pgsql: Fix potential use-after-frees in WAL sender

From: Michael Paquier <michael(at)paquier(dot)xyz>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Fix potential use-after-frees in WAL sender
Date: 2026-10-14 03:05:57
Message-ID: E1xGpJV-00000001X5w-0bsA@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Fix potential use-after-frees in WAL sender

A WAL sender tracks its WAL reader and logical decoding context as two
static variables, which were left set after being freed for a
START_REPLICATION command. The WAL reader is used for in a physical
replication command, both the WAL reader and the logical decoding
context are used for a logical replication command.

Both variables are now cleared once their contents are released at the
end of each replication command, to keep the release of the resources
and the maintenance of the pointers close to each other. Some more
cleanup is done by WalSndErrorCleanup(), as well, once the WAL reader is
clear.

The assertion added by 879ad9f90e83 is moved before the execution of a
replication command, checking now that both the WAL reader and the
logical decoding context are never set before the execution of a new
command.

Author: Ayush Tiwari <ayushtiwari(dot)slg01(at)gmail(dot)com>
Reviewed-by: Michael Paquier <michael(at)paquier(dot)xyz>
Discussion: https://postgr.es/m/CAJTYsWW+hdmmVt_A4hvGv2_5RWK8-kaOf5ncT65=5i_hyD=BHg@mail.gmail.com
Backpatch-through: 14

Branch
------
REL_14_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/0e2260ab10f68a681624157365dba58c76578958

Modified Files
--------------
src/backend/replication/walsender.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Richard Guo 2026-10-14 03:08:08 pgsql: Give antijoins made from sublinks a relid
Previous Message Michael Paquier 2026-10-14 03:05:56 pgsql: Fix potential use-after-frees in WAL sender