Fix possible corruption of AfterTriggerEventLists in subtransaction rollback.

tglsfdc · tglsfdc · commit 780a7dcb69bd · 2010-08-19T15:46:24.000Z
afterTriggerInvokeEvents failed to adjust events-&gt;tailfree when truncating
the last chunk of an event list.  This could result in the data being
"de-truncated" by afterTriggerRestoreEventList during a subsequent
subtransaction abort.  Even that wouldn't kill us, because the re-added data
would just be events marked DONE --- unless the data had been partially
overwritten by new events.  Then we might crash, or in any case misbehave
(perhaps fire triggers twice, or fire triggers with the wrong event data).
Per bug #5622 from Thue Janus Kristensen.

Back-patch to 8.4 where the current trigger list representation was introduced.
diff --git a/src/backend/commands/trigger.c b/src/backend/commands/trigger.c
@@ -7,7 +7,7 @@
  * Portions Copyright (c) 1994, Regents of the University of California
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/commands/trigger.c,v 1.262 2010/02/26 02:00:39 momjian Exp $
+ *	  $PostgreSQL: pgsql/src/backend/commands/trigger.c,v 1.262.4.1 2010/08/19 15:46:24 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -2928,6 +2928,7 @@ afterTriggerAddEvent(AfterTriggerEventList *events,
 		else
 			events->tail->next = chunk;
 		events->tail = chunk;
+		/* events->tailfree is now out of sync, but we'll fix it below */
 	}
 
 	/*
@@ -3329,6 +3330,15 @@ afterTriggerInvokeEvents(AfterTriggerEventList *events,
 		{
 			chunk->freeptr = CHUNK_DATA_START(chunk);
 			chunk->endfree = chunk->endptr;
+
+			/*
+			 * If it's last chunk, must sync event list's tailfree too.  Note
+			 * that delete_ok must NOT be passed as true if there could be
+			 * stacked AfterTriggerEventList values pointing at this event
+			 * list, since we'd fail to fix their copies of tailfree.
+			 */
+			if (chunk == events->tail)
+				events->tailfree = chunk->freeptr;
 		}
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@`
`7`	`7`	`* Portions Copyright (c) 1994, Regents of the University of California`
`8`	`8`	`*`
`9`	`9`	`* IDENTIFICATION`
`10`		`- * $PostgreSQL: pgsql/src/backend/commands/trigger.c,v 1.262 2010/02/26 02:00:39 momjian Exp $`
	`10`	`+ * $PostgreSQL: pgsql/src/backend/commands/trigger.c,v 1.262.4.1 2010/08/19 15:46:24 tgl Exp $`
`11`	`11`	`*`
`12`	`12`	`*-------------------------------------------------------------------------`
`13`	`13`	`*/`
`@@ -2928,6 +2928,7 @@ afterTriggerAddEvent(AfterTriggerEventList *events,`
`2928`	`2928`	`else`
`2929`	`2929`	`events->tail->next = chunk;`
`2930`	`2930`	`events->tail = chunk;`
	`2931`	`+ /* events->tailfree is now out of sync, but we'll fix it below */`
`2931`	`2932`	`}`
`2932`	`2933`
`2933`	`2934`	`/*`
`@@ -3329,6 +3330,15 @@ afterTriggerInvokeEvents(AfterTriggerEventList *events,`
`3329`	`3330`	`{`
`3330`	`3331`	`chunk->freeptr = CHUNK_DATA_START(chunk);`
`3331`	`3332`	`chunk->endfree = chunk->endptr;`
	`3333`	`+`
	`3334`	`+ /*`
	`3335`	`+ * If it's last chunk, must sync event list's tailfree too. Note`
	`3336`	`+ * that delete_ok must NOT be passed as true if there could be`
	`3337`	`+ * stacked AfterTriggerEventList values pointing at this event`
	`3338`	`+ * list, since we'd fail to fix their copies of tailfree.`
	`3339`	`+ */`
	`3340`	`+ if (chunk == events->tail)`
	`3341`	`+ events->tailfree = chunk->freeptr;`
`3332`	`3342`	`}`
`3333`	`3343`	`}`
`3334`	`3344`