From b1d6538903504904db44679355ac109aeda01737 Mon Sep 17 00:00:00 2001 From: Thomas Munro Date: Sat, 29 May 2021 14:48:15 +1200 Subject: [PATCH] Fix race condition when sharing tuple descriptors. Parallel query processes that called BlessTupleDesc() for identical tuple descriptors at the same moment could crash. There was code to handle that rare case, but it dereferenced a bogus DSA pointer. Repair. Back-patch to 11, where commit cc5f8136 added support for sharing tuple descriptors in parallel queries. Reported-by: Eric Thinnes Discussion: https://postgr.es/m/99aaa2eb-e194-bf07-c29a-1a76b4f2bcf9%40gmx.de --- src/backend/utils/cache/typcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/backend/utils/cache/typcache.c b/src/backend/utils/cache/typcache.c index 35c8cf7b24..de96e96c8f 100644 --- a/src/backend/utils/cache/typcache.c +++ b/src/backend/utils/cache/typcache.c @@ -2822,7 +2822,7 @@ find_or_make_matching_shared_tupledesc(TupleDesc tupdesc) Assert(record_table_entry->key.shared); result = (TupleDesc) dsa_get_address(CurrentSession->area, - record_table_entry->key.shared); + record_table_entry->key.u.shared_tupdesc); Assert(result->tdrefcount == -1); return result;