Subject: pgpool: Fix segfault in pool_do_auth().

From: Tatsuo Ishii <[email-masked]>
Date: Fri, 03 Jul 2026 06:29:43 +0000

Fix segfault in pool_do_auth().

If a client connect to pgpool while performing a failover,
pool_do_auth() could crash in opening a connection to backend.

When pool_do_auth() tries to obtain the protocol major version
MAIN_CONNECTION(cp)->sp->major, it crashes because MAIN_CONNECTION(cp)
is NULL.  MAIN_NODE_ID is actually a function call to
pool_virtual_main_db_node_id()). The function returns
my_main_node_id. my_main_node_id has been set in
pool_initialize_private_backend_status() in child process starting
up. It copies each backend status (CON_UP, CON_DOWN etc.) from
backend_status which is on the shared memory. Then it copies main node
id on the shared memory to my_main_node_id.  In failover, pgpool main
process first updates each backend_status on the shared memory, then
updates main node id on the shared memory. Since there's no
interlocking, it is possible that when pool_do_auth() reads the
backend_status, it has been already updated while main node id is not.
As a result, for example, it could happen that connection to backend 0
is not established because the backend 0 status is already CON_DOWN
while my_main_node_id is still 0. In this case since no connection to
backend 0 has not been made, MAIN_CONNECTION(cp) is NULL, which causes
the segfault.

To fix the issue in pool_initialize_private_backend_status(),

(1) Set my_main_node_id according to each backend status, rather than
    just copying REAL_MAIN_NODE_ID to make them consistent.

(2) Add volatile qualifiers to shared memory variables to read their
    values on shared memory reliably.

Author: Emond Papegaaij <[email-masked]>
Reviewed-by: Tatsuo Ishii <[email-masked]>
Discussion: https://www.postgresql.org/message-id/CAGXsc%2BY7OKp93zSqt1WUCh7ABC7kyZqrxJPFA8AC1woB30S8EQ%40mail.gmail.com
Backpatch-through: v4.3

Branch
------
V4_5_STABLE

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=c0c3c096375f4c7516dc1da51f4f9dc65730c833

Modified Files
--------------
src/protocol/child.c                | 18 ++++++++++++++++--
src/protocol/pool_connection_pool.c | 22 +++++++++++++++++++++-
2 files changed, 37 insertions(+), 3 deletions(-)