From ca99016f939dc1e1b260c3ea16721948a1558ef7 Mon Sep 17 00:00:00 2001 From: Peter Geoghegan Date: Thu, 20 Aug 2026 19:47:31 -0400 Subject: [PATCH] Fix snapshot import xmin ProcArrayLock bug. ProcArrayInstallImportedXmin verifies that the source transaction (the transaction whose snapshot we're importing) is still running, and then installs the caller's imported xmin. These steps have to be atomic. But it was just about possible for VACUUM to fail to observe the imported xmin in either the source proc or the importing one. This could result in VACUUM pruning away deleted tuples that were still visible to the imported snapshot. To fix, take ProcArrayLock in exclusive mode while importing an exported snapshot's xmin within ProcArrayInstallImportedXmin. That guarantees that a concurrent VACUUM's OldestXmin cannot advance past the xmin (one proc or the other always advertises an xmin that holds it back). Author: Chee Wooson Reviewed-by: Peter Geoghegan Discussion: https://postgr.es/m/20260730042128.714201-1-chee.wooson@gmail.com Backpatch-through: 14 --- src/backend/storage/ipc/procarray.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/backend/storage/ipc/procarray.c b/src/backend/storage/ipc/procarray.c index 60336b31803..dd221018322 100644 --- a/src/backend/storage/ipc/procarray.c +++ b/src/backend/storage/ipc/procarray.c @@ -2487,8 +2487,13 @@ ProcArrayInstallImportedXmin(TransactionId xmin, if (!sourcevxid) return false; - /* Get lock so source xact can't end while we're doing this */ - LWLockAcquire(ProcArrayLock, LW_SHARED); + /* + * Take the lock in exclusive mode to ensure that installing xmin is + * atomic with our check that the source transaction is still running. + * (Using shared mode risks a concurrent VACUUM whose ComputeXidHorizons() + * call fails to observe the xmin in either the source proc or our own.) + */ + LWLockAcquire(ProcArrayLock, LW_EXCLUSIVE); /* * Find the PGPROC entry of the source transaction. (This could use