Content-Type: multipart/mixed;
 boundary=18194a22b89a91d7b090efef74f2024bf9c4ccb73bc848c42352b739eba4
Date: Mon, 25 May 2026 19:26:17 -0300
Message-Id: <DIS405H05GE0.1OPMN9BEKKMS1@gmail.com>
Subject: Re: BUG #19480: PL/Python SRF crashes (SIGSEGV) when function is
 replaced mid-iteration: use-after-free in PLy_funct
From: "Matheus Alcantara" <matheusssilv97@gmail.com>
To: <adoros@starfishstorage.com>, <pgsql-bugs@lists.postgresql.org>
Mime-Version: 1.0
References: <19480-f1f9fdce30462fc4@postgresql.org>
In-Reply-To: <19480-f1f9fdce30462fc4@postgresql.org>
Archived-At: 
 <https://www.postgresql.org/message-id/DIS405H05GE0.1OPMN9BEKKMS1%40gmail.com>
Precedence: bulk

--18194a22b89a91d7b090efef74f2024bf9c4ccb73bc848c42352b739eba4
Content-Type: multipart/alternative;
 boundary=4f5f8659150cc68dade710fef0b0499c5ec5f2a353154a85eb87df62d891

--4f5f8659150cc68dade710fef0b0499c5ec5f2a353154a85eb87df62d891
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Content-Type: text/plain; charset=UTF-8

On Fri May 15, 2026 at 8:11 AM -03, PG Bug reporting form wrote:
> The root cause is that srfstate->savedargs is tied to proc->mcxt (which c=
an
> be deleted at any per-call boundary) rather than to
> funcctx->multi_call_memory_ctx (which lives for the entire SRF lifetime).
>
> Option A =E2=80=94 allocate savedargs in funcctx->multi_call_memory_ctx:
> Change PLy_function_save_args to accept a MemoryContext parameter and pas=
s
> funcctx->multi_call_memory_ctx from PLy_exec_function. The saved PyObject=
*
> references are valid regardless of which MemoryContext holds the struct.
>
> Option B =E2=80=94 detect proc rebuild and discard stale savedargs:
> After PLy_procedure_get returns a new proc, check whether it differs from
> the
> proc that created srfstate->savedargs. If so, discard savedargs
> (PLy_function_drop_args or simply set to NULL) and skip the restore.
>

Hi, thank you for the very detailed bug report. I've managed to
reproduce the issue on master.

Option A seems to fix the issue (see attached patch) but I've found
another issue while playing with this that I think it's related:

CREATE OR REPLACE FUNCTION trigger_stack_overflow(x BIGINT)
RETURNS TABLE(i BIGINT) AS $$
    import time
    plpy.execute(f"CREATE TEMP TABLE _rt_{x} (x int)")
    plpy.execute(f"DROP TABLE _rt_{x}")
    time.sleep(0.3)
    plpy.execute("SELECT trigger_stack_overflow(1)")
    yield x
$$ LANGUAGE plpython3u VOLATILE;

Run SELECT trigger_stack_overflow(1) and on another session execute the
CREATE OR REPLACE and wait for the first session to crash with this
stacktrace:
frame #3: 0x000000010554a694 postgres`ExceptionalCondition(conditionName=3D=
"proc->calldepth > 0", fileName=3D"../src/pl/plpython/plpy_exec.c", lineNum=
ber=3D701) at assert.c:65:2
frame #4: 0x0000000105e41984 plpython3.dylib`PLy_global_args_pop(proc=3D0x0=
00000014b03cf00) at plpy_exec.c:701:2
frame #5: 0x0000000105e40d94 plpython3.dylib`PLy_exec_function(fcinfo=3D0x0=
00000011e077738, proc=3D0x000000014b03cf00) at plpy_exec.c:264:3

The expected output from the first session should be something like
this:

ERROR:  54001: error fetching next item from iterator
DETAIL:  spiexceptions.StatementTooComplex: error fetching next item from i=
terator
HINT:  Increase the configuration parameter "max_stack_depth" (currently 20=
48kB), after ensuring the platform's stack depth limit is adequate.

This is because when PLy_procedure_delete() is executed on
PLy_procedure_get() it also destroy information related with recursive
functions, such as "calldepth", "argstack" and "globals" which cause the
assert failure Assert(proc->calldepth > 0) on PLy_global_args_pop() when
it's executed on PG_CATCH block on PLy_exec_function() or EXC_BAD_ACCESS
when accessing "argstack" or "globals".

Althrought changing the memory context where savedargs is allocated fix
the reported issue I think that the long term fix is to preserve such
necessary execution information during PLyProcedure re-creation. I'm
still studying the code to see if and how this can implemented.

--
Matheus Alcantara
EDB: https://www.enterprisedb.com

--4f5f8659150cc68dade710fef0b0499c5ec5f2a353154a85eb87df62d891--

--18194a22b89a91d7b090efef74f2024bf9c4ccb73bc848c42352b739eba4
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename=0001-plpython-Use-correct-memory-context-for-savedargs.patch
Content-Type: text/plain; charset=utf-8;
 name=0001-plpython-Use-correct-memory-context-for-savedargs.patch

RnJvbSA2MWY0NmFiZDQ1MDljYzUxOWRlM2U0M2FkZmQ5ZTBiNGZhMGY2ZmNiIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBNYXRoZXVzIEFsY2FudGFyYSA8bXRocy5kZXZAcG0ubWU+CkRh
dGU6IE1vbiwgMjUgTWF5IDIwMjYgMTk6MjI6MDkgLTAzMDAKU3ViamVjdDogW1BBVENIXSBwbHB5
dGhvbjogVXNlIGNvcnJlY3QgbWVtb3J5IGNvbnRleHQgZm9yIHNhdmVkYXJncwoKLS0tCiBzcmMv
cGwvcGxweXRob24vcGxweV9leGVjLmMgfCAyNyArKysrKysrKysrKysrKysrKysrKy0tLS0tLS0K
IDEgZmlsZSBjaGFuZ2VkLCAyMCBpbnNlcnRpb25zKCspLCA3IGRlbGV0aW9ucygtKQoKZGlmZiAt
LWdpdCBhL3NyYy9wbC9wbHB5dGhvbi9wbHB5X2V4ZWMuYyBiL3NyYy9wbC9wbHB5dGhvbi9wbHB5
X2V4ZWMuYwppbmRleCBkZTBkYWQxZjUzMy4uZDkzZTgwMGUwYmUgMTAwNjQ0Ci0tLSBhL3NyYy9w
bC9wbHB5dGhvbi9wbHB5X2V4ZWMuYworKysgYi9zcmMvcGwvcGxweXRob24vcGxweV9leGVjLmMK
QEAgLTMxLDcgKzMxLDcgQEAgdHlwZWRlZiBzdHJ1Y3QgUEx5U1JGU3RhdGUKIH0gUEx5U1JGU3Rh
dGU7CiAKIHN0YXRpYyBQeU9iamVjdCAqUEx5X2Z1bmN0aW9uX2J1aWxkX2FyZ3MoRnVuY3Rpb25D
YWxsSW5mbyBmY2luZm8sIFBMeVByb2NlZHVyZSAqcHJvYyk7Ci1zdGF0aWMgUEx5U2F2ZWRBcmdz
ICpQTHlfZnVuY3Rpb25fc2F2ZV9hcmdzKFBMeVByb2NlZHVyZSAqcHJvYyk7CitzdGF0aWMgUEx5
U2F2ZWRBcmdzICpQTHlfZnVuY3Rpb25fc2F2ZV9hcmdzKE1lbW9yeUNvbnRleHQgbWN0eCwgUEx5
UHJvY2VkdXJlICpwcm9jKTsKIHN0YXRpYyB2b2lkIFBMeV9mdW5jdGlvbl9yZXN0b3JlX2FyZ3Mo
UEx5UHJvY2VkdXJlICpwcm9jLCBQTHlTYXZlZEFyZ3MgKnNhdmVkYXJncyk7CiBzdGF0aWMgdm9p
ZCBQTHlfZnVuY3Rpb25fZHJvcF9hcmdzKFBMeVNhdmVkQXJncyAqc2F2ZWRhcmdzKTsKIHN0YXRp
YyB2b2lkIFBMeV9nbG9iYWxfYXJnc19wdXNoKFBMeVByb2NlZHVyZSAqcHJvYyk7CkBAIC0xNzYs
OCArMTc2LDE1IEBAIFBMeV9leGVjX2Z1bmN0aW9uKEZ1bmN0aW9uQ2FsbEluZm8gZmNpbmZvLCBQ
THlQcm9jZWR1cmUgKnByb2MpCiAJCQkJICogVGhpcyB3b24ndCBiZSBsYXN0IGNhbGwsIHNvIHNh
dmUgYXJndW1lbnQgdmFsdWVzLiAgV2UgZG8KIAkJCQkgKiB0aGlzIGFnYWluIGVhY2ggdGltZSBp
biBjYXNlIHRoZSBpdGVyYXRvciBpcyBjaGFuZ2luZyB0aG9zZQogCQkJCSAqIHZhbHVlcy4KKwkJ
CQkgKgorCQkJCSAqIFdlIHVzZSBmdW5jY3R4LT5tdWx0aV9jYWxsX21lbW9yeV9jdHggdG8gZW5z
dXJlIHNhdmVkYXJncworCQkJCSAqIHN1cnZpdmVzIGFjcm9zcyBWYWx1ZVBlckNhbGwgaW52b2Nh
dGlvbnMsIGJ1dCBpcyBjbGVhbmVkIHVwCisJCQkJICogd2hlbiB0aGUgU1JGIGNvbXBsZXRlcy4g
IFRoaXMgYWxzbyBwcm90ZWN0cyBhZ2FpbnN0IHRoZQorCQkJCSAqIGNhc2Ugd2hlcmUgdGhlIHBy
b2NlZHVyZSBpcyBkZWxhdGVkICh2aWEKKwkJCQkgKiBQTHlfcHJvY2VkdXJlX2RlbGV0ZSApIHdo
aWxlIHRoZSBTUkYgaXMgcnVubmluZy4KIAkJCQkgKi8KLQkJCQlzcmZzdGF0ZS0+c2F2ZWRhcmdz
ID0gUEx5X2Z1bmN0aW9uX3NhdmVfYXJncyhwcm9jKTsKKwkJCQlzcmZzdGF0ZS0+c2F2ZWRhcmdz
ID0gUEx5X2Z1bmN0aW9uX3NhdmVfYXJncyhmdW5jY3R4LT5tdWx0aV9jYWxsX21lbW9yeV9jdHgs
CisJCQkJCQkJCQkJCQkJCQkgcHJvYyk7CiAJCQl9CiAJCX0KIApAQCAtNTM2LDEzICs1NDMsMTMg
QEAgUEx5X2Z1bmN0aW9uX2J1aWxkX2FyZ3MoRnVuY3Rpb25DYWxsSW5mbyBmY2luZm8sIFBMeVBy
b2NlZHVyZSAqcHJvYykKICAqIGF2YWlsYWJsZSB2aWEgdGhlIHByb2MncyBnbG9iYWxzIDotKCAu
Li4gYnV0IHdlJ3JlIHN0dWNrIHdpdGggdGhhdCBub3cuCiAgKi8KIHN0YXRpYyBQTHlTYXZlZEFy
Z3MgKgotUEx5X2Z1bmN0aW9uX3NhdmVfYXJncyhQTHlQcm9jZWR1cmUgKnByb2MpCitQTHlfZnVu
Y3Rpb25fc2F2ZV9hcmdzKE1lbW9yeUNvbnRleHQgbWN0eCwgUEx5UHJvY2VkdXJlICpwcm9jKQog
ewogCVBMeVNhdmVkQXJncyAqcmVzdWx0OwogCi0JLyogc2F2ZWQgYXJncyBhcmUgYWx3YXlzIGFs
bG9jYXRlZCBpbiBwcm9jZWR1cmUncyBjb250ZXh0ICovCisJLyogQWxsb2NhdGUgaW4gdGhlIGNh
bGxlci1zcGVjaWZpZWQgbWVtb3J5IGNvbnRleHQgKi8KIAlyZXN1bHQgPSAoUEx5U2F2ZWRBcmdz
ICopCi0JCU1lbW9yeUNvbnRleHRBbGxvY1plcm8ocHJvYy0+bWN4dCwKKwkJTWVtb3J5Q29udGV4
dEFsbG9jWmVybyhtY3R4LAogCQkJCQkJCSAgIG9mZnNldG9mKFBMeVNhdmVkQXJncywgbmFtZWRh
cmdzKSArCiAJCQkJCQkJICAgcHJvYy0+bmFyZ3MgKiBzaXplb2YoUHlPYmplY3QgKikpOwogCXJl
c3VsdC0+bmFyZ3MgPSBwcm9jLT5uYXJnczsKQEAgLTY1OCw4ICs2NjUsMTQgQEAgUEx5X2dsb2Jh
bF9hcmdzX3B1c2goUEx5UHJvY2VkdXJlICpwcm9jKQogCXsKIAkJUEx5U2F2ZWRBcmdzICpub2Rl
OwogCi0JCS8qIEJ1aWxkIGEgc3RydWN0IGNvbnRhaW5pbmcgY3VycmVudCBhcmd1bWVudCB2YWx1
ZXMgKi8KLQkJbm9kZSA9IFBMeV9mdW5jdGlvbl9zYXZlX2FyZ3MocHJvYyk7CisJCS8qCisJCSAq
IEJ1aWxkIGEgc3RydWN0IGNvbnRhaW5pbmcgY3VycmVudCBhcmd1bWVudCB2YWx1ZXMuICBXZSB1
c2UKKwkJICogcHJvYy0+bWN4dCBiZWNhdXNlIHRoZSBzYXZlZCBhcmdzIG11c3QgcGVyc2lzdCBh
Y3Jvc3MgdGhlIGVudGlyZQorCQkgKiByZWN1cnNpdmUgY2FsbCBzdGFjaywgd2hpY2ggY2FuIHNw
YW4gbXVsdGlwbGUgZnVuY3Rpb24gaW52b2NhdGlvbnMuCisJCSAqIFRoZSBwcm9jZWR1cmUncyBt
ZW1vcnkgY29udGV4dCBoYXMgdGhlIGFwcHJvcHJpYXRlIGxpZmV0aW1lIGZvcgorCQkgKiB0aGlz
LCBhbmQgd2UgZXhwbGljaXRseSBmcmVlIHRoZSBzdHJ1Y3Qgd2hlbiBwb3BwaW5nLgorCQkgKi8K
KwkJbm9kZSA9IFBMeV9mdW5jdGlvbl9zYXZlX2FyZ3MocHJvYy0+bWN4dCwgcHJvYyk7CiAKIAkJ
LyoKIAkJICogUHVzaCB0aGUgc2F2ZWQgYXJndW1lbnQgdmFsdWVzIGludG8gdGhlIHByb2NlZHVy
ZSdzIHN0YWNrLiAgT25jZSB3ZQotLSAKMi41MC4xIChBcHBsZSBHaXQtMTU1KQoK
--18194a22b89a91d7b090efef74f2024bf9c4ccb73bc848c42352b739eba4--