Fix race in SSI interaction with gin fast path.

The ginfast.c code previously checked for conflicts in before locking
the relevant buffer, leaving a window where a RW conflict could be
missed.  Re-order.

There was also a place where buffer ID and block number were confused
while trying to predicate-lock a page, noted by visual inspection.

Back-patch to all supported releases.  Fixes one more problem discovered
with the reproducer from bug #17949, in this case when Dmitry tried
other index types.

Reported-by: Artem Anisimov <[email protected]>
Reported-by: Dmitry Dolgov <[email protected]>
Reviewed-by: Heikki Linnakangas <[email protected]>
Discussion: https://postgr.es/m/17949-a0f17035294a55e2%40postgresql.org

diff --git a/src/backend/access/gin/ginfast.c b/src/backend/access/gin/ginfast.c
index 1f4f3f62e3436981d70a671aed6bee3eeb39e2ce..ba36915835490d8d9470797a74140faff5ae9b83 100644 (file)
--- a/src/backend/access/gin/ginfast.c
+++ b/src/backend/access/gin/ginfast.c
@@ -245,9 +245,10 @@ ginHeapTupleFastInsert(GinState *ginstate, GinTupleCollector *collector)
    /*
     * An insertion to the pending list could logically belong anywhere in the
     * tree, so it conflicts with all serializable scans.  All scans acquire a
-    * predicate lock on the metabuffer to represent that.
+    * predicate lock on the metabuffer to represent that.  Therefore we'll
+    * check for conflicts in, but not until we have the page locked and are
+    * ready to modify the page.
     */
-   CheckForSerializableConflictIn(index, NULL, GIN_METAPAGE_BLKNO);
 
    if (collector->sumsize + collector->ntuples * sizeof(ItemIdData) > GinListPageSize)
    {
@@ -291,6 +292,8 @@ ginHeapTupleFastInsert(GinState *ginstate, GinTupleCollector *collector)
        LockBuffer(metabuffer, GIN_EXCLUSIVE);
        metadata = GinPageGetMeta(metapage);
 
+       CheckForSerializableConflictIn(index, NULL, GIN_METAPAGE_BLKNO);
+
        if (metadata->head == InvalidBlockNumber)
        {
            /*
@@ -353,6 +356,8 @@ ginHeapTupleFastInsert(GinState *ginstate, GinTupleCollector *collector)
        char       *ptr;
        char       *collectordata;
 
+       CheckForSerializableConflictIn(index, NULL, GIN_METAPAGE_BLKNO);
+
        buffer = ReadBuffer(index, metadata->tail);
        LockBuffer(buffer, GIN_EXCLUSIVE);
        page = BufferGetPage(buffer);

diff --git a/src/backend/access/gin/ginget.c b/src/backend/access/gin/ginget.c
index 03191e016ce5c4be0e5f59474789bd0114718991..02decb0adb93447b678af6aaeb74064cacc1a203 100644 (file)
--- a/src/backend/access/gin/ginget.c
+++ b/src/backend/access/gin/ginget.c
@@ -139,7 +139,9 @@ collectMatchBitmap(GinBtreeData *btree, GinBtreeStack *stack,
     * Predicate lock entry leaf page, following pages will be locked by
     * moveRightIfItNeeded()
     */
-   PredicateLockPage(btree->index, stack->buffer, snapshot);
+   PredicateLockPage(btree->index,
+                     BufferGetBlockNumber(stack->buffer),
+                     snapshot);
 
    for (;;)
    {