From 2ba9e2b778af7a8d040283db6cee11fb03cf9f4a Mon Sep 17 00:00:00 2001
From: Stephen Frost <sfrost@snowman.net>
Date: Fri, 28 Aug 2015 11:39:37 -0400
Subject: [PATCH] Ensure locks are acquired on RLS-added relations
During fireRIRrules(), get_row_security_policies can add to
securityQuals and withCheckOptions. Make sure to lock any relations
added at that point and before firing RIR rules on those expressions.
Back-patch to 9.5 where RLS was added.
---
src/backend/rewrite/rewriteHandler.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/src/backend/rewrite/rewriteHandler.c b/src/backend/rewrite/rewriteHandler.c
index 5cf9cc7bccc..761047ca082 100644
--- a/src/backend/rewrite/rewriteHandler.c
+++ b/src/backend/rewrite/rewriteHandler.c
@@ -1794,6 +1794,8 @@ fireRIRrules(Query *parsetree, List *activeRIRs, bool forUpdatePushedDown)
{
if (hasSubLinks)
{
+ acquireLocksOnSubLinks_context context;
+
/*
* Recursively process the new quals, checking for infinite
* recursion.
@@ -1806,6 +1808,23 @@ fireRIRrules(Query *parsetree, List *activeRIRs, bool forUpdatePushedDown)
activeRIRs = lcons_oid(RelationGetRelid(rel), activeRIRs);
+ /*
+ * get_row_security_policies just passed back securityQuals
+ * and/or withCheckOptions, and there were SubLinks, make sure
+ * we lock any relations which are referenced.
+ *
+ * These locks would normally be acquired by the parser, but
+ * securityQuals and withCheckOptions are added post-parsing.
+ */
+ context.for_execute = true;
+ (void) acquireLocksOnSubLinks((Node *) securityQuals, &context);
+ (void) acquireLocksOnSubLinks((Node *) withCheckOptions,
+ &context);
+
+ /*
+ * Now that we have the locks on anything added by
+ * get_row_security_policies, fire any RIR rules for them.
+ */
expression_tree_walker((Node *) securityQuals,
fireRIRonSubLink, (void *) activeRIRs);
--
GitLab