diff options
| author | Richard Guo <rguo@postgresql.org> | 2025-02-19 11:05:35 +0900 |
|---|---|---|
| committer | Richard Guo <rguo@postgresql.org> | 2025-02-19 11:05:35 +0900 |
| commit | 71d02dc478d574c75bd0af82cec774c7b9059a61 (patch) | |
| tree | 8dd41622bc04fcde9b4cf10fb605948ed513515f /src | |
| parent | c39392ebaeeff7dafbc255844bcc605aaef01d7d (diff) | |
| download | postgresql-71d02dc478d574c75bd0af82cec774c7b9059a61.tar.gz postgresql-71d02dc478d574c75bd0af82cec774c7b9059a61.zip | |
Fix unsafe access to BufferDescriptors
When considering a local buffer, the GetBufferDescriptor() call in
BufferGetLSNAtomic() would be retrieving a shared buffer with a bad
buffer ID. Since the code checks whether the buffer is shared before
using the retrieved BufferDesc, this issue did not lead to any
malfunction. Nonetheless this seems like trouble waiting to happen,
so fix it by ensuring that GetBufferDescriptor() is only called when
we know the buffer is shared.
Author: Tender Wang <tndrwang@gmail.com>
Reviewed-by: Xuneng Zhou <xunengzhou@gmail.com>
Reviewed-by: Richard Guo <guofenglinux@gmail.com>
Discussion: https://postgr.es/m/CAHewXNku-o46-9cmUgyv6LkSZ25doDrWq32p=oz9kfD8ovVJMg@mail.gmail.com
Backpatch-through: 13
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/storage/buffer/bufmgr.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/backend/storage/buffer/bufmgr.c b/src/backend/storage/buffer/bufmgr.c index 80b0d0c5ded..75cfc2b6fe9 100644 --- a/src/backend/storage/buffer/bufmgr.c +++ b/src/backend/storage/buffer/bufmgr.c @@ -3981,8 +3981,8 @@ BufferIsPermanent(Buffer buffer) XLogRecPtr BufferGetLSNAtomic(Buffer buffer) { - BufferDesc *bufHdr = GetBufferDescriptor(buffer - 1); char *page = BufferGetPage(buffer); + BufferDesc *bufHdr; XLogRecPtr lsn; uint32 buf_state; @@ -3996,6 +3996,7 @@ BufferGetLSNAtomic(Buffer buffer) Assert(BufferIsValid(buffer)); Assert(BufferIsPinned(buffer)); + bufHdr = GetBufferDescriptor(buffer - 1); buf_state = LockBufHdr(bufHdr); lsn = PageGetLSN(page); UnlockBufHdr(bufHdr, buf_state); |