From 453cc7ec35a06748bfc0dd8600b9fb7ba064bd5a Mon Sep 17 00:00:00 2001 From: Masahiko Sawada Date: Wed, 8 Oct 2025 10:40:13 -0700 Subject: [PATCH v5] Fix access-to-already-freed-memory issue in pgoutput. While pgoutput caches relation synchronization information in RelationSyncCache that resides in CacheMemoryContext, each entry's information (such as row filter expressions and column lists) is stored in the entry's private memory context (entry_cxt in RelationSyncEntry), which is a descendant memory context of the decoding context. If a logical decoding invoked via SQL functions like pg_logical_slot_get_binary_changes fails with an error, subsequent logical decoding executions could access already-freed memory of the entry's cache, resulting in a crash. With this change, it's ensured that RelationSyncCache is cleaned up even in error cases by using a memory context reset callback function. Backpatch to 15, where entry_cxt was introduced for column filtering and row filtering. Author: vignesh C Co-authored-by: Masahiko Sawada Reviewed-by: Zhijie Hou Reviewed-by: Euler Taveira Discussion: https://postgr.es/m/CALDaNm0x-aCehgt8Bevs2cm=uhmwS28MvbYq1=s2Ekf0aDPkOA@mail.gmail.com Backpatch: 15 --- src/backend/replication/pgoutput/pgoutput.c | 27 ++++++++++++--------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/src/backend/replication/pgoutput/pgoutput.c b/src/backend/replication/pgoutput/pgoutput.c index 64f62de635f..f3acc64c451 100644 --- a/src/backend/replication/pgoutput/pgoutput.c +++ b/src/backend/replication/pgoutput/pgoutput.c @@ -232,6 +232,7 @@ static bool get_schema_sent_in_streamed_txn(RelationSyncEntry *entry, TransactionId xid); static void init_tuple_slot(PGOutputData *data, Relation relation, RelationSyncEntry *entry); +static void pgoutput_memory_context_reset(void *arg); /* row filter routines */ static EState *create_estate_for_relation(Relation rel); @@ -393,11 +394,18 @@ parse_output_parameters(List *options, PGOutputData *data) } /* - * Callback of PGOutputData->context in charge of cleaning pubctx. + * Memory context reset callback of PGOutputData->context. */ static void -pgoutput_pubctx_reset_callback(void *arg) +pgoutput_memory_context_reset(void *arg) { + if (RelationSyncCache) + { + hash_destroy(RelationSyncCache); + RelationSyncCache = NULL; + } + + /* Better safe than sorry */ pubctx = NULL; } @@ -426,8 +434,12 @@ pgoutput_startup(LogicalDecodingContext *ctx, OutputPluginOptions *opt, "logical replication publication list context", ALLOCSET_SMALL_SIZES); + /* + * Ensure to cleanup RelationSyncCache even when logical decoding invoked + * via SQL interface ends up with an error. + */ mcallback = palloc0(sizeof(MemoryContextCallback)); - mcallback->func = pgoutput_pubctx_reset_callback; + mcallback->func = pgoutput_memory_context_reset; MemoryContextRegisterResetCallback(ctx->context, mcallback); ctx->output_plugin_private = data; @@ -1761,14 +1773,7 @@ pgoutput_origin_filter(LogicalDecodingContext *ctx, static void pgoutput_shutdown(LogicalDecodingContext *ctx) { - if (RelationSyncCache) - { - hash_destroy(RelationSyncCache); - RelationSyncCache = NULL; - } - - /* Better safe than sorry */ - pubctx = NULL; + pgoutput_memory_context_reset(NULL); } /* -- 2.47.3