net/http/fcgi: fix race in child.serve connection read

Guards the connection read with a mutex, because typeStdin
asynchronously and concurrently writes to the underlying conn.

Fixes #41167

Change-Id: Ia2610f4fde0bd4b108c54164095ea293980b0301
Reviewed-on: https://go-review.googlesource.com/c/go/+/252417
Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>

diff --git a/src/net/http/fcgi/child.go b/src/net/http/fcgi/child.go
index 30a6b2ce2dfe8335efce24b38c274bc0476fd8ed..0e91042543b59860fdd892e41da10493d3bc3286 100644 (file)
--- a/src/net/http/fcgi/child.go
+++ b/src/net/http/fcgi/child.go
@@ -155,9 +155,12 @@ func (c *child) serve() {
        defer c.cleanUp()
        var rec record
        for {
+               c.conn.mutex.Lock()
                if err := rec.read(c.conn.rwc); err != nil {
+                       c.conn.mutex.Unlock()
                        return
                }
+               c.conn.mutex.Unlock()
                if err := c.handleRecord(&rec); err != nil {
                        return
                }