Fix rare sharedtuplestore.c corruption.

macdice · macdice · commit ffcf6f4cfca5 · 2023-01-26T14:52:19.000+13:00
If the final chunk of an oversized tuple being written out to disk was exactly 32760 bytes, it would be corrupted due to a fencepost bug. Bug #17619. Back-patch to 11 where the code arrived. While testing that (see test module in archives), I (tmunro) noticed that the per-participant page counter was not initialized to zero as it should have been; that wasn't a live bug when it was written since DSM memory was originally always zeroed, but since 14 min_dynamic_shared_memory might be configured and it supplies non-zeroed memory, so that is also fixed here. Author: Dmitry Astapov <dastapov@gmail.com> Discussion: https://postgr.es/m/17619-0de62ceda812b8b5%40postgresql.org
diff --git a/src/backend/utils/sort/sharedtuplestore.c b/src/backend/utils/sort/sharedtuplestore.c
@@ -158,6 +158,7 @@ sts_initialize(SharedTuplestore *sts, int participants,
 		LWLockInitialize(&sts->participants[i].lock,
 						 LWTRANCHE_SHARED_TUPLESTORE);
 		sts->participants[i].read_page = 0;
+		sts->participants[i].npages = 0;
 		sts->participants[i].writing = false;
 	}
 
@@ -320,7 +321,7 @@ sts_puttuple(SharedTuplestoreAccessor *accessor, void *meta_data,
 
 	/* Do we have space? */
 	size = accessor->sts->meta_data_size + tuple->t_len;
-	if (accessor->write_pointer + size >= accessor->write_end)
+	if (accessor->write_pointer + size > accessor->write_end)
 	{
 		if (accessor->write_chunk == NULL)
 		{
@@ -340,7 +341,7 @@ sts_puttuple(SharedTuplestoreAccessor *accessor, void *meta_data,
 		}
 
 		/* It may still not be enough in the case of a gigantic tuple. */
-		if (accessor->write_pointer + size >= accessor->write_end)
+		if (accessor->write_pointer + size > accessor->write_end)
 		{
 			size_t		written;
 

Original file line number	Diff line number	Diff line change
`@@ -158,6 +158,7 @@ sts_initialize(SharedTuplestore *sts, int participants,`
`158`	`158`	`LWLockInitialize(&sts->participants[i].lock,`
`159`	`159`	`LWTRANCHE_SHARED_TUPLESTORE);`
`160`	`160`	`sts->participants[i].read_page = 0;`
	`161`	`+ sts->participants[i].npages = 0;`
`161`	`162`	`sts->participants[i].writing = false;`
`162`	`163`	`}`
`163`	`164`
`@@ -320,7 +321,7 @@ sts_puttuple(SharedTuplestoreAccessor accessor, void meta_data,`
`320`	`321`
`321`	`322`	`/* Do we have space? */`
`322`	`323`	`size = accessor->sts->meta_data_size + tuple->t_len;`
`323`		`- if (accessor->write_pointer + size >= accessor->write_end)`
	`324`	`+ if (accessor->write_pointer + size > accessor->write_end)`
`324`	`325`	`{`
`325`	`326`	`if (accessor->write_chunk == NULL)`
`326`	`327`	`{`
`@@ -340,7 +341,7 @@ sts_puttuple(SharedTuplestoreAccessor accessor, void meta_data,`
`340`	`341`	`}`
`341`	`342`
`342`	`343`	`/* It may still not be enough in the case of a gigantic tuple. */`
`343`		`- if (accessor->write_pointer + size >= accessor->write_end)`
	`344`	`+ if (accessor->write_pointer + size > accessor->write_end)`
`344`	`345`	`{`
`345`	`346`	`size_t written;`
`346`	`347`