Skip to content

Commit 6eb3fc7

Browse files
committed
Prevent excess SimpleLruTruncate() deletion.
Every core SLRU wraps around. With the exception of pg_notify, the wrap point can fall in the middle of a page. Account for this in the PagePrecedes callback specification and in SimpleLruTruncate()'s use of said callback. Update each callback implementation to fit the new specification. This changes SerialPagePrecedesLogically() from the style of asyncQueuePagePrecedes() to the style of CLOGPagePrecedes(). (Whereas pg_clog and pg_serial share a key space, pg_serial is nothing like pg_notify.) The bug fixed here has the same symptoms and user followup steps as 592a589. Back-patch to 9.5 (all supported versions). Reviewed by Andrey Borodin and (in earlier versions) by Tom Lane. Discussion: https://postgr.es/m/20190202083822.GC32531@gust.leadboat.com
1 parent d26d4c7 commit 6eb3fc7

File tree

8 files changed

+315
-81
lines changed

8 files changed

+315
-81
lines changed

src/backend/access/transam/clog.c

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -693,6 +693,7 @@ CLOGShmemInit(void)
693693
XactCtl->PagePrecedes = CLOGPagePrecedes;
694694
SimpleLruInit(XactCtl, "Xact", CLOGShmemBuffers(), CLOG_LSNS_PER_PAGE,
695695
XactSLRULock, "pg_xact", LWTRANCHE_XACT_BUFFER);
696+
SlruPagePrecedesUnitTests(XactCtl, CLOG_XACTS_PER_PAGE);
696697
}
697698

698699
/*
@@ -926,13 +927,22 @@ TruncateCLOG(TransactionId oldestXact, Oid oldestxid_datoid)
926927

927928

928929
/*
929-
* Decide which of two CLOG page numbers is "older" for truncation purposes.
930+
* Decide whether a CLOG page number is "older" for truncation purposes.
930931
*
931932
* We need to use comparison of TransactionIds here in order to do the right
932-
* thing with wraparound XID arithmetic. However, if we are asked about
933-
* page number zero, we don't want to hand InvalidTransactionId to
934-
* TransactionIdPrecedes: it'll get weird about permanent xact IDs. So,
935-
* offset both xids by FirstNormalTransactionId to avoid that.
933+
* thing with wraparound XID arithmetic. However, TransactionIdPrecedes()
934+
* would get weird about permanent xact IDs. So, offset both such that xid1,
935+
* xid2, and xid2 + CLOG_XACTS_PER_PAGE - 1 are all normal XIDs; this offset
936+
* is relevant to page 0 and to the page preceding page 0.
937+
*
938+
* The page containing oldestXact-2^31 is the important edge case. The
939+
* portion of that page equaling or following oldestXact-2^31 is expendable,
940+
* but the portion preceding oldestXact-2^31 is not. When oldestXact-2^31 is
941+
* the first XID of a page and segment, the entire page and segment is
942+
* expendable, and we could truncate the segment. Recognizing that case would
943+
* require making oldestXact, not just the page containing oldestXact,
944+
* available to this callback. The benefit would be rare and small, so we
945+
* don't optimize that edge case.
936946
*/
937947
static bool
938948
CLOGPagePrecedes(int page1, int page2)
@@ -941,11 +951,12 @@ CLOGPagePrecedes(int page1, int page2)
941951
TransactionId xid2;
942952

943953
xid1 = ((TransactionId) page1) * CLOG_XACTS_PER_PAGE;
944-
xid1 += FirstNormalTransactionId;
954+
xid1 += FirstNormalTransactionId + 1;
945955
xid2 = ((TransactionId) page2) * CLOG_XACTS_PER_PAGE;
946-
xid2 += FirstNormalTransactionId;
956+
xid2 += FirstNormalTransactionId + 1;
947957

948-
return TransactionIdPrecedes(xid1, xid2);
958+
return (TransactionIdPrecedes(xid1, xid2) &&
959+
TransactionIdPrecedes(xid1, xid2 + CLOG_XACTS_PER_PAGE - 1));
949960
}
950961

951962

src/backend/access/transam/commit_ts.c

Lines changed: 25 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -495,6 +495,7 @@ CommitTsShmemInit(void)
495495
SimpleLruInit(CommitTsCtl, "CommitTs", CommitTsShmemBuffers(), 0,
496496
CommitTsSLRULock, "pg_commit_ts",
497497
LWTRANCHE_COMMITTS_BUFFER);
498+
SlruPagePrecedesUnitTests(CommitTsCtl, COMMIT_TS_XACTS_PER_PAGE);
498499

499500
commitTsShared = ShmemInitStruct("CommitTs shared",
500501
sizeof(CommitTimestampShared),
@@ -877,14 +878,27 @@ AdvanceOldestCommitTsXid(TransactionId oldestXact)
877878

878879

879880
/*
880-
* Decide which of two commitTS page numbers is "older" for truncation
881-
* purposes.
881+
* Decide whether a commitTS page number is "older" for truncation purposes.
882+
* Analogous to CLOGPagePrecedes().
882883
*
883-
* We need to use comparison of TransactionIds here in order to do the right
884-
* thing with wraparound XID arithmetic. However, if we are asked about
885-
* page number zero, we don't want to hand InvalidTransactionId to
886-
* TransactionIdPrecedes: it'll get weird about permanent xact IDs. So,
887-
* offset both xids by FirstNormalTransactionId to avoid that.
884+
* At default BLCKSZ, (1 << 31) % COMMIT_TS_XACTS_PER_PAGE == 128. This
885+
* introduces differences compared to CLOG and the other SLRUs having (1 <<
886+
* 31) % per_page == 0. This function never tests exactly
887+
* TransactionIdPrecedes(x-2^31, x). When the system reaches xidStopLimit,
888+
* there are two possible counts of page boundaries between oldestXact and the
889+
* latest XID assigned, depending on whether oldestXact is within the first
890+
* 128 entries of its page. Since this function doesn't know the location of
891+
* oldestXact within page2, it returns false for one page that actually is
892+
* expendable. This is a wider (yet still negligible) version of the
893+
* truncation opportunity that CLOGPagePrecedes() cannot recognize.
894+
*
895+
* For the sake of a worked example, number entries with decimal values such
896+
* that page1==1 entries range from 1.0 to 1.999. Let N+0.15 be the number of
897+
* pages that 2^31 entries will span (N is an integer). If oldestXact=N+2.1,
898+
* then the final safe XID assignment leaves newestXact=1.95. We keep page 2,
899+
* because entry=2.85 is the border that toggles whether entries precede the
900+
* last entry of the oldestXact page. While page 2 is expendable at
901+
* oldestXact=N+2.1, it would be precious at oldestXact=N+2.9.
888902
*/
889903
static bool
890904
CommitTsPagePrecedes(int page1, int page2)
@@ -893,11 +907,12 @@ CommitTsPagePrecedes(int page1, int page2)
893907
TransactionId xid2;
894908

895909
xid1 = ((TransactionId) page1) * COMMIT_TS_XACTS_PER_PAGE;
896-
xid1 += FirstNormalTransactionId;
910+
xid1 += FirstNormalTransactionId + 1;
897911
xid2 = ((TransactionId) page2) * COMMIT_TS_XACTS_PER_PAGE;
898-
xid2 += FirstNormalTransactionId;
912+
xid2 += FirstNormalTransactionId + 1;
899913

900-
return TransactionIdPrecedes(xid1, xid2);
914+
return (TransactionIdPrecedes(xid1, xid2) &&
915+
TransactionIdPrecedes(xid1, xid2 + COMMIT_TS_XACTS_PER_PAGE - 1));
901916
}
902917

903918

src/backend/access/transam/multixact.c

Lines changed: 24 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1832,10 +1832,12 @@ MultiXactShmemInit(void)
18321832
"MultiXactOffset", NUM_MULTIXACTOFFSET_BUFFERS, 0,
18331833
MultiXactOffsetSLRULock, "pg_multixact/offsets",
18341834
LWTRANCHE_MULTIXACTOFFSET_BUFFER);
1835+
SlruPagePrecedesUnitTests(MultiXactOffsetCtl, MULTIXACT_OFFSETS_PER_PAGE);
18351836
SimpleLruInit(MultiXactMemberCtl,
18361837
"MultiXactMember", NUM_MULTIXACTMEMBER_BUFFERS, 0,
18371838
MultiXactMemberSLRULock, "pg_multixact/members",
18381839
LWTRANCHE_MULTIXACTMEMBER_BUFFER);
1840+
/* doesn't call SimpleLruTruncate() or meet criteria for unit tests */
18391841

18401842
/* Initialize our shared state struct */
18411843
MultiXactState = ShmemInitStruct("Shared MultiXact State",
@@ -2978,6 +2980,14 @@ TruncateMultiXact(MultiXactId newOldestMulti, Oid newOldestMultiDB)
29782980
* truncate the members SLRU. So we first scan the directory to determine
29792981
* the earliest offsets page number that we can read without error.
29802982
*
2983+
* When nextMXact is less than one segment away from multiWrapLimit,
2984+
* SlruScanDirCbFindEarliest can find some early segment other than the
2985+
* actual earliest. (MultiXactOffsetPagePrecedes(EARLIEST, LATEST)
2986+
* returns false, because not all pairs of entries have the same answer.)
2987+
* That can also arise when an earlier truncation attempt failed unlink()
2988+
* or returned early from this function. The only consequence is
2989+
* returning early, which wastes space that we could have liberated.
2990+
*
29812991
* NB: It's also possible that the page that oldestMulti is on has already
29822992
* been truncated away, and we crashed before updating oldestMulti.
29832993
*/
@@ -3092,15 +3102,11 @@ TruncateMultiXact(MultiXactId newOldestMulti, Oid newOldestMultiDB)
30923102
}
30933103

30943104
/*
3095-
* Decide which of two MultiXactOffset page numbers is "older" for truncation
3096-
* purposes.
3097-
*
3098-
* We need to use comparison of MultiXactId here in order to do the right
3099-
* thing with wraparound. However, if we are asked about page number zero, we
3100-
* don't want to hand InvalidMultiXactId to MultiXactIdPrecedes: it'll get
3101-
* weird. So, offset both multis by FirstMultiXactId to avoid that.
3102-
* (Actually, the current implementation doesn't do anything weird with
3103-
* InvalidMultiXactId, but there's no harm in leaving this code like this.)
3105+
* Decide whether a MultiXactOffset page number is "older" for truncation
3106+
* purposes. Analogous to CLOGPagePrecedes().
3107+
*
3108+
* Offsetting the values is optional, because MultiXactIdPrecedes() has
3109+
* translational symmetry.
31043110
*/
31053111
static bool
31063112
MultiXactOffsetPagePrecedes(int page1, int page2)
@@ -3109,15 +3115,17 @@ MultiXactOffsetPagePrecedes(int page1, int page2)
31093115
MultiXactId multi2;
31103116

31113117
multi1 = ((MultiXactId) page1) * MULTIXACT_OFFSETS_PER_PAGE;
3112-
multi1 += FirstMultiXactId;
3118+
multi1 += FirstMultiXactId + 1;
31133119
multi2 = ((MultiXactId) page2) * MULTIXACT_OFFSETS_PER_PAGE;
3114-
multi2 += FirstMultiXactId;
3120+
multi2 += FirstMultiXactId + 1;
31153121

3116-
return MultiXactIdPrecedes(multi1, multi2);
3122+
return (MultiXactIdPrecedes(multi1, multi2) &&
3123+
MultiXactIdPrecedes(multi1,
3124+
multi2 + MULTIXACT_OFFSETS_PER_PAGE - 1));
31173125
}
31183126

31193127
/*
3120-
* Decide which of two MultiXactMember page numbers is "older" for truncation
3128+
* Decide whether a MultiXactMember page number is "older" for truncation
31213129
* purposes. There is no "invalid offset number" so use the numbers verbatim.
31223130
*/
31233131
static bool
@@ -3129,7 +3137,9 @@ MultiXactMemberPagePrecedes(int page1, int page2)
31293137
offset1 = ((MultiXactOffset) page1) * MULTIXACT_MEMBERS_PER_PAGE;
31303138
offset2 = ((MultiXactOffset) page2) * MULTIXACT_MEMBERS_PER_PAGE;
31313139

3132-
return MultiXactOffsetPrecedes(offset1, offset2);
3140+
return (MultiXactOffsetPrecedes(offset1, offset2) &&
3141+
MultiXactOffsetPrecedes(offset1,
3142+
offset2 + MULTIXACT_MEMBERS_PER_PAGE - 1));
31333143
}
31343144

31353145
/*

src/backend/access/transam/slru.c

Lines changed: 127 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1230,11 +1230,6 @@ SimpleLruTruncate(SlruCtl ctl, int cutoffPage)
12301230
/* update the stats counter of truncates */
12311231
pgstat_count_slru_truncate(shared->slru_stats_idx);
12321232

1233-
/*
1234-
* The cutoff point is the start of the segment containing cutoffPage.
1235-
*/
1236-
cutoffPage -= cutoffPage % SLRU_PAGES_PER_SEGMENT;
1237-
12381233
/*
12391234
* Scan shared memory and remove any pages preceding the cutoff page, to
12401235
* ensure we won't rewrite them later. (Since this is normally called in
@@ -1247,9 +1242,7 @@ restart:;
12471242

12481243
/*
12491244
* While we are holding the lock, make an important safety check: the
1250-
* planned cutoff point must be <= the current endpoint page. Otherwise we
1251-
* have already wrapped around, and proceeding with the truncation would
1252-
* risk removing the current segment.
1245+
* current endpoint page must not be eligible for removal.
12531246
*/
12541247
if (ctl->PagePrecedes(shared->latest_page_number, cutoffPage))
12551248
{
@@ -1281,8 +1274,11 @@ restart:;
12811274
* Hmm, we have (or may have) I/O operations acting on the page, so
12821275
* we've got to wait for them to finish and then start again. This is
12831276
* the same logic as in SlruSelectLRUPage. (XXX if page is dirty,
1284-
* wouldn't it be OK to just discard it without writing it? For now,
1285-
* keep the logic the same as it was.)
1277+
* wouldn't it be OK to just discard it without writing it?
1278+
* SlruMayDeleteSegment() uses a stricter qualification, so we might
1279+
* not delete this page in the end; even if we don't delete it, we
1280+
* won't have cause to read its data again. For now, keep the logic
1281+
* the same as it was.)
12861282
*/
12871283
if (shared->page_status[slotno] == SLRU_PAGE_VALID)
12881284
SlruInternalWritePage(ctl, slotno, NULL);
@@ -1372,19 +1368,134 @@ SlruDeleteSegment(SlruCtl ctl, int segno)
13721368
LWLockRelease(shared->ControlLock);
13731369
}
13741370

1371+
/*
1372+
* Determine whether a segment is okay to delete.
1373+
*
1374+
* segpage is the first page of the segment, and cutoffPage is the oldest (in
1375+
* PagePrecedes order) page in the SLRU containing still-useful data. Since
1376+
* every core PagePrecedes callback implements "wrap around", check the
1377+
* segment's first and last pages:
1378+
*
1379+
* first<cutoff && last<cutoff: yes
1380+
* first<cutoff && last>=cutoff: no; cutoff falls inside this segment
1381+
* first>=cutoff && last<cutoff: no; wrap point falls inside this segment
1382+
* first>=cutoff && last>=cutoff: no; every page of this segment is too young
1383+
*/
1384+
static bool
1385+
SlruMayDeleteSegment(SlruCtl ctl, int segpage, int cutoffPage)
1386+
{
1387+
int seg_last_page = segpage + SLRU_PAGES_PER_SEGMENT - 1;
1388+
1389+
Assert(segpage % SLRU_PAGES_PER_SEGMENT == 0);
1390+
1391+
return (ctl->PagePrecedes(segpage, cutoffPage) &&
1392+
ctl->PagePrecedes(seg_last_page, cutoffPage));
1393+
}
1394+
1395+
#ifdef USE_ASSERT_CHECKING
1396+
static void
1397+
SlruPagePrecedesTestOffset(SlruCtl ctl, int per_page, uint32 offset)
1398+
{
1399+
TransactionId lhs,
1400+
rhs;
1401+
int newestPage,
1402+
oldestPage;
1403+
TransactionId newestXact,
1404+
oldestXact;
1405+
1406+
/*
1407+
* Compare an XID pair having undefined order (see RFC 1982), a pair at
1408+
* "opposite ends" of the XID space. TransactionIdPrecedes() treats each
1409+
* as preceding the other. If RHS is oldestXact, LHS is the first XID we
1410+
* must not assign.
1411+
*/
1412+
lhs = per_page + offset; /* skip first page to avoid non-normal XIDs */
1413+
rhs = lhs + (1U << 31);
1414+
Assert(TransactionIdPrecedes(lhs, rhs));
1415+
Assert(TransactionIdPrecedes(rhs, lhs));
1416+
Assert(!TransactionIdPrecedes(lhs - 1, rhs));
1417+
Assert(TransactionIdPrecedes(rhs, lhs - 1));
1418+
Assert(TransactionIdPrecedes(lhs + 1, rhs));
1419+
Assert(!TransactionIdPrecedes(rhs, lhs + 1));
1420+
Assert(!TransactionIdFollowsOrEquals(lhs, rhs));
1421+
Assert(!TransactionIdFollowsOrEquals(rhs, lhs));
1422+
Assert(!ctl->PagePrecedes(lhs / per_page, lhs / per_page));
1423+
Assert(!ctl->PagePrecedes(lhs / per_page, rhs / per_page));
1424+
Assert(!ctl->PagePrecedes(rhs / per_page, lhs / per_page));
1425+
Assert(!ctl->PagePrecedes((lhs - per_page) / per_page, rhs / per_page));
1426+
Assert(ctl->PagePrecedes(rhs / per_page, (lhs - 3 * per_page) / per_page));
1427+
Assert(ctl->PagePrecedes(rhs / per_page, (lhs - 2 * per_page) / per_page));
1428+
Assert(ctl->PagePrecedes(rhs / per_page, (lhs - 1 * per_page) / per_page)
1429+
|| (1U << 31) % per_page != 0); /* See CommitTsPagePrecedes() */
1430+
Assert(ctl->PagePrecedes((lhs + 1 * per_page) / per_page, rhs / per_page)
1431+
|| (1U << 31) % per_page != 0);
1432+
Assert(ctl->PagePrecedes((lhs + 2 * per_page) / per_page, rhs / per_page));
1433+
Assert(ctl->PagePrecedes((lhs + 3 * per_page) / per_page, rhs / per_page));
1434+
Assert(!ctl->PagePrecedes(rhs / per_page, (lhs + per_page) / per_page));
1435+
1436+
/*
1437+
* GetNewTransactionId() has assigned the last XID it can safely use, and
1438+
* that XID is in the *LAST* page of the second segment. We must not
1439+
* delete that segment.
1440+
*/
1441+
newestPage = 2 * SLRU_PAGES_PER_SEGMENT - 1;
1442+
newestXact = newestPage * per_page + offset;
1443+
Assert(newestXact / per_page == newestPage);
1444+
oldestXact = newestXact + 1;
1445+
oldestXact -= 1U << 31;
1446+
oldestPage = oldestXact / per_page;
1447+
Assert(!SlruMayDeleteSegment(ctl,
1448+
(newestPage -
1449+
newestPage % SLRU_PAGES_PER_SEGMENT),
1450+
oldestPage));
1451+
1452+
/*
1453+
* GetNewTransactionId() has assigned the last XID it can safely use, and
1454+
* that XID is in the *FIRST* page of the second segment. We must not
1455+
* delete that segment.
1456+
*/
1457+
newestPage = SLRU_PAGES_PER_SEGMENT;
1458+
newestXact = newestPage * per_page + offset;
1459+
Assert(newestXact / per_page == newestPage);
1460+
oldestXact = newestXact + 1;
1461+
oldestXact -= 1U << 31;
1462+
oldestPage = oldestXact / per_page;
1463+
Assert(!SlruMayDeleteSegment(ctl,
1464+
(newestPage -
1465+
newestPage % SLRU_PAGES_PER_SEGMENT),
1466+
oldestPage));
1467+
}
1468+
1469+
/*
1470+
* Unit-test a PagePrecedes function.
1471+
*
1472+
* This assumes every uint32 >= FirstNormalTransactionId is a valid key. It
1473+
* assumes each value occupies a contiguous, fixed-size region of SLRU bytes.
1474+
* (MultiXactMemberCtl separates flags from XIDs. AsyncCtl has
1475+
* variable-length entries, no keys, and no random access. These unit tests
1476+
* do not apply to them.)
1477+
*/
1478+
void
1479+
SlruPagePrecedesUnitTests(SlruCtl ctl, int per_page)
1480+
{
1481+
/* Test first, middle and last entries of a page. */
1482+
SlruPagePrecedesTestOffset(ctl, per_page, 0);
1483+
SlruPagePrecedesTestOffset(ctl, per_page, per_page / 2);
1484+
SlruPagePrecedesTestOffset(ctl, per_page, per_page - 1);
1485+
}
1486+
#endif
1487+
13751488
/*
13761489
* SlruScanDirectory callback
1377-
* This callback reports true if there's any segment prior to the one
1378-
* containing the page passed as "data".
1490+
* This callback reports true if there's any segment wholly prior to the
1491+
* one containing the page passed as "data".
13791492
*/
13801493
bool
13811494
SlruScanDirCbReportPresence(SlruCtl ctl, char *filename, int segpage, void *data)
13821495
{
13831496
int cutoffPage = *(int *) data;
13841497

1385-
cutoffPage -= cutoffPage % SLRU_PAGES_PER_SEGMENT;
1386-
1387-
if (ctl->PagePrecedes(segpage, cutoffPage))
1498+
if (SlruMayDeleteSegment(ctl, segpage, cutoffPage))
13881499
return true; /* found one; don't iterate any more */
13891500

13901501
return false; /* keep going */
@@ -1399,7 +1510,7 @@ SlruScanDirCbDeleteCutoff(SlruCtl ctl, char *filename, int segpage, void *data)
13991510
{
14001511
int cutoffPage = *(int *) data;
14011512

1402-
if (ctl->PagePrecedes(segpage, cutoffPage))
1513+
if (SlruMayDeleteSegment(ctl, segpage, cutoffPage))
14031514
SlruInternalDeleteSegment(ctl, filename);
14041515

14051516
return false; /* keep going */

0 commit comments

Comments
 (0)