Re: Potential use-after-free in partion related code - Mailing list pgsql-hackers

From Alvaro Herrera
Subject Re: Potential use-after-free in partion related code
Date
Msg-id 202311151802.ngj2la66jwgi@alvherre.pgsql
Whole thread Raw
In response to Potential use-after-free in partion related code  (Andres Freund <andres@anarazel.de>)
List pgsql-hackers
On 2023-Nov-15, Andres Freund wrote:

>     partConstraint = list_concat(partBoundConstraint,
>                                  RelationGetPartitionQual(rel));
> 
> At this point partBoundConstraint may not be used anymore, because
> list_concat() might have reallocated.
> 
> But then a few lines later:
> 
>         /* we already hold a lock on the default partition */
>         defaultrel = table_open(defaultPartOid, NoLock);
>         defPartConstraint =
>             get_proposed_default_constraint(partBoundConstraint);
> 
> We use partBoundConstraint again.

Yeah, this is wrong if partBoundConstraint is reallocated by
list_concat.  One possible fix is to change list_concat to
list_concat_copy(), which leaves the original list unmodified.

AFAICT the bug came in with 6f6b99d1335b, which added default
partitions.

-- 
Álvaro Herrera        Breisgau, Deutschland  —  https://www.EnterpriseDB.com/
"Now I have my system running, not a byte was off the shelf;
It rarely breaks and when it does I fix the code myself.
It's stable, clean and elegant, and lightning fast as well,
And it doesn't cost a nickel, so Bill Gates can go to hell."



pgsql-hackers by date:

Previous
From: Tom Lane
Date:
Subject: Re: On non-Windows, hard depend on uselocale(3)
Next
From: vignesh C
Date:
Subject: Re: pg_upgrade and logical replication