From cf46961f752a9358434dd8f05e56c481caf8496b Mon Sep 17 00:00:00 2001 From: Konstantinos Tsanaktsidis Date: Thu, 4 Oct 2018 23:51:08 +1000 Subject: [PATCH] Fix a panic in MongoDB backend with concurrent create/revoke (#5463) When Vault is concurrently creating and revoking leases for MongoDB users as part of the database secrets engine, and then loses connection to MongoDB, it can panic. This occurrs because the RevokeUser path does _not_ lock the mutex, but the CreateUser path does. Both threads of execution can concurently decide to call c.session.Close() in mongodb/connection_producer.go:119, and then mgo panics when the second close attempt occurs. --- plugins/database/mongodb/mongodb.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/plugins/database/mongodb/mongodb.go b/plugins/database/mongodb/mongodb.go index 61ca9c51bf5d..9f338a152a2f 100644 --- a/plugins/database/mongodb/mongodb.go +++ b/plugins/database/mongodb/mongodb.go @@ -165,6 +165,9 @@ func (m *MongoDB) RenewUser(ctx context.Context, statements dbplugin.Statements, // RevokeUser drops the specified user from the authentication database. If none is provided // in the revocation statement, the default "admin" authentication database will be assumed. func (m *MongoDB) RevokeUser(ctx context.Context, statements dbplugin.Statements, username string) error { + m.Lock() + defer m.Unlock() + statements = dbutil.StatementCompatibilityHelper(statements) session, err := m.getConnection(ctx)