From d5e035369611a0765304066ca46259c47b9b2c68 Mon Sep 17 00:00:00 2001
From: Nick Cabatoff <ncabatoff@hashicorp.com>
Date: Wed, 5 Oct 2022 08:56:36 -0400
Subject: [PATCH] Fix unsafe access to perf standby status from systemview
 (#17186)

Ensure that we don't try to access Core.perfStandby or Core.PerfStandby() from dynamicSystemView, which might be accessed with or without stateLock held.
---
 changelog/17186.txt          | 3 +++
 vault/dynamic_system_view.go | 7 ++++---
 vault/mount_util.go          | 5 +++--
 vault/policy_store.go        | 2 +-
 vault/testing.go             | 2 +-
 5 files changed, 12 insertions(+), 7 deletions(-)
 create mode 100644 changelog/17186.txt

diff --git a/changelog/17186.txt b/changelog/17186.txt
new file mode 100644
index 000000000..d086dd0ef
--- /dev/null
+++ b/changelog/17186.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: fix race when using SystemView.ReplicationState outside of a request context
+```
\ No newline at end of file
diff --git a/vault/dynamic_system_view.go b/vault/dynamic_system_view.go
index 77eccf087..f87089e7b 100644
--- a/vault/dynamic_system_view.go
+++ b/vault/dynamic_system_view.go
@@ -23,8 +23,9 @@ func (c ctxKeyForwardedRequestMountAccessor) String() string {
 }
 
 type dynamicSystemView struct {
-	core       *Core
-	mountEntry *MountEntry
+	core        *Core
+	mountEntry  *MountEntry
+	perfStandby bool
 }
 
 type extendedSystemView interface {
@@ -178,7 +179,7 @@ func (d dynamicSystemView) LocalMount() bool {
 // in read mode.
 func (d dynamicSystemView) ReplicationState() consts.ReplicationState {
 	state := d.core.ReplicationState()
-	if d.core.perfStandby {
+	if d.perfStandby {
 		state |= consts.ReplicationPerformanceStandby
 	}
 	return state
diff --git a/vault/mount_util.go b/vault/mount_util.go
index d6a108b0d..a82687766 100644
--- a/vault/mount_util.go
+++ b/vault/mount_util.go
@@ -49,8 +49,9 @@ func verifyNamespace(*Core, *namespace.Namespace, *MountEntry) error { return ni
 func (c *Core) mountEntrySysView(entry *MountEntry) extendedSystemView {
 	return extendedSystemViewImpl{
 		dynamicSystemView{
-			core:       c,
-			mountEntry: entry,
+			core:        c,
+			mountEntry:  entry,
+			perfStandby: c.perfStandby,
 		},
 	}
 }
diff --git a/vault/policy_store.go b/vault/policy_store.go
index 08f09fd06..db92ebab5 100644
--- a/vault/policy_store.go
+++ b/vault/policy_store.go
@@ -251,7 +251,7 @@ func NewPolicyStore(ctx context.Context, core *Core, baseView *BarrierView, syst
 func (c *Core) setupPolicyStore(ctx context.Context) error {
 	// Create the policy store
 	var err error
-	sysView := &dynamicSystemView{core: c}
+	sysView := &dynamicSystemView{core: c, perfStandby: c.perfStandby}
 	psLogger := c.baseLogger.Named("policy")
 	c.AddLogger(psLogger)
 	c.policyStore, err = NewPolicyStore(ctx, c, c.systemBarrierView, sysView, psLogger)
diff --git a/vault/testing.go b/vault/testing.go
index 302332360..07e39f111 100644
--- a/vault/testing.go
+++ b/vault/testing.go
@@ -508,7 +508,7 @@ func TestDynamicSystemView(c *Core, ns *namespace.Namespace) *dynamicSystemView
 		me.namespace = ns
 	}
 
-	return &dynamicSystemView{c, me}
+	return &dynamicSystemView{c, me, c.perfStandby}
 }
 
 // TestAddTestPlugin registers the testFunc as part of the plugin command to the