Re: Fix bug with accessing to temporary tables of other sessions

Jim Jones <jim.jones@uni-muenster.de>

From: Jim Jones <jim.jones@uni-muenster.de>
To: Soumya S Murali <soumyamurali.work@gmail.com>, Daniil Davydov <3danissimo@gmail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Stepan Neretin <slpmcf@gmail.com>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Date: 2026-04-08T10:41:00Z
Lists: pgsql-hackers
Hi

On 08/04/2026 11:17, Soumya S Murali wrote:
> I worked on the issue of accessing temporary tables belonging to other
> sessions and tried implementing the fix at the buffer manager level,
> as suggested. I added checks in ReadBuffer_common() and
> PrefetchBuffer() to reject access when a relation is temporary
> (relpersistence = TEMP) but does not use local buffers
> (!RelationUsesLocalBuffers) so that it ensures only heap page access
> is blocked, while catalog lookups and other metadata operations
> continue to work as before. While testing, I observed that in many
> cases the query does not reach the buffer manager because name
> resolution fails earlier with “relation does not exist”. However, the
> added checks ensure that even if execution reaches the buffer layer,
> access to other sessions’ temporary tables is safely rejected. The
> change is minimal, and did not modify parser/ACL behavior and all
> regression tests got passed successfully too.
> Kindly review the attached patch herewith. Please let me know if this
> approach aligns with expectations or if further adjustments are
> needed.

A few comments:

== PrefetchBuffer ==

The condition nested inside the if (RelationUsesLocalBuffers(reln))
tests the opposite of the main if !RelationUsesLocalBuffers(reln):

if (RelationUsesLocalBuffers(reln))
{
  /* ACCESS DENIED CHECK */
  if (reln != NULL &&
  reln->rd_rel != NULL &&
  reln->rd_rel->relpersistence == RELPERSISTENCE_TEMP &&
  !RelationUsesLocalBuffers(reln))
  {
  ereport(ERROR,
  	(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
  	errmsg("cannot access temporary tables of other sessions")));
  }
...
}

So it'll be always false, making the ereport unreachable.

== ReadBufferExtended ==

These conditions cancel each other out:

if (reln->rd_rel->relpersistence == RELPERSISTENCE_TEMP &&
    !RelationUsesLocalBuffers(reln))

RelationUsesLocalBuffers(reln) expands to
((relation)->rd_rel->relpersistence == RELPERSISTENCE_TEMP), making the
error message unreachable. Perhaps you meant RELATION_IS_OTHER_TEMP?

== ReadBuffer_common ==

Same as in ReadBufferExtended and PrefetchBuffer.

== tests ==

You excluded the tests from the patch.

== patch version ==

You forgot to add the patch version.

Best, Jim




Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →
  1. Prevent access to other sessions' temp tables

  2. Add tests for cross-session temp table access

  3. Doc: use "an SQL" consistently rather than "a SQL"

  4. Modify the relcache to record the temp status of both local and nonlocal