Piete.Brooks at cl.cam.ac.uk reported via email a crash which was

caused by use of an invalid kgss_gssd_handle during an upcall to
the gssd daemon when it has exited. This patch seems to avoid the
crashes by holding a reference count on the kgss_gssd_handle until
the upcall is done. It also adds a new mutex kgss_gssd_lock used to
make manipulation of kgss_gssd_handle SMP safe.

Tested by:	Illias A. Marinos, Herbert Poeckl
Reviewed by:	jhb
MFC after:	2 weeks

1 files changed, 7 insertions, 2 deletions

diff --git a/sys/kgssapi/gss_import_name.c b/sys/kgssapi/gss_import_name.c
index c8019c5..d3a2240 100644
--- a/sys/kgssapi/gss_import_name.c
+++ b/sys/kgssapi/gss_import_name.c
@@ -31,7 +31,9 @@ __FBSDID("$FreeBSD$");
 #include <sys/param.h>
 #include <sys/kernel.h>
 #include <sys/kobj.h>
+#include <sys/lock.h>
 #include <sys/malloc.h>
+#include <sys/mutex.h>
 
 #include <kgssapi/gssapi.h>
 #include <kgssapi/gssapi_impl.h>
@@ -48,18 +50,21 @@ gss_import_name(OM_uint32 *minor_status,
 	struct import_name_args args;
 	enum clnt_stat stat;
 	gss_name_t name;
+	CLIENT *cl;
 
 	*minor_status = 0;
 	*output_name = GSS_C_NO_NAME;
 
-	if (!kgss_gssd_handle)
+	cl = kgss_gssd_client();
+	if (cl == NULL)
 		return (GSS_S_FAILURE);
 
 	args.input_name_buffer = *input_name_buffer;
 	args.input_name_type = input_name_type;
 	
 	bzero(&res, sizeof(res));
-	stat = gssd_import_name_1(&args, &res, kgss_gssd_handle);
+	stat = gssd_import_name_1(&args, &res, cl);
+	CLNT_RELEASE(cl);
 	if (stat != RPC_SUCCESS) {
 		*minor_status = stat;
 		return (GSS_S_FAILURE);