pgsql: Fix race condition with unprotected use of a latch pointer varia

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Fix race condition with unprotected use of a latch pointer varia
Date: 2017-10-03 18:01:06
Message-ID: E1dzRVC-00028G-CZ@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Fix race condition with unprotected use of a latch pointer variable.

Commit 597a87ccc introduced a latch pointer variable to replace use
of a long-lived shared latch in the shared WalRcvData structure.
This was not well thought out, because there are now hazards of the
pointer variable changing while it's being inspected by another
process. This could obviously lead to a core dump in code like

if (WalRcv->latch)
SetLatch(WalRcv->latch);

and there's a more remote risk of a torn read, if we have any
platforms where reading/writing a pointer is not atomic.

An actual problem would occur only if the walreceiver process
exits (gracefully) while the startup process is trying to
signal it, but that seems well within the realm of possibility.

To fix, treat the pointer variable (not the referenced latch)
as being protected by the WalRcv->mutex spinlock. There
remains a race condition that we could apply SetLatch to a
process latch that no longer belongs to the walreceiver, but
I believe that's harmless: at worst it'd cause an extra wakeup
of the next process to use that PGPROC structure.

Back-patch to v10 where the faulty code was added.

Discussion: https://postgr.es/m/22735.1507048202@sss.pgh.pa.us

Branch
------
REL_10_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/2451de7e9e72943dbc71a3749379cf16946920f0

Modified Files
--------------
src/backend/replication/walreceiver.c | 19 +++++++++++++------
src/backend/replication/walreceiverfuncs.c | 7 +++++--
src/include/replication/walreceiver.h | 5 +++--
3 files changed, 21 insertions(+), 10 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message pgsql 2017-10-03 22:23:26 pgsql: Tag refs/tags/REL_10_0 was created
Previous Message Peter Geoghegan 2017-10-03 17:01:58 Re: [COMMITTERS] pgsql: Fix freezing of a dead HOT-updated tuple