Horton

Re: Use-after-free in reorderbuffer.c for INSERT ON CONFLICT

Michael Paquier <michael@paquier.xyz>

View thread
From: Michael Paquier <michael@paquier.xyz>
To: Amit Kapila <amit.kapila16@gmail.com>
Cc: Postgres bugs <pgsql-bugs@lists.postgresql.org>, Masahiko Sawada <sawada.mshk@gmail.com>, Ethan Mertz <ethan.mertz@gmail.com>
Date: 2025-08-01T04:52:20Z
Lists: pgsql-bugs

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

  1. Fix use-after-free with INSERT ON CONFLICT changes in reorderbuffer.c

On Fri, Aug 01, 2025 at 10:03:14AM +0530, Amit Kapila wrote:
> We still won't be able to capture the latest LSN in case of
> REORDER_BUFFER_CHANGE_INTERNAL_SPEC_ABORT. IIRC, update_progress_txn
> is used to keep the client active so that when many changes are
> skipped, the client doesn't timeout. In this case, it seems okay to
> use prev_lsn as well.

I am not quite sure to follow your argument here.  In the case of a
REORDER_BUFFER_CHANGE_INTERNAL_SPEC_ABORT change, we would use
change->lsn, which is in the case of the patch and HEAD the same
thing: prev_lsn.  So the logic is unchanged in the case, isn't it?
--
Michael