Potential use-after-free in partion related code

Поиск
Список
Период
Сортировка
От Andres Freund
Тема Potential use-after-free in partion related code
Дата
Msg-id 20231115165737.zeulb575cgrbqo74@awork3.anarazel.de
обсуждение исходный текст
Ответы Re: Potential use-after-free in partion related code
Список pgsql-hackers
Hi,

A while back I had proposed annotations for palloc() et al that let the
compiler know about which allocators pair with what freeing functions. One
thing that allows the compiler to do is to detect use after free.

One such complaint is:

../../../../../home/andres/src/postgresql/src/backend/commands/tablecmds.c: In function ‘ATExecAttachPartition’:
../../../../../home/andres/src/postgresql/src/backend/commands/tablecmds.c:18758:25: warning: pointer
‘partBoundConstraint’may be used after ‘list_concat’ [-Wuse-after-free]
 
18758 |                         get_proposed_default_constraint(partBoundConstraint);
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../../../../../home/andres/src/postgresql/src/backend/commands/tablecmds.c:18711:26: note: call to ‘list_concat’ here
18711 |         partConstraint = list_concat(partBoundConstraint,
      |                          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
18712 |                                                                  RelationGetPartitionQual(rel));
      |                                                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


And it seems quite right:

    partConstraint = list_concat(partBoundConstraint,
                                 RelationGetPartitionQual(rel));

At this point partBoundConstraint may not be used anymore, because
list_concat() might have reallocated.

But then a few lines later:

        /* we already hold a lock on the default partition */
        defaultrel = table_open(defaultPartOid, NoLock);
        defPartConstraint =
            get_proposed_default_constraint(partBoundConstraint);

We use partBoundConstraint again.

I unfortunately can't quickly enough identify what partConstraint,
defPartConstraint, partBoundConstraint are, so I don't don't really know what
the fix here is.

Greetings,

Andres Freund



В списке pgsql-hackers по дате отправления:

Предыдущее
От: Andres Freund
Дата:
Сообщение: Re: Explicitly skip TAP tests under Meson if disabled
Следующее
От: Andres Freund
Дата:
Сообщение: Re: remaining sql/json patches