SIGSEGV in dynahash

From: Konstantin Knizhnik <knizhnik(at)garret(dot)ru>
To: PostgreSQL mailing lists <pgsql-bugs(at)lists(dot)postgresql(dot)org>
Subject: SIGSEGV in dynahash
Date: 2026-08-15 13:06:53
Message-ID: d59221f2-b3d2-41ad-8bf0-d581b42e4cba@garret.ru
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

On PG19,|ShmemInitHash|always builds afixed-sizeshared hash with abump
allocator(|ShmemHashAlloc|) whose|alloc_arg|is astack-localregion used
only during|hash_create|. After init, that pointer is dead.

In|hash_search|, for every|HASH_ENTER|/|HASH_ENTER_NULL|, dynahash does
thisbeforelookup:

dynahash.cLines927-937
if(action ==HASH_ENTER ||action ==HASH_ENTER_NULL)
{
if(hctl->freeList[0].nentries>(int64)hctl->max_bucket&&
!IS_PARTITIONED(hctl)&&!hashp->frozen&&
!has_seq_scans(hashp))
(void)expand_table(hashp);
}

It may cause SIGSEGV in case of using HASH_ENTER_NULL:

hash_search(HASH_ENTER_NULL)
→ expand_table → seg_alloc → SIGSEGV in libc (MemSet/alloc)

Pre-PG19, shared hashes used|ShmemAllocNoError|from the global pool, so
a failed grow tended to return|NULL|/ error instead of faulting on a
dead bump allocator.

It was introduced by commit 9fe9ecd516b — Allocate all parts of shmem
hash table from a single contiguous area

Patch preventing extension of fixed dynahash is attached.

Attachment Content-Type Size
0001-prevent-fixed-dynahash-extension-20260815.patch text/plain 781 bytes

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Tom Lane 2026-08-15 16:12:29 Re: SIGSEGV in dynahash
Previous Message Alvaro Herrera 2026-08-15 09:12:00 Re: Should CUSTER (ANALYZE) work?