message-State: AOJu0YzKas7apXgz6jhhXorMWQomX60QB76QgEoWyvtPtMc3S7qBfBMn M7JGvtBN+k+cWxEr/1KctPbvnnsx9mTqKT+7C7RVDJ7bbKCu+Cg0JILNNG7UMZVUDLQuyo3MBiy zsoSjcg== X-Gm-Gg: AR+sD12wAFLzoBjtpk28HSJgqRB4zsFDssqfwrE67iaquHMq1NVhdtYpEnqyeYaHblU Grqu4prDAGdAu/yInx1WxN5VpIQyg+akHz0uwNFhyrZbGhVrofKj5vcxQ8j6M5wJatqu6DuJRGB 9YfQKRT5qo9FsOO00ny7oGwCDDVAszS7MHSqLthf+ZiE7J80n5qHg/bwsne8++J29nhR9d7X8DI b+AgE9cRaLqqdnr/4/9SFPe7DzQRQA7axWkiC+wUbtyvLdM3X6TuWccEE9pPbLGiQ8FwEPji//4 DmtWGnPYJunkgVXaPcVY0N2qH7Xaqu86ygllTtUJknx5o9ODOUgrwtubg8wzrf936v+iTaD6Osw D6+83OEHhuKsox6KBErQrn/lZxwltXmRoORrCiY3D7ppBOiG7J7PFFS4hwR15vL4bYL029iPtHd yk9WFhjUjzbORb3xkf+eM0dnaeH8IyQaNHAaYsMRnniTDJe3e7DHaoFqCWFddYtdfSIfazP3SDP ZUc X-Received: by 2002:a17:907:3d4c:b0:c1c:4e36:eec6 with SMTP id a640c23a62f3a-c212a12b064mr641388766b.18.1786799216840; Sat, 15 Aug 2026 06:06:56 -0700 (PDT) Received: from [10.248.56.19] ([75.125.237.193]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c21233a174fsm225910366b.5.2026.08.15.06.06.54 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 15 Aug 2026 06:06:54 -0700 (PDT) Content-Type: multipart/mixed; boundary="------------Onvru6lGQ6xX4BpZVjznR70Y" Message-ID: Date: Sat, 15 Aug 2026 16:06:53 +0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: PostgreSQL mailing lists From: Konstantin Knizhnik Subject: SIGSEGV in dynahash List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk This is a multi-part message in MIME format. --------------Onvru6lGQ6xX4BpZVjznR70Y Content-Type: multipart/alternative; boundary="------------iPU4Yef9h4Ox7IckGcw0G1Ae" --------------iPU4Yef9h4Ox7IckGcw0G1Ae Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit On PG19,|ShmemInitHash|always builds afixed-sizeshared hash with abump allocator(|ShmemHashAlloc|) whose|alloc_arg|is astack-localregion used only during|hash_create|. After init, that pointer is dead. In|hash_search|, for every|HASH_ENTER|/|HASH_ENTER_NULL|, dynahash does thisbeforelookup: dynahash.cLines927-937 if(action ==HASH_ENTER ||action ==HASH_ENTER_NULL) { if(hctl->freeList[0].nentries>(int64)hctl->max_bucket&& !IS_PARTITIONED(hctl)&&!hashp->frozen&& !has_seq_scans(hashp)) (void)expand_table(hashp); } It may cause SIGSEGV in case of using HASH_ENTER_NULL: hash_search(HASH_ENTER_NULL) → expand_table → seg_alloc → SIGSEGV in libc (MemSet/alloc) Pre-PG19, shared hashes used|ShmemAllocNoError|from the global pool, so a failed grow tended to return|NULL|/ error instead of faulting on a dead bump allocator. It was introduced by commit 9fe9ecd516b — Allocate all parts of shmem hash table from a single contiguous area Patch preventing extension of fixed dynahash is attached. --------------iPU4Yef9h4Ox7IckGcw0G1Ae Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

On PG19,=C2=A0Shm= emInitHash=C2=A0always builds a=C2=A0fixed-size=C2=A0shared hash with a=C2=A0bump allocator= =C2=A0(Shm= emHashAlloc) whose=C2=A0all= oc_arg=C2=A0is a=C2=A0stack-local=C2=A0region used only during=C2=A0has= h_create. After init, that pointer is dead.

In=C2=A0has= h_search, for every=C2=A0HAS= H_ENTER=C2=A0/=C2=A0HAS= H_ENTER_NULL, dynahash does this=C2=A0before<= span>=C2=A0lookup:

if (action =3D=3D HASH_ENTER || action =3D=3D HASH_ENTER_NULL<= /span>)
{
if (hctl->freeList[0].nentries > (int64) hctl->max_bucket= &&=
!IS_PARTITIONED(hctl) &&= !hashp->frozen &&=
!has_seq_scans(hashp))
(void) expand_table(hashp);
}


It may cause SIGSEGV in case of using HASH_ENTER_NULL:


hash_search(HASH_ENTER_NULL)
=E2=86=92 expand_table =E2=86=92 seg_alloc = =E2=86=92 SIGSEGV in libc (MemSet/alloc)


Pre-PG19, shared hashes used=C2=A0Shm= emAllocNoError=C2=A0from the global pool, so a failed grow tended to return=C2=A0NUL= L=C2=A0/ error instead of faulting on a dead bump allocator.

It was introduced by commit 9fe9ecd516b =E2=80=94 Allocate all par= ts of shmem hash table from a single contiguous area

Patch preventing extension of fixed dynahash is attached. --------------iPU4Yef9h4Ox7IckGcw0G1Ae-- --------------Onvru6lGQ6xX4BpZVjznR70Y Content-Type: text/plain; charset=UTF-8; name="0001-prevent-fixed-dynahash-extension-20260815.patch" Content-Disposition: attachment; filename="0001-prevent-fixed-dynahash-extension-20260815.patch" Content-Transfer-Encoding: base64 ZGlmZiAtLWdpdCBhL3NyYy9iYWNrZW5kL3V0aWxzL2hhc2gvZHluYWhhc2guYyBiL3NyYy9i YWNrZW5kL3V0aWxzL2hhc2gvZHluYWhhc2guYwppbmRleCBkYzdhZTY0YTVhOS4uNzI3YWRm Y2NmMmQgMTAwNjQ0Ci0tLSBhL3NyYy9iYWNrZW5kL3V0aWxzL2hhc2gvZHluYWhhc2guYwor KysgYi9zcmMvYmFja2VuZC91dGlscy9oYXNoL2R5bmFoYXNoLmMKQEAgLTkyNywxMSArOTI3 LDEzIEBAIGhhc2hfc2VhcmNoX3dpdGhfaGFzaF92YWx1ZShIVEFCICpoYXNocCwKIAlpZiAo YWN0aW9uID09IEhBU0hfRU5URVIgfHwgYWN0aW9uID09IEhBU0hfRU5URVJfTlVMTCkKIAl7 CiAJCS8qCi0JCSAqIENhbid0IHNwbGl0IGlmIHJ1bm5pbmcgaW4gcGFydGl0aW9uZWQgbW9k ZSwgbm9yIGlmIGZyb3plbiwgbm9yIGlmCisJCSAqIENhbid0IHNwbGl0IGlmIHJ1bm5pbmcg aW4gcGFydGl0aW9uZWQgbW9kZSwgbm9yIGlmIGZyb3plbiwKKwkJICogbm9yIGlmIGZpeGVk IChpbiBzaGFyZWQgbWVtb3J5KSwgbm9yIGlmCiAJCSAqIHRhYmxlIGlzIHRoZSBzdWJqZWN0 IG9mIGFueSBhY3RpdmUgaGFzaF9zZXFfc2VhcmNoIHNjYW5zLgogCQkgKi8KIAkJaWYgKGhj dGwtPmZyZWVMaXN0WzBdLm5lbnRyaWVzID4gKGludDY0KSBoY3RsLT5tYXhfYnVja2V0ICYm CiAJCQkhSVNfUEFSVElUSU9ORUQoaGN0bCkgJiYgIWhhc2hwLT5mcm96ZW4gJiYKKwkJCSFo Y3RsLT5pc2ZpeGVkICYmCiAJCQkhaGFzX3NlcV9zY2FucyhoYXNocCkpCiAJCQkodm9pZCkg ZXhwYW5kX3RhYmxlKGhhc2hwKTsKIAl9Cg== --------------Onvru6lGQ6xX4BpZVjznR70Y--