Fix MarkBufferDirtyHint() to not call GetBufferDescriptor() for local buffers

GetBufferDescriptor() was called before checking if the buffer is local.
Such buffers have a negative ID, meaning that we could call
GetBufferDescriptor() with a wrapped-around uint32 value causing a
potential out-of-bound access to the BufferDescriptors array.

This is harmless in the existing code for the current uses of
MarkBufferDirtyHint(), but the author has found a way to make that
buggy while working on a different patch set, and the order of the
operations is wrong.

Oversight in 82467f627b.  No backpatch is required, as this is new to
v19.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Discussion: https://postgr.es/m/CAExHW5uzRMYVZsXXS3HXXT0fG_sNrpUhUqwP4NorhaCqH9JDhA@mail.gmail.com
This commit is contained in:
Michael Paquier 2026-06-10 13:49:26 +09:00
parent b70d5672d0
commit e18b0cb734

View file

@ -5831,8 +5831,6 @@ MarkBufferDirtyHint(Buffer buffer, bool buffer_std)
{
BufferDesc *bufHdr;
bufHdr = GetBufferDescriptor(buffer - 1);
if (!BufferIsValid(buffer))
elog(ERROR, "bad buffer ID: %d", buffer);
@ -5842,6 +5840,8 @@ MarkBufferDirtyHint(Buffer buffer, bool buffer_std)
return;
}
bufHdr = GetBufferDescriptor(buffer - 1);
MarkSharedBufferDirtyHint(buffer, bufHdr,
pg_atomic_read_u64(&bufHdr->state),
buffer_std);