agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Michael Paquier <michael@paquier.xyz>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Fix MarkBufferDirtyHint() to not call GetBufferDescriptor() for
Date: Wed, 10 Jun 2026 04:53:39 +0000
Message-ID: <E1wXAwd-001pRz-0F@gemulon.postgresql.org> (raw)
Fix MarkBufferDirtyHint() to not call GetBufferDescriptor() for local buffers
GetBufferDescriptor() was called before checking if the buffer is local.
Such buffers have a negative ID, meaning that we could call
GetBufferDescriptor() with a wrapped-around uint32 value causing a
potential out-of-bound access to the BufferDescriptors array.
This is harmless in the existing code for the current uses of
MarkBufferDirtyHint(), but the author has found a way to make that
buggy while working on a different patch set, and the order of the
operations is wrong.
Oversight in 82467f627bd4. No backpatch is required, as this is new to
v19.
Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Discussion: https://postgr.es/m/CAExHW5uzRMYVZsXXS3HXXT0fG_sNrpUhUqwP4NorhaCqH9JDhA@mail.gmail.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/e18b0cb7344cb4bd28468f6c0aeeb9b9241d30aa
Modified Files
--------------
src/backend/storage/buffer/bufmgr.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
Message-ID: <E1wXAwd-001pRz-0F@gemulon.postgresql.org>
Permalink: ../E1wXAwd-001pRz-0F@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wXAwd-001pRz-0F@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: michael@paquier.xyz, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Fix MarkBufferDirtyHint() to not call GetBufferDescriptor() for
In-Reply-To: <E1wXAwd-001pRz-0F@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox