Fix possible cache invalidation failure in ReceiveSharedInvalidMessages.

tglsfdc · tglsfdc · commit 3ada1fab8bf9 · 2014-05-05T14:43:55.000-04:00
Commit fad153e modified sinval.c to reduce the number of calls into sinvaladt.c (which require taking a shared lock) by keeping a local buffer of collected-but-not-yet-processed messages. However, if processing of the last message in a batch resulted in a recursive call to ReceiveSharedInvalidMessages, we could overwrite that message with a new one while the outer invalidation function was still working on it. This would be likely to lead to invalidation of the wrong cache entry, allowing subsequent processing to use stale cache data. The fix is just to make a local copy of each message while we're processing it. Spotted by Andres Freund. Back-patch to 8.4 where the bug was introduced.
diff --git a/src/backend/storage/ipc/sinval.c b/src/backend/storage/ipc/sinval.c
@@ -88,9 +88,9 @@ ReceiveSharedInvalidMessages(
 	/* Deal with any messages still pending from an outer recursion */
 	while (nextmsg < nummsgs)
 	{
-		SharedInvalidationMessage *msg = &messages[nextmsg++];
+		SharedInvalidationMessage msg = messages[nextmsg++];
 
-		invalFunction(msg);
+		invalFunction(&msg);
 	}
 
 	do
@@ -116,9 +116,9 @@ ReceiveSharedInvalidMessages(
 
 		while (nextmsg < nummsgs)
 		{
-			SharedInvalidationMessage *msg = &messages[nextmsg++];
+			SharedInvalidationMessage msg = messages[nextmsg++];
 
-			invalFunction(msg);
+			invalFunction(&msg);
 		}
 
 		/*

Original file line number	Diff line number	Diff line change
`@@ -88,9 +88,9 @@ ReceiveSharedInvalidMessages(`
`88`	`88`	`/* Deal with any messages still pending from an outer recursion */`
`89`	`89`	`while (nextmsg < nummsgs)`
`90`	`90`	`{`
`91`		`- SharedInvalidationMessage *msg = &messages[nextmsg++];`
	`91`	`+ SharedInvalidationMessage msg = messages[nextmsg++];`
`92`	`92`
`93`		`- invalFunction(msg);`
	`93`	`+ invalFunction(&msg);`
`94`	`94`	`}`
`95`	`95`
`96`	`96`	`do`
`@@ -116,9 +116,9 @@ ReceiveSharedInvalidMessages(`
`116`	`116`
`117`	`117`	`while (nextmsg < nummsgs)`
`118`	`118`	`{`
`119`		`- SharedInvalidationMessage *msg = &messages[nextmsg++];`
	`119`	`+ SharedInvalidationMessage msg = messages[nextmsg++];`
`120`	`120`
`121`		`- invalFunction(msg);`
	`121`	`+ invalFunction(&msg);`
`122`	`122`	`}`
`123`	`123`
`124`	`124`	`/*`