Fix potential crash after constraint violation errors in partitioned tables.

During the reporting of constraint violations for partitioned tables,
ExecPartitionCheckEmitError(), ExecConstraints(),
ExecWithCheckOptions() set the slot descriptor of the input slot to
the root partition's tuple desc.  That's generally problematic when
the slot could be used by other routines, but can cause crashes after
the introduction of slots with "fixed" tuple descriptors in
ad7dbee368a.

The problem likely escaped detection so far for two reasons: First,
currently the only known way that these routines are used with a
partitioned table that is not "owned" by partitioning code is when
"fast defaults" are used for the child partition. Second, as an error
is raised afterwards, an "external" slot that had its descriptor
changed, is very unlikely to continue being used.

Even though the issue currently is only known to cause a crash for
11 (as that has both fast defaults and "fixed" slot descriptors), it
seems worth applying the fix to 10 too. Potentially changing random
slots is hazardous.

Regression tests will be added in a separate commit, as it seems best
to add them for master and 12 too.

Reported-By: Daniel WM
Author: Andres Freund
Bug: #16293
Discussion: https://postgr.es/m/16293-26f5777d10143a66@postgresql.org
Backpatch: 11, 10 only

diff --git a/src/backend/executor/execMain.c b/src/backend/executor/execMain.c
index 66cac46acf73280cac4dcf621f4a50d9d1ded931..8daf0fe9330681cc23a1d7730a2d5b0f67736fd4 100644 (file)
--- a/src/backend/executor/execMain.c
+++ b/src/backend/executor/execMain.c
@@ -1932,7 +1932,8 @@ ExecPartitionCheckEmitError(ResultRelInfo *resultRelInfo,
        if (map != NULL)
        {
            tuple = do_convert_tuple(tuple, map);
-           ExecSetSlotDescriptor(slot, tupdesc);
+           /* one off slot for building error message */
+           slot = MakeTupleTableSlot(tupdesc);
            ExecStoreTuple(tuple, slot, InvalidBuffer, false);
        }
    }
@@ -2011,7 +2012,8 @@ ExecConstraints(ResultRelInfo *resultRelInfo,
                    if (map != NULL)
                    {
                        tuple = do_convert_tuple(tuple, map);
-                       ExecSetSlotDescriptor(slot, tupdesc);
+                       /* one off slot for building error message */
+                       slot = MakeTupleTableSlot(tupdesc);
                        ExecStoreTuple(tuple, slot, InvalidBuffer, false);
                    }
                }
@@ -2059,7 +2061,8 @@ ExecConstraints(ResultRelInfo *resultRelInfo,
                if (map != NULL)
                {
                    tuple = do_convert_tuple(tuple, map);
-                   ExecSetSlotDescriptor(slot, tupdesc);
+                   /* one off slot for building error message */
+                   slot = MakeTupleTableSlot(tupdesc);
                    ExecStoreTuple(tuple, slot, InvalidBuffer, false);
                }
            }
@@ -2165,7 +2168,8 @@ ExecWithCheckOptions(WCOKind kind, ResultRelInfo *resultRelInfo,
                        if (map != NULL)
                        {
                            tuple = do_convert_tuple(tuple, map);
-                           ExecSetSlotDescriptor(slot, tupdesc);
+                           /* one off slot for building error message */
+                           slot = MakeTupleTableSlot(tupdesc);
                            ExecStoreTuple(tuple, slot, InvalidBuffer, false);
                        }
                    }