Re: Avoid orphaned objects dependencies, take 3

public inbox for [email protected]  
help / color / mirror / Atom feed

From: Bertrand Drouvot <[email protected]>
To: Jeff Davis <[email protected]>
Cc: Heikki Linnakangas <[email protected]>
Cc: Robert Haas <[email protected]>
Cc: Roman Eskin <[email protected]>
Cc: Michael Paquier <[email protected]>
Cc: Alexander Lakhin <[email protected]>
Cc: [email protected]
Cc: Tom Lane <[email protected]>
Subject: Re: Avoid orphaned objects dependencies, take 3
Date: Fri, 5 Jun 2026 13:09:37 +0000
Message-ID: <aiLKkTC6QBt8i35P@bdtpg> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>
	<ad/awXLnMuc6Rf5M@bdtpg>
	<afCXPVNuvpf5ECGZ@bdtpg>
	<CA+TgmobtzkG9HzGtDXbgb3KVE46qHuSvGcuKHgAGQ1aejCoLLw@mail.gmail.com>
	<agsCqlLTytZCudMv@bdtpg>
	<[email protected]>
	<ahYAKgbx05IQdjwR@bdtpg>
	<[email protected]>
	<ah1PIyqtT+427dWb@bdtpg>
	<[email protected]>

Hi,

On Thu, Jun 04, 2026 at 10:03:22AM -0700, Jeff Davis wrote:
> On Mon, 2026-06-01 at 09:21 +0000, Bertrand Drouvot wrote:
> > The tracking array lives in a dedicated AclCheckTrackContext memory
> > context
> > (child of TopMemoryContext). The context is reset at the start of
> > each
> > top-level utility statement, which frees all prior allocations and
> > provides
> > clean lifetime management.
> > 
> > Recording is gated by aclcheck_tracking_active, which is set to true
> > only
> > during top-level utility statement execution. This ensures DML and
> > queries pay
> > no cost. The flag is cleared both at normal completion of
> > ProcessUtility and in
> > AbortTransaction to handle the error path.
> 
> This could use some better high-level comments in the code. Something
> like:
> 
> "DDL performs ACL checks on referenced objects before acquiring a lock
> on them. The lock is acquired much later, when recording dependencies.
> Track the ACL checks, so that we can re-check them after acquiring the
> lock.

Agreed, I just re-worded a bit to add some nuance in v24 attached, as:

"
may perform ACL checks on referenced objects without first holding a lock on
them. In that case, the lock is acquired much later, when recording the
dependencies. Track the ACL checks, so that we can re-check them after acquiring
the lock while recording dependencies."

> XXX: consider refactoring so that we perform the name lookup,
> acquire the lock, and check ACLs all in unison, like
> RangeVarGetRelidExtended()."

I like the XXX, as I agree that what you mentioned in [1] is an area of improvement
but not something directly linked to the TOCTOU issue that this patch is addressing.

FWIW, with the scenario you described in [1]:

- before 2fbb21170e9, the function would be linked to a non existing schema
- with 2fbb21170e9, it produces "ERROR:  referenced schema was concurrently dropped"

the current patch just "keep" the post 2fbb21170e9 behavior.

[1]: https://postgr.es/m/5315d15a42109297259d1a3264ad09e363eb98df.camel%40j-davis.com

Regards,

-- 
Bertrand Drouvot
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com

view thread (50+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
  Subject: Re: Avoid orphaned objects dependencies, take 3
  In-Reply-To: <aiLKkTC6QBt8i35P@bdtpg>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox