Skip to content

fix(server): hold RLock when reading activeUploads in handleChunkedUpload#2175

Open
wilfredmulenga wants to merge 2 commits intomainfrom
fix/rel-01-map-race-condition
Open

fix(server): hold RLock when reading activeUploads in handleChunkedUpload#2175
wilfredmulenga wants to merge 2 commits intomainfrom
fix/rel-01-map-race-condition

Conversation

@wilfredmulenga
Copy link
Copy Markdown
Contributor

@wilfredmulenga wilfredmulenga commented Apr 23, 2026

Fixes a fatal crash where concurrent chunk uploads caused a Go runtime map race in handleChunkedUpload. Also guards against a nil pointer if a non-zero chunk arrives before chunk 0 has set the project. Adds tests verified clean under go test -race.

Reported in: https://github.com/eukarya-inc/compliance/issues/7 (REL-01)

  • Verified backward compatibility related to feature modifications (if not compatible, reported deployment notes to the next release owner).
  • Confirmed backward compatibility for migrations.
  • Verified that no personally identifiable information (PII) is included in any values that may be displayed.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes a concurrency issue in chunked split-upload handling by protecting access to the activeUploads map with an RLock, and adds unit tests around split-upload session behavior.

Changes:

  • Add RLock/RUnlock around activeUploads[fileID] lookup in handleChunkedUpload.
  • Reuse the session read once (instead of re-reading the map) to avoid inconsistent reads.
  • Add tests for concurrent access patterns, UpdateSession chunk tracking, and CleanupSession.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File Description
server/internal/app/file_split_uploader.go Protects activeUploads map read in handleChunkedUpload and uses the read session consistently.
server/internal/app/file_split_uploader_test.go Introduces tests for concurrency patterns and session bookkeeping/cleanup.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread server/internal/app/file_split_uploader.go Outdated
Comment thread server/internal/app/file_split_uploader_test.go Outdated
Comment thread server/internal/app/file_split_uploader_test.go Outdated
wilfredmulenga and others added 2 commits April 23, 2026 19:48
…load

Concurrent chunk uploads could trigger a fatal Go runtime crash because
activeUploads was read at line 115 without holding the mutex, while
UpdateSession and cleanupStaleSessions write to it under a lock.

Also fixes a nil pointer dereference: the old code re-read
activeUploads[fileID] to get the Project, which could be nil if a
concurrent goroutine had only partially written the session. The session
is now read once under RLock and reused safely.

Adds tests covering concurrent map access (run with -race), session
chunk tracking, and cleanup behaviour.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
- Extract readSessionProjectID helper so the test exercises the real
  production read path rather than duplicating the lock pattern
- Guard session.Project nil before calling .ID() — a non-zero chunk
  arriving before chunk 0 creates the session with Project == nil
- Remove unused chunkNum parameter from concurrent access test goroutine

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants