database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-10-27 00:12:01 +03:00
Code Activity

Assert lack of hazardous buffer locks before possible catalog read.

Browse Source 
Commit 0bada39c83 fixed a bug of this kind,
which existed in all branches for six days before detection.  While the
probability of reaching the trouble was low, the disruption was extreme.  No
new backends could start, and service restoration needed an immediate
shutdown.  Hence, add this to catch the next bug like it.

The new check in RelationIdGetRelation() suffices to make autovacuum detect
the bug in commit 243e9b40f1 that led to commit
0bada39.  This also checks in a number of similar places.  It replaces each
Assert(IsTransactionState()) that pertained to a conditional catalog read.

No back-patch for now, but a back-patch of commit 243e9b4 should back-patch
this, too.  A back-patch could omit the src/test/regress changes, since back
branches won't gain new index columns.

Reported-by: Alexander Lakhin <exclusion@gmail.com>
Discussion: https://postgr.es/m/20250410191830.0e.nmisch@google.com
Discussion: https://postgr.es/m/10ec0bc3-5933-1189-6bb8-5dec4114558e@gmail.com
This commit is contained in:
Noah Misch
2025-04-17 05:00:30 -07:00
parent b669293e34
commit f4ece891fc
15 changed files with 248 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

70
src/backend/storage/buffer/bufmgr.c
View File

@@ -40,6 +40,9 @@
#include "access/tableam.h"
#include "access/xloginsert.h"
#include "access/xlogutils.h"
#ifdef USE_ASSERT_CHECKING
#include "catalog/pg_tablespace_d.h"
#endif
#include "catalog/storage.h"
#include "catalog/storage_xlog.h"
#include "executor/instrument.h"
@@ -541,6 +544,10 @@ static void RelationCopyStorageUsingBuffer(RelFileLocator srclocator,
ForkNumber forkNum, bool permanent);
static void AtProcExit_Buffers(int code, Datum arg);
static void CheckForBufferLeaks(void);
#ifdef USE_ASSERT_CHECKING
static void AssertNotCatalogBufferLock(LWLock *lock, LWLockMode mode,
void *unused_context);
#endif
static int rlocator_comparator(const void *p1, const void *p2);
static inline int buffertag_comparator(const BufferTag *ba, const BufferTag *bb);
static inline int ckpt_buforder_comparator(const CkptSortItem *a, const CkptSortItem *b);
@@ -4097,6 +4104,69 @@ CheckForBufferLeaks(void)
#endif
}
#ifdef USE_ASSERT_CHECKING
/*
* Check for exclusive-locked catalog buffers. This is the core of
* AssertCouldGetRelation().
*
* A backend would self-deadlock on LWLocks if the catalog scan read the
* exclusive-locked buffer. The main threat is exclusive-locked buffers of
* catalogs used in relcache, because a catcache search on any catalog may
* build that catalog's relcache entry. We don't have an inventory of
* catalogs relcache uses, so just check buffers of most catalogs.
*
* It's better to minimize waits while holding an exclusive buffer lock, so it
* would be nice to broaden this check not to be catalog-specific. However,
* bttextcmp() accesses pg_collation, and non-core opclasses might similarly
* read tables. That is deadlock-free as long as there's no loop in the
* dependency graph: modifying table A may cause an opclass to read table B,
* but it must not cause a read of table A.
*/
void
AssertBufferLocksPermitCatalogRead(void)
{
ForEachLWLockHeldByMe(AssertNotCatalogBufferLock, NULL);
}
static void
AssertNotCatalogBufferLock(LWLock *lock, LWLockMode mode,
void *unused_context)
{
BufferDesc *bufHdr;
BufferTag tag;
Oid relid;
if (mode != LW_EXCLUSIVE)
return;
if (!((BufferDescPadded *) lock > BufferDescriptors &&
(BufferDescPadded *) lock < BufferDescriptors + NBuffers))
return; /* not a buffer lock */
bufHdr = (BufferDesc *)
((char *) lock - offsetof(BufferDesc, content_lock));
tag = bufHdr->tag;
/*
* This relNumber==relid assumption holds until a catalog experiences
* VACUUM FULL or similar. After a command like that, relNumber will be
* in the normal (non-catalog) range, and we lose the ability to detect
* hazardous access to that catalog. Calling RelidByRelfilenumber() would
* close that gap, but RelidByRelfilenumber() might then deadlock with a
* held lock.
*/
relid = tag.relNumber;
if (IsCatalogTextUniqueIndexOid(relid)) /* see comments at the callee */
return;
Assert(!IsCatalogRelationOid(relid));
/* Shared rels are always catalogs: detect even after VACUUM FULL. */
Assert(tag.spcOid != GLOBALTABLESPACE_OID);
}
#endif
/*
* Helper routine to issue warnings when a buffer is unexpectedly pinned
*/

15
src/backend/storage/lmgr/lwlock.c
View File

@@ -1961,6 +1961,21 @@ LWLockReleaseAll(void)
}
/*
* ForEachLWLockHeldByMe - run a callback for each held lock
*
* This is meant as debug support only.
*/
void
ForEachLWLockHeldByMe(void (*callback) (LWLock *, LWLockMode, void *),
void *context)
{
int i;
for (i = 0; i < num_held_lwlocks; i++)
callback(held_lwlocks[i].lock, held_lwlocks[i].mode, context);
}
/*
* LWLockHeldByMe - test whether my process holds a lock in any mode
*