| From: | Siddharth Kothari <sidkot(at)google(dot)com> |
|---|---|
| To: | pgsql-bugs(at)lists(dot)postgresql(dot)org |
| Cc: | Vaibhav Jain <jainva(at)google(dot)com>, Madhukar <madhukarprasad(at)google(dot)com>, Xun Cheng <xuncheng(at)google(dot)com>, pg(at)bowt(dot)ie |
| Subject: | Fix size estimation for parallel B-Tree scans with skip arrays |
| Date: | 2026-04-29 06:54:21 |
| Message-ID: | CAGCUe0Lwk3C0qdkBa+OLpYc7yXwW=pbaz8Sju4xMXEQAmyp+5g@mail.gmail.com |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
Hi folks.
This commit
<https://github.com/postgres/postgres/commit/92fe23d93aa3bbbc40fca669cabc4a4d7975e327#diff-db0039b5ba12b5915e91ed6eedd78744e3cf7a77082af072d9626a5ae306c579>
introduced parallel scan skip support, however it underestimates the
required memory, causing it to write past the allocated shared memory
boundary. This can corrupt any entity using the adjacent shared memory
segment, leading to unpredictable behavior.
I reproduced the issue manually on stock postgres and raised a patch that
fixes it along with regress tests. In my repro, the issue manifested as
postgres server crashing unexpectedly.
Root cause:
In src/backend/access/nbtree/nbtree.c, the loop in
btestimateparallelscan assumes
that every index column might require a skip array and adds sizeof(int) to
the estimated size:
However, every skip array actually needs space for its slot in the
btps_arrElems array AND space to store its scan key's sk_flags. Therefore,
it requires sizeof(int) * 2.
The attached patch fixes this by allocating sizeof(int) * 2 per attribute
in btestimateparallelscan.
Please let me know your thoughts.
Thanks,
Siddharth Kothari
| Attachment | Content-Type | Size |
|---|---|---|
| 0001-Fix-size-estimation-for-parallel-B-Tree-scans-with-s.patch | application/x-patch | 12.5 KB |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | PG Bug reporting form | 2026-04-29 11:27:19 | BUG #19470: PostgreSQL backend aborts (assert failure) when a prepared statement returns a composite type cast t |
| Previous Message | Nikita Malakhov | 2026-04-28 20:19:15 | Re: BUG #19458: OOM killer in jsonb_path_exists_opr (@?) with malformed JSONPath containing non-existent variables |