diff --git a/configure b/configure index fb6a4914b06..1da073f0aaa 100755 --- a/configure +++ b/configure @@ -16177,6 +16177,20 @@ cat >>confdefs.h <<_ACEOF _ACEOF +# Linux open file descriptor locks +ac_fn_c_check_decl "$LINENO" "F_OFD_SETLK" "ac_cv_have_decl_F_OFD_SETLK" "#include +" +if test "x$ac_cv_have_decl_F_OFD_SETLK" = xyes; then : + ac_have_decl=1 +else + ac_have_decl=0 +fi + +cat >>confdefs.h <<_ACEOF +#define HAVE_DECL_F_OFD_SETLK $ac_have_decl +_ACEOF + + ac_fn_c_check_func "$LINENO" "explicit_bzero" "ac_cv_func_explicit_bzero" if test "x$ac_cv_func_explicit_bzero" = xyes; then : $as_echo "#define HAVE_EXPLICIT_BZERO 1" >>confdefs.h diff --git a/configure.ac b/configure.ac index d3febfe58f1..075194a8af8 100644 --- a/configure.ac +++ b/configure.ac @@ -1844,6 +1844,9 @@ AC_CHECK_DECLS([memset_s], [], [], [#define __STDC_WANT_LIB_EXT1__ 1 # This is probably only present on macOS, but may as well check always AC_CHECK_DECLS(F_FULLFSYNC, [], [], [#include ]) +# Linux open file descriptor locks +AC_CHECK_DECLS([F_OFD_SETLK], [], [], [#include ]) + AC_REPLACE_FUNCS(m4_normalize([ explicit_bzero getopt diff --git a/meson.build b/meson.build index 6d304f32fb0..d346aefe9b6 100644 --- a/meson.build +++ b/meson.build @@ -2694,6 +2694,7 @@ decl_checks = [ ['strlcpy', 'string.h'], ['strsep', 'string.h'], ['timingsafe_bcmp', 'string.h'], + ['F_OFD_SETLK', 'fcntl.h'], ] # Need to check for function declarations for these functions, because diff --git a/src/backend/utils/init/miscinit.c b/src/backend/utils/init/miscinit.c index 563f20374ff..b41a5f9dcca 100644 --- a/src/backend/utils/init/miscinit.c +++ b/src/backend/utils/init/miscinit.c @@ -68,6 +68,11 @@ static List *lock_files = NIL; static Latch LocalLatchData; +#if HAVE_DECL_F_OFD_SETLK +/* File descriptor for data directory lock file. */ +static int DataDirLockFD; +#endif + /* ---------------------------------------------------------------- * ignoring system indexes support stuff * @@ -1117,6 +1122,45 @@ RestoreClientConnectionInfo(char *conninfo) *------------------------------------------------------------------------- */ +/* + * Flock the data directory lockfile. + * + * Lock the data directory lockfile with an open file description lock. If the + * lock is already taken, it's a hard stop. It's only a best effort test, and + * any other errors are ignored. On succes the file descriptor is duplicated, + * to make sure there will be at least one open copy of it to keep the lock. + * + * filename is used only for reporting purposes. + */ +static void +FlockDataDirLockFile(int fd, const char *filename) +{ + +#if HAVE_DECL_F_OFD_SETLK + struct flock lock; + + lock.l_type = F_WRLCK; + lock.l_whence = SEEK_SET; + lock.l_start = 0; + lock.l_len = 0; + lock.l_pid = 0; + + if (fcntl(fd, F_OFD_SETLK, &lock) == -1) + { + if (errno == EAGAIN) + ereport(FATAL, + (errcode(ERRCODE_LOCK_FILE_EXISTS), + errmsg("cannot lock the lock file \"%s\"", filename), + errhint("Another server is starting."))); + else + elog(WARNING, "Failed locking file \"%s\", %m", filename); + } + else + DataDirLockFD = dup(fd); +#endif + +} + /* * proc_exit callback to remove lockfiles. */ @@ -1125,6 +1169,11 @@ UnlinkLockFiles(int status, Datum arg) { ListCell *l; +#if HAVE_DECL_F_OFD_SETLK + /* Close the file descriptor, which keeps the open file description lock */ + close(DataDirLockFD); +#endif + foreach(l, lock_files) { char *curfile = (char *) lfirst(l); @@ -1171,22 +1220,32 @@ CreateLockFile(const char *filename, bool amPostmaster, const char *envvar; /* - * If the PID in the lockfile is our own PID or our parent's or - * grandparent's PID, then the file must be stale (probably left over from - * a previous system boot cycle). We need to check this because of the - * likelihood that a reboot will assign exactly the same PID as we had in - * the previous reboot, or one that's only one or two counts larger and - * hence the lockfile's PID now refers to an ancestor shell process. We - * allow pg_ctl to pass down its parent shell PID (our grandparent PID) - * via the environment variable PG_GRANDPARENT_PID; this is so that - * launching the postmaster via pg_ctl can be just as reliable as - * launching it directly. There is no provision for detecting - * further-removed ancestor processes, but if the init script is written - * carefully then all but the immediate parent shell will be root-owned - * processes and so the kill test will fail with EPERM. Note that we - * cannot get a false negative this way, because an existing postmaster - * would surely never launch a competing postmaster or pg_ctl process - * directly. + * If we find an already existing lockfile containing our own PID, + * there are few options: + * + * - There is another process, that we don't see due to PID namespace + * isolation, which is already running in this data directory. + * + * To prevent two concurrent processes working with the same data + * directory, we first try to lock the lockfile exclusively. + * + * - The file must be stale, probably left over from a previous system boot + * cycle. The same if the lockfile contains our parent's or grandparent's + * PID. + * + * We need to check this because of the likelihood that a reboot will + * assign exactly the same PID as we had in the previous reboot, or one + * that's only one or two counts larger and hence the lockfile's PID now + * refers to an ancestor shell process. We allow pg_ctl to pass down its + * parent shell PID (our grandparent PID) via the environment variable + * PG_GRANDPARENT_PID; this is so that launching the postmaster via + * pg_ctl can be just as reliable as launching it directly. There is no + * provision for detecting further-removed ancestor processes, but if the + * init script is written carefully then all but the immediate parent + * shell will be root-owned processes and so the kill test will fail with + * EPERM. Note that we cannot get a false negative this way, because an + * existing postmaster would surely never launch a competing postmaster + * or pg_ctl process directly. */ my_pid = getpid(); @@ -1222,7 +1281,11 @@ CreateLockFile(const char *filename, bool amPostmaster, */ fd = open(filename, O_RDWR | O_CREAT | O_EXCL, pg_file_create_mode); if (fd >= 0) - break; /* Success; exit the retry loop */ + { + /* Success; lock and exit the retry loop */ + FlockDataDirLockFile(fd, filename); + break; + } /* * Couldn't create the pid file. Probably it already exists. @@ -1236,8 +1299,12 @@ CreateLockFile(const char *filename, bool amPostmaster, /* * Read the file to get the old owner's PID. Note race condition * here: file might have been deleted since we tried to create it. + * + * We're going to use the same fd for flock, and want to create a write + * lock for the latter one. Since both fd and the lock have to be of + * the same type, open the file for read and write. */ - fd = open(filename, O_RDONLY, pg_file_create_mode); + fd = open(filename, O_RDWR, pg_file_create_mode); if (fd < 0) { if (errno == ENOENT) @@ -1247,6 +1314,10 @@ CreateLockFile(const char *filename, bool amPostmaster, errmsg("could not open lock file \"%s\": %m", filename))); } + + /* Try to lock the file. We stop here, if it's already locked. */ + FlockDataDirLockFile(fd, filename); + pgstat_report_wait_start(WAIT_EVENT_LOCK_FILE_CREATE_READ); if ((len = read(fd, buffer, sizeof(buffer) - 1)) < 0) ereport(FATAL, diff --git a/src/include/pg_config.h.in b/src/include/pg_config.h.in index 339268dc8ef..e7b8e023829 100644 --- a/src/include/pg_config.h.in +++ b/src/include/pg_config.h.in @@ -80,6 +80,10 @@ don't. */ #undef HAVE_DECL_F_FULLFSYNC +/* Define to 1 if you have the declaration of `F_OFD_SETLK', and to 0 if you + don't. */ +#undef HAVE_DECL_F_OFD_SETLK + /* Define to 1 if you have the declaration of `memset_s', and to 0 if you don't. */ #undef HAVE_DECL_MEMSET_S