Skip to content

Segfault when postgres was build with -DRELCACHE_FORCE_RELEASE #177

Description

@manaldush

Hello,
Postgres revision 917fdbc633e, postgres configured with

./configure --prefix=/home/test/postgres --with-pgport=4444 --enable-tap-tests --enable-cassert --with-lz4 --with-libxml --with-openssl --enable-debug CFLAGS='-O0 -Wall' CPPFLAGS='-DRELCACHE_FORCE_RELEASE' --with-icu --enable-injection-points

rum contrib revision 5133b76

Segfault occured when tap-tests were executed

make check
....
t/001_wal.pl .............. ok     
t/002_pglist.pl ........... skipped: This test requires downloading a 1GB archive. The unpacked file weighs almost 3GB. Perform only if the big_values is enabled in PG_TEST_EXTRA
t/003_rum_debug_funcs.pl .. 1/11 # Looks like your test exited with 29 just after 7.
t/003_rum_debug_funcs.pl .. Dubious, test returned 29 (wstat 7424, 0x1d00)
Failed 4/11 subtests 

Test Summary Report
-------------------
t/003_rum_debug_funcs.pl (Wstat: 7424 (exited 29) Tests: 7 Failed: 0)
  Non-zero exit status: 29
  Parse errors: Bad plan.  You planned 11 tests but ran 7.
Files=3, Tests=38, 12 wallclock secs ( 0.02 usr  0.00 sys +  0.61 cusr  1.02 csys =  1.65 CPU)

gdb bt was attached, it seems rum is using a pointer to relcache entry, that has been already freed

Core was generated by `postgres: primary: maxim postgres [local] SELECT                              '.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007c9026ee33a1 in get_cur_tuple_key_oid (piState=0x55c7939c7788) at src/rum_debug_funcs.c:610
610		return TupleDescAttr(origTupleDesc, attnum - 1)->atttypid;
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
─────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────────────────────────────────────────────────────────────
 RAX  0x7c929a9e3880
 RBX  0x7ffd099b3818 —▸ 0x7ffd099b5951 ◂— 'postgres: primary: maxim postgres [local] SELECT'
 RCX  0x55c7939c4622 ◂— 0xffff000000703107
 RDX  0
 RDI  0x7c9027369568 —▸ 0x7c9027367a30 ◂— 0xffffffffffffffff
 RSI  0
 R8   0
 R9   0
 R10  0x55c7938e5bf0 ◂— 0x55c7938e5
 R11  0x6c748984f86def26
 R12  4
 R13  0
 R14  0x55c764e3e978 (__do_global_dtors_aux_fini_array_entry) —▸ 0x55c7641d3d50 (__do_global_dtors_aux) ◂— endbr64
 R15  0x7c9027dab000 (_rtld_global) —▸ 0x7c9027dac2e0 —▸ 0x55c7640ec000 ◂— 0x10102464c457f
 RBP  0x7ffd099b1ed0 —▸ 0x7ffd099b1f00 —▸ 0x7ffd099b1f30 —▸ 0x7ffd099b1fa0 —▸ 0x7ffd099b20e0 ◂— ...
 RSP  0x7ffd099b1eb8 {piState} —▸ 0x55c7939c7788 —▸ 0x55c7939c7d38 —▸ 0x7c9027934538 —▸ 0x7c902736d8f0 ◂— ...
 RIP  0x7c9026ee33a1 (get_cur_tuple_key_oid+64) ◂— mov eax, dword ptr [rax + 0x44]
──────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]──────────────────────────────────────────────────────────────────────────
 ► 0x7c9026ee33a1 <get_cur_tuple_key_oid+64>           mov    eax, dword ptr [rax + 0x44]     <Cannot dereference [0x7c929a9e38c4]>
   0x7c9026ee33a4 <get_cur_tuple_key_oid+67>           leave 
   0x7c9026ee33a5 <get_cur_tuple_key_oid+68>           ret   
 
   0x7c9026ee33a6 <get_entry_index_tuple_values>       endbr64
   0x7c9026ee33aa <get_entry_index_tuple_values+4>     push   rbp
   0x7c9026ee33ab <get_entry_index_tuple_values+5>     mov    rbp, rsp
   0x7c9026ee33ae <get_entry_index_tuple_values+8>     sub    rsp, 0x20
   0x7c9026ee33b2 <get_entry_index_tuple_values+12>    mov    qword ptr [rbp - 0x18], rdi
   0x7c9026ee33b6 <get_entry_index_tuple_values+16>    mov    rax, qword ptr [rbp - 0x18]
   0x7c9026ee33ba <get_entry_index_tuple_values+20>    mov    rax, qword ptr [rax]
   0x7c9026ee33bd <get_entry_index_tuple_values+23>    mov    qword ptr [rbp - 8], rax
───────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]────────────────────────────────────────────────────────────────────────────────────
In file: /home/maxim/git/postgrespro/contrib/rum/src/rum_debug_funcs.c:610
   605         OffsetNumber attnum;
   606 
   607         attnum = piState->curKeyAttnum;
   608         origTupleDesc = piState->rumState->origTupdesc;
   609 
 ► 610         return TupleDescAttr(origTupleDesc, attnum - 1)->atttypid;
   611 }
   612 
   613 /*
   614  * The function is used to extract values
   615  * from a previously read IndexTuple.
   616  */
   617 static void
   618 get_entry_index_tuple_values(RumPageItemsState piState)
───────────────────────────────────────────────────────────────────────────────────────[ STACK ]────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0x7ffd099b1eb8 {piState} —▸ 0x55c7939c7788 —▸ 0x55c7939c7d38 —▸ 0x7c9027934538 —▸ 0x7c902736d8f0 ◂— ...
01:0008│-010 0x7ffd099b1ec0 ◂— 0x155c7939c4622
02:0010│-008 0x7ffd099b1ec8 {origTupleDesc} —▸ 0x7c9027369568 —▸ 0x7c9027367a30 ◂— 0xffffffffffffffff
03:0018│ rbp 0x7ffd099b1ed0 —▸ 0x7ffd099b1f00 —▸ 0x7ffd099b1f30 —▸ 0x7ffd099b1fa0 —▸ 0x7ffd099b20e0 ◂— ...
04:0020│+008 0x7ffd099b1ed8 —▸ 0x7c9026ee3413 (get_entry_index_tuple_values+109) ◂— mov rdx, qword ptr [rbp - 0x18]
05:0028│+010 0x7ffd099b1ee0 —▸ 0x7c9027936100 ◂— 0x66000000000111
06:0030│+018 0x7ffd099b1ee8 —▸ 0x55c7939c7788 —▸ 0x55c7939c7d38 —▸ 0x7c9027934538 —▸ 0x7c902736d8f0 ◂— ...
07:0038│+020 0x7ffd099b1ef0 —▸ 0x55c7939c2650 ◂— 0x309fa800309fd8
─────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────────────────────────────────────────────────
 ► 0   0x7c9026ee33a1 get_cur_tuple_key_oid+64
   1   0x7c9026ee3413 get_entry_index_tuple_values+109
   2   0x7c9026ee43ad entry_internal_page_get_next_result+159
   3   0x7c9026ee5450 rum_page_items_info+613
   4   0x55c764510f39 ExecMakeTableFunctionResult+870
   5   0x55c76452ee3e FunctionNext+182
   6   0x55c764512a75 ExecScanFetch+672
   7   0x55c764512adc ExecScanExtended+101
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  0x00007c9026ee33a1 in get_cur_tuple_key_oid (piState=0x55c7939c7788) at src/rum_debug_funcs.c:610
#1  0x00007c9026ee3413 in get_entry_index_tuple_values (piState=0x55c7939c7788) at src/rum_debug_funcs.c:629
#2  0x00007c9026ee43ad in entry_internal_page_get_next_result (piState=0x55c7939c7788) at src/rum_debug_funcs.c:1172
#3  0x00007c9026ee5450 in rum_page_items_info (fcinfo=0x55c7939be2a0) at src/rum_debug_funcs.c:1642
#4  0x000055c764510f39 in ExecMakeTableFunctionResult (setexpr=0x55c7939ba868, econtext=0x55c7939ba6b8, argContext=0x55c7939be1a0, expectedDesc=0x55c7939bb940, randomAccess=false)
    at execSRF.c:234
#5  0x000055c76452ee3e in FunctionNext (node=0x55c7939ba4a8) at nodeFunctionscan.c:94
#6  0x000055c764512a75 in ExecScanFetch (node=0x55c7939ba4a8, epqstate=0x0, accessMtd=0x55c76452ed88 <FunctionNext>, recheckMtd=0x55c76452f192 <FunctionRecheck>)
    at ../../../src/include/executor/execScan.h:134
#7  0x000055c764512adc in ExecScanExtended (node=0x55c7939ba4a8, accessMtd=0x55c76452ed88 <FunctionNext>, recheckMtd=0x55c76452f192 <FunctionRecheck>, epqstate=0x0, qual=0x0, 
    projInfo=0x0) at ../../../src/include/executor/execScan.h:178
#8  0x000055c764512c4c in ExecScan (node=0x55c7939ba4a8, accessMtd=0x55c76452ed88 <FunctionNext>, recheckMtd=0x55c76452f192 <FunctionRecheck>) at execScan.c:59
#9  0x000055c76452f1eb in ExecFunctionScan (pstate=0x55c7939ba4a8) at nodeFunctionscan.c:269
#10 0x000055c76450de55 in ExecProcNodeFirst (node=0x55c7939ba4a8) at execProcnode.c:469
#11 0x000055c76450037e in ExecProcNode (node=0x55c7939ba4a8) at ../../../src/include/executor/executor.h:315
#12 0x000055c764503356 in ExecutePlan (queryDesc=0x55c7939ad090, operation=CMD_SELECT, sendTuples=true, numberTuples=0, direction=ForwardScanDirection, dest=0x55c7939b17a8)
    at execMain.c:1711
#13 0x000055c764500a41 in standard_ExecutorRun (queryDesc=0x55c7939ad090, direction=ForwardScanDirection, count=0) at execMain.c:366
#14 0x000055c76450089f in ExecutorRun (queryDesc=0x55c7939ad090, direction=ForwardScanDirection, count=0) at execMain.c:303
#15 0x000055c76451c034 in postquel_getnext (es=0x55c793997158, fcache=0x55c793999658) at functions.c:1425
#16 0x000055c76451c615 in fmgr_sql (fcinfo=0x55c7939972a0) at functions.c:1703
#17 0x000055c764510f39 in ExecMakeTableFunctionResult (setexpr=0x55c793981908, econtext=0x55c793981718, argContext=0x55c7939971a0, expectedDesc=0x55c7939953d8, randomAccess=false)
    at execSRF.c:234
#18 0x000055c76452ee3e in FunctionNext (node=0x55c793981508) at nodeFunctionscan.c:94
#19 0x000055c764512a75 in ExecScanFetch (node=0x55c793981508, epqstate=0x0, accessMtd=0x55c76452ed88 <FunctionNext>, recheckMtd=0x55c76452f192 <FunctionRecheck>)
    at ../../../src/include/executor/execScan.h:134
#20 0x000055c764512b09 in ExecScanExtended (node=0x55c793981508, accessMtd=0x55c76452ed88 <FunctionNext>, recheckMtd=0x55c76452f192 <FunctionRecheck>, epqstate=0x0, 
    qual=0x55c793995b68, projInfo=0x0) at ../../../src/include/executor/execScan.h:195
#21 0x000055c764512c4c in ExecScan (node=0x55c793981508, accessMtd=0x55c76452ed88 <FunctionNext>, recheckMtd=0x55c76452f192 <FunctionRecheck>) at execScan.c:59
#22 0x000055c76452f1eb in ExecFunctionScan (pstate=0x55c793981508) at nodeFunctionscan.c:269
#23 0x000055c76450de55 in ExecProcNodeFirst (node=0x55c793981508) at execProcnode.c:469
#24 0x000055c76451f519 in ExecProcNode (node=0x55c793981508) at ../../../src/include/executor/executor.h:315
#25 0x000055c76451faef in fetch_input_tuple (aggstate=0x55c793980ca0) at nodeAgg.c:563
#26 0x000055c764523613 in agg_fill_hash_table (aggstate=0x55c793980ca0) at nodeAgg.c:2637
#27 0x000055c764522e41 in ExecAgg (pstate=0x55c793980ca0) at nodeAgg.c:2258
#28 0x000055c76450de55 in ExecProcNodeFirst (node=0x55c793980ca0) at execProcnode.c:469
#29 0x000055c764543554 in ExecProcNode (node=0x55c793980ca0) at ../../../src/include/executor/executor.h:315
#30 0x000055c7645437ad in ExecLimit (pstate=0x55c793980930) at nodeLimit.c:95
#31 0x000055c76450de55 in ExecProcNodeFirst (node=0x55c793980930) at execProcnode.c:469
#32 0x000055c76450037e in ExecProcNode (node=0x55c793980930) at ../../../src/include/executor/executor.h:315
#33 0x000055c764503356 in ExecutePlan (queryDesc=0x55c793891510, operation=CMD_SELECT, sendTuples=true, numberTuples=0, direction=ForwardScanDirection, dest=0x55c79397e0e8)
    at execMain.c:1711
#34 0x000055c764500a41 in standard_ExecutorRun (queryDesc=0x55c793891510, direction=ForwardScanDirection, count=0) at execMain.c:366
#35 0x000055c76450089f in ExecutorRun (queryDesc=0x55c793891510, direction=ForwardScanDirection, count=0) at execMain.c:303
#36 0x000055c764807c9e in PortalRunSelect (portal=0x55c79393c5d0, forward=true, count=0, dest=0x55c79397e0e8) at pquery.c:921
#37 0x000055c7648078d2 in PortalRun (portal=0x55c79393c5d0, count=9223372036854775807, isTopLevel=true, dest=0x55c79397e0e8, altdest=0x55c79397e0e8, qc=0x7ffd099b2c40) at pquery.c:765
#38 0x000055c7647ffff2 in exec_simple_query (
    query_string=0x55c7938bcda0 "SELECT attrnum\n\t\tFROM rum_internal_entry_page_items('test_rum_idx_false', 1)\n\t\tWHERE attrnum IS NOT NULL\n\t\tGROUP BY attrnum\n\t\tLIMIT 1;")
    at postgres.c:1274
#39 0x000055c7648057f7 in PostgresMain (dbname=0x55c7938f61b0 "postgres", username=0x55c7938f6198 "maxim") at postgres.c:4770
#40 0x000055c7647fb524 in BackendMain (startup_data=0x7ffd099b2ef0, startup_data_len=24) at backend_startup.c:124
#41 0x000055c7646f9c21 in postmaster_child_launch (child_type=B_BACKEND, child_slot=1, startup_data=0x7ffd099b2ef0, startup_data_len=24, client_sock=0x7ffd099b2f50)
    at launch_backend.c:290
#42 0x000055c764700667 in BackendStartup (client_sock=0x7ffd099b2f50) at postmaster.c:3569
#43 0x000055c7646fdbe2 in ServerLoop () at postmaster.c:1703
#44 0x000055c7646fd4d1 in PostmasterMain (argc=4, argv=0x55c793876110) at postmaster.c:1401
#45 0x000055c764597ec7 in main (argc=4, argv=0x55c793876110) at main.c:227
#46 0x00007c902682a1ca in __libc_start_call_main (main=main@entry=0x55c764597b3b <main>, argc=argc@entry=4, argv=argv@entry=0x7ffd099b3818)
    at ../sysdeps/nptl/libc_start_call_main.h:58
#47 0x00007c902682a28b in __libc_start_main_impl (main=0x55c764597b3b <main>, argc=4, argv=0x7ffd099b3818, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, 
    stack_end=0x7ffd099b3808) at ../csu/libc-start.c:360
#48 0x000055c7641d3cd5 in _start ()

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions