agora inbox for pgpool-committers@postgresql.orghelp / color / mirror / Atom feed
pgpool: Fix segfault with CopyOut. 7+ messages / 1 participants [nested] [flat]
* pgpool: Fix segfault with CopyOut. @ 2025-11-16 07:17 Tatsuo Ishii <ishii@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Tatsuo Ishii @ 2025-11-16 07:17 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Fix segfault with CopyOut. When "COPY relname TO STDOUT" is executed in the extended query protocol mode, pgpool segfaulted. When read_kind_from_backend() reads a message from backend, it extracts the corresponding entry from the pending message queue when processing extended query protocol messages. However, if the head of the message queue is an "execute" message, some of incoming message types are exceptional because other than CommandComplete message (which means the execute message finishes) may come from backend. This includes DataRow, ErrorResponse, NoticeMessage. Unfortunately we overlooked that 'H' (CopyOutResponse) is in the group too. Thus when CopyOutResponse comes from backend, the execute pending message is removed. If the next message from frontend is Sync (it's often happens), read_kind_from_backend() sets session_context->query_context to NULL, and calls pool_unset_query_in_progress(), which accesses session_context->query_context and segfaults. The fix is, to add CopyOutResponse to the exception list. Just in case, we also add 'd' (CopyData) and 'c' (CopyDone) to the list. This may not be actually necessary since CopyData and CopyDone are processced in CopyDataRows() though. Add regression test case to 126.copy_hang (master and v4.7) or 076.copy_hang (v4.6 or before). Author: Tatsuo Ishii <ishii@postgresql.org> Reported-by: https://github.com/tetesh Reviewed-by: Bo Peng <pengbo@sraoss.co.jp> Discussion: https://github.com/pgpool/pgpool2/issues/133 Backpatch-through: v4.2 Branch ------ V4_2_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=9b20e81c09fc874890894c6210684b6cc01d5... Modified Files -------------- src/protocol/pool_process_query.c | 11 ++++--- .../tests/076.copy_hang/copy-out-expected | 37 ++++++++++++++++++++++ .../tests/076.copy_hang/pgproto-copy-out.data | 9 ++++++ src/test/regression/tests/076.copy_hang/test.sh | 16 ++++++++++ 4 files changed, 69 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgpool: Fix segfault with CopyOut. @ 2025-11-16 07:17 Tatsuo Ishii <ishii@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Tatsuo Ishii @ 2025-11-16 07:17 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Fix segfault with CopyOut. When "COPY relname TO STDOUT" is executed in the extended query protocol mode, pgpool segfaulted. When read_kind_from_backend() reads a message from backend, it extracts the corresponding entry from the pending message queue when processing extended query protocol messages. However, if the head of the message queue is an "execute" message, some of incoming message types are exceptional because other than CommandComplete message (which means the execute message finishes) may come from backend. This includes DataRow, ErrorResponse, NoticeMessage. Unfortunately we overlooked that 'H' (CopyOutResponse) is in the group too. Thus when CopyOutResponse comes from backend, the execute pending message is removed. If the next message from frontend is Sync (it's often happens), read_kind_from_backend() sets session_context->query_context to NULL, and calls pool_unset_query_in_progress(), which accesses session_context->query_context and segfaults. The fix is, to add CopyOutResponse to the exception list. Just in case, we also add 'd' (CopyData) and 'c' (CopyDone) to the list. This may not be actually necessary since CopyData and CopyDone are processced in CopyDataRows() though. Add regression test case to 126.copy_hang (master and v4.7) or 076.copy_hang (v4.6 or before). Author: Tatsuo Ishii <ishii@postgresql.org> Reported-by: https://github.com/tetesh Reviewed-by: Bo Peng <pengbo@sraoss.co.jp> Discussion: https://github.com/pgpool/pgpool2/issues/133 Backpatch-through: v4.2 Branch ------ V4_3_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=4a094611ea49ff6c53512b2a8825d6cf46e18... Modified Files -------------- src/protocol/pool_process_query.c | 11 ++++--- .../tests/076.copy_hang/copy-out-expected | 37 ++++++++++++++++++++++ .../tests/076.copy_hang/pgproto-copy-out.data | 9 ++++++ src/test/regression/tests/076.copy_hang/test.sh | 16 ++++++++++ 4 files changed, 69 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgpool: Fix segfault with CopyOut. @ 2025-11-16 07:17 Tatsuo Ishii <ishii@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Tatsuo Ishii @ 2025-11-16 07:17 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Fix segfault with CopyOut. When "COPY relname TO STDOUT" is executed in the extended query protocol mode, pgpool segfaulted. When read_kind_from_backend() reads a message from backend, it extracts the corresponding entry from the pending message queue when processing extended query protocol messages. However, if the head of the message queue is an "execute" message, some of incoming message types are exceptional because other than CommandComplete message (which means the execute message finishes) may come from backend. This includes DataRow, ErrorResponse, NoticeMessage. Unfortunately we overlooked that 'H' (CopyOutResponse) is in the group too. Thus when CopyOutResponse comes from backend, the execute pending message is removed. If the next message from frontend is Sync (it's often happens), read_kind_from_backend() sets session_context->query_context to NULL, and calls pool_unset_query_in_progress(), which accesses session_context->query_context and segfaults. The fix is, to add CopyOutResponse to the exception list. Just in case, we also add 'd' (CopyData) and 'c' (CopyDone) to the list. This may not be actually necessary since CopyData and CopyDone are processced in CopyDataRows() though. Add regression test case to 126.copy_hang (master and v4.7) or 076.copy_hang (v4.6 or before). Author: Tatsuo Ishii <ishii@postgresql.org> Reported-by: https://github.com/tetesh Reviewed-by: Bo Peng <pengbo@sraoss.co.jp> Discussion: https://github.com/pgpool/pgpool2/issues/133 Backpatch-through: v4.2 Branch ------ V4_4_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=83102f6d5513026493c0edc9e93e82ebef451... Modified Files -------------- src/protocol/pool_process_query.c | 11 ++++--- .../tests/076.copy_hang/copy-out-expected | 37 ++++++++++++++++++++++ .../tests/076.copy_hang/pgproto-copy-out.data | 9 ++++++ src/test/regression/tests/076.copy_hang/test.sh | 16 ++++++++++ 4 files changed, 69 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgpool: Fix segfault with CopyOut. @ 2025-11-16 07:18 Tatsuo Ishii <ishii@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Tatsuo Ishii @ 2025-11-16 07:18 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Fix segfault with CopyOut. When "COPY relname TO STDOUT" is executed in the extended query protocol mode, pgpool segfaulted. When read_kind_from_backend() reads a message from backend, it extracts the corresponding entry from the pending message queue when processing extended query protocol messages. However, if the head of the message queue is an "execute" message, some of incoming message types are exceptional because other than CommandComplete message (which means the execute message finishes) may come from backend. This includes DataRow, ErrorResponse, NoticeMessage. Unfortunately we overlooked that 'H' (CopyOutResponse) is in the group too. Thus when CopyOutResponse comes from backend, the execute pending message is removed. If the next message from frontend is Sync (it's often happens), read_kind_from_backend() sets session_context->query_context to NULL, and calls pool_unset_query_in_progress(), which accesses session_context->query_context and segfaults. The fix is, to add CopyOutResponse to the exception list. Just in case, we also add 'd' (CopyData) and 'c' (CopyDone) to the list. This may not be actually necessary since CopyData and CopyDone are processced in CopyDataRows() though. Add regression test case to 126.copy_hang (master and v4.7) or 076.copy_hang (v4.6 or before). Author: Tatsuo Ishii <ishii@postgresql.org> Reported-by: https://github.com/tetesh Reviewed-by: Bo Peng <pengbo@sraoss.co.jp> Discussion: https://github.com/pgpool/pgpool2/issues/133 Backpatch-through: v4.2 Branch ------ V4_5_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=e691263462e097cc2b833eef3b41fe943649e... Modified Files -------------- src/protocol/pool_process_query.c | 11 ++++--- .../tests/076.copy_hang/copy-out-expected | 37 ++++++++++++++++++++++ .../tests/076.copy_hang/pgproto-copy-out.data | 9 ++++++ src/test/regression/tests/076.copy_hang/test.sh | 16 ++++++++++ 4 files changed, 69 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgpool: Fix segfault with CopyOut. @ 2025-11-16 07:18 Tatsuo Ishii <ishii@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Tatsuo Ishii @ 2025-11-16 07:18 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Fix segfault with CopyOut. When "COPY relname TO STDOUT" is executed in the extended query protocol mode, pgpool segfaulted. When read_kind_from_backend() reads a message from backend, it extracts the corresponding entry from the pending message queue when processing extended query protocol messages. However, if the head of the message queue is an "execute" message, some of incoming message types are exceptional because other than CommandComplete message (which means the execute message finishes) may come from backend. This includes DataRow, ErrorResponse, NoticeMessage. Unfortunately we overlooked that 'H' (CopyOutResponse) is in the group too. Thus when CopyOutResponse comes from backend, the execute pending message is removed. If the next message from frontend is Sync (it's often happens), read_kind_from_backend() sets session_context->query_context to NULL, and calls pool_unset_query_in_progress(), which accesses session_context->query_context and segfaults. The fix is, to add CopyOutResponse to the exception list. Just in case, we also add 'd' (CopyData) and 'c' (CopyDone) to the list. This may not be actually necessary since CopyData and CopyDone are processced in CopyDataRows() though. Add regression test case to 126.copy_hang (master and v4.7) or 076.copy_hang (v4.6 or before). Author: Tatsuo Ishii <ishii@postgresql.org> Reported-by: https://github.com/tetesh Reviewed-by: Bo Peng <pengbo@sraoss.co.jp> Discussion: https://github.com/pgpool/pgpool2/issues/133 Backpatch-through: v4.2 Branch ------ V4_6_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=3d6974cb344f449d35d73a15d24a6a8e6650b... Modified Files -------------- src/protocol/pool_process_query.c | 11 ++++--- .../tests/076.copy_hang/copy-out-expected | 37 ++++++++++++++++++++++ .../tests/076.copy_hang/pgproto-copy-out.data | 9 ++++++ src/test/regression/tests/076.copy_hang/test.sh | 16 ++++++++++ 4 files changed, 69 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgpool: Fix segfault with CopyOut. @ 2025-11-16 07:18 Tatsuo Ishii <ishii@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Tatsuo Ishii @ 2025-11-16 07:18 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Fix segfault with CopyOut. When "COPY relname TO STDOUT" is executed in the extended query protocol mode, pgpool segfaulted. When read_kind_from_backend() reads a message from backend, it extracts the corresponding entry from the pending message queue when processing extended query protocol messages. However, if the head of the message queue is an "execute" message, some of incoming message types are exceptional because other than CommandComplete message (which means the execute message finishes) may come from backend. This includes DataRow, ErrorResponse, NoticeMessage. Unfortunately we overlooked that 'H' (CopyOutResponse) is in the group too. Thus when CopyOutResponse comes from backend, the execute pending message is removed. If the next message from frontend is Sync (it's often happens), read_kind_from_backend() sets session_context->query_context to NULL, and calls pool_unset_query_in_progress(), which accesses session_context->query_context and segfaults. The fix is, to add CopyOutResponse to the exception list. Just in case, we also add 'd' (CopyData) and 'c' (CopyDone) to the list. This may not be actually necessary since CopyData and CopyDone are processced in CopyDataRows() though. Add regression test case to 126.copy_hang (master and v4.7) or 076.copy_hang (v4.6 or before). Author: Tatsuo Ishii <ishii@postgresql.org> Reported-by: https://github.com/tetesh Reviewed-by: Bo Peng <pengbo@sraoss.co.jp> Discussion: https://github.com/pgpool/pgpool2/issues/133 Backpatch-through: v4.2 Branch ------ master Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=f26c04746b4a84b9772a5ac8304c5c2921fc6... Modified Files -------------- src/protocol/pool_process_query.c | 11 ++++--- .../tests/126.copy_hang/copy-out-expected | 37 ++++++++++++++++++++++ .../tests/126.copy_hang/pgproto-copy-out.data | 9 ++++++ src/test/regression/tests/126.copy_hang/test.sh | 16 ++++++++++ 4 files changed, 69 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgpool: Fix segfault with CopyOut. @ 2025-11-16 07:18 Tatsuo Ishii <ishii@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Tatsuo Ishii @ 2025-11-16 07:18 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Fix segfault with CopyOut. When "COPY relname TO STDOUT" is executed in the extended query protocol mode, pgpool segfaulted. When read_kind_from_backend() reads a message from backend, it extracts the corresponding entry from the pending message queue when processing extended query protocol messages. However, if the head of the message queue is an "execute" message, some of incoming message types are exceptional because other than CommandComplete message (which means the execute message finishes) may come from backend. This includes DataRow, ErrorResponse, NoticeMessage. Unfortunately we overlooked that 'H' (CopyOutResponse) is in the group too. Thus when CopyOutResponse comes from backend, the execute pending message is removed. If the next message from frontend is Sync (it's often happens), read_kind_from_backend() sets session_context->query_context to NULL, and calls pool_unset_query_in_progress(), which accesses session_context->query_context and segfaults. The fix is, to add CopyOutResponse to the exception list. Just in case, we also add 'd' (CopyData) and 'c' (CopyDone) to the list. This may not be actually necessary since CopyData and CopyDone are processced in CopyDataRows() though. Add regression test case to 126.copy_hang (master and v4.7) or 076.copy_hang (v4.6 or before). Author: Tatsuo Ishii <ishii@postgresql.org> Reported-by: https://github.com/tetesh Reviewed-by: Bo Peng <pengbo@sraoss.co.jp> Discussion: https://github.com/pgpool/pgpool2/issues/133 Backpatch-through: v4.2 Branch ------ V4_7_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=b113027dddd0f80b22fabc56af141b57ece6f... Modified Files -------------- src/protocol/pool_process_query.c | 11 ++++--- .../tests/126.copy_hang/copy-out-expected | 37 ++++++++++++++++++++++ .../tests/126.copy_hang/pgproto-copy-out.data | 9 ++++++ src/test/regression/tests/126.copy_hang/test.sh | 16 ++++++++++ 4 files changed, 69 insertions(+), 4 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2025-11-16 07:18 UTC | newest] Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2025-11-16 07:17 pgpool: Fix segfault with CopyOut. Tatsuo Ishii <ishii@postgresql.org> 2025-11-16 07:17 pgpool: Fix segfault with CopyOut. Tatsuo Ishii <ishii@postgresql.org> 2025-11-16 07:17 pgpool: Fix segfault with CopyOut. Tatsuo Ishii <ishii@postgresql.org> 2025-11-16 07:18 pgpool: Fix segfault with CopyOut. Tatsuo Ishii <ishii@postgresql.org> 2025-11-16 07:18 pgpool: Fix segfault with CopyOut. Tatsuo Ishii <ishii@postgresql.org> 2025-11-16 07:18 pgpool: Fix segfault with CopyOut. Tatsuo Ishii <ishii@postgresql.org> 2025-11-16 07:18 pgpool: Fix segfault with CopyOut. Tatsuo Ishii <ishii@postgresql.org>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox