{"record":{"id":"20f2de9024fd2fab","repo":"rustfs/rustfs","slug":"credential-task-join-mutex-poisoned","errorCode":null,"errorMessage":"credential task join mutex poisoned","messagePattern":"credential task join mutex poisoned","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/kms/src/backends/vault_credentials.rs","lineNumber":975,"sourceCode":"            }\n        }\n    }\n}\n\n/// Owner handle for a spawned renewal task.\n///\n/// Dropping the handle cancels the task, so hanging it off the service version\n/// recycles the task on stop and reconfigure without explicit lifecycle calls.\npub(crate) struct CredentialTaskHandle {\n    cancel: CancellationToken,\n    join: std::sync::Mutex<Option<tokio::task::JoinHandle<()>>>,\n}\n\nimpl CredentialTaskHandle {\n    /// Cancel the renewal task and wait for it to exit.\n    pub(crate) async fn shutdown(&self) {\n        self.cancel.cancel();\n        let join = self.join.lock().expect(\"credential task join mutex poisoned\").take();\n        if let Some(join) = join {\n            let _ = join.await;\n        }\n    }\n}\n\nimpl Drop for CredentialTaskHandle {\n    fn drop(&mut self) {\n        self.cancel.cancel();\n    }\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use crate::config::{DEFAULT_VAULT_KUBERNETES_MOUNT, REDACTED_SECRET};\n    use std::sync::atomic::{AtomicBool, AtomicU32, Ordering};\n","sourceCodeStart":957,"sourceCodeEnd":993,"githubUrl":"https://github.com/rustfs/rustfs/blob/35af688cd9d41b4346fbe27dcf7250ba72046c1f/crates/kms/src/backends/vault_credentials.rs#L957-L993","documentation":"Panic-style guard in CredentialTaskHandle::shutdown: the mutex holding the renewal task's JoinHandle was poisoned by an earlier panic in another thread that held it. Shutdown expects the lock to be healthy so it can cancel and join the task; a poisoned lock means the handle's lifecycle state is untrustworthy and the process takes the panic rather than leaking the task silently.","triggerScenarios":"Thrown at crates/kms/src/backends/vault_credentials.rs:975 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the panic inside the renewal task that poisoned the lock","Recycle the credential task via the service version handle"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"35af688cd9d41b4346fbe27dcf7250ba72046c1f","analyzedAt":"2026-08-20T21:57:04.799Z","contentChangedAt":"2026-08-20T21:57:04.799Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}