Fix race accessing b.crls within cert auth

builtin/credential/cert/path_crls.go

@@ -71,6 +71,16 @@ using the same name as specified here.`,
 	}
 }
 
+func (b *backend) populateCrlsIfNil(ctx context.Context, storage logical.Storage) error {
+	b.crlUpdateMutex.RLock()
+	if b.crls == nil {
+		b.crlUpdateMutex.RUnlock()
+		return b.lockThenpopulateCRLs(ctx, storage)
+	}
+	b.crlUpdateMutex.RUnlock()
+	return nil
+}
+
 func (b *backend) lockThenpopulateCRLs(ctx context.Context, storage logical.Storage) error {
 	b.crlUpdateMutex.Lock()
 	defer b.crlUpdateMutex.Unlock()

builtin/credential/cert/path_login.go

@@ -48,6 +48,11 @@ func pathLogin(b *backend) *framework.Path {
 
 func (b *backend) pathLoginResolveRole(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
 	var matched *ParsedCert
+	// Make sure b.crls is populated if it was invalidated by replication
+	if err := b.populateCrlsIfNil(ctx, req.Storage); err != nil {
+		return nil, err
+	}
+
 	if verifyResp, resp, err := b.verifyCredentials(ctx, req, data); err != nil {
 		return nil, err
 	} else if resp != nil {
@@ -90,11 +95,9 @@ func (b *backend) pathLogin(ctx context.Context, req *logical.Request, data *fra
 		b.updatedConfig(config)
 	}
 
-	if b.crls == nil {
-		// Probably invalidated due to replication, but we need these to proceed
-		if err := b.populateCRLs(ctx, req.Storage); err != nil {
-			return nil, err
-		}
+	// Probably invalidated due to replication, but we need these to proceed
+	if err := b.populateCrlsIfNil(ctx, req.Storage); err != nil {
+		return nil, err
 	}
 
 	var matched *ParsedCert
@@ -173,10 +176,8 @@ func (b *backend) pathLoginRenew(ctx context.Context, req *logical.Request, d *f
 		b.updatedConfig(config)
 	}
 
-	if b.crls == nil {
-		if err := b.populateCRLs(ctx, req.Storage); err != nil {
-			return nil, err
-		}
+	if err := b.populateCrlsIfNil(ctx, req.Storage); err != nil {
+		return nil, err
 	}
 
 	if !config.DisableBinding {

changelog/18945.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+auth/cert: Address a race condition accessing the loaded crls without a lock
+```