MIME-Version: 1.0
From: Emond Papegaaij <emond.papegaaij@gmail.com>
Date: Thu, 4 Jun 2026 15:00:38 +0200
Message-ID: 
 <CAGXsc+ZhGjwm+F42Xmt8Qn1qP_h7woipiV0WsY-e-P7W3ZG2OA@mail.gmail.com>
Subject: Race condition in pcp_node_info can cause it to hang
To: pgpool-hackers@lists.postgresql.org
Content-Type: multipart/mixed; boundary="00000000000035d88406536d221f"
Archived-At: 
 <https://www.postgresql.org/message-id/CAGXsc%2BZhGjwm%2BF42Xmt8Qn1qP_h7woipiV0WsY-e-P7W3ZG2OA%40mail.gmail.com>
Precedence: bulk

--00000000000035d88406536d221f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

We've hit another very rare flake in our tests, which can cause
pcp_node_info to hang indefinitely. I've analyzed the problem with
Claude Code, and it came to the conclusion and (quite small) fix
below. Attached is a patch against 4.7.

The problem:
In inform_node_info() (src/pcp_con/pcp_worker.c), the PCP reply packet
reads bi->replication_state and bi->replication_sync_state directly
from shared memory twice: once via strlen() to compute the packet
length, and once via pcp_write() to write the payload.

The streaming-replication check worker rewrites those same
shared-memory strings without a lock (it clears them to "" then
repopulates them every check cycle and on state transitions,
src/streaming_replication/pool_worker_child.c). If the string's length
changes between the two reads, the declared wsize no longer matches
the bytes actually written, so the PCP byte stream desynchronises. The
client then blocks forever in pcp_read() waiting for bytes the server
never sends.

The fix:
Snapshot the two strings into local buffers once, right after bi =3D
pool_get_node_info(i),
and use the locals for both the length and the payload =E2=80=94 so a singl=
e
packet is always
internally consistent. This matches how every other field in the
packet is already
handled.

Best regards,
Emond

--00000000000035d88406536d221f
Content-Type: text/x-patch; charset="US-ASCII";
 name="pcp_node_info_hang.patch"
Content-Disposition: attachment; filename="pcp_node_info_hang.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mpzi5vp80>
X-Attachment-Id: f_mpzi5vp80

ZGlmZiAtLWdpdCBhL3NyYy9wY3BfY29uL3BjcF93b3JrZXIuYyBiL3NyYy9wY3BfY29uL3BjcF93
b3JrZXIuYwppbmRleCA3MmJmNjhkODQuLmEzZWQzNDk0ZCAxMDA2NDQKLS0tIGEvc3JjL3BjcF9j
b24vcGNwX3dvcmtlci5jCisrKyBiL3NyYy9wY3BfY29uL3BjcF93b3JrZXIuYwpAQCAtODk2LDYg
Kzg5Niw4IEBAIGluZm9ybV9ub2RlX2luZm8oUENQX0NPTk5FQ1RJT04gKmZyb250ZW5kLCBjaGFy
ICpidWYpCiAJCQljaGFyCQlzdGFuZGJ5X2RlbGF5X3N0clsyMF07CiAJCQljaGFyCQlzdGFuZGJ5
X2RlbGF5X2J5X3RpbWVfc3RyWzRdOwogCQkJY2hhcgkJc3RhdHVzX2NoYW5nZWRfdGltZV9zdHJb
MjBdOworCQkJY2hhcgkJcmVwbF9zdGF0ZVtOQU1FREFUQUxFTl07CisJCQljaGFyCQlyZXBsX3N5
bmNfc3RhdGVbTkFNRURBVEFMRU5dOwogCQkJY2hhcgkJY29kZVtdID0gIk5vZGVJbmZvIjsKIAkJ
CUJhY2tlbmRJbmZvICpiaSA9IE5VTEw7CiAJCQlTRVJWRVJfUk9MRSByb2xlOwpAQCAtOTEwLDYg
KzkxMiwxNyBAQCBpbmZvcm1fbm9kZV9pbmZvKFBDUF9DT05ORUNUSU9OICpmcm9udGVuZCwgY2hh
ciAqYnVmKQogCQkJCQkJKGVycm1zZygiaW5mb3JtaW5nIG5vZGUgaW5mbyBmYWlsZWQiKSwKIAkJ
CQkJCSBlcnJkZXRhaWwoImludmFsaWQgbm9kZSBJRCIpKSk7CiAKKwkJCS8qCisJCQkgKiBTbmFw
c2hvdCB0aGUgcmVwbGljYXRpb24gc3RhdGUgc3RyaW5ncywgd2hpY2ggdGhlIHNyLWNoZWNrCisJ
CQkgKiB3b3JrZXIgcmV3cml0ZXMgbG9jay1mcmVlIGluIHNoYXJlZCBtZW1vcnkuICBUaGV5IGFy
ZSB1c2VkCisJCQkgKiBmb3IgYm90aCB0aGUgcGFja2V0IGxlbmd0aCAod3NpemUpIGFuZCB0aGUg
cGF5bG9hZCBiZWxvdzsKKwkJCSAqIHJlYWRpbmcgdGhlbSBsaXZlIHR3aWNlIGNvdWxkIG1ha2Ug
dGhlIGxlbmd0aCBkaXNhZ3JlZSB3aXRoCisJCQkgKiB0aGUgYnl0ZXMgd3JpdHRlbiBhbmQgZGVz
eW5jIHRoZSBQQ1Agc3RyZWFtLCBoYW5naW5nIHRoZQorCQkJICogY2xpZW50LgorCQkJICovCisJ
CQlzdHJsY3B5KHJlcGxfc3RhdGUsIGJpLT5yZXBsaWNhdGlvbl9zdGF0ZSwgc2l6ZW9mKHJlcGxf
c3RhdGUpKTsKKwkJCXN0cmxjcHkocmVwbF9zeW5jX3N0YXRlLCBiaS0+cmVwbGljYXRpb25fc3lu
Y19zdGF0ZSwgc2l6ZW9mKHJlcGxfc3luY19zdGF0ZSkpOworCiAJCQlzbnByaW50Zihwb3J0X3N0
ciwgc2l6ZW9mKHBvcnRfc3RyKSwgIiVkIiwgYmktPmJhY2tlbmRfcG9ydCk7CiAJCQlzbnByaW50
ZihzdGF0dXMsIHNpemVvZihzdGF0dXMpLCAiJWQiLCBiaS0+YmFja2VuZF9zdGF0dXMpOwogCQkJ
c25wcmludGYocXVhcmFudGluZSwgc2l6ZW9mKHF1YXJhbnRpbmUpLCAiJWQiLCBiaS0+cXVhcmFu
dGluZSk7CkBAIC05NDksOCArOTYyLDggQEAgaW5mb3JtX25vZGVfaW5mbyhQQ1BfQ09OTkVDVElP
TiAqZnJvbnRlbmQsIGNoYXIgKmJ1ZikKIAkJCQkJCSAgc3RybGVuKG5vZGVzW2ldLnBnX3JvbGUp
ICsgMSArCiAJCQkJCQkgIHN0cmxlbihzdGFuZGJ5X2RlbGF5X2J5X3RpbWVfc3RyKSArIDEgKwog
CQkJCQkJICBzdHJsZW4oc3RhbmRieV9kZWxheV9zdHIpICsgMSArCi0JCQkJCQkgIHN0cmxlbihi
aS0+cmVwbGljYXRpb25fc3RhdGUpICsgMSArCi0JCQkJCQkgIHN0cmxlbihiaS0+cmVwbGljYXRp
b25fc3luY19zdGF0ZSkgKyAxICsKKwkJCQkJCSAgc3RybGVuKHJlcGxfc3RhdGUpICsgMSArCisJ
CQkJCQkgIHN0cmxlbihyZXBsX3N5bmNfc3RhdGUpICsgMSArCiAJCQkJCQkgIHN0cmxlbihzdGF0
dXNfY2hhbmdlZF90aW1lX3N0cikgKyAxICsKIAkJCQkJCSAgc2l6ZW9mKGludCkpOwogCQkJcGNw
X3dyaXRlKGZyb250ZW5kLCAmd3NpemUsIHNpemVvZihpbnQpKTsKQEAgLTk2NSw4ICs5NzgsOCBA
QCBpbmZvcm1fbm9kZV9pbmZvKFBDUF9DT05ORUNUSU9OICpmcm9udGVuZCwgY2hhciAqYnVmKQog
CQkJcGNwX3dyaXRlKGZyb250ZW5kLCBub2Rlc1tpXS5wZ19yb2xlLCBzdHJsZW4obm9kZXNbaV0u
cGdfcm9sZSkgKyAxKTsKIAkJCXBjcF93cml0ZShmcm9udGVuZCwgc3RhbmRieV9kZWxheV9ieV90
aW1lX3N0ciwgc3RybGVuKHN0YW5kYnlfZGVsYXlfYnlfdGltZV9zdHIpICsgMSk7CiAJCQlwY3Bf
d3JpdGUoZnJvbnRlbmQsIHN0YW5kYnlfZGVsYXlfc3RyLCBzdHJsZW4oc3RhbmRieV9kZWxheV9z
dHIpICsgMSk7Ci0JCQlwY3Bfd3JpdGUoZnJvbnRlbmQsIGJpLT5yZXBsaWNhdGlvbl9zdGF0ZSwg
c3RybGVuKGJpLT5yZXBsaWNhdGlvbl9zdGF0ZSkgKyAxKTsKLQkJCXBjcF93cml0ZShmcm9udGVu
ZCwgYmktPnJlcGxpY2F0aW9uX3N5bmNfc3RhdGUsIHN0cmxlbihiaS0+cmVwbGljYXRpb25fc3lu
Y19zdGF0ZSkgKyAxKTsKKwkJCXBjcF93cml0ZShmcm9udGVuZCwgcmVwbF9zdGF0ZSwgc3RybGVu
KHJlcGxfc3RhdGUpICsgMSk7CisJCQlwY3Bfd3JpdGUoZnJvbnRlbmQsIHJlcGxfc3luY19zdGF0
ZSwgc3RybGVuKHJlcGxfc3luY19zdGF0ZSkgKyAxKTsKIAkJCXBjcF93cml0ZShmcm9udGVuZCwg
c3RhdHVzX2NoYW5nZWRfdGltZV9zdHIsIHN0cmxlbihzdGF0dXNfY2hhbmdlZF90aW1lX3N0cikg
KyAxKTsKIAkJCWRvX3BjcF9mbHVzaChmcm9udGVuZCk7CiAJCX0K
--00000000000035d88406536d221f--