| From: | Emond Papegaaij <emond(dot)papegaaij(at)gmail(dot)com> |
|---|---|
| To: | pgpool-hackers(at)lists(dot)postgresql(dot)org |
| Subject: | [PATCH] Segfault in pool_do_auth() when failover races with a new connection |
| Date: | 2026-06-29 08:25:51 |
| Message-ID: | CAGXsc+Y7OKp93zSqt1WUCh7ABC7kyZqrxJPFA8AC1woB30S8EQ@mail.gmail.com |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgpool-hackers |
Hi,
Last night one of CI builds detected a segmentation fault in pgpool
(4.7.2). I've ran an analysis on the coredump with Claude and came to
the conclusion that this can happen when trying to open a connection
in the middle of a failover.
Symptom / backtrace (resolved from the core dump):
pool_do_auth (src/auth/pool_auth.c:349) <-- SIGSEGV, fault addr 0x0
connect_backend (src/protocol/child.c:1099) (PG_TRY block)
get_backend_connection (src/protocol/child.c:2109)
do_child (src/protocol/child.c:233)
The crashing statement is:
protoMajor = MAIN_CONNECTION(cp)->sp->major; /* pool_auth.c:349 */
i.e. cp->slots[MAIN_NODE_ID] is NULL. From the core, the pool had
slots[0] == NULL while slots[1]/slots[2] were valid, and MAIN_NODE_ID == 0.
pool_initialize_private_backend_status() snapshots
private_backend_status[] and my_main_node_id non‑atomically w.r.t. the
parent's failover, so a child can capture my_main_node_id == 0 while
node 0 is already CON_DOWN. new_connection() then never creates
slots[0], and pool_do_auth() dereferences the NULL main slot. (Same
class as the NULL‑MAIN_CONNECTION case noted in
pool_virtual_main_db_node_id().)
Attached is a patch that fixes the issue.
Best regards,
Emond
| Attachment | Content-Type | Size |
|---|---|---|
| connect_crash_fix.patch | text/x-patch | 1.9 KB |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tatsuo Ishii | 2026-06-30 07:46:00 | Re: [PATCH] Segfault in pool_do_auth() when failover races with a new connection |
| Previous Message | Nadav Shatz | 2026-06-28 04:33:32 | Re: Proposal: Recent mutated table tracking in memory |