Fix size estimation for parallel B-Tree scans with skip arrays

Siddharth Kothari <sidkot@google.com>

From: Siddharth Kothari <sidkot@google.com>
To: pgsql-bugs@lists.postgresql.org
Cc: Vaibhav Jain <jainva@google.com>, Madhukar <madhukarprasad@google.com>, Xun Cheng <xuncheng@google.com>, pg@bowt.ie
Date: 2026-04-29T06:54:21Z
Lists: pgsql-bugs

Attachments

Hi folks.

This commit
<https://github.com/postgres/postgres/commit/92fe23d93aa3bbbc40fca669cabc4a4d7975e327#diff-db0039b5ba12b5915e91ed6eedd78744e3cf7a77082af072d9626a5ae306c579>
 introduced parallel scan skip support, however it underestimates the
required memory, causing it to write past the allocated shared memory
boundary. This can corrupt any entity using the adjacent shared memory
segment, leading to unpredictable behavior.

I reproduced the issue manually on stock postgres and raised a patch that
fixes it along with regress tests. In my repro, the issue manifested as
postgres server crashing unexpectedly.

Root cause:

In src/backend/access/nbtree/nbtree.c, the loop in
btestimateparallelscan assumes
that every index column might require a skip array and adds sizeof(int) to
the estimated size:

However, every skip array actually needs space for its slot in the
btps_arrElems array AND space to store its scan key's sk_flags. Therefore,
it requires sizeof(int) * 2.


The attached patch fixes this by allocating sizeof(int) * 2 per attribute
in btestimateparallelscan.


Please let me know your thoughts.


Thanks,

Siddharth Kothari

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →
  1. Fix nbtree skip array parallel alloc accounting.

  2. Add nbtree skip scan optimization.