public inbox for [email protected]
help / color / mirror / Atom feedpgpool: Fix segfault in pool_do_auth().
6+ messages / 1 participants
[nested] [flat]
* pgpool: Fix segfault in pool_do_auth().
@ 2026-07-03 06:29 Tatsuo Ishii <[email protected]>
0 siblings, 0 replies; 6+ messages in thread
From: Tatsuo Ishii @ 2026-07-03 06:29 UTC (permalink / raw)
To: [email protected]
Fix segfault in pool_do_auth().
If a client connect to pgpool while performing a failover,
pool_do_auth() could crash in opening a connection to backend.
When pool_do_auth() tries to obtain the protocol major version
MAIN_CONNECTION(cp)->sp->major, it crashes because MAIN_CONNECTION(cp)
is NULL. MAIN_NODE_ID is actually a function call to
pool_virtual_main_db_node_id()). The function returns
my_main_node_id. my_main_node_id has been set in
pool_initialize_private_backend_status() in child process starting
up. It copies each backend status (CON_UP, CON_DOWN etc.) from
backend_status which is on the shared memory. Then it copies main node
id on the shared memory to my_main_node_id. In failover, pgpool main
process first updates each backend_status on the shared memory, then
updates main node id on the shared memory. Since there's no
interlocking, it is possible that when pool_do_auth() reads the
backend_status, it has been already updated while main node id is not.
As a result, for example, it could happen that connection to backend 0
is not established because the backend 0 status is already CON_DOWN
while my_main_node_id is still 0. In this case since no connection to
backend 0 has not been made, MAIN_CONNECTION(cp) is NULL, which causes
the segfault.
To fix the issue in pool_initialize_private_backend_status(),
(1) Set my_main_node_id according to each backend status, rather than
just copying REAL_MAIN_NODE_ID to make them consistent.
(2) Add volatile qualifiers to shared memory variables to read their
values on shared memory reliably.
Author: Emond Papegaaij <[email protected]>
Reviewed-by: Tatsuo Ishii <[email protected]>
Discussion: https://www.postgresql.org/message-id/CAGXsc%2BY7OKp93zSqt1WUCh7ABC7kyZqrxJPFA8AC1woB30S8EQ%40mail.g...
Backpatch-through: v4.3
Branch
------
V4_3_STABLE
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=1815b4aa86d8d72ce417703503f79d76fc1c6...
Modified Files
--------------
src/protocol/child.c | 18 ++++++++++++++++--
src/protocol/pool_connection_pool.c | 22 +++++++++++++++++++++-
2 files changed, 37 insertions(+), 3 deletions(-)
^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix segfault in pool_do_auth().
@ 2026-07-03 06:29 Tatsuo Ishii <[email protected]>
0 siblings, 0 replies; 6+ messages in thread
From: Tatsuo Ishii @ 2026-07-03 06:29 UTC (permalink / raw)
To: [email protected]
Fix segfault in pool_do_auth().
If a client connect to pgpool while performing a failover,
pool_do_auth() could crash in opening a connection to backend.
When pool_do_auth() tries to obtain the protocol major version
MAIN_CONNECTION(cp)->sp->major, it crashes because MAIN_CONNECTION(cp)
is NULL. MAIN_NODE_ID is actually a function call to
pool_virtual_main_db_node_id()). The function returns
my_main_node_id. my_main_node_id has been set in
pool_initialize_private_backend_status() in child process starting
up. It copies each backend status (CON_UP, CON_DOWN etc.) from
backend_status which is on the shared memory. Then it copies main node
id on the shared memory to my_main_node_id. In failover, pgpool main
process first updates each backend_status on the shared memory, then
updates main node id on the shared memory. Since there's no
interlocking, it is possible that when pool_do_auth() reads the
backend_status, it has been already updated while main node id is not.
As a result, for example, it could happen that connection to backend 0
is not established because the backend 0 status is already CON_DOWN
while my_main_node_id is still 0. In this case since no connection to
backend 0 has not been made, MAIN_CONNECTION(cp) is NULL, which causes
the segfault.
To fix the issue in pool_initialize_private_backend_status(),
(1) Set my_main_node_id according to each backend status, rather than
just copying REAL_MAIN_NODE_ID to make them consistent.
(2) Add volatile qualifiers to shared memory variables to read their
values on shared memory reliably.
Author: Emond Papegaaij <[email protected]>
Reviewed-by: Tatsuo Ishii <[email protected]>
Discussion: https://www.postgresql.org/message-id/CAGXsc%2BY7OKp93zSqt1WUCh7ABC7kyZqrxJPFA8AC1woB30S8EQ%40mail.g...
Backpatch-through: v4.3
Branch
------
V4_4_STABLE
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=2ff69a70ac853ecc2c0324449f5b6e94f179c...
Modified Files
--------------
src/protocol/child.c | 18 ++++++++++++++++--
src/protocol/pool_connection_pool.c | 22 +++++++++++++++++++++-
2 files changed, 37 insertions(+), 3 deletions(-)
^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix segfault in pool_do_auth().
@ 2026-07-03 06:29 Tatsuo Ishii <[email protected]>
0 siblings, 0 replies; 6+ messages in thread
From: Tatsuo Ishii @ 2026-07-03 06:29 UTC (permalink / raw)
To: [email protected]
Fix segfault in pool_do_auth().
If a client connect to pgpool while performing a failover,
pool_do_auth() could crash in opening a connection to backend.
When pool_do_auth() tries to obtain the protocol major version
MAIN_CONNECTION(cp)->sp->major, it crashes because MAIN_CONNECTION(cp)
is NULL. MAIN_NODE_ID is actually a function call to
pool_virtual_main_db_node_id()). The function returns
my_main_node_id. my_main_node_id has been set in
pool_initialize_private_backend_status() in child process starting
up. It copies each backend status (CON_UP, CON_DOWN etc.) from
backend_status which is on the shared memory. Then it copies main node
id on the shared memory to my_main_node_id. In failover, pgpool main
process first updates each backend_status on the shared memory, then
updates main node id on the shared memory. Since there's no
interlocking, it is possible that when pool_do_auth() reads the
backend_status, it has been already updated while main node id is not.
As a result, for example, it could happen that connection to backend 0
is not established because the backend 0 status is already CON_DOWN
while my_main_node_id is still 0. In this case since no connection to
backend 0 has not been made, MAIN_CONNECTION(cp) is NULL, which causes
the segfault.
To fix the issue in pool_initialize_private_backend_status(),
(1) Set my_main_node_id according to each backend status, rather than
just copying REAL_MAIN_NODE_ID to make them consistent.
(2) Add volatile qualifiers to shared memory variables to read their
values on shared memory reliably.
Author: Emond Papegaaij <[email protected]>
Reviewed-by: Tatsuo Ishii <[email protected]>
Discussion: https://www.postgresql.org/message-id/CAGXsc%2BY7OKp93zSqt1WUCh7ABC7kyZqrxJPFA8AC1woB30S8EQ%40mail.g...
Backpatch-through: v4.3
Branch
------
V4_5_STABLE
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=c0c3c096375f4c7516dc1da51f4f9dc65730c...
Modified Files
--------------
src/protocol/child.c | 18 ++++++++++++++++--
src/protocol/pool_connection_pool.c | 22 +++++++++++++++++++++-
2 files changed, 37 insertions(+), 3 deletions(-)
^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix segfault in pool_do_auth().
@ 2026-07-03 06:29 Tatsuo Ishii <[email protected]>
0 siblings, 0 replies; 6+ messages in thread
From: Tatsuo Ishii @ 2026-07-03 06:29 UTC (permalink / raw)
To: [email protected]
Fix segfault in pool_do_auth().
If a client connect to pgpool while performing a failover,
pool_do_auth() could crash in opening a connection to backend.
When pool_do_auth() tries to obtain the protocol major version
MAIN_CONNECTION(cp)->sp->major, it crashes because MAIN_CONNECTION(cp)
is NULL. MAIN_NODE_ID is actually a function call to
pool_virtual_main_db_node_id()). The function returns
my_main_node_id. my_main_node_id has been set in
pool_initialize_private_backend_status() in child process starting
up. It copies each backend status (CON_UP, CON_DOWN etc.) from
backend_status which is on the shared memory. Then it copies main node
id on the shared memory to my_main_node_id. In failover, pgpool main
process first updates each backend_status on the shared memory, then
updates main node id on the shared memory. Since there's no
interlocking, it is possible that when pool_do_auth() reads the
backend_status, it has been already updated while main node id is not.
As a result, for example, it could happen that connection to backend 0
is not established because the backend 0 status is already CON_DOWN
while my_main_node_id is still 0. In this case since no connection to
backend 0 has not been made, MAIN_CONNECTION(cp) is NULL, which causes
the segfault.
To fix the issue in pool_initialize_private_backend_status(),
(1) Set my_main_node_id according to each backend status, rather than
just copying REAL_MAIN_NODE_ID to make them consistent.
(2) Add volatile qualifiers to shared memory variables to read their
values on shared memory reliably.
Author: Emond Papegaaij <[email protected]>
Reviewed-by: Tatsuo Ishii <[email protected]>
Discussion: https://www.postgresql.org/message-id/CAGXsc%2BY7OKp93zSqt1WUCh7ABC7kyZqrxJPFA8AC1woB30S8EQ%40mail.g...
Backpatch-through: v4.3
Branch
------
V4_6_STABLE
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=8b97ee77e5f0db9c1d52c61d2db37a1b09bf1...
Modified Files
--------------
src/protocol/child.c | 18 ++++++++++++++++--
src/protocol/pool_connection_pool.c | 22 +++++++++++++++++++++-
2 files changed, 37 insertions(+), 3 deletions(-)
^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix segfault in pool_do_auth().
@ 2026-07-03 06:29 Tatsuo Ishii <[email protected]>
0 siblings, 0 replies; 6+ messages in thread
From: Tatsuo Ishii @ 2026-07-03 06:29 UTC (permalink / raw)
To: [email protected]
Fix segfault in pool_do_auth().
If a client connect to pgpool while performing a failover,
pool_do_auth() could crash in opening a connection to backend.
When pool_do_auth() tries to obtain the protocol major version
MAIN_CONNECTION(cp)->sp->major, it crashes because MAIN_CONNECTION(cp)
is NULL. MAIN_NODE_ID is actually a function call to
pool_virtual_main_db_node_id()). The function returns
my_main_node_id. my_main_node_id has been set in
pool_initialize_private_backend_status() in child process starting
up. It copies each backend status (CON_UP, CON_DOWN etc.) from
backend_status which is on the shared memory. Then it copies main node
id on the shared memory to my_main_node_id. In failover, pgpool main
process first updates each backend_status on the shared memory, then
updates main node id on the shared memory. Since there's no
interlocking, it is possible that when pool_do_auth() reads the
backend_status, it has been already updated while main node id is not.
As a result, for example, it could happen that connection to backend 0
is not established because the backend 0 status is already CON_DOWN
while my_main_node_id is still 0. In this case since no connection to
backend 0 has not been made, MAIN_CONNECTION(cp) is NULL, which causes
the segfault.
To fix the issue in pool_initialize_private_backend_status(),
(1) Set my_main_node_id according to each backend status, rather than
just copying REAL_MAIN_NODE_ID to make them consistent.
(2) Add volatile qualifiers to shared memory variables to read their
values on shared memory reliably.
Author: Emond Papegaaij <[email protected]>
Reviewed-by: Tatsuo Ishii <[email protected]>
Discussion: https://www.postgresql.org/message-id/CAGXsc%2BY7OKp93zSqt1WUCh7ABC7kyZqrxJPFA8AC1woB30S8EQ%40mail.g...
Backpatch-through: v4.3
Branch
------
V4_7_STABLE
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=1f02bd3126efc528a744bc3a881ab5e32fd06...
Modified Files
--------------
src/protocol/child.c | 18 ++++++++++++++++--
src/protocol/pool_connection_pool.c | 22 +++++++++++++++++++++-
2 files changed, 37 insertions(+), 3 deletions(-)
^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix segfault in pool_do_auth().
@ 2026-07-03 06:29 Tatsuo Ishii <[email protected]>
0 siblings, 0 replies; 6+ messages in thread
From: Tatsuo Ishii @ 2026-07-03 06:29 UTC (permalink / raw)
To: [email protected]
Fix segfault in pool_do_auth().
If a client connect to pgpool while performing a failover,
pool_do_auth() could crash in opening a connection to backend.
When pool_do_auth() tries to obtain the protocol major version
MAIN_CONNECTION(cp)->sp->major, it crashes because MAIN_CONNECTION(cp)
is NULL. MAIN_NODE_ID is actually a function call to
pool_virtual_main_db_node_id()). The function returns
my_main_node_id. my_main_node_id has been set in
pool_initialize_private_backend_status() in child process starting
up. It copies each backend status (CON_UP, CON_DOWN etc.) from
backend_status which is on the shared memory. Then it copies main node
id on the shared memory to my_main_node_id. In failover, pgpool main
process first updates each backend_status on the shared memory, then
updates main node id on the shared memory. Since there's no
interlocking, it is possible that when pool_do_auth() reads the
backend_status, it has been already updated while main node id is not.
As a result, for example, it could happen that connection to backend 0
is not established because the backend 0 status is already CON_DOWN
while my_main_node_id is still 0. In this case since no connection to
backend 0 has not been made, MAIN_CONNECTION(cp) is NULL, which causes
the segfault.
To fix the issue in pool_initialize_private_backend_status(),
(1) Set my_main_node_id according to each backend status, rather than
just copying REAL_MAIN_NODE_ID to make them consistent.
(2) Add volatile qualifiers to shared memory variables to read their
values on shared memory reliably.
Author: Emond Papegaaij <[email protected]>
Reviewed-by: Tatsuo Ishii <[email protected]>
Discussion: https://www.postgresql.org/message-id/CAGXsc%2BY7OKp93zSqt1WUCh7ABC7kyZqrxJPFA8AC1woB30S8EQ%40mail.g...
Backpatch-through: v4.3
Branch
------
master
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=c39c7b40bf7573e8fc1b4772e99c3b371dca1...
Modified Files
--------------
src/protocol/child.c | 18 ++++++++++++++++--
src/protocol/pool_connection_pool.c | 22 +++++++++++++++++++++-
2 files changed, 37 insertions(+), 3 deletions(-)
^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-07-03 06:29 UTC | newest]
Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-07-03 06:29 pgpool: Fix segfault in pool_do_auth(). Tatsuo Ishii <[email protected]>
2026-07-03 06:29 pgpool: Fix segfault in pool_do_auth(). Tatsuo Ishii <[email protected]>
2026-07-03 06:29 pgpool: Fix segfault in pool_do_auth(). Tatsuo Ishii <[email protected]>
2026-07-03 06:29 pgpool: Fix segfault in pool_do_auth(). Tatsuo Ishii <[email protected]>
2026-07-03 06:29 pgpool: Fix segfault in pool_do_auth(). Tatsuo Ishii <[email protected]>
2026-07-03 06:29 pgpool: Fix segfault in pool_do_auth(). Tatsuo Ishii <[email protected]>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox