Fix policy refcount corruption race in dump

ticket: 7384

diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c
index 10096793115286128e887126b664426a9f925fe2..63f48f31020a69e6a0f2d6a73d0a589692b9d41d 100644 (file)
--- a/src/kadmin/dbutil/dump.c
+++ b/src/kadmin/dbutil/dump.c
@@ -1476,17 +1476,17 @@ dump_db(argc, argv)
         arglist.kcontext = util_context;
         fprintf(arglist.ofile, "%s", dump->header);
 
-        if (dump_sno) {
-            /*
-             * We grab the lock twice (once again in the iterator call),
-             * but that's ok since the lock func handles incr locks held.
-             */
-            if (krb5_db_lock(util_context, KRB5_LOCKMODE_SHARED)) {
-                fprintf(stderr,
-                        _("%s: Couldn't grab lock\n"), progname);
-                goto error;
-            }
+        /*
+         * We grab the lock twice (once again in the iterator call),
+         * but that's ok since the lock func handles incr locks held.
+         */
+        if (krb5_db_lock(util_context, KRB5_LOCKMODE_SHARED)) {
+            fprintf(stderr,
+                    _("%s: Couldn't grab lock\n"), progname);
+            goto error;
+        }
 
+        if (dump_sno) {
             if (ipropx_version)
                 fprintf(f, " %u", IPROPX_VERSION);
             fprintf(f, " %u", log_ctx->ulog->kdb_last_sno);