From: John Naylor <john.naylor@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Fix reuse-after-free hazard in dead_items_reset
Date: Fri, 03 Oct 2025 09:19:14 +0000
Message-ID: <E1v4bwX-001Ewy-38@gemulon.postgresql.org> (raw)
Fix reuse-after-free hazard in dead_items_reset
In similar vein to commit ccc8194e427, a reset instance of a shared
memory TID store happened to occupy the same private memory as the old
one for the entry point, since the chunk freed after the last round
of index vacuuming was put on the context's freelist. The failure
to update the vacrel->dead_items pointer was evident by nudging the
system to allocate memory in a different area. This was not discovered
at the time of the earlier commit since our regression tests didn't
cover multiple index passes with parallel vacuum.
Backpatch to v17, when TidStore came in.
Author: Kevin Oommen Anish <kevin.o@zohocorp.com>
Reviewed-by: Richard Guo <guofenglinux@gmail.com>
Tested-by: Richard Guo <guofenglinux@gmail.com>
Discussion: https://postgr.es/m/199a07cbdfc.7a1c4aac25838.1675074408277594551%40zohocorp.com
Backpatch-through: 17
Branch
------
REL_17_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/3549ffb6afaf045d715be6ca42814f0a08ad2af9
Modified Files
--------------
src/backend/access/heap/vacuumlazy.c | 2 ++
1 file changed, 2 insertions(+)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: john.naylor@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Fix reuse-after-free hazard in dead_items_reset
In-Reply-To: <E1v4bwX-001Ewy-38@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox