[HADOOP-10852] NetgroupCache is not thread-safe

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.5.0, 2.4.1
• Fix Version/s: 2.7.0
• Component/s: security
• Target Version/s: 2.7.0
• Assignee: Benoy Antony
• Reporter: Benoy Antony
• Created: 16/Jul/14 19:20
• Updated: 10/Apr/15 20:04
• Resolved: 15/Dec/14 22:06

Description

NetgroupCache internally uses two ConcurrentHashMaps and a boolean variable to signal updates on one of the ConcurrentHashMap
None of the functions are synchronized and hence is possible to have unexpected results due to race condition between different threads.

As an example, consider the following sequence:

Thread1 :
add a group
netgroupToUsersMap is updated.
netgroupToUsersMapUpdated is set to true.
Thread 2:
calls getNetgroups for a user
Due to re-ordering, netgroupToUsersMapUpdated=true is visible, but updates in netgroupToUsersMap is not visible.
Does a wrong update with older netgroupToUsersMap values.

Issue Links

• relates to: HADOOP-11234 Potential thread unsafe in NetgroupCache
• requires: HADOOP-10851 NetgroupCache does not remove group memberships