Re: Use-after-free in reorderbuffer.c for INSERT ON CONFLICT

From: Michael Paquier <michael(at)paquier(dot)xyz>
To: Amit Kapila <amit(dot)kapila16(at)gmail(dot)com>
Cc: Postgres bugs <pgsql-bugs(at)lists(dot)postgresql(dot)org>, Masahiko Sawada <sawada(dot)mshk(at)gmail(dot)com>, Ethan Mertz <ethan(dot)mertz(at)gmail(dot)com>
Subject: Re: Use-after-free in reorderbuffer.c for INSERT ON CONFLICT
Date: 2025-08-01 11:45:10
Message-ID: aIyoxicMnn2ebKLa@paquier.xyz
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

On Fri, Aug 01, 2025 at 03:30:17PM +0530, Amit Kapila wrote:
> I mean to say we can use the same change LSN both for
> REORDER_BUFFER_CHANGE_INTERNAL_SPEC_CONFIRM and
> REORDER_BUFFER_CHANGE_INTERNAL_SPEC_ABORT. Right now, for
> REORDER_BUFFER_CHANGE_INTERNAL_SPEC_CONFIRM, we switch the change to
> specinsert which would have a prior LSN value (say, if confirm/abort
> record will have value, 1000, it will be 800 or so) but we should
> still use 1000 for update_progress_txn. The update_progress_txn() is
> helpful when such an insert is skipped by a plugin (in this case
> pgouput) and in that case, we would require the latest LSN processed
> by reorder buffer to pass to it. We use it to send a keep_alive to a
> client with the last LSN processed.

Ah, OK, I've missed your point then. It's kind of an optimization in
itself because we would be a bit more aggressive with the updates, but
I agree to do that in the scope of this fix. The updated attached
uses prev_lsn for the job, for both the ABORT and CONFIRM cases,
meaning a one-liner.
--
Michael

Attachment Content-Type Size
v2-0001-Fix-use-after-free-in-reorderbuffer.c-with-ON-CON.patch text/x-diff 894 bytes

In response to

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Masahiko Sawada 2025-08-01 16:32:07 Re: Use-after-free in reorderbuffer.c for INSERT ON CONFLICT
Previous Message Amit Kapila 2025-08-01 10:00:17 Re: Use-after-free in reorderbuffer.c for INSERT ON CONFLICT