2014-11-21 12:46:50 +03:00
|
|
|
/*
|
|
|
|
* ginfuncs.c
|
|
|
|
* Functions to investigate the content of GIN indexes
|
|
|
|
*
|
2022-01-08 03:04:57 +03:00
|
|
|
* Copyright (c) 2014-2022, PostgreSQL Global Development Group
|
2014-11-21 12:46:50 +03:00
|
|
|
*
|
|
|
|
* IDENTIFICATION
|
|
|
|
* contrib/pageinspect/ginfuncs.c
|
|
|
|
*/
|
|
|
|
#include "postgres.h"
|
|
|
|
|
|
|
|
#include "access/gin.h"
|
|
|
|
#include "access/gin_private.h"
|
|
|
|
#include "access/htup_details.h"
|
|
|
|
#include "catalog/namespace.h"
|
|
|
|
#include "catalog/pg_type.h"
|
|
|
|
#include "funcapi.h"
|
|
|
|
#include "miscadmin.h"
|
2019-10-23 06:56:22 +03:00
|
|
|
#include "pageinspect.h"
|
2014-11-21 12:46:50 +03:00
|
|
|
#include "utils/array.h"
|
|
|
|
#include "utils/builtins.h"
|
|
|
|
#include "utils/rel.h"
|
|
|
|
|
|
|
|
#define DatumGetItemPointer(X) ((ItemPointer) DatumGetPointer(X))
|
|
|
|
#define ItemPointerGetDatum(X) PointerGetDatum(X)
|
|
|
|
|
|
|
|
|
|
|
|
PG_FUNCTION_INFO_V1(gin_metapage_info);
|
|
|
|
PG_FUNCTION_INFO_V1(gin_page_opaque_info);
|
|
|
|
PG_FUNCTION_INFO_V1(gin_leafpage_items);
|
|
|
|
|
2016-11-04 19:00:00 +03:00
|
|
|
|
2014-11-21 12:46:50 +03:00
|
|
|
Datum
|
|
|
|
gin_metapage_info(PG_FUNCTION_ARGS)
|
|
|
|
{
|
|
|
|
bytea *raw_page = PG_GETARG_BYTEA_P(0);
|
|
|
|
TupleDesc tupdesc;
|
|
|
|
Page page;
|
|
|
|
GinPageOpaque opaq;
|
|
|
|
GinMetaPageData *metadata;
|
|
|
|
HeapTuple resultTuple;
|
|
|
|
Datum values[10];
|
|
|
|
bool nulls[10];
|
|
|
|
|
|
|
|
if (!superuser())
|
|
|
|
ereport(ERROR,
|
|
|
|
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
|
2020-01-30 19:32:04 +03:00
|
|
|
errmsg("must be superuser to use raw page functions")));
|
2014-11-21 12:46:50 +03:00
|
|
|
|
2016-11-04 19:00:00 +03:00
|
|
|
page = get_page_from_raw(raw_page);
|
2014-11-21 12:46:50 +03:00
|
|
|
|
pageinspect: Add more sanity checks to prevent out-of-bound reads
A couple of code paths use the special area on the page passed by the
function caller, expecting to find some data in it. However, feeding
an incorrect page can lead to out-of-bound reads when trying to access
the page special area (like a heap page that has no special area,
leading PageGetSpecialPointer() to grab a pointer outside the allocated
page).
The functions used for hash and btree indexes have some protection
already against that, while some other functions using a relation OID
as argument would make sure that the access method involved is correct,
but functions taking in input a raw page without knowing the relation
the page is attached to would run into problems.
This commit improves the set of checks used in the code paths of BRIN,
btree (including one check if a leaf page is found with a non-zero
level), GIN and GiST to verify that the page given in input has a
special area size that fits with each access method, which is done
though PageGetSpecialSize(), becore calling PageGetSpecialPointer().
The scope of the checks done is limited to work with pages that one
would pass after getting a block with get_raw_page(), as it is possible
to craft byteas that could bypass existing code paths. Having too many
checks would also impact the usability of pageinspect, as the existing
code is very useful to look at the content details in a corrupted page,
so the focus is really to avoid out-of-bound reads as this is never a
good thing even with functions whose execution is limited to
superusers.
The safest approach could be to rework the functions so as these fetch a
block using a relation OID and a block number, but there are also cases
where using a raw page is useful.
Tests are added to cover all the code paths that needed such checks, and
an error message for hash indexes is reworded to fit better with what
this commit adds.
Reported-By: Alexander Lakhin
Author: Julien Rouhaud, Michael Paquier
Discussion: https://postgr.es/m/16527-ef7606186f0610a1@postgresql.org
Discussion: https://postgr.es/m/561e187b-3549-c8d5-03f5-525c14e65bd0@postgrespro.ru
Backpatch-through: 10
2022-03-27 11:53:40 +03:00
|
|
|
if (PageGetSpecialSize(page) != MAXALIGN(sizeof(GinPageOpaqueData)))
|
|
|
|
ereport(ERROR,
|
|
|
|
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
|
|
|
|
errmsg("input page is not a valid GIN metapage"),
|
|
|
|
errdetail("Expected special size %d, got %d.",
|
|
|
|
(int) MAXALIGN(sizeof(GinPageOpaqueData)),
|
|
|
|
(int) PageGetSpecialSize(page))));
|
|
|
|
|
2022-04-02 05:27:20 +03:00
|
|
|
opaq = GinPageGetOpaque(page);
|
2014-11-21 12:46:50 +03:00
|
|
|
if (opaq->flags != GIN_META)
|
|
|
|
ereport(ERROR,
|
|
|
|
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
|
|
|
|
errmsg("input page is not a GIN metapage"),
|
|
|
|
errdetail("Flags %04X, expected %04X",
|
|
|
|
opaq->flags, GIN_META)));
|
|
|
|
|
|
|
|
/* Build a tuple descriptor for our result type */
|
|
|
|
if (get_call_result_type(fcinfo, NULL, &tupdesc) != TYPEFUNC_COMPOSITE)
|
|
|
|
elog(ERROR, "return type must be a row type");
|
|
|
|
|
|
|
|
metadata = GinPageGetMeta(page);
|
|
|
|
|
|
|
|
memset(nulls, 0, sizeof(nulls));
|
|
|
|
|
|
|
|
values[0] = Int64GetDatum(metadata->head);
|
|
|
|
values[1] = Int64GetDatum(metadata->tail);
|
|
|
|
values[2] = Int32GetDatum(metadata->tailFreeSize);
|
|
|
|
values[3] = Int64GetDatum(metadata->nPendingPages);
|
|
|
|
values[4] = Int64GetDatum(metadata->nPendingHeapTuples);
|
|
|
|
|
|
|
|
/* statistics, updated by VACUUM */
|
|
|
|
values[5] = Int64GetDatum(metadata->nTotalPages);
|
|
|
|
values[6] = Int64GetDatum(metadata->nEntryPages);
|
|
|
|
values[7] = Int64GetDatum(metadata->nDataPages);
|
|
|
|
values[8] = Int64GetDatum(metadata->nEntries);
|
|
|
|
|
|
|
|
values[9] = Int32GetDatum(metadata->ginVersion);
|
|
|
|
|
|
|
|
/* Build and return the result tuple. */
|
|
|
|
resultTuple = heap_form_tuple(tupdesc, values, nulls);
|
|
|
|
|
|
|
|
return HeapTupleGetDatum(resultTuple);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
Datum
|
|
|
|
gin_page_opaque_info(PG_FUNCTION_ARGS)
|
|
|
|
{
|
|
|
|
bytea *raw_page = PG_GETARG_BYTEA_P(0);
|
|
|
|
TupleDesc tupdesc;
|
|
|
|
Page page;
|
|
|
|
GinPageOpaque opaq;
|
|
|
|
HeapTuple resultTuple;
|
|
|
|
Datum values[3];
|
2016-11-02 07:09:27 +03:00
|
|
|
bool nulls[3];
|
2014-11-21 12:46:50 +03:00
|
|
|
Datum flags[16];
|
|
|
|
int nflags = 0;
|
|
|
|
uint16 flagbits;
|
|
|
|
|
|
|
|
if (!superuser())
|
|
|
|
ereport(ERROR,
|
|
|
|
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
|
2020-01-30 19:32:04 +03:00
|
|
|
errmsg("must be superuser to use raw page functions")));
|
2014-11-21 12:46:50 +03:00
|
|
|
|
2016-11-04 19:00:00 +03:00
|
|
|
page = get_page_from_raw(raw_page);
|
2014-11-21 12:46:50 +03:00
|
|
|
|
pageinspect: Add more sanity checks to prevent out-of-bound reads
A couple of code paths use the special area on the page passed by the
function caller, expecting to find some data in it. However, feeding
an incorrect page can lead to out-of-bound reads when trying to access
the page special area (like a heap page that has no special area,
leading PageGetSpecialPointer() to grab a pointer outside the allocated
page).
The functions used for hash and btree indexes have some protection
already against that, while some other functions using a relation OID
as argument would make sure that the access method involved is correct,
but functions taking in input a raw page without knowing the relation
the page is attached to would run into problems.
This commit improves the set of checks used in the code paths of BRIN,
btree (including one check if a leaf page is found with a non-zero
level), GIN and GiST to verify that the page given in input has a
special area size that fits with each access method, which is done
though PageGetSpecialSize(), becore calling PageGetSpecialPointer().
The scope of the checks done is limited to work with pages that one
would pass after getting a block with get_raw_page(), as it is possible
to craft byteas that could bypass existing code paths. Having too many
checks would also impact the usability of pageinspect, as the existing
code is very useful to look at the content details in a corrupted page,
so the focus is really to avoid out-of-bound reads as this is never a
good thing even with functions whose execution is limited to
superusers.
The safest approach could be to rework the functions so as these fetch a
block using a relation OID and a block number, but there are also cases
where using a raw page is useful.
Tests are added to cover all the code paths that needed such checks, and
an error message for hash indexes is reworded to fit better with what
this commit adds.
Reported-By: Alexander Lakhin
Author: Julien Rouhaud, Michael Paquier
Discussion: https://postgr.es/m/16527-ef7606186f0610a1@postgresql.org
Discussion: https://postgr.es/m/561e187b-3549-c8d5-03f5-525c14e65bd0@postgrespro.ru
Backpatch-through: 10
2022-03-27 11:53:40 +03:00
|
|
|
if (PageGetSpecialSize(page) != MAXALIGN(sizeof(GinPageOpaqueData)))
|
|
|
|
ereport(ERROR,
|
|
|
|
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
|
|
|
|
errmsg("input page is not a valid GIN data leaf page"),
|
|
|
|
errdetail("Expected special size %d, got %d.",
|
|
|
|
(int) MAXALIGN(sizeof(GinPageOpaqueData)),
|
|
|
|
(int) PageGetSpecialSize(page))));
|
|
|
|
|
2022-04-02 05:27:20 +03:00
|
|
|
opaq = GinPageGetOpaque(page);
|
2014-11-21 12:46:50 +03:00
|
|
|
|
|
|
|
/* Build a tuple descriptor for our result type */
|
|
|
|
if (get_call_result_type(fcinfo, NULL, &tupdesc) != TYPEFUNC_COMPOSITE)
|
|
|
|
elog(ERROR, "return type must be a row type");
|
|
|
|
|
|
|
|
/* Convert the flags bitmask to an array of human-readable names */
|
|
|
|
flagbits = opaq->flags;
|
|
|
|
if (flagbits & GIN_DATA)
|
|
|
|
flags[nflags++] = CStringGetTextDatum("data");
|
|
|
|
if (flagbits & GIN_LEAF)
|
|
|
|
flags[nflags++] = CStringGetTextDatum("leaf");
|
|
|
|
if (flagbits & GIN_DELETED)
|
|
|
|
flags[nflags++] = CStringGetTextDatum("deleted");
|
|
|
|
if (flagbits & GIN_META)
|
|
|
|
flags[nflags++] = CStringGetTextDatum("meta");
|
|
|
|
if (flagbits & GIN_LIST)
|
|
|
|
flags[nflags++] = CStringGetTextDatum("list");
|
|
|
|
if (flagbits & GIN_LIST_FULLROW)
|
|
|
|
flags[nflags++] = CStringGetTextDatum("list_fullrow");
|
|
|
|
if (flagbits & GIN_INCOMPLETE_SPLIT)
|
|
|
|
flags[nflags++] = CStringGetTextDatum("incomplete_split");
|
|
|
|
if (flagbits & GIN_COMPRESSED)
|
|
|
|
flags[nflags++] = CStringGetTextDatum("compressed");
|
|
|
|
flagbits &= ~(GIN_DATA | GIN_LEAF | GIN_DELETED | GIN_META | GIN_LIST |
|
|
|
|
GIN_LIST_FULLROW | GIN_INCOMPLETE_SPLIT | GIN_COMPRESSED);
|
|
|
|
if (flagbits)
|
|
|
|
{
|
|
|
|
/* any flags we don't recognize are printed in hex */
|
|
|
|
flags[nflags++] = DirectFunctionCall1(to_hex32, Int32GetDatum(flagbits));
|
|
|
|
}
|
|
|
|
|
|
|
|
memset(nulls, 0, sizeof(nulls));
|
|
|
|
|
|
|
|
values[0] = Int64GetDatum(opaq->rightlink);
|
2016-11-02 07:09:27 +03:00
|
|
|
values[1] = Int32GetDatum(opaq->maxoff);
|
|
|
|
values[2] = PointerGetDatum(construct_array(flags, nflags,
|
2020-03-04 18:34:25 +03:00
|
|
|
TEXTOID,
|
|
|
|
-1, false, TYPALIGN_INT));
|
2014-11-21 12:46:50 +03:00
|
|
|
|
|
|
|
/* Build and return the result tuple. */
|
|
|
|
resultTuple = heap_form_tuple(tupdesc, values, nulls);
|
|
|
|
|
|
|
|
return HeapTupleGetDatum(resultTuple);
|
|
|
|
}
|
|
|
|
|
|
|
|
typedef struct gin_leafpage_items_state
|
|
|
|
{
|
|
|
|
TupleDesc tupd;
|
|
|
|
GinPostingList *seg;
|
|
|
|
GinPostingList *lastseg;
|
|
|
|
} gin_leafpage_items_state;
|
|
|
|
|
|
|
|
Datum
|
|
|
|
gin_leafpage_items(PG_FUNCTION_ARGS)
|
|
|
|
{
|
|
|
|
bytea *raw_page = PG_GETARG_BYTEA_P(0);
|
|
|
|
FuncCallContext *fctx;
|
|
|
|
gin_leafpage_items_state *inter_call_data;
|
|
|
|
|
|
|
|
if (!superuser())
|
|
|
|
ereport(ERROR,
|
|
|
|
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
|
2020-01-30 19:32:04 +03:00
|
|
|
errmsg("must be superuser to use raw page functions")));
|
2014-11-21 12:46:50 +03:00
|
|
|
|
|
|
|
if (SRF_IS_FIRSTCALL())
|
|
|
|
{
|
|
|
|
TupleDesc tupdesc;
|
|
|
|
MemoryContext mctx;
|
|
|
|
Page page;
|
|
|
|
GinPageOpaque opaq;
|
|
|
|
|
2016-11-04 19:11:47 +03:00
|
|
|
fctx = SRF_FIRSTCALL_INIT();
|
|
|
|
mctx = MemoryContextSwitchTo(fctx->multi_call_memory_ctx);
|
|
|
|
|
2016-11-04 19:00:00 +03:00
|
|
|
page = get_page_from_raw(raw_page);
|
2014-11-21 12:46:50 +03:00
|
|
|
|
|
|
|
if (PageGetSpecialSize(page) != MAXALIGN(sizeof(GinPageOpaqueData)))
|
|
|
|
ereport(ERROR,
|
|
|
|
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
|
|
|
|
errmsg("input page is not a valid GIN data leaf page"),
|
pageinspect: Add more sanity checks to prevent out-of-bound reads
A couple of code paths use the special area on the page passed by the
function caller, expecting to find some data in it. However, feeding
an incorrect page can lead to out-of-bound reads when trying to access
the page special area (like a heap page that has no special area,
leading PageGetSpecialPointer() to grab a pointer outside the allocated
page).
The functions used for hash and btree indexes have some protection
already against that, while some other functions using a relation OID
as argument would make sure that the access method involved is correct,
but functions taking in input a raw page without knowing the relation
the page is attached to would run into problems.
This commit improves the set of checks used in the code paths of BRIN,
btree (including one check if a leaf page is found with a non-zero
level), GIN and GiST to verify that the page given in input has a
special area size that fits with each access method, which is done
though PageGetSpecialSize(), becore calling PageGetSpecialPointer().
The scope of the checks done is limited to work with pages that one
would pass after getting a block with get_raw_page(), as it is possible
to craft byteas that could bypass existing code paths. Having too many
checks would also impact the usability of pageinspect, as the existing
code is very useful to look at the content details in a corrupted page,
so the focus is really to avoid out-of-bound reads as this is never a
good thing even with functions whose execution is limited to
superusers.
The safest approach could be to rework the functions so as these fetch a
block using a relation OID and a block number, but there are also cases
where using a raw page is useful.
Tests are added to cover all the code paths that needed such checks, and
an error message for hash indexes is reworded to fit better with what
this commit adds.
Reported-By: Alexander Lakhin
Author: Julien Rouhaud, Michael Paquier
Discussion: https://postgr.es/m/16527-ef7606186f0610a1@postgresql.org
Discussion: https://postgr.es/m/561e187b-3549-c8d5-03f5-525c14e65bd0@postgrespro.ru
Backpatch-through: 10
2022-03-27 11:53:40 +03:00
|
|
|
errdetail("Expected special size %d, got %d.",
|
|
|
|
(int) MAXALIGN(sizeof(GinPageOpaqueData)),
|
|
|
|
(int) PageGetSpecialSize(page))));
|
2014-11-21 12:46:50 +03:00
|
|
|
|
2022-04-02 05:27:20 +03:00
|
|
|
opaq = GinPageGetOpaque(page);
|
2014-11-21 12:46:50 +03:00
|
|
|
if (opaq->flags != (GIN_DATA | GIN_LEAF | GIN_COMPRESSED))
|
|
|
|
ereport(ERROR,
|
|
|
|
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
|
|
|
|
errmsg("input page is not a compressed GIN data leaf page"),
|
|
|
|
errdetail("Flags %04X, expected %04X",
|
|
|
|
opaq->flags,
|
|
|
|
(GIN_DATA | GIN_LEAF | GIN_COMPRESSED))));
|
|
|
|
|
|
|
|
inter_call_data = palloc(sizeof(gin_leafpage_items_state));
|
|
|
|
|
|
|
|
/* Build a tuple descriptor for our result type */
|
|
|
|
if (get_call_result_type(fcinfo, NULL, &tupdesc) != TYPEFUNC_COMPOSITE)
|
|
|
|
elog(ERROR, "return type must be a row type");
|
|
|
|
|
|
|
|
inter_call_data->tupd = tupdesc;
|
|
|
|
|
|
|
|
inter_call_data->seg = GinDataLeafPageGetPostingList(page);
|
|
|
|
inter_call_data->lastseg = (GinPostingList *)
|
|
|
|
(((char *) inter_call_data->seg) +
|
|
|
|
GinDataLeafPageGetPostingListSize(page));
|
|
|
|
|
|
|
|
fctx->user_fctx = inter_call_data;
|
|
|
|
|
|
|
|
MemoryContextSwitchTo(mctx);
|
|
|
|
}
|
|
|
|
|
|
|
|
fctx = SRF_PERCALL_SETUP();
|
|
|
|
inter_call_data = fctx->user_fctx;
|
|
|
|
|
|
|
|
if (inter_call_data->seg != inter_call_data->lastseg)
|
|
|
|
{
|
|
|
|
GinPostingList *cur = inter_call_data->seg;
|
|
|
|
HeapTuple resultTuple;
|
|
|
|
Datum result;
|
|
|
|
Datum values[3];
|
|
|
|
bool nulls[3];
|
|
|
|
int ndecoded,
|
|
|
|
i;
|
|
|
|
ItemPointer tids;
|
|
|
|
Datum *tids_datum;
|
|
|
|
|
|
|
|
memset(nulls, 0, sizeof(nulls));
|
|
|
|
|
|
|
|
values[0] = ItemPointerGetDatum(&cur->first);
|
|
|
|
values[1] = UInt16GetDatum(cur->nbytes);
|
|
|
|
|
|
|
|
/* build an array of decoded item pointers */
|
|
|
|
tids = ginPostingListDecode(cur, &ndecoded);
|
|
|
|
tids_datum = (Datum *) palloc(ndecoded * sizeof(Datum));
|
|
|
|
for (i = 0; i < ndecoded; i++)
|
|
|
|
tids_datum[i] = ItemPointerGetDatum(&tids[i]);
|
|
|
|
values[2] = PointerGetDatum(construct_array(tids_datum,
|
|
|
|
ndecoded,
|
|
|
|
TIDOID,
|
|
|
|
sizeof(ItemPointerData),
|
2020-03-04 18:34:25 +03:00
|
|
|
false, TYPALIGN_SHORT));
|
2014-11-21 12:46:50 +03:00
|
|
|
pfree(tids_datum);
|
|
|
|
pfree(tids);
|
|
|
|
|
|
|
|
/* Build and return the result tuple. */
|
|
|
|
resultTuple = heap_form_tuple(inter_call_data->tupd, values, nulls);
|
|
|
|
result = HeapTupleGetDatum(resultTuple);
|
|
|
|
|
|
|
|
inter_call_data->seg = GinNextPostingListSegment(cur);
|
|
|
|
|
|
|
|
SRF_RETURN_NEXT(fctx, result);
|
|
|
|
}
|
2020-03-17 04:36:53 +03:00
|
|
|
|
|
|
|
SRF_RETURN_DONE(fctx);
|
2014-11-21 12:46:50 +03:00
|
|
|
}
|