From d41fda6aa3c1016ef5aedb4bf393ead81f6e3a8f Mon Sep 17 00:00:00 2001 From: Thomas Munro Date: Sat, 29 May 2021 14:48:15 +1200 Subject: [PATCH] Fix race condition when sharing tuple descriptors. Parallel query processes that called BlessTupleDesc() for identical tuple descriptors at the same moment could crash. There was code to handle that rare case, but it dereferenced a bogus DSA pointer. Repair. Back-patch to 11, where commit cc5f8136 added support for sharing tuple descriptors in parallel queries. Reported-by: Eric Thinnes Discussion: https://postgr.es/m/99aaa2eb-e194-bf07-c29a-1a76b4f2bcf9%40gmx.de --- src/backend/utils/cache/typcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/backend/utils/cache/typcache.c b/src/backend/utils/cache/typcache.c index f51248b70d..c848d09d14 100644 --- a/src/backend/utils/cache/typcache.c +++ b/src/backend/utils/cache/typcache.c @@ -2707,7 +2707,7 @@ find_or_make_matching_shared_tupledesc(TupleDesc tupdesc) Assert(record_table_entry->key.shared); result = (TupleDesc) dsa_get_address(CurrentSession->area, - record_table_entry->key.shared); + record_table_entry->key.u.shared_tupdesc); Assert(result->tdrefcount == -1); return result;