grpc 1.84.1 → 1.85.0.pre1

data/src/core/client_channel/subchannel.cc

@@ -580,7 +580,7 @@ class Subchannel::QueuedCall::Canceller final {
     auto* self = static_cast<Canceller*>(arg);
     bool cancelled = false;
     {
-      MutexLock lock(&self->call_->subchannel_->mu_);
+      MutexLock lock(self->call_->subchannel_->mu_);
       if (self->call_->canceller_ == self && !error.ok()) {
         GRPC_TRACE_LOG(subchannel_call, INFO)
             << "subchannel " << self->call_->subchannel_.get()
@@ -592,7 +592,7 @@ class Subchannel::QueuedCall::Canceller final {
       }
     }
     if (cancelled) {
-      MutexLock lock(&self->call_->mu_);
+      MutexLock lock(self->call_->mu_);
       // Fail pending batches on the call.
       self->call_->buffered_call_.Fail(
           error, BufferedCall::YieldCallCombinerIfPendingBatchesFound);
@@ -626,7 +626,7 @@ Subchannel::QueuedCall::~QueuedCall() {
 
 void Subchannel::QueuedCall::SetAfterCallStackDestroy(grpc_closure* closure) {
   GRPC_CHECK_NE(closure, nullptr);
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (subchannel_call_ != nullptr) {
     subchannel_call_->SetAfterCallStackDestroy(closure);
   } else {
@@ -641,7 +641,7 @@ void Subchannel::QueuedCall::StartTransportStreamOpBatch(
       << "subchannel " << subchannel_.get() << " queued call " << this
       << ": starting batch: "
       << grpc_transport_stream_op_batch_string(batch, false);
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   // If we already have a real subchannel call, pass the batch down to it.
   if (subchannel_call_ != nullptr) {
     subchannel_call_->StartTransportStreamOpBatch(batch);
@@ -706,7 +706,7 @@ void Subchannel::QueuedCall::ResumeOnConnectionLocked(
       << ": resuming on connected_subchannel " << connected_subchannel;
   canceller_ = nullptr;
   queue_entry_ = nullptr;
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   grpc_error_handle error;
   subchannel_call_ = connected_subchannel->CreateCall(args_, &error);
   if (after_call_stack_destroy_ != nullptr) {
@@ -739,7 +739,7 @@ void Subchannel::QueuedCall::FailLocked(absl::Status status) {
   canceller_ = nullptr;
   queue_entry_ = nullptr;
   is_retriable_.store(true);
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   cancel_error_ = status;
   buffered_call_.Fail(status,
                       BufferedCall::YieldCallCombinerIfPendingBatchesFound);
@@ -790,7 +790,8 @@ class Subchannel::NewConnectedSubchannel final : public ConnectedSubchannel {
   }
 
   void Ping(absl::AnyInvocable<void(absl::Status)>) override {
-    // TODO(ctiller): add new transport API for this in v3 stack
+    // TODO(akshitpatel) : [PH2][P2][Client] : add new transport API for this in
+    // v3 stack
     Crash("not implemented");
   }
 
@@ -840,7 +841,7 @@ class Subchannel::ConnectionStateWatcher final
                 ? disconnect_info.keepalive_time->ToString()
                 : "<unset>")
         << ")";
-    MutexLock lock(&subchannel->mu_);
+    MutexLock lock(subchannel->mu_);
     // Handle keepalive update.
     if (disconnect_info.keepalive_time.has_value()) {
       subchannel->ThrottleKeepaliveTimeLocked(*disconnect_info.keepalive_time);
@@ -1124,7 +1125,7 @@ RefCountedPtr<Subchannel> Subchannel::Create(
 }
 
 void Subchannel::ThrottleKeepaliveTime(Duration new_keepalive_time) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   ThrottleKeepaliveTimeLocked(new_keepalive_time);
 }
 
@@ -1145,7 +1146,7 @@ channelz::SubchannelNode* Subchannel::channelz_node() {
 
 void Subchannel::WatchConnectivityState(
     RefCountedPtr<ConnectivityStateWatcherInterface> watcher) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   grpc_pollset_set* interested_parties = watcher->interested_parties();
   if (interested_parties != nullptr) {
     grpc_pollset_set_add_pollset_set(pollset_set_, interested_parties);
@@ -1163,7 +1164,7 @@ void Subchannel::WatchConnectivityState(
 
 void Subchannel::CancelConnectivityStateWatch(
     ConnectivityStateWatcherInterface* watcher) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   grpc_pollset_set* interested_parties = watcher->interested_parties();
   if (interested_parties != nullptr) {
     grpc_pollset_set_del_pollset_set(pollset_set_, interested_parties);
@@ -1175,7 +1176,7 @@ void Subchannel::RequestConnection() {
   GRPC_TRACE_LOG(subchannel, INFO)
       << "subchannel " << this << " " << key_.ToString()
       << ": RequestConnection()";
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (state_ == GRPC_CHANNEL_IDLE) {
     StartConnectingLocked();
   }
@@ -1188,7 +1189,7 @@ void Subchannel::ResetBackoff() {
   // does not eliminate the last ref and destroy the Subchannel before the
   // method returns.
   auto self = WeakRef(DEBUG_LOCATION, "ResetBackoff");
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   backoff_.Reset();
   if (retry_timer_handle_.has_value() &&
       event_engine_->Cancel(*retry_timer_handle_)) {
@@ -1207,7 +1208,7 @@ void Subchannel::Orphaned() {
     subchannel_pool_->UnregisterSubchannel(key_, this);
     subchannel_pool_.reset();
   }
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   GRPC_CHECK(!shutdown_);
   shutdown_ = true;
   connector_.reset();
@@ -1220,13 +1221,13 @@ void Subchannel::Orphaned() {
 void Subchannel::GetOrAddDataProducer(
     UniqueTypeName type,
     std::function<void(DataProducerInterface**)> get_or_add) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   auto it = data_producer_map_.emplace(type, nullptr).first;
   get_or_add(&it->second);
 }
 
 void Subchannel::RemoveDataProducer(DataProducerInterface* data_producer) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   auto it = data_producer_map_.find(data_producer->type());
   if (it != data_producer_map_.end() && it->second == data_producer) {
     data_producer_map_.erase(it);
@@ -1315,7 +1316,7 @@ bool Subchannel::RemoveConnectionLocked(
 }
 
 void Subchannel::OnRetryTimer() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   OnRetryTimerLocked();
 }
 
@@ -1351,7 +1352,7 @@ void Subchannel::StartConnectingLocked() {
 void Subchannel::OnConnectingFinished(void* arg, grpc_error_handle error) {
   WeakRefCountedPtr<Subchannel> c(static_cast<Subchannel*>(arg));
   {
-    MutexLock lock(&c->mu_);
+    MutexLock lock(c->mu_);
     c->OnConnectingFinishedLocked(error);
   }
   c.reset(DEBUG_LOCATION, "Connect");
@@ -1513,7 +1514,7 @@ RefCountedPtr<Subchannel::Call> Subchannel::CreateCall(
     CreateCallArgs args, grpc_error_handle* error) {
   RefCountedPtr<ConnectedSubchannel> connected_subchannel;
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     // If we hit a race condition where the LB picker chose the subchannel
     // at the same time as the last connection was closed, then tell the
     // channel to re-queue the pick.
@@ -1539,10 +1540,10 @@ RefCountedPtr<Subchannel::Call> Subchannel::CreateCall(
 }
 
 RefCountedPtr<UnstartedCallDestination> Subchannel::call_destination() {
-  // TODO(roth): Implement connection scaling for v3.
+  // TODO(roth) : [PH2][P2][Client] : Implement connection scaling for v3.
   RefCountedPtr<ConnectedSubchannel> connected_subchannel;
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     if (!connections_.empty()) connected_subchannel = connections_[0];
   }
   if (connected_subchannel == nullptr) return nullptr;
@@ -1582,7 +1583,7 @@ Subchannel::ChooseConnectionLocked() {
 }
 
 void Subchannel::RetryQueuedRpcs() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (shutdown_) return;
   RetryQueuedRpcsLocked();
 }
@@ -1644,7 +1645,7 @@ void Subchannel::Ping(absl::AnyInvocable<void(absl::Status)>) {
 absl::Status Subchannel::Ping(grpc_closure* on_initiate, grpc_closure* on_ack) {
   RefCountedPtr<ConnectedSubchannel> connected_subchannel;
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     if (!connections_.empty()) connected_subchannel = connections_[0];
   }
   if (connected_subchannel == nullptr) {

data/src/core/client_channel/subchannel_stream_client.cc

@@ -90,7 +90,7 @@ void SubchannelStreamClient::Orphan() {
               << ": SubchannelStreamClient shutting down";
   }
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     event_handler_.reset();
     call_state_.reset();
     if (retry_timer_handle_.has_value()) {
@@ -102,7 +102,7 @@ void SubchannelStreamClient::Orphan() {
 }
 
 void SubchannelStreamClient::StartCall() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   StartCallLocked();
 }
 
@@ -150,7 +150,7 @@ void SubchannelStreamClient::StartRetryTimerLocked() {
 }
 
 void SubchannelStreamClient::OnRetryTimer() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (event_handler_ != nullptr && retry_timer_handle_.has_value() &&
       call_state_ == nullptr) {
     if (GPR_UNLIKELY(tracer_ != nullptr)) {
@@ -353,7 +353,7 @@ void SubchannelStreamClient::CallState::RecvMessageReady() {
   }
   // Report payload.
   {
-    MutexLock lock(&subchannel_stream_client_->mu_);
+    MutexLock lock(subchannel_stream_client_->mu_);
     if (subchannel_stream_client_->event_handler_ != nullptr) {
       absl::Status status =
           subchannel_stream_client_->event_handler_->RecvMessageReadyLocked(
@@ -418,7 +418,7 @@ void SubchannelStreamClient::CallState::RecvTrailingMetadataReady(
   // that it lives long enough for us to release the mutex, since the
   // call to CallEndedLocked() may release the last ref.
   auto subchannel_stream_client = self->subchannel_stream_client_->Ref();
-  MutexLock lock(&self->subchannel_stream_client_->mu_);
+  MutexLock lock(self->subchannel_stream_client_->mu_);
   if (self->subchannel_stream_client_->event_handler_ != nullptr) {
     self->subchannel_stream_client_->event_handler_
         ->RecvTrailingMetadataReadyLocked(self->subchannel_stream_client_.get(),

data/src/core/credentials/call/external/aws_external_account_credentials.cc

@@ -91,7 +91,7 @@ AwsExternalAccountCredentials::AwsFetchBody::AwsFetchBody(
     absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done,
     AwsExternalAccountCredentials* creds, Timestamp deadline)
     : FetchBody(std::move(on_done)), creds_(creds), deadline_(deadline) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   // Do a quick async hop here, so that we can invoke the callback at
   // any time without deadlocking.
   fetch_body_ = MakeOrphanable<NoOpFetchBody>(
@@ -102,7 +102,7 @@ AwsExternalAccountCredentials::AwsFetchBody::AwsFetchBody(
 }
 
 void AwsExternalAccountCredentials::AwsFetchBody::Shutdown() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   fetch_body_.reset();
 }
 
@@ -131,7 +131,7 @@ bool AwsExternalAccountCredentials::AwsFetchBody::MaybeFail(
 }
 
 void AwsExternalAccountCredentials::AwsFetchBody::Start() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (MaybeFail(absl::OkStatus())) return;
   if (!creds_->imdsv2_session_token_url_.empty() && ShouldUseMetadataServer()) {
     RetrieveImdsV2SessionToken();
@@ -175,7 +175,7 @@ void AwsExternalAccountCredentials::AwsFetchBody::RetrieveImdsV2SessionToken() {
       },
       [self =
            RefAsSubclass<AwsFetchBody>()](absl::StatusOr<std::string> result) {
-        MutexLock lock(&self->mu_);
+        MutexLock lock(self->mu_);
         if (self->MaybeFail(result.status())) return;
         self->imdsv2_session_token_ = std::move(*result);
         if (self->creds_->signer_ != nullptr) {
@@ -228,7 +228,7 @@ void AwsExternalAccountCredentials::AwsFetchBody::RetrieveRegion() {
       },
       [self =
            RefAsSubclass<AwsFetchBody>()](absl::StatusOr<std::string> result) {
-        MutexLock lock(&self->mu_);
+        MutexLock lock(self->mu_);
         if (self->MaybeFail(result.status())) return;
         // Remove the last letter of availability zone to get pure region
         self->region_ = result->substr(0, result->size() - 1);
@@ -270,7 +270,7 @@ void AwsExternalAccountCredentials::AwsFetchBody::RetrieveRoleName() {
       },
       [self =
            RefAsSubclass<AwsFetchBody>()](absl::StatusOr<std::string> result) {
-        MutexLock lock(&self->mu_);
+        MutexLock lock(self->mu_);
         if (self->MaybeFail(result.status())) return;
         self->role_name_ = std::move(*result);
         self->RetrieveSigningKeys();
@@ -326,7 +326,7 @@ void AwsExternalAccountCredentials::AwsFetchBody::RetrieveSigningKeys() {
       },
       [self =
            RefAsSubclass<AwsFetchBody>()](absl::StatusOr<std::string> result) {
-        MutexLock lock(&self->mu_);
+        MutexLock lock(self->mu_);
         if (self->MaybeFail(result.status())) return;
         self->OnRetrieveSigningKeys(std::move(*result));
       });

data/src/core/credentials/call/external/aws_request_signer.cc

@@ -18,12 +18,15 @@
 #include <grpc/support/port_platform.h>
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
 #include <openssl/hmac.h>
+#endif
 #include <openssl/sha.h>
 
 #include <utility>
 #include <vector>
 
+#include "src/core/util/grpc_check.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/ascii.h"
 #include "absl/strings/escaping.h"
@@ -41,6 +44,7 @@ namespace {
 
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
 const char kSha256[] = "SHA256";
+const char kHmacName[] = "HMAC";
 #endif
 const char kAlgorithm[] = "AWS4-HMAC-SHA256";
 const char kDateFormat[] = "%a, %d %b %E4Y %H:%M:%S %Z";
@@ -67,12 +71,24 @@ std::string SHA256Hex(const std::string& str) {
 }
 
 std::string HMAC(const std::string& key, const std::string& msg) {
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
   unsigned int len;
   unsigned char digest[EVP_MAX_MD_SIZE];
   HMAC(EVP_sha256(), key.c_str(), key.length(),
        reinterpret_cast<const unsigned char*>(msg.c_str()), msg.length(),
        digest, &len);
   return std::string(digest, digest + len);
+#else
+  size_t len = 0;
+  unsigned char digest[EVP_MAX_MD_SIZE];
+  GRPC_CHECK_NE(EVP_Q_mac(nullptr, kHmacName, nullptr, kSha256, nullptr,
+                          reinterpret_cast<const unsigned char*>(key.c_str()),
+                          key.length(),
+                          reinterpret_cast<const unsigned char*>(msg.c_str()),
+                          msg.length(), digest, sizeof(digest), &len),
+                nullptr);
+  return std::string(digest, digest + len);
+#endif
 }
 
 }  // namespace

data/src/core/credentials/call/external/external_account_credentials.cc

@@ -181,7 +181,7 @@ ExternalAccountCredentials::ExternalFetchRequest::ExternalFetchRequest(
 
 void ExternalAccountCredentials::ExternalFetchRequest::Orphan() {
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     fetch_body_.reset();
   }
   Unref();
@@ -211,7 +211,7 @@ std::string UrlEncode(const absl::string_view s) {
 
 void ExternalAccountCredentials::ExternalFetchRequest::ExchangeToken(
     absl::StatusOr<std::string> subject_token) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (MaybeFailLocked(subject_token.status())) return;
   // Parse URI.
   absl::StatusOr<URI> uri = URI::Parse(options().token_url);
@@ -300,7 +300,7 @@ void ExternalAccountCredentials::ExternalFetchRequest::ExchangeToken(
 
 void ExternalAccountCredentials::ExternalFetchRequest::
     MaybeImpersonateServiceAccount(absl::StatusOr<std::string> response_body) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (MaybeFailLocked(response_body.status())) return;
   // If not doing impersonation, response_body contains oauth token.
   if (options().service_account_impersonation_url.empty()) {
@@ -381,7 +381,7 @@ void ExternalAccountCredentials::ExternalFetchRequest::
 
 void ExternalAccountCredentials::ExternalFetchRequest::
     OnImpersonateServiceAccount(absl::StatusOr<std::string> response_body) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (MaybeFailLocked(response_body.status())) return;
   auto json = JsonParse(*response_body);
   if (!json.ok()) {

data/src/core/credentials/call/regional_access_boundary_fetcher.cc

@@ -84,7 +84,7 @@ RegionalAccessBoundaryFetcher::RegionalAccessBoundaryFetcher(
 }
 
 void RegionalAccessBoundaryFetcher::OnFetchSuccess(Slice encoded_locations) {
-  MutexLock lock(&cache_mu_);
+  MutexLock lock(cache_mu_);
   if (shutdown_) return;
   cache_ = {std::move(encoded_locations),
             Timestamp::Now() + kRegionalAccessBoundaryCacheDuration};
@@ -94,7 +94,7 @@ void RegionalAccessBoundaryFetcher::OnFetchSuccess(Slice encoded_locations) {
 
 void RegionalAccessBoundaryFetcher::OnFetchFailure(
     grpc_error_handle error, int http_status, absl::string_view response_body) {
-  MutexLock lock(&cache_mu_);
+  MutexLock lock(cache_mu_);
   if (shutdown_) return;
   auto log_message = absl::StrCat(
       "Regional access boundary request will be retried after failing with "
@@ -134,7 +134,7 @@ void RegionalAccessBoundaryFetcher::Fetch(absl::string_view access_token,
   }
   {
     const Timestamp now = Timestamp::Now();
-    MutexLock lock(&cache_mu_);
+    MutexLock lock(cache_mu_);
     // We kick off a new fetch attempt if all of the following are true:
     // - We have no cached Regioanl Access Boundary data, or the cached
     //   Regional Access Boundary data's expiration time is less than the grace
@@ -161,7 +161,7 @@ void RegionalAccessBoundaryFetcher::Fetch(absl::string_view access_token,
 }
 
 void RegionalAccessBoundaryFetcher::Orphaned() {
-  MutexLock lock(&cache_mu_);
+  MutexLock lock(cache_mu_);
   shutdown_ = true;
   pending_request_.reset();
 }
@@ -323,7 +323,7 @@ EmailFetcher::EmailFetcher(
 EmailFetcher::~EmailFetcher() = default;
 
 void EmailFetcher::StartEmailFetch() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (Timestamp::Now() < next_fetch_earliest_time_) {
     return;
   }
@@ -338,7 +338,7 @@ void EmailFetcher::StartEmailFetch() {
 
 void EmailFetcher::Fetch(absl::string_view token,
                          ClientMetadata& initial_metadata) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   auto* rab_fetcher =
       std::get_if<RefCountedPtr<RegionalAccessBoundaryFetcher>>(&state_);
   if (rab_fetcher == nullptr) return;   // Don't yet have RAB fetcher.
@@ -347,12 +347,12 @@ void EmailFetcher::Fetch(absl::string_view token,
 }
 
 void EmailFetcher::Orphaned() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   state_ = RefCountedPtr<RegionalAccessBoundaryFetcher>(nullptr);
 }
 
 void EmailFetcher::OnEmailFetchComplete(absl::string_view email) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (std::holds_alternative<OrphanablePtr<EmailRequest>>(state_)) {
     absl::string_view trimmed_email = absl::StripAsciiWhitespace(email);
     if (!IsValidEmail(trimmed_email)) {
@@ -378,7 +378,7 @@ void EmailFetcher::OnEmailFetchComplete(absl::string_view email) {
 }
 
 void EmailFetcher::OnEmailFetchError(grpc_error_handle error) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (std::holds_alternative<OrphanablePtr<EmailRequest>>(state_)) {
     LOG_EVERY_N_SEC(INFO, 60) << "Regional Access Boundary fetch skipped due "
                                  "to service account email fetch failure: "

data/src/core/credentials/call/token_fetcher/token_fetcher_credentials.cc

@@ -94,7 +94,7 @@ void TokenFetcherCredentials::FetchState::BackoffTimer::Orphan() {
 }
 
 void TokenFetcherCredentials::FetchState::BackoffTimer::OnTimer() {
-  MutexLock lock(&fetch_state_->creds_->mu_);
+  MutexLock lock(fetch_state_->creds_->mu_);
   if (!timer_handle_.has_value()) return;
   timer_handle_.reset();
   GRPC_TRACE_LOG(token_fetcher_credentials, INFO)
@@ -156,7 +156,7 @@ void TokenFetcherCredentials::FetchState::StartFetchAttempt() {
 
 void TokenFetcherCredentials::FetchState::TokenFetchComplete(
     absl::StatusOr<RefCountedPtr<Token>> token) {
-  MutexLock lock(&creds_->mu_);
+  MutexLock lock(creds_->mu_);
   // If we were shut down, clean up.
   if (std::holds_alternative<Shutdown>(state_)) {
     if (token.ok()) token = absl::CancelledError("credentials shutdown");
@@ -232,7 +232,7 @@ TokenFetcherCredentials::~TokenFetcherCredentials() {
 }
 
 void TokenFetcherCredentials::Orphaned() {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   fetch_state_.reset();
 }
 
@@ -241,7 +241,7 @@ TokenFetcherCredentials::GetRequestMetadata(
     ClientMetadataHandle initial_metadata, const GetRequestMetadataArgs*) {
   RefCountedPtr<QueuedCall> queued_call;
   {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     // If we don't have a cached token or the token is within the
     // refresh duration, start a new fetch if there isn't a pending one.
     if ((token_ == nullptr || (token_->ExpirationTime() - Timestamp::Now()) <=

data/src/core/credentials/transport/google_default/google_default_credentials.cc

@@ -314,7 +314,7 @@ static grpc_error_handle create_default_creds_from_path(
 
 static void update_tenancy() {
   gpr_once_init(&g_once, init_default_credentials);
-  grpc_core::MutexLock lock(g_state_mu);
+  grpc_core::MutexLock lock(*g_state_mu);
 
   // Try a platform-provided hint for GCE.
   if (!g_metadata_server_available) {
@@ -329,7 +329,7 @@ static void update_tenancy() {
 }
 
 static bool metadata_server_available() {
-  grpc_core::MutexLock lock(g_state_mu);
+  grpc_core::MutexLock lock(*g_state_mu);
   return static_cast<bool>(g_metadata_server_available);
 }
 
@@ -531,7 +531,7 @@ void set_gce_tenancy_checker_for_testing(grpc_gce_tenancy_checker checker) {
 void grpc_flush_cached_google_default_credentials(void) {
   ExecCtx exec_ctx;
   gpr_once_init(&g_once, init_default_credentials);
-  MutexLock lock(g_state_mu);
+  MutexLock lock(*g_state_mu);
   g_metadata_server_available = 0;
 }
 

data/src/core/credentials/transport/ssl/ssl_security_connector.cc

@@ -331,7 +331,7 @@ class grpc_ssl_server_security_connector
     bool status;
     if (!has_cert_config_fetcher()) return false;
 
-    grpc_core::MutexLock lock(&mu_);
+    grpc_core::MutexLock lock(mu_);
     grpc_ssl_server_credentials* server_creds =
         static_cast<grpc_ssl_server_credentials*>(this->mutable_server_creds());
     grpc_ssl_certificate_config_reload_status cb_result =

data/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.cc

@@ -34,7 +34,7 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
     std::optional<grpc_core::KeyCertPairsOrSelector>
         key_cert_pairs_or_selector) {
   GRPC_CHECK(roots != nullptr || key_cert_pairs_or_selector.has_value());
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   auto& cert_info = certificate_info_map_[cert_name];
   if (roots != nullptr) {
     // Successful credential updates will clear any pre-existing error.
@@ -93,14 +93,14 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
 
 bool grpc_tls_certificate_distributor::HasRootCerts(
     const std::string& root_cert_name) {
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   const auto it = certificate_info_map_.find(root_cert_name);
   return it != certificate_info_map_.end() && !it->second.AreRootsEmpty();
 };
 
 bool grpc_tls_certificate_distributor::HasKeyCertPairs(
     const std::string& identity_cert_name) {
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   const auto it = certificate_info_map_.find(identity_cert_name);
   return it != certificate_info_map_.end() &&
          !grpc_core::IsKeyCertPairsOrSelectorEmpty(
@@ -112,7 +112,7 @@ void grpc_tls_certificate_distributor::SetErrorForCert(
     std::optional<grpc_error_handle> root_cert_error,
     std::optional<grpc_error_handle> identity_cert_error) {
   GRPC_CHECK(root_cert_error.has_value() || identity_cert_error.has_value());
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   CertificateInfo& cert_info = certificate_info_map_[cert_name];
   if (root_cert_error.has_value()) {
     for (auto* watcher_ptr : cert_info.root_cert_watchers) {
@@ -160,7 +160,7 @@ void grpc_tls_certificate_distributor::SetErrorForCert(
 
 void grpc_tls_certificate_distributor::SetError(grpc_error_handle error) {
   GRPC_CHECK(!error.ok());
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   for (const auto& watcher : watchers_) {
     const auto watcher_ptr = watcher.first;
     GRPC_CHECK_NE(watcher_ptr, nullptr);
@@ -189,7 +189,7 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
   GRPC_CHECK_NE(watcher_ptr, nullptr);
   // Update watchers_ and certificate_info_map_.
   {
-    grpc_core::MutexLock lock(&mu_);
+    grpc_core::MutexLock lock(mu_);
     const auto watcher_it = watchers_.find(watcher_ptr);
     // The caller needs to cancel the watcher first if it wants to re-register
     // the watcher.
@@ -245,7 +245,7 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
   }
   // Invoke watch status callback if needed.
   {
-    grpc_core::MutexLock lock(&callback_mu_);
+    grpc_core::MutexLock lock(callback_mu_);
     if (watch_status_callback_ != nullptr) {
       if (root_cert_name == identity_cert_name &&
           (start_watching_root_cert || start_watching_identity_cert)) {
@@ -275,7 +275,7 @@ void grpc_tls_certificate_distributor::CancelTlsCertificatesWatch(
   bool already_watching_root_for_identity_cert = false;
   // Update watchers_ and certificate_info_map_.
   {
-    grpc_core::MutexLock lock(&mu_);
+    grpc_core::MutexLock lock(mu_);
     auto it = watchers_.find(watcher);
     if (it == watchers_.end()) return;
     WatcherInfo& watcher_info = it->second;
@@ -310,7 +310,7 @@ void grpc_tls_certificate_distributor::CancelTlsCertificatesWatch(
   }
   // Invoke watch status callback if needed.
   {
-    grpc_core::MutexLock lock(&callback_mu_);
+    grpc_core::MutexLock lock(callback_mu_);
     if (watch_status_callback_ != nullptr) {
       if (root_cert_name == identity_cert_name &&
           (stop_watching_root_cert || stop_watching_identity_cert)) {

data/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h

@@ -138,7 +138,7 @@ struct grpc_tls_certificate_distributor
   // are being watched.
   void SetWatchStatusCallback(
       std::function<void(std::string, bool, bool)> callback) {
-    grpc_core::MutexLock lock(&callback_mu_);
+    grpc_core::MutexLock lock(callback_mu_);
     watch_status_callback_ = std::move(callback);
   };
 

data/src/core/credentials/transport/tls/grpc_tls_certificate_provider.cc

@@ -172,7 +172,7 @@ FileWatcherCertificateProvider::FileWatcherCertificateProvider(
   distributor_->SetWatchStatusCallback([this](std::string cert_name,
                                               bool root_being_watched,
                                               bool identity_being_watched) {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     absl::StatusOr<std::shared_ptr<tsi::RootCertInfo>> roots = nullptr;
     std::optional<PemKeyCertPairList> pem_key_cert_pairs;
     FileWatcherCertificateProvider::WatcherInfo& info =
@@ -212,7 +212,7 @@ UniqueTypeName FileWatcherCertificateProvider::type() const {
 }
 
 absl::Status FileWatcherCertificateProvider::ValidateCredentials() const {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (!root_cert_info_.ok()) {
     return root_cert_info_.status();
   }
@@ -254,7 +254,7 @@ void FileWatcherCertificateProvider::ForceUpdate() {
     pem_key_cert_pairs = ReadIdentityKeyCertPairFromFiles(
         private_key_path_, identity_certificate_path_);
   }
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   const bool root_changed =
       HasRootCertInfoChanged(root_cert_info_, root_cert_info);
   if (root_changed) {
@@ -406,7 +406,7 @@ InMemoryCertificateProvider::InMemoryCertificateProvider()
   distributor_->SetWatchStatusCallback([this](std::string cert_name,
                                               bool root_being_watched,
                                               bool identity_being_watched) {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     std::shared_ptr<tsi::RootCertInfo> roots;
     std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector;
     WatcherInfo& info = watcher_info_[cert_name];
@@ -433,7 +433,7 @@ InMemoryCertificateProvider::InMemoryCertificateProvider()
 absl::Status InMemoryCertificateProvider::Update(
     std::optional<std::shared_ptr<tsi::RootCertInfo>> root_cert_info,
     std::optional<const KeyCertPairsOrSelector> key_cert_pairs_or_selector) {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   const bool root_changed =
       root_cert_info.has_value() &&
       HasRootCertInfoChanged(root_certificates_, *root_cert_info);
@@ -488,7 +488,7 @@ absl::Status InMemoryCertificateProvider::Update(
 }
 
 absl::Status InMemoryCertificateProvider::ValidateCredentials() const {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (!root_certificates_.ok()) {
     return root_certificates_.status();
   }