pg.ddx.io pgsql-committers@postgresql.org mailing list archive
help / color / mirror / Atom feedpgsql: Fix lookups in pg_{clear,restore}_{attribute,relation}_stats().
2+ messages / 1 participants
[nested] [flat]
* pgsql: Fix lookups in pg_{clear,restore}_{attribute,relation}_stats().
@ 2025-10-15 17:49 Nathan Bossart <nathan@postgresql.org>
0 siblings, 0 replies; 2+ messages in thread
From: Nathan Bossart @ 2025-10-15 17:49 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix lookups in pg_{clear,restore}_{attribute,relation}_stats().
Presently, these functions look up the relation's OID, lock it, and
then check privileges. Not only does this approach provide no
guarantee that the locked relation matches the arguments of the
lookup, but it also allows users to briefly lock relations for
which they do not have privileges, which might enable
denial-of-service attacks. This commit adjusts these functions to
use RangeVarGetRelidExtended(), which is purpose-built to avoid
both of these issues. The new RangeVarGetRelidCallback function is
somewhat complicated because it must handle both tables and
indexes, and for indexes, we must check privileges on the parent
table and lock it first. Also, it needs to handle a couple of
extremely unlikely race conditions involving concurrent OID reuse.
A downside of this change is that the coding doesn't allow for
locking indexes in AccessShare mode anymore; everything is locked
in ShareUpdateExclusive mode. Per discussion, the original choice
of lock levels was intended for a now defunct implementation that
used in-place updates, so we believe this change is okay.
Reviewed-by: Jeff Davis <pgsql@j-davis.com>
Discussion: https://postgr.es/m/Z8zwVmGzXyDdkAXj%40nathan
Backpatch-through: 18
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/688dc6299a5bda3221db99fdd957ac9edf11c8a6
Modified Files
--------------
src/backend/statistics/attribute_stats.c | 16 +--
src/backend/statistics/relation_stats.c | 8 +-
src/backend/statistics/stat_utils.c | 152 +++++++++++++++--------------
src/include/statistics/stat_utils.h | 8 +-
src/test/regress/expected/stats_import.out | 6 +-
5 files changed, 103 insertions(+), 87 deletions(-)
^ permalink raw reply [nested|flat] 2+ messages in thread
* pgsql: Fix lookups in pg_{clear,restore}_{attribute,relation}_stats().
@ 2025-10-15 17:49 Nathan Bossart <nathan@postgresql.org>
0 siblings, 0 replies; 2+ messages in thread
From: Nathan Bossart @ 2025-10-15 17:49 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix lookups in pg_{clear,restore}_{attribute,relation}_stats().
Presently, these functions look up the relation's OID, lock it, and
then check privileges. Not only does this approach provide no
guarantee that the locked relation matches the arguments of the
lookup, but it also allows users to briefly lock relations for
which they do not have privileges, which might enable
denial-of-service attacks. This commit adjusts these functions to
use RangeVarGetRelidExtended(), which is purpose-built to avoid
both of these issues. The new RangeVarGetRelidCallback function is
somewhat complicated because it must handle both tables and
indexes, and for indexes, we must check privileges on the parent
table and lock it first. Also, it needs to handle a couple of
extremely unlikely race conditions involving concurrent OID reuse.
A downside of this change is that the coding doesn't allow for
locking indexes in AccessShare mode anymore; everything is locked
in ShareUpdateExclusive mode. Per discussion, the original choice
of lock levels was intended for a now defunct implementation that
used in-place updates, so we believe this change is okay.
Reviewed-by: Jeff Davis <pgsql@j-davis.com>
Discussion: https://postgr.es/m/Z8zwVmGzXyDdkAXj%40nathan
Backpatch-through: 18
Branch
------
REL_18_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/c8af5019bee5c57502db830f8005a01cba60fee0
Modified Files
--------------
src/backend/statistics/attribute_stats.c | 16 +--
src/backend/statistics/relation_stats.c | 8 +-
src/backend/statistics/stat_utils.c | 152 +++++++++++++++--------------
src/include/statistics/stat_utils.h | 8 +-
src/test/regress/expected/stats_import.out | 6 +-
5 files changed, 103 insertions(+), 87 deletions(-)
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2025-10-15 17:49 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2025-10-15 17:49 pgsql: Fix lookups in pg_{clear,restore}_{attribute,relation}_stats(). Nathan Bossart <nathan@postgresql.org>
2025-10-15 17:49 pgsql: Fix lookups in pg_{clear,restore}_{attribute,relation}_stats(). Nathan Bossart <nathan@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox