From: Michael Paquier Date: Wed, 29 Jul 2026 08:39:37 +0000 (+0900) Subject: Protect PGPROC lookup when terminating background workers X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=refs%2Fremotes%2Fgithub%2Fmaster;p=thirdparty%2Fpostgresql.git Protect PGPROC lookup when terminating background workers TerminateBackgroundWorkersForDatabase() uses BackendPidGetProc() and, until now, accessed fields of the returned PGPROC after releasing ProcArrayLock, including its database OID. If the PGPROC slot is recycled during this window, the database OID being checked may belong to a different backend, causing an unrelated background worker to be terminated. Triggering this bug requires a very narrow race: the background worker identified by BackendPidGetProc() must exit, its PGPROC slot must be released and reused, and only then must TerminateBackgroundWorkersForDatabase() examine the database OID. TerminateBackgroundWorkersForDatabase() holds BackgroundWorkerLock, preventing parallel workers and dynamically registered workers (such as those created by worker_spi) from reusing the slot. As far as I know, the only plausible scenario is a static background worker that exits and is restarted quickly enough to reuse the same PGPROC slot within the race window. In practice, this race is extremely unlikely, still reachable in theory. Oversight in f1e251be80a0. Author: Chao Li Reviewed-by: Aya Iwata Reviewed-by: Haibo Yan Discussion: https://postgr.es/m/78E81763-EA1D-4788-9741-4092BCB997A5@gmail.com Backpatch-through: 19 --- diff --git a/src/backend/postmaster/bgworker.c b/src/backend/postmaster/bgworker.c index f2cffce3ff6..3da2a90417f 100644 --- a/src/backend/postmaster/bgworker.c +++ b/src/backend/postmaster/bgworker.c @@ -1442,16 +1442,20 @@ TerminateBackgroundWorkersForDatabase(Oid databaseId) if (slot->in_use && (slot->worker.bgw_flags & BGWORKER_INTERRUPTIBLE)) { - PGPROC *proc = BackendPidGetProc(slot->pid); + PGPROC *proc; + pid_t pid = slot->pid; + LWLockAcquire(ProcArrayLock, LW_SHARED); + proc = BackendPidGetProcWithLock(pid); if (proc && proc->databaseId == databaseId) { slot->terminate = true; signal_postmaster = true; elog(DEBUG1, "termination requested for worker (PID %d) on database %u", - (int) slot->pid, databaseId); + (int) pid, databaseId); } + LWLockRelease(ProcArrayLock); } }