From d411d6eff1b7e91de0fecece08acc6b6eca04d6d Mon Sep 17 00:00:00 2001 From: Heikki Linnakangas Date: Fri, 7 Mar 2014 13:25:11 +0200 Subject: [PATCH] Fix dangling smgr_owner pointer when a fake relcache entry is freed. A fake relcache entry can "own" a SmgrRelation object, like a regular relcache entry. But when it was free'd, the owner field in SmgrRelation was not cleared, so it was left pointing to free'd memory. Amazingly this apparently hasn't caused crashes in practice, or we would've heard about it earlier. Andres found this with Valgrind. Report and fix by Andres Freund, with minor modifications by me. Backpatch to all supported versions. --- src/backend/access/transam/xlogutils.c | 3 +++ src/backend/storage/smgr/smgr.c | 18 ++++++++++++++++++ src/include/storage/smgr.h | 1 + 3 files changed, 22 insertions(+) diff --git a/src/backend/access/transam/xlogutils.c b/src/backend/access/transam/xlogutils.c index 1811c91d58..8f0bbc21db 100644 --- a/src/backend/access/transam/xlogutils.c +++ b/src/backend/access/transam/xlogutils.c @@ -413,6 +413,9 @@ CreateFakeRelcacheEntry(RelFileNode rnode) void FreeFakeRelcacheEntry(Relation fakerel) { + /* make sure the fakerel is not referenced by the SmgrRelation anymore */ + if (fakerel->rd_smgr != NULL) + smgrclearowner(&fakerel->rd_smgr, fakerel->rd_smgr); pfree(fakerel); } diff --git a/src/backend/storage/smgr/smgr.c b/src/backend/storage/smgr/smgr.c index 7d1cd5af16..9379e33793 100644 --- a/src/backend/storage/smgr/smgr.c +++ b/src/backend/storage/smgr/smgr.c @@ -193,6 +193,24 @@ smgrsetowner(SMgrRelation *owner, SMgrRelation reln) *owner = reln; } +/* + * smgrclearowner() -- Remove long-lived reference to an SMgrRelation object + * if one exists + */ +void +smgrclearowner(SMgrRelation *owner, SMgrRelation reln) +{ + /* Do nothing if the SMgrRelation object is not owned by the owner */ + if (reln->smgr_owner != owner) + return; + + /* unset the owner's reference */ + *owner = NULL; + + /* unset our reference to the owner */ + reln->smgr_owner = NULL; +} + /* * smgrexists() -- Does the underlying file for a fork exist? */ diff --git a/src/include/storage/smgr.h b/src/include/storage/smgr.h index 1761f1c808..957f2108d5 100644 --- a/src/include/storage/smgr.h +++ b/src/include/storage/smgr.h @@ -62,6 +62,7 @@ extern void smgrinit(void); extern SMgrRelation smgropen(RelFileNode rnode); extern bool smgrexists(SMgrRelation reln, ForkNumber forknum); extern void smgrsetowner(SMgrRelation *owner, SMgrRelation reln); +extern void smgrclearowner(SMgrRelation *owner, SMgrRelation reln); extern void smgrclose(SMgrRelation reln); extern void smgrcloseall(void); extern void smgrclosenode(RelFileNode rnode); -- 2.50.0