MIME-Version: 1.0
From: Tender Wang <tndrwang@gmail.com>
Date: Wed, 8 Apr 2026 15:56:46 +0800
Message-ID: 
 <CAHewXNkJKdwb3D5OnksrdOqzqUnXUEMpDam1TPW0vfUkW=7jUw@mail.gmail.com>
Subject: Fix "detected double pfree in PgStat Snapshot 0x557d9926b400" error
To: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Content-Type: multipart/mixed; boundary="00000000000087508d064eee3e76"
Archived-At: 
 <https://www.postgresql.org/message-id/CAHewXNkJKdwb3D5OnksrdOqzqUnXUEMpDam1TPW0vfUkW%3D7jUw%40mail.gmail.com>
Precedence: bulk

--00000000000087508d064eee3e76
Content-Type: text/plain; charset="UTF-8"

Hi,

In my recent SQLSmith test on HEAD, I found $SUBJECT.
The original query is too large and complex, and after reducing,  I
found that the following short query can reproduce:

psql (19devel)
Type "help" for help.

postgres=# select NULLIF((SELECT score FROM pg_stat_autovacuum_scores LIMIT 1),
              (SELECT score FROM pg_stat_autovacuum_scores LIMIT 1));
ERROR:  detected double pfree in PgStat Snapshot 0x557d9926b400

Thanks to commit 095555d, this error can be surfaced. Before 095555d,
the above query succeeded.
I did research on this issue, and I found that after 5891c7a, the
PgStat_EntryRef can be cached if
stats_fetch_consistency > none.
If the value of stats_fetch_consistency is set to none, the query will
not report an error.

postgres=# set stats_fetch_consistency = none;
SET
postgres=# select NULLIF((SELECT score FROM pg_stat_autovacuum_scores LIMIT 1),
              (SELECT score FROM pg_stat_autovacuum_scores LIMIT 1));
 nullif
--------

(1 row)

If stats_fetch_consistency is cache or snapshot,  when calling
pgstat_fetch_entry(),
the PgStat_EntryRef will be inserted into hash-table if it doesn't exist.
In relation_needs_vacanalyze(), at the end, the tabentry will be free if it
is not null.

In this case, we may get the same PgStat_EntryRef entry again from the
hash table, but it was pfree when it first appeared.
So, detected double pfree will be reported when pfree is called at the
end of relation_needs_vacanalyze().

If the pgstat_fetch_consistency > PGSTAT_FETCH_CONSISTENCY_NONE, we
should not free the entry.
I wrote a patch to fix this issue.  Please see the attached patch.
-- 
Thanks,
Tender Wang

--00000000000087508d064eee3e76
Content-Type: application/octet-stream;
	name="0001-Fix-double-pfree-for-PgStat_StatTabEntry.patch"
Content-Disposition: attachment;
	filename="0001-Fix-double-pfree-for-PgStat_StatTabEntry.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mnpr7d360>
X-Attachment-Id: f_mnpr7d360

RnJvbSA3Zjk5YzY5Mzc0NDU0ODE0NzNjMDg0YmJiYjlhZGQ4YzkxOGQ4ZTAwIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBUZW5kZXIgV2FuZyA8dG5kcndhbmdAZ21haWwuY29tPgpEYXRl
OiBXZWQsIDggQXByIDIwMjYgMTU6MTg6MDAgKzA4MDAKU3ViamVjdDogW1BBVENIXSBGaXggZG91
YmxlIHBmcmVlIGZvciBQZ1N0YXRfU3RhdFRhYkVudHJ5CgotLS0KIHNyYy9iYWNrZW5kL3Bvc3Rt
YXN0ZXIvYXV0b3ZhY3V1bS5jIHwgNCArKystCiAxIGZpbGUgY2hhbmdlZCwgMyBpbnNlcnRpb25z
KCspLCAxIGRlbGV0aW9uKC0pCgpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvcG9zdG1hc3Rlci9h
dXRvdmFjdXVtLmMgYi9zcmMvYmFja2VuZC9wb3N0bWFzdGVyL2F1dG92YWN1dW0uYwppbmRleCBi
ZDYyNmExNjM2My4uOWRmODJhNGJiNmEgMTAwNjQ0Ci0tLSBhL3NyYy9iYWNrZW5kL3Bvc3RtYXN0
ZXIvYXV0b3ZhY3V1bS5jCisrKyBiL3NyYy9iYWNrZW5kL3Bvc3RtYXN0ZXIvYXV0b3ZhY3V1bS5j
CkBAIC0zMzI3LDcgKzMzMjcsOSBAQCByZWxhdGlvbl9uZWVkc192YWNhbmFseXplKE9pZCByZWxp
ZCwKIAkJCSBhbmx0dXBsZXMsIGFubHRocmVzaCwgc2NvcmVzLT5hbmwsCiAJCQkgc2NvcmVzLT54
aWQsIHNjb3Jlcy0+bXhpZCk7CiAKLQlwZnJlZSh0YWJlbnRyeSk7CisJLyogV2UgY2FuIGZyZWUg
dGhlIGVudHJ5IGlmIHdlJ3JlIG5vdCBjYWNoaW5nIGl0ICovCisJaWYgKHBnc3RhdF9mZXRjaF9j
b25zaXN0ZW5jeSA9PSBQR1NUQVRfRkVUQ0hfQ09OU0lTVEVOQ1lfTk9ORSkKKwkJcGZyZWUodGFi
ZW50cnkpOwogfQogCiAvKgotLSAKMi4zNC4xCgo=
--00000000000087508d064eee3e76--