Horton

Re: [Bug] Usage of stale dead_items pointer in parallel vacuum

Richard Guo <guofenglinux@gmail.com>

View thread
From: Richard Guo <guofenglinux@gmail.com>
To: Kevin Oommen Anish <kevin.o@zohocorp.com>
Cc: pgsql-bugs <pgsql-bugs@lists.postgresql.org>
Date: 2025-10-02T04:16:47Z
Lists: pgsql-bugs

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

  1. Fix reuse-after-free hazard in dead_items_reset

On Thu, Oct 2, 2025 at 12:56 AM Kevin Oommen Anish <kevin.o@zohocorp.com> wrote:
> Failed regression:
> CREATE TABLE pvactst2 (i INT) WITH (autovacuum_enabled = off);
> INSERT INTO pvactst2 SELECT generate_series(1, 1000);
> CREATE INDEX ON pvactst2 (i);
> CREATE INDEX ON pvactst2 (i);
> SET min_parallel_index_scan_size to 0;
> SET maintenance_work_mem TO 64;
> INSERT INTO pvactst2 SELECT generate_series(1, 1000);
> DELETE FROM pvactst2 WHERE i < 1000;
> VACUUM (PARALLEL 2) pvactst2;

I can reproduce the issue and confirm that your patch fixes it.  I
didn't use your custom malloc allocator but instead applied a
redundant palloc0 for TidStore in TidStoreCreateShared(), hoping to
get a different chunk of memory (haha).

@@ -212,6 +212,7 @@ TidStoreCreateShared(size_t max_bytes, int tranche_id)
        size_t          dsa_init_size = DSA_DEFAULT_INIT_SEGMENT_SIZE;
        size_t          dsa_max_size = DSA_MAX_SEGMENT_SIZE;

+       ts = palloc0(sizeof(TidStore));
        ts = palloc0(sizeof(TidStore));

- Richard