Age Owner Branch data TLA Line data Source code
1 : : /*-------------------------------------------------------------------------
2 : : *
3 : : * verify_heapam.c
4 : : * Functions to check postgresql heap relations for corruption
5 : : *
6 : : * Copyright (c) 2016-2026, PostgreSQL Global Development Group
7 : : *
8 : : * contrib/amcheck/verify_heapam.c
9 : : *-------------------------------------------------------------------------
10 : : */
11 : : #include "postgres.h"
12 : :
13 : : #include "access/detoast.h"
14 : : #include "access/genam.h"
15 : : #include "access/heaptoast.h"
16 : : #include "access/multixact.h"
17 : : #include "access/relation.h"
18 : : #include "access/table.h"
19 : : #include "access/toast_compression.h"
20 : : #include "access/toast_internals.h"
21 : : #include "access/visibilitymap.h"
22 : : #include "access/xact.h"
23 : : #include "catalog/pg_am.h"
24 : : #include "catalog/pg_class.h"
25 : : #include "funcapi.h"
26 : : #include "miscadmin.h"
27 : : #include "storage/bufmgr.h"
28 : : #include "storage/lwlock.h"
29 : : #include "storage/procarray.h"
30 : : #include "storage/read_stream.h"
31 : : #include "utils/builtins.h"
32 : : #include "utils/rel.h"
33 : : #include "utils/tuplestore.h"
34 : :
2181 rhaas@postgresql.org 35 :CBC 303 : PG_FUNCTION_INFO_V1(verify_heapam);
36 : :
37 : : /* The number of columns in tuples returned by verify_heapam */
38 : : #define HEAPCHECK_RELATION_COLS 4
39 : :
40 : : /* The largest valid toast va_rawsize */
41 : : #define VARLENA_SIZE_LIMIT 0x3FFFFFFF
42 : :
43 : : /*
44 : : * Despite the name, we use this for reporting problems with both XIDs and
45 : : * MXIDs.
46 : : */
47 : : typedef enum XidBoundsViolation
48 : : {
49 : : XID_INVALID,
50 : : XID_IN_FUTURE,
51 : : XID_PRECEDES_CLUSTERMIN,
52 : : XID_PRECEDES_RELMIN,
53 : : XID_BOUNDS_OK,
54 : : } XidBoundsViolation;
55 : :
56 : : typedef enum XidCommitStatus
57 : : {
58 : : XID_COMMITTED,
59 : : XID_IS_CURRENT_XID,
60 : : XID_IN_PROGRESS,
61 : : XID_ABORTED,
62 : : } XidCommitStatus;
63 : :
64 : : typedef enum SkipPages
65 : : {
66 : : SKIP_PAGES_ALL_FROZEN,
67 : : SKIP_PAGES_ALL_VISIBLE,
68 : : SKIP_PAGES_NONE,
69 : : } SkipPages;
70 : :
71 : : /*
72 : : * Struct holding information about a toasted attribute sufficient to both
73 : : * check the toasted attribute and, if found to be corrupt, to report where it
74 : : * was encountered in the main table.
75 : : */
76 : : typedef struct ToastedAttribute
77 : : {
78 : : Oid8 va_valueid; /* value ID (works for both Oid and Oid8) */
79 : : uint32 va_extinfo; /* external size and compression method */
80 : : vartag_external tag; /* VARTAG_ONDISK_OID or VARTAG_ONDISK_OID8 */
81 : : BlockNumber blkno; /* block in main table */
82 : : OffsetNumber offnum; /* offset in main table */
83 : : AttrNumber attnum; /* attribute in main table */
84 : : } ToastedAttribute;
85 : :
86 : : /*
87 : : * Struct holding the running context information during
88 : : * a lifetime of a verify_heapam execution.
89 : : */
90 : : typedef struct HeapCheckContext
91 : : {
92 : : /*
93 : : * Cached copies of values from TransamVariables and computed values from
94 : : * them.
95 : : */
96 : : FullTransactionId next_fxid; /* TransamVariables->nextXid */
97 : : TransactionId next_xid; /* 32-bit version of next_fxid */
98 : : TransactionId oldest_xid; /* TransamVariables->oldestXid */
99 : : FullTransactionId oldest_fxid; /* 64-bit version of oldest_xid, computed
100 : : * relative to next_fxid */
101 : : TransactionId safe_xmin; /* this XID and newer ones can't become
102 : : * all-visible while we're running */
103 : :
104 : : /*
105 : : * Cached copy of value from MultiXactState
106 : : */
107 : : MultiXactId next_mxact; /* MultiXactState->nextMXact */
108 : : MultiXactId oldest_mxact; /* MultiXactState->oldestMultiXactId */
109 : :
110 : : /*
111 : : * Cached copies of the most recently checked xid and its status.
112 : : */
113 : : TransactionId cached_xid;
114 : : XidCommitStatus cached_status;
115 : :
116 : : /* Values concerning the heap relation being checked */
117 : : Relation rel;
118 : : TransactionId relfrozenxid;
119 : : FullTransactionId relfrozenfxid;
120 : : TransactionId relminmxid;
121 : : Relation toast_rel;
122 : : Relation *toast_indexes;
123 : : Relation valid_toast_index;
124 : : int num_toast_indexes;
125 : :
126 : : /*
127 : : * Values for iterating over pages in the relation. `blkno` is the most
128 : : * recent block in the buffer yielded by the read stream API.
129 : : */
130 : : BlockNumber blkno;
131 : : BufferAccessStrategy bstrategy;
132 : : Buffer buffer;
133 : : Page page;
134 : :
135 : : /* Values for iterating over tuples within a page */
136 : : OffsetNumber offnum;
137 : : ItemId itemid;
138 : : uint16 lp_len;
139 : : uint16 lp_off;
140 : : HeapTupleHeader tuphdr;
141 : : int natts;
142 : :
143 : : /* Values for iterating over attributes within the tuple */
144 : : uint32 offset; /* offset in tuple data */
145 : : AttrNumber attnum;
146 : :
147 : : /* True if tuple's xmax makes it eligible for pruning */
148 : : bool tuple_could_be_pruned;
149 : :
150 : : /*
151 : : * List of ToastedAttribute structs for toasted attributes which are not
152 : : * eligible for pruning and should be checked
153 : : */
154 : : List *toasted_attributes;
155 : :
156 : : /* Whether verify_heapam has yet encountered any corrupt tuples */
157 : : bool is_corrupt;
158 : :
159 : : /* The descriptor and tuplestore for verify_heapam's result tuples */
160 : : TupleDesc tupdesc;
161 : : Tuplestorestate *tupstore;
162 : : } HeapCheckContext;
163 : :
164 : : /*
165 : : * The per-relation data provided to the read stream API for heap amcheck to
166 : : * use in its callback for the SKIP_PAGES_ALL_FROZEN and
167 : : * SKIP_PAGES_ALL_VISIBLE options.
168 : : */
169 : : typedef struct HeapCheckReadStreamData
170 : : {
171 : : /*
172 : : * `range` is used by all SkipPages options. SKIP_PAGES_NONE uses the
173 : : * default read stream callback, block_range_read_stream_cb(), which takes
174 : : * a BlockRangeReadStreamPrivate as its callback_private_data. `range`
175 : : * keeps track of the current block number across
176 : : * read_stream_next_buffer() invocations.
177 : : */
178 : : BlockRangeReadStreamPrivate range;
179 : : SkipPages skip_option;
180 : : Relation rel;
181 : : Buffer *vmbuffer;
182 : : } HeapCheckReadStreamData;
183 : :
184 : :
185 : : /* Internal implementation */
186 : : static BlockNumber heapcheck_read_stream_next_unskippable(ReadStream *stream,
187 : : void *callback_private_data,
188 : : void *per_buffer_data);
189 : :
190 : : static void check_tuple(HeapCheckContext *ctx,
191 : : bool *xmin_commit_status_ok,
192 : : XidCommitStatus *xmin_commit_status);
193 : : static void check_toast_tuple(HeapTuple toasttup, HeapCheckContext *ctx,
194 : : ToastedAttribute *ta, int32 *expected_chunk_seq,
195 : : uint32 extsize, int32 max_chunk_size);
196 : :
197 : : static bool check_tuple_attribute(HeapCheckContext *ctx);
198 : : static void check_toasted_attribute(HeapCheckContext *ctx,
199 : : ToastedAttribute *ta);
200 : :
201 : : static bool check_tuple_header(HeapCheckContext *ctx);
202 : : static bool check_tuple_visibility(HeapCheckContext *ctx,
203 : : bool *xmin_commit_status_ok,
204 : : XidCommitStatus *xmin_commit_status);
205 : :
206 : : static void report_corruption(HeapCheckContext *ctx, char *msg);
207 : : static void report_toast_corruption(HeapCheckContext *ctx,
208 : : ToastedAttribute *ta, char *msg);
209 : : static FullTransactionId FullTransactionIdFromXidAndCtx(TransactionId xid,
210 : : const HeapCheckContext *ctx);
211 : : static void update_cached_xid_range(HeapCheckContext *ctx);
212 : : static void update_cached_mxid_range(HeapCheckContext *ctx);
213 : : static XidBoundsViolation check_mxid_in_range(MultiXactId mxid,
214 : : HeapCheckContext *ctx);
215 : : static XidBoundsViolation check_mxid_valid_in_rel(MultiXactId mxid,
216 : : HeapCheckContext *ctx);
217 : : static XidBoundsViolation get_xid_status(TransactionId xid,
218 : : HeapCheckContext *ctx,
219 : : XidCommitStatus *status);
220 : :
221 : : /*
222 : : * Scan and report corruption in heap pages, optionally reconciling toasted
223 : : * attributes with entries in the associated toast table. Intended to be
224 : : * called from SQL with the following parameters:
225 : : *
226 : : * relation:
227 : : * The Oid of the heap relation to be checked.
228 : : *
229 : : * on_error_stop:
230 : : * Whether to stop at the end of the first page for which errors are
231 : : * detected. Note that multiple rows may be returned.
232 : : *
233 : : * check_toast:
234 : : * Whether to check each toasted attribute against the toast table to
235 : : * verify that it can be found there.
236 : : *
237 : : * skip:
238 : : * What kinds of pages in the heap relation should be skipped. Valid
239 : : * options are "all-visible", "all-frozen", and "none".
240 : : *
241 : : * Returns to the SQL caller a set of tuples, each containing the location
242 : : * and a description of a corruption found in the heap.
243 : : *
244 : : * This code goes to some trouble to avoid crashing the server even if the
245 : : * table pages are badly corrupted, but it's probably not perfect. If
246 : : * check_toast is true, we'll use regular index lookups to try to fetch TOAST
247 : : * tuples, which can certainly cause crashes if the right kind of corruption
248 : : * exists in the toast table or index. No matter what parameters you pass,
249 : : * we can't protect against crashes that might occur trying to look up the
250 : : * commit status of transaction IDs (though we avoid trying to do such lookups
251 : : * for transaction IDs that can't legally appear in the table).
252 : : */
253 : : Datum
254 : 3419 : verify_heapam(PG_FUNCTION_ARGS)
255 : : {
256 : 3419 : ReturnSetInfo *rsinfo = (ReturnSetInfo *) fcinfo->resultinfo;
257 : : HeapCheckContext ctx;
258 : 3419 : Buffer vmbuffer = InvalidBuffer;
259 : : Oid relid;
260 : : bool on_error_stop;
261 : : bool check_toast;
262 : 3419 : SkipPages skip_option = SKIP_PAGES_NONE;
263 : : BlockNumber first_block;
264 : : BlockNumber last_block;
265 : : BlockNumber nblocks;
266 : : const char *skip;
267 : : ReadStream *stream;
268 : : int stream_flags;
269 : : ReadStreamBlockNumberCB stream_cb;
270 : : void *stream_data;
271 : : HeapCheckReadStreamData stream_skip_data;
272 : :
273 : : /* Check supplied arguments */
274 [ - + ]: 3419 : if (PG_ARGISNULL(0))
2181 rhaas@postgresql.org 275 [ # # ]:UBC 0 : ereport(ERROR,
276 : : (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
277 : : errmsg("relation cannot be null")));
2181 rhaas@postgresql.org 278 :CBC 3419 : relid = PG_GETARG_OID(0);
279 : :
280 [ - + ]: 3419 : if (PG_ARGISNULL(1))
2181 rhaas@postgresql.org 281 [ # # ]:UBC 0 : ereport(ERROR,
282 : : (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
283 : : errmsg("on_error_stop cannot be null")));
2181 rhaas@postgresql.org 284 :CBC 3419 : on_error_stop = PG_GETARG_BOOL(1);
285 : :
286 [ - + ]: 3419 : if (PG_ARGISNULL(2))
2181 rhaas@postgresql.org 287 [ # # ]:UBC 0 : ereport(ERROR,
288 : : (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
289 : : errmsg("check_toast cannot be null")));
2181 rhaas@postgresql.org 290 :CBC 3419 : check_toast = PG_GETARG_BOOL(2);
291 : :
292 [ - + ]: 3419 : if (PG_ARGISNULL(3))
2181 rhaas@postgresql.org 293 [ # # ]:UBC 0 : ereport(ERROR,
294 : : (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
295 : : errmsg("skip cannot be null")));
2181 rhaas@postgresql.org 296 :CBC 3419 : skip = text_to_cstring(PG_GETARG_TEXT_PP(3));
297 [ + + ]: 3419 : if (pg_strcasecmp(skip, "all-visible") == 0)
298 : 83 : skip_option = SKIP_PAGES_ALL_VISIBLE;
299 [ + + ]: 3336 : else if (pg_strcasecmp(skip, "all-frozen") == 0)
300 : 87 : skip_option = SKIP_PAGES_ALL_FROZEN;
301 [ + + ]: 3249 : else if (pg_strcasecmp(skip, "none") == 0)
302 : 3248 : skip_option = SKIP_PAGES_NONE;
303 : : else
304 [ + - ]: 1 : ereport(ERROR,
305 : : (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
306 : : errmsg("invalid skip option"),
307 : : errhint("Valid skip options are \"all-visible\", \"all-frozen\", and \"none\".")));
308 : :
309 : 3418 : memset(&ctx, 0, sizeof(HeapCheckContext));
310 : 3418 : ctx.cached_xid = InvalidTransactionId;
2014 311 : 3418 : ctx.toasted_attributes = NIL;
312 : :
313 : : /*
314 : : * Any xmin newer than the xmin of our snapshot can't become all-visible
315 : : * while we're running.
316 : : */
2020 317 : 3418 : ctx.safe_xmin = GetTransactionSnapshot()->xmin;
318 : :
319 : : /*
320 : : * If we report corruption when not examining some individual attribute,
321 : : * we need attnum to be reported as NULL. Set that up before any
322 : : * corruption reporting might happen.
323 : : */
2180 tgl@sss.pgh.pa.us 324 : 3418 : ctx.attnum = -1;
325 : :
326 : : /* Construct the tuplestore and tuple descriptor */
1455 michael@paquier.xyz 327 : 3418 : InitMaterializedSRF(fcinfo, 0);
1679 328 : 3418 : ctx.tupdesc = rsinfo->setDesc;
329 : 3418 : ctx.tupstore = rsinfo->setResult;
330 : :
331 : : /* Open relation, check relkind and access method */
2181 rhaas@postgresql.org 332 : 3418 : ctx.rel = relation_open(relid, AccessShareLock);
333 : :
334 : : /*
335 : : * Check that a relation's relkind and access method are both supported.
336 : : */
1774 peter@eisentraut.org 337 [ + + + + : 3418 : if (!RELKIND_HAS_TABLE_AM(ctx.rel->rd_rel->relkind) &&
+ + ]
1840 338 [ + + ]: 194 : ctx.rel->rd_rel->relkind != RELKIND_SEQUENCE)
1922 339 [ + - ]: 4 : ereport(ERROR,
340 : : (errcode(ERRCODE_WRONG_OBJECT_TYPE),
341 : : errmsg("cannot check relation \"%s\"",
342 : : RelationGetRelationName(ctx.rel)),
343 : : errdetail_relkind_not_supported(ctx.rel->rd_rel->relkind)));
344 : :
345 : : /*
346 : : * Sequences always use heap AM, but they don't show that in the catalogs.
347 : : * Other relkinds might be using a different AM, so check.
348 : : */
1840 349 [ + + ]: 3414 : if (ctx.rel->rd_rel->relkind != RELKIND_SEQUENCE &&
350 [ - + ]: 3224 : ctx.rel->rd_rel->relam != HEAP_TABLE_AM_OID)
1922 peter@eisentraut.org 351 [ # # ]:UBC 0 : ereport(ERROR,
352 : : (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
353 : : errmsg("only heap AM is supported")));
354 : :
355 : : /*
356 : : * Early exit for unlogged relations during recovery. These will have no
357 : : * relation fork, so there won't be anything to check. We behave as if
358 : : * the relation is empty.
359 : : */
1827 pg@bowt.ie 360 [ - + - - ]:CBC 3414 : if (ctx.rel->rd_rel->relpersistence == RELPERSISTENCE_UNLOGGED &&
1827 pg@bowt.ie 361 :UBC 0 : RecoveryInProgress())
362 : : {
363 [ # # ]: 0 : ereport(DEBUG1,
364 : : (errcode(ERRCODE_READ_ONLY_SQL_TRANSACTION),
365 : : errmsg("cannot verify unlogged relation \"%s\" during recovery, skipping",
366 : : RelationGetRelationName(ctx.rel))));
367 : 0 : relation_close(ctx.rel, AccessShareLock);
368 : 0 : PG_RETURN_NULL();
369 : : }
370 : :
371 : : /* Early exit if the relation is empty */
2181 rhaas@postgresql.org 372 :CBC 3414 : nblocks = RelationGetNumberOfBlocks(ctx.rel);
373 [ + + ]: 3397 : if (!nblocks)
374 : : {
375 : 1919 : relation_close(ctx.rel, AccessShareLock);
376 : 1919 : PG_RETURN_NULL();
377 : : }
378 : :
379 : 1478 : ctx.bstrategy = GetAccessStrategy(BAS_BULKREAD);
380 : 1478 : ctx.buffer = InvalidBuffer;
381 : 1478 : ctx.page = NULL;
382 : :
383 : : /* Validate block numbers, or handle nulls. */
384 [ + + ]: 1478 : if (PG_ARGISNULL(4))
385 : 1355 : first_block = 0;
386 : : else
387 : : {
388 : 123 : int64 fb = PG_GETARG_INT64(4);
389 : :
390 [ + - + + ]: 123 : if (fb < 0 || fb >= nblocks)
391 [ + - ]: 1 : ereport(ERROR,
392 : : (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
393 : : errmsg("starting block number must be between 0 and %u",
394 : : nblocks - 1)));
395 : 122 : first_block = (BlockNumber) fb;
396 : : }
397 [ + + ]: 1477 : if (PG_ARGISNULL(5))
398 : 1354 : last_block = nblocks - 1;
399 : : else
400 : : {
401 : 123 : int64 lb = PG_GETARG_INT64(5);
402 : :
403 [ + - + + ]: 123 : if (lb < 0 || lb >= nblocks)
404 [ + - ]: 1 : ereport(ERROR,
405 : : (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
406 : : errmsg("ending block number must be between 0 and %u",
407 : : nblocks - 1)));
408 : 122 : last_block = (BlockNumber) lb;
409 : : }
410 : :
411 : : /* Optionally open the toast relation, if any. */
412 [ + + + + ]: 1476 : if (ctx.rel->rd_rel->reltoastrelid && check_toast)
413 : 698 : {
414 : : int offset;
415 : :
416 : : /* Main relation has associated toast relation */
417 : 698 : ctx.toast_rel = table_open(ctx.rel->rd_rel->reltoastrelid,
418 : : AccessShareLock);
419 : 698 : offset = toast_open_indexes(ctx.toast_rel,
420 : : AccessShareLock,
421 : : &(ctx.toast_indexes),
422 : : &(ctx.num_toast_indexes));
423 : 698 : ctx.valid_toast_index = ctx.toast_indexes[offset];
424 : : }
425 : : else
426 : : {
427 : : /*
428 : : * Main relation has no associated toast relation, or we're
429 : : * intentionally skipping it.
430 : : */
431 : 778 : ctx.toast_rel = NULL;
432 : 778 : ctx.toast_indexes = NULL;
433 : 778 : ctx.num_toast_indexes = 0;
434 : : }
435 : :
436 : 1476 : update_cached_xid_range(&ctx);
437 : 1476 : update_cached_mxid_range(&ctx);
438 : 1476 : ctx.relfrozenxid = ctx.rel->rd_rel->relfrozenxid;
439 : 1476 : ctx.relfrozenfxid = FullTransactionIdFromXidAndCtx(ctx.relfrozenxid, &ctx);
440 : 1476 : ctx.relminmxid = ctx.rel->rd_rel->relminmxid;
441 : :
442 [ + + ]: 1476 : if (TransactionIdIsNormal(ctx.relfrozenxid))
443 : 1286 : ctx.oldest_xid = ctx.relfrozenxid;
444 : :
445 : : /* Now that `ctx` is set up, set up the read stream */
564 melanieplageman@gmai 446 : 1476 : stream_skip_data.range.current_blocknum = first_block;
447 : 1476 : stream_skip_data.range.last_exclusive = last_block + 1;
448 : 1476 : stream_skip_data.skip_option = skip_option;
449 : 1476 : stream_skip_data.rel = ctx.rel;
450 : 1476 : stream_skip_data.vmbuffer = &vmbuffer;
451 : :
452 [ + + ]: 1476 : if (skip_option == SKIP_PAGES_NONE)
453 : : {
454 : : /*
455 : : * It is safe to use batchmode as block_range_read_stream_cb takes no
456 : : * locks.
457 : : */
458 : 1312 : stream_cb = block_range_read_stream_cb;
561 andres@anarazel.de 459 : 1312 : stream_flags = READ_STREAM_SEQUENTIAL |
460 : : READ_STREAM_FULL |
461 : : READ_STREAM_USE_BATCHING;
564 melanieplageman@gmai 462 : 1312 : stream_data = &stream_skip_data.range;
463 : : }
464 : : else
465 : : {
466 : : /*
467 : : * It would not be safe to naively use batchmode, as
468 : : * heapcheck_read_stream_next_unskippable takes locks. It shouldn't be
469 : : * too hard to convert though.
470 : : */
471 : 164 : stream_cb = heapcheck_read_stream_next_unskippable;
472 : 164 : stream_flags = READ_STREAM_DEFAULT;
473 : 164 : stream_data = &stream_skip_data;
474 : : }
475 : :
476 : 1476 : stream = read_stream_begin_relation(stream_flags,
477 : : ctx.bstrategy,
478 : : ctx.rel,
479 : : MAIN_FORKNUM,
480 : : stream_cb,
481 : : stream_data,
482 : : 0);
483 : :
484 [ + + ]: 13439 : while ((ctx.buffer = read_stream_next_buffer(stream, NULL)) != InvalidBuffer)
485 : : {
486 : : uint8 vmbits;
487 : : OffsetNumber maxoff;
488 : : OffsetNumber predecessor[MaxOffsetNumber];
489 : : OffsetNumber successor[MaxOffsetNumber];
490 : : bool lp_valid[MaxOffsetNumber];
491 : : bool xmin_commit_status_ok[MaxOffsetNumber];
492 : : XidCommitStatus xmin_commit_status[MaxOffsetNumber];
493 : :
1873 pg@bowt.ie 494 [ - + ]: 11966 : CHECK_FOR_INTERRUPTS();
495 : :
1300 rhaas@postgresql.org 496 : 11966 : memset(predecessor, 0, sizeof(OffsetNumber) * MaxOffsetNumber);
497 : :
498 : : /* Lock the next page. */
564 melanieplageman@gmai 499 [ - + ]: 11966 : Assert(BufferIsValid(ctx.buffer));
2181 rhaas@postgresql.org 500 : 11966 : LockBuffer(ctx.buffer, BUFFER_LOCK_SHARE);
501 : :
564 melanieplageman@gmai 502 : 11966 : ctx.blkno = BufferGetBlockNumber(ctx.buffer);
2181 rhaas@postgresql.org 503 : 11966 : ctx.page = BufferGetPage(ctx.buffer);
504 : :
505 : : /*
506 : : * It is corruption if PD_ALL_VISIBLE is clear while either VM bit is
507 : : * set. Missing VM pages are treated as having no bits set. VM pages
508 : : * that fail page verification are read with RBM_ZERO_ON_ERROR, so
509 : : * those failures are not reported as corruption rows here.
510 : : */
19 melanieplageman@gmai 511 :GNC 11966 : vmbits = visibilitymap_get_status(ctx.rel, ctx.blkno, &vmbuffer);
512 : :
513 [ + + ]: 11966 : if (!PageIsAllVisible(ctx.page) &&
514 [ - + ]: 2704 : (vmbits & VISIBILITYMAP_VALID_BITS) != 0)
515 : : {
19 melanieplageman@gmai 516 :UNC 0 : ctx.offnum = InvalidOffsetNumber;
517 : 0 : ctx.attnum = -1;
518 : 0 : report_corruption(&ctx,
519 : : psprintf("page is not marked all-visible in page header but visibility map bit is set"));
520 : : }
521 : :
522 : : /* Perform tuple checks */
2181 rhaas@postgresql.org 523 :CBC 11966 : maxoff = PageGetMaxOffsetNumber(ctx.page);
524 [ + + ]: 578638 : for (ctx.offnum = FirstOffsetNumber; ctx.offnum <= maxoff;
525 : 566672 : ctx.offnum = OffsetNumberNext(ctx.offnum))
526 : : {
527 : : BlockNumber nextblkno;
528 : : OffsetNumber nextoffnum;
529 : :
1300 530 : 566672 : successor[ctx.offnum] = InvalidOffsetNumber;
531 : 566672 : lp_valid[ctx.offnum] = false;
532 : 566672 : xmin_commit_status_ok[ctx.offnum] = false;
2181 533 : 566672 : ctx.itemid = PageGetItemId(ctx.page, ctx.offnum);
534 : :
535 : : /* Skip over unused/dead line pointers */
536 [ + + + + ]: 566672 : if (!ItemIdIsUsed(ctx.itemid) || ItemIdIsDead(ctx.itemid))
537 : 9118 : continue;
538 : :
539 : : /*
540 : : * If this line pointer has been redirected, check that it
541 : : * redirects to a valid offset within the line pointer array
542 : : */
543 [ + + ]: 557554 : if (ItemIdIsRedirected(ctx.itemid))
544 : 4503 : {
545 : 4524 : OffsetNumber rdoffnum = ItemIdGetRedirect(ctx.itemid);
546 : : ItemId rditem;
547 : :
2180 tgl@sss.pgh.pa.us 548 [ + + ]: 4524 : if (rdoffnum < FirstOffsetNumber)
549 : : {
550 : 6 : report_corruption(&ctx,
551 : : psprintf("line pointer redirection to item at offset %d precedes minimum offset %d",
552 : : rdoffnum,
553 : : FirstOffsetNumber));
554 : 6 : continue;
555 : : }
556 [ + + ]: 4518 : if (rdoffnum > maxoff)
557 : : {
2181 rhaas@postgresql.org 558 : 14 : report_corruption(&ctx,
559 : : psprintf("line pointer redirection to item at offset %d exceeds maximum offset %d",
560 : : rdoffnum,
561 : : maxoff));
562 : 14 : continue;
563 : : }
564 : :
565 : : /*
566 : : * Since we've checked that this redirect points to a line
567 : : * pointer between FirstOffsetNumber and maxoff, it should now
568 : : * be safe to fetch the referenced line pointer. We expect it
569 : : * to be LP_NORMAL; if not, that's corruption.
570 : : */
571 : 4504 : rditem = PageGetItemId(ctx.page, rdoffnum);
572 [ - + ]: 4504 : if (!ItemIdIsUsed(rditem))
573 : : {
2181 rhaas@postgresql.org 574 :UBC 0 : report_corruption(&ctx,
575 : : psprintf("redirected line pointer points to an unused item at offset %d",
576 : : rdoffnum));
1295 577 : 0 : continue;
578 : : }
1295 rhaas@postgresql.org 579 [ - + ]:CBC 4504 : else if (ItemIdIsDead(rditem))
580 : : {
1295 rhaas@postgresql.org 581 :UBC 0 : report_corruption(&ctx,
582 : : psprintf("redirected line pointer points to a dead item at offset %d",
583 : : rdoffnum));
584 : 0 : continue;
585 : : }
1295 rhaas@postgresql.org 586 [ + + ]:CBC 4504 : else if (ItemIdIsRedirected(rditem))
587 : : {
588 : 1 : report_corruption(&ctx,
589 : : psprintf("redirected line pointer points to another redirected line pointer at offset %d",
590 : : rdoffnum));
591 : 1 : continue;
592 : : }
593 : :
594 : : /*
595 : : * Record the fact that this line pointer has passed basic
596 : : * sanity checking, and also the offset number to which it
597 : : * points.
598 : : */
1300 599 : 4503 : lp_valid[ctx.offnum] = true;
600 : 4503 : successor[ctx.offnum] = rdoffnum;
2181 601 : 4503 : continue;
602 : : }
603 : :
604 : : /* Sanity-check the line pointer's offset and length values */
605 : 553030 : ctx.lp_len = ItemIdGetLength(ctx.itemid);
2180 tgl@sss.pgh.pa.us 606 : 553030 : ctx.lp_off = ItemIdGetOffset(ctx.itemid);
607 : :
608 [ + + ]: 553030 : if (ctx.lp_off != MAXALIGN(ctx.lp_off))
609 : : {
610 : 6 : report_corruption(&ctx,
611 : : psprintf("line pointer to page offset %u is not maximally aligned",
612 : 6 : ctx.lp_off));
613 : 6 : continue;
614 : : }
615 [ + + ]: 553024 : if (ctx.lp_len < MAXALIGN(SizeofHeapTupleHeader))
616 : : {
617 : 12 : report_corruption(&ctx,
618 : : psprintf("line pointer length %u is less than the minimum tuple header size %u",
619 : 12 : ctx.lp_len,
620 : : (unsigned) MAXALIGN(SizeofHeapTupleHeader)));
621 : 12 : continue;
622 : : }
623 [ + + ]: 553012 : if (ctx.lp_off + ctx.lp_len > BLCKSZ)
624 : : {
625 : 14 : report_corruption(&ctx,
626 : : psprintf("line pointer to page offset %u with length %u ends beyond maximum page offset %d",
627 : 14 : ctx.lp_off,
628 : 14 : ctx.lp_len,
629 : : BLCKSZ));
630 : 14 : continue;
631 : : }
632 : :
633 : : /* It should be safe to examine the tuple's header, at least */
1300 rhaas@postgresql.org 634 : 552998 : lp_valid[ctx.offnum] = true;
2181 635 : 552998 : ctx.tuphdr = (HeapTupleHeader) PageGetItem(ctx.page, ctx.itemid);
636 : 552998 : ctx.natts = HeapTupleHeaderGetNatts(ctx.tuphdr);
637 : :
638 : : /* Ok, ready to check this next tuple */
1300 639 : 552998 : check_tuple(&ctx,
640 : 552998 : &xmin_commit_status_ok[ctx.offnum],
641 : 552998 : &xmin_commit_status[ctx.offnum]);
642 : :
643 : : /*
644 : : * If the CTID field of this tuple seems to point to another tuple
645 : : * on the same page, record that tuple as the successor of this
646 : : * one.
647 : : */
648 : 552998 : nextblkno = ItemPointerGetBlockNumber(&(ctx.tuphdr)->t_ctid);
649 : 552998 : nextoffnum = ItemPointerGetOffsetNumber(&(ctx.tuphdr)->t_ctid);
1299 650 [ + + + + : 552998 : if (nextblkno == ctx.blkno && nextoffnum != ctx.offnum &&
+ - ]
651 [ + - ]: 195 : nextoffnum >= FirstOffsetNumber && nextoffnum <= maxoff)
1300 652 : 195 : successor[ctx.offnum] = nextoffnum;
653 : : }
654 : :
655 : : /*
656 : : * Update chain validation. Check each line pointer that's got a valid
657 : : * successor against that successor.
658 : : */
659 : 11966 : ctx.attnum = -1;
660 [ + + ]: 578638 : for (ctx.offnum = FirstOffsetNumber; ctx.offnum <= maxoff;
661 : 566672 : ctx.offnum = OffsetNumberNext(ctx.offnum))
662 : : {
663 : : ItemId curr_lp;
664 : : ItemId next_lp;
665 : : HeapTupleHeader curr_htup;
666 : : HeapTupleHeader next_htup;
667 : : TransactionId curr_xmin;
668 : : TransactionId curr_xmax;
669 : : TransactionId next_xmin;
670 : 566672 : OffsetNumber nextoffnum = successor[ctx.offnum];
671 : :
672 : : /*
673 : : * The current line pointer may not have a successor, either
674 : : * because it's not valid or because it didn't point to anything.
675 : : * In either case, we have to give up.
676 : : *
677 : : * If the current line pointer does point to something, it's
678 : : * possible that the target line pointer isn't valid. We have to
679 : : * give up in that case, too.
680 : : */
681 [ + + - + ]: 566672 : if (nextoffnum == InvalidOffsetNumber || !lp_valid[nextoffnum])
682 : 561974 : continue;
683 : :
684 : : /* We have two valid line pointers that we can examine. */
685 : 4698 : curr_lp = PageGetItemId(ctx.page, ctx.offnum);
686 : 4698 : next_lp = PageGetItemId(ctx.page, nextoffnum);
687 : :
688 : : /* Handle the cases where the current line pointer is a redirect. */
689 [ + + ]: 4698 : if (ItemIdIsRedirected(curr_lp))
690 : : {
691 : : /*
692 : : * We should not have set successor[ctx.offnum] to a value
693 : : * other than InvalidOffsetNumber unless that line pointer is
694 : : * LP_NORMAL.
695 : : */
1295 696 [ - + ]: 4503 : Assert(ItemIdIsNormal(next_lp));
697 : :
698 : : /* Can only redirect to a HOT tuple. */
1300 699 : 4503 : next_htup = (HeapTupleHeader) PageGetItem(ctx.page, next_lp);
700 [ + + ]: 4503 : if (!HeapTupleHeaderIsHeapOnly(next_htup))
701 : : {
702 : 1 : report_corruption(&ctx,
703 : : psprintf("redirected line pointer points to a non-heap-only tuple at offset %d",
704 : : nextoffnum));
705 : : }
706 : :
707 : : /* HOT chains should not intersect. */
708 [ + + ]: 4503 : if (predecessor[nextoffnum] != InvalidOffsetNumber)
709 : : {
710 : 1 : report_corruption(&ctx,
711 : : psprintf("redirect line pointer points to offset %d, but offset %d also points there",
307 peter@eisentraut.org 712 : 1 : nextoffnum, predecessor[nextoffnum]));
1300 rhaas@postgresql.org 713 : 1 : continue;
714 : : }
715 : :
716 : : /*
717 : : * This redirect and the tuple to which it points seem to be
718 : : * part of an update chain.
719 : : */
720 : 4502 : predecessor[nextoffnum] = ctx.offnum;
721 : 4502 : continue;
722 : : }
723 : :
724 : : /*
725 : : * If the next line pointer is a redirect, or if it's a tuple but
726 : : * the XMAX of this tuple doesn't match the XMIN of the next
727 : : * tuple, then the two aren't part of the same update chain and
728 : : * there is nothing more to do.
729 : : */
730 [ - + ]: 195 : if (ItemIdIsRedirected(next_lp))
1300 rhaas@postgresql.org 731 :UBC 0 : continue;
1300 rhaas@postgresql.org 732 :CBC 195 : curr_htup = (HeapTupleHeader) PageGetItem(ctx.page, curr_lp);
733 : 195 : curr_xmax = HeapTupleHeaderGetUpdateXid(curr_htup);
734 : 195 : next_htup = (HeapTupleHeader) PageGetItem(ctx.page, next_lp);
735 : 195 : next_xmin = HeapTupleHeaderGetXmin(next_htup);
736 [ + + - + ]: 195 : if (!TransactionIdIsValid(curr_xmax) ||
737 : : !TransactionIdEquals(curr_xmax, next_xmin))
738 : 4 : continue;
739 : :
740 : : /* HOT chains should not intersect. */
741 [ + + ]: 191 : if (predecessor[nextoffnum] != InvalidOffsetNumber)
742 : : {
743 : 1 : report_corruption(&ctx,
744 : : psprintf("tuple points to new version at offset %d, but offset %d also points there",
307 peter@eisentraut.org 745 : 1 : nextoffnum, predecessor[nextoffnum]));
1300 rhaas@postgresql.org 746 : 1 : continue;
747 : : }
748 : :
749 : : /*
750 : : * This tuple and the tuple to which it points seem to be part of
751 : : * an update chain.
752 : : */
753 : 190 : predecessor[nextoffnum] = ctx.offnum;
754 : :
755 : : /*
756 : : * If the current tuple is marked as HOT-updated, then the next
757 : : * tuple should be marked as a heap-only tuple. Conversely, if the
758 : : * current tuple isn't marked as HOT-updated, then the next tuple
759 : : * shouldn't be marked as a heap-only tuple.
760 : : *
761 : : * NB: Can't use HeapTupleHeaderIsHotUpdated() as it checks if
762 : : * hint bits indicate xmin/xmax aborted.
763 : : */
1299 764 [ + + + - ]: 191 : if (!(curr_htup->t_infomask2 & HEAP_HOT_UPDATED) &&
1300 765 : 1 : HeapTupleHeaderIsHeapOnly(next_htup))
766 : : {
767 : 1 : report_corruption(&ctx,
768 : : psprintf("non-heap-only update produced a heap-only tuple at offset %d",
769 : : nextoffnum));
770 : : }
1299 771 [ + + ]: 190 : if ((curr_htup->t_infomask2 & HEAP_HOT_UPDATED) &&
1300 772 [ + + ]: 189 : !HeapTupleHeaderIsHeapOnly(next_htup))
773 : : {
774 : 1 : report_corruption(&ctx,
775 : : psprintf("heap-only update produced a non-heap only tuple at offset %d",
776 : : nextoffnum));
777 : : }
778 : :
779 : : /*
780 : : * If the current tuple's xmin is still in progress but the
781 : : * successor tuple's xmin is committed, that's corruption.
782 : : *
783 : : * NB: We recheck the commit status of the current tuple's xmin
784 : : * here, because it might have committed after we checked it and
785 : : * before we checked the commit status of the successor tuple's
786 : : * xmin. This should be safe because the xmin itself can't have
787 : : * changed, only its commit status.
788 : : */
789 : 190 : curr_xmin = HeapTupleHeaderGetXmin(curr_htup);
790 [ + - ]: 190 : if (xmin_commit_status_ok[ctx.offnum] &&
791 [ + + ]: 190 : xmin_commit_status[ctx.offnum] == XID_IN_PROGRESS &&
792 [ + - ]: 1 : xmin_commit_status_ok[nextoffnum] &&
793 [ + - + - ]: 2 : xmin_commit_status[nextoffnum] == XID_COMMITTED &&
794 : 1 : TransactionIdIsInProgress(curr_xmin))
795 : : {
796 : 1 : report_corruption(&ctx,
797 : : psprintf("tuple with in-progress xmin %u was updated to produce a tuple at offset %d with committed xmin %u",
798 : : curr_xmin,
307 peter@eisentraut.org 799 : 1 : ctx.offnum,
800 : : next_xmin));
801 : : }
802 : :
803 : : /*
804 : : * If the current tuple's xmin is aborted but the successor
805 : : * tuple's xmin is in-progress or committed, that's corruption.
806 : : */
1300 rhaas@postgresql.org 807 [ + - ]: 190 : if (xmin_commit_status_ok[ctx.offnum] &&
808 [ + + ]: 190 : xmin_commit_status[ctx.offnum] == XID_ABORTED &&
809 [ + - ]: 2 : xmin_commit_status_ok[nextoffnum])
810 : : {
811 [ + + ]: 2 : if (xmin_commit_status[nextoffnum] == XID_IN_PROGRESS)
812 : 1 : report_corruption(&ctx,
813 : : psprintf("tuple with aborted xmin %u was updated to produce a tuple at offset %d with in-progress xmin %u",
814 : : curr_xmin,
307 peter@eisentraut.org 815 : 1 : ctx.offnum,
816 : : next_xmin));
1300 rhaas@postgresql.org 817 [ + - ]: 1 : else if (xmin_commit_status[nextoffnum] == XID_COMMITTED)
818 : 1 : report_corruption(&ctx,
819 : : psprintf("tuple with aborted xmin %u was updated to produce a tuple at offset %d with committed xmin %u",
820 : : curr_xmin,
307 peter@eisentraut.org 821 : 1 : ctx.offnum,
822 : : next_xmin));
823 : : }
824 : : }
825 : :
826 : : /*
827 : : * An update chain can start either with a non-heap-only tuple or with
828 : : * a redirect line pointer, but not with a heap-only tuple.
829 : : *
830 : : * (This check is in a separate loop because we need the predecessor
831 : : * array to be fully populated before we can perform it.)
832 : : */
1300 rhaas@postgresql.org 833 : 11966 : for (ctx.offnum = FirstOffsetNumber;
834 [ + + ]: 578638 : ctx.offnum <= maxoff;
835 : 566672 : ctx.offnum = OffsetNumberNext(ctx.offnum))
836 : : {
837 [ + + ]: 566672 : if (xmin_commit_status_ok[ctx.offnum] &&
838 [ + + ]: 552989 : (xmin_commit_status[ctx.offnum] == XID_COMMITTED ||
839 [ + + ]: 7 : xmin_commit_status[ctx.offnum] == XID_IN_PROGRESS) &&
840 [ + + ]: 552984 : predecessor[ctx.offnum] == InvalidOffsetNumber)
841 : : {
842 : : ItemId curr_lp;
843 : :
844 : 548295 : curr_lp = PageGetItemId(ctx.page, ctx.offnum);
845 [ + - ]: 548295 : if (!ItemIdIsRedirected(curr_lp))
846 : : {
847 : : HeapTupleHeader curr_htup;
848 : :
849 : : curr_htup = (HeapTupleHeader)
850 : 548295 : PageGetItem(ctx.page, curr_lp);
851 [ + + ]: 548295 : if (HeapTupleHeaderIsHeapOnly(curr_htup))
852 : 4 : report_corruption(&ctx,
853 : : psprintf("tuple is root of chain but is marked as heap-only tuple"));
854 : : }
855 : : }
856 : : }
857 : :
858 : : /* clean up */
2181 859 : 11966 : UnlockReleaseBuffer(ctx.buffer);
860 : :
861 : : /*
862 : : * Check any toast pointers from the page whose lock we just released
863 : : */
2014 864 [ + + ]: 11966 : if (ctx.toasted_attributes != NIL)
865 : : {
866 : : ListCell *cell;
867 : :
868 [ + - + + : 13220 : foreach(cell, ctx.toasted_attributes)
+ + ]
869 : 12331 : check_toasted_attribute(&ctx, lfirst(cell));
870 : 889 : list_free_deep(ctx.toasted_attributes);
871 : 889 : ctx.toasted_attributes = NIL;
872 : : }
873 : :
2181 874 [ + + - + ]: 11963 : if (on_error_stop && ctx.is_corrupt)
2181 rhaas@postgresql.org 875 :UBC 0 : break;
876 : : }
877 : :
564 melanieplageman@gmai 878 :CBC 1473 : read_stream_end(stream);
879 : :
2181 rhaas@postgresql.org 880 [ + + ]: 1473 : if (vmbuffer != InvalidBuffer)
881 : 1142 : ReleaseBuffer(vmbuffer);
882 : :
883 : : /* Close the associated toast table and indexes, if any. */
884 [ + + ]: 1473 : if (ctx.toast_indexes)
885 : 695 : toast_close_indexes(ctx.toast_indexes, ctx.num_toast_indexes,
886 : : AccessShareLock);
887 [ + + ]: 1473 : if (ctx.toast_rel)
888 : 695 : table_close(ctx.toast_rel, AccessShareLock);
889 : :
890 : : /* Close the main relation */
891 : 1473 : relation_close(ctx.rel, AccessShareLock);
892 : :
893 : 1473 : PG_RETURN_NULL();
894 : : }
895 : :
896 : : /*
897 : : * Heap amcheck's read stream callback for getting the next unskippable block.
898 : : * This callback is only used when 'all-visible' or 'all-frozen' is provided
899 : : * as the skip option to verify_heapam(). With the default 'none',
900 : : * block_range_read_stream_cb() is used instead.
901 : : */
902 : : static BlockNumber
564 melanieplageman@gmai 903 : 865 : heapcheck_read_stream_next_unskippable(ReadStream *stream,
904 : : void *callback_private_data,
905 : : void *per_buffer_data)
906 : : {
907 : 865 : HeapCheckReadStreamData *p = callback_private_data;
908 : :
909 : : /* Loops over [current_blocknum, last_exclusive) blocks */
910 [ + + ]: 898 : for (BlockNumber i; (i = p->range.current_blocknum++) < p->range.last_exclusive;)
911 : : {
912 : 734 : uint8 mapbits = visibilitymap_get_status(p->rel, i, p->vmbuffer);
913 : :
914 [ + + ]: 734 : if (p->skip_option == SKIP_PAGES_ALL_FROZEN)
915 : : {
916 [ + + ]: 384 : if ((mapbits & VISIBILITYMAP_ALL_FROZEN) != 0)
917 : 32 : continue;
918 : : }
919 : :
920 [ + + ]: 702 : if (p->skip_option == SKIP_PAGES_ALL_VISIBLE)
921 : : {
922 [ + + ]: 350 : if ((mapbits & VISIBILITYMAP_ALL_VISIBLE) != 0)
923 : 1 : continue;
924 : : }
925 : :
926 : 701 : return i;
927 : : }
928 : :
929 : 164 : return InvalidBlockNumber;
930 : : }
931 : :
932 : : /*
933 : : * Shared internal implementation for report_corruption and
934 : : * report_toast_corruption.
935 : : */
936 : : static void
2014 rhaas@postgresql.org 937 : 86 : report_corruption_internal(Tuplestorestate *tupstore, TupleDesc tupdesc,
938 : : BlockNumber blkno, OffsetNumber offnum,
939 : : AttrNumber attnum, char *msg)
940 : : {
1549 peter@eisentraut.org 941 : 86 : Datum values[HEAPCHECK_RELATION_COLS] = {0};
942 : 86 : bool nulls[HEAPCHECK_RELATION_COLS] = {0};
943 : : HeapTuple tuple;
944 : :
2014 rhaas@postgresql.org 945 : 86 : values[0] = Int64GetDatum(blkno);
946 : 86 : values[1] = Int32GetDatum(offnum);
947 : 86 : values[2] = Int32GetDatum(attnum);
948 : 86 : nulls[2] = (attnum < 0);
2181 949 : 86 : values[3] = CStringGetTextDatum(msg);
950 : :
951 : : /*
952 : : * In principle, there is nothing to prevent a scan over a large, highly
953 : : * corrupted table from using work_mem worth of memory building up the
954 : : * tuplestore. That's ok, but if we also leak the msg argument memory
955 : : * until the end of the query, we could exceed work_mem by more than a
956 : : * trivial amount. Therefore, free the msg argument each time we are
957 : : * called rather than waiting for our current memory context to be freed.
958 : : */
959 : 86 : pfree(msg);
960 : :
2014 961 : 86 : tuple = heap_form_tuple(tupdesc, values, nulls);
962 : 86 : tuplestore_puttuple(tupstore, tuple);
963 : 86 : }
964 : :
965 : : /*
966 : : * Record a single corruption found in the main table. The values in ctx should
967 : : * indicate the location of the corruption, and the msg argument should contain
968 : : * a human-readable description of the corruption.
969 : : *
970 : : * The msg argument is pfree'd by this function.
971 : : */
972 : : static void
973 : 85 : report_corruption(HeapCheckContext *ctx, char *msg)
974 : : {
975 : 85 : report_corruption_internal(ctx->tupstore, ctx->tupdesc, ctx->blkno,
976 : 85 : ctx->offnum, ctx->attnum, msg);
977 : 85 : ctx->is_corrupt = true;
978 : 85 : }
979 : :
980 : : /*
981 : : * Record corruption found in the toast table. The values in ta should
982 : : * indicate the location in the main table where the toast pointer was
983 : : * encountered, and the msg argument should contain a human-readable
984 : : * description of the toast table corruption.
985 : : *
986 : : * As above, the msg argument is pfree'd by this function.
987 : : */
988 : : static void
989 : 1 : report_toast_corruption(HeapCheckContext *ctx, ToastedAttribute *ta,
990 : : char *msg)
991 : : {
992 : 1 : report_corruption_internal(ctx->tupstore, ctx->tupdesc, ta->blkno,
993 : 1 : ta->offnum, ta->attnum, msg);
2181 994 : 1 : ctx->is_corrupt = true;
995 : 1 : }
996 : :
997 : : /*
998 : : * Check for tuple header corruption.
999 : : *
1000 : : * Some kinds of corruption make it unsafe to check the tuple attributes, for
1001 : : * example when the line pointer refers to a range of bytes outside the page.
1002 : : * In such cases, we return false (not checkable) after recording appropriate
1003 : : * corruption messages.
1004 : : *
1005 : : * Some other kinds of tuple header corruption confuse the question of where
1006 : : * the tuple attributes begin, or how long the nulls bitmap is, etc., making it
1007 : : * unreasonable to attempt to check attributes, even if all candidate answers
1008 : : * to those questions would not result in reading past the end of the line
1009 : : * pointer or page. In such cases, like above, we record corruption messages
1010 : : * about the header and then return false.
1011 : : *
1012 : : * Other kinds of tuple header corruption do not bear on the question of
1013 : : * whether the tuple attributes can be checked, so we record corruption
1014 : : * messages for them but we do not return false merely because we detected
1015 : : * them.
1016 : : *
1017 : : * Returns whether the tuple is sufficiently sensible to undergo visibility and
1018 : : * attribute checks.
1019 : : */
1020 : : static bool
2020 1021 : 552998 : check_tuple_header(HeapCheckContext *ctx)
1022 : : {
1023 : 552998 : HeapTupleHeader tuphdr = ctx->tuphdr;
2181 1024 : 552998 : uint16 infomask = tuphdr->t_infomask;
1300 1025 : 552998 : TransactionId curr_xmax = HeapTupleHeaderGetUpdateXid(tuphdr);
2020 1026 : 552998 : bool result = true;
1027 : : unsigned expected_hoff;
1028 : :
2181 1029 [ + + ]: 552998 : if (ctx->tuphdr->t_hoff > ctx->lp_len)
1030 : : {
1031 : 1 : report_corruption(ctx,
1032 : : psprintf("data begins at offset %u beyond the tuple length %u",
1033 : 1 : ctx->tuphdr->t_hoff, ctx->lp_len));
2020 1034 : 1 : result = false;
1035 : : }
1036 : :
2181 1037 [ + + ]: 552998 : if ((ctx->tuphdr->t_infomask & HEAP_XMAX_COMMITTED) &&
1038 [ + + ]: 176 : (ctx->tuphdr->t_infomask & HEAP_XMAX_IS_MULTI))
1039 : : {
1040 : 2 : report_corruption(ctx,
1041 : : pstrdup("multixact should not be marked committed"));
1042 : :
1043 : : /*
1044 : : * This condition is clearly wrong, but it's not enough to justify
1045 : : * skipping further checks, because we don't rely on this to determine
1046 : : * whether the tuple is visible or to interpret other relevant header
1047 : : * fields.
1048 : : */
1049 : : }
1050 : :
1300 1051 [ + + + + ]: 1105047 : if (!TransactionIdIsValid(curr_xmax) &&
1052 : 552049 : HeapTupleHeaderIsHotUpdated(tuphdr))
1053 : : {
1054 : 1 : report_corruption(ctx,
1055 : : psprintf("tuple has been HOT updated, but xmax is 0"));
1056 : :
1057 : : /*
1058 : : * As above, even though this shouldn't happen, it's not sufficient
1059 : : * justification for skipping further checks, we should still be able
1060 : : * to perform sensibly.
1061 : : */
1062 : : }
1063 : :
1295 1064 [ + + ]: 552998 : if (HeapTupleHeaderIsHeapOnly(tuphdr) &&
1065 [ + + ]: 4694 : ((tuphdr->t_infomask & HEAP_UPDATED) == 0))
1066 : : {
1067 : 1 : report_corruption(ctx,
1068 : : psprintf("tuple is heap only, but not the result of an update"));
1069 : :
1070 : : /* Here again, we can still perform further checks. */
1071 : : }
1072 : :
2181 1073 [ + + ]: 552998 : if (infomask & HEAP_HASNULL)
1074 : 248845 : expected_hoff = MAXALIGN(SizeofHeapTupleHeader + BITMAPLEN(ctx->natts));
1075 : : else
1076 : 304153 : expected_hoff = MAXALIGN(SizeofHeapTupleHeader);
1077 [ + + ]: 552998 : if (ctx->tuphdr->t_hoff != expected_hoff)
1078 : : {
1079 [ + + - + ]: 5 : if ((infomask & HEAP_HASNULL) && ctx->natts == 1)
2181 rhaas@postgresql.org 1080 :UBC 0 : report_corruption(ctx,
1081 : : psprintf("tuple data should begin at byte %u, but actually begins at byte %u (1 attribute, has nulls)",
1082 : 0 : expected_hoff, ctx->tuphdr->t_hoff));
2181 rhaas@postgresql.org 1083 [ + + ]:CBC 5 : else if ((infomask & HEAP_HASNULL))
1084 : 1 : report_corruption(ctx,
1085 : : psprintf("tuple data should begin at byte %u, but actually begins at byte %u (%u attributes, has nulls)",
1086 : 1 : expected_hoff, ctx->tuphdr->t_hoff, ctx->natts));
1087 [ - + ]: 4 : else if (ctx->natts == 1)
2181 rhaas@postgresql.org 1088 :UBC 0 : report_corruption(ctx,
1089 : : psprintf("tuple data should begin at byte %u, but actually begins at byte %u (1 attribute, no nulls)",
1090 : 0 : expected_hoff, ctx->tuphdr->t_hoff));
1091 : : else
2181 rhaas@postgresql.org 1092 :CBC 4 : report_corruption(ctx,
1093 : : psprintf("tuple data should begin at byte %u, but actually begins at byte %u (%u attributes, no nulls)",
1094 : 4 : expected_hoff, ctx->tuphdr->t_hoff, ctx->natts));
2020 1095 : 5 : result = false;
1096 : : }
1097 : :
1098 : 552998 : return result;
1099 : : }
1100 : :
1101 : : /*
1102 : : * Checks tuple visibility so we know which further checks are safe to
1103 : : * perform.
1104 : : *
1105 : : * If a tuple could have been inserted by a transaction that also added a
1106 : : * column to the table, but which ultimately did not commit, or which has not
1107 : : * yet committed, then the table's current TupleDesc might differ from the one
1108 : : * used to construct this tuple, so we must not check it.
1109 : : *
1110 : : * As a special case, if our own transaction inserted the tuple, even if we
1111 : : * added a column to the table, our TupleDesc should match. We could check the
1112 : : * tuple, but choose not to do so.
1113 : : *
1114 : : * If a tuple has been updated or deleted, we can still read the old tuple for
1115 : : * corruption checking purposes, as long as we are careful about concurrent
1116 : : * vacuums. The main table tuple itself cannot be vacuumed away because we
1117 : : * hold a buffer lock on the page, but if the deleting transaction is older
1118 : : * than our transaction snapshot's xmin, then vacuum could remove the toast at
1119 : : * any time, so we must not try to follow TOAST pointers.
1120 : : *
1121 : : * If xmin or xmax values are older than can be checked against clog, or appear
1122 : : * to be in the future (possibly due to wrap-around), then we cannot make a
1123 : : * determination about the visibility of the tuple, so we skip further checks.
1124 : : *
1125 : : * Returns true if the tuple itself should be checked, false otherwise. Sets
1126 : : * ctx->tuple_could_be_pruned if the tuple -- and thus also any associated
1127 : : * TOAST tuples -- are eligible for pruning.
1128 : : *
1129 : : * Sets *xmin_commit_status_ok to true if the commit status of xmin is known
1130 : : * and false otherwise. If it's set to true, then also set *xmin_commit_status
1131 : : * to the actual commit status.
1132 : : */
1133 : : static bool
1300 1134 : 552993 : check_tuple_visibility(HeapCheckContext *ctx, bool *xmin_commit_status_ok,
1135 : : XidCommitStatus *xmin_commit_status)
1136 : : {
1137 : : TransactionId xmin;
1138 : : TransactionId xvac;
1139 : : TransactionId xmax;
1140 : : XidCommitStatus xmin_status;
1141 : : XidCommitStatus xvac_status;
1142 : : XidCommitStatus xmax_status;
2020 1143 : 552993 : HeapTupleHeader tuphdr = ctx->tuphdr;
1144 : :
1145 : 552993 : ctx->tuple_could_be_pruned = true; /* have not yet proven otherwise */
1242 tgl@sss.pgh.pa.us 1146 : 552993 : *xmin_commit_status_ok = false; /* have not yet proven otherwise */
1147 : :
1148 : : /* If xmin is normal, it should be within valid range */
2020 rhaas@postgresql.org 1149 : 552993 : xmin = HeapTupleHeaderGetXmin(tuphdr);
1150 [ - + + + : 552993 : switch (get_xid_status(xmin, ctx, &xmin_status))
+ - ]
1151 : : {
2020 rhaas@postgresql.org 1152 :UBC 0 : case XID_INVALID:
1153 : : /* Could be the result of a speculative insertion that aborted. */
1299 1154 : 0 : return false;
2020 rhaas@postgresql.org 1155 :CBC 552989 : case XID_BOUNDS_OK:
1300 1156 : 552989 : *xmin_commit_status_ok = true;
1157 : 552989 : *xmin_commit_status = xmin_status;
2020 1158 : 552989 : break;
1159 : 1 : case XID_IN_FUTURE:
1160 : 1 : report_corruption(ctx,
1161 : : psprintf("xmin %u equals or exceeds next valid transaction ID %u:%u",
1162 : : xmin,
1163 : 1 : EpochFromFullTransactionId(ctx->next_fxid),
1164 : 1 : XidFromFullTransactionId(ctx->next_fxid)));
1165 : 1 : return false;
1166 : 2 : case XID_PRECEDES_CLUSTERMIN:
1167 : 2 : report_corruption(ctx,
1168 : : psprintf("xmin %u precedes oldest valid transaction ID %u:%u",
1169 : : xmin,
1170 : 2 : EpochFromFullTransactionId(ctx->oldest_fxid),
1171 : 2 : XidFromFullTransactionId(ctx->oldest_fxid)));
1172 : 2 : return false;
1173 : 1 : case XID_PRECEDES_RELMIN:
1174 : 1 : report_corruption(ctx,
1175 : : psprintf("xmin %u precedes relation freeze threshold %u:%u",
1176 : : xmin,
1177 : 1 : EpochFromFullTransactionId(ctx->relfrozenfxid),
1178 : 1 : XidFromFullTransactionId(ctx->relfrozenfxid)));
1179 : 1 : return false;
1180 : : }
1181 : :
1182 : : /*
1183 : : * Has inserting transaction committed?
1184 : : */
2181 1185 [ + + ]: 552989 : if (!HeapTupleHeaderXminCommitted(tuphdr))
1186 : : {
1187 [ - + ]: 7253 : if (HeapTupleHeaderXminInvalid(tuphdr))
2020 rhaas@postgresql.org 1188 :UBC 0 : return false; /* inserter aborted, don't check */
1189 : : /* Used by pre-9.0 binary upgrades */
2020 rhaas@postgresql.org 1190 [ - + ]:CBC 7253 : else if (tuphdr->t_infomask & HEAP_MOVED_OFF)
1191 : : {
2020 rhaas@postgresql.org 1192 :UBC 0 : xvac = HeapTupleHeaderGetXvac(tuphdr);
1193 : :
1194 [ # # # # : 0 : switch (get_xid_status(xvac, ctx, &xvac_status))
# # ]
1195 : : {
2181 1196 : 0 : case XID_INVALID:
1197 : 0 : report_corruption(ctx,
1198 : : pstrdup("old-style VACUUM FULL transaction ID for moved off tuple is invalid"));
2020 1199 : 0 : return false;
2181 1200 : 0 : case XID_IN_FUTURE:
1201 : 0 : report_corruption(ctx,
1202 : : psprintf("old-style VACUUM FULL transaction ID %u for moved off tuple equals or exceeds next valid transaction ID %u:%u",
1203 : : xvac,
1204 : 0 : EpochFromFullTransactionId(ctx->next_fxid),
1205 : 0 : XidFromFullTransactionId(ctx->next_fxid)));
2020 1206 : 0 : return false;
2181 1207 : 0 : case XID_PRECEDES_RELMIN:
1208 : 0 : report_corruption(ctx,
1209 : : psprintf("old-style VACUUM FULL transaction ID %u for moved off tuple precedes relation freeze threshold %u:%u",
1210 : : xvac,
1211 : 0 : EpochFromFullTransactionId(ctx->relfrozenfxid),
1212 : 0 : XidFromFullTransactionId(ctx->relfrozenfxid)));
2020 1213 : 0 : return false;
2181 1214 : 0 : case XID_PRECEDES_CLUSTERMIN:
1215 : 0 : report_corruption(ctx,
1216 : : psprintf("old-style VACUUM FULL transaction ID %u for moved off tuple precedes oldest valid transaction ID %u:%u",
1217 : : xvac,
1218 : 0 : EpochFromFullTransactionId(ctx->oldest_fxid),
1219 : 0 : XidFromFullTransactionId(ctx->oldest_fxid)));
2020 1220 : 0 : return false;
2181 1221 : 0 : case XID_BOUNDS_OK:
2020 1222 : 0 : break;
1223 : : }
1224 : :
1225 [ # # # # : 0 : switch (xvac_status)
# ]
1226 : : {
1227 : 0 : case XID_IS_CURRENT_XID:
1228 : 0 : report_corruption(ctx,
1229 : : psprintf("old-style VACUUM FULL transaction ID %u for moved off tuple matches our current transaction ID",
1230 : : xvac));
1231 : 0 : return false;
1232 : 0 : case XID_IN_PROGRESS:
1233 : 0 : report_corruption(ctx,
1234 : : psprintf("old-style VACUUM FULL transaction ID %u for moved off tuple appears to be in progress",
1235 : : xvac));
1236 : 0 : return false;
1237 : :
1238 : 0 : case XID_COMMITTED:
1239 : :
1240 : : /*
1241 : : * The tuple is dead, because the xvac transaction moved
1242 : : * it off and committed. It's checkable, but also
1243 : : * prunable.
1244 : : */
1245 : 0 : return true;
1246 : :
1247 : 0 : case XID_ABORTED:
1248 : :
1249 : : /*
1250 : : * The original xmin must have committed, because the xvac
1251 : : * transaction tried to move it later. Since xvac is
1252 : : * aborted, whether it's still alive now depends on the
1253 : : * status of xmax.
1254 : : */
1255 : 0 : break;
1256 : : }
1257 : : }
1258 : : /* Used by pre-9.0 binary upgrades */
2020 rhaas@postgresql.org 1259 [ - + ]:CBC 7253 : else if (tuphdr->t_infomask & HEAP_MOVED_IN)
1260 : : {
2020 rhaas@postgresql.org 1261 :UBC 0 : xvac = HeapTupleHeaderGetXvac(tuphdr);
1262 : :
1263 [ # # # # : 0 : switch (get_xid_status(xvac, ctx, &xvac_status))
# # ]
1264 : : {
2181 1265 : 0 : case XID_INVALID:
1266 : 0 : report_corruption(ctx,
1267 : : pstrdup("old-style VACUUM FULL transaction ID for moved in tuple is invalid"));
1268 : 0 : return false;
1269 : 0 : case XID_IN_FUTURE:
1270 : 0 : report_corruption(ctx,
1271 : : psprintf("old-style VACUUM FULL transaction ID %u for moved in tuple equals or exceeds next valid transaction ID %u:%u",
1272 : : xvac,
1273 : 0 : EpochFromFullTransactionId(ctx->next_fxid),
1274 : 0 : XidFromFullTransactionId(ctx->next_fxid)));
2020 1275 : 0 : return false;
2181 1276 : 0 : case XID_PRECEDES_RELMIN:
1277 : 0 : report_corruption(ctx,
1278 : : psprintf("old-style VACUUM FULL transaction ID %u for moved in tuple precedes relation freeze threshold %u:%u",
1279 : : xvac,
1280 : 0 : EpochFromFullTransactionId(ctx->relfrozenfxid),
1281 : 0 : XidFromFullTransactionId(ctx->relfrozenfxid)));
2020 1282 : 0 : return false;
2181 1283 : 0 : case XID_PRECEDES_CLUSTERMIN:
1284 : 0 : report_corruption(ctx,
1285 : : psprintf("old-style VACUUM FULL transaction ID %u for moved in tuple precedes oldest valid transaction ID %u:%u",
1286 : : xvac,
1287 : 0 : EpochFromFullTransactionId(ctx->oldest_fxid),
1288 : 0 : XidFromFullTransactionId(ctx->oldest_fxid)));
2020 1289 : 0 : return false;
2181 1290 : 0 : case XID_BOUNDS_OK:
2020 1291 : 0 : break;
1292 : : }
1293 : :
1294 [ # # # # : 0 : switch (xvac_status)
# ]
1295 : : {
1296 : 0 : case XID_IS_CURRENT_XID:
1297 : 0 : report_corruption(ctx,
1298 : : psprintf("old-style VACUUM FULL transaction ID %u for moved in tuple matches our current transaction ID",
1299 : : xvac));
1300 : 0 : return false;
1301 : 0 : case XID_IN_PROGRESS:
1302 : 0 : report_corruption(ctx,
1303 : : psprintf("old-style VACUUM FULL transaction ID %u for moved in tuple appears to be in progress",
1304 : : xvac));
1305 : 0 : return false;
1306 : :
1307 : 0 : case XID_COMMITTED:
1308 : :
1309 : : /*
1310 : : * The original xmin must have committed, because the xvac
1311 : : * transaction moved it later. Whether it's still alive
1312 : : * now depends on the status of xmax.
1313 : : */
1314 : 0 : break;
1315 : :
1316 : 0 : case XID_ABORTED:
1317 : :
1318 : : /*
1319 : : * The tuple is dead, because the xvac transaction moved
1320 : : * it off and committed. It's checkable, but also
1321 : : * prunable.
1322 : : */
1323 : 0 : return true;
1324 : : }
1325 : : }
2020 rhaas@postgresql.org 1326 [ + + ]:CBC 7253 : else if (xmin_status != XID_COMMITTED)
1327 : : {
1328 : : /*
1329 : : * Inserting transaction is not in progress, and not committed, so
1330 : : * it might have changed the TupleDesc in ways we don't know
1331 : : * about. Thus, don't try to check the tuple structure.
1332 : : *
1333 : : * If xmin_status happens to be XID_IS_CURRENT_XID, then in theory
1334 : : * any such DDL changes ought to be visible to us, so perhaps we
1335 : : * could check anyway in that case. But, for now, let's be
1336 : : * conservative and treat this like any other uncommitted insert.
1337 : : */
1338 : 7 : return false;
1339 : : }
1340 : : }
1341 : :
1342 : : /*
1343 : : * Okay, the inserter committed, so it was good at some point. Now what
1344 : : * about the deleting transaction?
1345 : : */
1346 : :
1347 [ + + ]: 552982 : if (tuphdr->t_infomask & HEAP_XMAX_IS_MULTI)
1348 : : {
1349 : : /*
1350 : : * xmax is a multixact, so sanity-check the MXID. Note that we do this
1351 : : * prior to checking for HEAP_XMAX_INVALID or
1352 : : * HEAP_XMAX_IS_LOCKED_ONLY. This might therefore complain about
1353 : : * things that wouldn't actually be a problem during a normal scan,
1354 : : * but eventually we're going to have to freeze, and that process will
1355 : : * ignore hint bits.
1356 : : *
1357 : : * Even if the MXID is out of range, we still know that the original
1358 : : * insert committed, so we can check the tuple itself. However, we
1359 : : * can't rule out the possibility that this tuple is dead, so don't
1360 : : * clear ctx->tuple_could_be_pruned. Possibly we should go ahead and
1361 : : * clear that flag anyway if HEAP_XMAX_INVALID is set or if
1362 : : * HEAP_XMAX_IS_LOCKED_ONLY is true, but for now we err on the side of
1363 : : * avoiding possibly-bogus complaints about missing TOAST entries.
1364 : : */
1365 : 58 : xmax = HeapTupleHeaderGetRawXmax(tuphdr);
1366 [ - + - + : 58 : switch (check_mxid_valid_in_rel(xmax, ctx))
+ - ]
1367 : : {
2020 rhaas@postgresql.org 1368 :UBC 0 : case XID_INVALID:
1369 : 0 : report_corruption(ctx,
1370 : : pstrdup("multitransaction ID is invalid"));
1371 : 0 : return true;
2020 rhaas@postgresql.org 1372 :CBC 1 : case XID_PRECEDES_RELMIN:
1373 : 1 : report_corruption(ctx,
1374 : : psprintf("multitransaction ID %u precedes relation minimum multitransaction ID threshold %u",
1375 : : xmax, ctx->relminmxid));
1376 : 1 : return true;
2020 rhaas@postgresql.org 1377 :UBC 0 : case XID_PRECEDES_CLUSTERMIN:
1378 : 0 : report_corruption(ctx,
1379 : : psprintf("multitransaction ID %u precedes oldest valid multitransaction ID threshold %u",
1380 : : xmax, ctx->oldest_mxact));
1381 : 0 : return true;
2020 rhaas@postgresql.org 1382 :CBC 1 : case XID_IN_FUTURE:
1383 : 1 : report_corruption(ctx,
1384 : : psprintf("multitransaction ID %u equals or exceeds next valid multitransaction ID %u",
1385 : : xmax,
1386 : : ctx->next_mxact));
1387 : 1 : return true;
1388 : 56 : case XID_BOUNDS_OK:
1389 : 56 : break;
1390 : : }
1391 : : }
1392 : :
1393 [ + + ]: 552980 : if (tuphdr->t_infomask & HEAP_XMAX_INVALID)
1394 : : {
1395 : : /*
1396 : : * This tuple is live. A concurrently running transaction could
1397 : : * delete it before we get around to checking the toast, but any such
1398 : : * running transaction is surely not less than our safe_xmin, so the
1399 : : * toast cannot be vacuumed out from under us.
1400 : : */
1401 : 552036 : ctx->tuple_could_be_pruned = false;
1402 : 552036 : return true;
1403 : : }
1404 : :
1405 [ + + ]: 944 : if (HEAP_XMAX_IS_LOCKED_ONLY(tuphdr->t_infomask))
1406 : : {
1407 : : /*
1408 : : * "Deleting" xact really only locked it, so the tuple is live in any
1409 : : * case. As above, a concurrently running transaction could delete
1410 : : * it, but it cannot be vacuumed out from under us.
1411 : : */
1412 : 28 : ctx->tuple_could_be_pruned = false;
1413 : 28 : return true;
1414 : : }
1415 : :
1416 [ + + ]: 916 : if (tuphdr->t_infomask & HEAP_XMAX_IS_MULTI)
1417 : : {
1418 : : /*
1419 : : * We already checked above that this multixact is within limits for
1420 : : * this table. Now check the update xid from this multixact.
1421 : : */
1422 : 28 : xmax = HeapTupleGetUpdateXid(tuphdr);
1423 [ - - - - : 28 : switch (get_xid_status(xmax, ctx, &xmax_status))
+ - ]
1424 : : {
2020 rhaas@postgresql.org 1425 :UBC 0 : case XID_INVALID:
1426 : : /* not LOCKED_ONLY, so it has to have an xmax */
1427 : 0 : report_corruption(ctx,
1428 : : pstrdup("update xid is invalid"));
1429 : 0 : return true;
1430 : 0 : case XID_IN_FUTURE:
1431 : 0 : report_corruption(ctx,
1432 : : psprintf("update xid %u equals or exceeds next valid transaction ID %u:%u",
1433 : : xmax,
1434 : 0 : EpochFromFullTransactionId(ctx->next_fxid),
1435 : 0 : XidFromFullTransactionId(ctx->next_fxid)));
1436 : 0 : return true;
1437 : 0 : case XID_PRECEDES_RELMIN:
1438 : 0 : report_corruption(ctx,
1439 : : psprintf("update xid %u precedes relation freeze threshold %u:%u",
1440 : : xmax,
1441 : 0 : EpochFromFullTransactionId(ctx->relfrozenfxid),
1442 : 0 : XidFromFullTransactionId(ctx->relfrozenfxid)));
1443 : 0 : return true;
1444 : 0 : case XID_PRECEDES_CLUSTERMIN:
1445 : 0 : report_corruption(ctx,
1446 : : psprintf("update xid %u precedes oldest valid transaction ID %u:%u",
1447 : : xmax,
1448 : 0 : EpochFromFullTransactionId(ctx->oldest_fxid),
1449 : 0 : XidFromFullTransactionId(ctx->oldest_fxid)));
1450 : 0 : return true;
2020 rhaas@postgresql.org 1451 :CBC 28 : case XID_BOUNDS_OK:
1452 : 28 : break;
1453 : : }
1454 : :
1455 [ - + - - ]: 28 : switch (xmax_status)
1456 : : {
2020 rhaas@postgresql.org 1457 :UBC 0 : case XID_IS_CURRENT_XID:
1458 : : case XID_IN_PROGRESS:
1459 : :
1460 : : /*
1461 : : * The delete is in progress, so it cannot be visible to our
1462 : : * snapshot.
1463 : : */
1464 : 0 : ctx->tuple_could_be_pruned = false;
1465 : 0 : break;
2020 rhaas@postgresql.org 1466 :CBC 28 : case XID_COMMITTED:
1467 : :
1468 : : /*
1469 : : * The delete committed. Whether the toast can be vacuumed
1470 : : * away depends on how old the deleting transaction is.
1471 : : */
1472 : 28 : ctx->tuple_could_be_pruned = TransactionIdPrecedes(xmax,
1473 : : ctx->safe_xmin);
1474 : 28 : break;
2020 rhaas@postgresql.org 1475 :UBC 0 : case XID_ABORTED:
1476 : :
1477 : : /*
1478 : : * The delete aborted or crashed. The tuple is still live.
1479 : : */
1480 : 0 : ctx->tuple_could_be_pruned = false;
1481 : 0 : break;
1482 : : }
1483 : :
1484 : : /* Tuple itself is checkable even if it's dead. */
2020 rhaas@postgresql.org 1485 :CBC 28 : return true;
1486 : : }
1487 : :
1488 : : /* xmax is an XID, not a MXID. Sanity check it. */
1489 : 888 : xmax = HeapTupleHeaderGetRawXmax(tuphdr);
1490 [ + - - + : 888 : switch (get_xid_status(xmax, ctx, &xmax_status))
+ - ]
1491 : : {
1299 1492 : 1 : case XID_INVALID:
1493 : 1 : ctx->tuple_could_be_pruned = false;
1494 : 1 : return true;
2020 rhaas@postgresql.org 1495 :UBC 0 : case XID_IN_FUTURE:
1496 : 0 : report_corruption(ctx,
1497 : : psprintf("xmax %u equals or exceeds next valid transaction ID %u:%u",
1498 : : xmax,
1499 : 0 : EpochFromFullTransactionId(ctx->next_fxid),
1500 : 0 : XidFromFullTransactionId(ctx->next_fxid)));
1501 : 0 : return false; /* corrupt */
1502 : 0 : case XID_PRECEDES_RELMIN:
1503 : 0 : report_corruption(ctx,
1504 : : psprintf("xmax %u precedes relation freeze threshold %u:%u",
1505 : : xmax,
1506 : 0 : EpochFromFullTransactionId(ctx->relfrozenfxid),
1507 : 0 : XidFromFullTransactionId(ctx->relfrozenfxid)));
1508 : 0 : return false; /* corrupt */
2020 rhaas@postgresql.org 1509 :CBC 1 : case XID_PRECEDES_CLUSTERMIN:
1510 : 1 : report_corruption(ctx,
1511 : : psprintf("xmax %u precedes oldest valid transaction ID %u:%u",
1512 : : xmax,
1513 : 1 : EpochFromFullTransactionId(ctx->oldest_fxid),
1514 : 1 : XidFromFullTransactionId(ctx->oldest_fxid)));
1515 : 1 : return false; /* corrupt */
1516 : 886 : case XID_BOUNDS_OK:
1517 : 886 : break;
1518 : : }
1519 : :
1520 : : /*
1521 : : * Whether the toast can be vacuumed away depends on how old the deleting
1522 : : * transaction is.
1523 : : */
1524 [ - + + - ]: 886 : switch (xmax_status)
1525 : : {
2020 rhaas@postgresql.org 1526 :UBC 0 : case XID_IS_CURRENT_XID:
1527 : : case XID_IN_PROGRESS:
1528 : :
1529 : : /*
1530 : : * The delete is in progress, so it cannot be visible to our
1531 : : * snapshot.
1532 : : */
1533 : 0 : ctx->tuple_could_be_pruned = false;
1534 : 0 : break;
1535 : :
2020 rhaas@postgresql.org 1536 :CBC 883 : case XID_COMMITTED:
1537 : :
1538 : : /*
1539 : : * The delete committed. Whether the toast can be vacuumed away
1540 : : * depends on how old the deleting transaction is.
1541 : : */
1542 : 883 : ctx->tuple_could_be_pruned = TransactionIdPrecedes(xmax,
1543 : : ctx->safe_xmin);
1544 : 883 : break;
1545 : :
1546 : 3 : case XID_ABORTED:
1547 : :
1548 : : /*
1549 : : * The delete aborted or crashed. The tuple is still live.
1550 : : */
1551 : 3 : ctx->tuple_could_be_pruned = false;
1552 : 3 : break;
1553 : : }
1554 : :
1555 : : /* Tuple itself is checkable even if it's dead. */
1556 : 886 : return true;
1557 : : }
1558 : :
1559 : :
1560 : : /*
1561 : : * Check the current toast tuple against the state tracked in ctx, recording
1562 : : * any corruption found in ctx->tupstore.
1563 : : *
1564 : : * This is not equivalent to running verify_heapam on the toast table itself,
1565 : : * and is not hardened against corruption of the toast table. Rather, when
1566 : : * validating a toasted attribute in the main table, the sequence of toast
1567 : : * tuples that store the toasted value are retrieved and checked in order, with
1568 : : * each toast tuple being checked against where we are in the sequence, as well
1569 : : * as each toast tuple having its varlena structure sanity checked.
1570 : : *
1571 : : * On entry, *expected_chunk_seq should be the chunk_seq value that we expect
1572 : : * to find in toasttup. On exit, it will be updated to the value the next call
1573 : : * to this function should expect to see.
1574 : : */
1575 : : static void
2014 1576 : 41659 : check_toast_tuple(HeapTuple toasttup, HeapCheckContext *ctx,
1577 : : ToastedAttribute *ta, int32 *expected_chunk_seq,
1578 : : uint32 extsize, int32 max_chunk_size)
1579 : : {
1580 : : int32 chunk_seq;
1581 : : int32 last_chunk_seq;
1582 : : Pointer chunk;
1583 : : bool isnull;
1584 : : int32 chunksize;
1585 : : int32 expected_size;
27 michael@paquier.xyz 1586 :GNC 41659 : Oid8 toast_valueid = ta->va_valueid;
1587 : :
38 1588 : 41659 : last_chunk_seq = (extsize - 1) / max_chunk_size;
1589 : :
1590 : : /* Sanity-check the sequence number. */
1988 rhaas@postgresql.org 1591 :CBC 41659 : chunk_seq = DatumGetInt32(fastgetattr(toasttup, 2,
1592 : 41659 : ctx->toast_rel->rd_att, &isnull));
2181 1593 [ - + ]: 41659 : if (isnull)
1594 : : {
2014 rhaas@postgresql.org 1595 :UBC 0 : report_toast_corruption(ctx, ta,
1596 : : psprintf("toast value %" PRIu64 " has toast chunk with null sequence number",
1597 : : toast_valueid));
2181 1598 : 0 : return;
1599 : : }
1988 rhaas@postgresql.org 1600 [ - + ]:CBC 41659 : if (chunk_seq != *expected_chunk_seq)
1601 : : {
1602 : : /* Either the TOAST index is corrupt, or we don't have all chunks. */
1988 rhaas@postgresql.org 1603 :UBC 0 : report_toast_corruption(ctx, ta,
1604 : : psprintf("toast value %" PRIu64 " index scan returned chunk %d when expecting chunk %d",
1605 : : toast_valueid,
1606 : : chunk_seq, *expected_chunk_seq));
1607 : : }
1988 rhaas@postgresql.org 1608 :CBC 41659 : *expected_chunk_seq = chunk_seq + 1;
1609 : :
1610 : : /* Sanity-check the chunk data. */
2181 1611 : 41659 : chunk = DatumGetPointer(fastgetattr(toasttup, 3,
1612 : 41659 : ctx->toast_rel->rd_att, &isnull));
1613 [ - + ]: 41659 : if (isnull)
1614 : : {
2014 rhaas@postgresql.org 1615 :UBC 0 : report_toast_corruption(ctx, ta,
1616 : : psprintf("toast value %" PRIu64 " chunk %d has null data",
1617 : : toast_valueid,
1618 : : chunk_seq));
2181 1619 : 0 : return;
1620 : : }
2181 rhaas@postgresql.org 1621 [ + - ]:CBC 41659 : if (!VARATT_IS_EXTENDED(chunk))
1622 : 41659 : chunksize = VARSIZE(chunk) - VARHDRSZ;
2181 rhaas@postgresql.org 1623 [ # # ]:UBC 0 : else if (VARATT_IS_SHORT(chunk))
1624 : : {
1625 : : /*
1626 : : * could happen due to heap_form_tuple doing its thing
1627 : : */
1628 : 0 : chunksize = VARSIZE_SHORT(chunk) - VARHDRSZ_SHORT;
1629 : : }
1630 : : else
1631 : : {
1632 : : /* should never happen */
1633 : 0 : uint32 header = ((varattrib_4b *) chunk)->va_4byte.va_header;
1634 : :
2014 1635 : 0 : report_toast_corruption(ctx, ta,
1636 : : psprintf("toast value %" PRIu64 " chunk %d has invalid varlena header %0x",
1637 : : toast_valueid,
1638 : : chunk_seq, header));
2181 1639 : 0 : return;
1640 : : }
1641 : :
1642 : : /*
1643 : : * Some checks on the data we've found
1644 : : */
1988 rhaas@postgresql.org 1645 [ - + ]:CBC 41659 : if (chunk_seq > last_chunk_seq)
1646 : : {
2014 rhaas@postgresql.org 1647 :UBC 0 : report_toast_corruption(ctx, ta,
1648 : : psprintf("toast value %" PRIu64 " chunk %d follows last expected chunk %d",
1649 : : toast_valueid,
1650 : : chunk_seq, last_chunk_seq));
2181 1651 : 0 : return;
1652 : : }
1653 : :
38 michael@paquier.xyz 1654 :GNC 41659 : expected_size = chunk_seq < last_chunk_seq ? max_chunk_size
1655 [ + + ]: 41659 : : extsize - (last_chunk_seq * max_chunk_size);
1656 : :
2181 rhaas@postgresql.org 1657 [ - + ]:CBC 41659 : if (chunksize != expected_size)
2014 rhaas@postgresql.org 1658 :UBC 0 : report_toast_corruption(ctx, ta,
1659 : : psprintf("toast value %" PRIu64 " chunk %d has size %u, but expected size %u",
1660 : : toast_valueid,
1661 : : chunk_seq, chunksize, expected_size));
1662 : : }
1663 : :
1664 : : /*
1665 : : * Check the current attribute as tracked in ctx, recording any corruption
1666 : : * found in ctx->tupstore.
1667 : : *
1668 : : * This function follows the logic performed by heap_deform_tuple(), and in the
1669 : : * case of a toasted value, optionally stores the toast pointer so later it can
1670 : : * be checked following the logic of detoast_external_attr(), checking for any
1671 : : * conditions that would result in either of those functions Asserting or
1672 : : * crashing the backend. The checks performed by Asserts present in those two
1673 : : * functions are also performed here and in check_toasted_attribute. In cases
1674 : : * where those two functions are a bit cavalier in their assumptions about data
1675 : : * being correct, we perform additional checks not present in either of those
1676 : : * two functions. Where some condition is checked in both of those functions,
1677 : : * we perform it here twice, as we parallel the logical flow of those two
1678 : : * functions. The presence of duplicate checks seems a reasonable price to pay
1679 : : * for keeping this code tightly coupled with the code it protects.
1680 : : *
1681 : : * Returns true if the tuple attribute is sane enough for processing to
1682 : : * continue on to the next attribute, false otherwise.
1683 : : */
1684 : : static bool
2181 rhaas@postgresql.org 1685 :CBC 7952707 : check_tuple_attribute(HeapCheckContext *ctx)
1686 : : {
1687 : : Datum attdatum;
1688 : : varlena *attr;
1689 : : char *tp; /* pointer to the tuple data */
1690 : : uint16 infomask;
1691 : : Oid8 toast_pointer_valueid;
1692 : : int32 va_rawsize;
1693 : : uint32 va_extinfo;
1694 : : CompactAttribute *thisatt;
1695 : : vartag_external va_tag_value;
1696 : : toast_external_data toast_ext_data;
1697 : :
1698 : 7952707 : infomask = ctx->tuphdr->t_infomask;
661 drowley@postgresql.o 1699 : 7952707 : thisatt = TupleDescCompactAttr(RelationGetDescr(ctx->rel), ctx->attnum);
1700 : :
2181 rhaas@postgresql.org 1701 : 7952707 : tp = (char *) ctx->tuphdr + ctx->tuphdr->t_hoff;
1702 : :
1703 [ - + ]: 7952707 : if (ctx->tuphdr->t_hoff + ctx->offset > ctx->lp_len)
1704 : : {
2181 rhaas@postgresql.org 1705 :UBC 0 : report_corruption(ctx,
1706 : : psprintf("attribute with length %u starts at offset %u beyond total tuple length %u",
1707 : 0 : thisatt->attlen,
1708 : 0 : ctx->tuphdr->t_hoff + ctx->offset,
1709 : 0 : ctx->lp_len));
1710 : 0 : return false;
1711 : : }
1712 : :
1713 : : /* Skip null values */
2181 rhaas@postgresql.org 1714 [ + + + + ]:CBC 7952707 : if (infomask & HEAP_HASNULL && att_isnull(ctx->attnum, ctx->tuphdr->t_bits))
1715 : 1362436 : return true;
1716 : :
1717 : : /* Skip non-varlena values, but update offset first */
1718 [ + + ]: 6590271 : if (thisatt->attlen != -1)
1719 : : {
660 drowley@postgresql.o 1720 : 6047531 : ctx->offset = att_nominal_alignby(ctx->offset, thisatt->attalignby);
2181 rhaas@postgresql.org 1721 [ + - - - : 6047531 : ctx->offset = att_addlength_pointer(ctx->offset, thisatt->attlen,
- - ]
1722 : : tp + ctx->offset);
1723 [ - + ]: 6047531 : if (ctx->tuphdr->t_hoff + ctx->offset > ctx->lp_len)
1724 : : {
2181 rhaas@postgresql.org 1725 :UBC 0 : report_corruption(ctx,
1726 : : psprintf("attribute with length %u ends at offset %u beyond total tuple length %u",
1727 : 0 : thisatt->attlen,
1728 : 0 : ctx->tuphdr->t_hoff + ctx->offset,
1729 : 0 : ctx->lp_len));
1730 : 0 : return false;
1731 : : }
2181 rhaas@postgresql.org 1732 :CBC 6047531 : return true;
1733 : : }
1734 : :
1735 : : /* Ok, we're looking at a varlena attribute. */
660 drowley@postgresql.o 1736 [ + + ]: 542740 : ctx->offset = att_pointer_alignby(ctx->offset, thisatt->attalignby, -1,
1737 : : tp + ctx->offset);
1738 : :
1739 : : /* Get the (possibly corrupt) varlena datum */
2181 rhaas@postgresql.org 1740 : 542740 : attdatum = fetchatt(thisatt, tp + ctx->offset);
1741 : :
1742 : : /*
1743 : : * We have the datum, but we cannot decode it carelessly, as it may still
1744 : : * be corrupt.
1745 : : */
1746 : :
1747 : : /*
1748 : : * Check that VARTAG_SIZE won't hit an Assert on a corrupt va_tag before
1749 : : * risking a call into att_addlength_pointer
1750 : : */
1751 [ + + ]: 542740 : if (VARATT_IS_EXTERNAL(tp + ctx->offset))
1752 : : {
1753 : 26768 : uint8 va_tag = VARTAG_EXTERNAL(tp + ctx->offset);
1754 : :
27 michael@paquier.xyz 1755 [ + + - + ]:GNC 26768 : if (va_tag != VARTAG_ONDISK_OID && va_tag != VARTAG_ONDISK_OID8)
1756 : : {
2181 rhaas@postgresql.org 1757 :UBC 0 : report_corruption(ctx,
1758 : : psprintf("toasted attribute has unexpected TOAST tag %u",
1759 : : va_tag));
1760 : : /* We can't know where the next attribute begins */
1761 : 0 : return false;
1762 : : }
1763 : : }
1764 : :
1765 : : /* Ok, should be safe now */
2181 rhaas@postgresql.org 1766 [ - + + - :CBC 542740 : ctx->offset = att_addlength_pointer(ctx->offset, thisatt->attlen,
- - ]
1767 : : tp + ctx->offset);
1768 : :
1769 [ + + ]: 542740 : if (ctx->tuphdr->t_hoff + ctx->offset > ctx->lp_len)
1770 : : {
1771 : 1 : report_corruption(ctx,
1772 : : psprintf("attribute with length %u ends at offset %u beyond total tuple length %u",
1773 : 1 : thisatt->attlen,
1774 : 1 : ctx->tuphdr->t_hoff + ctx->offset,
1775 : 1 : ctx->lp_len));
1776 : :
1777 : 1 : return false;
1778 : : }
1779 : :
1780 : : /*
1781 : : * heap_deform_tuple would be done with this attribute at this point,
1782 : : * having stored it in values[], and would continue to the next attribute.
1783 : : * We go further, because we need to check if the toast datum is corrupt.
1784 : : */
1785 : :
243 michael@paquier.xyz 1786 : 542739 : attr = (varlena *) DatumGetPointer(attdatum);
1787 : :
1788 : : /*
1789 : : * Now we follow the logic of detoast_external_attr(), with the same
1790 : : * caveats about being paranoid about corruption.
1791 : : */
1792 : :
1793 : : /* Skip values that are not external */
2181 rhaas@postgresql.org 1794 [ + + ]: 542739 : if (!VARATT_IS_EXTERNAL(attr))
1795 : 515971 : return true;
1796 : :
1797 : : /* It is external, and we're looking at a page on disk */
1798 : :
1799 : : /* Must copy attr into a decoded pointer for alignment considerations */
27 michael@paquier.xyz 1800 :GNC 26768 : toast_external_info_get(attr, &toast_ext_data);
1801 : 26768 : va_tag_value = toast_ext_data.tag;
1802 : 26768 : toast_pointer_valueid = toast_ext_data.valueid;
1803 : 26768 : va_rawsize = toast_ext_data.rawsize;
1804 : 26768 : va_extinfo = toast_ext_data.extinfo;
1805 : :
1806 : : /* Toasted attributes too large to be untoasted should never be stored */
1807 [ - + ]: 26768 : if (va_rawsize > VARLENA_SIZE_LIMIT)
1802 rhaas@postgresql.org 1808 :UBC 0 : report_corruption(ctx,
1809 : : psprintf("toast value %" PRIu64 " rawsize %d exceeds limit %d",
1810 : : toast_pointer_valueid,
1811 : : va_rawsize,
1812 : : VARLENA_SIZE_LIMIT));
1813 : :
27 michael@paquier.xyz 1814 [ + + ]:GNC 26768 : if (VARATT_EXTINFO_IS_COMPRESSED(toast_ext_data.extinfo, toast_ext_data.rawsize))
1815 : : {
1816 : : ToastCompressionId cmid;
1802 rhaas@postgresql.org 1817 :CBC 2538 : bool valid = false;
1818 : :
1819 : : /* Compressed attributes should have a valid compression method */
27 michael@paquier.xyz 1820 :GNC 2538 : cmid = VARATT_EXTINFO_GET_COMPRESS_METHOD(toast_ext_data.extinfo);
1802 rhaas@postgresql.org 1821 [ + - - ]:CBC 2538 : switch (cmid)
1822 : : {
1823 : : /* List of all valid compression method IDs */
1824 : 2538 : case TOAST_PGLZ_COMPRESSION_ID:
1825 : : case TOAST_LZ4_COMPRESSION_ID:
1826 : 2538 : valid = true;
1827 : 2538 : break;
1828 : :
1829 : : /* Recognized but invalid compression method ID */
1802 rhaas@postgresql.org 1830 :UBC 0 : case TOAST_INVALID_COMPRESSION_ID:
1831 : 0 : break;
1832 : :
1833 : : /* Intentionally no default here */
1834 : : }
1802 rhaas@postgresql.org 1835 [ - + ]:CBC 2538 : if (!valid)
1802 rhaas@postgresql.org 1836 :UBC 0 : report_corruption(ctx,
1837 : : psprintf("toast value %" PRIu64 " has invalid compression method id %d",
1838 : : toast_pointer_valueid, cmid));
1839 : : }
1840 : :
1841 : : /* The tuple header better claim to contain toasted values */
2181 rhaas@postgresql.org 1842 [ - + ]:CBC 26768 : if (!(infomask & HEAP_HASEXTERNAL))
1843 : : {
2181 rhaas@postgresql.org 1844 :UBC 0 : report_corruption(ctx,
1845 : : psprintf("toast value %" PRIu64 " is external but tuple header flag HEAP_HASEXTERNAL not set",
1846 : : toast_pointer_valueid));
1847 : 0 : return true;
1848 : : }
1849 : :
1850 : : /* The relation better have a toast table */
2181 rhaas@postgresql.org 1851 [ - + ]:CBC 26768 : if (!ctx->rel->rd_rel->reltoastrelid)
1852 : : {
2181 rhaas@postgresql.org 1853 :UBC 0 : report_corruption(ctx,
1854 : : psprintf("toast value %" PRIu64 " is external but relation has no toast relation",
1855 : : toast_pointer_valueid));
1856 : 0 : return true;
1857 : : }
1858 : :
1859 : : /* If we were told to skip toast checking, then we're done. */
2181 rhaas@postgresql.org 1860 [ + + ]:CBC 26768 : if (ctx->toast_rel == NULL)
1861 : 14429 : return true;
1862 : :
1863 : : /*
1864 : : * If this tuple is eligible to be pruned, we cannot check the toast.
1865 : : * Otherwise, we push a copy of the toast tuple so we can check it after
1866 : : * releasing the main table buffer lock.
1867 : : */
2014 1868 [ + + ]: 12339 : if (!ctx->tuple_could_be_pruned)
1869 : : {
1870 : : ToastedAttribute *ta;
1871 : :
311 michael@paquier.xyz 1872 : 12337 : ta = palloc0_object(ToastedAttribute);
1873 : :
1874 : : /* The pointer has already been decoded above, just reuse it */
27 michael@paquier.xyz 1875 :GNC 12337 : ta->tag = va_tag_value;
1876 : 12337 : ta->va_valueid = toast_pointer_valueid;
1877 : 12337 : ta->va_extinfo = va_extinfo;
2014 rhaas@postgresql.org 1878 :CBC 12337 : ta->blkno = ctx->blkno;
1879 : 12337 : ta->offnum = ctx->offnum;
1880 : 12337 : ta->attnum = ctx->attnum;
1881 : 12337 : ctx->toasted_attributes = lappend(ctx->toasted_attributes, ta);
1882 : : }
1883 : :
1884 : 12339 : return true;
1885 : : }
1886 : :
1887 : : /*
1888 : : * For each attribute collected in ctx->toasted_attributes, look up the value
1889 : : * in the toast table and perform checks on it. This function should only be
1890 : : * called on toast pointers which cannot be vacuumed away during our
1891 : : * processing.
1892 : : */
1893 : : static void
1894 : 12331 : check_toasted_attribute(HeapCheckContext *ctx, ToastedAttribute *ta)
1895 : : {
1896 : : ScanKeyData toastkey;
1897 : : SysScanDesc toastscan;
1898 : : bool found_toasttup;
1899 : : HeapTuple toasttup;
1900 : : uint32 extsize;
1988 1901 : 12331 : int32 expected_chunk_seq = 0;
1902 : : int32 last_chunk_seq;
1903 : : int32 max_chunk_size;
1904 : : Oid8 toast_valueid;
1905 : : Oid toast_typid;
1906 : : vartag_external expected_tag;
1907 : :
27 michael@paquier.xyz 1908 :GNC 12331 : toast_valueid = ta->va_valueid;
1909 : 12331 : extsize = VARATT_EXTINFO_GET_EXTSIZE(ta->va_extinfo);
1910 : :
1911 : : /*
1912 : : * Take the chunk_id type from the TOAST table's own definition, not from
1913 : : * the vartag in the main table as that pointer is the very thing under
1914 : : * scrutiny here. The two must agree.
1915 : : */
1916 : 12331 : toast_typid = TupleDescAttr(ctx->toast_rel->rd_att, 0)->atttypid;
1917 [ + + ]: 12331 : if (toast_typid == OID8OID)
1918 : 2 : expected_tag = VARTAG_ONDISK_OID8;
1919 [ + - ]: 12329 : else if (toast_typid == OIDOID)
1920 : 12329 : expected_tag = VARTAG_ONDISK_OID;
1921 : : else
1922 : : {
27 michael@paquier.xyz 1923 :UNC 0 : report_toast_corruption(ctx, ta,
1924 : : psprintf("toast value %" PRIu64 " stored in toast table whose chunk_id has unexpected type %u",
1925 : : toast_valueid, toast_typid));
1926 : 0 : return;
1927 : : }
1928 : :
27 michael@paquier.xyz 1929 [ - + ]:GNC 12331 : if (ta->tag != expected_tag)
1930 : : {
27 michael@paquier.xyz 1931 :UNC 0 : report_toast_corruption(ctx, ta,
1932 : : psprintf("toast value %" PRIu64 " has TOAST tag %u, but chunk_id of toast table has type %u",
1933 : 0 : toast_valueid, (uint8) ta->tag,
1934 : : toast_typid));
1935 : 0 : return;
1936 : : }
1937 : :
27 michael@paquier.xyz 1938 [ + + ]:GNC 12331 : max_chunk_size = TOAST_MAX_CHUNK_SIZE(toast_typid);
38 1939 : 12331 : last_chunk_seq = (extsize - 1) / max_chunk_size;
1940 : :
1941 : : /*
1942 : : * Setup a scan key to find chunks in toast table with matching value ID
1943 : : */
27 1944 : 12331 : toast_valueid_scankey_init(&toastkey, toast_typid, toast_valueid);
1945 : :
1946 : : /*
1947 : : * Check if any chunks for this toasted object exist in the toast table,
1948 : : * accessible via the index.
1949 : : */
2181 rhaas@postgresql.org 1950 :CBC 12331 : toastscan = systable_beginscan_ordered(ctx->toast_rel,
1951 : : ctx->valid_toast_index,
1952 : : get_toast_snapshot(), 1,
1953 : : &toastkey);
1954 : 12331 : found_toasttup = false;
1955 : 12331 : while ((toasttup =
1956 : 53990 : systable_getnext_ordered(toastscan,
1957 [ + + ]: 53987 : ForwardScanDirection)) != NULL)
1958 : : {
1959 : 41659 : found_toasttup = true;
27 michael@paquier.xyz 1960 :GNC 41659 : check_toast_tuple(toasttup, ctx, ta, &expected_chunk_seq, extsize,
1961 : : max_chunk_size);
1962 : : }
2181 rhaas@postgresql.org 1963 :CBC 12328 : systable_endscan_ordered(toastscan);
1964 : :
2014 1965 [ + + ]: 12328 : if (!found_toasttup)
1966 : 1 : report_toast_corruption(ctx, ta,
1967 : : psprintf("toast value %" PRIu64 " not found in toast table",
1968 : : toast_valueid));
1988 1969 [ - + ]: 12327 : else if (expected_chunk_seq <= last_chunk_seq)
2014 rhaas@postgresql.org 1970 :UBC 0 : report_toast_corruption(ctx, ta,
1971 : : psprintf("toast value %" PRIu64 " was expected to end at chunk %d, but ended while expecting chunk %d",
1972 : : toast_valueid,
1973 : : last_chunk_seq, expected_chunk_seq));
2181 rhaas@postgresql.org 1974 :ECB (12280) : }
1975 : :
1976 : : /*
1977 : : * Check the current tuple as tracked in ctx, recording any corruption found in
1978 : : * ctx->tupstore.
1979 : : *
1980 : : * We return some information about the status of xmin to aid in validating
1981 : : * update chains.
1982 : : */
1983 : : static void
1300 rhaas@postgresql.org 1984 :CBC 552998 : check_tuple(HeapCheckContext *ctx, bool *xmin_commit_status_ok,
1985 : : XidCommitStatus *xmin_commit_status)
1986 : : {
1987 : : /*
1988 : : * Check various forms of tuple header corruption, and if the header is
1989 : : * too corrupt, do not continue with other checks.
1990 : : */
2014 1991 [ + + ]: 552998 : if (!check_tuple_header(ctx))
2181 1992 : 5 : return;
1993 : :
1994 : : /*
1995 : : * Check tuple visibility. If the inserting transaction aborted, we
1996 : : * cannot assume our relation description matches the tuple structure, and
1997 : : * therefore cannot check it.
1998 : : */
1300 1999 [ + + ]: 552993 : if (!check_tuple_visibility(ctx, xmin_commit_status_ok,
2000 : : xmin_commit_status))
2181 2001 : 12 : return;
2002 : :
2003 : : /*
2004 : : * The tuple is visible, so it must be compatible with the current version
2005 : : * of the relation descriptor. It might have fewer columns than are
2006 : : * present in the relation descriptor, but it cannot have more.
2007 : : */
2008 [ + + ]: 552981 : if (RelationGetDescr(ctx->rel)->natts < ctx->natts)
2009 : : {
2010 : 2 : report_corruption(ctx,
2011 : : psprintf("number of attributes %u exceeds maximum %u expected for table",
2012 : : ctx->natts,
2013 : 2 : RelationGetDescr(ctx->rel)->natts));
2014 : 2 : return;
2015 : : }
2016 : :
2017 : : /*
2018 : : * Check each attribute unless we hit corruption that confuses what to do
2019 : : * next, at which point we abort further attribute checks for this tuple.
2020 : : * Note that we don't abort for all types of corruption, only for those
2021 : : * types where we don't know how to continue. We also don't abort the
2022 : : * checking of toasted attributes collected from the tuple prior to
2023 : : * aborting. Those will still be checked later along with other toasted
2024 : : * attributes collected from the page.
2025 : : */
2026 : 552979 : ctx->offset = 0;
2027 [ + + ]: 8505685 : for (ctx->attnum = 0; ctx->attnum < ctx->natts; ctx->attnum++)
2028 [ + + ]: 7952707 : if (!check_tuple_attribute(ctx))
2029 : 1 : break; /* cannot continue */
2030 : :
2031 : : /* revert attnum to -1 until we again examine individual attributes */
2180 tgl@sss.pgh.pa.us 2032 : 552979 : ctx->attnum = -1;
2033 : : }
2034 : :
2035 : : /*
2036 : : * Convert a TransactionId into a FullTransactionId using our cached values of
2037 : : * the valid transaction ID range. It is the caller's responsibility to have
2038 : : * already updated the cached values, if necessary. This is akin to
2039 : : * FullTransactionIdFromAllowableAt(), but it tolerates corruption in the form
2040 : : * of an xid before epoch 0.
2041 : : */
2042 : : static FullTransactionId
2181 rhaas@postgresql.org 2043 : 74669 : FullTransactionIdFromXidAndCtx(TransactionId xid, const HeapCheckContext *ctx)
2044 : : {
2045 : : uint64 nextfxid_i;
2046 : : int32 diff;
2047 : : FullTransactionId fxid;
2048 : :
1311 andres@anarazel.de 2049 [ - + ]: 74669 : Assert(TransactionIdIsNormal(ctx->next_xid));
2050 [ - + ]: 74669 : Assert(FullTransactionIdIsNormal(ctx->next_fxid));
2051 [ - + ]: 74669 : Assert(XidFromFullTransactionId(ctx->next_fxid) == ctx->next_xid);
2052 : :
2181 rhaas@postgresql.org 2053 [ + + ]: 74669 : if (!TransactionIdIsNormal(xid))
2054 : 190 : return FullTransactionIdFromEpochAndXid(0, xid);
2055 : :
1311 andres@anarazel.de 2056 : 74479 : nextfxid_i = U64FromFullTransactionId(ctx->next_fxid);
2057 : :
2058 : : /* compute the 32bit modulo difference */
2059 : 74479 : diff = (int32) (ctx->next_xid - xid);
2060 : :
2061 : : /*
2062 : : * In cases of corruption we might see a 32bit xid that is before epoch 0.
2063 : : * We can't represent that as a 64bit xid, due to 64bit xids being
2064 : : * unsigned integers, without the modulo arithmetic of 32bit xid. There's
2065 : : * no really nice way to deal with that, but it works ok enough to use
2066 : : * FirstNormalFullTransactionId in that case, as a freshly initdb'd
2067 : : * cluster already has a newer horizon.
2068 : : */
2069 [ + + + + ]: 74479 : if (diff > 0 && (nextfxid_i - FirstNormalTransactionId) < (int64) diff)
2070 : : {
2071 [ - + ]: 4 : Assert(EpochFromFullTransactionId(ctx->next_fxid) == 0);
2072 : 4 : fxid = FirstNormalFullTransactionId;
2073 : : }
2074 : : else
2075 : 74475 : fxid = FullTransactionIdFromU64(nextfxid_i - diff);
2076 : :
2077 [ - + ]: 74479 : Assert(FullTransactionIdIsNormal(fxid));
2078 : 74479 : return fxid;
2079 : : }
2080 : :
2081 : : /*
2082 : : * Update our cached range of valid transaction IDs.
2083 : : */
2084 : : static void
2181 rhaas@postgresql.org 2085 : 1480 : update_cached_xid_range(HeapCheckContext *ctx)
2086 : : {
2087 : : /* Make cached copies */
2088 : 1480 : LWLockAcquire(XidGenLock, LW_SHARED);
1039 heikki.linnakangas@i 2089 : 1480 : ctx->next_fxid = TransamVariables->nextXid;
2090 : 1480 : ctx->oldest_xid = TransamVariables->oldestXid;
2181 rhaas@postgresql.org 2091 : 1480 : LWLockRelease(XidGenLock);
2092 : :
2093 : : /* And compute alternate versions of the same */
2094 : 1480 : ctx->next_xid = XidFromFullTransactionId(ctx->next_fxid);
1311 andres@anarazel.de 2095 : 1480 : ctx->oldest_fxid = FullTransactionIdFromXidAndCtx(ctx->oldest_xid, ctx);
2181 rhaas@postgresql.org 2096 : 1480 : }
2097 : :
2098 : : /*
2099 : : * Update our cached range of valid multitransaction IDs.
2100 : : */
2101 : : static void
2102 : 1478 : update_cached_mxid_range(HeapCheckContext *ctx)
2103 : : {
2104 : 1478 : ReadMultiXactIdRange(&ctx->oldest_mxact, &ctx->next_mxact);
2105 : 1478 : }
2106 : :
2107 : : /*
2108 : : * Return whether the given FullTransactionId is within our cached valid
2109 : : * transaction ID range.
2110 : : */
2111 : : static inline bool
2112 : 62544 : fxid_in_cached_range(FullTransactionId fxid, const HeapCheckContext *ctx)
2113 : : {
2114 [ + + ]: 125085 : return (FullTransactionIdPrecedesOrEquals(ctx->oldest_fxid, fxid) &&
2115 [ + + ]: 62541 : FullTransactionIdPrecedes(fxid, ctx->next_fxid));
2116 : : }
2117 : :
2118 : : /*
2119 : : * Checks whether a multitransaction ID is in the cached valid range, returning
2120 : : * the nature of the range violation, if any.
2121 : : */
2122 : : static XidBoundsViolation
2123 : 60 : check_mxid_in_range(MultiXactId mxid, HeapCheckContext *ctx)
2124 : : {
2125 [ - + ]: 60 : if (!TransactionIdIsValid(mxid))
2181 rhaas@postgresql.org 2126 :UBC 0 : return XID_INVALID;
2181 rhaas@postgresql.org 2127 [ + + ]:CBC 60 : if (MultiXactIdPrecedes(mxid, ctx->relminmxid))
2128 : 2 : return XID_PRECEDES_RELMIN;
2129 [ - + ]: 58 : if (MultiXactIdPrecedes(mxid, ctx->oldest_mxact))
2181 rhaas@postgresql.org 2130 :UBC 0 : return XID_PRECEDES_CLUSTERMIN;
2181 rhaas@postgresql.org 2131 [ + + ]:CBC 58 : if (MultiXactIdPrecedesOrEquals(ctx->next_mxact, mxid))
2132 : 2 : return XID_IN_FUTURE;
2133 : 56 : return XID_BOUNDS_OK;
2134 : : }
2135 : :
2136 : : /*
2137 : : * Checks whether the given mxid is valid to appear in the heap being checked,
2138 : : * returning the nature of the range violation, if any.
2139 : : *
2140 : : * This function attempts to return quickly by caching the known valid mxid
2141 : : * range in ctx. Callers should already have performed the initial setup of
2142 : : * the cache prior to the first call to this function.
2143 : : */
2144 : : static XidBoundsViolation
2145 : 58 : check_mxid_valid_in_rel(MultiXactId mxid, HeapCheckContext *ctx)
2146 : : {
2147 : : XidBoundsViolation result;
2148 : :
2149 : 58 : result = check_mxid_in_range(mxid, ctx);
2150 [ + + ]: 58 : if (result == XID_BOUNDS_OK)
2151 : 56 : return XID_BOUNDS_OK;
2152 : :
2153 : : /* The range may have advanced. Recheck. */
2154 : 2 : update_cached_mxid_range(ctx);
2155 : 2 : return check_mxid_in_range(mxid, ctx);
2156 : : }
2157 : :
2158 : : /*
2159 : : * Checks whether the given transaction ID is (or was recently) valid to appear
2160 : : * in the heap being checked, or whether it is too old or too new to appear in
2161 : : * the relation, returning information about the nature of the bounds violation.
2162 : : *
2163 : : * We cache the range of valid transaction IDs. If xid is in that range, we
2164 : : * conclude that it is valid, even though concurrent changes to the table might
2165 : : * invalidate it under certain corrupt conditions. (For example, if the table
2166 : : * contains corrupt all-frozen bits, a concurrent vacuum might skip the page(s)
2167 : : * containing the xid and then truncate clog and advance the relfrozenxid
2168 : : * beyond xid.) Reporting the xid as valid under such conditions seems
2169 : : * acceptable, since if we had checked it earlier in our scan it would have
2170 : : * truly been valid at that time.
2171 : : *
2172 : : * If the status argument is not NULL, and if and only if the transaction ID
2173 : : * appears to be valid in this relation, the status argument will be set with
2174 : : * the commit status of the transaction ID.
2175 : : */
2176 : : static XidBoundsViolation
2177 : 553909 : get_xid_status(TransactionId xid, HeapCheckContext *ctx,
2178 : : XidCommitStatus *status)
2179 : : {
2180 : : FullTransactionId fxid;
2181 : : FullTransactionId clog_horizon;
2182 : :
2183 : : /* Quick check for special xids */
2184 [ + + ]: 553909 : if (!TransactionIdIsValid(xid))
2185 : 1 : return XID_INVALID;
2186 [ + + + + ]: 553908 : else if (xid == BootstrapTransactionId || xid == FrozenTransactionId)
2187 : : {
2188 [ + - ]: 491364 : if (status != NULL)
2189 : 491364 : *status = XID_COMMITTED;
2190 : 491364 : return XID_BOUNDS_OK;
2191 : : }
2192 : :
2193 : : /* Check if the xid is within bounds */
2194 : 62544 : fxid = FullTransactionIdFromXidAndCtx(xid, ctx);
2195 [ + + ]: 62544 : if (!fxid_in_cached_range(fxid, ctx))
2196 : : {
2197 : : /*
2198 : : * We may have been checking against stale values. Update the cached
2199 : : * range to be sure, and since we relied on the cached range when we
2200 : : * performed the full xid conversion, reconvert.
2201 : : */
2202 : 4 : update_cached_xid_range(ctx);
2203 : 4 : fxid = FullTransactionIdFromXidAndCtx(xid, ctx);
2204 : : }
2205 : :
2206 [ + + ]: 62544 : if (FullTransactionIdPrecedesOrEquals(ctx->next_fxid, fxid))
2207 : 1 : return XID_IN_FUTURE;
2208 [ + + ]: 62543 : if (FullTransactionIdPrecedes(fxid, ctx->oldest_fxid))
2209 : 3 : return XID_PRECEDES_CLUSTERMIN;
2210 [ + + ]: 62540 : if (FullTransactionIdPrecedes(fxid, ctx->relfrozenfxid))
2211 : 1 : return XID_PRECEDES_RELMIN;
2212 : :
2213 : : /* Early return if the caller does not request clog checking */
2214 [ - + ]: 62539 : if (status == NULL)
2181 rhaas@postgresql.org 2215 :UBC 0 : return XID_BOUNDS_OK;
2216 : :
2217 : : /* Early return if we just checked this xid in a prior call */
2181 rhaas@postgresql.org 2218 [ + + ]:CBC 62539 : if (xid == ctx->cached_xid)
2219 : : {
2220 : 53374 : *status = ctx->cached_status;
2221 : 53374 : return XID_BOUNDS_OK;
2222 : : }
2223 : :
2224 : 9165 : *status = XID_COMMITTED;
2225 : 9165 : LWLockAcquire(XactTruncationLock, LW_SHARED);
2226 : : clog_horizon =
1039 heikki.linnakangas@i 2227 : 9165 : FullTransactionIdFromXidAndCtx(TransamVariables->oldestClogXid,
2228 : : ctx);
2181 rhaas@postgresql.org 2229 [ + - ]: 9165 : if (FullTransactionIdPrecedesOrEquals(clog_horizon, fxid))
2230 : : {
2231 [ - + ]: 9165 : if (TransactionIdIsCurrentTransactionId(xid))
2020 rhaas@postgresql.org 2232 :UBC 0 : *status = XID_IS_CURRENT_XID;
2020 rhaas@postgresql.org 2233 [ + + ]:CBC 9165 : else if (TransactionIdIsInProgress(xid))
2181 2234 : 2 : *status = XID_IN_PROGRESS;
2235 [ + + ]: 9163 : else if (TransactionIdDidCommit(xid))
2236 : 9156 : *status = XID_COMMITTED;
2237 : : else
2020 2238 : 7 : *status = XID_ABORTED;
2239 : : }
2181 2240 : 9165 : LWLockRelease(XactTruncationLock);
2241 : 9165 : ctx->cached_xid = xid;
2242 : 9165 : ctx->cached_status = *status;
2243 : 9165 : return XID_BOUNDS_OK;
2244 : : }
|
