From 0d110901f0ef362fcf24b07357c20745f971c602 Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Thu, 15 Oct 2026 08:23:09 +0900 Subject: [PATCH] Fix crash when reading stats file at startup with fixed-sized kinds pgstat_read_statsfile() has never checked that the kind of a hash entry is variable-sized. Since 44539786b829, that has begun tracking which hash table a kind ID should use, it is possible to finish with a NULL pointer dereference for a PGSTAT_FILE_ENTRY_HASH. Fixed-sized stats kinds have no hash table and no DSA area, hence their dsa references in pgStatLocal.kind_hash[] are NULL. This case can occur when reading statistics files if the same kind ID is reused across server restarts, with shared_preload_libraries loading different stats kind information each time: stats written with a set of PGSTAT_FILE_ENTRY_HASH, then read back with the same kind ID pointing to a custom fixed-sized kind info. Oversight in 44539786b829. Reported-by: Zsolt Parragi Author: Sami Imseih Author: Zsolt Parragi Discussion: https://postgr.es/m/CAN4CZFMxuOOuYV14+i3YcPG-16q02eBtSVa82J111=ZnDwSicA@mail.gmail.com --- src/backend/utils/activity/pgstat.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/backend/utils/activity/pgstat.c b/src/backend/utils/activity/pgstat.c index c393bf7d59e..74ba085ca69 100644 --- a/src/backend/utils/activity/pgstat.c +++ b/src/backend/utils/activity/pgstat.c @@ -2048,6 +2048,14 @@ pgstat_read_statsfile(void) key.objid, t); goto error; } + + if (kind_info->fixed_amount) + { + elog(WARNING, "invalid fixed_amount in stats kind for entry %u/%u/%" PRIu64 " of type %c", + key.kind, key.dboid, + key.objid, t); + goto error; + } } else {