crypto/tls: missing "configForClient.mutex.RUnlock()" in "Config.ticketKeys(configForClient *Config)" func

[wamshawn]

Go version

go1.23.2

Output of go env in your module/workspace:

D:\workspace\go\src\github.com\brickingsoft\rio git:[main]
go env
set GO111MODULE=on
set GOARCH=amd64
set GOBIN=D:\sdk\golang\bin
set GOCACHE=C:\Users\ryougi\AppData\Local\go-build
set GOENV=C:\Users\ryougi\AppData\Roaming\go\env
set GOEXE=.exe
set GOEXPERIMENT=
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=D:\workspace\go\pkg\mod
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=D:\workspace\go
set GOPRIVATE=
set GOPROXY=https://mirrors.aliyun.com/goproxy/,direct
set GOROOT=D:/sdk/golang/go1.23.2
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLCHAIN=auto
set GOTOOLDIR=D:\sdk\golang\go1.23.2\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.23.2
set GODEBUG=
set GOTELEMETRY=local
set GOTELEMETRYDIR=C:\Users\ryougi\AppData\Roaming\go\telemetry
set GCCGO=gccgo
set GOAMD64=v1
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=D:\workspace\go\src\github.com\brickingsoft\rio\go.mod
set GOWORK=
set CGO_CFLAGS=-O2 -g
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-O2 -g
set CGO_FFLAGS=-O2 -g
set CGO_LDFLAGS=-O2 -g
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=C:\Users\ryougi\AppData\Local\Temp\go-build665883129=/tmp/go-build -gno-record-gcc-switches

What did you do?

Just find a mistake in crypto/tls/common.go, maybe it is a bug.

func (c *Config) ticketKeys(configForClient *Config) []ticketKey {
	if configForClient != nil {
		configForClient.mutex.RLock()
		if configForClient.SessionTicketsDisabled {
                        // **missing configForClient.mutex.RUnlock() here**
			return nil
		}
		configForClient.initLegacySessionTicketKeyRLocked()
		if len(configForClient.sessionTicketKeys) != 0 {
			ret := configForClient.sessionTicketKeys
			configForClient.mutex.RUnlock()
			return ret
		}
		configForClient.mutex.RUnlock()
	}

	// ...
	return c.autoSessionTicketKeys
}

What did you see happen?

I haven't run it yet, just reading code and find it.

What did you expect to see?

fix it, or tell me the reason about no RUnlock after Rnlock.

[gabyhelp]

Related Issues

• crypto/tls: add missing RUnlock in ticketKeys #68607

Related Code Changes

• crypto/tls: add missing RUnlock in ticketKeys
• crypto/tls: drop ClientForConfig mutex when session tickets disabled

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[dmitshur]

Thanks for the report. I agree it looks like the code is missing a matching RUnlock call on configForClient.mutex in that case. This code doesn't seem to have changed recently, but it only comes up when SessionTicketsDisabled is true.

CC @golang/security.

[seankhliao]

i saw https://go.dev/cl/601335