From e4115a19f988553d29bf60fe7a846e4d02026813 Mon Sep 17 00:00:00 2001
From: Nick Cabatoff <ncabatoff@hashicorp.com>
Date: Mon, 6 Nov 2023 15:26:27 +0000
Subject: [PATCH] backport of commit 7ec3867eea2ad3c405f15f9ab5447618685739cf

---
 changelog/24027.txt | 3 +++
 vault/expiration.go | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)
 create mode 100644 changelog/24027.txt

diff --git a/changelog/24027.txt b/changelog/24027.txt
new file mode 100644
index 000000000000..d276928f93fb
--- /dev/null
+++ b/changelog/24027.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases.
+```
diff --git a/vault/expiration.go b/vault/expiration.go
index 68fb49b6db20..9c7c8b62542a 100644
--- a/vault/expiration.go
+++ b/vault/expiration.go
@@ -879,7 +879,7 @@ func (m *ExpirationManager) Stop() error {
 	// for the next ExpirationManager to handle them.
 	newStrategy := ExpireLeaseStrategy(expireNoop)
 	m.expireFunc.Store(&newStrategy)
-	oldPending := m.pending
+	oldPending := &m.pending
 	m.pending, m.nonexpiring, m.irrevocable = sync.Map{}, sync.Map{}, sync.Map{}
 	m.leaseCount = 0
 	m.uniquePolicies = make(map[string][]string)
@@ -2485,7 +2485,7 @@ func (m *ExpirationManager) WalkTokens(walkFn ExpirationWalkFunction) error {
 	}
 
 	m.pendingLock.RLock()
-	toWalk := []sync.Map{m.pending, m.nonexpiring}
+	toWalk := []*sync.Map{&m.pending, &m.nonexpiring}
 	m.pendingLock.RUnlock()
 
 	for _, m := range toWalk {
@@ -2514,7 +2514,7 @@ func (m *ExpirationManager) walkLeases(walkFn leaseWalkFunction) error {
 	}
 
 	m.pendingLock.RLock()
-	toWalk := []sync.Map{m.pending, m.nonexpiring}
+	toWalk := []*sync.Map{&m.pending, &m.nonexpiring}
 	m.pendingLock.RUnlock()
 
 	for _, m := range toWalk {