Fix size estimation for parallel B-Tree scans with skip arrays

From: Siddharth Kothari <sidkot(at)google(dot)com>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Cc: Vaibhav Jain <jainva(at)google(dot)com>, Madhukar <madhukarprasad(at)google(dot)com>, Xun Cheng <xuncheng(at)google(dot)com>, pg(at)bowt(dot)ie
Subject: Fix size estimation for parallel B-Tree scans with skip arrays
Date: 2026-04-29 06:54:21
Message-ID: CAGCUe0Lwk3C0qdkBa+OLpYc7yXwW=pbaz8Sju4xMXEQAmyp+5g@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

Hi folks.

This commit
<https://github.com/postgres/postgres/commit/92fe23d93aa3bbbc40fca669cabc4a4d7975e327#diff-db0039b5ba12b5915e91ed6eedd78744e3cf7a77082af072d9626a5ae306c579>
introduced parallel scan skip support, however it underestimates the
required memory, causing it to write past the allocated shared memory
boundary. This can corrupt any entity using the adjacent shared memory
segment, leading to unpredictable behavior.

I reproduced the issue manually on stock postgres and raised a patch that
fixes it along with regress tests. In my repro, the issue manifested as
postgres server crashing unexpectedly.

Root cause:

In src/backend/access/nbtree/nbtree.c, the loop in
btestimateparallelscan assumes
that every index column might require a skip array and adds sizeof(int) to
the estimated size:

However, every skip array actually needs space for its slot in the
btps_arrElems array AND space to store its scan key's sk_flags. Therefore,
it requires sizeof(int) * 2.

The attached patch fixes this by allocating sizeof(int) * 2 per attribute
in btestimateparallelscan.

Please let me know your thoughts.

Thanks,

Siddharth Kothari

Attachment Content-Type Size
0001-Fix-size-estimation-for-parallel-B-Tree-scans-with-s.patch application/x-patch 12.5 KB

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message PG Bug reporting form 2026-04-29 11:27:19 BUG #19470: PostgreSQL backend aborts (assert failure) when a prepared statement returns a composite type cast t
Previous Message Nikita Malakhov 2026-04-28 20:19:15 Re: BUG #19458: OOM killer in jsonb_path_exists_opr (@?) with malformed JSONPath containing non-existent variables