[PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server

agora inbox for [email protected]  
help / color / mirror / Atom feed

[PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
202+ messages / 2 participants
[nested] [flat]

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52  Jehan-Guillaume de Rorthais <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <[email protected]>
Author: Kyotaro Horiguchi <[email protected]>

Rebased by Jehan-Guillaume de Rorthais <[email protected]>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 202+ messages in thread

* [PATCH v12 1/3] cpuidex check: Support detecting newer GCC versions defining it in cpuid.h
@ 2025-07-27 17:45  Lukas Fittl <[email protected]>
  0 siblings, 0 replies; 202+ messages in thread

From: Lukas Fittl @ 2025-07-27 17:45 UTC (permalink / raw)

Author: Lukas Fittl <[email protected]>
Discussion: https://postgr.es/m/CAP53Pky-BN0Ui+A9no3TsU=GoMTFpxYSWYtp_LVaDH=y69BxNg@mail.gmail.com
---
 meson.build                       | 4 ++++
 src/port/pg_crc32c_sse42_choose.c | 4 ++--
 src/port/pg_popcount_avx512.c     | 4 ++--
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/meson.build b/meson.build
index 395416a6060..007ec30800f 100644
--- a/meson.build
+++ b/meson.build
@@ -2015,7 +2015,11 @@ if cc.links('''
     args: test_c_args)
   cdata.set('HAVE__GET_CPUID_COUNT', 1)
 elif cc.links('''
+    #if defined(_MSC_VER)
     #include <intrin.h>
+    #else
+    #include <cpuid.h>
+    #endif
     int main(int arg, char **argv)
     {
         unsigned int exx[4] = {0, 0, 0, 0};
diff --git a/src/port/pg_crc32c_sse42_choose.c b/src/port/pg_crc32c_sse42_choose.c
index 74d2421ba2b..750f390bfdf 100644
--- a/src/port/pg_crc32c_sse42_choose.c
+++ b/src/port/pg_crc32c_sse42_choose.c
@@ -20,11 +20,11 @@
 
 #include "c.h"
 
-#if defined(HAVE__GET_CPUID) || defined(HAVE__GET_CPUID_COUNT)
+#if defined(HAVE__GET_CPUID) || defined(HAVE__GET_CPUID_COUNT) || (defined(HAVE__CPUIDEX) && !defined(_MSC_VER))
 #include <cpuid.h>
 #endif
 
-#if defined(HAVE__CPUID) || defined(HAVE__CPUIDEX)
+#if defined(HAVE__CPUID) || (defined(HAVE__CPUIDEX) && defined(_MSC_VER))
 #include <intrin.h>
 #endif
 
diff --git a/src/port/pg_popcount_avx512.c b/src/port/pg_popcount_avx512.c
index 80c0aee3e73..80d9a372dd7 100644
--- a/src/port/pg_popcount_avx512.c
+++ b/src/port/pg_popcount_avx512.c
@@ -14,13 +14,13 @@
 
 #ifdef USE_AVX512_POPCNT_WITH_RUNTIME_CHECK
 
-#if defined(HAVE__GET_CPUID) || defined(HAVE__GET_CPUID_COUNT)
+#if defined(HAVE__GET_CPUID) || defined(HAVE__GET_CPUID_COUNT) || (defined(HAVE__CPUIDEX) && !defined(_MSC_VER))
 #include <cpuid.h>
 #endif
 
 #include <immintrin.h>
 
-#if defined(HAVE__CPUID) || defined(HAVE__CPUIDEX)
+#if defined(HAVE__CPUID) || (defined(HAVE__CPUIDEX) && defined(_MSC_VER))
 #include <intrin.h>
 #endif
 
-- 
2.47.3


--vtqqtrpooseurzip
Content-Type: text/x-diff; charset=utf-8
Content-Disposition: attachment;
	filename="v12-0002-Use-time-stamp-counter-to-measure-time-on-Linux-.patch"



^ permalink  raw  reply  [nested|flat] 202+ messages in thread

end of thread, other threads:[~2025-07-27 17:45 UTC | newest]

Thread overview: 202+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-18 14:52 [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server Jehan-Guillaume de Rorthais <[email protected]>
2025-07-27 17:45 [PATCH v12 1/3] cpuidex check: Support detecting newer GCC versions defining it in cpuid.h Lukas Fittl <[email protected]>

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox