Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit ef1b5af

Browse files
committed
Do not let PostmasterContext survive into background workers.
We don't want postmaster child processes to contain a copy of the postmaster's PostmasterContext. That would be a waste of memory at least, and at worst a security issue, since there are copies of the semi-sensitive pg_hba and pg_ident data in there. All other child process types delete the PostmasterContext after forking, but the original coding of the background worker patch (commit da07a1e) did not do so. It appears that the only reason for that was to avoid copying the bgworker's MyBgworkerEntry out of that context; but the couple of additional statements needed to do so are hardly good justification for it. Hence, copy that data and then clear the context as other child processes do. Because this patch changes the memory context in which a bgworker function gains control, back-patching it would be a bit risky, so we won't fix this in back branches. The "security" complaint is pretty thin anyway for generic bgworkers; only with the introduction of parallel query is there any question of running untrusted code in a bgworker process. Discussion: <14111.1470082717@sss.pgh.pa.us>
1 parent 6a9e09c commit ef1b5af

File tree

2 files changed

+20
-7
lines changed

2 files changed

+20
-7
lines changed

src/backend/postmaster/postmaster.c

+14-3
Original file line numberDiff line numberDiff line change
@@ -5181,7 +5181,7 @@ CountChildren(int target)
51815181
/*
51825182
* StartChildProcess -- start an auxiliary process for the postmaster
51835183
*
5184-
* xlop determines what kind of child will be started. All child types
5184+
* "type" determines what kind of child will be started. All child types
51855185
* initially go to AuxiliaryProcessMain, which will handle common setup.
51865186
*
51875187
* Return value of StartChildProcess is subprocess' PID, or 0 if failed
@@ -5529,16 +5529,27 @@ do_start_bgworker(RegisteredBgWorker *rw)
55295529
/* Close the postmaster's sockets */
55305530
ClosePostmasterPorts(false);
55315531

5532-
/* Do NOT release postmaster's working memory context */
5532+
/*
5533+
* Before blowing away PostmasterContext, save this bgworker's
5534+
* data where it can find it.
5535+
*/
5536+
MyBgworkerEntry = (BackgroundWorker *)
5537+
MemoryContextAlloc(TopMemoryContext, sizeof(BackgroundWorker));
5538+
memcpy(MyBgworkerEntry, &rw->rw_worker, sizeof(BackgroundWorker));
5539+
5540+
/* Release postmaster's working memory context */
5541+
MemoryContextSwitchTo(TopMemoryContext);
5542+
MemoryContextDelete(PostmasterContext);
5543+
PostmasterContext = NULL;
55335544

5534-
MyBgworkerEntry = &rw->rw_worker;
55355545
StartBackgroundWorker();
55365546
break;
55375547
#endif
55385548
default:
55395549
rw->rw_pid = worker_pid;
55405550
rw->rw_backend->pid = rw->rw_pid;
55415551
ReportBackgroundWorkerPID(rw);
5552+
break;
55425553
}
55435554
}
55445555

src/backend/utils/mmgr/README

+6-4
Original file line numberDiff line numberDiff line change
@@ -160,10 +160,12 @@ running with CurrentMemoryContext pointing here.
160160
PostmasterContext --- this is the postmaster's normal working context.
161161
After a backend is spawned, it can delete PostmasterContext to free its
162162
copy of memory the postmaster was using that it doesn't need.
163-
(Anything that has to be passed from postmaster to backends is passed
164-
in TopMemoryContext. The postmaster has only TopMemoryContext,
165-
PostmasterContext, and ErrorContext --- the remaining top-level contexts
166-
are set up in each backend during startup.)
163+
Note that in non-EXEC_BACKEND builds, the postmaster's copy of pg_hba.conf
164+
and pg_ident.conf data is used directly during authentication in backend
165+
processes; so backends can't delete PostmasterContext until that's done.
166+
(The postmaster has only TopMemoryContext, PostmasterContext, and
167+
ErrorContext --- the remaining top-level contexts are set up in each
168+
backend during startup.)
167169

168170
CacheMemoryContext --- permanent storage for relcache, catcache, and
169171
related modules. This will never be reset or deleted, either, so it's

0 commit comments

Comments
 (0)