src/backend/utils/misc/stack_depth.c - master - githubmirror/postgres

src/backend/utils/misc/stack_depth.c
217 строк6 KB
Andres Freund
Make stack depth check work with asan's use-after-return
28 май 2026, 18:43
28 май 2026, 18:436597017
/*-------------------------------------------------------------------------
 *
 * stack_depth.c
 *	  Functions for monitoring and limiting process stack depth
 *
 * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
 * Portions Copyright (c) 1994, Regents of the University of California
 *
 *
 * IDENTIFICATION
 *	  src/backend/utils/misc/stack_depth.c
 *
 *-------------------------------------------------------------------------
 */

#include "postgres.h"

#include <limits.h>
#include <sys/resource.h>

#include "miscadmin.h"
#include "utils/guc_hooks.h"


/* GUC variable for maximum stack depth (measured in kilobytes) */
int			max_stack_depth = 100;

/* max_stack_depth converted to bytes for speed of checking */
static ssize_t max_stack_depth_bytes = 100 * (ssize_t) 1024;

/*
 * Stack base pointer -- initialized by set_stack_base(), which
 * should be called from main().
 */
static char *stack_base_ptr = NULL;


/*
 * set_stack_base: set up reference point for stack depth checking
 *
 * Returns the old reference point, if any.
 */
pg_stack_base_t
set_stack_base(void)
{
#ifndef HAVE__BUILTIN_FRAME_ADDRESS
	char		stack_base;
#endif
	pg_stack_base_t old;

	old = stack_base_ptr;

	/*
	 * Set up reference point for stack depth checking.  On recent gcc we use
	 * __builtin_frame_address() to avoid a warning about storing a local
	 * variable's address in a long-lived variable.  This is also important
	 * with address sanitizer, see comment in stack_is_too_deep().
	 */
#ifdef HAVE__BUILTIN_FRAME_ADDRESS
	stack_base_ptr = __builtin_frame_address(0);
#else
	stack_base_ptr = &stack_base;
#endif

	return old;
}

/*
 * restore_stack_base: restore reference point for stack depth checking
 *
 * This can be used after set_stack_base() to restore the old value. This
 * is currently only used in PL/Java. When PL/Java calls a backend function
 * from different thread, the thread's stack is at a different location than
 * the main thread's stack, so it sets the base pointer before the call, and
 * restores it afterwards.
 */
void
restore_stack_base(pg_stack_base_t base)
{
	stack_base_ptr = base;
}


/*
 * check_stack_depth/stack_is_too_deep: check for excessively deep recursion
 *
 * This should be called someplace in any recursive routine that might possibly
 * recurse deep enough to overflow the stack.  Most Unixen treat stack
 * overflow as an unrecoverable SIGSEGV, so we want to error out ourselves
 * before hitting the hardware limit.
 *
 * check_stack_depth() just throws an error summarily.  stack_is_too_deep()
 * can be used by code that wants to handle the error condition itself.
 */
void
check_stack_depth(void)
{
	if (stack_is_too_deep())
	{
		ereport(ERROR,
				(errcode(ERRCODE_STATEMENT_TOO_COMPLEX),
				 errmsg("stack depth limit exceeded"),
				 errhint("Increase the configuration parameter \"max_stack_depth\" (currently %dkB), "
						 "after ensuring the platform's stack depth limit is adequate.",
						 max_stack_depth)));
	}
}

bool
stack_is_too_deep(void)
{
#ifndef HAVE__BUILTIN_FRAME_ADDRESS
	char		stack_top_loc;
#endif
	ssize_t		stack_depth;
	char	   *stack_address;

	/*
	 * With address sanitizer's stack-use-after-return check, stack variables
	 * are moved to heap allocations, to allow to detect references to the
	 * memory at a later time. That would break our stack-depth check. Luckily
	 * __builtin_frame_address() works correctly, even under asan.
	 */
#ifndef HAVE__BUILTIN_FRAME_ADDRESS
	stack_address = &stack_top_loc;
#else
	stack_address = (char *) __builtin_frame_address(0);
#endif

	/*
	 * Compute distance from reference point to my stack frame.
	 */
	stack_depth = (ssize_t) (stack_base_ptr - stack_address);

	/*
	 * Take abs value, since stacks grow up on some machines, down on others
	 */
	if (stack_depth < 0)
		stack_depth = -stack_depth;

	/*
	 * Trouble?
	 *
	 * The test on stack_base_ptr prevents us from erroring out if called
	 * before that's been set.  Logically it should be done first, but putting
	 * it last avoids wasting cycles during normal cases.
	 */
	if (stack_depth > max_stack_depth_bytes &&
		stack_base_ptr != NULL)
		return true;

	return false;
}


/* GUC check hook for max_stack_depth */
bool
check_max_stack_depth(int *newval, void **extra, GucSource source)
{
	ssize_t		newval_bytes = *newval * (ssize_t) 1024;
	ssize_t		stack_rlimit = get_stack_depth_rlimit();

	if (stack_rlimit > 0 && newval_bytes > stack_rlimit - STACK_DEPTH_SLOP)
	{
		GUC_check_errdetail("\"max_stack_depth\" must not exceed %zdkB.",
							(stack_rlimit - STACK_DEPTH_SLOP) / 1024);
		GUC_check_errhint("Increase the platform's stack depth limit via \"ulimit -s\" or local equivalent.");
		return false;
	}
	return true;
}

/* GUC assign hook for max_stack_depth */
void
assign_max_stack_depth(int newval, void *extra)
{
	ssize_t		newval_bytes = newval * (ssize_t) 1024;

	max_stack_depth_bytes = newval_bytes;
}

/*
 * Obtain platform stack depth limit (in bytes)
 *
 * Return -1 if unknown
 *
 * Note: we choose to use ssize_t not size_t as the result type because
 * callers compute values that could theoretically go negative,
 * such as "result - STACK_DEPTH_SLOP".
 */
ssize_t
get_stack_depth_rlimit(void)
{
#if defined(HAVE_GETRLIMIT)
	static ssize_t val = 0;

	/* This won't change after process launch, so check just once */
	if (val == 0)
	{
		struct rlimit rlim;

		if (getrlimit(RLIMIT_STACK, &rlim) < 0)
			val = -1;
		else if (rlim.rlim_cur == RLIM_INFINITY)
			val = SSIZE_MAX;
		/* rlim_cur is probably of an unsigned type, so check for overflow */
		else if (rlim.rlim_cur >= SSIZE_MAX)
			val = SSIZE_MAX;
		else
			val = rlim.rlim_cur;
	}
	return val;
#else
	/* On Windows we set the backend stack size in src/backend/Makefile */
	return WIN32_STACK_RLIMIT;
#endif
}