From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jeremy Evans <code@jeremyevans.net>
cc: Michael Paquier <michael@paquier.xyz>, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #15367: Crash in pg_fe_scram_free when using foreign tables
In-reply-to: <16558.1536407783@sss.pgh.pa.us>
References: <153626613985.23143.4743626885618266803@wrigleys.postgresql.org>
 <20180906215836.GP2726@paquier.xyz>
 <20180906222843.GF17425@jeremyevans.local>
 <20180907165103.GH17425@jeremyevans.local>
 <20180907175518.GI17425@jeremyevans.local>
 <20180907181522.GB32058@paquier.xyz> <20016.1536351535@sss.pgh.pa.us>
 <20180907204403.GC32058@paquier.xyz> <16558.1536407783@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Sat, 08 Sep 2018 07:56:23 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <18397.1536410055.1@sss.pgh.pa.us>
Date: Sat, 08 Sep 2018 08:34:15 -0400
Message-ID: <18398.1536410055@sss.pgh.pa.us>
Precedence: bulk

I wrote:
> We're still no closer to an explanation of Jeremy's failure, though
> I'm now pretty sure that pg_saslprep itself isn't the issue.

I had an idea about that --- it's probably all wet, but the code as
written seems bulletproof enough that I'm forced to postulate something
very strange is happening.

Observe that there are two copies of pg_saslprep() in play: there is one
in the backend, which is compiled to allocate its result with palloc,
and there is one in libpq, which is compiled to allocate its result
with malloc.  Could it be that somehow, when libpq is loaded into the
backend address space as it is here, libpq winds up calling the backend's
copy of pg_saslprep rather than its own?  That would work just fine,
until libpq tried to free the returned string using free(), and then
we'd get exactly the reported error.

The main weakness in this theory is that it suggests that Jeremy's
postgres_fdw connections ought to be falling over more easily than
they are.  However, I think that postgres_fdw will never explicitly
close a PGconn unless it's forced to; during a normal backend session
exit, the process just dies without going through PQfinish, so that
the problem would be masked.  The only way to get to the PQfinish
call shown in the backtrace is for pgfdw_inval_callback to mark the
connection invalid, which'd require either an update on the relevant
foreign server object, an update on the user mapping in use, or a
SI cache reset.  That explains how heavy DDL activity in an apparently
unrelated database can trigger the problem: it eventually results in
a SI message queue overrun and ensuing cache reset.  In the absence
of SI cache resets, maybe indeed the problem is rare even if the
pg_saslprep result is misallocated every time.

Not sure about a good way to test this theory.  Need more caffeine.

			regards, tom lane