BUG with accessing to temporary tables of other sessions still exists

Daniil Davydov <3danissimo@gmail.com>

From: Daniil Davydov <3danissimo@gmail.com>
To: PostgreSQL Hackers <pgsql-hackers@postgresql.org>, Jim Jones <jim.jones@uni-muenster.de>
Date: 2026-06-03T13:23:20Z
Lists: pgsql-hackers

Attachments

Hi,

Recently, we have added two commits ([1], [2]) that are fixing a bug with
accessing temporary tables of other sessions. I found out that this bug didn't
go away completely :

== session 1 ==

postgres=# CREATE TABLE empty_table (id INT);
CREATE TABLE

== session 2 ==

postgres=# INSERT INTO pg_temp_0.empty_table VALUES (1);
INSERT 0 1

As you can see, the INSERT command completes successfully. This happens because
empty_table has no pages, so the insert path looks like this :
heap_insert -> RelationGetBufferForTuple -> RelationAddBlocks -> ....

The RelationAddBlocks extends relations's smgr and allocates a new temp buffer
without calling ReadBufferExtended. Thus, we are 1) bypassing the
"RELATION_IS_OTHER_TEMP" check and 2) creating a buffer in our own temp buffers
pool. The (2) will lead to an error [3] if we attempt to flush such a buffer.

I suggest fixing it by checking whether the relation is other-temp-rel inside
the ExtendBufferedRelLocal function. As far as I can see, all
temp-relation-extend paths include this function.

Please, see the attached patch that fixes a problem and adds a new test.

[1] 40927d458fe1a8c96bcf418b47169f0f6eb15946
[2] ce146621f7860d2e19c509f1466feca3bf777678
[3] ERROR: could not open file "base/5/t3_16386": No such file or directory

P.S.
Jim, I attach you in CC of this thread since you are the co-author of the
original fix. I hope you don't mind :)

--
Best regards,
Daniil Davydov

Commits

  1. Prevent access to other sessions' empty temp tables

  2. Add tests for cross-session temp table access

  3. Prevent access to other sessions' temp tables