database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-05 07:21:24 +03:00
Code Activity

Fix dangling smgr_owner pointer when a fake relcache entry is freed.

Browse Source 
A fake relcache entry can "own" a SmgrRelation object, like a regular
relcache entry. But when it was free'd, the owner field in SmgrRelation
was not cleared, so it was left pointing to free'd memory.

Amazingly this apparently hasn't caused crashes in practice, or we would've
heard about it earlier. Andres found this with Valgrind.

Report and fix by Andres Freund, with minor modifications by me. Backpatch
to all supported versions.
This commit is contained in:
Heikki Linnakangas
2014-03-07 13:25:11 +02:00
parent ad7b48ea08
commit 55566c9a74
3 changed files with 42 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/backend/access/transam/xlogutils.c
View File

@ -445,6 +445,9 @@ CreateFakeRelcacheEntry(RelFileNode rnode)
void
FreeFakeRelcacheEntry(Relation fakerel)
{
/* make sure the fakerel is not referenced by the SmgrRelation anymore */
if (fakerel->rd_smgr != NULL)
smgrclearowner(&fakerel->rd_smgr, fakerel->rd_smgr);
pfree(fakerel);
}