Must not reach consistency before XLOG_BACKUP_RECORD

When waiting for an XLOG_BACKUP_RECORD the minRecoveryPoint
will be incorrect, so we must not declare recovery as consistent
before we have seen the record. Major bug allowing recovery to end
too early in some cases, allowing people to see inconsistent db.
This patch to HEAD and 9.2, other fix required for 9.1 and 9.0

Simon Riggs and Andres Freund, bug report by Jeff Janes

diff --git a/src/backend/access/transam/xlog.c b/src/backend/access/transam/xlog.c
index 50e2b22dd70e35de9f84e88fbdd4566c9b2f033b..187b60999e00a1254e6c766ce170c3a39c917db1 100644 (file)
--- a/src/backend/access/transam/xlog.c
+++ b/src/backend/access/transam/xlog.c
@@ -7155,9 +7155,12 @@ CheckRecoveryConsistency(void)
                return;
 
        /*
-        * Have we passed our safe starting point?
+        * Have we passed our safe starting point? Note that minRecoveryPoint
+        * is known to be incorrectly set if ControlFile->backupEndRequired,
+        * until the XLOG_BACKUP_RECORD arrives to advise us of the correct
+        * minRecoveryPoint. All we prior to that is its not consistent yet.
         */
-       if (!reachedConsistency &&
+       if (!reachedConsistency && !ControlFile->backupEndRequired &&
                XLByteLE(minRecoveryPoint, EndRecPtr) &&
                XLogRecPtrIsInvalid(ControlFile->backupStartPoint))
        {