Fix unsafe access to BufferDescriptors

When considering a local buffer, the GetBufferDescriptor() call in
BufferGetLSNAtomic() would be retrieving a shared buffer with a bad
buffer ID.  Since the code checks whether the buffer is shared before
using the retrieved BufferDesc, this issue did not lead to any
malfunction.  Nonetheless this seems like trouble waiting to happen,
so fix it by ensuring that GetBufferDescriptor() is only called when
we know the buffer is shared.

Author: Tender Wang <tndrwang@gmail.com>
Reviewed-by: Xuneng Zhou <xunengzhou@gmail.com>
Reviewed-by: Richard Guo <guofenglinux@gmail.com>
Discussion: https://postgr.es/m/CAHewXNku-o46-9cmUgyv6LkSZ25doDrWq32p=oz9kfD8ovVJMg@mail.gmail.com
Backpatch-through: 13

diff --git a/src/backend/storage/buffer/bufmgr.c b/src/backend/storage/buffer/bufmgr.c
index e066a3f888fb794074db6f419db9566a1e246a96..e007bd46e93a0281279ae4eb46d2a01878e1205e 100644 (file)
--- a/src/backend/storage/buffer/bufmgr.c
+++ b/src/backend/storage/buffer/bufmgr.c
@@ -3550,8 +3550,8 @@ BufferIsPermanent(Buffer buffer)
 XLogRecPtr
 BufferGetLSNAtomic(Buffer buffer)
 {
-       BufferDesc *bufHdr = GetBufferDescriptor(buffer - 1);
        char       *page = BufferGetPage(buffer);
+       BufferDesc *bufHdr;
        XLogRecPtr      lsn;
        uint32          buf_state;
 
@@ -3565,6 +3565,7 @@ BufferGetLSNAtomic(Buffer buffer)
        Assert(BufferIsValid(buffer));
        Assert(BufferIsPinned(buffer));
 
+       bufHdr = GetBufferDescriptor(buffer - 1);
        buf_state = LockBufHdr(bufHdr);
        lsn = PageGetLSN(page);
        UnlockBufHdr(bufHdr, buf_state);