From: Willi Mann <w.mann@celonis.de>
Content-Type: multipart/mixed; boundary="------------F4LDkW3H8vFb0LHF1PTwoGrh"
Message-ID: <e77abc4c-4d03-4058-a9d7-ef0035657e04@celonis.com>
Date: Mon, 20 Nov 2023 14:37:39 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: [PATCH] fix race condition in libpq (related to ssl connections)
Content-Language: en-US
To: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Archived-At: <https://www.postgresql.org/message-id/e77abc4c-4d03-4058-a9d7-ef0035657e04%40celonis.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------F4LDkW3H8vFb0LHF1PTwoGrh
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Hi,

I've found a race condition in libpq. It is about the initialization of
the my_bio_methods static variable in fe-secure-openssl.c, which is not
protected by any lock. The race condition may make the initialization of
the connection fail, and as an additional weird consequence, it might
cause openssl call close(0), so stdin of the client application gets
closed.

I've prepared a patch to protect the initialization of my_bio_methods
from the race. This is my first patch submission to the postgresql
project, so I hope I didn't miss anything. Any comments and suggestions
are of course very welcome.

I also prepared a testcase. In the testcase tarball, there is a patch
that adds sleeps at the right positions to make the close(0) problem
occur practically always. It also includes comments to explain how the
race can end up calling close(0).

Concerning the patch, it is only tested on Linux. I'm unsure about
whether the simple initialization of the mutex would work nowadays also
on Windows or whether the more complicated initialization also to be
found for the ssl_config_mutex in the same source file needs to be used.
Let me know whether I should adapt that.

We discovered the problem with release 11.5, but the patch and the 
testcase are against the master branch.

Regards,
Willi

-- 
___________________________________________________

Dr. Willi Mann | Principal Software Engineer, Tech Lead PQL

Celonis SE | Theresienstrasse 6 | 80333 Munich, Germany
F: +4989416159679
w.mann@celonis.com | www.celonis.com | LinkedIn | Twitter | Xing

AG Munich HRB 225439 | Management: Martin Klenk, Bastian Nominacher, 
Alexander Rinke
--------------F4LDkW3H8vFb0LHF1PTwoGrh
Content-Type: text/x-patch; charset=UTF-8;
 name="0001-libpq-Fix-race-condition-in-initialization-of-my_bio.patch"
Content-Disposition: attachment;
 filename*0="0001-libpq-Fix-race-condition-in-initialization-of-my_bio.pa";
 filename*1="tch"
Content-Transfer-Encoding: base64

RnJvbSA3MjFiZThkNmVhMjZkNzhmYzA4NmEyZTg1NDEzODU4NTg1Y2E5MzAwIE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBXaWxsaSBNYW5uIDx3Lm1hbm5AY2Vsb25pcy5jb20+
CkRhdGU6IFRodSwgMTYgTm92IDIwMjMgMTE6NTA6MjcgKzAxMDAKU3ViamVjdDogW1BBVENI
XSBsaWJwcTogRml4IHJhY2UgY29uZGl0aW9uIGluIGluaXRpYWxpemF0aW9uIG9mIG15X2Jp
b19tZXRob2RzCiBzdGF0aWMgdmFyaWFibGUKCi0tLQogc3JjL2ludGVyZmFjZXMvbGlicHEv
ZmUtc2VjdXJlLW9wZW5zc2wuYyB8IDI2ICsrKysrKysrKysrKysrKysrKy0tLS0tLQogMSBm
aWxlIGNoYW5nZWQsIDIwIGluc2VydGlvbnMoKyksIDYgZGVsZXRpb25zKC0pCgpkaWZmIC0t
Z2l0IGEvc3JjL2ludGVyZmFjZXMvbGlicHEvZmUtc2VjdXJlLW9wZW5zc2wuYyBiL3NyYy9p
bnRlcmZhY2VzL2xpYnBxL2ZlLXNlY3VyZS1vcGVuc3NsLmMKaW5kZXggZjExOTJkMjhmMi4u
ZThmYTNlYjQwMyAxMDA2NDQKLS0tIGEvc3JjL2ludGVyZmFjZXMvbGlicHEvZmUtc2VjdXJl
LW9wZW5zc2wuYworKysgYi9zcmMvaW50ZXJmYWNlcy9saWJwcS9mZS1zZWN1cmUtb3BlbnNz
bC5jCkBAIC04MSw2ICs4MSw3IEBAIHN0YXRpYyBpbnQJUFFzc2xfcGFzc3dkX2NiKGNoYXIg
KmJ1ZiwgaW50IHNpemUsIGludCByd2ZsYWcsIHZvaWQgKnVzZXJkYXRhKTsKIHN0YXRpYyBp
bnQJbXlfc29ja19yZWFkKEJJTyAqaCwgY2hhciAqYnVmLCBpbnQgc2l6ZSk7CiBzdGF0aWMg
aW50CW15X3NvY2tfd3JpdGUoQklPICpoLCBjb25zdCBjaGFyICpidWYsIGludCBzaXplKTsK
IHN0YXRpYyBCSU9fTUVUSE9EICpteV9CSU9fc19zb2NrZXQodm9pZCk7CitzdGF0aWMgdm9p
ZCBteV9CSU9fbWV0aG9kc19pbml0KHZvaWQpOwogc3RhdGljIGludAlteV9TU0xfc2V0X2Zk
KFBHY29ubiAqY29ubiwgaW50IGZkKTsKIAogCkBAIC0xODgyLDggKzE4ODMsOCBAQCBteV9z
b2NrX3dyaXRlKEJJTyAqaCwgY29uc3QgY2hhciAqYnVmLCBpbnQgc2l6ZSkKIAlyZXR1cm4g
cmVzOwogfQogCi1zdGF0aWMgQklPX01FVEhPRCAqCi1teV9CSU9fc19zb2NrZXQodm9pZCkK
K3N0YXRpYyB2b2lkCitteV9CSU9fbWV0aG9kc19pbml0KHZvaWQpCiB7CiAJaWYgKCFteV9i
aW9fbWV0aG9kcykKIAl7CkBAIC0xODkzLDExICsxODk0LDExIEBAIG15X0JJT19zX3NvY2tl
dCh2b2lkKQogCiAJCW15X2Jpb19pbmRleCA9IEJJT19nZXRfbmV3X2luZGV4KCk7CiAJCWlm
IChteV9iaW9faW5kZXggPT0gLTEpCi0JCQlyZXR1cm4gTlVMTDsKKwkJCXJldHVybjsKIAkJ
bXlfYmlvX2luZGV4IHw9IChCSU9fVFlQRV9ERVNDUklQVE9SIHwgQklPX1RZUEVfU09VUkNF
X1NJTkspOwogCQlteV9iaW9fbWV0aG9kcyA9IEJJT19tZXRoX25ldyhteV9iaW9faW5kZXgs
ICJsaWJwcSBzb2NrZXQiKTsKIAkJaWYgKCFteV9iaW9fbWV0aG9kcykKLQkJCXJldHVybiBO
VUxMOworCQkJcmV0dXJuOwogCiAJCS8qCiAJCSAqIEFzIG9mIHRoaXMgd3JpdGluZywgdGhl
c2UgZnVuY3Rpb25zIG5ldmVyIGZhaWwuIEJ1dCBjaGVjayBhbnl3YXksCkBAIC0xOTE0LDE3
ICsxOTE1LDMwIEBAIG15X0JJT19zX3NvY2tldCh2b2lkKQogCQl7CiAJCQlCSU9fbWV0aF9m
cmVlKG15X2Jpb19tZXRob2RzKTsKIAkJCW15X2Jpb19tZXRob2RzID0gTlVMTDsKLQkJCXJl
dHVybiBOVUxMOworCQkJcmV0dXJuOwogCQl9CiAjZWxzZQogCQlteV9iaW9fbWV0aG9kcyA9
IG1hbGxvYyhzaXplb2YoQklPX01FVEhPRCkpOwogCQlpZiAoIW15X2Jpb19tZXRob2RzKQot
CQkJcmV0dXJuIE5VTEw7CisJCQlyZXR1cm47CiAJCW1lbWNweShteV9iaW9fbWV0aG9kcywg
YmlvbSwgc2l6ZW9mKEJJT19NRVRIT0QpKTsKIAkJbXlfYmlvX21ldGhvZHMtPmJyZWFkID0g
bXlfc29ja19yZWFkOwogCQlteV9iaW9fbWV0aG9kcy0+YndyaXRlID0gbXlfc29ja193cml0
ZTsKICNlbmRpZgogCX0KK30KKworc3RhdGljIHB0aHJlYWRfbXV0ZXhfdCBteV9CSU9fbWV0
aG9kc19pbml0X211dGV4ID0gUFRIUkVBRF9NVVRFWF9JTklUSUFMSVpFUjsKKworc3RhdGlj
IEJJT19NRVRIT0QgKgorbXlfQklPX3Nfc29ja2V0KCkKK3sKKwlpZiAocHRocmVhZF9tdXRl
eF9sb2NrKCZteV9CSU9fbWV0aG9kc19pbml0X211dGV4KSAhPSAwKQorCXsKKwkJcmV0dXJu
IE5VTEw7CisJfQorCW15X0JJT19tZXRob2RzX2luaXQoKTsKKwlwdGhyZWFkX211dGV4X3Vu
bG9jaygmbXlfQklPX21ldGhvZHNfaW5pdF9tdXRleCk7CiAJcmV0dXJuIG15X2Jpb19tZXRo
b2RzOwogfQogCi0tIAoyLjM5LjIKCg==
--------------F4LDkW3H8vFb0LHF1PTwoGrh
Content-Type: application/gzip; name="testcase.tar.gz"
Content-Disposition: attachment; filename="testcase.tar.gz"
Content-Transfer-Encoding: base64

H4sIAAAAAAAAA+0Za1PbSJKv6Ff0ksutAFtYfmKDqRBwLlQRIEB2P+S2XGNphLWRNYpmhMNl
+e/XPSPZwgFCNo+9rWOSQtJMT3dPv6etuFQek3xj6fuNGo5Oq0VPt9OqlZ/FWHKbrXq73eq0
mp2lmut2mrUlaH1HnmYjk4qlAEvTCYvje+A+t/43HarQ/+lgd//V4LvQIAW3m8079d/pNLX+
W51au9VAOLfedttLUPsu3CyM/3P970LKPA6eiP1QhSIGNWYKvEhILkEqP4yhCoWRWP0vGZb1
a4o44wtIeRSyUcQ1IiBMEgKRLpCWEEoYs9R34HzMU44QvIL8mG0WbUPgCe6dhmoMDBKmvLFh
mPk+shtxnkjAT9qUhhdjBYmQOXIlYMLecXrispWkAjmagPC8LIUEWVGhx6LoClg0ZVeygk8p
IIy9KPPpEEh6wmOF+CHgUwiSNIxVUKC1QgWcyZCnNJPFPk/RsGJfs5LTcizrPD+NPozIVJIh
QssCGlraPTg5PjwcnJ7S4+iX3UPLYoFCrGyE4NACyUlgKKsgV8+USaMvvwICqaXTUKLckJ8c
v0FvgKUKowhEwmPLskj/M//fe4WnOAylko76oL6pjX3G/91mo6H9v9ls1FoNiv/NZrvx6P8/
YljoOUP+gXuZIg+1JwythP44XpKsWtYT9EV0SzJ+smamFJ8kSntTEObmHYWjlKVXFTgdvH5z
cDrYB5ZeZOQs5NEiIf9jkfWENgwT5r1jF9w+EVJdpPzs9eFsmya36/u503Hww5R7SqQh1wSv
BHoqauuCKwdOTg9+2T0fEIVM8iCLTFSYZJEKqwaI/O53RCAxhEmO6ISnuWI60IkgxzXMyQ3L
5Cg8TTAAIS+BsJ7cDWkkVnDzj4/zcw0PjvYO3+wPhvsHp2fXq9ZDcWyMMchtaHvbkCJQU5by
jcSgle+j8qtMvQ2MQjwNMJLKDVRE8v7L92t+ZsI32sxFHoXxu7LcgV0gqxgjYJdeKmU1hJNE
pBjzlBHebYqYCZLwDmeU7pHh4cHz093Tg0FJgPft/UrZmb+OFE5r1fqrXfOHjFn8L3z+O9D4
TPyvN9r1hfq/0eg8xv8fMp4UsXabpSm72rHmE0GmspSXZ0L0npSzSXlOe0w14M64PKvGCOeX
Z7IYawv/JtSlDoDlmUREEcFYWORIxT8kKQZgBXvHR0eDvfOD46Ozj/XrLcu6FCGliVANETBG
NBjR7VX4iKXOxhpQKYNl2nwpL/rAZ5jlqPRa20DIk38RBKzpv31ThMHJ63ybP7JXxnjgvlvv
ODX851KiSfvaELD2lHIqUr/vj3RRK2U0ET7vp/x9hoEdVnJ05bHij2I24f0gjDDscMyFWcHj
UIUTjvVa363VVla3cDPWd/bJazROlUmboFah3y8JYvh8d98cGIpa1EYB8zStwMre/OR5xoaA
hRH3e/BUrmDUfo1wIn3FpaRcrNFrqtfWdS5c0kTNLijQV4CTW+bLwfc+1IovfqkL476uXTEU
wx/67eDIAJAGU8wCfY3G/mdSAbcCLXT91a2iNu310LSozFZXCc+3BTbuKjjIZxInzan9UVTK
ZQjaDet9WMnXVrZmS9f3oaFKu4znE1wE8FBkL9+c3IUrX74NkRaCh3qB7W1YyS8DK/ShN9Pk
v+OchWvgEVrxx/s2l2r9+T5SL6mDor1NejaM6u3GG7f1u/H9bYLY2UHlSczm0i65odYc5Xmb
0IXaGvCxXXbVLVhfDwtJ5Djehr8hrKbB5FXs2W9/g4+fevIWXOf2CIUl/nmCDlYN9sy8/+qI
+781ZvmfknLV3KCrSlTNJbiKhduleMerGDyrdFuvzm7rjr59P4jGZ/J/u9N0i/5PBx9LWBF0
ao/5/4eMF6mYQMtrtVENrVF7s7vJR7zZZbV6e+TzbmOzxlqdTqNZa7ZaPrzChHLGE3A7UKv1
9H+oozYtQtODXzHghJh9MT9uTx0S2DOPRwIzv4MXyB1rnynewwtlhgmgDUfiEjfXG1Dr9tzN
XqML6zVMf9ZZNqLLQg/enuye7738rejrYA43Vgm5VZo2z40ekmVVq1ULbq3tA16VeM9NeZVi
IiZsx8OA7SLZT4cFLt5vI8Q8ZvEFtVYQLowx/+tmkr2O1yU/DAKoVi9CvBXdfpu4jeLowaAY
qH3+AQLX7db9+mZQd5xajY14Y9NjHrjap+i4X0DdwqN9CQfPnkHV3dxsVdqwrp+uCzg3uRpK
4b0bTtNQcfv5wTGsjSugSzYSWAproyyo6Lwvw//g1RKojgk9QNDhq8H5y+N9WLMIDU1IjQxD
tM5HFobv9WW9ldSOJcGQon4fbIziKvSxJKkCvib0ugprJAi0wqfmiSXJ+nKmd9rl/as0/0mZ
ZKpUeOoTrcTcW/EDyzwPU2YFCooVWMSF2LDOpG5eEKaSGo4a05QyLrUa8GijUAwnXI2FT4Xb
0ZvDQ9PMNA08kGORRf4twD8ZYHAcR5epy1QJ/nQDRqKUljHLLS+XBYrrE5JTeW4VbkgYWTcq
7Xa1Sru1ZqWba/Q2VSzfRXx5GUuzLI01q5hZUR63CiTm3NeeqwUI1Nbt3Tyv7vomAhWjqz9T
p7MoEh4GCx8mfCKotTTK1OI+XBrxVJKdYTmOjullEdreTajqjoeMKE5UtFhRpMjr3aZQuQtB
H54mc0MgogtCWzAZWiIcQ+pZGBz2giC1VS4ba3WpQCEh0l80612pO1TUfJuaNro2H6z6giz2
TEs7xrIz1ZW9A88z8j3uvQMWX2GUrOR4ohAD5TF69NnZ4c+IcxoD/8AmScQl+MIx9tCtGxfv
NhqVzXvtYVE4Ix0DUDg3YgIe5QnHkBzgluu5r+Smn8sa5SK1RRiTcWCuqVgouMIbA9WFIYsw
hvgOHAcYYrI0b25Tw2m+CiL2eNm9Fmk4RvF/Wu94GtLHt1A5FL5zcwkXsNrN9dGsVzqkj1a9
4tZyhaAChxIRB75dvrmaOBsY9SAMnssm0Bd6w9ngfPhivwJ4FxqeDp+/eUEdNWNqFwK9DaG3
/k5KmgtsQUHmVxLSQMynD9DLHJHRCX4jpnx/efX+zHEPR7hQ3aHj07f/VRwaANM9DhWtGKYp
OmvGTc6YpYUHm4GxtpZrrK3drLiNh1ub9gQEoa4KsaFLgJgYw8ViP87r/kJ1B0sKLRT9R4sV
Le5ITCu3mMSYzbMGBl1xU8oqjYzRMCoFE5TqJYsyTBuIQBsmYNF5gdM64tulX8WmVCti3o1/
pt8hMVlr0hS3NNI8BdtUCJjDU4lBNmmCdP3bWYP+luNM+RSS8zn9mycYZX21hcynCjKF4dzh
67GYasEvSJWEsSh+rROSXYCXczHVv49qcQoorCLA4ibzPF0AzGqZ+aIxmMA3XB4d7x0enw0K
3rQmZUjhQotMfxayYiiiEeqUNEQEXWNARE+h+KgvaKQbZxMyByZlNsFpBB3x/PdYfhmKTNKe
IsmSG+X2Y35N/ZpgdLvrfyO9FikEcbv4ilz15jkFH1t4KQCr7jS6Tt16bHc8jsfxOO4a/wUs
6XlWACgAAA==

--------------F4LDkW3H8vFb0LHF1PTwoGrh--