Nullify the hypertable cache pointer on invalidation - #9636
Conversation
|
@Poroma-Banerjee, @svenklemm: please review this pull request.
|
6b92dce to
c653f8b
Compare
akuzm
left a comment
There was a problem hiding this comment.
Discussed offline that it makes more sense ts_cache_invalidate, because the core problem that it is supposed to release our pointer to the cache, but it doesn't actually nullify the pointer.
c653f8b to
f67968c
Compare
Failure to do this results in the possible use after free if hypertable_cache_create fails due to out of memory. Possibly (not reproducible, since there is no OOMs anymore) observed on the running instance with: ``` [1034109]: [69d02db8.fc77d-15] [XX000] ERROR: cache "(null)" is not initialized [1034109]: [69d02db8.fc77d-16] 0 tsdbadmin@tsdb,app=PostgreSQL JDBC Driver [XX000] STATEMENT: INSERT INTO sample_table (a_id, timestamp, metric, b_text, c_text, d_text, created, updated, e_bool) VALUES ($1, $2, $3, $4, $5, $6, NOW(), NOW(), false) ON CONFLICT (a_id, timestamp, metric, b_text) DO NOTHING [891]: [69c81ac3.37b-1174] 0 @,app= [00000] LOG: server process (PID 1034109) was terminated by signal 11: Segmentation fault [891]: [69c81ac3.37b-1175] 0 @,app= [00000] DETAIL: Failed process was running: INSERT INTO sample_table (a_id, timestamp, metric, b_text, c_text, d_text, created, updated, e_bool) VALUES ($1, $2, $3, $4, $5, $6, NOW(), NOW(), false) ON CONFLICT (a_id, timestamp, metric, b_text) DO NOTHING
f67968c to
902e7ad
Compare
|
I could construct a test but it needed an error injection point: #9644 |
|
This seems similar to #9610 so might already be fixed in main |
|
@svenklemm I think #9610 doesn't have path where cache is pinned correctly, i.e. for a global hyper table cache pointer, the NULL is assigned only when the cache is destroyed; however, if the old cache is pinned, but the global cache pointer is not assigned due to out of memory, it keeps pointing to the soon-to-be-released (at rollback) struct, causing SIGSEGV on access. |
The bug is fixed by #9636 The test fails only under AddressSanitizer.
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
Failure to do this results in the possible use after free if hypertable_cache_create fails due to out of memory.
Observed a segfault on the running instance under low memory condition (schema obfuscated):
Disable-check: force-changelog-file