Tom Lane [Thu, 12 Jul 2007 21:13:27 +0000 (21:13 +0000)]
Some of our port-specific dynloader implementations are careful to
define pg_dlsym() as returning a PGFunction pointer, not just any
pointer-to-function. But many are not. Suppress compiler warnings
on platforms that aren't careful by inserting explicit casts at the
two call sites that didn't have a cast already. Per Stefan.
Magnus Hagander [Thu, 12 Jul 2007 14:10:39 +0000 (14:10 +0000)]
Fix freenig of names in Kerberos when using MIT - need to use the
free function provided in the Kerberos library.
This fixes a very hard to track down heap corruption on windows
when using debug runtimes.
Tom Lane [Tue, 10 Jul 2007 00:21:31 +0000 (00:21 +0000)]
Adjust processSQLNamePattern() so that $ within the pattern is always matched
literally, whether quoted or not. Since we allow $ as a character within
identifiers, this behavior is useful, whereas the previous behavior of
treating it as the regexp ending anchor was nearly useless given that the
pattern is automatically anchored anyway. This affects the arguments of
psql's \d commands as well as pg_dump's -n and -t switches. Per discussion.
Tom Lane [Mon, 9 Jul 2007 01:15:14 +0000 (01:15 +0000)]
Fix single-user mode so that interrupts (particularly SIGTERM and
SIGQUIT) will be recognized and processed while waiting for input,
rather than only after something has been typed. Also make SIGQUIT
do the same thing as SIGTERM in single-user mode, ie, do a normal
shutdown and exit. Since it's relatively easy to provoke SIGQUIT
from the keyboard, people may try that instead of control-D, and we'd
rather this leads to orderly shutdown. Per report from Leon Mergen
and subsequent discussion.
Tom Lane [Sun, 8 Jul 2007 22:23:16 +0000 (22:23 +0000)]
Remove the pgstat_drop_relation() call from smgr_internal_unlink(), because
we don't know at that point which relation OID to tell pgstat to forget.
The code was passing the relfilenode, which is incorrect, and could possibly
cause some other relation's stats to be zeroed out. While we could try to
clean this up, it seems much simpler and more reliable to let the next
invocation of pgstat_vacuum_tabstat() fix things; which indeed is how it
worked before I introduced the buggy code into 8.1.3 and later :-(.
Problem noticed by Itagaki Takahiro, fix is per subsequent discussion.
Tom Lane [Sun, 8 Jul 2007 19:07:38 +0000 (19:07 +0000)]
Get rid of client-code dependencies on the exact text of the no-password
error message, by using PQconnectionUsedPassword() instead. Someday
we might be able to localize that error message, but not until this
coding technique has disappeared everywhere.
Tom Lane [Sun, 8 Jul 2007 18:28:56 +0000 (18:28 +0000)]
Closer code review for PQconnectionUsedPassword() patch: in particular,
not OK to include postgres_fe.h into libpq-fe.h, hence declare it as
returning int not bool.
Joe Conway [Sun, 8 Jul 2007 17:12:38 +0000 (17:12 +0000)]
Restrict non-superusers to password authenticated connections
to prevent possible escalation of privilege. Provide new SECURITY
DEFINER functions with old behavior, but initially REVOKE ALL
from public for these functions. Per list discussion and design
proposed by Tom Lane. A different approach will be used for
back-branches, committed separately.
Joe Conway [Sun, 8 Jul 2007 17:11:51 +0000 (17:11 +0000)]
Arrange for the authentication request type to be preserved in
PGconn. Invent a new libpq connection-status function,
PQconnectionUsedPassword() that returns true if the server
demanded a password during authentication, false otherwise.
This may be useful to clients in general, but is immediately
useful to help plug a privilege escalation path in dblink.
Per list discussion and design proposed by Tom Lane.
Tom Lane [Sat, 7 Jul 2007 20:46:45 +0000 (20:46 +0000)]
Fix a couple of planner bugs introduced by the new ability to discard
ORDER BY <constant> as redundant. One is that this means query_planner()
has to canonicalize pathkeys even when the query jointree is empty;
the canonicalization was always a no-op in such cases before, but no more.
Also, we have to guard against thinking that a set-returning function is
"constant" for this purpose. Add a couple of regression tests for these
evidently under-tested cases. Per report from Greg Stark and subsequent
experimentation.
Tom Lane [Fri, 6 Jul 2007 04:16:00 +0000 (04:16 +0000)]
Fix up hash functions for datetime datatypes so that they don't take
unwarranted liberties with int8 vs float8 values for these types.
Specifically, be sure to apply either hashint8 or hashfloat8 depending
on HAVE_INT64_TIMESTAMP. Per my gripe of even date.
Tom Lane [Tue, 3 Jul 2007 14:51:24 +0000 (14:51 +0000)]
Fix incorrect comment about the timing of AbsorbFsyncRequests() during
checkpoint. The comment claimed that we could do this anytime after
setting the checkpoint REDO point, but actually BufferSync is relying
on the assumption that buffers dumped by other backends will be fsync'd
too. So we really could not do it any sooner than we are doing it.
Neil Conway [Tue, 3 Jul 2007 01:30:37 +0000 (01:30 +0000)]
Add ALTER VIEW ... RENAME TO, and a RENAME TO clause to ALTER SEQUENCE.
Sequences and views could previously be renamed using ALTER TABLE, but
this was a repeated source of confusion for users. Update the docs,
and psql tab completion. Patch from David Fetter; various minor fixes
by myself.
Magnus Hagander [Mon, 2 Jul 2007 21:58:31 +0000 (21:58 +0000)]
- Fix the -w (wait) option to work in Windows service mode, per bug #3382.
- Prevent the -w option being passed to the postmaster.
- Read the postmaster options file when starting as a Windows service.
Tom Lane [Mon, 2 Jul 2007 20:11:55 +0000 (20:11 +0000)]
Fix failure to restart Postgres when Linux kernel returns EIDRM for shmctl().
This is a Linux kernel bug that apparently exists in every extant kernel
version: sometimes shmctl() will fail with EIDRM when EINVAL is correct.
We were assuming that EIDRM indicates a possible conflict with pre-existing
backends, and refusing to start the postmaster when this happens. Fortunately,
there does not seem to be any case where Linux can legitimately return EIDRM
(it doesn't track shmem segments in a way that would allow that), so we can
get away with just assuming that EIDRM means EINVAL on this platform.
Per reports from Michael Fuhr and Jon Lapham --- it's a bit surprising
we have not seen more reports, actually.
Tom Lane [Sun, 1 Jul 2007 18:30:54 +0000 (18:30 +0000)]
Reduce the maximum sleep interval in the autovac launcher to 1 second,
so that it responds to SIGQUIT reasonably promptly even on machines where
SA_RESTART signals restart a sleep from scratch. (This whole area could
stand some rethinking, but for now make it work like the other processes
do.) Also some marginal stylistic cleanups.
Tom Lane [Sun, 1 Jul 2007 18:28:41 +0000 (18:28 +0000)]
Treat the autovac launcher more like a regular backend, in that we wait
for it to die before telling the bgwriter to initiate shutdown checkpoint.
Since it's connected to shared memory, this seems more prudent than the
alternative of letting it quit asynchronously. Resolves my complaint
of yesterday about repeated shutdown checkpoints in CVS HEAD.
Tom Lane [Sun, 1 Jul 2007 17:45:42 +0000 (17:45 +0000)]
Avoid memory leakage when a series of subtransactions invoke AFTER triggers
that are fired at end-of-statement (as is the normal case for foreign keys,
for example). In this situation the per-subxact deferred trigger context
is always empty when subtransaction exit is reached; so we could free it,
but were not doing so, leading to an intratransaction leak of 8K or more
per subtransaction. Per off-list example from Viatcheslav Kalinin
subsequent to bug #3418 (his original bug report omitted a foreign key
constraint needed to cause this leak).
Back-patch to 8.2; prior versions were not using per-subxact contexts
for deferred triggers, so did not have this leak.
Alvaro Herrera [Fri, 29 Jun 2007 17:07:39 +0000 (17:07 +0000)]
Arrange for SIGINT in autovacuum workers to cancel the current table and
continue with the schedule. Change current uses of SIGINT to abort a worker
into SIGTERM, which keeps the old behaviour of terminating the process.
Patch from ITAGAKI Takahiro, with some editorializing of my own.
Tom Lane [Fri, 29 Jun 2007 16:18:43 +0000 (16:18 +0000)]
Fix computation of PG_VERSION_NUM by configure: remove unnecessary and
unportable backslashes in awk script (per Patrick Welche), and add
brackets to prevent autoconf from mangling sed's regexp (the sed call
here never did what was expected).
Tom Lane [Fri, 29 Jun 2007 15:46:21 +0000 (15:46 +0000)]
Add a note that pg_start_backup will take awhile because of new
distributed checkpoint behavior. Explain how to work around this
by issuing a manual CHECKPOINT command. Per discussion with Heikki.
Tom Lane [Fri, 29 Jun 2007 01:51:35 +0000 (01:51 +0000)]
Fix a passel of ancient bugs in to_char(), including two distinct buffer
overruns (neither of which seem likely to be exploitable as security holes,
fortunately, since the provoker can't control the data written). One of
these is due to choosing to stomp on the output of a called function, which
is bad news in any case; make it treat the called functions' results as
read-only. Avoid some unnecessary palloc/pfree traffic too; it's not
really helpful to free small temporary objects, and again this is presuming
more than it ought to about the nature of the results of called functions.
Per report from Patrick Welche and additional code-reading by Imad.
Tom Lane [Thu, 28 Jun 2007 17:49:59 +0000 (17:49 +0000)]
Fix incorrect tests for undef Perl values in some places in plperl.c.
The correct test for defined-ness is SvOK(sv), not anything involving
SvTYPE. Per bug #3415 from Matt Taylor.
Back-patch as far as 8.0; no apparent problem in 7.x.
Tom Lane [Thu, 28 Jun 2007 00:02:40 +0000 (00:02 +0000)]
Implement "distributed" checkpoints in which the checkpoint I/O is spread
over a fairly long period of time, rather than being spat out in a burst.
This happens only for background checkpoints carried out by the bgwriter;
other cases, such as a shutdown checkpoint, are still done at full speed.
Remove the "all buffers" scan in the bgwriter, and associated stats
infrastructure, since this seems no longer very useful when the checkpoint
itself is properly throttled.
Original patch by Itagaki Takahiro, reworked by Heikki Linnakangas,
and some minor API editorialization by me.
Tom Lane [Tue, 26 Jun 2007 22:05:04 +0000 (22:05 +0000)]
Fix PGXS conventions so that extensions can be built against Postgres
installations whose pg_config program does not appear first in the PATH.
Per gripe from Eddie Stanley and subsequent discussions with Fabien Coelho
and others.
Alvaro Herrera [Mon, 25 Jun 2007 16:09:03 +0000 (16:09 +0000)]
Improve autovacuum launcher's ability to detect a problem in worker startup,
by having the postmaster signal it when certain failures occur. This requires
the postmaster setting a flag in shared memory, but should be as safe as the
pmsignal.c code is.
Also make sure the launcher honor's a postgresql.conf change turning it off
on SIGHUP.
Tom Lane [Sat, 23 Jun 2007 22:12:52 +0000 (22:12 +0000)]
Separate parse-analysis for utility commands out of parser/analyze.c
(which now deals only in optimizable statements), and put that code
into a new file parser/parse_utilcmd.c. This helps clarify and enforce
the design rule that utility statements shouldn't be processed during
the regular parse analysis phase; all interpretation of their meaning
should happen after they are given to ProcessUtility to execute.
(We need this because we don't retain any locks for a utility statement
that's in a plan cache, nor have any way to detect that it's stale.)
We are also able to simplify the API for parse_analyze() and related
routines, because they will now always return exactly one Query structure.
In passing, fix bug #3403 concerning trying to add a serial column to
an existing temp table (this is largely Heikki's work, but we needed
all that restructuring to make it safe).
Tom Lane [Fri, 22 Jun 2007 16:15:23 +0000 (16:15 +0000)]
Add a <tip> that log_line_prefix should usually end with a space to
provide visual separation from the rest of the log line; I've been
noticing lately that quite a few newbies fail to figure this out for
themselves. Also a little editorial cleanup of the log_line_prefix
description.
Neil Conway [Fri, 22 Jun 2007 01:09:28 +0000 (01:09 +0000)]
In psql, when running a SELECT query using a cursor, flush the query
output after each FETCH. This ensures that incremental results are
available to clients that are executing long-running SELECT queries
via the FETCH_COUNT feature.
Tom Lane [Thu, 21 Jun 2007 22:59:12 +0000 (22:59 +0000)]
Allow trailing whitespace in parse_real(), for consistency with
parse_int() and with itself (strtod allows leading whitespace, so it
seems odd not to allow trailing whitespace). parse_bool remains
not-whitespace-friendly, but this is generically true for non-numeric
GUC variables, so I'll desist from changing it.
Tom Lane [Thu, 21 Jun 2007 18:14:21 +0000 (18:14 +0000)]
Provide a HINT listing the allowed unit names when a GUC variable seems to
contain a wrong unit specification, per discussion.
In passing, fix the code to avoid unnecessary integer overflows when
converting units, and to detect overflows when they do occur.
Tom Lane [Wed, 20 Jun 2007 23:11:38 +0000 (23:11 +0000)]
Add a caveat pointing out that constraint exclusion doesn't work with
constraints the planner is unable to disprove, hence simple btree-compatible
conditions should be used. We've seen people try to get cute with stuff
like date_part(something) = something at least twice now. Even if we
wanted to try to teach predtest.c about the properties of date_part,
most of the useful variants aren't immutable so nothing could be proved.
Tom Lane [Wed, 20 Jun 2007 18:31:39 +0000 (18:31 +0000)]
Restrict deadlock_timeout to the range for which the implementation
actually works sanely, viz not 0 and not more than INT_MAX/1000
(else TimestampTzPlusMilliseconds can overflow). Per discussion with
Greg Stark. Since this is a superuser-only setting and there was not
previously any big reason to change it, not worth back-patching.
Tom Lane [Wed, 20 Jun 2007 18:21:00 +0000 (18:21 +0000)]
transformColumnDefinition failed to complain about
create table foo (bar int default null default 3);
due to not thinking about the special-case handling of DEFAULT NULL.
Problem noticed while investigating bug #3396.
Tom Lane [Wed, 20 Jun 2007 18:15:49 +0000 (18:15 +0000)]
CREATE DOMAIN ... DEFAULT NULL failed because gram.y special-cases DEFAULT
NULL and DefineDomain didn't. Bug goes all the way back to original coding
of domains. Per bug #3396 from Sergey Burladyan.
Neil Conway [Wed, 20 Jun 2007 02:02:49 +0000 (02:02 +0000)]
Minor code cleanup: calling FreeFile() before ereport(ERROR) is not
necessary, since files opened via AllocateFile() are closed automatically
as part of error recovery.
Tom Lane [Tue, 19 Jun 2007 22:01:15 +0000 (22:01 +0000)]
Only log 'process acquired lock' if we actually did get the lock. This
test seems inessential right now since the only control path for not
getting the lock is via CHECK_FOR_INTERRUPTS which won't return control
to ProcSleep, but it would be important if we ever allow the deadlock
code to kill someone else's transaction instead of our own.
Tom Lane [Tue, 19 Jun 2007 20:13:22 +0000 (20:13 +0000)]
Code review for log_lock_waits patch. Don't try to issue log messages from
within a signal handler (this might be safe given the relatively narrow code
range in which the interrupt is enabled, but it seems awfully risky); do issue
more informative log messages that tell what is being waited for and the exact
length of the wait; minor other code cleanup. Greg Stark and Tom Lane
Tom Lane [Mon, 18 Jun 2007 21:40:58 +0000 (21:40 +0000)]
Arrange for quote_identifier() and pg_dump to not quote keywords that are
unreserved according to the grammar. The list of unreserved words has gotten
extensive enough that the unnecessary quoting is becoming a bit of an eyesore.
To do this, add knowledge of the keyword category to keywords.c's table.
(Someday we might be able to generate keywords.c's table and the keyword lists
in gram.y from a common source.) For the moment, lie about WITH's status in
the table so it will still get quoted --- this is because of the expectation
that WITH will become reserved when the SQL recursive-queries patch gets done.
I didn't force initdb because this affects nothing on-disk; but note that a
few regression tests have changed expected output.
Tom Lane [Sun, 17 Jun 2007 23:39:28 +0000 (23:39 +0000)]
Marginal hacking to improve the speed of COPY OUT. I had found in a bit of
profiling that CopyAttributeOutText was taking an unreasonable fraction of
the backend run time (like 66%!) on the following trivial test case:
$ time psql -c "copy (select repeat('xyzzy',50) from generate_series(1,10000000)) to stdout" regression >/dev/null
The time is all being spent on scanning the string for characters to be
escaped, which most of the time there aren't any of. Some tweaking to take
as many tests as possible out of the inner loop reduced the runtime of this
example by more than 10%. In a real-world case it wouldn't be as useful
a speedup, but it still seems worth adding a few lines here.
Tom Lane [Sun, 17 Jun 2007 18:57:29 +0000 (18:57 +0000)]
Revert an ill-considered portion of my patch of 12-Mar, which tried to save a
few lines in sql_exec_error_callback() by using the function source string
field that the patch added to SQL function cache entries. This doesn't work
because the fn_extra field isn't filled in yet during init_sql_fcache().
Probably it could be made to work, but it doesn't seem appropriate to contort
the main code paths to make an error-reporting path a tad faster. Per report
from Pavel Stehule.
Tom Lane [Fri, 15 Jun 2007 20:56:52 +0000 (20:56 +0000)]
Tweak the API for per-datatype typmodin functions so that they are passed
an array of strings rather than an array of integers, and allow any simple
constant or identifier to be used in typmods; for example
create table foo (f1 widget(42,'23skidoo',point));
Of course the typmodin function has still got to pack this info into a
non-negative int32 for storage, but it's still a useful improvement in
flexibility, especially considering that you can do nearly anything if you
are willing to keep the info in a side table. We can get away with this
change since we have not yet released a version providing user-definable
typmods. Per discussion.
Andrew Dunstan [Thu, 14 Jun 2007 01:48:51 +0000 (01:48 +0000)]
Implement a chunking protocol for writes to the syslogger pipe, with messages
reassembled in the syslogger before writing to the log file. This prevents
partial messages from being written, which mucks up log rotation, and
messages from different backends being interleaved, which causes garbled
logs. Backport as far as 8.0, where the syslogger was introduced.
Neil Conway [Wed, 13 Jun 2007 23:59:47 +0000 (23:59 +0000)]
Schema-qualify several references to the builtin function length(), to
avoid mistakenly calling a function of the same name that might happen
to appear earlier in the schema search path.
Tom Lane [Tue, 12 Jun 2007 19:46:24 +0000 (19:46 +0000)]
Add some simple defenses against null fields in pg_largeobject, and add
comments noting that there's an alignment assumption now that the data
field could be in 1-byte-header format. Per discussion with Greg Stark.
Tom Lane [Tue, 12 Jun 2007 15:58:32 +0000 (15:58 +0000)]
Fix DecodeDateTime to allow timezone to appear before year. This had
historically worked in some but not all cases, but as of 8.2 it failed for all
timezone formats. Fix, and add regression test cases to catch future
regressions in this area. Per gripe from Adam Witney.