From 10e20e59e9fdf4458c23570bc813333acc328e6c Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Fri, 7 Aug 2026 14:23:39 +0900 Subject: [PATCH] Fix local pgstat entry leak on OOM during entry creation When pgstat_init_entry() fails due to an OOM in the DSA allocation, pgstat_get_entry_ref() cleaned up the shared hashtable but forgot to remove the local reference that pgstat_get_entry_ref_cached() had already inserted into pgStatEntryRefHash. Missing this cleanup would leave a backend with a stale local cache entry whose entry_ref points to a NULL shared_stats. If pgstat_gc_entry_refs() runs with this reference still around, it would crash due to a pointer dereference. The local reference is now removed before removing the shared entry, the order being sensitive to pending interrupts. Oversight in 8191e0c16a03. Author: Niall Newman Discussion: https://postgr.es/m/2FDAA194-9CF3-4FD7-A450-F1A4BEB125F6@turacolabs.com Backpatch-through: 15 --- src/backend/utils/activity/pgstat_shmem.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/backend/utils/activity/pgstat_shmem.c b/src/backend/utils/activity/pgstat_shmem.c index 332c88eed62..5b5abc1edc9 100644 --- a/src/backend/utils/activity/pgstat_shmem.c +++ b/src/backend/utils/activity/pgstat_shmem.c @@ -493,9 +493,12 @@ pgstat_get_entry_ref(PgStat_Kind kind, Oid dboid, Oid objoid, bool create, if (shheader == NULL) { /* - * Failed the allocation of a new entry, so clean up the - * shared hashtable before giving up. + * Failed the allocation of a new entry, so clean up both the + * local reference and the shared hashtable before giving up. + * Clean the local state first, since releasing the dshash + * lock can process a pending interrupt. */ + pgstat_release_entry_ref(key, entry_ref, false); dshash_delete_entry(pgStatLocal.shared_hash, shhashent); ereport(ERROR,