Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: capturing wrong references to loop variables from a goroutine #22

Open
wants to merge 1 commit into
base: db_main
Choose a base branch
from

Conversation

rng70-or
Copy link

Changes

In file: manager.go, there is a function Run which has a goroutine running inside a loop while using the iteration variable of the enclosing loop. This may lead to a scenario in which the inner function may observe the wrong value of the iteration variable coming from a different iteration and may lead to a race condition. This scenario is likely to happen with go version 1.21 and prior to that.

Fix

according to documentation one of the fix

is just to create a new variable, using a declaration style

for _, mgr := range m.mgrs {
	mgr := mgr
 	go mgr.Run()
}

from go.mod file

module github.com/thanos-io/thanos

go 1.21

so, this type of race condition problem is likely to happen with this go version.

same type of fix was suggested for endpointset.go file as well.

Sponsorship and Support

This work is done by the security researchers from OpenRefactory and is supported by the Open Source Security Foundation (OpenSSF): Project Alpha-Omega. Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed – to improve global software supply chain security.

The bug is found by running the Intelligent Code Repair (iCR) tool by OpenRefactory and then manually triaging the results.

@christopherzli
Copy link

why is this pr showing up in databricks repo?

@rng70-or
Copy link
Author

While triaging the open sourced repositories under this organization we found this issue. So, we submitted the PR here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants