From 0d8ce8406d1f6f66cff621626ff8d3775ea18f33 Mon Sep 17 00:00:00 2001 From: Arunesh Dwivedi Date: Sat, 29 Aug 2026 09:19:53 +0000 Subject: [PATCH] fix(yurttunnel): avoid reusing pooled bufio.Reader in getResponse The getResponse function reads HTTP response headers into a bufio.Reader and returns the parsed *http.Response whose Body still reads from the underlying reader. Using a pooled reader and returning it to the pool via defer before the response body is fully consumed causes a data race when another goroutine reuses the same pooled reader. Create a fresh bufio.Reader instead of using the pool to eliminate the race condition. Signed-off-by: Arunesh Dwivedi --- pkg/yurttunnel/server/interceptor.go | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/pkg/yurttunnel/server/interceptor.go b/pkg/yurttunnel/server/interceptor.go index d121bafabce..7fe8473945c 100644 --- a/pkg/yurttunnel/server/interceptor.go +++ b/pkg/yurttunnel/server/interceptor.go @@ -171,8 +171,7 @@ func (ri *RequestInterceptor) ServeHTTP(w http.ResponseWriter, r *http.Request) func getResponse(r io.Reader) (*http.Response, []byte, error) { rawResponse := bytes.NewBuffer(make([]byte, 0, 256)) // Save the bytes read while reading the response headers into the rawResponse buffer - br := newBufioReader(io.TeeReader(r, rawResponse)) - defer putBufioReader(br) + br := bufio.NewReader(io.TeeReader(r, rawResponse)) resp, err := http.ReadResponse(br, nil) if err != nil { return nil, nil, err @@ -272,7 +271,6 @@ func isChunked(response *http.Response) bool { // serverRequest serves the normal requests, e.g., kubectl logs func serveRequest(tunnelConn net.Conn, w http.ResponseWriter, r *http.Request) { br := newBufioReader(tunnelConn) - defer putBufioReader(br) tunnelHTTPResp, err := http.ReadResponse(br, r) if err != nil { klogAndHTTPError(w, http.StatusServiceUnavailable, "could not read response from the tunnel: %v", err)