From: Nathan Bossart <nathan@postgresql.org>
Subject: [PATCH v3 2/3] fix priv checks in index code
Date: Wed, 24 Sep 2025 09:24:36 -0500
---
src/backend/commands/indexcmds.c | 51 +++++++++++++++-----------------
1 file changed, 24 insertions(+), 27 deletions(-)
diff --git a/src/backend/commands/indexcmds.c b/src/backend/commands/indexcmds.cindex ca2bde62e82..e4d05b5f8e6 100644--- a/src/backend/commands/indexcmds.c+++ b/src/backend/commands/indexcmds.c@@ -2976,6 +2976,8 @@ RangeVarCallbackForReindexIndex(const RangeVar *relation,
struct ReindexIndexCallbackState *state = arg;
LOCKMODE table_lockmode;
Oid table_oid;
+ AclResult aclresult;+ bool is_missing = false;
/*
* Lock level here should match table lock in reindex_index() for
@@ -2985,12 +2987,8 @@ RangeVarCallbackForReindexIndex(const RangeVar *relation,
table_lockmode = (state->params.options & REINDEXOPT_CONCURRENTLY) != 0 ?
ShareUpdateExclusiveLock : ShareLock;
- /*- * If we previously locked some other index's heap, and the name we're- * looking up no longer refers to that relation, release the now-useless- * lock.- */- if (relId != oldRelId && OidIsValid(oldRelId))+ /* Unlock any previously locked heap. */+ if (OidIsValid(state->locked_table_oid))
{
UnlockRelationOid(state->locked_table_oid, table_lockmode);
state->locked_table_oid = InvalidOid;
@@ -3014,30 +3012,29 @@ RangeVarCallbackForReindexIndex(const RangeVar *relation,
(errcode(ERRCODE_WRONG_OBJECT_TYPE),
errmsg("\"%s\" is not an index", relation->relname)));
- /* Check permissions */+ /*+ * If the OID isn't valid, it means the index was concurrently dropped,+ * which is not a problem for us; just return normally.+ */
table_oid = IndexGetRelation(relId, true);
- if (OidIsValid(table_oid))- {- AclResult aclresult;-- aclresult = pg_class_aclcheck(table_oid, GetUserId(), ACL_MAINTAIN);- if (aclresult != ACLCHECK_OK)- aclcheck_error(aclresult, OBJECT_INDEX, relation->relname);- }+ if (!OidIsValid(table_oid))+ return;
/* Lock heap before index to avoid deadlock. */
- if (relId != oldRelId)- {- /*- * If the OID isn't valid, it means the index was concurrently- * dropped, which is not a problem for us; just return normally.- */- if (OidIsValid(table_oid))- {- LockRelationOid(table_oid, table_lockmode);- state->locked_table_oid = table_oid;- }- }+ LockRelationOid(table_oid, table_lockmode);+ state->locked_table_oid = table_oid;++ /*+ * Check permissions. Since LockRelationOid() checks for invalidation+ * messages, the table might go missing here, too. As before, this isn't+ * our problem; just return normally.+ */+ aclresult = pg_class_aclcheck_ext(table_oid, GetUserId(),+ ACL_MAINTAIN, &is_missing);+ if (is_missing)+ return;+ else if (aclresult != ACLCHECK_OK)+ aclcheck_error(aclresult, OBJECT_INDEX, relation->relname);
}
/*
--
2.39.5 (Apple Git-154)
--31qWFSWVZhdEZdR9
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment;
filename=v3-0003-fix-priv-checks-in-pg_prewarm.patch
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-general@postgresql.org
Cc: nathan@postgresql.org
Subject: Re: [PATCH v3 2/3] fix priv checks in index code
In-Reply-To: <no-message-id-49392@localhost>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox