|
 |
7eafc1 |
Do not attempt to manage OpenSSL locking callbacks in libpq
|
|
|
7eafc1 |
|
|
|
7eafc1 |
A deadlock occurs when connecting to Postgresql using SSL with postgresql-libs in
|
|
|
7eafc1 |
a multi-threaded environment with other threads performing SSL independently.
|
|
|
7eafc1 |
|
|
|
7eafc1 |
This issue has been causing Module Build Service (https://pagure.io/fm-orchestrator)
|
|
|
7eafc1 |
outages, which is deployed on RHEL 7.4 but with the latest postgresql-libs package installed.
|
|
|
7eafc1 |
|
|
|
7eafc1 |
You can find a reproducer script and a more in-depth description of the issue here:
|
|
|
7eafc1 |
https://postgrespro.com/list/thread-id/1861629
|
|
|
7eafc1 |
|
|
|
7eafc1 |
The upstream patch that resolves this issue is here:
|
|
|
7eafc1 |
https://commitfest.postgresql.org/4/140/
|
|
|
7eafc1 |
|
|
|
7eafc1 |
RHBZ: #1755154
|
|
|
7eafc1 |
|
|
|
7eafc1 |
diff -ur postgresql-9.2.24/src/interfaces/libpq/fe-secure.c postgresql-patch/src/interfaces/libpq/fe-secure.c
|
|
|
7eafc1 |
--- postgresql-9.2.24/src/interfaces/libpq/fe-secure.c 2017-11-06 23:17:39.000000000 +0100
|
|
|
7eafc1 |
+++ postgresql-patch/src/interfaces/libpq/fe-secure.c 2019-10-29 15:25:28.448918186 +0100
|
|
|
7eafc1 |
@@ -941,9 +941,12 @@
|
|
|
7eafc1 |
|
|
|
7eafc1 |
if (ssl_open_connections++ == 0)
|
|
|
7eafc1 |
{
|
|
|
7eafc1 |
- /* These are only required for threaded libcrypto applications */
|
|
|
7eafc1 |
- CRYPTO_set_id_callback(pq_threadidcallback);
|
|
|
7eafc1 |
- CRYPTO_set_locking_callback(pq_lockingcallback);
|
|
|
7eafc1 |
+ /* These are only required for threaded libcrypto applications, but
|
|
|
7eafc1 |
+ * make sure we don't stomp on them if they're already set. */
|
|
|
7eafc1 |
+ if (CRYPTO_get_id_callback() == NULL)
|
|
|
7eafc1 |
+ CRYPTO_set_id_callback(pq_threadidcallback);
|
|
|
7eafc1 |
+ if (CRYPTO_get_locking_callback() == NULL)
|
|
|
7eafc1 |
+ CRYPTO_set_locking_callback(pq_lockingcallback);
|
|
|
7eafc1 |
}
|
|
|
7eafc1 |
}
|
|
|
7eafc1 |
#endif /* HAVE_CRYPTO_LOCK */
|
|
|
7eafc1 |
@@ -997,10 +1000,13 @@
|
|
|
7eafc1 |
|
|
|
7eafc1 |
if (pq_init_crypto_lib && ssl_open_connections == 0)
|
|
|
7eafc1 |
{
|
|
|
7eafc1 |
- /* No connections left, unregister libcrypto callbacks */
|
|
|
7eafc1 |
- CRYPTO_set_locking_callback(NULL);
|
|
|
7eafc1 |
- CRYPTO_set_id_callback(NULL);
|
|
|
7eafc1 |
|
|
|
7eafc1 |
+ /* No connections left, unregister libcrypto callbacks, if no one
|
|
|
7eafc1 |
+ * registered different ones in the meantime. */
|
|
|
7eafc1 |
+ if (CRYPTO_get_id_callback() == pq_threadidcallback)
|
|
|
7eafc1 |
+ CRYPTO_set_id_callback(NULL);
|
|
|
7eafc1 |
+ if (CRYPTO_get_locking_callback() == pq_lockingcallback)
|
|
|
7eafc1 |
+ CRYPTO_set_locking_callback(NULL);
|
|
|
7eafc1 |
/*
|
|
|
7eafc1 |
* We don't free the lock array. If we get another connection in
|
|
|
7eafc1 |
* this process, we will just re-use them with the existing mutexes.
|