pgpool: Fix segfault in pool_do_auth().

From: Tatsuo Ishii <ishii(at)postgresql(dot)org>
To: pgpool-committers(at)lists(dot)postgresql(dot)org
Subject: pgpool: Fix segfault in pool_do_auth().
Date: 2026-07-03 06:29:54
Message-ID: E1wfXPM-0091aB-33@gothos.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgpool-committers

Fix segfault in pool_do_auth().

If a client connect to pgpool while performing a failover,
pool_do_auth() could crash in opening a connection to backend.

When pool_do_auth() tries to obtain the protocol major version
MAIN_CONNECTION(cp)->sp->major, it crashes because MAIN_CONNECTION(cp)
is NULL. MAIN_NODE_ID is actually a function call to
pool_virtual_main_db_node_id()). The function returns
my_main_node_id. my_main_node_id has been set in
pool_initialize_private_backend_status() in child process starting
up. It copies each backend status (CON_UP, CON_DOWN etc.) from
backend_status which is on the shared memory. Then it copies main node
id on the shared memory to my_main_node_id. In failover, pgpool main
process first updates each backend_status on the shared memory, then
updates main node id on the shared memory. Since there's no
interlocking, it is possible that when pool_do_auth() reads the
backend_status, it has been already updated while main node id is not.
As a result, for example, it could happen that connection to backend 0
is not established because the backend 0 status is already CON_DOWN
while my_main_node_id is still 0. In this case since no connection to
backend 0 has not been made, MAIN_CONNECTION(cp) is NULL, which causes
the segfault.

To fix the issue in pool_initialize_private_backend_status(),

(1) Set my_main_node_id according to each backend status, rather than
just copying REAL_MAIN_NODE_ID to make them consistent.

(2) Add volatile qualifiers to shared memory variables to read their
values on shared memory reliably.

Author: Emond Papegaaij <emond(dot)papegaaij(at)gmail(dot)com>
Reviewed-by: Tatsuo Ishii <ishii(at)postgresql(dot)org>
Discussion: https://www.postgresql.org/message-id/CAGXsc%2BY7OKp93zSqt1WUCh7ABC7kyZqrxJPFA8AC1woB30S8EQ%40mail.gmail.com
Backpatch-through: v4.3

Branch
------
V4_7_STABLE

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=1f02bd3126efc528a744bc3a881ab5e32fd063a3

Modified Files
--------------
src/protocol/child.c | 18 ++++++++++++++++--
src/protocol/pool_connection_pool.c | 22 +++++++++++++++++++++-
2 files changed, 37 insertions(+), 3 deletions(-)

Browse pgpool-committers by date

  From Date Subject
Next Message Tatsuo Ishii 2026-07-03 06:29:59 pgpool: Fix segfault in pool_do_auth().
Previous Message Tatsuo Ishii 2026-07-03 06:29:48 pgpool: Fix segfault in pool_do_auth().