Possible segfault when sending notification within a ProcessUtility hook

From: Anthonin Bonnefoy <anthonin(dot)bonnefoy(at)datadoghq(dot)com>
To: PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Possible segfault when sending notification within a ProcessUtility hook
Date: 2023-12-05 17:33:38
Message-ID: CAO6_XqqDOSziXWd+WOsBB2TpV8HTeO7ZKPfkwpFYX2zCUmezTQ@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi,

I've encountered the following segfault:

#0: 0x0000000104e821a8 postgres`list_head(l=0x7f7f7f7f7f7f7f7f) at
pg_list.h:130:17
#1: 0x0000000104e81c9c postgres`PreCommit_Notify at async.c:932:16
#2: 0x0000000104dd02f8 postgres`CommitTransaction at xact.c:2236:2
#3: 0x0000000104dcfc24 postgres`CommitTransactionCommand at xact.c:3061:4
#4: 0x000000010528a880 postgres`finish_xact_command at postgres.c:2777:3
#5: 0x00000001052883ac postgres`exec_simple_query(query_string="notify
test;") at postgres.c:1298:4

This happens when a transaction block fails and a ProcessUtility hook
sends a notification during the rollback command.

When a transaction block fails, it will enter in a TBLOCK_ABORT state,
waiting for a rollback. Calling rollback will switch to a
TBLOCK_ABORT_END state and will only go through CleanupTransaction.
If a hook sends a notification during the rollback command, a
notification will be queued but its content will be wiped when the
TopTransactionContext is destroyed.
Trying to send a notification immediately after will segfault in
PreCommit_Notify as pendingNotifies->events will be invalid.

There's a test_notify_rollback test module attached to the patch that reproduces
the issue.

Moving notification clean up from AbortTransaction to CleanupTransaction fixes
the issue as it will clear pendingActions in the same function that destroys the
TopTransactionContext.

Regards,
Anthonin

Attachment Content-Type Size
v1-0001-Fix-segfault-when-notifying-in-a-ProcessUtility-h.patch application/octet-stream 10.9 KB

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Krishnakumar R 2023-12-05 17:36:52 Add checks in pg_rewind to abort if backup_label file is present
Previous Message Joe Conway 2023-12-05 16:54:42 Re: Emitting JSON to file using COPY TO