pgsql: Fix crash when reading stats file at startup with fixed-sized ki

From: Michael Paquier <michael(at)paquier(dot)xyz>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Fix crash when reading stats file at startup with fixed-sized ki
Date: 2026-10-14 23:26:50
Message-ID: E1xH8N0-00000001emh-2gTp@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Fix crash when reading stats file at startup with fixed-sized kinds

pgstat_read_statsfile() has never checked that the kind of a hash entry
is variable-sized. Since 44539786b829, that has begun tracking which
hash table a kind ID should use, it is possible to finish with a NULL
pointer dereference for a PGSTAT_FILE_ENTRY_HASH. Fixed-sized stats
kinds have no hash table and no DSA area, hence their dsa references in
pgStatLocal.kind_hash[] are NULL.

This case can occur when reading statistics files if the same kind ID is
reused across server restarts, with shared_preload_libraries loading
different stats kind information each time: stats written with a set of
PGSTAT_FILE_ENTRY_HASH, then read back with the same kind ID pointing to
a custom fixed-sized kind info.

Oversight in 44539786b829.

Reported-by: Zsolt Parragi <zsolt(dot)parragi(at)percona(dot)com>
Author: Sami Imseih <samimseih(dot)pg(at)gmail(dot)com>
Author: Zsolt Parragi <zsolt(dot)parragi(at)percona(dot)com>
Discussion: https://postgr.es/m/CAN4CZFMxuOOuYV14+i3YcPG-16q02eBtSVa82J111=ZnDwSicA@mail.gmail.com

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/0d110901f0ef362fcf24b07357c20745f971c602

Modified Files
--------------
src/backend/utils/activity/pgstat.c | 8 ++++++++
1 file changed, 8 insertions(+)

Browse pgsql-committers by date

  From Date Subject
Next Message Michael Paquier 2026-10-14 23:47:24 pgsql: Disallow serialized callbacks for fixed-sized custom stats kinds
Previous Message Tom Lane 2026-10-14 22:45:48 pgsql: btree_gin: Fix timestamp-vs-timestamptz comparisons near DST bou