Fix pfree-of-already-freed-tuple when rescanning a GiST index-only scan.

GiST's getNextNearest() function attempts to pfree the previously-returned
tuple if any (that is, scan->xs_hitup in HEAD, or scan->xs_itup in older
branches).  However, if we are rescanning a plan node after ending a
previous scan early, those tuple pointers could be pointing to garbage,
because they would be pointing into the scan's pageDataCxt or queueCxt
which has been reset.  In a debug build this reliably results in a crash,
although I think it might sometimes accidentally fail to fail in
production builds.

To fix, clear the pointer field anyplace we reset a context it might
be pointing into.  This may be overkill --- I think probably only the
queueCxt case is involved in this bug, so that resetting in gistrescan()
would be sufficient --- but dangling pointers are generally bad news,
so let's avoid them.

Another plausible answer might be to just not bother with the pfree in
getNextNearest().  The reconstructed tuples would go away anyway in the
context resets, and I'm far from convinced that freeing them a bit earlier
really saves anything meaningful.  I'll stick with the original logic in
this patch, but if we find more problems in the same area we should
consider that approach.

Per bug #14641 from Denis Smirnov.  Back-patch to 9.5 where this
logic was introduced.

Discussion: https://postgr.es/m/20170504072034[email protected]

diff --git a/src/backend/access/gist/gistget.c b/src/backend/access/gist/gistget.c
index 20f695cee4ed09be550817a4e480e36cbbf9b920..1a69d40a7158618013f64afa3763a29bb3e671c0 100644 (file)
--- a/src/backend/access/gist/gistget.c
+++ b/src/backend/access/gist/gistget.c
@@ -302,6 +302,7 @@ gistScanPage(IndexScanDesc scan, GISTSearchItem *pageItem, double *myDistances,
    }
 
    so->nPageData = so->curPageData = 0;
+   scan->xs_itup = NULL;       /* might point into pageDataCxt */
    if (so->pageDataCxt)
        MemoryContextReset(so->pageDataCxt);
 
@@ -552,6 +553,7 @@ gistgettuple(PG_FUNCTION_ARGS)
 
        so->firstCall = false;
        so->curPageData = so->nPageData = 0;
+       scan->xs_itup = NULL;
        if (so->pageDataCxt)
            MemoryContextReset(so->pageDataCxt);
 
@@ -629,6 +631,7 @@ gistgetbitmap(PG_FUNCTION_ARGS)
 
    /* Begin the scan by processing the root page */
    so->curPageData = so->nPageData = 0;
+   scan->xs_itup = NULL;
    if (so->pageDataCxt)
        MemoryContextReset(so->pageDataCxt);
 

diff --git a/src/backend/access/gist/gistscan.c b/src/backend/access/gist/gistscan.c
index 62f1fdd8da2206758675729054f7885606e35180..cde9e79496728e9121df3d21cfa5479e393c931e 100644 (file)
--- a/src/backend/access/gist/gistscan.c
+++ b/src/backend/access/gist/gistscan.c
@@ -318,6 +318,9 @@ gistrescan(PG_FUNCTION_ARGS)
            pfree(fn_extras);
    }
 
+   /* any previous xs_itup will have been pfree'd in context resets above */
+   scan->xs_itup = NULL;
+
    PG_RETURN_VOID();
 }
 

diff --git a/src/test/regress/expected/gist.out b/src/test/regress/expected/gist.out
index c7181b0397ec4688a416b40eb0d7233f8632c552..91f999814090423bbbd64b855cc462d3a752e33e 100644 (file)
--- a/src/test/regress/expected/gist.out
+++ b/src/test/regress/expected/gist.out
@@ -114,6 +114,40 @@ order by point(0.101, 0.101) <-> p;
  (0.5,0.5)
 (11 rows)
 
+-- Check case with multiple rescans (bug #14641)
+explain (costs off)
+select p from
+  (values (box(point(0,0), point(0.5,0.5))),
+          (box(point(0.5,0.5), point(0.75,0.75))),
+          (box(point(0.8,0.8), point(1.0,1.0)))) as v(bb)
+cross join lateral
+  (select p from gist_tbl where p <@ bb order by p <-> bb[0] limit 2) ss;
+                             QUERY PLAN                             
+--------------------------------------------------------------------
+ Nested Loop
+   ->  Values Scan on "*VALUES*"
+   ->  Limit
+         ->  Index Only Scan using gist_tbl_point_index on gist_tbl
+               Index Cond: (p <@ "*VALUES*".column1)
+               Order By: (p <-> ("*VALUES*".column1)[0])
+(6 rows)
+
+select p from
+  (values (box(point(0,0), point(0.5,0.5))),
+          (box(point(0.5,0.5), point(0.75,0.75))),
+          (box(point(0.8,0.8), point(1.0,1.0)))) as v(bb)
+cross join lateral
+  (select p from gist_tbl where p <@ bb order by p <-> bb[0] limit 2) ss;
+      p      
+-------------
+ (0.5,0.5)
+ (0.45,0.45)
+ (0.75,0.75)
+ (0.7,0.7)
+ (1,1)
+ (0.95,0.95)
+(6 rows)
+
 drop index gist_tbl_point_index;
 -- Test index-only scan with box opclass
 create index gist_tbl_box_index on gist_tbl using gist (b);

diff --git a/src/test/regress/sql/gist.sql b/src/test/regress/sql/gist.sql
index 9d4ff1e97e970c7b2a2558014c7765dbfaa47d94..49126fd466df64400a92fc59245b3df0ec848494 100644 (file)
--- a/src/test/regress/sql/gist.sql
+++ b/src/test/regress/sql/gist.sql
@@ -69,6 +69,22 @@ order by point(0.101, 0.101) <-> p;
 select p from gist_tbl where p <@ box(point(0,0), point(0.5, 0.5))
 order by point(0.101, 0.101) <-> p;
 
+-- Check case with multiple rescans (bug #14641)
+explain (costs off)
+select p from
+  (values (box(point(0,0), point(0.5,0.5))),
+          (box(point(0.5,0.5), point(0.75,0.75))),
+          (box(point(0.8,0.8), point(1.0,1.0)))) as v(bb)
+cross join lateral
+  (select p from gist_tbl where p <@ bb order by p <-> bb[0] limit 2) ss;
+
+select p from
+  (values (box(point(0,0), point(0.5,0.5))),
+          (box(point(0.5,0.5), point(0.75,0.75))),
+          (box(point(0.8,0.8), point(1.0,1.0)))) as v(bb)
+cross join lateral
+  (select p from gist_tbl where p <@ bb order by p <-> bb[0] limit 2) ss;
+
 drop index gist_tbl_point_index;
 
 -- Test index-only scan with box opclass