Possible segfault when sending notification within a ProcessUtility hook - Mailing list pgsql-hackers

From Anthonin Bonnefoy
Subject Possible segfault when sending notification within a ProcessUtility hook
Date
Msg-id CAO6_XqqDOSziXWd+WOsBB2TpV8HTeO7ZKPfkwpFYX2zCUmezTQ@mail.gmail.com
Whole thread Raw
Responses Re: Possible segfault when sending notification within a ProcessUtility hook
List pgsql-hackers
Hi,

I've encountered the following segfault:

#0: 0x0000000104e821a8 postgres`list_head(l=0x7f7f7f7f7f7f7f7f) at
pg_list.h:130:17
#1: 0x0000000104e81c9c postgres`PreCommit_Notify at async.c:932:16
#2: 0x0000000104dd02f8 postgres`CommitTransaction at xact.c:2236:2
#3: 0x0000000104dcfc24 postgres`CommitTransactionCommand at xact.c:3061:4
#4: 0x000000010528a880 postgres`finish_xact_command at postgres.c:2777:3
#5: 0x00000001052883ac postgres`exec_simple_query(query_string="notify
test;") at postgres.c:1298:4

This happens when a transaction block fails and a ProcessUtility hook
sends a notification during the rollback command.

When a transaction block fails, it will enter in a TBLOCK_ABORT state,
waiting for a rollback. Calling rollback will switch to a
TBLOCK_ABORT_END state and will only go through CleanupTransaction.
If a hook sends a notification during the rollback command, a
notification will be queued but its content will be wiped when the
TopTransactionContext is destroyed.
Trying to send a notification immediately after will segfault in
PreCommit_Notify as pendingNotifies->events will be invalid.

There's a test_notify_rollback test module attached to the patch that reproduces
the issue.

Moving notification clean up from AbortTransaction to CleanupTransaction fixes
the issue as it will clear pendingActions in the same function that destroys the
TopTransactionContext.

Regards,
Anthonin

Attachment

pgsql-hackers by date:

Previous
From: Joe Conway
Date:
Subject: Re: Emitting JSON to file using COPY TO
Next
From: Krishnakumar R
Date:
Subject: Add checks in pg_rewind to abort if backup_label file is present