Fix freeing of dangling IndexScanDesc.xs_hitup in GiST
Hackorum builds and tests every patch posted to the lists, not only commitfest submissions. This is Hackorum's own CI rather than the PostgreSQL project's, and it is still under testing - please report anything that looks wrong.
Hello, hackers!
The last query in the following script crashes Postgres:
create table t (id serial, amount int);
insert into t (amount) select random() * 1000 from generate_series(1, 100);
create extension btree_gist;
create index t_gist_idx on t using gist(id, amount);
select p.id, p.amount, s.nearest
from t as p left join lateral
(
select p.id, array_agg(l.id) as nearest from (
select id from t order by amount <-> p.amount limit 10
) l
) s using(id);
In gistrescan() IndexScanDesc.xs_hitup is not reset after MemoryContextReset() of
so->queueCxt in which xs_hitup was allocated, then getNextNearest() tries to pfree()
dangling xs_hitup, which results in the reuse of this pointer and the subsequent crash.
Attached patches fix this bug introduced in commit
d04c8ed9044eccebce043143a930617e3998c005 "Add support for index-only scans in GiST".
The bug is present in v9.5, v9.6, v10.0.
--
Nikita Glukhov
Postgres Professional:http://www.postgrespro.com
The Russian Postgres Company
Attachments:
fix-freeing-of-dangling-IndexScanDesc.xs_hitup-in-GiST-9.6-v01.patchtext/x-diff; name=fix-freeing-of-dangling-IndexScanDesc.xs_hitup-in-GiST-9.6-v01.patchDownload+5-0
fix-freeing-of-dangling-IndexScanDesc.xs_hitup-in-GiST-10.0-v01.patchtext/x-diff; name=fix-freeing-of-dangling-IndexScanDesc.xs_hitup-in-GiST-10.0-v01.patchDownload+5-0
Nikita Glukhov <n.gluhov@postgrespro.ru> writes:
In gistrescan() IndexScanDesc.xs_hitup is not reset after MemoryContextReset() of
so->queueCxt in which xs_hitup was allocated, then getNextNearest() tries to pfree()
dangling xs_hitup, which results in the reuse of this pointer and the subsequent crash.
Right. I already did something about this, about an hour ago --- a
bit differently from your patch, but same idea.
regards, tom lane
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
On 04.05.2017 22:16, Tom Lane wrote:
Nikita Glukhov <n.gluhov@postgrespro.ru> writes:
In gistrescan() IndexScanDesc.xs_hitup is not reset after MemoryContextReset() of
so->queueCxt in which xs_hitup was allocated, then getNextNearest() tries to pfree()
dangling xs_hitup, which results in the reuse of this pointer and the subsequent crash.Right. I already did something about this, about an hour ago --- a
bit differently from your patch, but same idea.regards, tom lane
Sorry that I'm not monitoring pgsql-bugs.
It might be interesting that I found this bug back in July 2016 when I
was experimenting with my KNN-btree implementation, but I failed to report
it because I could reproduce it only manually by a calling in a loop
gistrescan() and gistgettuple().
--
Nikita Glukhov
Postgres Professional:http://www.postgrespro.com
The Russian Postgres Company
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers