| From: | Lucas Jeffrey <lucas(dot)jeffrey(at)anachronics(dot)com> |
|---|---|
| To: | pgsql-hackers(at)lists(dot)postgresql(dot)org |
| Cc: | Andrés Krüger <andres(dot)kruger(at)anachronics(dot)com>, Rodolfo Campero <rodolfo(dot)campero(at)anachronics(dot)com>, Marcos Castedo <marcos(dot)castedo(at)anachronics(dot)com> |
| Subject: | [PATCH] Fix segmentation fault caused by reentrancy in RI_Fkey_cascade_del (ri_triggers.c) |
| Date: | 2026-05-29 15:32:06 |
| Message-ID: | CAGHzy7S0XfXdK3amd5c4QhpS1o9dySVzPr+-d9ohaE4iV_vNog@mail.gmail.com |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Hi hackers,
We found a bug where executing a DELETE on a self-referential table that
fires triggers can cause a segmentation fault. This is due to a
*use-after-free* of a Postgres plan generated by the referential integrity
module (ri_triggers.c, RI_FKey_cascade_del). The crash occurs if the
Postgres plancache is invalidated (ResetPlanCache) during the execution of
a reentrant RI trigger.
A reentrant RI_FKey_cascade_del can occur if a table is self-referential
(i.e., it has a foreign key referencing its own primary key) and has BEFORE
DELETE triggers that delete rows from that same table.
-
*The first patch* adds a test case that reproduces the segmentation
fault. The crash itself happens in _SPI_execute_plan, but the root cause
is that the plan being executed was prematurely freed by the RI module.
-
*The second patch* fixes ri_triggers.c by introducing reentrancy guards,
which maintain a reference count of plans in execution to prevent them from
being freed while active.
Feedback and reviews are welcome.
Best regards,
Lucas Jeffrey
| Attachment | Content-Type | Size |
|---|---|---|
| v2-0002-Fix-crash-of-self-referencing-tables-with-delete-tri.patch | text/x-patch | 5.0 KB |
| v2-0001-Add-test-case-that-triggers-self-referencing-table-c.patch | text/x-patch | 5.2 KB |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Hannu Krosing | 2026-05-29 15:34:46 | Re: some utf8 breaking substring(txt,1,3) but not substring(txt from '^.{4}') |
| Previous Message | Hannu Krosing | 2026-05-29 15:16:13 | Re: some utf8 breaking substring(txt,1,3) but not substring(txt from '^.{4}') |