PostgreSQL admin interface crashes (SIGSEGV) when serving cluster PROXY_SELECT queries

[leekihyunn]

Description

Sending any of the cluster-synchronization PROXY_SELECT queries for PostgreSQL tables to the PostgreSQL-protocol admin interface crashes proxysql with SIGSEGV.

Real cluster peers fetch these queries over the MySQL-protocol admin interface, which works correctly — so ProxySQL Cluster itself is not affected. However, any operator or tooling that issues one of these queries through the PostgreSQL admin port (e.g. psql against admin-pgsql_ifaces) kills the whole proxy.

Version

v3.0 branch, commit 7c91137a4 (also reproduces on earlier v3.0 heads).

Steps to reproduce

1. Start proxysql with the PostgreSQL admin interface enabled:

admin_variables =
{
  admin_credentials="admin:admin;radmin2:radmin2"
  pgsql_ifaces="0.0.0.0:6132"
}

2. Connect with psql and issue one of the cluster queries:

psql -h 127.0.0.1 -p 6132 -U radmin2 -d admin \
  -c "PROXY_SELECT writer_hostgroup, reader_hostgroup, check_type, comment FROM runtime_pgsql_replication_hostgroups ORDER BY writer_hostgroup"

3. The connection drops and the proxysql process terminates:

server closed the connection unexpectedly
        This probably means the server terminated abnormally
        before or while processing the request.

Backtrace

Reproduced on a clean build of v3.0 at 7c91137a4 (process exits with SIGSEGV / 139):

./src/proxysql(_Z13crash_handleri+0x4c)
linux-vdso.so.1(__kernel_rt_sigreturn+0x0)
./src/proxysql(_ZN13PgSQL_Session16SQLite3_to_MySQLEP14SQLite3_resultPciP14MySQL_Protocolbb+0x58)
./src/proxysql(_Z21admin_session_handlerI13PgSQL_SessionEvPT_PvP10_PtrSize_t+0x3b58)
./src/proxysql(_ZN13PgSQL_Session80handler___status_WAITING_CLIENT_DATA___STATE_SLEEP___MYSQL_COM_QUERY___not_mysqlER10_PtrSize_t+0x44)
./src/proxysql(_ZN13PgSQL_Session20get_pkts_from_clientERbR10_PtrSize_t+0x804)
./src/proxysql(_ZN13PgSQL_Session7handlerEv+0x8c)
./src/proxysql(_Z14child_postgresPv+0x3ac)

Demangled highlights:

• PgSQL_Session::SQLite3_to_MySQL(SQLite3_result*, char*, int, MySQL_Protocol*, bool, bool) (+0x58)
• void admin_session_handler<PgSQL_Session>(PgSQL_Session*, void*, _PtrSize_t*)
• PgSQL_Session::handler___status_WAITING_CLIENT_DATA___STATE_SLEEP___MYSQL_COM_QUERY___not_mysql

Analysis

In lib/Admin_Handler.cpp, the admin_session_handler<PgSQL_Session> cluster-query branch maps the PROXY_SELECT ... FROM runtime_pgsql_* queries to a table name and serves the resultset via sess->SQLite3_to_MySQL(resultset, error, affected_rows, &sess->client_myds->myprot). On a PgSQL_Session (PostgreSQL wire protocol) this path crashes inside SQLite3_to_MySQL at a small offset (+0x58), for every mapped tn (tested runtime_pgsql_replication_hostgroups; the behavior is identical for the other pgsql cluster queries).

The equivalent queries served over the MySQL-protocol admin interface return correct resultsets.

Found while testing PR #5267 (which reproduces the same crash through the same handler with its new table — the pre-existing runtime_pgsql_replication_hostgroups case above shows the issue is independent of that PR).