Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix SkipScan crash due to pruned unique path #3881

Conversation

erimatnor
Copy link
Contributor

When SkipScan paths are added it can result in a crash if the new
SkipScan dominates the PostgreSQL planned unique path. In that case,
the previous unique path is pruned and freed, leading to a potential
memory corruption since a pointer to the original unique path is used
when looping over all subpaths to try to apply SkipScan. Thus, if the
original unique path is pruned, and there are multiple subpaths, a
crash will occur in the next iteration over the subpaths.

The crash is fixed by making a shallow copy of the original unique
path while iterating the subpaths.

@erimatnor erimatnor requested a review from a team as a code owner December 2, 2021 10:50
@erimatnor erimatnor self-assigned this Dec 2, 2021
@erimatnor
Copy link
Contributor Author

I've tried to add a test case but it is very difficult to create on for the regression suite. Basically, these conditions must be fulfilled:

  • There must be multiple paths considered for scanning the base relation
  • The SkipScan path must dominate a previous unique path so that it is pruned
  • The pruned path cannot be an indexpath (they're never pfreed in add_path)

@codecov
Copy link

codecov bot commented Dec 2, 2021

Codecov Report

Merging #3881 (095991a) into master (8afac60) will increase coverage by 0.00%.
The diff coverage is 100.00%.

Impacted file tree graph

@@           Coverage Diff           @@
##           master    #3881   +/-   ##
=======================================
  Coverage   90.58%   90.58%           
=======================================
  Files         213      213           
  Lines       37966    37967    +1     
=======================================
+ Hits        34390    34391    +1     
  Misses       3576     3576           
Impacted Files Coverage Δ
tsl/src/nodes/skip_scan/planner.c 96.21% <100.00%> (+0.02%) ⬆️
tsl/src/bgw_policy/job.c 88.04% <0.00%> (-0.05%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 210886e...095991a. Read the comment docs.

When SkipScan paths are added it can result in a crash if the new
SkipScan dominates the PostgreSQL planned unique path. In that case,
the previous unique path is pruned and freed, leading to a potential
memory corruption since a pointer to the original unique path is used
when looping over all subpaths to try to apply SkipScan. Thus, if the
original unique path is pruned, and there are multiple subpaths, a
crash will occur in the next iteration over the subpaths.

The crash is fixed by making a shallow copy of the original unique
path while iterating the subpaths.
@erimatnor erimatnor force-pushed the fix-pruned-unique-path-crash-in-skip-scan branch from a6f647f to 095991a Compare December 2, 2021 11:51
@erimatnor erimatnor enabled auto-merge (rebase) December 2, 2021 12:22
@erimatnor erimatnor merged commit 320119d into timescale:master Dec 2, 2021
This was referenced Dec 2, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants