Subject: pgpool: Fix use-after-free of query context after a backend node shutdo

From: Tatsuo Ishii <[email-masked]>
Date: Thu, 18 Jun 2026 09:38:38 +0000

Fix use-after-free of query context after a backend node shutdown.

A POOL_QUERY_CONTEXT is referenced from the session scoped sent
message list (session_context->message_list) and pending message list,
which live in session_context->memory_context and survive for the
whole client session.  However pool_init_query_context() allocated the
query context in the global QueryContext memory context.

do_child() resets QueryContext (MemoryContextResetAndDeleteChildren)
at the top of every iteration of its query processing loop.  In normal
operation pool_process_query() runs the whole session in a single
iteration, so QueryContext is effectively session lived and this is
harmless.  But when pool_process_query() returns POOL_CONTINUE in the
middle of a session, the loop iterates and QueryContext is reset while
the sent/pending message lists still reference query contexts that
were allocated in it.  The freed query contexts are later dereferenced
(for example from pool_clear_sent_message_list() in
reset_connection(), or from pool_remove_sent_message() while binding a
reused statement name), causing a use-after-free and a SIGSEGV.

This is reachable when a backend node is shut down by an
administrative command (e.g. "fast" shutdown of PostgreSQL) while a
client session that has named prepared statements is open.
read_packets_and_process() detects the admin shutdown, sets was_error
and returns POOL_CONTINUE (cont = false), so pool_process_query()
returns to do_child() mid session and the next loop iteration frees
the still referenced query contexts.

Fix this by allocating the query context under the session memory
context rather than the per-iteration QueryContext, so its lifetime
matches the session scoped lists that reference it.  When there is no
session context (internal queries issued before a session exists) fall
back to QueryContext, preserving the previous behaviour.  Query
contexts are still freed explicitly by pool_query_context_destroy(),
and at the latest when the session memory context is destroyed, so
this does not change memory reclamation for the normal
single-iteration case (in which QueryContext was likewise only freed
at session end).

Author: Emond Papegaaij <[email-masked]>
Reported-by: Claude Code
Reviewed-by: Tatsuo Ishii <[email-masked]>
Discussion: https://www.postgresql.org/message-id/CAGXsc%2BaFfv2_PUrEdCt8TousYP9dPmty3i%2B0mkJpWwVg%3DfVN%2BQ%40mail.gmail.com

Branch
------
V4_7_STABLE

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=346e54778cc6d44986bba99a3f321329e8bbcf0d

Modified Files
--------------
src/context/pool_query_context.c | 34 +++++++++++++++++++++++++++-------
1 file changed, 27 insertions(+), 7 deletions(-)