[PATCH] Segfault in pool_do_auth() when failover races with a new connection

From: Emond Papegaaij <emond(dot)papegaaij(at)gmail(dot)com>
To: pgpool-hackers(at)lists(dot)postgresql(dot)org
Subject: [PATCH] Segfault in pool_do_auth() when failover races with a new connection
Date: 2026-06-29 08:25:51
Message-ID: CAGXsc+Y7OKp93zSqt1WUCh7ABC7kyZqrxJPFA8AC1woB30S8EQ@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgpool-hackers

Hi,

Last night one of CI builds detected a segmentation fault in pgpool
(4.7.2). I've ran an analysis on the coredump with Claude and came to
the conclusion that this can happen when trying to open a connection
in the middle of a failover.

Symptom / backtrace (resolved from the core dump):
pool_do_auth (src/auth/pool_auth.c:349) <-- SIGSEGV, fault addr 0x0
connect_backend (src/protocol/child.c:1099) (PG_TRY block)
get_backend_connection (src/protocol/child.c:2109)
do_child (src/protocol/child.c:233)

The crashing statement is:
protoMajor = MAIN_CONNECTION(cp)->sp->major; /* pool_auth.c:349 */
i.e. cp->slots[MAIN_NODE_ID] is NULL. From the core, the pool had
slots[0] == NULL while slots[1]/slots[2] were valid, and MAIN_NODE_ID == 0.

pool_initialize_private_backend_status() snapshots
private_backend_status[] and my_main_node_id non‑atomically w.r.t. the
parent's failover, so a child can capture my_main_node_id == 0 while
node 0 is already CON_DOWN. new_connection() then never creates
slots[0], and pool_do_auth() dereferences the NULL main slot. (Same
class as the NULL‑MAIN_CONNECTION case noted in
pool_virtual_main_db_node_id().)

Attached is a patch that fixes the issue.

Best regards,
Emond

Attachment Content-Type Size
connect_crash_fix.patch text/x-patch 1.9 KB

Responses

Browse pgpool-hackers by date

  From Date Subject
Next Message Tatsuo Ishii 2026-06-30 07:46:00 Re: [PATCH] Segfault in pool_do_auth() when failover races with a new connection
Previous Message Nadav Shatz 2026-06-28 04:33:32 Re: Proposal: Recent mutated table tracking in memory