Piete.Brooks at cl.cam.ac.uk reported via email a crash which was

caused by use of an invalid kgss_gssd_handle during an upcall to
the gssd daemon when it has exited. This patch seems to avoid the
crashes by holding a reference count on the kgss_gssd_handle until
the upcall is done. It also adds a new mutex kgss_gssd_lock used to
make manipulation of kgss_gssd_handle SMP safe.

Tested by:	Illias A. Marinos, Herbert Poeckl
Reviewed by:	jhb
MFC after:	2 weeks

1 files changed, 10 insertions, 3 deletions

diff --git a/sys/kgssapi/gss_delete_sec_context.c b/sys/kgssapi/gss_delete_sec_context.c
index e1582a2712e4..8689927816e1 100644
--- a/sys/kgssapi/gss_delete_sec_context.c
+++ b/sys/kgssapi/gss_delete_sec_context.c
@@ -31,7 +31,9 @@ __FBSDID("$FreeBSD$");
 #include <sys/param.h>
 #include <sys/kernel.h>
 #include <sys/kobj.h>
+#include <sys/lock.h>
 #include <sys/malloc.h>
+#include <sys/mutex.h>
 
 #include <kgssapi/gssapi.h>
 #include <kgssapi/gssapi_impl.h>
@@ -46,6 +48,9 @@ gss_delete_sec_context(OM_uint32 *minor_status, gss_ctx_id_t *context_handle,
 	struct delete_sec_context_args args;
 	enum clnt_stat stat;
 	gss_ctx_id_t ctx;
+	CLIENT *cl;
+
+	*minor_status = 0;
 
 	if (!kgss_gssd_handle)
 		return (GSS_S_FAILURE);
@@ -60,9 +65,13 @@ gss_delete_sec_context(OM_uint32 *minor_status, gss_ctx_id_t *context_handle,
 		 */
 		if (ctx->handle) {
 			args.ctx = ctx->handle;
+			cl = kgss_gssd_client();
+			if (cl == NULL)
+				return (GSS_S_FAILURE);
 	
 			bzero(&res, sizeof(res));
-			stat = gssd_delete_sec_context_1(&args, &res, kgss_gssd_handle);
+			stat = gssd_delete_sec_context_1(&args, &res, cl);
+			CLNT_RELEASE(cl);
 			if (stat != RPC_SUCCESS) {
 				*minor_status = stat;
 				return (GSS_S_FAILURE);
@@ -85,7 +94,5 @@ gss_delete_sec_context(OM_uint32 *minor_status, gss_ctx_id_t *context_handle,
 		}
 	}
 
-	*minor_status = 0;
-
 	return (GSS_S_COMPLETE);
 }