Ensure locks are acquired on RLS-added relations

During fireRIRrules(), get_row_security_policies can add to
securityQuals and withCheckOptions.  Make sure to lock any relations
added at that point and before firing RIR rules on those expressions.

Back-patch to 9.5 where RLS was added.

diff --git a/src/backend/rewrite/rewriteHandler.c b/src/backend/rewrite/rewriteHandler.c
index 1734e48241ada102ac66cfd2788ffff0837dfcab..a238cffa88b894711127a7db536feb5f69f0e2dd 100644 (file)
--- a/src/backend/rewrite/rewriteHandler.c
+++ b/src/backend/rewrite/rewriteHandler.c
@@ -1787,6 +1787,8 @@ fireRIRrules(Query *parsetree, List *activeRIRs, bool forUpdatePushedDown)
                {
                        if (hasSubLinks)
                        {
+                               acquireLocksOnSubLinks_context context;
+
                                /*
                                 * Recursively process the new quals, checking for infinite
                                 * recursion.
@@ -1799,6 +1801,23 @@ fireRIRrules(Query *parsetree, List *activeRIRs, bool forUpdatePushedDown)
 
                                activeRIRs = lcons_oid(RelationGetRelid(rel), activeRIRs);
 
+                               /*
+                                * get_row_security_policies just passed back securityQuals
+                                * and/or withCheckOptions, and there were SubLinks, make sure
+                                * we lock any relations which are referenced.
+                                *
+                                * These locks would normally be acquired by the parser, but
+                                * securityQuals and withCheckOptions are added post-parsing.
+                                */
+                               context.for_execute = true;
+                               (void) acquireLocksOnSubLinks((Node *) securityQuals, &context);
+                               (void) acquireLocksOnSubLinks((Node *) withCheckOptions,
+                                                                                         &context);
+
+                               /*
+                                * Now that we have the locks on anything added by
+                                * get_row_security_policies, fire any RIR rules for them.
+                                */
                                expression_tree_walker((Node *) securityQuals,
                                                                           fireRIRonSubLink, (void *) activeRIRs);