Re: [sqlsmith] crashes in RestoreSnapshot on hot standby

From: Thomas Munro <thomas(dot)munro(at)enterprisedb(dot)com>
To: Amit Kapila <amit(dot)kapila16(at)gmail(dot)com>
Cc: Michael Paquier <michael(dot)paquier(at)gmail(dot)com>, Andreas Seltenreich <seltenreich(at)gmx(dot)de>, PostgreSQL mailing lists <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: [sqlsmith] crashes in RestoreSnapshot on hot standby
Date: 2016-07-01 04:08:10
Message-ID: CAEepm=1EEesHpk8a=YFisNYyqHwELYD3vFKS=AHhKmCQi1v69A@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

On Fri, Jul 1, 2016 at 3:25 PM, Amit Kapila <amit(dot)kapila16(at)gmail(dot)com> wrote:
> On Fri, Jul 1, 2016 at 8:48 AM, Thomas Munro <thomas(dot)munro(at)enterprisedb(dot)com>
> wrote:
>> If serialized_snapshot->xcnt == 0, then snapshot->xip never gets
>> initialized to a non-NULL value. Then if serialized_snapshot->subxcnt
>> > 0, we set snapshot->subxip = snapshot->xip +
>> serialized_snapshot->xcnt (so that's NULL too). Then in line the line
>> you show we call memcpy(snapshot->subxip, ...). The fix might be
>> something like the attached.
>
> I was just typing the mail, when I see this mail. I also reached to the
> conclusion that this is the reason of crash. You can see how CopySnapshot
> calculates the subxipoff, may be writing code that way will be more
> consistent.

Or maybe just like this?

- snapshot->subxip = snapshot->xip + serialized_snapshot->xcnt;
+ snapshot->subxip = ((TransactionId *) (snapshot + 1)) +
+ serialized_snapshot->xcnt;

--
Thomas Munro
http://www.enterprisedb.com

Attachment Content-Type Size
fix-subxip-v2.patch application/octet-stream 620 bytes

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Noah Misch 2016-07-01 04:09:02 Re: Broken handling of lwlocknames.h
Previous Message Noah Misch 2016-07-01 04:06:08 Re: Bug in batch tuplesort memory CLUSTER case (9.6 only)