Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1tFeIL-00EdRg-DY for pgsql-bugs@arkaria.postgresql.org; Mon, 25 Nov 2024 18:58:49 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1tFeII-00HDEC-Or for pgsql-bugs@arkaria.postgresql.org; Mon, 25 Nov 2024 18:58:46 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1tFdnw-00H7Ti-7y; Mon, 25 Nov 2024 18:27:24 +0000 Received: from sender4-op-o11.zoho.com ([136.143.188.11]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1tFdnq-003oDR-Tk; Mon, 25 Nov 2024 18:27:22 +0000 ARC-Seal: i=1; a=rsa-sha256; t=1732559231; cv=none; d=zohomail.com; s=zohoarc; b=OIz4pjCL5ljUz2GaUkXM8Kw1XIqP9iZax5o+1Hu9wqPdQV6WJkCNTtwDd1dtfMIk8HrGC/ubuyPuAiAonPbU7+rDhYBWOhQNBm9nuH5fTV5H/nOjkXLVdofeDaPdL4tZ9+kotPYaX2O7FTNRRxFqv4V9pewAY/UNXLBEL3QshXY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1732559231; h=Content-Type:Cc:Cc:Date:Date:From:From:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=JKezCRCos86RPIdISEdobC2Tc5XXigdeWRwwdCitn3o=; b=Ku2iUqCZosPtLqYhrwJiXLyFhPqDQc1ZuG6PfrfojMOjRe9t0YTnbAYMj/5TkCYytRVyARCRfr/g0Mtkxw8V/TZhAOD0wWHf+hZMLRt0p171lySXa4Lg9vVxR9dCzX5ZFrlCXtRd4mIxFoQ4cAyJQHh/9JxLNXCCcLfeH+R3tgw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=zohocorp.com; spf=pass smtp.mailfrom=vallimaharajan.gs@zohocorp.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1732559231; s=admin; d=zohocorp.com; i=vallimaharajan.gs@zohocorp.com; h=Date:Date:From:From:To:To:Cc:Cc:Message-Id:Message-Id:In-Reply-To:Subject:Subject:MIME-Version:Content-Type:Reply-To; bh=JKezCRCos86RPIdISEdobC2Tc5XXigdeWRwwdCitn3o=; b=tM5+uJt5n0hPE5+eMJYpkmtxkkb0fEkYIdrmGh/EClrGmOXdwgdt19joFwHXG/09 WpzeGXinWe2BFZ4hgKaxzzmt60dMWJZ0LXj6v33HhRr1WUA0JYc456XrkcdePK6LLRN g5l/dJnUWMIL+7QADF2+o7YfiugRbAFv2tbvcEgc= Received: from mail.zoho.com by mx.zohomail.com with SMTP id 1732559228059350.3686716139928; Mon, 25 Nov 2024 10:27:08 -0800 (PST) Date: Mon, 25 Nov 2024 23:57:07 +0530 From: Vallimaharajan G To: "pgsql-hackers" Cc: "zlabs-cstore@zohocorp.com" , "pgsql-hackers" , "pgsql-bugs" Message-Id: <1936493cc38.68cb2ef27266.7456585136086197135@zohocorp.com> In-Reply-To: Subject: [Bug] Heap Use After Free in parallel_vacuum_reset_dead_items Function MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_25938_355327261.1732559227961" Importance: Medium User-Agent: Zoho Mail X-Mailer: Zoho Mail X-Zoho-Virus-Status: 1 X-Zoho-AV-Stamp: zmail-av-1.4.1/232.469.0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk ------=_Part_25938_355327261.1732559227961 Content-Type: multipart/alternative; boundary="----=_Part_25939_712289123.1732559227961" ------=_Part_25939_712289123.1732559227961 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Developers, =C2=A0 =C2=A0 =C2=A0We have discovered a bug in the parallel_vacuum_reset_d= ead_items function in PG v17.2. Specifically: TidStoreDestroy(dead_items) frees the dead_items pointer. The pointer is reinitialized using TidStoreCreateShared(). However, the code later accesses the freed pointer instead of the newly rei= nitialized pvs->dead_items, as seen in these lines: =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pvs->shared->dead_items_dsa_handle= =3D dsa_get_handle(TidStoreGetDSA(dead_items)); =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pvs->shared->dead_items_handle =3D= TidStoreGetHandle(dead_items); =C2=A0 =C2=A0 =C2=A0 =C2=A0=20 =C2=A0 =C2=A0 =C2=A0 =C2=A0This can lead to undefined behaviour or crashes = due to the use of invalid memory. =C2=A0 =C2=A0 =C2=A0 =C2=A0Caught this issue while running the existing reg= ression tests from vacuum_parallel.sql with our custom malloc allocator imp= lementation.=20 =C2=A0 =C2=A0 =C2=A0 =C2=A0For your reference, we have previously shared ou= r custom malloc allocator implementation in a separate bug fix. (message ID= : ). Failed regression: SET max_parallel_maintenance_workers TO 4; SET min_parallel_index_scan_size TO '128kB'; CREATE TABLE parallel_vacuum_table (a int) WITH (autovacuum_enabled =3D off= ); INSERT INTO parallel_vacuum_table SELECT i from generate_series(1, 10000) i= ; CREATE INDEX regular_sized_index ON parallel_vacuum_table(a); CREATE INDEX typically_sized_index ON parallel_vacuum_table(a); CREATE INDEX vacuum_in_leader_small_index ON parallel_vacuum_table((1)); DELETE FROM parallel_vacuum_table; VACUUM (PARALLEL 4, INDEX_CLEANUP ON) parallel_vacuum_table; Please let me know if you have any questions or would like further details. Thanks & Regards, Vallimaharajan G Member Technical Staff ZOHO Corporation =C2=A0 =C2=A0 =C2=A0=C2=A0 ------=_Part_25939_712289123.1732559227961 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable =
<= span class=3D"font" style=3D"font-family:Verdana, Arial, Helvetica, sans-se= rif">Hi D= evelopers,
     We have disco= vered a bug in the parallel_vacuum_reset_dead_items fun= ction in PG v17.2. Specifically:
  1. TidStoreDestroy(= dead_items) frees the dead_items pointer.
    2. <= li>The pointer is reinitialized using TidStoreCreateShared().<= br>
  2. However, the code later accesses the freed pointer instead of t= he newly reinitialized pvs->dead_items, as seen in t= hese lines:
           p= vs->shared->dead_items_dsa_handle =3D dsa_get_handle(TidStoreGetDSA(d= ead_items));
           = pvs->shared->dead_items_handle =3D TidStoreGetHandle(dead_items);=
       
  =      This can lead to undefined behaviour or crashes due= to the use of invalid memory.

    &= nbsp;  Caught this issue while running the existing regression tests f= rom vacuum_parallel.sql with our custom malloc allocator implementat= ion.
       For your reference, we have = previously shared our custom malloc allocator implementation in a separate = bug fix. (message ID: 193261e2c= 4d.3dd3cd7c1842.871636075166132237@zohocorp.com).
=

Failed regression:

SET max_parallel_maint= enance_workers TO 4;
SET min_parallel_index_scan_size TO '128= kB';

CREATE TABLE parallel_vacuum_table (a int= ) WITH (autovacuum_enabled =3D off);
INSERT INTO parallel_vac= uum_table SELECT i from generate_series(1, 10000) i;

CREATE INDEX regular_sized_index ON parallel_vacuum_table(a);
CREATE INDEX typically_sized_index ON parallel_vacuum_table(a);
=
CREATE INDEX vacuum_in_leader_small_index ON parallel_vacuum_tab= le((1));

DELETE FROM parallel_vacuum_table;
VACUUM (PARALLEL 4, INDEX_CLEANUP ON) parallel_vacuum_table;

Please let me know if you hav= e any questions or would like further details.

Thanks = & Regards,
Vallimaharajan G
Member Technica= l Staff
ZOHO Corporation

    &nbs= p; 



------=_Part_25939_712289123.1732559227961-- ------=_Part_25938_355327261.1732559227961 Content-Type: application/octet-stream; name=parallel_vacuum_fix.patch Content-Transfer-Encoding: 7bit X-ZM_AttachId: 139518520279620070 Content-Disposition: attachment; filename=parallel_vacuum_fix.patch From 04b023f26013ec23fdd248c1fcada3561ce80918 Mon Sep 17 00:00:00 2001 From: Vallimaharajan Date: Mon, 25 Nov 2024 22:56:13 +0530 Subject: [PATCH] Avoid usage of freed memory in parallel_vacuum_reset_dead_items --- src/backend/commands/vacuumparallel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/backend/commands/vacuumparallel.c b/src/backend/commands/vacuumparallel.c index f26070bff2..eea55c1ac6 100644 --- a/src/backend/commands/vacuumparallel.c +++ b/src/backend/commands/vacuumparallel.c @@ -485,8 +485,8 @@ parallel_vacuum_reset_dead_items(ParallelVacuumState *pvs) LWTRANCHE_PARALLEL_VACUUM_DSA); /* Update the DSA pointer for dead_items to the new one */ - pvs->shared->dead_items_dsa_handle = dsa_get_handle(TidStoreGetDSA(dead_items)); - pvs->shared->dead_items_handle = TidStoreGetHandle(dead_items); + pvs->shared->dead_items_dsa_handle = dsa_get_handle(TidStoreGetDSA(pvs->dead_items)); + pvs->shared->dead_items_handle = TidStoreGetHandle(pvs->dead_items); /* Reset the counter */ dead_items_info->num_items = 0; -- 2.34.1 ------=_Part_25938_355327261.1732559227961--