ORCA: Fix use-after-free in CXformSplitWindowFunc#1853
Open
zhangwenchao-123 wants to merge 1 commit into
Open
Conversation
CXformSplitWindowFunc::Transform() builds a local and a global CLogicalSequenceProject, and each constructor takes ownership of one reference to the window's distribution spec (pds), order specs (pdrgpos) and frames (pdrgpwf). Only a single AddRef() was issued for each object, so once both SequenceProjects and the original are released the reference count underflows and the objects are freed while still in use. The dangling memory later surfaces as a corrupt (unaligned) scalar DXL node while translating a table scan filter, crashing the coordinator with SIGSEGV at CTranslatorDXLToScalar.cpp:111 during DXL-to-PlStmt translation. This reproduces on window-function queries (e.g. TPC-DS query 44) when optimizer_force_split_window_function is on; the transform is only enabled under that GUC, which is why the crash disappears when it is off. Add the missing AddRef() for pds, pdrgpos and pdrgpwf before building the global SequenceProject, and for the Select operator and its scalar comparison before reusing them in the global Select, so every owner holds its own reference.
zhangwenchao-123
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CXformSplitWindowFunc::Transform() builds a local and a global CLogicalSequenceProject, and each constructor takes ownership of one reference to the window's distribution spec (pds), order specs (pdrgpos) and frames (pdrgpwf). Only a single AddRef() was issued for each object, so once both SequenceProjects and the original are released the reference count underflows and the objects are freed while still in use.
The dangling memory later surfaces as a corrupt (unaligned) scalar DXL node while translating a table scan filter, crashing the coordinator with SIGSEGV at CTranslatorDXLToScalar.cpp:111 during DXL-to-PlStmt translation. This reproduces on window-function queries (e.g. TPC-DS query 44) when optimizer_force_split_window_function is on; the transform is only enabled under that GUC, which is why the crash disappears when it is off.
Add the missing AddRef() for pds, pdrgpos and pdrgpwf before building the global SequenceProject, and for the Select operator and its scalar comparison before reusing them in the global Select, so every owner holds its own reference.
Fixes #ISSUE_Number
What does this PR do?
Type of Change
Breaking Changes
Test Plan
make installcheckmake -C src/test installcheck-cbdb-parallelImpact
Performance:
User-facing changes:
Dependencies:
Checklist
Additional Context
CI Skip Instructions