pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: Fix possible use after free in expand_partitioned_rtentry() 5+ messages / 1 participants [nested] [flat]
* pgsql: Fix possible use after free in expand_partitioned_rtentry() @ 2025-08-29 12:51 David Rowley <drowley@postgresql.org> 0 siblings, 0 replies; 5+ messages in thread From: David Rowley @ 2025-08-29 12:51 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix possible use after free in expand_partitioned_rtentry() It's possible that if the only live partition is concurrently dropped and try_table_open() fails, that the bms_del_member() will pfree the live_parts Bitmapset. Since the bms_del_member() call does not assign the result back to the live_parts local variable, the while loop could segfault as that variable would still reference the pfree'd Bitmapset. Backpatch to 15. 52f3de874 was backpatched to 14, but there's no bms_del_member() there due to live_parts not yet existing in RelOptInfo in that version. Technically there's no bug in version 15 as bms_del_member() didn't pfree when the set became empty prior to 00b41463c (from v16). Applied to v15 anyway to keep the code similar and to avoid the bad coding pattern. Author: Bernd Reiß <bd_reiss@gmx.at> Reviewed-by: David Rowley <dgrowleyml@gmail.com> Discussion: https://postgr.es/m/6b88f27a-c45c-4826-8e37-d61a04d90182@gmx.at Backpatch-through: 15 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/da9f9f75e5ce27a45878ffa262156d18f0046188 Modified Files -------------- src/backend/optimizer/util/inherit.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Fix possible use after free in expand_partitioned_rtentry() @ 2025-08-29 12:52 David Rowley <drowley@postgresql.org> 0 siblings, 0 replies; 5+ messages in thread From: David Rowley @ 2025-08-29 12:52 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix possible use after free in expand_partitioned_rtentry() It's possible that if the only live partition is concurrently dropped and try_table_open() fails, that the bms_del_member() will pfree the live_parts Bitmapset. Since the bms_del_member() call does not assign the result back to the live_parts local variable, the while loop could segfault as that variable would still reference the pfree'd Bitmapset. Backpatch to 15. 52f3de874 was backpatched to 14, but there's no bms_del_member() there due to live_parts not yet existing in RelOptInfo in that version. Technically there's no bug in version 15 as bms_del_member() didn't pfree when the set became empty prior to 00b41463c (from v16). Applied to v15 anyway to keep the code similar and to avoid the bad coding pattern. Author: Bernd Reiß <bd_reiss@gmx.at> Reviewed-by: David Rowley <dgrowleyml@gmail.com> Discussion: https://postgr.es/m/6b88f27a-c45c-4826-8e37-d61a04d90182@gmx.at Backpatch-through: 15 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/4aea5589106bdaa949e45e8ae6a7e49204a460f6 Modified Files -------------- src/backend/optimizer/util/inherit.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Fix possible use after free in expand_partitioned_rtentry() @ 2025-08-29 12:52 David Rowley <drowley@postgresql.org> 0 siblings, 0 replies; 5+ messages in thread From: David Rowley @ 2025-08-29 12:52 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix possible use after free in expand_partitioned_rtentry() It's possible that if the only live partition is concurrently dropped and try_table_open() fails, that the bms_del_member() will pfree the live_parts Bitmapset. Since the bms_del_member() call does not assign the result back to the live_parts local variable, the while loop could segfault as that variable would still reference the pfree'd Bitmapset. Backpatch to 15. 52f3de874 was backpatched to 14, but there's no bms_del_member() there due to live_parts not yet existing in RelOptInfo in that version. Technically there's no bug in version 15 as bms_del_member() didn't pfree when the set became empty prior to 00b41463c (from v16). Applied to v15 anyway to keep the code similar and to avoid the bad coding pattern. Author: Bernd Reiß <bd_reiss@gmx.at> Reviewed-by: David Rowley <dgrowleyml@gmail.com> Discussion: https://postgr.es/m/6b88f27a-c45c-4826-8e37-d61a04d90182@gmx.at Backpatch-through: 15 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/ed394c4bdf1247fb7e9a6525f7588f49887c33a1 Modified Files -------------- src/backend/optimizer/util/inherit.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Fix possible use after free in expand_partitioned_rtentry() @ 2025-08-29 12:53 David Rowley <drowley@postgresql.org> 0 siblings, 0 replies; 5+ messages in thread From: David Rowley @ 2025-08-29 12:53 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix possible use after free in expand_partitioned_rtentry() It's possible that if the only live partition is concurrently dropped and try_table_open() fails, that the bms_del_member() will pfree the live_parts Bitmapset. Since the bms_del_member() call does not assign the result back to the live_parts local variable, the while loop could segfault as that variable would still reference the pfree'd Bitmapset. Backpatch to 15. 52f3de874 was backpatched to 14, but there's no bms_del_member() there due to live_parts not yet existing in RelOptInfo in that version. Technically there's no bug in version 15 as bms_del_member() didn't pfree when the set became empty prior to 00b41463c (from v16). Applied to v15 anyway to keep the code similar and to avoid the bad coding pattern. Author: Bernd Reiß <bd_reiss@gmx.at> Reviewed-by: David Rowley <dgrowleyml@gmail.com> Discussion: https://postgr.es/m/6b88f27a-c45c-4826-8e37-d61a04d90182@gmx.at Backpatch-through: 15 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/f0fe1da50998beb08e066508b9d2ed87ab900472 Modified Files -------------- src/backend/optimizer/util/inherit.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Fix possible use after free in expand_partitioned_rtentry() @ 2025-08-29 12:53 David Rowley <drowley@postgresql.org> 0 siblings, 0 replies; 5+ messages in thread From: David Rowley @ 2025-08-29 12:53 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix possible use after free in expand_partitioned_rtentry() It's possible that if the only live partition is concurrently dropped and try_table_open() fails, that the bms_del_member() will pfree the live_parts Bitmapset. Since the bms_del_member() call does not assign the result back to the live_parts local variable, the while loop could segfault as that variable would still reference the pfree'd Bitmapset. Backpatch to 15. 52f3de874 was backpatched to 14, but there's no bms_del_member() there due to live_parts not yet existing in RelOptInfo in that version. Technically there's no bug in version 15 as bms_del_member() didn't pfree when the set became empty prior to 00b41463c (from v16). Applied to v15 anyway to keep the code similar and to avoid the bad coding pattern. Author: Bernd Reiß <bd_reiss@gmx.at> Reviewed-by: David Rowley <dgrowleyml@gmail.com> Discussion: https://postgr.es/m/6b88f27a-c45c-4826-8e37-d61a04d90182@gmx.at Backpatch-through: 15 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/8286bce0a06a3975bc7d292b5c5f972fc31a9a57 Modified Files -------------- src/backend/optimizer/util/inherit.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2025-08-29 12:53 UTC | newest] Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2025-08-29 12:51 pgsql: Fix possible use after free in expand_partitioned_rtentry() David Rowley <drowley@postgresql.org> 2025-08-29 12:52 pgsql: Fix possible use after free in expand_partitioned_rtentry() David Rowley <drowley@postgresql.org> 2025-08-29 12:52 pgsql: Fix possible use after free in expand_partitioned_rtentry() David Rowley <drowley@postgresql.org> 2025-08-29 12:53 pgsql: Fix possible use after free in expand_partitioned_rtentry() David Rowley <drowley@postgresql.org> 2025-08-29 12:53 pgsql: Fix possible use after free in expand_partitioned_rtentry() David Rowley <drowley@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox