From: Tom Yu <tlyu@mit.edu>
Date: Thu, 10 Oct 2013 17:59:27 +0000 (-0400)
Subject: Fix KDC lock persistence on error conditions
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=047afa2244c33ef54805ebf0436db42c12e83332;p=thirdparty%2Fkrb5.git

Fix KDC lock persistence on error conditions

If k5db2_dbopen() returns an error, krb5_db2_lock() can return an
error without unlocking the lock file.  This lock will persist until
krb5_db2_lock() executes successfully, preventing kadmind from making
changes to the KDB.  One possible trigger is running out of file
descriptors.

ticket: 7717 (new)
version_fixed: 1.9.6
---

diff --git a/src/plugins/kdb/db2/kdb_db2.c b/src/plugins/kdb/db2/kdb_db2.c
index 210afff00a..73ee803541 100644
--- a/src/plugins/kdb/db2/kdb_db2.c
+++ b/src/plugins/kdb/db2/kdb_db2.c
@@ -611,7 +611,7 @@ policy_lock:
 lock_error:;
     db_ctx->db_lock_mode = 0;
     db_ctx->db_locks_held = 0;
-    krb5_db2_unlock(context);
+    krb5_lock_file(context, db_ctx->db_lf_file, KRB5_LOCKMODE_UNLOCK);
     return retval;
 }