PG-1446 Do not realase locks too early

We need to hold onto the lock until after the last use of the
principal key we fetched from the cache.

Author: jeltz

contrib/pg_tde/src/access/pg_tde_tdemap.c

@@ -897,6 +897,7 @@ pg_tde_get_key_from_file(const RelFileLocator *rlocator, uint32 key_type)
 	TDEPrincipalKey *principal_key;
 	LWLock	   *lock_pk = tde_lwlock_enc_keys();
 	char		db_map_path[MAXPGPATH] = {0};
+	InternalKey *rel_key;
 
 	Assert(rlocator);
 
@@ -934,9 +935,12 @@ pg_tde_get_key_from_file(const RelFileLocator *rlocator, uint32 key_type)
 		ereport(ERROR,
 				(errmsg("principal key not configured"),
 				 errhint("create one using pg_tde_set_principal_key before using encrypted tables")));
+
+	rel_key = tde_decrypt_rel_key(principal_key, map_entry);
+
 	LWLockRelease(lock_pk);
 
-	return tde_decrypt_rel_key(principal_key, map_entry);
+	return rel_key;
 }
 
 /*

contrib/pg_tde/src/catalog/tde_principal_key.c

@@ -654,7 +654,6 @@ pg_tde_get_key_info(PG_FUNCTION_ARGS, Oid dbOid)
 
 	LWLockAcquire(tde_lwlock_enc_keys(), LW_SHARED);
 	principal_key = GetPrincipalKeyNoDefault(dbOid, LW_SHARED);
-	LWLockRelease(tde_lwlock_enc_keys());
 	if (principal_key == NULL)
 	{
 		ereport(ERROR,
@@ -688,6 +687,8 @@ pg_tde_get_key_info(PG_FUNCTION_ARGS, Oid dbOid)
 	values[3] = TimestampTzGetDatum(ts);
 	isnull[3] = false;
 
+	LWLockRelease(tde_lwlock_enc_keys());
+
 	/* Form the tuple */
 	tuple = heap_form_tuple(tupdesc, values, isnull);
 
@@ -952,10 +953,11 @@ pg_tde_is_provider_used(Oid databaseOid, Oid providerId)
 		/* database local provider, just verify that it isn't currently active */
 
 		TDEPrincipalKey *principal_key = GetPrincipalKeyNoDefault(databaseOid, LW_EXCLUSIVE);
+		bool		used = principal_key != NULL && providerId == principal_key->keyInfo.keyringId;
 
 		LWLockRelease(tde_lwlock_enc_keys());
 
-		return principal_key != NULL && providerId == principal_key->keyInfo.keyringId;
+		return used;
 	}
 }
 
@@ -1083,8 +1085,6 @@ pg_tde_verify_principal_key_internal(Oid databaseOid)
 	fromKeyring = get_principal_key_from_keyring(databaseOid);
 	fromCache = get_principal_key_from_cache(databaseOid);
 
-	LWLockRelease(tde_lwlock_enc_keys());
-
 	if (fromKeyring == NULL)
 	{
 		ereport(ERROR,
@@ -1097,6 +1097,8 @@ pg_tde_verify_principal_key_internal(Oid databaseOid)
 				(errmsg("key returned from keyring and cached in pg_tde differ")));
 	}
 
+	LWLockRelease(tde_lwlock_enc_keys());
+
 	PG_RETURN_VOID();
 }