Fix corruption of local buffer state during extend of temp relation

A typo has been introduced by 31966b151e6a when updating the state of a
local buffer when a temporary relation is extended, for the case of a
block included in the relation range extended, when it is already found
in the hash table holding the local buffers.  In this case, BM_VALID
should be cleared, but the buffer state was changed so as BM_VALID
remained while clearing the other flags.

As reported on the thread, it was possible to corrupt the state of the
local buffers on ENOSPC, but the states would be corrupted on any kind
of ERROR during the relation extend (like partial writes or some other
errno).

Reported-by: Alexander Lakhin
Author: Tender Wang
Reviewed-by: Richard Guo, Alexander Lakhin, Michael Paquier
Discussion: https://postgr.es/m/18259-6e256429825dd435@postgresql.org
Backpatch-through: 16

diff --git a/src/backend/storage/buffer/localbuf.c b/src/backend/storage/buffer/localbuf.c
index 5a195c0d596612e563fbed9f293656f561a7cdba..1be4f4f8dafd66d31f519f272f1c7ae18a5ca675 100644 (file)
--- a/src/backend/storage/buffer/localbuf.c
+++ b/src/backend/storage/buffer/localbuf.c
@@ -380,7 +380,7 @@ ExtendBufferedRelLocal(BufferManagerRelation bmr,
                        hash_search(LocalBufHash, (void *) &tag, HASH_ENTER, &found);
                if (found)
                {
-                       BufferDesc *existing_hdr = GetLocalBufferDescriptor(hresult->id);
+                       BufferDesc *existing_hdr;
                        uint32          buf_state;
 
                        UnpinLocalBuffer(BufferDescriptorGetBuffer(victim_buf_hdr));
@@ -392,7 +392,7 @@ ExtendBufferedRelLocal(BufferManagerRelation bmr,
                        buf_state = pg_atomic_read_u32(&existing_hdr->state);
                        Assert(buf_state & BM_TAG_VALID);
                        Assert(!(buf_state & BM_DIRTY));
-                       buf_state &= BM_VALID;
+                       buf_state &= ~BM_VALID;
                        pg_atomic_unlocked_write_u32(&existing_hdr->state, buf_state);
                }
                else