Fix potential crash after constraint violation errors in partitioned tables.

During the reporting of constraint violations for partitioned tables,
ExecPartitionCheckEmitError(), ExecConstraints(),
ExecWithCheckOptions() set the slot descriptor of the input slot to
the root partition's tuple desc.  That's generally problematic when
the slot could be used by other routines, but can cause crashes after
the introduction of slots with "fixed" tuple descriptors in
ad7dbee368a.

The problem likely escaped detection so far for two reasons: First,
currently the only known way that these routines are used with a
partitioned table that is not "owned" by partitioning code is when
"fast defaults" are used for the child partition. Second, as an error
is raised afterwards, an "external" slot that had its descriptor
changed, is very unlikely to continue being used.

Even though the issue currently is only known to cause a crash for
11 (as that has both fast defaults and "fixed" slot descriptors), it
seems worth applying the fix to 10 too. Potentially changing random
slots is hazardous.

Regression tests will be added in a separate commit, as it seems best
to add them for master and 12 too.

Reported-By: Daniel WM
Author: Andres Freund
Bug: #16293
Discussion: https://postgr.es/m/16293-26f5777d10143a66@postgresql.org
Backpatch: 11, 10 only

diff --git a/src/backend/executor/execMain.c b/src/backend/executor/execMain.c
index 6c6d098e54c30a09099db59d0c8d3a80503b38cd..9ce8c87d99505e0fb6d22fda53bd3d8425a6f394 100644 (file)
--- a/src/backend/executor/execMain.c
+++ b/src/backend/executor/execMain.c
@@ -1917,6 +1917,8 @@ ExecPartitionCheck(ResultRelInfo *resultRelInfo, TupleTableSlot *slot,
            if (map != NULL)
            {
                tuple = do_convert_tuple(tuple, map);
+               /* one off slot for building error message */
+               slot = MakeTupleTableSlot();
                ExecSetSlotDescriptor(slot, tupdesc);
                ExecStoreTuple(tuple, slot, InvalidBuffer, false);
            }
@@ -1995,6 +1997,8 @@ ExecConstraints(ResultRelInfo *resultRelInfo,
                    if (map != NULL)
                    {
                        tuple = do_convert_tuple(tuple, map);
+                       /* one off slot for building error message */
+                       slot = MakeTupleTableSlot();
                        ExecSetSlotDescriptor(slot, tupdesc);
                        ExecStoreTuple(tuple, slot, InvalidBuffer, false);
                    }
@@ -2043,6 +2047,8 @@ ExecConstraints(ResultRelInfo *resultRelInfo,
                if (map != NULL)
                {
                    tuple = do_convert_tuple(tuple, map);
+                   /* one off slot for building error message */
+                   slot = MakeTupleTableSlot();
                    ExecSetSlotDescriptor(slot, tupdesc);
                    ExecStoreTuple(tuple, slot, InvalidBuffer, false);
                }
@@ -2153,6 +2159,8 @@ ExecWithCheckOptions(WCOKind kind, ResultRelInfo *resultRelInfo,
                        if (map != NULL)
                        {
                            tuple = do_convert_tuple(tuple, map);
+                           /* one off slot for building error message */
+                           slot = MakeTupleTableSlot();
                            ExecSetSlotDescriptor(slot, tupdesc);
                            ExecStoreTuple(tuple, slot, InvalidBuffer, false);
                        }