agora inbox for [email protected]  

help / color / mirror / Atom feed

[PATCH 6/8] Avoid tuple coversion in common partitioning cases
814+ messages / 2 participants
[nested] [flat]

* [PATCH 6/8] Avoid tuple coversion in common partitioning cases
@ 2016-12-26 08:44 amit <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: amit @ 2016-12-26 08:44 UTC (permalink / raw)

Currently, the tuple conversion is performed after a tuple is routed,
even if the attributes of a target leaf partition map one-to-one with
those of the root table, which is wasteful.  Avoid that by making
convert_tuples_by_name() return a NULL map for such cases.

Reported by: n/a
Patch by: Amit Langote
Reports: n/a
---
 src/backend/access/common/tupconvert.c | 8 ++++++--
 src/backend/catalog/partition.c        | 5 ++---
 src/backend/commands/analyze.c         | 1 +
 src/backend/executor/execMain.c        | 1 +
 src/backend/executor/execQual.c        | 2 +-
 src/include/access/tupconvert.h        | 1 +
 6 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/src/backend/access/common/tupconvert.c b/src/backend/access/common/tupconvert.c
index b17ceafa6e..bbbd271e1f 100644
--- a/src/backend/access/common/tupconvert.c
+++ b/src/backend/access/common/tupconvert.c
@@ -202,6 +202,7 @@ convert_tuples_by_position(TupleDesc indesc,
 TupleConversionMap *
 convert_tuples_by_name(TupleDesc indesc,
 					   TupleDesc outdesc,
+					   bool consider_typeid,
 					   const char *msg)
 {
 	TupleConversionMap *map;
@@ -216,11 +217,14 @@ convert_tuples_by_name(TupleDesc indesc,
 	/*
 	 * Check to see if the map is one-to-one and the tuple types are the same.
 	 * (We check the latter because if they're not, we want to do conversion
-	 * to inject the right OID into the tuple datum.)
+	 * to inject the right OID into the tuple datum.  In the partitioning
+	 * case (!consider_typeid), tdhasoids must always match between indesc
+	 * and outdesc, so we need not require tdtypeid's to be the same.)
 	 */
 	if (indesc->natts == outdesc->natts &&
-		indesc->tdtypeid == outdesc->tdtypeid)
+		(!consider_typeid || indesc->tdtypeid == outdesc->tdtypeid))
 	{
+		Assert(!consider_typeid && indesc->tdhasoid == outdesc->tdhasoid);
 		same = true;
 		for (i = 0; i < n; i++)
 		{
diff --git a/src/backend/catalog/partition.c b/src/backend/catalog/partition.c
index 5ca57f44fb..75ec746cb4 100644
--- a/src/backend/catalog/partition.c
+++ b/src/backend/catalog/partition.c
@@ -1084,7 +1084,7 @@ RelationGetPartitionDispatchInfo(Relation rel, int lockmode,
 			 */
 			pd[i]->tupslot = MakeSingleTupleTableSlot(tupdesc);
 			pd[i]->tupmap = convert_tuples_by_name(RelationGetDescr(parent),
-												   tupdesc,
+												   tupdesc, false,
 								gettext_noop("could not convert row type"));
 		}
 		else
@@ -1694,12 +1694,11 @@ get_partition_for_tuple(PartitionDispatch *pd,
 			return -1;
 		}
 
-		if (myslot != NULL)
+		if (myslot != NULL && map != NULL)
 		{
 			HeapTuple	tuple = ExecFetchSlotTuple(slot);
 
 			ExecClearTuple(myslot);
-			Assert(map != NULL);
 			tuple = do_convert_tuple(tuple, map);
 			ExecStoreTuple(tuple, myslot, InvalidBuffer, true);
 			slot = myslot;
diff --git a/src/backend/commands/analyze.c b/src/backend/commands/analyze.c
index e3e1a53072..31bec9f961 100644
--- a/src/backend/commands/analyze.c
+++ b/src/backend/commands/analyze.c
@@ -1419,6 +1419,7 @@ acquire_inherited_sample_rows(Relation onerel, int elevel,
 
 					map = convert_tuples_by_name(RelationGetDescr(childrel),
 												 RelationGetDescr(onerel),
+												 true,
 								 gettext_noop("could not convert row type"));
 					if (map != NULL)
 					{
diff --git a/src/backend/executor/execMain.c b/src/backend/executor/execMain.c
index 04c026f3f8..b14cc98caf 100644
--- a/src/backend/executor/execMain.c
+++ b/src/backend/executor/execMain.c
@@ -3201,6 +3201,7 @@ ExecSetupPartitionTupleRouting(Relation rel,
 		 * partition from the parent's type to the partition's.
 		 */
 		(*tup_conv_maps)[i] = convert_tuples_by_name(tupDesc, part_tupdesc,
+													 false,
 								 gettext_noop("could not convert row type"));
 
 		InitResultRelInfo(leaf_part_rri,
diff --git a/src/backend/executor/execQual.c b/src/backend/executor/execQual.c
index eed7e95c75..5f637006d1 100644
--- a/src/backend/executor/execQual.c
+++ b/src/backend/executor/execQual.c
@@ -2920,7 +2920,7 @@ ExecEvalConvertRowtype(ConvertRowtypeExprState *cstate,
 
 		/* prepare map from old to new attribute numbers */
 		cstate->map = convert_tuples_by_name(cstate->indesc,
-											 cstate->outdesc,
+											 cstate->outdesc, true,
 								 gettext_noop("could not convert row type"));
 		cstate->initialized = true;
 
diff --git a/src/include/access/tupconvert.h b/src/include/access/tupconvert.h
index e86cfd56c8..231fe872d7 100644
--- a/src/include/access/tupconvert.h
+++ b/src/include/access/tupconvert.h
@@ -36,6 +36,7 @@ extern TupleConversionMap *convert_tuples_by_position(TupleDesc indesc,
 
 extern TupleConversionMap *convert_tuples_by_name(TupleDesc indesc,
 					   TupleDesc outdesc,
+					   bool consider_typeid,
 					   const char *msg);
 
 extern AttrNumber *convert_tuples_by_name_map(TupleDesc indesc,
-- 
2.11.0


--------------49BF125E4F135FB3D50EF5A9
Content-Type: text/x-diff;
 name="0007-Avoid-code-duplication-in-map_partition_varattnos.patch"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment;
 filename*0="0007-Avoid-code-duplication-in-map_partition_varattnos.patch"



^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 814+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 814+ messages in thread