Horton

Re: Multixid SLRU truncation bugs at wraparound

x4mmm@yandex-team.ru

View thread View on postgr.es
From: Andrey Borodin <x4mmm@yandex-team.ru>
To: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>, Maxim Orlov <orlovmg@gmail.com>
Date: 2026-01-09T17:58:21Z
Lists: pgsql-hackers 

> On 6 Jan 2026, at 16:53, Heikki Linnakangas <hlinnaka@iki.fi> wrote:
> 
> For all branches, I propose v1-0002-Add-check-for-invalid-offset-at-multixid-truncati.patch to add a check for oldestOffset == 0. That fixes the potential for catastrophic truncation with invalid offset 0.

Multixid that is used in heap is WAL-logged. WAL-logged multixact has non-zero offset.
So in non-corrupted database such as condition is impossible.
However, I observed several incidents when AI recommended pg_resetwal to users.
Proposed safeguard might be useful to prevent sprawling corruption in database.



> On 6 Jan 2026, at 16:53, Heikki Linnakangas <hlinnaka@iki.fi> wrote:
> 
> But for 'master', I propose the attached v1-0001-Remove-some-unnecessary-code-from-multixact-trunc.patch.

The patch simplifies the code while maintaining correctness.
The only issue I can think of is that clog, commit_ts and async are still using approach based on SlruScanDirectory().


Best regards, Andrey Borodin.

Commits

  1. Add check for invalid offset at multixid truncation

  2. Remove some unnecessary code from multixact truncation

  3. Never store 0 as the nextMXact

  4. Set next multixid's offset when creating a new multixid