agora inbox for pgsql-hackers@postgresql.org  

help / color / mirror / Atom feed

[PATCH v4] Add pg_tablespace_avail() functions
324+ messages / 2 participants
[nested] [flat]

* [PATCH v4] Add pg_tablespace_avail() functions
@ 2025-03-14 15:29 Christoph Berg <myon@debian.org>
  0 siblings, 0 replies; 324+ messages in thread

From: Christoph Berg @ 2025-03-14 15:29 UTC (permalink / raw)

This exposes the f_avail value from statvfs() on tablespace directories
on the SQL level, allowing monitoring of free disk space from within the
server. On windows, GetDiskFreeSpaceEx() is used.

Permissions required match those from pg_tablespace_size().

In psql, include a new "Free" column in \db+ output.

Add test coverage for pg_tablespace_avail() and the previously not
covered pg_tablespace_size() function.
---
 doc/src/sgml/func.sgml                   |  21 +++++
 doc/src/sgml/ref/psql-ref.sgml           |   2 +-
 src/backend/utils/adt/dbsize.c           | 102 +++++++++++++++++++++++
 src/bin/psql/describe.c                  |  11 ++-
 src/include/catalog/pg_proc.dat          |   8 ++
 src/test/regress/expected/tablespace.out |  21 +++++
 src/test/regress/sql/tablespace.sql      |  10 +++
 7 files changed, 171 insertions(+), 4 deletions(-)

diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml
index 51dd8ad6571..0b4456ad958 100644
--- a/doc/src/sgml/func.sgml
+++ b/doc/src/sgml/func.sgml
@@ -30093,6 +30093,27 @@ postgres=# SELECT '0/0'::pg_lsn + pd.segment_number * ps.setting::int + :offset
        </para></entry>
       </row>
 
+      <row>
+       <entry role="func_table_entry"><para role="func_signature">
+        <indexterm>
+         <primary>pg_tablespace_avail</primary>
+        </indexterm>
+        <function>pg_tablespace_avail</function> ( <type>name</type> )
+        <returnvalue>bigint</returnvalue>
+       </para>
+       <para role="func_signature">
+        <function>pg_tablespace_avail</function> ( <type>oid</type> )
+        <returnvalue>bigint</returnvalue>
+       </para>
+       <para>
+        Returns the available disk space in the tablespace with the
+        specified name or OID. To use this function, you must
+        have <literal>CREATE</literal> privilege on the specified tablespace
+        or have privileges of the <literal>pg_read_all_stats</literal> role,
+        unless it is the default tablespace for the current database.
+       </para></entry>
+      </row>
+
       <row>
        <entry role="func_table_entry"><para role="func_signature">
         <indexterm>
diff --git a/doc/src/sgml/ref/psql-ref.sgml b/doc/src/sgml/ref/psql-ref.sgml
index cedccc14129..9e1bec0b422 100644
--- a/doc/src/sgml/ref/psql-ref.sgml
+++ b/doc/src/sgml/ref/psql-ref.sgml
@@ -1492,7 +1492,7 @@ SELECT $1 \parse stmt1
         If <literal>x</literal> is appended to the command name, the results
         are displayed in expanded mode.
         If <literal>+</literal> is appended to the command name, each tablespace
-        is listed with its associated options, on-disk size, permissions and
+        is listed with its associated options, on-disk size and free disk space, permissions and
         description.
         </para>
         </listitem>
diff --git a/src/backend/utils/adt/dbsize.c b/src/backend/utils/adt/dbsize.c
index 25865b660ef..9bd8667c2d9 100644
--- a/src/backend/utils/adt/dbsize.c
+++ b/src/backend/utils/adt/dbsize.c
@@ -12,6 +12,12 @@
 #include "postgres.h"
 
 #include <sys/stat.h>
+#ifdef WIN32
+#include <fileapi.h>
+#include <errhandlingapi.h>
+#else
+#include <sys/statvfs.h>
+#endif
 
 #include "access/htup_details.h"
 #include "access/relation.h"
@@ -316,6 +322,102 @@ pg_tablespace_size_name(PG_FUNCTION_ARGS)
 }
 
 
+/*
+ * Return available disk space of tablespace. Returns -1 if the tablespace
+ * directory cannot be found.
+ */
+static int64
+calculate_tablespace_avail(Oid tblspcOid)
+{
+	char		tblspcPath[MAXPGPATH];
+	AclResult	aclresult;
+#ifdef WIN32
+	ULARGE_INTEGER lpFreeBytesAvailable;
+#else
+	struct statvfs fst;
+#endif
+
+	/*
+	 * User must have privileges of pg_read_all_stats or have CREATE privilege
+	 * for target tablespace, either explicitly granted or implicitly because
+	 * it is default for current database.
+	 */
+	if (tblspcOid != MyDatabaseTableSpace &&
+		!has_privs_of_role(GetUserId(), ROLE_PG_READ_ALL_STATS))
+	{
+		aclresult = object_aclcheck(TableSpaceRelationId, tblspcOid, GetUserId(), ACL_CREATE);
+		if (aclresult != ACLCHECK_OK)
+			aclcheck_error(aclresult, OBJECT_TABLESPACE,
+						   get_tablespace_name(tblspcOid));
+	}
+
+	if (tblspcOid == DEFAULTTABLESPACE_OID)
+		snprintf(tblspcPath, MAXPGPATH, "base");
+	else if (tblspcOid == GLOBALTABLESPACE_OID)
+		snprintf(tblspcPath, MAXPGPATH, "global");
+	else
+		snprintf(tblspcPath, MAXPGPATH, "%s/%u/%s", PG_TBLSPC_DIR, tblspcOid,
+				 TABLESPACE_VERSION_DIRECTORY);
+
+#ifdef WIN32
+	if (! GetDiskFreeSpaceEx(tblspcPath, &lpFreeBytesAvailable, NULL, NULL))
+		elog(ERROR, "GetDiskFreeSpaceEx failed: error code %lu", GetLastError());
+
+	return lpFreeBytesAvailable.QuadPart; /* ULONGLONG part of ULARGE_INTEGER */
+#else
+	if (statvfs(tblspcPath, &fst) < 0)
+	{
+		if (errno == ENOENT)
+			return -1;
+		else
+			ereport(ERROR,
+					(errcode_for_file_access(),
+					 errmsg("could not statvfs directory \"%s\": %m", tblspcPath)));
+	}
+
+	return fst.f_bavail * fst.f_frsize; /* available blocks times fragment size */
+#endif
+}
+
+Datum
+pg_tablespace_avail_oid(PG_FUNCTION_ARGS)
+{
+	Oid			tblspcOid = PG_GETARG_OID(0);
+	int64		avail;
+
+	/*
+	 * Not needed for correctness, but avoid non-user-facing error message
+	 * later if the tablespace doesn't exist.
+	 */
+	if (!SearchSysCacheExists1(TABLESPACEOID, ObjectIdGetDatum(tblspcOid)))
+		ereport(ERROR,
+				errcode(ERRCODE_UNDEFINED_OBJECT),
+				errmsg("tablespace with OID %u does not exist", tblspcOid));
+
+	avail = calculate_tablespace_avail(tblspcOid);
+
+	if (avail < 0)
+		PG_RETURN_NULL();
+
+	PG_RETURN_INT64(avail);
+}
+
+Datum
+pg_tablespace_avail_name(PG_FUNCTION_ARGS)
+{
+	Name		tblspcName = PG_GETARG_NAME(0);
+	Oid			tblspcOid = get_tablespace_oid(NameStr(*tblspcName), false);
+	int64		avail;
+
+	avail = calculate_tablespace_avail(tblspcOid);
+
+	if (avail < 0)
+		PG_RETURN_NULL();
+
+	PG_RETURN_INT64(avail);
+}
+
+
 /*
  * calculate size of (one fork of) a relation
  *
diff --git a/src/bin/psql/describe.c b/src/bin/psql/describe.c
index e6cf468ac9e..8c52a126ac1 100644
--- a/src/bin/psql/describe.c
+++ b/src/bin/psql/describe.c
@@ -241,10 +241,15 @@ describeTablespaces(const char *pattern, bool verbose)
 		printACLColumn(&buf, "spcacl");
 		appendPQExpBuffer(&buf,
 						  ",\n  spcoptions AS \"%s\""
-						  ",\n  pg_catalog.pg_size_pretty(pg_catalog.pg_tablespace_size(oid)) AS \"%s\""
-						  ",\n  pg_catalog.shobj_description(oid, 'pg_tablespace') AS \"%s\"",
+						  ",\n  pg_catalog.pg_size_pretty(pg_catalog.pg_tablespace_size(oid)) AS \"%s\"",
 						  gettext_noop("Options"),
-						  gettext_noop("Size"),
+						  gettext_noop("Size"));
+		if (pset.sversion >= 180000)
+			appendPQExpBuffer(&buf,
+							  ",\n  pg_catalog.pg_size_pretty(pg_catalog.pg_tablespace_avail(oid)) AS \"%s\"",
+							  gettext_noop("Free"));
+		appendPQExpBuffer(&buf,
+						  ",\n  pg_catalog.shobj_description(oid, 'pg_tablespace') AS \"%s\"",
 						  gettext_noop("Description"));
 	}
 
diff --git a/src/include/catalog/pg_proc.dat b/src/include/catalog/pg_proc.dat
index 42e427f8fe8..9d64da6bfb8 100644
--- a/src/include/catalog/pg_proc.dat
+++ b/src/include/catalog/pg_proc.dat
@@ -7680,6 +7680,14 @@
   descr => 'total disk space usage for the specified tablespace',
   proname => 'pg_tablespace_size', provolatile => 'v', prorettype => 'int8',
   proargtypes => 'name', prosrc => 'pg_tablespace_size_name' },
+{ oid => '6015',
+  descr => 'disk stats for the specified tablespace',
+  proname => 'pg_tablespace_avail', provolatile => 'v', prorettype => 'int8',
+  proargtypes => 'oid', prosrc => 'pg_tablespace_avail_oid' },
+{ oid => '6016',
+  descr => 'disk stats for the specified tablespace',
+  proname => 'pg_tablespace_avail', provolatile => 'v', prorettype => 'int8',
+  proargtypes => 'name', prosrc => 'pg_tablespace_avail_name' },
 { oid => '2324', descr => 'total disk space usage for the specified database',
   proname => 'pg_database_size', provolatile => 'v', prorettype => 'int8',
   proargtypes => 'oid', prosrc => 'pg_database_size_oid' },
diff --git a/src/test/regress/expected/tablespace.out b/src/test/regress/expected/tablespace.out
index a90e39e5738..6709ed794df 100644
--- a/src/test/regress/expected/tablespace.out
+++ b/src/test/regress/expected/tablespace.out
@@ -20,6 +20,27 @@ SELECT spcoptions FROM pg_tablespace WHERE spcname = 'regress_tblspacewith';
  {random_page_cost=3.0}
 (1 row)
 
+-- check size functions
+SELECT pg_tablespace_size('pg_default') BETWEEN 1_000_000 and 10_000_000_000, -- rough sanity check
+       pg_tablespace_size('pg_global') BETWEEN 100_000 and 10_000_000,
+       pg_tablespace_size('regress_tblspacewith'); -- empty
+ ?column? | ?column? | pg_tablespace_size 
+----------+----------+--------------------
+ t        | t        |                  0
+(1 row)
+
+SELECT pg_tablespace_size('missing');
+ERROR:  tablespace "missing" does not exist
+SELECT pg_tablespace_avail('pg_default') > 1_000_000,
+       pg_tablespace_avail('pg_global') > 1_000_000,
+       pg_tablespace_avail('regress_tblspacewith') > 1_000_000;
+ ?column? | ?column? | ?column? 
+----------+----------+----------
+ t        | t        | t
+(1 row)
+
+SELECT pg_tablespace_avail('missing');
+ERROR:  tablespace "missing" does not exist
 -- drop the tablespace so we can re-use the location
 DROP TABLESPACE regress_tblspacewith;
 -- This returns a relative path as of an effect of allow_in_place_tablespaces,
diff --git a/src/test/regress/sql/tablespace.sql b/src/test/regress/sql/tablespace.sql
index dfe3db096e2..3fcd4bb00ff 100644
--- a/src/test/regress/sql/tablespace.sql
+++ b/src/test/regress/sql/tablespace.sql
@@ -17,6 +17,16 @@ CREATE TABLESPACE regress_tblspacewith LOCATION '' WITH (random_page_cost = 3.0)
 -- check to see the parameter was used
 SELECT spcoptions FROM pg_tablespace WHERE spcname = 'regress_tblspacewith';
 
+-- check size functions
+SELECT pg_tablespace_size('pg_default') BETWEEN 1_000_000 and 10_000_000_000, -- rough sanity check
+       pg_tablespace_size('pg_global') BETWEEN 100_000 and 10_000_000,
+       pg_tablespace_size('regress_tblspacewith'); -- empty
+SELECT pg_tablespace_size('missing');
+SELECT pg_tablespace_avail('pg_default') > 1_000_000,
+       pg_tablespace_avail('pg_global') > 1_000_000,
+       pg_tablespace_avail('regress_tblspacewith') > 1_000_000;
+SELECT pg_tablespace_avail('missing');
+
 -- drop the tablespace so we can re-use the location
 DROP TABLESPACE regress_tblspacewith;
 
-- 
2.47.2


--mxigUiQ2jY+Id+Rf--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread

* [PATCH v3 2/2] Error out if one iteration of non-direct DML affects more than one row on the foreign server
@ 2025-07-18 14:52 Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
  0 siblings, 0 replies; 324+ messages in thread

From: Jehan-Guillaume de Rorthais @ 2025-07-18 14:52 UTC (permalink / raw)

When a foreign table points to a partitioned table or an inheritance
parent on the foreign server, a non-direct DML can affect multiple
rows when only one row is intended to be affected. This happens
because postgres_fdw uses only ctid to identify a row to work on.
Though ctid uniquely identifies a row in a single table, in a
partitioned table or in an inheritance hierarchy, there can be be
multiple rows, in different partitions, with the same ctid. So a DML
statement sent to the foreign server by postgres_fdw ends up affecting
more than one rows, only one of which is intended to be affected.

In such a case it's good to throw an error instead of corrupting
remote database with unwanted UPDATE/DELETEs. Subsequent commits will
try to fix this situation.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>

Rebased by Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
---
 .../postgres_fdw/expected/postgres_fdw.out    | 26 ++++++++------
 contrib/postgres_fdw/postgres_fdw.c           | 36 +++++++++++++++----
 2 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 62019eaa881..b0ef54a2889 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8984,10 +8984,11 @@ UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa
 (5 rows)
 
 UPDATE fa SET aa = (CASE WHEN random() <= 1 THEN 'zzzz' ELSE NULL END) WHERE aa = 'aaa';
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  |  aa  
-----------+-------+------
- fa       | (0,2) | zzzz
+ tableoid | ctid  | aa  
+----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
 (2 rows)
 
@@ -9008,11 +9009,13 @@ DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
 (6 rows)
 
 DELETE FROM fa WHERE aa = (CASE WHEN random() <= 1 THEN 'aaa' ELSE 'bbb' END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fa;
- tableoid | ctid  | aa 
+ tableoid | ctid  | aa  
 ----------+-------+-----
+ fa       | (0,1) | aaa
  fa       | (0,1) | bbb
-(1 row)
+(2 rows)
 
 -- cleanup
 DROP FOREIGN TABLE fa;
@@ -9048,10 +9051,11 @@ UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
 (5 rows)
 
 UPDATE fplt SET b = (CASE WHEN random() <= 1 THEN 10 ELSE 20 END) WHERE a = 1;
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
- tableoid | ctid  | a | b  
-----------+-------+---+----
- fplt     | (0,2) | 1 | 10
+ tableoid | ctid  | a | b 
+----------+-------+---+---
+ fplt     | (0,1) | 1 | 1
  fplt     | (0,1) | 2 | 2
 (2 rows)
 
@@ -9071,11 +9075,13 @@ DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
 (6 rows)
 
 DELETE FROM fplt WHERE a = (CASE WHEN random() <=  1 THEN 1 ELSE 10 END);
+ERROR:  foreign server affected 2 rows when only one was expected
 SELECT tableoid::regclass, ctid, * FROM fplt;
  tableoid | ctid  | a | b 
 ----------+-------+---+---
- fplt     | (0,1) | 2 | 2 
-(1 row)
+ fplt     | (0,1) | 1 | 1
+ fplt     | (0,1) | 2 | 2
+(2 rows)
 
 DROP TABLE plt;
 DROP FOREIGN TABLE fplt;
diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index e0a34b27c7c..09c87d0e5d8 100644
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -4132,7 +4132,8 @@ execute_foreign_modify(EState *estate,
 	ItemPointer ctid = NULL;
 	const char **p_values;
 	PGresult   *res;
-	int			n_rows;
+	int			n_rows_returned;
+	int			n_rows_affected;
 	StringInfoData sql;
 
 	/* The operation should be INSERT, UPDATE, or DELETE */
@@ -4213,27 +4214,50 @@ execute_foreign_modify(EState *estate,
 		pgfdw_report_error(ERROR, res, fmstate->conn, true, fmstate->query);
 
 	/* Check number of rows affected, and fetch RETURNING tuple if any */
+	n_rows_affected = atoi(PQcmdTuples(res));
 	if (fmstate->has_returning)
 	{
 		Assert(*numSlots == 1);
-		n_rows = PQntuples(res);
-		if (n_rows > 0)
+		n_rows_returned = PQntuples(res);
+		if (n_rows_returned > 0)
 			store_returning_result(fmstate, slots[0], res);
+
+		// FIXME: shouldn't we check the max number of rows returned is one?
 	}
 	else
-		n_rows = atoi(PQcmdTuples(res));
+		n_rows_returned = 0;
 
 	/* And clean up */
 	PQclear(res);
 
 	MemoryContextReset(fmstate->temp_cxt);
 
-	*numSlots = n_rows;
+	/*
+	 * UPDATE & DELETE command can only affect one row, make sure this contract
+	 * is respected.
+	 * CMD_INSERT can insert multiple row when called from ForeignBatchInsert.
+	 */
+	if (operation != CMD_INSERT)
+	{
+		/* No rows should be returned if no rows were affected */
+		if (n_rows_affected == 0 && n_rows_returned != 0)
+			elog(ERROR, "foreign server returned %d rows when no row was affected",
+				 n_rows_returned);
+
+		/* ERROR if more than one row was updated on the remote end */
+		if (n_rows_affected > 1)
+			ereport(ERROR,
+					(errcode (ERRCODE_FDW_ERROR), /* XXX */
+					 errmsg ("foreign server affected %d rows when only one was expected",
+							 n_rows_affected)));
+	}
+
+	*numSlots = n_rows_returned;
 
 	/*
 	 * Return NULL if nothing was inserted/updated/deleted on the remote end
 	 */
-	return (n_rows > 0) ? slots : NULL;
+	return (n_rows_affected > 0) ? slots : NULL;
 }
 
 /*
-- 
2.50.0


--MP_/4ZRYdF7Ah.pt5w65PuZdaPz--





^ permalink  raw  reply  [nested|flat] 324+ messages in thread