public inbox for [email protected]help / color / mirror / Atom feed
pgpool: Fix use-after-free of query context after a backend node shutdo 6+ messages / 1 participants [nested] [flat]
* pgpool: Fix use-after-free of query context after a backend node shutdo @ 2026-06-18 09:38 Tatsuo Ishii <[email protected]> 0 siblings, 0 replies; 6+ messages in thread From: Tatsuo Ishii @ 2026-06-18 09:38 UTC (permalink / raw) To: [email protected] Fix use-after-free of query context after a backend node shutdown. A POOL_QUERY_CONTEXT is referenced from the session scoped sent message list (session_context->message_list) and pending message list, which live in session_context->memory_context and survive for the whole client session. However pool_init_query_context() allocated the query context in the global QueryContext memory context. do_child() resets QueryContext (MemoryContextResetAndDeleteChildren) at the top of every iteration of its query processing loop. In normal operation pool_process_query() runs the whole session in a single iteration, so QueryContext is effectively session lived and this is harmless. But when pool_process_query() returns POOL_CONTINUE in the middle of a session, the loop iterates and QueryContext is reset while the sent/pending message lists still reference query contexts that were allocated in it. The freed query contexts are later dereferenced (for example from pool_clear_sent_message_list() in reset_connection(), or from pool_remove_sent_message() while binding a reused statement name), causing a use-after-free and a SIGSEGV. This is reachable when a backend node is shut down by an administrative command (e.g. "fast" shutdown of PostgreSQL) while a client session that has named prepared statements is open. read_packets_and_process() detects the admin shutdown, sets was_error and returns POOL_CONTINUE (cont = false), so pool_process_query() returns to do_child() mid session and the next loop iteration frees the still referenced query contexts. Fix this by allocating the query context under the session memory context rather than the per-iteration QueryContext, so its lifetime matches the session scoped lists that reference it. When there is no session context (internal queries issued before a session exists) fall back to QueryContext, preserving the previous behaviour. Query contexts are still freed explicitly by pool_query_context_destroy(), and at the latest when the session memory context is destroyed, so this does not change memory reclamation for the normal single-iteration case (in which QueryContext was likewise only freed at session end). Author: Emond Papegaaij <[email protected]> Reported-by: Claude Code Reviewed-by: Tatsuo Ishii <[email protected]> Discussion: https://www.postgresql.org/message-id/CAGXsc%2BaFfv2_PUrEdCt8TousYP9dPmty3i%2B0mkJpWwVg%3DfVN%2BQ%40... Branch ------ V4_3_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=d59654c4e19c7e40140dced2902597f28511f... Modified Files -------------- src/context/pool_query_context.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix use-after-free of query context after a backend node shutdo @ 2026-06-18 09:38 Tatsuo Ishii <[email protected]> 0 siblings, 0 replies; 6+ messages in thread From: Tatsuo Ishii @ 2026-06-18 09:38 UTC (permalink / raw) To: [email protected] Fix use-after-free of query context after a backend node shutdown. A POOL_QUERY_CONTEXT is referenced from the session scoped sent message list (session_context->message_list) and pending message list, which live in session_context->memory_context and survive for the whole client session. However pool_init_query_context() allocated the query context in the global QueryContext memory context. do_child() resets QueryContext (MemoryContextResetAndDeleteChildren) at the top of every iteration of its query processing loop. In normal operation pool_process_query() runs the whole session in a single iteration, so QueryContext is effectively session lived and this is harmless. But when pool_process_query() returns POOL_CONTINUE in the middle of a session, the loop iterates and QueryContext is reset while the sent/pending message lists still reference query contexts that were allocated in it. The freed query contexts are later dereferenced (for example from pool_clear_sent_message_list() in reset_connection(), or from pool_remove_sent_message() while binding a reused statement name), causing a use-after-free and a SIGSEGV. This is reachable when a backend node is shut down by an administrative command (e.g. "fast" shutdown of PostgreSQL) while a client session that has named prepared statements is open. read_packets_and_process() detects the admin shutdown, sets was_error and returns POOL_CONTINUE (cont = false), so pool_process_query() returns to do_child() mid session and the next loop iteration frees the still referenced query contexts. Fix this by allocating the query context under the session memory context rather than the per-iteration QueryContext, so its lifetime matches the session scoped lists that reference it. When there is no session context (internal queries issued before a session exists) fall back to QueryContext, preserving the previous behaviour. Query contexts are still freed explicitly by pool_query_context_destroy(), and at the latest when the session memory context is destroyed, so this does not change memory reclamation for the normal single-iteration case (in which QueryContext was likewise only freed at session end). Author: Emond Papegaaij <[email protected]> Reported-by: Claude Code Reviewed-by: Tatsuo Ishii <[email protected]> Discussion: https://www.postgresql.org/message-id/CAGXsc%2BaFfv2_PUrEdCt8TousYP9dPmty3i%2B0mkJpWwVg%3DfVN%2BQ%40... Branch ------ V4_4_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=a601b3e63b805f78071e59327f632d42cf54c... Modified Files -------------- src/context/pool_query_context.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix use-after-free of query context after a backend node shutdo @ 2026-06-18 09:38 Tatsuo Ishii <[email protected]> 0 siblings, 0 replies; 6+ messages in thread From: Tatsuo Ishii @ 2026-06-18 09:38 UTC (permalink / raw) To: [email protected] Fix use-after-free of query context after a backend node shutdown. A POOL_QUERY_CONTEXT is referenced from the session scoped sent message list (session_context->message_list) and pending message list, which live in session_context->memory_context and survive for the whole client session. However pool_init_query_context() allocated the query context in the global QueryContext memory context. do_child() resets QueryContext (MemoryContextResetAndDeleteChildren) at the top of every iteration of its query processing loop. In normal operation pool_process_query() runs the whole session in a single iteration, so QueryContext is effectively session lived and this is harmless. But when pool_process_query() returns POOL_CONTINUE in the middle of a session, the loop iterates and QueryContext is reset while the sent/pending message lists still reference query contexts that were allocated in it. The freed query contexts are later dereferenced (for example from pool_clear_sent_message_list() in reset_connection(), or from pool_remove_sent_message() while binding a reused statement name), causing a use-after-free and a SIGSEGV. This is reachable when a backend node is shut down by an administrative command (e.g. "fast" shutdown of PostgreSQL) while a client session that has named prepared statements is open. read_packets_and_process() detects the admin shutdown, sets was_error and returns POOL_CONTINUE (cont = false), so pool_process_query() returns to do_child() mid session and the next loop iteration frees the still referenced query contexts. Fix this by allocating the query context under the session memory context rather than the per-iteration QueryContext, so its lifetime matches the session scoped lists that reference it. When there is no session context (internal queries issued before a session exists) fall back to QueryContext, preserving the previous behaviour. Query contexts are still freed explicitly by pool_query_context_destroy(), and at the latest when the session memory context is destroyed, so this does not change memory reclamation for the normal single-iteration case (in which QueryContext was likewise only freed at session end). Author: Emond Papegaaij <[email protected]> Reported-by: Claude Code Reviewed-by: Tatsuo Ishii <[email protected]> Discussion: https://www.postgresql.org/message-id/CAGXsc%2BaFfv2_PUrEdCt8TousYP9dPmty3i%2B0mkJpWwVg%3DfVN%2BQ%40... Branch ------ V4_5_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=006f7c826d4c490e73c58489a7509310c74b1... Modified Files -------------- src/context/pool_query_context.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix use-after-free of query context after a backend node shutdo @ 2026-06-18 09:38 Tatsuo Ishii <[email protected]> 0 siblings, 0 replies; 6+ messages in thread From: Tatsuo Ishii @ 2026-06-18 09:38 UTC (permalink / raw) To: [email protected] Fix use-after-free of query context after a backend node shutdown. A POOL_QUERY_CONTEXT is referenced from the session scoped sent message list (session_context->message_list) and pending message list, which live in session_context->memory_context and survive for the whole client session. However pool_init_query_context() allocated the query context in the global QueryContext memory context. do_child() resets QueryContext (MemoryContextResetAndDeleteChildren) at the top of every iteration of its query processing loop. In normal operation pool_process_query() runs the whole session in a single iteration, so QueryContext is effectively session lived and this is harmless. But when pool_process_query() returns POOL_CONTINUE in the middle of a session, the loop iterates and QueryContext is reset while the sent/pending message lists still reference query contexts that were allocated in it. The freed query contexts are later dereferenced (for example from pool_clear_sent_message_list() in reset_connection(), or from pool_remove_sent_message() while binding a reused statement name), causing a use-after-free and a SIGSEGV. This is reachable when a backend node is shut down by an administrative command (e.g. "fast" shutdown of PostgreSQL) while a client session that has named prepared statements is open. read_packets_and_process() detects the admin shutdown, sets was_error and returns POOL_CONTINUE (cont = false), so pool_process_query() returns to do_child() mid session and the next loop iteration frees the still referenced query contexts. Fix this by allocating the query context under the session memory context rather than the per-iteration QueryContext, so its lifetime matches the session scoped lists that reference it. When there is no session context (internal queries issued before a session exists) fall back to QueryContext, preserving the previous behaviour. Query contexts are still freed explicitly by pool_query_context_destroy(), and at the latest when the session memory context is destroyed, so this does not change memory reclamation for the normal single-iteration case (in which QueryContext was likewise only freed at session end). Author: Emond Papegaaij <[email protected]> Reported-by: Claude Code Reviewed-by: Tatsuo Ishii <[email protected]> Discussion: https://www.postgresql.org/message-id/CAGXsc%2BaFfv2_PUrEdCt8TousYP9dPmty3i%2B0mkJpWwVg%3DfVN%2BQ%40... Branch ------ V4_6_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=760a166d03dd165bc92ebcbf7be9ded2c320e... Modified Files -------------- src/context/pool_query_context.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix use-after-free of query context after a backend node shutdo @ 2026-06-18 09:38 Tatsuo Ishii <[email protected]> 0 siblings, 0 replies; 6+ messages in thread From: Tatsuo Ishii @ 2026-06-18 09:38 UTC (permalink / raw) To: [email protected] Fix use-after-free of query context after a backend node shutdown. A POOL_QUERY_CONTEXT is referenced from the session scoped sent message list (session_context->message_list) and pending message list, which live in session_context->memory_context and survive for the whole client session. However pool_init_query_context() allocated the query context in the global QueryContext memory context. do_child() resets QueryContext (MemoryContextResetAndDeleteChildren) at the top of every iteration of its query processing loop. In normal operation pool_process_query() runs the whole session in a single iteration, so QueryContext is effectively session lived and this is harmless. But when pool_process_query() returns POOL_CONTINUE in the middle of a session, the loop iterates and QueryContext is reset while the sent/pending message lists still reference query contexts that were allocated in it. The freed query contexts are later dereferenced (for example from pool_clear_sent_message_list() in reset_connection(), or from pool_remove_sent_message() while binding a reused statement name), causing a use-after-free and a SIGSEGV. This is reachable when a backend node is shut down by an administrative command (e.g. "fast" shutdown of PostgreSQL) while a client session that has named prepared statements is open. read_packets_and_process() detects the admin shutdown, sets was_error and returns POOL_CONTINUE (cont = false), so pool_process_query() returns to do_child() mid session and the next loop iteration frees the still referenced query contexts. Fix this by allocating the query context under the session memory context rather than the per-iteration QueryContext, so its lifetime matches the session scoped lists that reference it. When there is no session context (internal queries issued before a session exists) fall back to QueryContext, preserving the previous behaviour. Query contexts are still freed explicitly by pool_query_context_destroy(), and at the latest when the session memory context is destroyed, so this does not change memory reclamation for the normal single-iteration case (in which QueryContext was likewise only freed at session end). Author: Emond Papegaaij <[email protected]> Reported-by: Claude Code Reviewed-by: Tatsuo Ishii <[email protected]> Discussion: https://www.postgresql.org/message-id/CAGXsc%2BaFfv2_PUrEdCt8TousYP9dPmty3i%2B0mkJpWwVg%3DfVN%2BQ%40... Branch ------ V4_7_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=346e54778cc6d44986bba99a3f321329e8bbc... Modified Files -------------- src/context/pool_query_context.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix use-after-free of query context after a backend node shutdo @ 2026-06-18 09:38 Tatsuo Ishii <[email protected]> 0 siblings, 0 replies; 6+ messages in thread From: Tatsuo Ishii @ 2026-06-18 09:38 UTC (permalink / raw) To: [email protected] Fix use-after-free of query context after a backend node shutdown. A POOL_QUERY_CONTEXT is referenced from the session scoped sent message list (session_context->message_list) and pending message list, which live in session_context->memory_context and survive for the whole client session. However pool_init_query_context() allocated the query context in the global QueryContext memory context. do_child() resets QueryContext (MemoryContextResetAndDeleteChildren) at the top of every iteration of its query processing loop. In normal operation pool_process_query() runs the whole session in a single iteration, so QueryContext is effectively session lived and this is harmless. But when pool_process_query() returns POOL_CONTINUE in the middle of a session, the loop iterates and QueryContext is reset while the sent/pending message lists still reference query contexts that were allocated in it. The freed query contexts are later dereferenced (for example from pool_clear_sent_message_list() in reset_connection(), or from pool_remove_sent_message() while binding a reused statement name), causing a use-after-free and a SIGSEGV. This is reachable when a backend node is shut down by an administrative command (e.g. "fast" shutdown of PostgreSQL) while a client session that has named prepared statements is open. read_packets_and_process() detects the admin shutdown, sets was_error and returns POOL_CONTINUE (cont = false), so pool_process_query() returns to do_child() mid session and the next loop iteration frees the still referenced query contexts. Fix this by allocating the query context under the session memory context rather than the per-iteration QueryContext, so its lifetime matches the session scoped lists that reference it. When there is no session context (internal queries issued before a session exists) fall back to QueryContext, preserving the previous behaviour. Query contexts are still freed explicitly by pool_query_context_destroy(), and at the latest when the session memory context is destroyed, so this does not change memory reclamation for the normal single-iteration case (in which QueryContext was likewise only freed at session end). Author: Emond Papegaaij <[email protected]> Reported-by: Claude Code Reviewed-by: Tatsuo Ishii <[email protected]> Discussion: https://www.postgresql.org/message-id/CAGXsc%2BaFfv2_PUrEdCt8TousYP9dPmty3i%2B0mkJpWwVg%3DfVN%2BQ%40... Branch ------ master Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=05208cd74f4104a0c1c9a86d68b896dfd1f55... Modified Files -------------- src/context/pool_query_context.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-06-18 09:38 UTC | newest] Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-06-18 09:38 pgpool: Fix use-after-free of query context after a backend node shutdo Tatsuo Ishii <[email protected]> 2026-06-18 09:38 pgpool: Fix use-after-free of query context after a backend node shutdo Tatsuo Ishii <[email protected]> 2026-06-18 09:38 pgpool: Fix use-after-free of query context after a backend node shutdo Tatsuo Ishii <[email protected]> 2026-06-18 09:38 pgpool: Fix use-after-free of query context after a backend node shutdo Tatsuo Ishii <[email protected]> 2026-06-18 09:38 pgpool: Fix use-after-free of query context after a backend node shutdo Tatsuo Ishii <[email protected]> 2026-06-18 09:38 pgpool: Fix use-after-free of query context after a backend node shutdo Tatsuo Ishii <[email protected]>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox