Fix KDC lock persistence on error conditions

If k5db2_dbopen() returns an error, krb5_db2_lock() can return an
error without unlocking the lock file.  This lock will persist until
krb5_db2_lock() executes successfully, preventing kadmind from making
changes to the KDB.  One possible trigger is running out of file
descriptors.

ticket: 7717 (new)
version_fixed: 1.9.6

diff --git a/src/plugins/kdb/db2/kdb_db2.c b/src/plugins/kdb/db2/kdb_db2.c
index 210afff00a118da12199614f9ba2fbf4e139d163..73ee803541dcdcacf9b85c7d5b7e9ae9acbf248c 100644 (file)
--- a/src/plugins/kdb/db2/kdb_db2.c
+++ b/src/plugins/kdb/db2/kdb_db2.c
@@ -611,7 +611,7 @@ policy_lock:
 lock_error:;
     db_ctx->db_lock_mode = 0;
     db_ctx->db_locks_held = 0;
-    krb5_db2_unlock(context);
+    krb5_lock_file(context, db_ctx->db_lf_file, KRB5_LOCKMODE_UNLOCK);
     return retval;
 }