Re: Use-after-free issue in postgres_fdw

Matheus Alcantara <matheusssilv97@gmail.com>

From: Matheus Alcantara <matheusssilv97@gmail.com>
To: Etsuro Fujita <etsuro.fujita@gmail.com>, PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Cc: Michael Paquier <michael@paquier.xyz>
Date: 2026-03-20T16:00:48Z
Lists: pgsql-hackers
Hi,

On 19/03/26 11:56, Etsuro Fujita wrote:
> I think the root cause is that it is too early to free the PGconn in
> pgfdw_reject_incomplete_xact_state_change() even if the connection is
> in a state where we cannot use it any further; I think we should delay
> that until abort cleanup (ie, pgfdw_xact_callback()).  Attached is a
> patch for that.
> 

IIUC, with this patch, disconnect_pg_server() will be called at 
pgfdw_xact_callback() via pgfdw_reset_xact_state() when the top level 
transaction is rollback right?

I've tested and it seems to fix the issue, when "close c1;" is 
executed "conn" points to a valid connection pointer and this 
connection is properly disconnected when the top level transactions is 
rollback.

This issue is reproducible on v14, so I think that we need a back-port.

--
Matheus Alcantara
EDB: https://www.enterprisedb.com



Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →
  1. postgres_fdw: Fix handling of abort-cleanup-failed connections.