database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-10-31 10:30:33 +03:00
Code Activity

Fix possible use after free in expand_partitioned_rtentry()

Browse Source 
It's possible that if the only live partition is concurrently dropped
and try_table_open() fails, that the bms_del_member() will pfree the
live_parts Bitmapset.  Since the bms_del_member() call does not assign
the result back to the live_parts local variable, the while loop could
segfault as that variable would still reference the pfree'd Bitmapset.

Backpatch to 15. 52f3de874 was backpatched to 14, but there's no
bms_del_member() there due to live_parts not yet existing in RelOptInfo in
that version.  Technically there's no bug in version 15 as
bms_del_member() didn't pfree when the set became empty prior to
00b41463c (from v16).  Applied to v15 anyway to keep the code similar and
to avoid the bad coding pattern.

Author: Bernd Reiß <bd_reiss@gmx.at>
Reviewed-by: David Rowley <dgrowleyml@gmail.com>
Discussion: https://postgr.es/m/6b88f27a-c45c-4826-8e37-d61a04d90182@gmx.at
Backpatch-through: 15
This commit is contained in:
David Rowley
2025-08-30 00:53:17 +12:00
parent f9a7622483
commit 8286bce0a0
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/backend/optimizer/util/inherit.c
View File

@@ -313,7 +313,6 @@ expand_partitioned_rtentry(PlannerInfo *root, RelOptInfo *relinfo,
PlanRowMark *top_parentrc, LOCKMODE lockmode)
{
PartitionDesc partdesc;
Bitmapset *live_parts;
int num_live_parts;
int i;
@@ -348,10 +347,10 @@ expand_partitioned_rtentry(PlannerInfo *root, RelOptInfo *relinfo,
* that survive pruning. Below, we will initialize child objects for the
* surviving partitions.
*/
relinfo->live_parts = live_parts = prune_append_rel_partitions(relinfo);
relinfo->live_parts = prune_append_rel_partitions(relinfo);
/* Expand simple_rel_array and friends to hold child objects. */
num_live_parts = bms_num_members(live_parts);
num_live_parts = bms_num_members(relinfo->live_parts);
if (num_live_parts > 0)
expand_planner_arrays(root, num_live_parts);
@@ -370,7 +369,7 @@ expand_partitioned_rtentry(PlannerInfo *root, RelOptInfo *relinfo,
* table itself, because it's not going to be scanned.
*/
i = -1;
while ((i = bms_next_member(live_parts, i)) >= 0)
while ((i = bms_next_member(relinfo->live_parts, i)) >= 0)
{
Oid childOID = partdesc->oids[i];
Relation childrel;