#4459·crowdsec

以pkg/leakybucket计的数据种族. 来自队列的事件引起"同时期地图迭代/读取和地图写出"恐慌 (v1.7.7)

作者: sirianap创建于 2026年5月8日更新于 2026年9月6日
标签kind/bugneeds/triageversion/1.7.7

Both races point at EventsFromQueue iterating/reading qEvents[idx].Meta (an Event Meta map) without synchronization. Looking at master pkg/leakybucket/overflows.go:

go
for idx := range qEvents {
    if qEvents[idx].Meta == nil { continue }
    meta := models.Meta{}
    skeys := make([]string, 0, len(qEvents[idx].Meta))
    for k := range qEvents[idx].Meta {        // <-- iteration race (line 215 in v1.7.7)
        skeys = append(skeys, k)
    }
    sort.Strings(skeys)
    for _, k := range skeys {
        v := qEvents[idx].Meta[k]              // <-- read race (line 222 in v1.7.7)
        ...
    }
}

The Event queued in the bucket appears to still be referenced/mutated by other goroutines (e.g. enrichment/parse

内容来源: crowdsecurity/crowdsec