[PATCH] Fix segmentation fault caused by reentrancy in RI_Fkey_cascade_del (ri_triggers.c)

From: Lucas Jeffrey <lucas(dot)jeffrey(at)anachronics(dot)com>
To: pgsql-hackers(at)lists(dot)postgresql(dot)org
Cc: Andrés Krüger <andres(dot)kruger(at)anachronics(dot)com>, Rodolfo Campero <rodolfo(dot)campero(at)anachronics(dot)com>, Marcos Castedo <marcos(dot)castedo(at)anachronics(dot)com>
Subject: [PATCH] Fix segmentation fault caused by reentrancy in RI_Fkey_cascade_del (ri_triggers.c)
Date: 2026-05-29 15:32:06
Message-ID: CAGHzy7S0XfXdK3amd5c4QhpS1o9dySVzPr+-d9ohaE4iV_vNog@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi hackers,

We found a bug where executing a DELETE on a self-referential table that
fires triggers can cause a segmentation fault. This is due to a
*use-after-free* of a Postgres plan generated by the referential integrity
module (ri_triggers.c, RI_FKey_cascade_del). The crash occurs if the
Postgres plancache is invalidated (ResetPlanCache) during the execution of
a reentrant RI trigger.

A reentrant RI_FKey_cascade_del can occur if a table is self-referential
(i.e., it has a foreign key referencing its own primary key) and has BEFORE
DELETE triggers that delete rows from that same table.

-

*The first patch* adds a test case that reproduces the segmentation
fault. The crash itself happens in _SPI_execute_plan, but the root cause
is that the plan being executed was prematurely freed by the RI module.
-

*The second patch* fixes ri_triggers.c by introducing reentrancy guards,
which maintain a reference count of plans in execution to prevent them from
being freed while active.

Feedback and reviews are welcome.

Best regards,

Lucas Jeffrey

Attachment Content-Type Size
v2-0002-Fix-crash-of-self-referencing-tables-with-delete-tri.patch text/x-patch 5.0 KB
v2-0001-Add-test-case-that-triggers-self-referencing-table-c.patch text/x-patch 5.2 KB

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Hannu Krosing 2026-05-29 15:34:46 Re: some utf8 breaking substring(txt,1,3) but not substring(txt from '^.{4}')
Previous Message Hannu Krosing 2026-05-29 15:16:13 Re: some utf8 breaking substring(txt,1,3) but not substring(txt from '^.{4}')