From 2ba9e2b778af7a8d040283db6cee11fb03cf9f4a Mon Sep 17 00:00:00 2001 From: Stephen Frost Date: Fri, 28 Aug 2015 11:39:37 -0400 Subject: [PATCH] Ensure locks are acquired on RLS-added relations During fireRIRrules(), get_row_security_policies can add to securityQuals and withCheckOptions. Make sure to lock any relations added at that point and before firing RIR rules on those expressions. Back-patch to 9.5 where RLS was added. --- src/backend/rewrite/rewriteHandler.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/src/backend/rewrite/rewriteHandler.c b/src/backend/rewrite/rewriteHandler.c index 5cf9cc7bcc..761047ca08 100644 --- a/src/backend/rewrite/rewriteHandler.c +++ b/src/backend/rewrite/rewriteHandler.c @@ -1794,6 +1794,8 @@ fireRIRrules(Query *parsetree, List *activeRIRs, bool forUpdatePushedDown) { if (hasSubLinks) { + acquireLocksOnSubLinks_context context; + /* * Recursively process the new quals, checking for infinite * recursion. @@ -1806,6 +1808,23 @@ fireRIRrules(Query *parsetree, List *activeRIRs, bool forUpdatePushedDown) activeRIRs = lcons_oid(RelationGetRelid(rel), activeRIRs); + /* + * get_row_security_policies just passed back securityQuals + * and/or withCheckOptions, and there were SubLinks, make sure + * we lock any relations which are referenced. + * + * These locks would normally be acquired by the parser, but + * securityQuals and withCheckOptions are added post-parsing. + */ + context.for_execute = true; + (void) acquireLocksOnSubLinks((Node *) securityQuals, &context); + (void) acquireLocksOnSubLinks((Node *) withCheckOptions, + &context); + + /* + * Now that we have the locks on anything added by + * get_row_security_policies, fire any RIR rules for them. + */ expression_tree_walker((Node *) securityQuals, fireRIRonSubLink, (void *) activeRIRs); -- 2.40.0