| From: | Konstantin Knizhnik <knizhnik(at)garret(dot)ru> |
|---|---|
| To: | PostgreSQL mailing lists <pgsql-bugs(at)lists(dot)postgresql(dot)org> |
| Subject: | SIGSEGV in dynahash |
| Date: | 2026-08-15 13:06:53 |
| Message-ID: | d59221f2-b3d2-41ad-8bf0-d581b42e4cba@garret.ru |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
On PG19,|ShmemInitHash|always builds afixed-sizeshared hash with abump
allocator(|ShmemHashAlloc|) whose|alloc_arg|is astack-localregion used
only during|hash_create|. After init, that pointer is dead.
In|hash_search|, for every|HASH_ENTER|/|HASH_ENTER_NULL|, dynahash does
thisbeforelookup:
dynahash.cLines927-937
if(action ==HASH_ENTER ||action ==HASH_ENTER_NULL)
{
if(hctl->freeList[0].nentries>(int64)hctl->max_bucket&&
!IS_PARTITIONED(hctl)&&!hashp->frozen&&
!has_seq_scans(hashp))
(void)expand_table(hashp);
}
It may cause SIGSEGV in case of using HASH_ENTER_NULL:
hash_search(HASH_ENTER_NULL)
→ expand_table → seg_alloc → SIGSEGV in libc (MemSet/alloc)
Pre-PG19, shared hashes used|ShmemAllocNoError|from the global pool, so
a failed grow tended to return|NULL|/ error instead of faulting on a
dead bump allocator.
It was introduced by commit 9fe9ecd516b — Allocate all parts of shmem
hash table from a single contiguous area
Patch preventing extension of fixed dynahash is attached.
| Attachment | Content-Type | Size |
|---|---|---|
| 0001-prevent-fixed-dynahash-extension-20260815.patch | text/plain | 781 bytes |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tom Lane | 2026-08-15 16:12:29 | Re: SIGSEGV in dynahash |
| Previous Message | Alvaro Herrera | 2026-08-15 09:12:00 | Re: Should CUSTER (ANALYZE) work? |