diff options
| author | Michael Paquier | 2026-09-17 10:25:27 +0000 |
|---|---|---|
| committer | Michael Paquier | 2026-09-17 10:25:27 +0000 |
| commit | 6e0011596c92d290dffe566fa851235df6b18d5b (patch) | |
| tree | f0c9f9d440092b311c3cf3b2c84e6645e3d1a359 | |
| parent | 84287ab890ffed4cfe334019c2cb6abdaaf7c97f (diff) | |
Tolerate partial pgstats entries in pgstat_gc_entry_refs()REL_17_STABLE
pgstat_get_entry_ref_cached() inserts a local entry_ref with
shmem-related fields set to NULL, expecting pgstat_get_entry_ref() (its
sole caller) to fill them up before returning. If an ERROR happens
while pgstat_get_entry_ref() runs, it could be possible to finish with a
local pgstats entry partially filled.
This could lead to a crash of pgstat_gc_entry_refs(), which tolerates a
NULL shared_stats in an assertion but unconditionally dereferenced its
"dropped" and "generation" fields.
This extends 4069df21beb8, being a cheap insurance against NULL pointer
dereference, if some code paths of pgstat_get_entry_ref() are not able
to perform any cleanup actions (for example after a dsm_create()
throwing an ERROR).
Reviewed-by: Grigorev Jurij <ju.grigorev@ftdata.ru>
Discussion: https://postgr.es/m/aqtiKTvl519bu8-V@paquier.xyz
Backpatch-through: 15
| -rw-r--r-- | src/backend/utils/activity/pgstat_shmem.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/src/backend/utils/activity/pgstat_shmem.c b/src/backend/utils/activity/pgstat_shmem.c index d1a6337347b..e325e0ab82e 100644 --- a/src/backend/utils/activity/pgstat_shmem.c +++ b/src/backend/utils/activity/pgstat_shmem.c @@ -743,6 +743,15 @@ pgstat_gc_entry_refs(void) Assert(!entry_ref->shared_stats || entry_ref->shared_stats->magic == 0xdeadbeef); + /* A NULL shared_entry marks a partial reference. */ + if (entry_ref->shared_entry == NULL) + { + Assert(entry_ref->shared_stats == NULL); + Assert(entry_ref->pending == NULL); + pgstat_release_entry_ref(ent->key, entry_ref, false); + continue; + } + /* * "generation" checks for the case of entries being reinitialized, * and "dropped" for the case where these are.. dropped. |