From 24bf23fe665f265328cc6ff82a5a5d5faab2b3bd Mon Sep 17 00:00:00 2001 From: Peter Geoghegan Date: Thu, 20 Aug 2026 19:47:27 -0400 Subject: [PATCH] Fix snapshot import xmin ProcArrayLock bug. ProcArrayInstallImportedXmin verifies that the source transaction (the transaction whose snapshot we're importing) is still running, and then installs the caller's imported xmin. These steps have to be atomic. But it was just about possible for VACUUM to fail to observe the imported xmin in either the source proc or the importing one. This could result in VACUUM pruning away deleted tuples that were still visible to the imported snapshot. To fix, take ProcArrayLock in exclusive mode while importing an exported snapshot's xmin within ProcArrayInstallImportedXmin. That guarantees that a concurrent VACUUM's OldestXmin cannot advance past the xmin (one proc or the other always advertises an xmin that holds it back). Author: Chee Wooson Reviewed-by: Peter Geoghegan Discussion: https://postgr.es/m/20260730042128.714201-1-chee.wooson@gmail.com Backpatch-through: 14 --- src/backend/storage/ipc/procarray.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/backend/storage/ipc/procarray.c b/src/backend/storage/ipc/procarray.c index 7b931f028e9..cfb0fcee440 100644 --- a/src/backend/storage/ipc/procarray.c +++ b/src/backend/storage/ipc/procarray.c @@ -2544,8 +2544,13 @@ ProcArrayInstallImportedXmin(TransactionId xmin, if (!sourcevxid) return false; - /* Get lock so source xact can't end while we're doing this */ - LWLockAcquire(ProcArrayLock, LW_SHARED); + /* + * Take the lock in exclusive mode to ensure that installing xmin is + * atomic with our check that the source transaction is still running. + * (Using shared mode risks a concurrent VACUUM whose ComputeXidHorizons() + * call fails to observe the xmin in either the source proc or our own.) + */ + LWLockAcquire(ProcArrayLock, LW_EXCLUSIVE); /* * Find the PGPROC entry of the source transaction. (This could use