Horton

Re: [Bug] Usage of stale dead_items pointer in parallel vacuum

Richard Guo <guofenglinux@gmail.com>

View thread
From: Richard Guo <guofenglinux@gmail.com>
To: John Naylor <johncnaylorls@gmail.com>
Cc: Kevin Oommen Anish <kevin.o@zohocorp.com>, pgsql-bugs <pgsql-bugs@lists.postgresql.org>
Date: 2025-10-02T09:33:02Z
Lists: pgsql-bugs

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

  1. Fix reuse-after-free hazard in dead_items_reset

On Thu, Oct 2, 2025 at 2:09 PM John Naylor <johncnaylorls@gmail.com> wrote:
> On Thu, Oct 2, 2025 at 11:17 AM Richard Guo <guofenglinux@gmail.com> wrote:
> > I can reproduce the issue and confirm that your patch fixes it.  I
> > didn't use your custom malloc allocator but instead applied a
> > redundant palloc0 for TidStore in TidStoreCreateShared(), hoping to
> > get a different chunk of memory (haha).

> I'm starting to wonder if we should have something similar to that
> allocator in core, which is actually here and not in the link
> upthread:

+1.  This issue is more like a reuse-after-free rather than a
use-after-free, and it doesn't seem easy to detect with current tools.
This kind of allocator seems to be quite useful -- it has helped catch
at least two bugs in our code so far.

- Richard