Fix possible NULL pointer dereference in GetNamedDSMSegment().

GetNamedDSMSegment() doesn't check whether dsm_attach() returns
NULL, which creates the possibility of a NULL pointer dereference
soon after.  To fix, emit an ERROR if dsm_attach() returns NULL.
This shouldn't happen, but it would be nice to avoid a segfault if
it does.  In passing, tidy up the surrounding code.

Reported-by: Tom Lane
Reviewed-by: Michael Paquier, Bharath Rupireddy
Discussion: https://postgr.es/m/3348869.1705854106%40sss.pgh.pa.us

diff --git a/src/backend/storage/ipc/dsm_registry.c b/src/backend/storage/ipc/dsm_registry.c
index ac11f51375e764a3f601c37233ed2a285ce60584..c17817365325bec99727df9a3b6def1b938cc83f 100644 (file)
--- a/src/backend/storage/ipc/dsm_registry.c
+++ b/src/backend/storage/ipc/dsm_registry.c
@@ -177,19 +177,22 @@ GetNamedDSMSegment(const char *name, size_t size,
                                (errmsg("requested DSM segment size does not match size of "
                                                "existing segment")));
        }
-       else if (!dsm_find_mapping(entry->handle))
+       else
        {
-               /* Attach to existing segment. */
-               dsm_segment *seg = dsm_attach(entry->handle);
+               dsm_segment *seg = dsm_find_mapping(entry->handle);
+
+               /* If the existing segment is not already attached, attach it now. */
+               if (seg == NULL)
+               {
+                       seg = dsm_attach(entry->handle);
+                       if (seg == NULL)
+                               elog(ERROR, "could not map dynamic shared memory segment");
+
+                       dsm_pin_mapping(seg);
+               }
 
-               dsm_pin_mapping(seg);
                ret = dsm_segment_address(seg);
        }
-       else
-       {
-               /* Return address of an already-attached segment. */
-               ret = dsm_segment_address(dsm_find_mapping(entry->handle));
-       }
 
        dshash_release_lock(dsm_registry_table, entry);
        MemoryContextSwitchTo(oldcontext);