From f833c92077a1ba7fd8bb5d51dc466409e2fd33b0 Mon Sep 17 00:00:00 2001 From: Fujii Masao Date: Wed, 3 Jun 2026 18:46:49 +0900 Subject: [PATCH] Fix race in ReplicationSlotRelease() for ephemeral slots When releasing an ephemeral replication slot, ReplicationSlotRelease() drops the slot via ReplicationSlotDropAcquired(). However, after dropping the slot, ReplicationSlotRelease() continued to use its local "slot" pointer, which still referenced the dropped slot's former shared-memory entry. It could then update fields such as effective_xmin in that entry. Once an ephemeral slot has been dropped (via ReplicationSlotDropAcquired()), its slot array entry can be reused immediately by another backend creating a new slot. As a result, those updates could corrupt the state of an unrelated replication slot. Fix by skipping those shared-memory updates for phemeral slots and performing them only for non-ephemeral slots, whose shared-memory entries remain valid after release. Backpatch to all supported versions. Author: Zhijie Hou Reviewed-by: Masao Fujii Reviewed-by: Srinath Reddy Sadipiralla Reviewed-by: Xuneng Zhou Discussion: https://postgr.es/m/TY4PR01MB177184FF9EE916F577E1F554194082@TY4PR01MB17718.jpnprd01.prod.outlook.com Backpatch-through: 14 --- src/backend/replication/slot.c | 68 +++++++++++++++++----------------- 1 file changed, 35 insertions(+), 33 deletions(-) diff --git a/src/backend/replication/slot.c b/src/backend/replication/slot.c index 4246d0a51e1..e60ccc424dd 100644 --- a/src/backend/replication/slot.c +++ b/src/backend/replication/slot.c @@ -737,44 +737,46 @@ ReplicationSlotRelease(void) */ ReplicationSlotDropAcquired(); } - - /* - * If slot needed to temporarily restrain both data and catalog xmin to - * create the catalog snapshot, remove that temporary constraint. - * Snapshots can only be exported while the initial snapshot is still - * acquired. - */ - if (!TransactionIdIsValid(slot->data.xmin) && - TransactionIdIsValid(slot->effective_xmin)) + else { - SpinLockAcquire(&slot->mutex); - slot->effective_xmin = InvalidTransactionId; - SpinLockRelease(&slot->mutex); - ReplicationSlotsComputeRequiredXmin(false); - } - - /* - * Set the time since the slot has become inactive. We get the current - * time beforehand to avoid system call while holding the spinlock. - */ - now = GetCurrentTimestamp(); + /* + * If slot needed to temporarily restrain both data and catalog xmin + * to create the catalog snapshot, remove that temporary constraint. + * Snapshots can only be exported while the initial snapshot is still + * acquired. + */ + if (!TransactionIdIsValid(slot->data.xmin) && + TransactionIdIsValid(slot->effective_xmin)) + { + SpinLockAcquire(&slot->mutex); + slot->effective_xmin = InvalidTransactionId; + SpinLockRelease(&slot->mutex); + ReplicationSlotsComputeRequiredXmin(false); + } - if (slot->data.persistency == RS_PERSISTENT) - { /* - * Mark persistent slot inactive. We're not freeing it, just - * disconnecting, but wake up others that may be waiting for it. + * Set the time since the slot has become inactive. We get the current + * time beforehand to avoid system call while holding the spinlock. */ - SpinLockAcquire(&slot->mutex); - slot->active_pid = 0; - ReplicationSlotSetInactiveSince(slot, now, false); - SpinLockRelease(&slot->mutex); - ConditionVariableBroadcast(&slot->active_cv); - } - else - ReplicationSlotSetInactiveSince(slot, now, true); + now = GetCurrentTimestamp(); - MyReplicationSlot = NULL; + if (slot->data.persistency == RS_PERSISTENT) + { + /* + * Mark persistent slot inactive. We're not freeing it, just + * disconnecting, but wake up others that may be waiting for it. + */ + SpinLockAcquire(&slot->mutex); + slot->active_pid = 0; + ReplicationSlotSetInactiveSince(slot, now, false); + SpinLockRelease(&slot->mutex); + ConditionVariableBroadcast(&slot->active_cv); + } + else + ReplicationSlotSetInactiveSince(slot, now, true); + + MyReplicationSlot = NULL; + } /* might not have been set when we've been a plain slot */ LWLockAcquire(ProcArrayLock, LW_EXCLUSIVE); -- 2.47.3