stack_depth.c

Go to the documentation of this file.

/*-------------------------------------------------------------------------
 *
 * stack_depth.c
 *    Functions for monitoring and limiting process stack depth
 *
 * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
 * Portions Copyright (c) 1994, Regents of the University of California
 *
 *
 * IDENTIFICATION
 *    src/backend/utils/misc/stack_depth.c
 *
 *-------------------------------------------------------------------------
 */
 
#include "postgres.h"
 
#include <limits.h>
#include <sys/resource.h>
 
#include "miscadmin.h"
#include "utils/guc_hooks.h"
 
 
/* GUC variable for maximum stack depth (measured in kilobytes) */
int         max_stack_depth = 100;
 
/* max_stack_depth converted to bytes for speed of checking */
static ssize_t max_stack_depth_bytes = 100 * (ssize_t) 1024;
 
/*
 * Stack base pointer -- initialized by set_stack_base(), which
 * should be called from main().
 */
static char *stack_base_ptr = NULL;
 
 
/*
 * set_stack_base: set up reference point for stack depth checking
 *
 * Returns the old reference point, if any.
 */
pg_stack_base_t
set_stack_base(void)
{
#ifndef HAVE__BUILTIN_FRAME_ADDRESS
    char        stack_base;
#endif
    pg_stack_base_t old;
 
    old = stack_base_ptr;
 
    /*
     * Set up reference point for stack depth checking.  On recent gcc we use
     * __builtin_frame_address() to avoid a warning about storing a local
     * variable's address in a long-lived variable.  This is also important
     * with address sanitizer, see comment in stack_is_too_deep().
     */
#ifdef HAVE__BUILTIN_FRAME_ADDRESS
    stack_base_ptr = __builtin_frame_address(0);
#else
    stack_base_ptr = &stack_base;
#endif
 
    return old;
}
 
/*
 * restore_stack_base: restore reference point for stack depth checking
 *
 * This can be used after set_stack_base() to restore the old value. This
 * is currently only used in PL/Java. When PL/Java calls a backend function
 * from different thread, the thread's stack is at a different location than
 * the main thread's stack, so it sets the base pointer before the call, and
 * restores it afterwards.
 */
void
restore_stack_base(pg_stack_base_t base)
{
    stack_base_ptr = base;
}
 
 
/*
 * check_stack_depth/stack_is_too_deep: check for excessively deep recursion
 *
 * This should be called someplace in any recursive routine that might possibly
 * recurse deep enough to overflow the stack.  Most Unixen treat stack
 * overflow as an unrecoverable SIGSEGV, so we want to error out ourselves
 * before hitting the hardware limit.
 *
 * check_stack_depth() just throws an error summarily.  stack_is_too_deep()
 * can be used by code that wants to handle the error condition itself.
 */
void
check_stack_depth(void)
{
    if (stack_is_too_deep())
    {
        ereport(ERROR,
                (errcode(ERRCODE_STATEMENT_TOO_COMPLEX),
                 errmsg("stack depth limit exceeded"),
                 errhint("Increase the configuration parameter \"max_stack_depth\" (currently %dkB), "
                         "after ensuring the platform's stack depth limit is adequate.",
                         max_stack_depth)));
    }
}
 
bool
stack_is_too_deep(void)
{
#ifndef HAVE__BUILTIN_FRAME_ADDRESS
    char        stack_top_loc;
#endif
    ssize_t     stack_depth;
    char       *stack_address;
 
    /*
     * With address sanitizer's stack-use-after-return check, stack variables
     * are moved to heap allocations, to allow to detect references to the
     * memory at a later time. That would break our stack-depth check. Luckily
     * __builtin_frame_address() works correctly, even under asan.
     */
#ifndef HAVE__BUILTIN_FRAME_ADDRESS
    stack_address = &stack_top_loc;
#else
    stack_address = (char *) __builtin_frame_address(0);
#endif
 
    /*
     * Compute distance from reference point to my stack frame.
     */
    stack_depth = (ssize_t) (stack_base_ptr - stack_address);
 
    /*
     * Take abs value, since stacks grow up on some machines, down on others
     */
    if (stack_depth < 0)
        stack_depth = -stack_depth;
 
    /*
     * Trouble?
     *
     * The test on stack_base_ptr prevents us from erroring out if called
     * before that's been set.  Logically it should be done first, but putting
     * it last avoids wasting cycles during normal cases.
     */
    if (stack_depth > max_stack_depth_bytes &&
        stack_base_ptr != NULL)
        return true;
 
    return false;
}
 
 
/* GUC check hook for max_stack_depth */
bool
check_max_stack_depth(int *newval, void **extra, GucSource source)
{
    ssize_t     newval_bytes = *newval * (ssize_t) 1024;
    ssize_t     stack_rlimit = get_stack_depth_rlimit();
 
    if (stack_rlimit > 0 && newval_bytes > stack_rlimit - STACK_DEPTH_SLOP)
    {
        GUC_check_errdetail("\"max_stack_depth\" must not exceed %zdkB.",
                            (stack_rlimit - STACK_DEPTH_SLOP) / 1024);
        GUC_check_errhint("Increase the platform's stack depth limit via \"ulimit -s\" or local equivalent.");
        return false;
    }
    return true;
}
 
/* GUC assign hook for max_stack_depth */
void
assign_max_stack_depth(int newval, void *extra)
{
    ssize_t     newval_bytes = newval * (ssize_t) 1024;
 
    max_stack_depth_bytes = newval_bytes;
}
 
/*
 * Obtain platform stack depth limit (in bytes)
 *
 * Return -1 if unknown
 *
 * Note: we choose to use ssize_t not size_t as the result type because
 * callers compute values that could theoretically go negative,
 * such as "result - STACK_DEPTH_SLOP".
 */
ssize_t
get_stack_depth_rlimit(void)
{
#if defined(HAVE_GETRLIMIT)
    static ssize_t val = 0;
 
    /* This won't change after process launch, so check just once */
    if (val == 0)
    {
        struct rlimit rlim;
 
        if (getrlimit(RLIMIT_STACK, &rlim) < 0)
            val = -1;
        else if (rlim.rlim_cur == RLIM_INFINITY)
            val = SSIZE_MAX;
        /* rlim_cur is probably of an unsigned type, so check for overflow */
        else if (rlim.rlim_cur >= SSIZE_MAX)
            val = SSIZE_MAX;
        else
            val = rlim.rlim_cur;
    }
    return val;
#else
    /* On Windows we set the backend stack size in src/backend/Makefile */
    return WIN32_STACK_RLIMIT;
#endif
}