pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: Fix reuse-after-free hazard in dead_items_reset 3+ messages / 1 participants [nested] [flat]
* pgsql: Fix reuse-after-free hazard in dead_items_reset @ 2025-10-03 09:18 John Naylor <john.naylor@postgresql.org> 0 siblings, 0 replies; 3+ messages in thread From: John Naylor @ 2025-10-03 09:18 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix reuse-after-free hazard in dead_items_reset In similar vein to commit ccc8194e427, a reset instance of a shared memory TID store happened to occupy the same private memory as the old one for the entry point, since the chunk freed after the last round of index vacuuming was put on the context's freelist. The failure to update the vacrel->dead_items pointer was evident by nudging the system to allocate memory in a different area. This was not discovered at the time of the earlier commit since our regression tests didn't cover multiple index passes with parallel vacuum. Backpatch to v17, when TidStore came in. Author: Kevin Oommen Anish <kevin.o@zohocorp.com> Reviewed-by: Richard Guo <guofenglinux@gmail.com> Tested-by: Richard Guo <guofenglinux@gmail.com> Discussion: https://postgr.es/m/199a07cbdfc.7a1c4aac25838.1675074408277594551%40zohocorp.com Backpatch-through: 17 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/54ab74865147c0051357d23af63314ff5e7332f4 Modified Files -------------- src/backend/access/heap/vacuumlazy.c | 2 ++ 1 file changed, 2 insertions(+) ^ permalink raw reply [nested|flat] 3+ messages in thread
* pgsql: Fix reuse-after-free hazard in dead_items_reset @ 2025-10-03 09:19 John Naylor <john.naylor@postgresql.org> 0 siblings, 0 replies; 3+ messages in thread From: John Naylor @ 2025-10-03 09:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix reuse-after-free hazard in dead_items_reset In similar vein to commit ccc8194e427, a reset instance of a shared memory TID store happened to occupy the same private memory as the old one for the entry point, since the chunk freed after the last round of index vacuuming was put on the context's freelist. The failure to update the vacrel->dead_items pointer was evident by nudging the system to allocate memory in a different area. This was not discovered at the time of the earlier commit since our regression tests didn't cover multiple index passes with parallel vacuum. Backpatch to v17, when TidStore came in. Author: Kevin Oommen Anish <kevin.o@zohocorp.com> Reviewed-by: Richard Guo <guofenglinux@gmail.com> Tested-by: Richard Guo <guofenglinux@gmail.com> Discussion: https://postgr.es/m/199a07cbdfc.7a1c4aac25838.1675074408277594551%40zohocorp.com Backpatch-through: 17 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/76613b539ac5d87d26f8026ec1e2cd11d0583b3d Modified Files -------------- src/backend/access/heap/vacuumlazy.c | 2 ++ 1 file changed, 2 insertions(+) ^ permalink raw reply [nested|flat] 3+ messages in thread
* pgsql: Fix reuse-after-free hazard in dead_items_reset @ 2025-10-03 09:19 John Naylor <john.naylor@postgresql.org> 0 siblings, 0 replies; 3+ messages in thread From: John Naylor @ 2025-10-03 09:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix reuse-after-free hazard in dead_items_reset In similar vein to commit ccc8194e427, a reset instance of a shared memory TID store happened to occupy the same private memory as the old one for the entry point, since the chunk freed after the last round of index vacuuming was put on the context's freelist. The failure to update the vacrel->dead_items pointer was evident by nudging the system to allocate memory in a different area. This was not discovered at the time of the earlier commit since our regression tests didn't cover multiple index passes with parallel vacuum. Backpatch to v17, when TidStore came in. Author: Kevin Oommen Anish <kevin.o@zohocorp.com> Reviewed-by: Richard Guo <guofenglinux@gmail.com> Tested-by: Richard Guo <guofenglinux@gmail.com> Discussion: https://postgr.es/m/199a07cbdfc.7a1c4aac25838.1675074408277594551%40zohocorp.com Backpatch-through: 17 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/3549ffb6afaf045d715be6ca42814f0a08ad2af9 Modified Files -------------- src/backend/access/heap/vacuumlazy.c | 2 ++ 1 file changed, 2 insertions(+) ^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2025-10-03 09:19 UTC | newest] Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2025-10-03 09:18 pgsql: Fix reuse-after-free hazard in dead_items_reset John Naylor <john.naylor@postgresql.org> 2025-10-03 09:19 pgsql: Fix reuse-after-free hazard in dead_items_reset John Naylor <john.naylor@postgresql.org> 2025-10-03 09:19 pgsql: Fix reuse-after-free hazard in dead_items_reset John Naylor <john.naylor@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox