From 8268e41aca23ae3414360b0a1dc6ae99ea7b43f4 Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Tue, 12 May 2026 13:36:38 +0900 Subject: [PATCH] pg_stat_statements: Fix potential use-after-free of PlannedStmt pgss_ProcessUtility() included a reference to a portion of a PlannedStmt after the point where this data's structure could have been freed, causing an incorrect memory access. There was a comment documenting this requirement, missed in 3357471cf9f5. This commit includes a test able to make valgrind complain with a PlannedStmt freed by an internal ROLLBACK query. Similarly to what is mentioned in 495e73c2079e, this can be triggered by using the extended query protocol, something that can be now tested thanks to the recent meta-command additions in psql. This commit mentions potential other cases, but as far as I can see the extended protocol case with an internal ROLLBACK is the only problematic pattern reachable in practice. Issue introduced by 3357471cf9f5, gone unnoticed due to a lack of test coverage. The fix is authored by Chao, my contribution being the new test. Author: Chao Li Co-authored-by: Michael Paquier Discussion: https://postgr.es/m/2F91906A-F2B5-4A6B-9695-D136957D4545@gmail.com --- .../pg_stat_statements/expected/plancache.out | 38 +++++++++++++++++++ .../pg_stat_statements/pg_stat_statements.c | 3 +- contrib/pg_stat_statements/sql/plancache.sql | 19 ++++++++++ 3 files changed, 59 insertions(+), 1 deletion(-) diff --git a/contrib/pg_stat_statements/expected/plancache.out b/contrib/pg_stat_statements/expected/plancache.out index 32bf913b286..d0796d5693c 100644 --- a/contrib/pg_stat_statements/expected/plancache.out +++ b/contrib/pg_stat_statements/expected/plancache.out @@ -216,6 +216,44 @@ SELECT calls, generic_plan_calls, custom_plan_calls, toplevel, query FROM pg_sta RESET pg_stat_statements.track; -- +-- Procedure with internal ROLLBACK and the extended query protocol. +-- The PlannedStmt used in pgss_ProcessUtility() is freed by the internal +-- ROLLBACK. +-- +CREATE OR REPLACE PROCEDURE rollback_proc(a INOUT int) AS $$ +BEGIN + ROLLBACK; +END; +$$ LANGUAGE plpgsql; +SELECT pg_stat_statements_reset() IS NOT NULL AS t; + t +--- + t +(1 row) + +CALL rollback_proc($1) \parse stmt_rollback +\bind_named stmt_rollback 1 \g + a +--- + 1 +(1 row) + +\bind_named stmt_rollback 2 \g + a +--- + 2 +(1 row) + +SELECT calls, query FROM pg_stat_statements + WHERE query LIKE '%rollback_proc%' + ORDER BY query COLLATE "C"; + calls | query +-------+------------------------ + 2 | CALL rollback_proc($1) +(1 row) + +DROP PROCEDURE rollback_proc; +-- -- Cleanup -- DROP FUNCTION select_one_func(int); diff --git a/contrib/pg_stat_statements/pg_stat_statements.c b/contrib/pg_stat_statements/pg_stat_statements.c index 95a5411a39d..a2d3ab770cc 100644 --- a/contrib/pg_stat_statements/pg_stat_statements.c +++ b/contrib/pg_stat_statements/pg_stat_statements.c @@ -1099,6 +1099,7 @@ pgss_ProcessUtility(PlannedStmt *pstmt, const char *queryString, int64 saved_queryId = pstmt->queryId; int saved_stmt_location = pstmt->stmt_location; int saved_stmt_len = pstmt->stmt_len; + PlannedStmtOrigin saved_planOrigin = pstmt->planOrigin; bool enabled = pgss_track_utility && pgss_enabled(nesting_level); /* @@ -1210,7 +1211,7 @@ pgss_ProcessUtility(PlannedStmt *pstmt, const char *queryString, NULL, 0, 0, - pstmt->planOrigin); + saved_planOrigin); } else { diff --git a/contrib/pg_stat_statements/sql/plancache.sql b/contrib/pg_stat_statements/sql/plancache.sql index 160ced7add3..948d3e98518 100644 --- a/contrib/pg_stat_statements/sql/plancache.sql +++ b/contrib/pg_stat_statements/sql/plancache.sql @@ -87,6 +87,25 @@ SELECT calls, generic_plan_calls, custom_plan_calls, toplevel, query FROM pg_sta RESET pg_stat_statements.track; +-- +-- Procedure with internal ROLLBACK and the extended query protocol. +-- The PlannedStmt used in pgss_ProcessUtility() is freed by the internal +-- ROLLBACK. +-- +CREATE OR REPLACE PROCEDURE rollback_proc(a INOUT int) AS $$ +BEGIN + ROLLBACK; +END; +$$ LANGUAGE plpgsql; +SELECT pg_stat_statements_reset() IS NOT NULL AS t; +CALL rollback_proc($1) \parse stmt_rollback +\bind_named stmt_rollback 1 \g +\bind_named stmt_rollback 2 \g +SELECT calls, query FROM pg_stat_statements + WHERE query LIKE '%rollback_proc%' + ORDER BY query COLLATE "C"; +DROP PROCEDURE rollback_proc; + -- -- Cleanup -- -- 2.47.3