Skip to content

Navigation Menu

Sign in

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 3b8981b

Browse filesBrowse files
macdicemacdice
committed
Fix race in Parallel Hash Join batch cleanup.
With very unlucky timing and parallel_leader_participation off, PHJ could attempt to access per-batch state just as it was being freed. There was code intended to prevent that by checking for a cleared pointer, but it was buggy. Fix, by introducing an extra barrier phase. The new phase PHJ_BUILD_RUNNING means that it's safe to access the per-batch state to find a batch to help with, and PHJ_BUILD_DONE means that it is too late. The last to detach will free the array of per-batch state as before, but now it will also atomically advance the phase at the same time, so that late attachers can avoid the hazard, without the data race. This mirrors the way per-batch hash tables are freed (see phases PHJ_BATCH_PROBING and PHJ_BATCH_DONE). Revealed by a one-off build farm failure, where BarrierAttach() failed a sanity check assertion, because the memory had been clobbered by dsa_free(). Back-patch to 11, where the code arrived. Reported-by: Michael Paquier <michael@paquier.xyz> Discussion: https://postgr.es/m/20200929061142.GA29096%40paquier.xyz
1 parent 3792959 commit 3b8981b
Copy full SHA for 3b8981b

File tree

3 files changed

+58
-32
lines changed
Filter options

3 files changed

+58
-32
lines changed

‎src/backend/executor/nodeHash.c

Copy file name to clipboardExpand all lines: src/backend/executor/nodeHash.c
+32-15Lines changed: 32 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -333,14 +333,21 @@ MultiExecParallelHash(HashState *node)
333333
hashtable->nbuckets = pstate->nbuckets;
334334
hashtable->log2_nbuckets = my_log2(hashtable->nbuckets);
335335
hashtable->totalTuples = pstate->total_tuples;
336-
ExecParallelHashEnsureBatchAccessors(hashtable);
336+
337+
/*
338+
* Unless we're completely done and the batch state has been freed, make
339+
* sure we have accessors.
340+
*/
341+
if (BarrierPhase(build_barrier) < PHJ_BUILD_DONE)
342+
ExecParallelHashEnsureBatchAccessors(hashtable);
337343

338344
/*
339345
* The next synchronization point is in ExecHashJoin's HJ_BUILD_HASHTABLE
340-
* case, which will bring the build phase to PHJ_BUILD_DONE (if it isn't
346+
* case, which will bring the build phase to PHJ_BUILD_RUNNING (if it isn't
341347
* there already).
342348
*/
343349
Assert(BarrierPhase(build_barrier) == PHJ_BUILD_HASHING_OUTER ||
350+
BarrierPhase(build_barrier) == PHJ_BUILD_RUNNING ||
344351
BarrierPhase(build_barrier) == PHJ_BUILD_DONE);
345352
}
346353

@@ -624,7 +631,7 @@ ExecHashTableCreate(HashState *state, List *hashOperators, List *hashCollations,
624631
/*
625632
* The next Parallel Hash synchronization point is in
626633
* MultiExecParallelHash(), which will progress it all the way to
627-
* PHJ_BUILD_DONE. The caller must not return control from this
634+
* PHJ_BUILD_RUNNING. The caller must not return control from this
628635
* executor node between now and then.
629636
*/
630637
}
@@ -3048,14 +3055,11 @@ ExecParallelHashEnsureBatchAccessors(HashJoinTable hashtable)
30483055
}
30493056

30503057
/*
3051-
* It's possible for a backend to start up very late so that the whole
3052-
* join is finished and the shm state for tracking batches has already
3053-
* been freed by ExecHashTableDetach(). In that case we'll just leave
3054-
* hashtable->batches as NULL so that ExecParallelHashJoinNewBatch() gives
3055-
* up early.
3058+
* We should never see a state where the batch-tracking array is freed,
3059+
* because we should have given up sooner if we join when the build barrier
3060+
* has reached the PHJ_BUILD_DONE phase.
30563061
*/
3057-
if (!DsaPointerIsValid(pstate->batches))
3058-
return;
3062+
Assert(DsaPointerIsValid(pstate->batches));
30593063

30603064
/* Use hash join memory context. */
30613065
oldcxt = MemoryContextSwitchTo(hashtable->hashCxt);
@@ -3175,9 +3179,17 @@ ExecHashTableDetachBatch(HashJoinTable hashtable)
31753179
void
31763180
ExecHashTableDetach(HashJoinTable hashtable)
31773181
{
3178-
if (hashtable->parallel_state)
3182+
ParallelHashJoinState *pstate = hashtable->parallel_state;
3183+
3184+
/*
3185+
* If we're involved in a parallel query, we must either have got all the
3186+
* way to PHJ_BUILD_RUNNING, or joined too late and be in PHJ_BUILD_DONE.
3187+
*/
3188+
Assert(!pstate ||
3189+
BarrierPhase(&pstate->build_barrier) >= PHJ_BUILD_RUNNING);
3190+
3191+
if (pstate && BarrierPhase(&pstate->build_barrier) == PHJ_BUILD_RUNNING)
31793192
{
3180-
ParallelHashJoinState *pstate = hashtable->parallel_state;
31813193
int i;
31823194

31833195
/* Make sure any temporary files are closed. */
@@ -3193,17 +3205,22 @@ ExecHashTableDetach(HashJoinTable hashtable)
31933205
}
31943206

31953207
/* If we're last to detach, clean up shared memory. */
3196-
if (BarrierDetach(&pstate->build_barrier))
3208+
if (BarrierArriveAndDetach(&pstate->build_barrier))
31973209
{
3210+
/*
3211+
* Late joining processes will see this state and give up
3212+
* immediately.
3213+
*/
3214+
Assert(BarrierPhase(&pstate->build_barrier) == PHJ_BUILD_DONE);
3215+
31983216
if (DsaPointerIsValid(pstate->batches))
31993217
{
32003218
dsa_free(hashtable->area, pstate->batches);
32013219
pstate->batches = InvalidDsaPointer;
32023220
}
32033221
}
3204-
3205-
hashtable->parallel_state = NULL;
32063222
}
3223+
hashtable->parallel_state = NULL;
32073224
}
32083225

32093226
/*

‎src/backend/executor/nodeHashjoin.c

Copy file name to clipboardExpand all lines: src/backend/executor/nodeHashjoin.c
+24-16Lines changed: 24 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,8 @@
4545
* PHJ_BUILD_ALLOCATING -- one sets up the batches and table 0
4646
* PHJ_BUILD_HASHING_INNER -- all hash the inner rel
4747
* PHJ_BUILD_HASHING_OUTER -- (multi-batch only) all hash the outer
48-
* PHJ_BUILD_DONE -- building done, probing can begin
48+
* PHJ_BUILD_RUNNING -- building done, probing can begin
49+
* PHJ_BUILD_DONE -- all work complete, one frees batches
4950
*
5051
* While in the phase PHJ_BUILD_HASHING_INNER a separate pair of barriers may
5152
* be used repeatedly as required to coordinate expansions in the number of
@@ -73,7 +74,7 @@
7374
* batches whenever it encounters them while scanning and probing, which it
7475
* can do because it processes batches in serial order.
7576
*
76-
* Once PHJ_BUILD_DONE is reached, backends then split up and process
77+
* Once PHJ_BUILD_RUNNING is reached, backends then split up and process
7778
* different batches, or gang up and work together on probing batches if there
7879
* aren't enough to go around. For each batch there is a separate barrier
7980
* with the following phases:
@@ -95,11 +96,16 @@
9596
*
9697
* To avoid deadlocks, we never wait for any barrier unless it is known that
9798
* all other backends attached to it are actively executing the node or have
98-
* already arrived. Practically, that means that we never return a tuple
99-
* while attached to a barrier, unless the barrier has reached its final
100-
* state. In the slightly special case of the per-batch barrier, we return
101-
* tuples while in PHJ_BATCH_PROBING phase, but that's OK because we use
102-
* BarrierArriveAndDetach() to advance it to PHJ_BATCH_DONE without waiting.
99+
* finished. Practically, that means that we never emit a tuple while attached
100+
* to a barrier, unless the barrier has reached a phase that means that no
101+
* process will wait on it again. We emit tuples while attached to the build
102+
* barrier in phase PHJ_BUILD_RUNNING, and to a per-batch barrier in phase
103+
* PHJ_BATCH_PROBING. These are advanced to PHJ_BUILD_DONE and PHJ_BATCH_DONE
104+
* respectively without waiting, using BarrierArriveAndDetach(). The last to
105+
* detach receives a different return value so that it knows that it's safe to
106+
* clean up. Any straggler process that attaches after that phase is reached
107+
* will see that it's too late to participate or access the relevant shared
108+
* memory objects.
103109
*
104110
*-------------------------------------------------------------------------
105111
*/
@@ -317,6 +323,7 @@ ExecHashJoinImpl(PlanState *pstate, bool parallel)
317323

318324
build_barrier = &parallel_state->build_barrier;
319325
Assert(BarrierPhase(build_barrier) == PHJ_BUILD_HASHING_OUTER ||
326+
BarrierPhase(build_barrier) == PHJ_BUILD_RUNNING ||
320327
BarrierPhase(build_barrier) == PHJ_BUILD_DONE);
321328
if (BarrierPhase(build_barrier) == PHJ_BUILD_HASHING_OUTER)
322329
{
@@ -329,9 +336,18 @@ ExecHashJoinImpl(PlanState *pstate, bool parallel)
329336
BarrierArriveAndWait(build_barrier,
330337
WAIT_EVENT_HASH_BUILD_HASH_OUTER);
331338
}
332-
Assert(BarrierPhase(build_barrier) == PHJ_BUILD_DONE);
339+
else if (BarrierPhase(build_barrier) == PHJ_BUILD_DONE)
340+
{
341+
/*
342+
* If we attached so late that the job is finished and
343+
* the batch state has been freed, we can return
344+
* immediately.
345+
*/
346+
return NULL;
347+
}
333348

334349
/* Each backend should now select a batch to work on. */
350+
Assert(BarrierPhase(build_barrier) == PHJ_BUILD_RUNNING);
335351
hashtable->curbatch = -1;
336352
node->hj_JoinState = HJ_NEED_NEW_BATCH;
337353

@@ -1090,14 +1106,6 @@ ExecParallelHashJoinNewBatch(HashJoinState *hjstate)
10901106
int start_batchno;
10911107
int batchno;
10921108

1093-
/*
1094-
* If we started up so late that the batch tracking array has been freed
1095-
* already by ExecHashTableDetach(), then we are finished. See also
1096-
* ExecParallelHashEnsureBatchAccessors().
1097-
*/
1098-
if (hashtable->batches == NULL)
1099-
return false;
1100-
11011109
/*
11021110
* If we were already attached to a batch, remember not to bother checking
11031111
* it again, and detach from it (possibly freeing the hash table if we are

‎src/include/executor/hashjoin.h

Copy file name to clipboardExpand all lines: src/include/executor/hashjoin.h
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,8 @@ typedef struct ParallelHashJoinState
258258
#define PHJ_BUILD_ALLOCATING 1
259259
#define PHJ_BUILD_HASHING_INNER 2
260260
#define PHJ_BUILD_HASHING_OUTER 3
261-
#define PHJ_BUILD_DONE 4
261+
#define PHJ_BUILD_RUNNING 4
262+
#define PHJ_BUILD_DONE 5
262263

263264
/* The phases for probing each batch, used by for batch_barrier. */
264265
#define PHJ_BATCH_ELECTING 0

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.