Return B_SYSTEM_BG_WORKER slots to the bgworker pool on release#74
Open
ironman5366 wants to merge 1 commit into
Open
Return B_SYSTEM_BG_WORKER slots to the bgworker pool on release#74ironman5366 wants to merge 1 commit into
ironman5366 wants to merge 1 commit into
Conversation
System background workers (BGWORKER_CLASS_SYSTEM, used by orioledb's S3 workers) get their postmaster child slot from the B_BG_WORKER pool in do_start_bgworker() and are then retyped to B_SYSTEM_BG_WORKER so the shutdown state machine lets them keep running. On exit, however, ReleasePostmasterChildSlot() returned the slot to the pool of the current backend type: the separate size-1 B_SYSTEM_BG_WORKER pool that nothing ever allocates from. The slot number is from the B_BG_WORKER range, so the pool range sanity check failed and the postmaster itself exited with 'pmchild freelist for backend type 6 is corrupt' - any S3 worker exit (a clean SIGTERM, or the FATAL that any S3 request error raises) took down the entire cluster. Remap B_SYSTEM_BG_WORKER to the B_BG_WORKER pool on release, exactly like the B_WAL_SENDER -> B_BACKEND remap above it, and drop the unused (and mis-sized: there can be s3_num_workers of these) size-1 pool. B_WAL_SENDER analogously has no pool of its own, and AssignPostmasterChildSlot() reports an error for zero-size pools if anything ever tries to allocate from it directly. Reproduced by test/t/s3_transient_error_test.py (orioledb repo): one injected 500 on one S3 PUT kills the whole cluster on PG18 builds, while PG17 builds (no pmchild.c, no B_SYSTEM_BG_WORKER) survive the same event with a worker restart. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See orioledb/orioledb#979.
The below, and the patch, is written by Claude, and I don't have enough context on the codebase to vouch for it. Apologies if it is slop, I am leaving in case it is useful given it does seem to fix the issue I encountered:
System background workers (BGWORKER_CLASS_SYSTEM, used by orioledb's S3 workers) get their postmaster child slot from the B_BG_WORKER pool in do_start_bgworker() and are then retyped to B_SYSTEM_BG_WORKER so the shutdown state machine lets them keep running. On exit, however, ReleasePostmasterChildSlot() returned the slot to the pool of the current backend type: the separate size-1 B_SYSTEM_BG_WORKER pool that nothing ever allocates from. The slot number is from the B_BG_WORKER range, so the pool range sanity check failed and the postmaster itself exited with 'pmchild freelist for backend type 6 is corrupt' - any S3 worker exit (a clean SIGTERM, or the FATAL that any S3 request error raises) took down the entire cluster.
Remap B_SYSTEM_BG_WORKER to the B_BG_WORKER pool on release, exactly like the B_WAL_SENDER -> B_BACKEND remap above it, and drop the unused (and mis-sized: there can be s3_num_workers of these) size-1 pool. B_WAL_SENDER analogously has no pool of its own, and AssignPostmasterChildSlot() reports an error for zero-size pools if anything ever tries to allocate from it directly.
Reproduced by test/t/s3_transient_error_test.py (orioledb repo): one injected 500 on one S3 PUT kills the whole cluster on PG18 builds, while PG17 builds (no pmchild.c, no B_SYSTEM_BG_WORKER) survive the same event with a worker restart.