MIME-Version: 1.0
From: Emond Papegaaij <emond.papegaaij@gmail.com>
Date: Mon, 29 Jun 2026 10:25:51 +0200
Message-ID: 
 <CAGXsc+Y7OKp93zSqt1WUCh7ABC7kyZqrxJPFA8AC1woB30S8EQ@mail.gmail.com>
Subject: [PATCH] Segfault in pool_do_auth() when failover races with a new
 connection
To: pgpool-hackers@lists.postgresql.org
Content-Type: multipart/mixed; boundary="000000000000877b760655603545"
Archived-At: 
 <https://www.postgresql.org/message-id/CAGXsc%2BY7OKp93zSqt1WUCh7ABC7kyZqrxJPFA8AC1woB30S8EQ%40mail.gmail.com>
Precedence: bulk

--000000000000877b760655603545
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

Last night one of CI builds detected a segmentation fault in pgpool
(4.7.2). I've ran an analysis on the coredump with Claude and came to
the conclusion that this can happen when trying to open a connection
in the middle of a failover.

Symptom / backtrace (resolved from the core dump):
pool_do_auth (src/auth/pool_auth.c:349)   <-- SIGSEGV, fault addr 0x0
connect_backend (src/protocol/child.c:1099)  (PG_TRY block)
get_backend_connection (src/protocol/child.c:2109)
do_child (src/protocol/child.c:233)

The crashing statement is:
protoMajor =3D MAIN_CONNECTION(cp)->sp->major;   /* pool_auth.c:349 */
i.e. cp->slots[MAIN_NODE_ID] is NULL. From the core, the pool had
slots[0] =3D=3D NULL while slots[1]/slots[2] were valid, and MAIN_NODE_ID =
=3D=3D 0.

pool_initialize_private_backend_status() snapshots
private_backend_status[] and my_main_node_id non=E2=80=91atomically w.r.t. =
the
parent's failover, so a child can capture my_main_node_id =3D=3D 0 while
node 0 is already CON_DOWN. new_connection() then never creates
slots[0], and pool_do_auth() dereferences the NULL main slot. (Same
class as the NULL=E2=80=91MAIN_CONNECTION case noted in
pool_virtual_main_db_node_id().)

Attached is a patch that fixes the issue.

Best regards,
Emond

--000000000000877b760655603545
Content-Type: text/x-patch; charset="US-ASCII"; name="connect_crash_fix.patch"
Content-Disposition: attachment; filename="connect_crash_fix.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mqyydiev0>
X-Attachment-Id: f_mqyydiev0

ZGlmZiAtLWdpdCBpL3NyYy9wcm90b2NvbC9jaGlsZC5jIHcvc3JjL3Byb3RvY29sL2NoaWxkLmMK
aW5kZXggYzM0ZjA1NzI4Li4xZjJlZGE4MWEgMTAwNjQ0Ci0tLSBpL3NyYy9wcm90b2NvbC9jaGls
ZC5jCisrKyB3L3NyYy9wcm90b2NvbC9jaGlsZC5jCkBAIC0xNDc2LDYgKzE0NzYsMjkgQEAgcG9v
bF9pbml0aWFsaXplX3ByaXZhdGVfYmFja2VuZF9zdGF0dXModm9pZCkKIAl9CiAKIAlteV9tYWlu
X25vZGVfaWQgPSBSRUFMX01BSU5fTk9ERV9JRDsKKworCS8qCisJICogUkVBTF9NQUlOX05PREVf
SUQgYW5kIHRoZSBwZXItbm9kZSBzdGF0dXMgYXJlIHJlYWQgZnJvbSBzaGFyZWQgbWVtb3J5CisJ
ICogbm9uLWF0b21pY2FsbHksIHNvIGEgY29uY3VycmVudCBmYWlsb3ZlciBjYW4gbGVhdmUgbXlf
bWFpbl9ub2RlX2lkCisJICogcG9pbnRpbmcgYXQgYSBub2RlIHdlIGp1c3QgY2FwdHVyZWQgYXMg
ZG93bi4gUmUtcG9pbnQgaXQgYXQgdGhlIGZpcnN0CisJICogbm9kZSB0aGF0IGlzIHVwIGluIG91
ciBwcml2YXRlIHNuYXBzaG90OyBvdGhlcndpc2UgTUFJTl9DT05ORUNUSU9OKCkKKwkgKiB3b3Vs
ZCBkZXJlZmVyZW5jZSBhIGNvbm5lY3Rpb24gc2xvdCB0aGF0IGlzIG5ldmVyIGNyZWF0ZWQgZm9y
IGEgZG93bgorCSAqIG5vZGUuCisJICovCisJaWYgKG15X21haW5fbm9kZV9pZCA8IDAgfHwgbXlf
bWFpbl9ub2RlX2lkID49IE5VTV9CQUNLRU5EUyB8fAorCQkocHJpdmF0ZV9iYWNrZW5kX3N0YXR1
c1tteV9tYWluX25vZGVfaWRdICE9IENPTl9VUCAmJgorCQkgcHJpdmF0ZV9iYWNrZW5kX3N0YXR1
c1tteV9tYWluX25vZGVfaWRdICE9IENPTl9DT05ORUNUX1dBSVQpKQorCXsKKwkJZm9yIChpID0g
MDsgaSA8IE5VTV9CQUNLRU5EUzsgaSsrKQorCQl7CisJCQlpZiAocHJpdmF0ZV9iYWNrZW5kX3N0
YXR1c1tpXSA9PSBDT05fVVAgfHwKKwkJCQlwcml2YXRlX2JhY2tlbmRfc3RhdHVzW2ldID09IENP
Tl9DT05ORUNUX1dBSVQpCisJCQl7CisJCQkJbXlfbWFpbl9ub2RlX2lkID0gaTsKKwkJCQlicmVh
azsKKwkJCX0KKwkJfQorCX0KIH0KIAogc3RhdGljIHZvaWQKZGlmZiAtLWdpdCBpL3NyYy9wcm90
b2NvbC9wb29sX2Nvbm5lY3Rpb25fcG9vbC5jIHcvc3JjL3Byb3RvY29sL3Bvb2xfY29ubmVjdGlv
bl9wb29sLmMKaW5kZXggYjE2Y2NjMzllLi5hOTM5YjA4YTcgMTAwNjQ0Ci0tLSBpL3NyYy9wcm90
b2NvbC9wb29sX2Nvbm5lY3Rpb25fcG9vbC5jCisrKyB3L3NyYy9wcm90b2NvbC9wb29sX2Nvbm5l
Y3Rpb25fcG9vbC5jCkBAIC0xMDM1LDYgKzEwMzUsMjYgQEAgbmV3X2Nvbm5lY3Rpb24oUE9PTF9D
T05ORUNUSU9OX1BPT0wgKnApCiAKIAlpZiAoYWN0aXZlX2JhY2tlbmRfY291bnQgPiAwKQogCXsK
KwkJLyoKKwkJICogQSBjb25jdXJyZW50IGZhaWxvdmVyIG1heSBoYXZlIGNoYW5nZWQgYmFja2Vu
ZCBzdGF0dXMgd2hpbGUgd2Ugd2VyZQorCQkgKiBjcmVhdGluZyBjb25uZWN0aW9ucywgbGVhdmlu
ZyBteV9tYWluX25vZGVfaWQgcG9pbnRpbmcgYXQgYSBub2RlIHdlCisJCSAqIHNraXBwZWQgKGl0
cyBzbG90IGlzIE5VTEwpLiBSZS1wb2ludCBpdCBhdCBhIG5vZGUgd2UgZGlkIGNvbm5lY3QgdG8K
KwkJICogc28gdGhhdCBNQUlOX0NPTk5FQ1RJT04oKSBuZXZlciBkZXJlZmVyZW5jZXMgYSBOVUxM
IHNsb3QgKGUuZy4gaW4KKwkJICogcG9vbF9kb19hdXRoKCkpLgorCQkgKi8KKwkJaWYgKG15X21h
aW5fbm9kZV9pZCA8IDAgfHwgbXlfbWFpbl9ub2RlX2lkID49IE5VTV9CQUNLRU5EUyB8fAorCQkJ
cC0+c2xvdHNbbXlfbWFpbl9ub2RlX2lkXSA9PSBOVUxMKQorCQl7CisJCQlmb3IgKGkgPSAwOyBp
IDwgTlVNX0JBQ0tFTkRTOyBpKyspCisJCQl7CisJCQkJaWYgKHAtPnNsb3RzW2ldICE9IE5VTEwp
CisJCQkJeworCQkJCQlteV9tYWluX25vZGVfaWQgPSBpOworCQkJCQlicmVhazsKKwkJCQl9CisJ
CQl9CisJCX0KKwogCQlyZXR1cm4gcDsKIAl9CiAK
--000000000000877b760655603545--