agora inbox for [email protected]  

help / color / mirror / Atom feed

[PATCH v25 2/8] sequential scan for dshash
1737+ messages / 2 participants
[nested] [flat]

* [PATCH v25 2/8] sequential scan for dshash
@ 2020-03-13 07:58  Kyotaro Horiguchi <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Kyotaro Horiguchi @ 2020-03-13 07:58 UTC (permalink / raw)

Dshash did not allow scan the all entries sequentially. This adds the
functionality. The interface is similar but a bit different both from
that of dynahash and simple dshash search functions. One of the most
significant differences is the sequential scan interface of dshash
always needs a call to dshash_seq_term when scan ends. Another is
locking. Dshash holds partition lock when returning an entry,
dshash_seq_next() also holds lock when returning an entry but callers
shouldn't release it, since the lock is essential to continue a
scan. The seqscan interface allows entry deletion while a scan. The
in-scan deletion should be performed by dshash_delete_current().
---
 src/backend/lib/dshash.c | 162 ++++++++++++++++++++++++++++++++++++++-
 src/include/lib/dshash.h |  21 +++++
 2 files changed, 182 insertions(+), 1 deletion(-)

diff --git a/src/backend/lib/dshash.c b/src/backend/lib/dshash.c
index 78ccf03217..2086bdbea9 100644
--- a/src/backend/lib/dshash.c
+++ b/src/backend/lib/dshash.c
@@ -112,6 +112,7 @@ struct dshash_table
 	size_t		size_log2;		/* log2(number of buckets) */
 	bool		find_locked;	/* Is any partition lock held by 'find'? */
 	bool		find_exclusively_locked;	/* ... exclusively? */
+	bool		seqscan_running;/* now under sequential scan */
 };
 
 /* Given a pointer to an item, find the entry (user data) it holds. */
@@ -127,6 +128,10 @@ struct dshash_table
 #define NUM_SPLITS(size_log2)					\
 	(size_log2 - DSHASH_NUM_PARTITIONS_LOG2)
 
+/* How many buckets are there in a given size? */
+#define NUM_BUCKETS(size_log2)		\
+	(((size_t) 1) << (size_log2))
+
 /* How many buckets are there in each partition at a given size? */
 #define BUCKETS_PER_PARTITION(size_log2)		\
 	(((size_t) 1) << NUM_SPLITS(size_log2))
@@ -153,6 +158,10 @@ struct dshash_table
 #define BUCKET_INDEX_FOR_PARTITION(partition, size_log2)	\
 	((partition) << NUM_SPLITS(size_log2))
 
+/* Choose partition based on bucket index. */
+#define PARTITION_FOR_BUCKET_INDEX(bucket_idx, size_log2)				\
+	((bucket_idx) >> NUM_SPLITS(size_log2))
+
 /* The head of the active bucket for a given hash value (lvalue). */
 #define BUCKET_FOR_HASH(hash_table, hash)								\
 	(hash_table->buckets[												\
@@ -228,6 +237,7 @@ dshash_create(dsa_area *area, const dshash_parameters *params, void *arg)
 
 	hash_table->find_locked = false;
 	hash_table->find_exclusively_locked = false;
+	hash_table->seqscan_running = false;
 
 	/*
 	 * Set up the initial array of buckets.  Our initial size is the same as
@@ -279,6 +289,7 @@ dshash_attach(dsa_area *area, const dshash_parameters *params,
 	hash_table->control = dsa_get_address(area, control);
 	hash_table->find_locked = false;
 	hash_table->find_exclusively_locked = false;
+	hash_table->seqscan_running = false;
 	Assert(hash_table->control->magic == DSHASH_MAGIC);
 
 	/*
@@ -324,7 +335,7 @@ dshash_destroy(dshash_table *hash_table)
 	ensure_valid_bucket_pointers(hash_table);
 
 	/* Free all the entries. */
-	size = ((size_t) 1) << hash_table->size_log2;
+	size = NUM_BUCKETS(hash_table->size_log2);
 	for (i = 0; i < size; ++i)
 	{
 		dsa_pointer item_pointer = hash_table->buckets[i];
@@ -568,6 +579,8 @@ dshash_release_lock(dshash_table *hash_table, void *entry)
 	Assert(LWLockHeldByMeInMode(PARTITION_LOCK(hash_table, partition_index),
 								hash_table->find_exclusively_locked
 								? LW_EXCLUSIVE : LW_SHARED));
+	/* lock is under control of sequential scan */
+	Assert(!hash_table->seqscan_running);
 
 	hash_table->find_locked = false;
 	hash_table->find_exclusively_locked = false;
@@ -592,6 +605,153 @@ dshash_memhash(const void *v, size_t size, void *arg)
 	return tag_hash(v, size);
 }
 
+/*
+ * dshash_seq_init/_next/_term
+ *           Sequentially scan through dshash table and return all the
+ *           elements one by one, return NULL when no more.
+ *
+ * dshash_seq_term should always be called when a scan finished.
+ * The caller may delete returned elements midst of a scan by using
+ * dshash_delete_current(). exclusive must be true to delete elements.
+ */
+void
+dshash_seq_init(dshash_seq_status *status, dshash_table *hash_table,
+				bool exclusive)
+{
+	/* allowed at most one scan at once */
+	Assert(!hash_table->seqscan_running);
+
+	status->hash_table = hash_table;
+	status->curbucket = 0;
+	status->nbuckets = 0;
+	status->curitem = NULL;
+	status->pnextitem = InvalidDsaPointer;
+	status->curpartition = -1;
+	status->exclusive = exclusive;
+	hash_table->seqscan_running = true;
+}
+
+/*
+ * Returns the next element.
+ *
+ * Returned elements are locked and the caller must not explicitly release
+ * it. It is released at the next call to dshash_next().
+ */
+void *
+dshash_seq_next(dshash_seq_status *status)
+{
+	dsa_pointer next_item_pointer;
+
+	Assert(status->hash_table->seqscan_running);
+	if (status->curitem == NULL)
+	{
+		int partition;
+
+		Assert (status->curbucket == 0);
+		Assert(!status->hash_table->find_locked);
+
+		/* first shot. grab the first item. */
+		partition =
+			PARTITION_FOR_BUCKET_INDEX(status->curbucket,
+									   status->hash_table->size_log2);
+		LWLockAcquire(PARTITION_LOCK(status->hash_table, partition),
+					  status->exclusive ? LW_EXCLUSIVE : LW_SHARED);
+		status->curpartition = partition;
+
+		/* resize doesn't happen from now until seq scan ends */
+		status->nbuckets =
+			NUM_BUCKETS(status->hash_table->control->size_log2);
+		ensure_valid_bucket_pointers(status->hash_table);
+
+		next_item_pointer = status->hash_table->buckets[status->curbucket];
+	}
+	else
+		next_item_pointer = status->pnextitem;
+
+	/* Move to the next bucket if we finished the current bucket */
+	while (!DsaPointerIsValid(next_item_pointer))
+	{
+		int next_partition;
+
+		if (++status->curbucket >= status->nbuckets)
+		{
+			/* all buckets have been scanned. finish. */
+			return NULL;
+		}
+
+		/* Also move parititon lock if needed */
+		next_partition =
+			PARTITION_FOR_BUCKET_INDEX(status->curbucket,
+									   status->hash_table->size_log2);
+
+		/* Move lock along with partition for the bucket */
+		if (status->curpartition != next_partition)
+		{
+			/*
+			 * Lock the next partition then release the current, not in the
+			 * reverse order to avoid concurrent resizing. Partitions are
+			 * locked in the same order with resize() so dead locks won't
+			 * happen.
+			 */
+			LWLockAcquire(PARTITION_LOCK(status->hash_table,
+										 next_partition),
+						  status->exclusive ? LW_EXCLUSIVE : LW_SHARED);
+			LWLockRelease(PARTITION_LOCK(status->hash_table,
+										 status->curpartition));
+			status->curpartition = next_partition;
+		}
+
+		next_item_pointer = status->hash_table->buckets[status->curbucket];
+	}
+
+	status->curitem =
+		dsa_get_address(status->hash_table->area, next_item_pointer);
+	status->hash_table->find_locked = true;
+	status->hash_table->find_exclusively_locked = status->exclusive;
+
+	/*
+	 * The caller may delete the item. Store the next item in case of deletion.
+	 */
+	status->pnextitem = status->curitem->next;
+
+	return ENTRY_FROM_ITEM(status->curitem);
+}
+
+/*
+ * Terminates the seqscan and release all locks.
+ *
+ * Should be always called when finishing or exiting a seqscan.
+ */
+void
+dshash_seq_term(dshash_seq_status *status)
+{
+	Assert(status->hash_table->seqscan_running);
+	status->hash_table->find_locked = false;
+	status->hash_table->find_exclusively_locked = false;
+	status->hash_table->seqscan_running = false;
+
+	if (status->curpartition >= 0)
+		LWLockRelease(PARTITION_LOCK(status->hash_table, status->curpartition));
+}
+
+/* Remove the current entry while a seq scan. */
+void
+dshash_delete_current(dshash_seq_status *status)
+{
+	dshash_table	   *hash_table	= status->hash_table;
+	dshash_table_item  *item		= status->curitem;
+	size_t				partition	= PARTITION_FOR_HASH(item->hash);
+
+	Assert(status->exclusive);
+	Assert(hash_table->control->magic == DSHASH_MAGIC);
+	Assert(hash_table->find_locked);
+	Assert(hash_table->find_exclusively_locked);
+	Assert(LWLockHeldByMeInMode(PARTITION_LOCK(hash_table, partition),
+								LW_EXCLUSIVE));
+
+	delete_item(hash_table, item);
+}
+
 /*
  * Print debugging information about the internal state of the hash table to
  * stderr.  The caller must hold no partition locks.
diff --git a/src/include/lib/dshash.h b/src/include/lib/dshash.h
index b86df68e77..81a929b8d9 100644
--- a/src/include/lib/dshash.h
+++ b/src/include/lib/dshash.h
@@ -59,6 +59,21 @@ typedef struct dshash_parameters
 struct dshash_table_item;
 typedef struct dshash_table_item dshash_table_item;
 
+/*
+ * Sequential scan state. The detail is exposed to let users know the storage
+ * size but it should be considered as an opaque type by callers.
+ */
+typedef struct dshash_seq_status
+{
+	dshash_table	   *hash_table;
+	int					curbucket;
+	int					nbuckets;
+	dshash_table_item  *curitem;
+	dsa_pointer			pnextitem;
+	int					curpartition;
+	bool				exclusive;
+} dshash_seq_status;
+
 /* Creating, sharing and destroying from hash tables. */
 extern dshash_table *dshash_create(dsa_area *area,
 								   const dshash_parameters *params,
@@ -80,6 +95,12 @@ extern bool dshash_delete_key(dshash_table *hash_table, const void *key);
 extern void dshash_delete_entry(dshash_table *hash_table, void *entry);
 extern void dshash_release_lock(dshash_table *hash_table, void *entry);
 
+/* seq scan support */
+extern void dshash_seq_init(dshash_seq_status *status, dshash_table *hash_table,
+							bool exclusive);
+extern void *dshash_seq_next(dshash_seq_status *status);
+extern void dshash_seq_term(dshash_seq_status *status);
+extern void dshash_delete_current(dshash_seq_status *status);
 /* Convenience hash and compare functions wrapping memcmp and tag_hash. */
 extern int	dshash_memcmp(const void *a, const void *b, size_t size, void *arg);
 extern dshash_hash dshash_memhash(const void *v, size_t size, void *arg);
-- 
2.18.2


----Next_Part(Thu_Mar_19_20_30_04_2020_284)--
Content-Type: Text/X-Patch; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="v25-0003-Add-conditional-lock-feature-to-dshash.patch"



^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--






^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--






^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--






^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--






^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--






^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--






^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v20 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 67424fe3b0c..3c3b35910e1 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3890,6 +3891,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4092,6 +4095,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5035,3 +5040,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 9f1dd55213d..0a8a2772b23 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -20,6 +20,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--zB/Wek73NRZcta1g--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--





^ permalink  raw  reply  [nested|flat] 1737+ messages in thread

* [PATCH v21 3/3] Add Assert guard to detect permission check before lock regressions
@ 2026-04-27 14:23  Bertrand Drouvot <[email protected]>
  0 siblings, 0 replies; 1737+ messages in thread

From: Bertrand Drouvot @ 2026-04-27 14:23 UTC (permalink / raw)

Add instrumentation under USE_ASSERT_CHECKING to detect cases where
object_aclcheck() is called on a referenced object before a lock is held on it,
which would widen the TOCTOU window between the permission check and the dependency
recording.

In recordMultipleDependencies() and changeDependencyFor(), for each referenced
object that had a permission check earlier in the same statement, assert that a
lock is already held. This catches any future code that adds a permission check
on a referenced object without first acquiring a lock.

The tracking records each (classId, objectId, mode) from object_aclcheck() and
pg_class_aclcheck(), filtering to only dependency-relevant ACL modes (ACL_CREATE,
ACL_USAGE on non namespaces, ACL_EXECUTE, ACL_TRIGGER, ACL_REFERENCES). Tracking
resets at each ProcessUtility() call. The tracking array is capped at 1024 entries
per statement, which is sufficient for any practical DDL command.

Author: Bertrand Drouvot <[email protected]>
Reviewed-by:
Discussion: https://postgr.es/m/[email protected]
---
 src/backend/catalog/aclchk.c         | 32 ++++++++++++
 src/backend/catalog/pg_depend.c      | 52 ++++++++++++++++++++
 src/backend/tcop/utility.c           |  3 ++
 src/include/catalog/aclcheck_track.h | 73 ++++++++++++++++++++++++++++
 src/tools/pgindent/typedefs.list     |  1 +
 5 files changed, 161 insertions(+)
  51.5% src/backend/catalog/
  46.7% src/include/catalog/

diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
index 007ede997c5..d13667f38a8 100644
--- a/src/backend/catalog/aclchk.c
+++ b/src/backend/catalog/aclchk.c
@@ -76,6 +76,7 @@
 #include "parser/parse_type.h"
 #include "storage/lmgr.h"
 #include "utils/acl.h"
+#include "catalog/aclcheck_track.h"
 #include "utils/aclchk_internal.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
@@ -3891,6 +3892,8 @@ object_aclcheck_ext(Oid classid, Oid objectid,
 					Oid roleid, AclMode mode,
 					bool *is_missing)
 {
+	aclcheck_track_record(classid, objectid, mode);
+
 	if (object_aclmask_ext(classid, objectid, roleid, mode, ACLMASK_ANY,
 						   is_missing) != 0)
 		return ACLCHECK_OK;
@@ -4093,6 +4096,8 @@ AclResult
 pg_class_aclcheck_ext(Oid table_oid, Oid roleid,
 					  AclMode mode, bool *is_missing)
 {
+	aclcheck_track_record(RelationRelationId, table_oid, mode);
+
 	if (pg_class_aclmask_ext(table_oid, roleid, mode,
 							 ACLMASK_ANY, is_missing) != 0)
 		return ACLCHECK_OK;
@@ -5036,3 +5041,30 @@ RemoveRoleFromInitPriv(Oid roleid, Oid classid, Oid objid, int32 objsubid)
 
 	table_close(rel, RowExclusiveLock);
 }
+
+/*
+ * Instrumentation to detect permission check before lock regressions.
+ * Only used in assert-enabled builds.
+ */
+#ifdef USE_ASSERT_CHECKING
+AclCheckEntry aclcheck_tracked[ACLCHECK_TRACK_MAX];
+int			aclcheck_tracked_count = 0;
+
+void
+aclcheck_track_reset(void)
+{
+	aclcheck_tracked_count = 0;
+}
+
+bool
+aclcheck_track_was_checked(Oid classId, Oid objectId)
+{
+	for (int i = 0; i < aclcheck_tracked_count; i++)
+	{
+		if (aclcheck_tracked[i].classId == classId &&
+			aclcheck_tracked[i].objectId == objectId)
+			return true;
+	}
+	return false;
+}
+#endif							/* USE_ASSERT_CHECKING */
diff --git a/src/backend/catalog/pg_depend.c b/src/backend/catalog/pg_depend.c
index 5618e3d26fa..28fa99b2d42 100644
--- a/src/backend/catalog/pg_depend.c
+++ b/src/backend/catalog/pg_depend.c
@@ -18,6 +18,7 @@
 #include "access/htup_details.h"
 #include "access/table.h"
 #include "catalog/catalog.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/dependency.h"
 #include "catalog/indexing.h"
 #include "catalog/pg_constraint.h"
@@ -27,6 +28,8 @@
 #include "catalog/partition.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
+#include "storage/lmgr.h"
+#include "storage/lock.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -107,6 +110,31 @@ recordMultipleDependencies(const ObjectAddress *depender,
 		if (isObjectPinned(referenced))
 			continue;
 
+#ifdef USE_ASSERT_CHECKING
+		/*
+		 * If this referenced object had a permission check earlier in this
+		 * statement, assert that a lock is already held on it.  This ensures
+		 * callers acquired the lock before calling object_aclcheck(), not
+		 * after. The latter would widen the TOCTOU window between the
+		 * permission check and the dependency recording.
+		 */
+		if (aclcheck_track_was_checked(referenced->classId, referenced->objectId))
+		{
+			if (referenced->classId == RelationRelationId)
+				Assert(CheckRelationOidLockedByMe(referenced->objectId,
+												  AccessShareLock, true));
+			else
+			{
+				LOCKTAG		tag;
+
+				SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+								   referenced->classId,
+								   referenced->objectId, 0);
+				Assert(LockHeldByMe(&tag, AccessShareLock, true));
+			}
+		}
+#endif
+
 		/*
 		 * Acquire a lock and check object still exists while recording the
 		 * dependency.
@@ -511,6 +539,30 @@ changeDependencyFor(Oid classId, Oid objectId,
 		return 1;
 	}
 
+#ifdef USE_ASSERT_CHECKING
+	/*
+	 * If this referenced object had a permission check earlier in this
+	 * statement, assert that a lock is already held on it.  This ensures
+	 * callers acquired the lock before calling object_aclcheck(), not after.
+	 * The latter would widen the TOCTOU window between the permission check and
+	 * the dependency recording.
+	 */
+	if (aclcheck_track_was_checked(objAddr.classId, objAddr.objectId))
+	{
+		if (objAddr.classId == RelationRelationId)
+			Assert(CheckRelationOidLockedByMe(objAddr.objectId,
+											  AccessShareLock, true));
+		else
+		{
+			LOCKTAG		tag;
+
+			SET_LOCKTAG_OBJECT(tag, MyDatabaseId,
+							   objAddr.classId,
+							   objAddr.objectId, 0);
+			Assert(LockHeldByMe(&tag, AccessShareLock, true));
+		}
+	}
+#endif
 	/*
 	 * Acquire a lock and check object still exists while changing the
 	 * dependency.
diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 73a56f1df1d..0c4d382bd37 100644
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -21,6 +21,7 @@
 #include "access/xact.h"
 #include "access/xlog.h"
 #include "catalog/namespace.h"
+#include "catalog/aclcheck_track.h"
 #include "catalog/pg_authid.h"
 #include "catalog/pg_inherits.h"
 #include "catalog/toasting.h"
@@ -515,6 +516,8 @@ ProcessUtility(PlannedStmt *pstmt,
 	Assert(queryString != NULL);	/* required as of 8.4 */
 	Assert(qc == NULL || qc->commandTag == CMDTAG_UNKNOWN);
 
+	aclcheck_track_reset();
+
 	/*
 	 * We provide a function hook variable that lets loadable plugins get
 	 * control when ProcessUtility is called.  Such a plugin would normally
diff --git a/src/include/catalog/aclcheck_track.h b/src/include/catalog/aclcheck_track.h
new file mode 100644
index 00000000000..5825d7398d3
--- /dev/null
+++ b/src/include/catalog/aclcheck_track.h
@@ -0,0 +1,73 @@
+/*-------------------------------------------------------------------------
+ *
+ * aclcheck_track.h
+ *	  Instrumentation to detect permission check before lock via Assert in
+ *	  recordMultipleDependencies() and changeDependencyFor().
+ *
+ *	  Only active in USE_ASSERT_CHECKING builds.
+ *
+ * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/catalog/aclcheck_track.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef ACLCHECK_TRACK_H
+#define ACLCHECK_TRACK_H
+
+#ifdef USE_ASSERT_CHECKING
+
+#include "catalog/pg_namespace.h"
+
+#define ACLCHECK_TRACK_MAX 1024
+
+typedef struct AclCheckEntry
+{
+	Oid			classId;
+	Oid			objectId;
+} AclCheckEntry;
+
+extern AclCheckEntry aclcheck_tracked[];
+extern int	aclcheck_tracked_count;
+
+extern void aclcheck_track_reset(void);
+extern bool aclcheck_track_was_checked(Oid classId, Oid objectId);
+
+/*
+ * Only record aclchecks that are dependency-relevant:
+ * - ACL_CREATE on any object (creating something in a container)
+ * - ACL_USAGE on non-namespace objects (using a type, language, server)
+ * - ACL_EXECUTE on functions
+ * - ACL_TRIGGER, ACL_REFERENCES on relations
+ *
+ * Skip ACL_USAGE on namespaces — that's name resolution, not dependency.
+ */
+static inline void
+aclcheck_track_record(Oid classId, Oid objectId, AclMode mode)
+{
+	/* Skip ACL_USAGE on namespaces (name resolution, not dependency) */
+	if (classId == NamespaceRelationId && !(mode & ACL_CREATE))
+		return;
+
+	/* Only track dependency-relevant modes */
+	if (!(mode & (ACL_CREATE | ACL_USAGE | ACL_EXECUTE | ACL_TRIGGER | ACL_REFERENCES)))
+		return;
+
+	if (aclcheck_tracked_count < ACLCHECK_TRACK_MAX)
+	{
+		aclcheck_tracked[aclcheck_tracked_count].classId = classId;
+		aclcheck_tracked[aclcheck_tracked_count].objectId = objectId;
+		aclcheck_tracked_count++;
+	}
+}
+
+#else							/* !USE_ASSERT_CHECKING */
+
+#define aclcheck_track_reset()			((void) 0)
+#define aclcheck_track_record(c, o, m)	((void) 0)
+#define aclcheck_track_was_checked(c, o) (false)
+
+#endif							/* USE_ASSERT_CHECKING */
+
+#endif							/* ACLCHECK_TRACK_H */
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 8cf40c87043..cb0cc25bda8 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -19,6 +19,7 @@ AbsoluteTime
 AccessMethodInfo
 AccessPriv
 Acl
+AclCheckEntry
 AclItem
 AclMaskHow
 AclMode
-- 
2.34.1


--FjYZKkuBdH+F20sI--






^ permalink  raw  reply  [nested|flat] 1737+ messages in thread