pg.ddx.io pgsql-committers@postgresql.org mailing list archive
help / color / mirror / Atom feedpgsql: Fix EPQ crash from missing partition pruning state in EState
5+ messages / 2 participants
[nested] [flat]
* pgsql: Fix EPQ crash from missing partition pruning state in EState
@ 2025-09-19 02:40 Amit Langote <amitlan@postgresql.org>
0 siblings, 0 replies; 5+ messages in thread
From: Amit Langote @ 2025-09-19 02:40 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix EPQ crash from missing partition pruning state in EState
Commit bb3ec16e14 moved partition pruning metadata into PlannedStmt.
At executor startup this metadata is used to initialize the EState
fields es_part_prune_infos, es_part_prune_states, and
es_part_prune_results. EvalPlanQualStart() failed to copy those
fields into the child EState, causing NULL dereference when Append
ran partition pruning during a recheck. This can occur with DELETE
or UPDATE on partitioned tables that use runtime pruning, e.g. with
generic plans.
Fix by copying all partition pruning state into the EPQ estate.
Add an isolation test that reproduces the crash with concurrent
UPDATE and DELETE on a partitioned table, where the DELETE session
hits the crash during its EPQ recheck after the UPDATE commits.
Bug: #19056
Reported-by: Fei Changhong <feichanghong@qq.com>
Diagnozed-by: Fei Changhong <feichanghong@qq.com>
Author: David Rowley <dgrowleyml@gmail.com>
Co-authored-by: Amit Langote <amitlangote09@gmail.com>
Discussion: https://postgr.es/m/19056-a677cef9b54d76a0%40postgresql.org
Branch
------
REL_18_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/9a82a64edcd8615cf16eae64bf1572d4156cb912
Modified Files
--------------
src/backend/executor/execMain.c | 9 +++++++++
src/test/isolation/expected/eval-plan-qual.out | 9 +++++++++
src/test/isolation/specs/eval-plan-qual.spec | 8 ++++++++
3 files changed, 26 insertions(+)
^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Fix EPQ crash from missing partition pruning state in EState
@ 2025-09-19 02:41 Amit Langote <amitlan@postgresql.org>
0 siblings, 0 replies; 5+ messages in thread
From: Amit Langote @ 2025-09-19 02:41 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix EPQ crash from missing partition pruning state in EState
Commit bb3ec16e14 moved partition pruning metadata into PlannedStmt.
At executor startup this metadata is used to initialize the EState
fields es_part_prune_infos, es_part_prune_states, and
es_part_prune_results. EvalPlanQualStart() failed to copy those
fields into the child EState, causing NULL dereference when Append
ran partition pruning during a recheck. This can occur with DELETE
or UPDATE on partitioned tables that use runtime pruning, e.g. with
generic plans.
Fix by copying all partition pruning state into the EPQ estate.
Add an isolation test that reproduces the crash with concurrent
UPDATE and DELETE on a partitioned table, where the DELETE session
hits the crash during its EPQ recheck after the UPDATE commits.
Bug: #19056
Reported-by: Fei Changhong <feichanghong@qq.com>
Diagnozed-by: Fei Changhong <feichanghong@qq.com>
Author: David Rowley <dgrowleyml@gmail.com>
Co-authored-by: Amit Langote <amitlangote09@gmail.com>
Discussion: https://postgr.es/m/19056-a677cef9b54d76a0%40postgresql.org
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/8741e48e5ddaab1148419ad8a4cd00098de57efc
Modified Files
--------------
src/backend/executor/execMain.c | 9 +++++++++
src/test/isolation/expected/eval-plan-qual.out | 9 +++++++++
src/test/isolation/specs/eval-plan-qual.spec | 8 ++++++++
3 files changed, 26 insertions(+)
^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Fix EPQ crash from missing partition directory in EState
@ 2025-10-16 05:02 Amit Langote <amitlan@postgresql.org>
0 siblings, 0 replies; 5+ messages in thread
From: Amit Langote @ 2025-10-16 05:02 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix EPQ crash from missing partition directory in EState
EvalPlanQualStart() failed to propagate es_partition_directory into
the child EState used for EPQ rechecks. When execution time partition
pruning ran during the EPQ scan, executor code dereferenced a NULL
partition directory and crashed.
Previously, propagating es_partition_directory into the EPQ EState was
unnecessary because CreatePartitionPruneState(), which sets it on
demand, also initialized the exec-pruning context. After commit
d47cbf474, CreatePartitionPruneState() now initializes only the init-
time pruning context, leaving exec-pruning context initialization to
ExecInitNode(). Since EvalPlanQualStart() runs only ExecInitNode() and
not CreatePartitionPruneState(), it can encounter a NULL
es_partition_directory. Other executor fields initialized during
CreatePartitionPruneState() are already copied into the child EState
thanks to commit 8741e48e5d, but es_partition_directory was missed.
Fix by borrowing the parent estate's es_partition_directory in
EvalPlanQualStart(), and by clearing that field in EvalPlanQualEnd()
so the parent remains responsible for freeing the directory.
Add an isolation test permutation that triggers EPQ with execution-
time partition pruning, the case that reproduces this crash.
Bug: #19078
Reported-by: Yuri Zamyatin <yuri@yrz.am>
Diagnosed-by: David Rowley <dgrowleyml@gmail.com>
Author: David Rowley <dgrowleyml@gmail.com>
Co-authored-by: Amit Langote <amitlangote09@gmail.com>
Discussion: https://postgr.es/m/19078-dfd62f840a2c0766@postgresql.org
Backpatch-through: 18
Branch
------
REL_18_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/1296dcf18b1cf3a064e5981c1655d133f0b1206f
Modified Files
--------------
src/backend/executor/execMain.c | 10 ++++++++++
src/test/isolation/expected/eval-plan-qual.out | 7 +++++++
src/test/isolation/specs/eval-plan-qual.spec | 2 ++
3 files changed, 19 insertions(+)
^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Fix EPQ crash from missing partition directory in EState
@ 2025-10-16 05:03 Amit Langote <amitlan@postgresql.org>
0 siblings, 1 reply; 5+ messages in thread
From: Amit Langote @ 2025-10-16 05:03 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix EPQ crash from missing partition directory in EState
EvalPlanQualStart() failed to propagate es_partition_directory into
the child EState used for EPQ rechecks. When execution time partition
pruning ran during the EPQ scan, executor code dereferenced a NULL
partition directory and crashed.
Previously, propagating es_partition_directory into the EPQ EState was
unnecessary because CreatePartitionPruneState(), which sets it on
demand, also initialized the exec-pruning context. After commit
d47cbf474, CreatePartitionPruneState() now initializes only the init-
time pruning context, leaving exec-pruning context initialization to
ExecInitNode(). Since EvalPlanQualStart() runs only ExecInitNode() and
not CreatePartitionPruneState(), it can encounter a NULL
es_partition_directory. Other executor fields initialized during
CreatePartitionPruneState() are already copied into the child EState
thanks to commit 8741e48e5d, but es_partition_directory was missed.
Fix by borrowing the parent estate's es_partition_directory in
EvalPlanQualStart(), and by clearing that field in EvalPlanQualEnd()
so the parent remains responsible for freeing the directory.
Add an isolation test permutation that triggers EPQ with execution-
time partition pruning, the case that reproduces this crash.
Bug: #19078
Reported-by: Yuri Zamyatin <yuri@yrz.am>
Diagnosed-by: David Rowley <dgrowleyml@gmail.com>
Author: David Rowley <dgrowleyml@gmail.com>
Co-authored-by: Amit Langote <amitlangote09@gmail.com>
Discussion: https://postgr.es/m/19078-dfd62f840a2c0766@postgresql.org
Backpatch-through: 18
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/905e932f0922a837bb3e4e482089c7c2e98bea67
Modified Files
--------------
src/backend/executor/execMain.c | 10 ++++++++++
src/test/isolation/expected/eval-plan-qual.out | 7 +++++++
src/test/isolation/specs/eval-plan-qual.spec | 2 ++
3 files changed, 19 insertions(+)
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: pgsql: Fix EPQ crash from missing partition directory in EState
@ 2025-10-16 06:20 Amit Langote <amitlangote09@gmail.com>
parent: Amit Langote <amitlan@postgresql.org>
0 siblings, 0 replies; 5+ messages in thread
From: Amit Langote @ 2025-10-16 06:20 UTC (permalink / raw)
To: Amit Langote <amitlan@postgresql.org>; +Cc: pgsql-committers@lists.postgresql.org
On Thu, Oct 16, 2025 at 2:03 PM Amit Langote <amitlan@postgresql.org> wrote:
> Fix EPQ crash from missing partition directory in EState
>
> EvalPlanQualStart() failed to propagate es_partition_directory into
> the child EState used for EPQ rechecks. When execution time partition
> pruning ran during the EPQ scan, executor code dereferenced a NULL
> partition directory and crashed.
>
> Previously, propagating es_partition_directory into the EPQ EState was
> unnecessary because CreatePartitionPruneState(), which sets it on
> demand, also initialized the exec-pruning context. After commit
> d47cbf474,
Oops, that could’ve been worded better -- I meant “Prior to d47cbf474”
rather than “Previously”.
--
Thanks, Amit Langote
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2025-10-16 06:20 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2025-09-19 02:40 pgsql: Fix EPQ crash from missing partition pruning state in EState Amit Langote <amitlan@postgresql.org>
2025-09-19 02:41 pgsql: Fix EPQ crash from missing partition pruning state in EState Amit Langote <amitlan@postgresql.org>
2025-10-16 05:02 pgsql: Fix EPQ crash from missing partition directory in EState Amit Langote <amitlan@postgresql.org>
2025-10-16 05:03 pgsql: Fix EPQ crash from missing partition directory in EState Amit Langote <amitlan@postgresql.org>
2025-10-16 06:20 ` Re: pgsql: Fix EPQ crash from missing partition directory in EState Amit Langote <amitlangote09@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox