mirror/postgresql
2
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2024-12-09 08:10:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

Make idle backends exit if the postmaster dies.

Browse Source 
Letting backends continue to run if the postmaster has exited prevents
PostgreSQL from being restarted, which in many environments is
catastrophic.  Worse, if some other backend crashes, we no longer have
any protection against shared memory corruption.  So, arrange for them
to exit instead.  We don't want to expend many cycles on this, but
including postmaster death in the set of things that we wait for when
a backend is idle seems cheap enough.

Rajeev Rastogi and Robert Haas
This commit is contained in:
Robert Haas 2015-11-12 09:00:33 -05:00
parent a05dc4d7fd
commit ac1d7945f8
1 changed files with 31 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
src/backend/libpq/be-secure.c
View File

@ -35,6 +35,7 @@
#include "miscadmin.h"
#include "tcop/tcopprot.h"
#include "utils/memutils.h"
#include "storage/ipc.h"
#include "storage/proc.h"
@ -144,9 +145,31 @@ retry:
Assert(waitfor);
w = WaitLatchOrSocket(MyLatch,
WL_LATCH_SET | waitfor,
WL_LATCH_SET | WL_POSTMASTER_DEATH | waitfor,
port->sock, 0);
/*
* If the postmaster has died, it's not safe to continue running,
* because it is the postmaster's job to kill us if some other backend
* exists uncleanly. Moreover, we won't run very well in this state;
* helper processes like walwriter and the bgwriter will exit, so
* performance may be poor. Finally, if we don't exit, pg_ctl will
* be unable to restart the postmaster without manual intervention,
* so no new connections can be accepted. Exiting clears the deck
* for a postmaster restart.
*
* (Note that we only make this check when we would otherwise sleep
* on our latch. We might still continue running for a while if the
* postmaster is killed in mid-query, or even through multiple queries
* if we never have to wait for read. We don't want to burn too many
* cycles checking for this very rare condition, and this should cause
* us to exit quickly in most cases.)
*/
if (w & WL_POSTMASTER_DEATH)
ereport(FATAL,
(errcode(ERRCODE_ADMIN_SHUTDOWN),
errmsg("terminating connection due to unexpected postmaster exit")));
/* Handle interrupt. */
if (w & WL_LATCH_SET)
{
@ -223,9 +246,15 @@ retry:
Assert(waitfor);
w = WaitLatchOrSocket(MyLatch,
WL_LATCH_SET | waitfor,
WL_LATCH_SET | WL_POSTMASTER_DEATH | waitfor,
port->sock, 0);
/* See comments in secure_read. */
if (w & WL_POSTMASTER_DEATH)
ereport(FATAL,
(errcode(ERRCODE_ADMIN_SHUTDOWN),
errmsg("terminating connection due to unexpected postmaster exit")));
/* Handle interrupt. */
if (w & WL_LATCH_SET)
{