Project

General

Profile

Actions

Bug #39277

open

TopbarSweeper Singleton is not thread-safe under Puma

Added by Pablo Méndez Hernández about 2 months ago. Updated about 2 months ago.

Status:
Ready For Testing
Priority:
Normal
Assignee:
-
Category:
Internationalization
Target version:
-
Difficulty:
Triaged:
No
Fixed in Releases:
Found in Releases:

Description

TopbarSweeper (`app/services/topbar_sweeper.rb`) uses `include Singleton` with an `attr_accessor :controller` that is shared across all Puma threads within each worker process. Under concurrent requests, one thread's `ensure` block in `set_topbar_sweeper_controller` nils the controller while another thread is actively using it, causing:

```
NoMethodError: undefined method `expire_fragment` for nil:NilClass
at topbar_sweeper.rb:6
```

The existing `if controller.present?` guard has a TOCTOU (time-of-check to time-of-use) race: the check passes, then another thread nils the value before `expire_fragment` is called.

The bug is hard to reproduce under typical load because the Singleton is per-process (each Puma worker has its own), so only threads within a single worker compete. With the default 5 threads per worker, the race window is extremely narrow. It becomes observable under high concurrency (many simultaneous registrations) or with increased threads per worker, where more threads share the same Singleton and the interleaving becomes likely.

Introduced in commit 0e52ebb70f57 (Redmine #19035) when migrating from rails-observers for Rails 5 compatibility.

Fix: replace the Singleton with `Thread.current` storage, following the same pattern already used by `ThreadSession` for `User.current` / `Organization.current`.

Actions #1

Updated by Pablo Méndez Hernández about 2 months ago

  • Category changed from Network to Internationalization
Actions #2

Updated by The Foreman Bot about 2 months ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman/pull/10969 added
Actions

Also available in: Atom PDF