Skip to content

A failed upgrade may lead to hung goroutines

Low severity GitHub Reviewed Published Feb 1, 2021 in cloudflare/tableflip • Updated Jan 9, 2023

Package

gomod github.com/cloudflare/tableflip (Go)

Affected versions

< 1.2.1

Patched versions

1.2.2

Description

Impact

Processes using tableflip may encounter hung goroutines in the parent process, after a failed upgrade.

The Go runtime has annoying behaviour around setting and clearing
O_NONBLOCK: exec.Cmd.Start() ends up calling os.File.Fd() for any
file in exec.Cmd.ExtraFiles. os.File.Fd() disables both the use
of the runtime poller for the file and clears O_NONBLOCK from
the underlying open file descriptor.

This can lead to goroutines hanging in a parent process, after at least
one failed upgrade. The bug manifests in goroutines which rely on
either a deadline or interruption via Close() to be unblocked being stuck
in read or accept like syscalls. As far as I can tell we've not experienced
this problem in production, so it's most likely quite rare.

Patches

The problem has been fixed in v1.2.2.

Workarounds

None.

References

References

@lmb lmb published to cloudflare/tableflip Feb 1, 2021
Reviewed May 21, 2021
Published to the GitHub Advisory Database May 21, 2021
Last updated Jan 9, 2023

Severity

Low

Weaknesses

No CWEs

CVE ID

No known CVE

GHSA ID

GHSA-gmq2-39ff-f5qg

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.