Re: BUG #17792: MERGE uses uninitialized pointer and crashes when target tuple is updated concurrently
Alvaro Herrera <alvherre@alvh.no-ip.org>
From: Alvaro Herrera <alvherre@alvh.no-ip.org>
To: exclusion@gmail.com, pgsql-bugs@lists.postgresql.org
Date: 2023-02-14T11:29:33Z
Lists: pgsql-bugs
Attachments
- merge-uninit.patch (text/x-diff) patch
On 2023-Feb-14, PG Bug reporting form wrote: > When executing the following queries with valgrind: > echo " > CREATE TABLE source (sid integer); > INSERT INTO source VALUES (1); > CREATE TABLE target (tid integer, tval integer); > INSERT INTO target VALUES (1, 1); > " | psql > At nodeModifyTable.c:2992 I see: > if (!TupIsNull(context->cpUpdateRetrySlot)) > > It looks like cpUpdateRetrySlot was not initialized on the context creation > in ExecModifyTable(), and ExecCrossPartitionUpdate(), where it could get a > value, just not called for this case. Hmm, yeah: because this is not a partitioned table, we are definitely not expecting that cpUpdateRetrySlot will be set. Can you still reproduce the problem with the attached patch? I'm not sure that the location of the initialization is best. My first impulse was to add it in line 3618, with the "Set global context" lines; but then I think it's possible for one tuple of a partition to be routed correctly and a later one that is concurrently updated suffer from an improper value in cpUpdateRetrySlot. Also, the comment is not great ... -- Álvaro Herrera 48°01'N 7°57'E — https://www.EnterpriseDB.com/
Commits
-
Don't rely on uninitialized value in MERGE / DELETE
- fd923b5de94c 16.0 landed
- 5d8ec1b9f625 15.3 landed