public inbox for [email protected]  

help / color / mirror / Atom feed

From: Vallimaharajan G <[email protected]>
To: pgsql-hackers <[email protected]>
Cc: [email protected] <[email protected]>
Cc: pgsql-hackers <[email protected]>
Cc: pgsql-bugs <[email protected]>
Subject: [Bug] Heap Use After Free in parallel_vacuum_reset_dead_items Function
Date: Mon, 25 Nov 2024 23:57:07 +0530
Message-ID: <[email protected]> (raw)

Hi Developers,
     We have discovered a bug in the parallel_vacuum_reset_dead_items function in PG v17.2. Specifically:

TidStoreDestroy(dead_items) frees the dead_items pointer.

The pointer is reinitialized using TidStoreCreateShared().

However, the code later accesses the freed pointer instead of the newly reinitialized pvs->dead_items, as seen in these lines:


           pvs->shared->dead_items_dsa_handle = dsa_get_handle(TidStoreGetDSA(dead_items));

           pvs->shared->dead_items_handle = TidStoreGetHandle(dead_items);

        

       This can lead to undefined behaviour or crashes due to the use of invalid memory.



       Caught this issue while running the existing regression tests from vacuum_parallel.sql with our custom malloc allocator implementation. 

       For your reference, we have previously shared our custom malloc allocator implementation in a separate bug fix. (message ID: ).



Failed regression:

SET max_parallel_maintenance_workers TO 4;

SET min_parallel_index_scan_size TO '128kB';



CREATE TABLE parallel_vacuum_table (a int) WITH (autovacuum_enabled = off);

INSERT INTO parallel_vacuum_table SELECT i from generate_series(1, 10000) i;



CREATE INDEX regular_sized_index ON parallel_vacuum_table(a);

CREATE INDEX typically_sized_index ON parallel_vacuum_table(a);

CREATE INDEX vacuum_in_leader_small_index ON parallel_vacuum_table((1));



DELETE FROM parallel_vacuum_table;

VACUUM (PARALLEL 4, INDEX_CLEANUP ON) parallel_vacuum_table;







Please let me know if you have any questions or would like further details.



Thanks & Regards,

Vallimaharajan G

Member Technical Staff

ZOHO Corporation


      

Attachments:

  [application/octet-stream] parallel_vacuum_fix.patch (1.1K, ../[email protected]/3-parallel_vacuum_fix.patch)
  download | inline diff:
From 04b023f26013ec23fdd248c1fcada3561ce80918 Mon Sep 17 00:00:00 2001
From: Vallimaharajan <[email protected]>
Date: Mon, 25 Nov 2024 22:56:13 +0530
Subject: [PATCH] Avoid usage of freed memory in
 parallel_vacuum_reset_dead_items

---
 src/backend/commands/vacuumparallel.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/backend/commands/vacuumparallel.c b/src/backend/commands/vacuumparallel.c
index f26070bff2..eea55c1ac6 100644
--- a/src/backend/commands/vacuumparallel.c
+++ b/src/backend/commands/vacuumparallel.c
@@ -485,8 +485,8 @@ parallel_vacuum_reset_dead_items(ParallelVacuumState *pvs)
 										   LWTRANCHE_PARALLEL_VACUUM_DSA);
 
 	/* Update the DSA pointer for dead_items to the new one */
-	pvs->shared->dead_items_dsa_handle = dsa_get_handle(TidStoreGetDSA(dead_items));
-	pvs->shared->dead_items_handle = TidStoreGetHandle(dead_items);
+	pvs->shared->dead_items_dsa_handle = dsa_get_handle(TidStoreGetDSA(pvs->dead_items));
+	pvs->shared->dead_items_handle = TidStoreGetHandle(pvs->dead_items);
 
 	/* Reset the counter */
 	dead_items_info->num_items = 0;
-- 
2.34.1

view thread (4+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected], [email protected]
  Subject: Re: [Bug] Heap Use After Free in parallel_vacuum_reset_dead_items Function
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox