Date: Mon, 13 Dec 2021 20:10:57 +0900
From: Michael Paquier <michael@paquier.xyz>
To: "James Pang (chaolpan)" <chaolpan@cisco.com>
Cc: Dmitry Dolgov <9erthalion6@gmail.com>,
	"pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>
Subject: Re: BUG #17326: Postgres crashed when pg_reload_conf()  with ssl
 certificate parameters
Message-ID: <YbcqQXfYRhzCgud2@paquier.xyz>
References: <17326-d40bbb1386b6c9c3@postgresql.org>
 <PH0PR11MB51915EF4E577B83F664F9AD8D66F9@PH0PR11MB5191.namprd11.prod.outlook.com>
 <20211208134601.gauysdttc65aoeze@localhost>
 <PH0PR11MB5191DFBF6685E3EF9632EAF0D6709@PH0PR11MB5191.namprd11.prod.outlook.com>
 <PH0PR11MB5191F4B6C7B80F2DC2BC5F89D6719@PH0PR11MB5191.namprd11.prod.outlook.com>
 <20211210142231.fvldmwwy4fr477h2@localhost>
 <PH0PR11MB51910828B552926204514891D6749@PH0PR11MB5191.namprd11.prod.outlook.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="enXEIoJa3cqkEqqs"
Content-Disposition: inline
In-Reply-To: 
 <PH0PR11MB51910828B552926204514891D6749@PH0PR11MB5191.namprd11.prod.outlook.com>
Archived-At: 
 <https://www.postgresql.org/message-id/YbcqQXfYRhzCgud2%40paquier.xyz>
Precedence: bulk


--enXEIoJa3cqkEqqs
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Mon, Dec 13, 2021 at 07:06:16AM +0000, James Pang (chaolpan) wrote:
> Edit postgresql.conf to change ssl_certificate parameter ,

Do you mean ssl_cert_file here?  Also, something that's not completely
clear to me is if this is a problem with a vanilla PostgreSQL
instance or if this is related to the pgaudit extension set_user, as
it has been mentioned as one potential origin of the problem upthread,
but you are not telling if this is the case here.  So what do you have
for shared_preload_libraries in this crash?

> #9  0x00007ff49a78059c in ssl_cert_clear_certs () from /lib64/libssl.so.1.1
> #10 0x00007ff49a780645 in ssl_cert_free () from /lib64/libssl.so.1.1
> #11 0x00007ff49a78a25c in SSL_CTX_free () from /lib64/libssl.so.1.1
> #12 0x000000000068b6b8 in be_tls_init ()
> #13 0x00000000007271e1 in SIGHUP_handler ()

Why is secure_initialize() not showing up in this stack?  That would
be the caller of be_tls_init() in the SIGHUP handler.  The version of
OpenSSL you are linking your binaries to would be useful here.  That
would be a 1.1.0 or a 1.1.1, no?  Any specific minor version letter?
--
Michael

--enXEIoJa3cqkEqqs
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmG3KkEACgkQnvQgOdby
QH12fQ//cXwfZ7xTCydYzebFNqI4m4SgIAk+NPfz1iQ58EtSyW3pbWVOXZH4+uEJ
7AwBQoXdY3bqD58Tg9dMuTlEq6SzFeC61Me/AaT2hPlaokKVMkfIZ1F3A0V0G8Mb
b27jvsZYpFzSvoWwGcSO3DyXz7j9SFnaQ9yAk5JGgBgoPXQZvq3jg2OXTn9CvTNP
8hMfYxeAvqYiQN4Vem5exXBtiOw1AboRjwgT+l3fC3Kw77hSl/6A724ZtdnY2MSt
n94bqGNxImvVZdpK5R2vaOR9B1mG8zygxaNwabfS9ROlUJ+D9B3vJlkcnpUPLOhS
LcViHet2ER1XQAVMx8Dm8dMuHhDZrKB64ULOB/58TGClXjcWcKGrwcsyClyxgSsj
Dq0B2YekKc8C33tHh/78H8SOn0hLc8DVPxU/uaLOiAkxaoAWd5+MtQ7pD3dTgjlo
66fgk6uaxMY4tz90eJNYdF4wX5dVIHHFwQs8+j2AjFDn2mHFYvoN1qnLqLcnKDG+
hJ4+iHlhiqicnU2aoe+BOHgUrLu8wLEMpSyXpkhaTwjcZMZ9A1FIfAvitFnGRy60
U1kRYGFF2eIo9z0xCqHF++eD05zZm3ShPUcAq2UH4B7w9izi6iWwsbNHaA74OIiA
luDJHURPLuVvCDbCZyluJDsDcYZBecW2UkkhlKWZCT8E44Lv8vU=
=X4Ub
-----END PGP SIGNATURE-----

--enXEIoJa3cqkEqqs--