From 158985ab7f6c5c9cfb658e2426c21767437d0ffb Mon Sep 17 00:00:00 2001
From: Bruce Ricard <bruce.ricard@gmail.com>
Date: Fri, 19 May 2023 17:43:29 -0400
Subject: [PATCH] fix: race condition

* the mutex release needs to be in a `finally` block not to create a dead lock in case an exception is thrown by the cleaning method
---
 .../identity/uaa/oauth/UaaTokenStore.java         | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/oauth/UaaTokenStore.java b/server/src/main/java/org/cloudfoundry/identity/uaa/oauth/UaaTokenStore.java
index b899caf6d1d..ad089046a24 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/oauth/UaaTokenStore.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/oauth/UaaTokenStore.java
@@ -215,13 +215,16 @@ else if (map.get(USER_AUTHENTICATION_UAA_PRINCIPAL)!=null) {
     protected void performExpirationCleanIfEnoughTimeHasElapsed() {
         if (cleanMutex.tryAcquire()) {
             //check if we should expire again
-            Instant now = Instant.now();
-            if (enoughTimeHasPassedSinceLastExpirationClean(lastClean, now)) {
-                //avoid concurrent deletes from the same UAA - performance improvement
-                lastClean = now;
-                actuallyPerformExpirationClean(now);
+            try {
+                Instant now = Instant.now();
+                if (enoughTimeHasPassedSinceLastExpirationClean(lastClean, now)) {
+                    //avoid concurrent deletes from the same UAA - performance improvement
+                    lastClean = now;
+                    actuallyPerformExpirationClean(now);
+                }
+            } finally {
+                cleanMutex.release();
             }
-            cleanMutex.release();
         }
     }