Content-Type: multipart/mixed; boundary="------------wDqqzX04vEFC2yCV1Yi6KKXV"
Message-ID: <e3ae5aa3-a051-4e07-9fac-c0a24c361e22@iki.fi>
Date: Tue, 25 Aug 2026 14:14:45 +0300
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: SIGSEGV in dynahash
To: Rahila Syed <rahilasyed90@gmail.com>,
 Konstantin Knizhnik <knizhnik@garret.ru>
Cc: PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
References: <d59221f2-b3d2-41ad-8bf0-d581b42e4cba@garret.ru>
 <CAH2L28vNkw2G4PbfWKKWSeaM_fntE3hpL3VRXkKSesEe21Z=Cg@mail.gmail.com>
Content-Language: en-US
From: Heikki Linnakangas <hlinnaka@iki.fi>
In-Reply-To: 
 <CAH2L28vNkw2G4PbfWKKWSeaM_fntE3hpL3VRXkKSesEe21Z=Cg@mail.gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/e3ae5aa3-a051-4e07-9fac-c0a24c361e22%40iki.fi>
Precedence: bulk

This is a multi-part message in MIME format.
--------------wDqqzX04vEFC2yCV1Yi6KKXV
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 25/08/2026 07:30, Rahila Syed wrote:
>> On PG19, ShmemInitHash always builds a fixed-size shared hash with a bump allocator (ShmemHashAlloc) whose alloc_arg is a stack-local region used only during hash_create. After init, that pointer is dead.
>>
>> In hash_search, for every HASH_ENTER / HASH_ENTER_NULL, dynahash does this before lookup:
>>
>> dynahash.cLines 927-937
>> if (action == HASH_ENTER || action == HASH_ENTER_NULL)
>> {
>> if (hctl->freeList[0].nentries > (int64) hctl->max_bucket &&
>> !IS_PARTITIONED(hctl) && !hashp->frozen &&
>> !has_seq_scans(hashp))
>> (void) expand_table(hashp);
>> }
>>
>>
>> It may cause SIGSEGV in case of using HASH_ENTER_NULL:
>>
>>
>> hash_search(HASH_ENTER_NULL)
>> → expand_table → seg_alloc → SIGSEGV in libc (MemSet/alloc)
> 
> The same thing cannot be triggered by
> hash_search_with_hash_value()->get_hash_entry()->element_alloc()
> because element_alloc()'s
> if (hctl->isfixed) return false; guard trips before ever touching the allocator.
> 
> Similarly for dir_realloc() which has a check if
> (hashp->hctl->max_dsize != NO_MAX_DSIZE) return false.
> Since shared hash tables set a fixed max_dsize (not NO_MAX_DSIZE),
> dir_realloc() returns false immediately instead of growing the
> directory.
> 
> This makes me think we should add a check for hctl->isfixed in
> seg_alloc() instead of before
> expand_table() like it is done in the proposed patch.

Hmm, yeah, I see what you mean, although I don't feel too bad about just 
assuming that they're not called from elsewhere. I added an 
Assert(!hashp->hctl->isfixed) in both seg_alloc() and dir_realloc(), to 
document that you shouldn't get there for fixed-size hash tables.

Committed the fix with those extra Asserts. Thanks!

> It would also be valuable to add this SIGSEGV as a regression test. It
> can't be triggered through any of the existing shared hash tables,
> though — LOCK and PROCLOCK are the only fixed-size ones in core, and
> both are partitioned, which makes expand_table() unreachable for them
> (!IS_PARTITIONED(hctl) at dynahash.c:934/:1497). A dedicated
> non-partitioned, fixed-size test hash table would be needed.

All shmem hash tables are fixed-size. But you need one that has just the 
right number of elements, is not partitioned, and you then need to fill 
it up to trigger the bug.

I came up with the attached, but now that we've fixed the bug it doesn't 
feel very interesting to test for exactly that, so I didn't feel it's 
worth committing. Maybe as part of a larger unit test of various hash 
table operations, but even then the requirement that the hash table is 
just the right size to exercise this case feels fragile.

- Heikki
--------------wDqqzX04vEFC2yCV1Yi6KKXV
Content-Type: text/x-patch; charset=UTF-8;
 name="test-fixed-hash-expand-bug.patch"
Content-Disposition: attachment; filename="test-fixed-hash-expand-bug.patch"
Content-Transfer-Encoding: base64

ZGlmZiAtLWdpdCBhL3NyYy90ZXN0L21vZHVsZXMvdGVzdF9zaG1lbS90LzAwMV9sYXRlX3No
bWVtX2FsbG9jLnBsIGIvc3JjL3Rlc3QvbW9kdWxlcy90ZXN0X3NobWVtL3QvMDAxX2xhdGVf
c2htZW1fYWxsb2MucGwKaW5kZXggNWNmMDdkMDcxZWMuLjYyYmU1Y2QwZWRkIDEwMDY0NAot
LS0gYS9zcmMvdGVzdC9tb2R1bGVzL3Rlc3Rfc2htZW0vdC8wMDFfbGF0ZV9zaG1lbV9hbGxv
Yy5wbAorKysgYi9zcmMvdGVzdC9tb2R1bGVzL3Rlc3Rfc2htZW0vdC8wMDFfbGF0ZV9zaG1l
bV9hbGxvYy5wbApAQCAtMjUsNiArMjUsMTEgQEAgbXkgJGF0dGFjaF9jb3VudDIgPQogICAk
bm9kZS0+c2FmZV9wc3FsKCJwb3N0Z3JlcyIsICJTRUxFQ1QgZ2V0X3Rlc3Rfc2htZW1fYXR0
YWNoX2NvdW50KCk7Iik7CiBjbXBfb2soJGF0dGFjaF9jb3VudDIsICc+JywgJGF0dGFjaF9j
b3VudDEsCiAJImF0dGFjaCBjYWxsYmFjayBpcyBjYWxsZWQgaW4gZWFjaCBiYWNrZW5kIik7
CisKKyMgVGVzdCBhIHNoYXJlZCBtZW1vcnkgaGFzaCB0YWJsZSB0b28uCitteSAkcmVzdWx0
ID0gJG5vZGUtPnNhZmVfcHNxbCgicG9zdGdyZXMiLCAiU0VMRUNUIHRlc3Rfc2htZW1faGFz
aF9vdmVyZmxvdygpOyIpOworb2soJHJlc3VsdCBlcSAiIiwgInNobWVtIGhhc2ggd29ya3Mi
KTsKKwogJG5vZGUtPnN0b3A7CiAKICMjIwpAQCAtNTYsNSArNjEsOSBAQCBlbHNlCiAJKTsK
IH0KIAorIyBUZXN0IGEgc2hhcmVkIG1lbW9yeSBoYXNoIHRhYmxlIHRvby4KKyRyZXN1bHQg
PSAkbm9kZS0+c2FmZV9wc3FsKCJwb3N0Z3JlcyIsICJTRUxFQ1QgdGVzdF9zaG1lbV9oYXNo
X292ZXJmbG93KCk7Iik7CitvaygkcmVzdWx0IGVxICIiLCAic2htZW0gaGFzaCB3b3JrcyIp
OworCiAkbm9kZS0+c3RvcDsKIGRvbmVfdGVzdGluZygpOwpkaWZmIC0tZ2l0IGEvc3JjL3Rl
c3QvbW9kdWxlcy90ZXN0X3NobWVtL3Rlc3Rfc2htZW0tLTEuMC5zcWwgYi9zcmMvdGVzdC9t
b2R1bGVzL3Rlc3Rfc2htZW0vdGVzdF9zaG1lbS0tMS4wLnNxbAppbmRleCAyZDAxZmQ5MjU2
Yy4uN2I5MWY4YzZmNDIgMTAwNjQ0Ci0tLSBhL3NyYy90ZXN0L21vZHVsZXMvdGVzdF9zaG1l
bS90ZXN0X3NobWVtLS0xLjAuc3FsCisrKyBiL3NyYy90ZXN0L21vZHVsZXMvdGVzdF9zaG1l
bS90ZXN0X3NobWVtLS0xLjAuc3FsCkBAIC03LDMgKzcsNyBAQAogQ1JFQVRFIEZVTkNUSU9O
IGdldF90ZXN0X3NobWVtX2F0dGFjaF9jb3VudCgpCiBSRVRVUk5TIHBnX2NhdGFsb2cuaW50
NCBTVFJJQ1QKIEFTICdNT0RVTEVfUEFUSE5BTUUnIExBTkdVQUdFIEM7CisKK0NSRUFURSBG
VU5DVElPTiB0ZXN0X3NobWVtX2hhc2hfb3ZlcmZsb3coKQorUkVUVVJOUyB2b2lkIFNUUklD
VAorQVMgJ01PRFVMRV9QQVRITkFNRScgTEFOR1VBR0UgQzsKZGlmZiAtLWdpdCBhL3NyYy90
ZXN0L21vZHVsZXMvdGVzdF9zaG1lbS90ZXN0X3NobWVtLmMgYi9zcmMvdGVzdC9tb2R1bGVz
L3Rlc3Rfc2htZW0vdGVzdF9zaG1lbS5jCmluZGV4IDliZDQwMTJiNDM1Li5kYTlmZGRjNWVl
NSAxMDA2NDQKLS0tIGEvc3JjL3Rlc3QvbW9kdWxlcy90ZXN0X3NobWVtL3Rlc3Rfc2htZW0u
YworKysgYi9zcmMvdGVzdC9tb2R1bGVzL3Rlc3Rfc2htZW0vdGVzdF9zaG1lbS5jCkBAIC0y
MCwxMCArMjAsMTIgQEAKICNpbmNsdWRlICJmbWdyLmgiCiAjaW5jbHVkZSAibWlzY2FkbWlu
LmgiCiAjaW5jbHVkZSAic3RvcmFnZS9zaG1lbS5oIgorI2luY2x1ZGUgInV0aWxzL2hzZWFy
Y2guaCIKIAogCiBQR19NT0RVTEVfTUFHSUM7CiAKKy8qIEZvciB0ZXN0aW5nIFNobWVtUmVx
dWVzdFN0cnVjdCAqLwogdHlwZWRlZiBzdHJ1Y3QgVGVzdFNobWVtRGF0YQogewogCWludAkJ
CXZhbHVlOwpAQCAtMzUsNiArMzcsMjEgQEAgc3RhdGljIFRlc3RTaG1lbURhdGEgKlRlc3RT
aG1lbTsKIAogc3RhdGljIGJvb2wgYXR0YWNoZWRfb3JfaW5pdGlhbGl6ZWQgPSBmYWxzZTsK
IAorLyogRm9yIHRlc3RpbmcgU2htZW1SZXF1ZXN0SGFzaCAqLworCisvKgorICogWFhYOiBU
aGlzIGlzIGNob3NlbiB0byBiZSBlcXVhbCB0byBIQVNIX1NFR1NJWkUgKDI1Nikgc28gdGhh
dCB3ZSBleGVyY2lzZQorICogdGhlIGRpcmVjdG9yeSBleHBhbnNpb24gYnVnLgorICovCisj
ZGVmaW5lIFRFU1RfSEFTSF9ORUxFTVMJMjU2CisKK3R5cGVkZWYgc3RydWN0IFRlc3RIYXNo
RW50cnkKK3sKKwlpbnQzMgkJa2V5OwkJCS8qIGhhc2gga2V5LCBtdXN0IGJlIGZpcnN0ICov
Cit9IFRlc3RIYXNoRW50cnk7CisKK3N0YXRpYyBIVEFCICpUZXN0U2htZW1IYXNoOworCiBz
dGF0aWMgdm9pZCB0ZXN0X3NobWVtX3JlcXVlc3Qodm9pZCAqYXJnKTsKIHN0YXRpYyB2b2lk
IHRlc3Rfc2htZW1faW5pdCh2b2lkICphcmcpOwogc3RhdGljIHZvaWQgdGVzdF9zaG1lbV9h
dHRhY2godm9pZCAqYXJnKTsKQEAgLTU0LDYgKzcxLDEzIEBAIHRlc3Rfc2htZW1fcmVxdWVz
dCh2b2lkICphcmcpCiAJU2htZW1SZXF1ZXN0U3RydWN0KC5uYW1lID0gInRlc3Rfc2htZW0g
YXJlYSIsCiAJCQkJCSAgIC5zaXplID0gc2l6ZW9mKFRlc3RTaG1lbURhdGEpLAogCQkJCQkg
ICAucHRyID0gKHZvaWQgKiopICZUZXN0U2htZW0pOworCisJU2htZW1SZXF1ZXN0SGFzaCgu
bmFtZSA9ICJ0ZXN0X3NobWVtIG92ZXJmbG93IGhhc2giLAorCQkJCQkgLm5lbGVtcyA9IFRF
U1RfSEFTSF9ORUxFTVMsCisJCQkJCSAuaGFzaF9pbmZvLmtleXNpemUgPSBzaXplb2YoaW50
MzIpLAorCQkJCQkgLmhhc2hfaW5mby5lbnRyeXNpemUgPSBzaXplb2YoVGVzdEhhc2hFbnRy
eSksCisJCQkJCSAuaGFzaF9mbGFncyA9IEhBU0hfRUxFTSB8IEhBU0hfQkxPQlMsCisJCQkJ
CSAucHRyID0gJlRlc3RTaG1lbUhhc2gpOwogfQogCiBzdGF0aWMgdm9pZApAQCAtOTksMyAr
MTIzLDQ4IEBAIGdldF90ZXN0X3NobWVtX2F0dGFjaF9jb3VudChQR19GVU5DVElPTl9BUkdT
KQogCQllbG9nKEVSUk9SLCAic2htZW0gYXJlYSBub3QgeWV0IGluaXRpYWxpemVkIik7CiAJ
UEdfUkVUVVJOX0lOVDMyKFRlc3RTaG1lbS0+YXR0YWNoX2NvdW50KTsKIH0KKworLyoKKyAq
IFRlc3QgYSBzaGFyZWQgbWVtb3J5IGhhc2ggdGFibGUuCisgKgorICogQ2hlY2sgdGhhdCB0
aGUgY29ycmVjdCBudW1iZXIgb2YgZWxlbWVudHMgY2FuIGJlIGluc2VydGVkIHdpdGgKKyAq
IEhBU0hfRU5URVJfTlVMTC4gIFRoZSBoYXNoIHRhYmxlIGlzIGV4cGVjdGVkIHRvIGJlIGVt
cHR5IGJlZm9yZSB0aGUgY2FsbC4KKyAqLworUEdfRlVOQ1RJT05fSU5GT19WMSh0ZXN0X3No
bWVtX2hhc2hfb3ZlcmZsb3cpOworRGF0dW0KK3Rlc3Rfc2htZW1faGFzaF9vdmVyZmxvdyhQ
R19GVU5DVElPTl9BUkdTKQoreworCWludAkJCWNvdW50ID0gMDsKKwlpbnQzMgkJa2V5Owor
CWJvb2wJCWZvdW5kOworCVRlc3RIYXNoRW50cnkgKmVudHJ5OworCisJLyogQXNzdW1lIHRo
ZSBoYXNoIHRvIGJlIGVtcHR5IGJlZm9yZSB0aGUgY2FsbCAqLworCWlmIChoYXNoX2dldF9u
dW1fZW50cmllcyhUZXN0U2htZW1IYXNoKSAhPSAwKQorCQllbG9nKEVSUk9SLCAiaGFzaCB0
YWJsZSBpcyBub3QgZW1wdHkiKTsKKworCS8qIEZpbGwgdXAgdGhlIGhhc2ggdGFibGUgKi8K
Kwlmb3IgKGtleSA9IDA7IGtleSA8IFRFU1RfSEFTSF9ORUxFTVM7IGtleSsrKQorCXsKKwkJ
ZW50cnkgPSBoYXNoX3NlYXJjaChUZXN0U2htZW1IYXNoLCAma2V5LCBIQVNIX0VOVEVSX05V
TEwsICZmb3VuZCk7CisJCWlmIChmb3VuZCkKKwkJCWVsb2coRVJST1IsICJoYXNoIGVudHJ5
IHdpdGgga2V5ICVkIGFscmVhZHkgZXhpc3RzIiwga2V5KTsKKwkJaWYgKGVudHJ5ID09IE5V
TEwpCisJCQllbG9nKEVSUk9SLCAiaGFzaCB0YWJsZSBvZiBzaXplICVkIGlzIGZ1bGwgYWZ0
ZXIgb25seSAlZCBpbnNlcnRpb25zIiwKKwkJCQkgVEVTVF9IQVNIX05FTEVNUywgY291bnQp
OworCQljb3VudCsrOworCX0KKworCS8qCisJICogVHJ5IHRvIGluc2VydCBvbmUgbW9yZSBl
bnRyeS4gIEl0IHNob3VsZCBub3cgZmFpbCBiZWNhdXNlIHRoZSBoYXNoCisJICogdGFibGUg
aXMgZnVsbC4KKwkgKi8KKwllbnRyeSA9IGhhc2hfc2VhcmNoKFRlc3RTaG1lbUhhc2gsICZr
ZXksIEhBU0hfRU5URVJfTlVMTCwgJmZvdW5kKTsKKwlpZiAoZm91bmQpCisJCWVsb2coRVJS
T1IsICJoYXNoIGVudHJ5IHdpdGgga2V5ICVkIGFscmVhZHkgZXhpc3RzIiwga2V5KTsKKwlp
ZiAoZW50cnkgIT0gTlVMTCkKKwkJZWxvZyhFUlJPUiwgImhhc2ggdGFibGUgb2Ygc2l6ZSAl
ZCBoYWQgc3BhY2UgZm9yIGFuIGV4dHJhIGVsZW1lbnQiLAorCQkJIFRFU1RfSEFTSF9ORUxF
TVMpOworCisJUEdfUkVUVVJOX1ZPSUQoKTsKK30K

--------------wDqqzX04vEFC2yCV1Yi6KKXV--