brin: Don't crash on auto-summarization

We were trying to free a pointer into a shared buffer, which never
works; and we were failing to release the buffer lock appropriately.
Fix those omissions.

While at it, improve documentation for brinGetTupleForHeapBlock, the
inadequacy of which evidently caused these bugs in the first place.

Reported independently by Zhou Digoal (bug #14668) and Alexander Sosna.

Discussion: https://postgr.es/m/8c31c11b-6adb-228d-22c2-4ace89fc9209@credativ.de
Discussion: https://postgr.es/m/20170524063323.29941.46339@wrigleys.postgresql.org
This commit is contained in:
Alvaro Herrera 2017-05-30 17:32:53 -04:00
parent e6785a5ca1
commit b4da9d0e1e
2 changed files with 10 additions and 6 deletions

View File

@ -190,7 +190,8 @@ brininsert(Relation idxRel, Datum *values, bool *nulls,
AutoVacuumRequestWork(AVW_BRINSummarizeRange,
RelationGetRelid(idxRel),
lastPageRange);
brin_free_tuple(lastPageTuple);
else
LockBuffer(buf, BUFFER_LOCK_UNLOCK);
}
brtup = brinGetTupleForHeapBlock(revmap, heapBlk, &buf, &off,

View File

@ -179,13 +179,16 @@ brinSetHeapBlockItemptr(Buffer buf, BlockNumber pagesPerRange,
/*
* Fetch the BrinTuple for a given heap block.
*
* The buffer containing the tuple is locked, and returned in *buf. As an
* optimization, the caller can pass a pinned buffer *buf on entry, which will
* avoid a pin-unpin cycle when the next tuple is on the same page as a
* previous one.
* The buffer containing the tuple is locked, and returned in *buf. The
* returned tuple points to the shared buffer and must not be freed; if caller
* wants to use it after releasing the buffer lock, it must create its own
* palloc'ed copy. As an optimization, the caller can pass a pinned buffer
* *buf on entry, which will avoid a pin-unpin cycle when the next tuple is on
* the same page as a previous one.
*
* If no tuple is found for the given heap range, returns NULL. In that case,
* *buf might still be updated, but it's not locked.
* *buf might still be updated (and pin must be released by caller), but it's
* not locked.
*
* The output tuple offset within the buffer is returned in *off, and its size
* is returned in *size.