From a15d84470db8f42d3850a007dfa166d3fce5bc66 Mon Sep 17 00:00:00 2001 From: Thomas Munro Date: Sat, 29 May 2021 14:48:15 +1200 Subject: [PATCH] Fix race condition when sharing tuple descriptors. Parallel query processes that called BlessTupleDesc() for identical tuple descriptors at the same moment could crash. There was code to handle that rare case, but it dereferenced a bogus DSA pointer. Repair. Back-patch to 11, where commit cc5f8136 added support for sharing tuple descriptors in parallel queries. Reported-by: Eric Thinnes Discussion: https://postgr.es/m/99aaa2eb-e194-bf07-c29a-1a76b4f2bcf9%40gmx.de --- src/backend/utils/cache/typcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/backend/utils/cache/typcache.c b/src/backend/utils/cache/typcache.c index 0fe06fd7c8b..65ca726c5ec 100644 --- a/src/backend/utils/cache/typcache.c +++ b/src/backend/utils/cache/typcache.c @@ -2606,7 +2606,7 @@ find_or_make_matching_shared_tupledesc(TupleDesc tupdesc) Assert(record_table_entry->key.shared); result = (TupleDesc) dsa_get_address(CurrentSession->area, - record_table_entry->key.shared); + record_table_entry->key.u.shared_tupdesc); Assert(result->tdrefcount == -1); return result;