From 5ed19caff2f40b0cd38587533921d77e831d48d5 Mon Sep 17 00:00:00 2001 From: KJ Tsanaktsidis Date: Thu, 4 Oct 2018 18:17:12 +1000 Subject: [PATCH] Fix a panic in MongoDB backend with concurrent create/revoke When Vault is concurrently creating and revoking leases for MongoDB users as part of the database secrets engine, and then loses connection to MongoDB, it can panic. This occurrs because the RevokeUser path does _not_ lock the mutex, but the CreateUser path does. Both threads of execution can concurently decide to call c.session.Close() in mongodb/connection_producer.go:119, and then mgo panics when the second close attempt occurs. --- plugins/database/mongodb/mongodb.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/plugins/database/mongodb/mongodb.go b/plugins/database/mongodb/mongodb.go index 61ca9c51bf5d..9f338a152a2f 100644 --- a/plugins/database/mongodb/mongodb.go +++ b/plugins/database/mongodb/mongodb.go @@ -165,6 +165,9 @@ func (m *MongoDB) RenewUser(ctx context.Context, statements dbplugin.Statements, // RevokeUser drops the specified user from the authentication database. If none is provided // in the revocation statement, the default "admin" authentication database will be assumed. func (m *MongoDB) RevokeUser(ctx context.Context, statements dbplugin.Statements, username string) error { + m.Lock() + defer m.Unlock() + statements = dbutil.StatementCompatibilityHelper(statements) session, err := m.getConnection(ctx)