NotificationsYou must be signed in to change notification settings
Fork5
Star26

Commitf47b602

committed

Fix bogus lock release in RemovePolicyById and RemoveRoleFromObjectPolicy.

Can't release the AccessExclusiveLock on the target table until commit.Otherwise there is a race condition whereby other backends might serviceour cache invalidation signals before they can actually see the updatedcatalog rows.Just to add insult to injury, RemovePolicyById was closing the rel (withincorrect lock drop) and then passing the now-dangling rel pointer toCacheInvalidateRelcache. Probably the reason this doesn't fall over onCLOBBER_CACHE buildfarm members is that some outer level of the DROP logicis still holding the rel open ... but it'd have bit us on the arseeventually, no doubt.

1 parentc1611db commitf47b602Copy full SHA for f47b602

File tree

1 file changed

+10

-5

lines changed

src/backend/commands
- policy.c

1 file changed

+10

-5

lines changed

`‎src/backend/commands/policy.c`

Lines changed: 10 additions & 5 deletions

Original file line number	Diff line number	Diff line change
`@@ -370,7 +370,10 @@ RemovePolicyById(Oid policy_id)`
`370`	`370`	`elog(ERROR,"could not find tuple for policy %u",policy_id);`
`371`	`371`
`372`	`372`	`/*`
`373`		`- * Open and exclusive-lock the relation the policy belong to.`
	`373`	`+ * Open and exclusive-lock the relation the policy belongs to. (We need`
	`374`	`+ * exclusive lock to lock out queries that might otherwise depend on the`
	`375`	`+ * set of policies the rel has; furthermore we've got to hold the lock`
	`376`	`+ * till commit.)`
`374`	`377`	`*/`
`375`	`378`	`relid= ((Form_pg_policy)GETSTRUCT(tuple))->polrelid;`
`376`	`379`
`@@ -390,7 +393,6 @@ RemovePolicyById(Oid policy_id)`
`390`	`393`	`simple_heap_delete(pg_policy_rel,&tuple->t_self);`
`391`	`394`
`392`	`395`	`systable_endscan(sscan);`
`393`		`-heap_close(rel,AccessExclusiveLock);`
`394`	`396`
`395`	`397`	`/*`
`396`	`398`	`* Note that, unlike some of the other flags in pg_class, relrowsecurity`
`@@ -400,9 +402,10 @@ RemovePolicyById(Oid policy_id)`
`400`	`402`	`* policy is created and all records are filtered (except for queries from`
`401`	`403`	`* the owner).`
`402`	`404`	`*/`
`403`		`-`
`404`	`405`	`CacheInvalidateRelcache(rel);`
`405`	`406`
	`407`	`+heap_close(rel,NoLock);`
	`408`	`+`
`406`	`409`	`/* Clean up */`
`407`	`410`	`heap_close(pg_policy_rel,RowExclusiveLock);`
`408`	`411`	`}`
`@@ -657,7 +660,9 @@ RemoveRoleFromObjectPolicy(Oid roleid, Oid classid, Oid policy_id)`
`657`	`660`
`658`	`661`	`/* Clean up. */`
`659`	`662`	`systable_endscan(sscan);`
`660`		`-relation_close(rel,AccessExclusiveLock);`
	`663`	`+`
	`664`	`+relation_close(rel,NoLock);`
	`665`	`+`
`661`	`666`	`heap_close(pg_policy_rel,RowExclusiveLock);`
`662`	`667`
`663`	`668`	`return(noperm\|\|num_roles>0);`
`@@ -734,7 +739,7 @@ CreatePolicy(CreatePolicyStmt *stmt)`
`734`	`739`	`RangeVarCallbackForPolicy,`
`735`	`740`	`(void*)stmt);`
`736`	`741`
`737`		`-/* Open target_table to build quals. No lock is necessary. */`
	`742`	`+/* Open target_table to build quals. Noadditionallock is necessary. */`
`738`	`743`	`target_table=relation_open(table_id,NoLock);`
`739`	`744`
`740`	`745`	`/* Add for the regular security quals */`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commitf47b602

File tree

1 file changed

1 file changed

`‎src/backend/commands/policy.c`

0 commit comments