From 295f75b4bb60c22acb7bdcd7aebf7bb8965658aa Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Wed, 30 Sep 2026 14:37:19 +0900 Subject: [PATCH] Fix clobbering of proc entry's statusFlags during slot invalidation ReplicationSlotRelease() copied MyProc->statusFlags unconditionally when resetting PROC_IN_LOGICAL_DECODING, using its pgxactoff to decide which area to update. Slot invalidations can be done by the checkpointer or the startup process, and ReplicationSlotRelease() ignored the fact that pgxactoff is only meaningful for processes in the proc array, that auxiliary processes never join. pgxactoff would remain at 0 for these, meaning that an incorrect set of status flags would be updated. The consequences of this issue could be various, depending on the statsFlags lost in the proc slot incorrectly overwritten. Losing PROC_AFFECTS_ALL_HORIZONS has been mentioned as the worse case, causing VACUUM to remove rows a standby may needs even if standby feedback is enabled. Assertions failures are another possibility. Let's skip the update of statusFlags unless PROC_IN_LOGICAL_DECODING is set. Nothing but StartupDecodingContext() sets it, and no auxiliary processes call it. Author: Vlad Lesin Reviewed-by: Hayato Kuroda Reviewed-by: Michael Paquier Discussion: https://postgr.es/m/889a06dd-45fc-423b-9dd2-87d5b5dc60c6@gmail.com Backpatch-through: 14 --- src/backend/replication/slot.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/src/backend/replication/slot.c b/src/backend/replication/slot.c index 2f1696f4111..1f3bb7f7f87 100644 --- a/src/backend/replication/slot.c +++ b/src/backend/replication/slot.c @@ -747,11 +747,19 @@ ReplicationSlotRelease(void) MyReplicationSlot = NULL; } - /* might not have been set when we've been a plain slot */ - LWLockAcquire(ProcArrayLock, LW_EXCLUSIVE); - MyProc->statusFlags &= ~PROC_IN_LOGICAL_DECODING; - ProcGlobal->statusFlags[MyProc->pgxactoff] = MyProc->statusFlags; - LWLockRelease(ProcArrayLock); + /* + * Update statusFlags only if PROC_IN_LOGICAL_DECODING is set. An + * auxiliary process (checkpointer or startup process) may invalidate a + * slot. Auxiliary processes are not in the proc array, and pgxactoff + * would point at something which is not its own. + */ + if (MyProc->statusFlags & PROC_IN_LOGICAL_DECODING) + { + LWLockAcquire(ProcArrayLock, LW_EXCLUSIVE); + MyProc->statusFlags &= ~PROC_IN_LOGICAL_DECODING; + ProcGlobal->statusFlags[MyProc->pgxactoff] = MyProc->statusFlags; + LWLockRelease(ProcArrayLock); + } if (am_walsender) {