pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: Fix use-after-free in parallel_vacuum_reset_dead_items 2+ messages / 1 participants [nested] [flat]
* pgsql: Fix use-after-free in parallel_vacuum_reset_dead_items @ 2024-12-04 10:12 John Naylor <john.naylor@postgresql.org> 0 siblings, 0 replies; 2+ messages in thread From: John Naylor @ 2024-12-04 10:12 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix use-after-free in parallel_vacuum_reset_dead_items parallel_vacuum_reset_dead_items used a local variable to hold a pointer from the passed vacrel, purely as a shorthand. This pointer was later freed and a new allocation was made and stored to the struct. Then the local pointer was mistakenly referenced again. This apparently happened not to break anything since the freed chunk would have been put on the context's freelist, so it was accidentally the same pointer anyway, in which case the DSA handle was correctly updated. The minimal fix is to change two places so they access dead_items through the vacrel. This coding style is a maintenance hazard, so while at it get rid of most other similar usages, which were inconsistently used anyway. Analysis and patch by Vallimaharajan G, with further defensive coding by me Backpath to v17, when TidStore came in Discussion: https://postgr.es/m/1936493cc38.68cb2ef27266.7456585136086197135@zohocorp.com Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/ccc8194e4275d0be557a9b94126a12b389520593 Modified Files -------------- src/backend/access/heap/vacuumlazy.c | 17 ++++++----------- src/backend/commands/vacuumparallel.c | 7 +++---- 2 files changed, 9 insertions(+), 15 deletions(-) ^ permalink raw reply [nested|flat] 2+ messages in thread
* pgsql: Fix use-after-free in parallel_vacuum_reset_dead_items @ 2024-12-04 10:12 John Naylor <john.naylor@postgresql.org> 0 siblings, 0 replies; 2+ messages in thread From: John Naylor @ 2024-12-04 10:12 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix use-after-free in parallel_vacuum_reset_dead_items parallel_vacuum_reset_dead_items used a local variable to hold a pointer from the passed vacrel, purely as a shorthand. This pointer was later freed and a new allocation was made and stored to the struct. Then the local pointer was mistakenly referenced again. This apparently happened not to break anything since the freed chunk would have been put on the context's freelist, so it was accidentally the same pointer anyway, in which case the DSA handle was correctly updated. The minimal fix is to change two places so they access dead_items through the vacrel. This coding style is a maintenance hazard, so while at it get rid of most other similar usages, which were inconsistently used anyway. Analysis and patch by Vallimaharajan G, with further defensive coding by me Backpath to v17, when TidStore came in Discussion: https://postgr.es/m/1936493cc38.68cb2ef27266.7456585136086197135@zohocorp.com Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/83ce20d67184d79f7a1e65feed7c06ec03e4472d Modified Files -------------- src/backend/access/heap/vacuumlazy.c | 17 ++++++----------- src/backend/commands/vacuumparallel.c | 7 +++---- 2 files changed, 9 insertions(+), 15 deletions(-) ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2024-12-04 10:12 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2024-12-04 10:12 pgsql: Fix use-after-free in parallel_vacuum_reset_dead_items John Naylor <john.naylor@postgresql.org> 2024-12-04 10:12 pgsql: Fix use-after-free in parallel_vacuum_reset_dead_items John Naylor <john.naylor@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox