fix(enterprise/coderd): prevent deadlock during entitlements update (#8215)

mafredri · web-flow · commit 31076ad6654a · 2023-06-26T20:22:28.000+03:00
diff --git a/enterprise/coderd/coderd.go b/enterprise/coderd/coderd.go
@@ -313,8 +313,9 @@ type API struct {
 	// ProxyHealth checks the reachability of all workspace proxies.
 	ProxyHealth *proxyhealth.ProxyHealth
 
-	entitlementsMu sync.RWMutex
-	entitlements   codersdk.Entitlements
+	entitlementsUpdateMu sync.Mutex
+	entitlementsMu       sync.RWMutex
+	entitlements         codersdk.Entitlements
 }
 
 func (api *API) Close() error {
@@ -329,8 +330,8 @@ func (api *API) Close() error {
 }
 
 func (api *API) updateEntitlements(ctx context.Context) error {
-	api.entitlementsMu.Lock()
-	defer api.entitlementsMu.Unlock()
+	api.entitlementsUpdateMu.Lock()
+	defer api.entitlementsUpdateMu.Unlock()
 
 	entitlements, err := license.Entitlements(
 		ctx, api.Database,
@@ -457,6 +458,8 @@ func (api *API) updateEntitlements(ctx context.Context) error {
 		}
 	}
 
+	api.entitlementsMu.Lock()
+	defer api.entitlementsMu.Unlock()
 	api.entitlements = entitlements
 	api.AGPL.SiteHandler.Entitlements.Store(&entitlements)
 
diff --git a/enterprise/coderd/workspaceagents.go b/enterprise/coderd/workspaceagents.go
@@ -9,9 +9,9 @@ import (
 )
 
 func (api *API) shouldBlockNonBrowserConnections(rw http.ResponseWriter) bool {
-	api.entitlementsMu.Lock()
+	api.entitlementsMu.RLock()
 	browserOnly := api.entitlements.Features[codersdk.FeatureBrowserOnly].Enabled
-	api.entitlementsMu.Unlock()
+	api.entitlementsMu.RUnlock()
 	if browserOnly {
 		httpapi.Write(context.Background(), rw, http.StatusConflict, codersdk.Response{
 			Message: "Non-browser connections are disabled for your deployment.",

Original file line number	Diff line number	Diff line change
`@@ -313,8 +313,9 @@ type API struct {`
`313`	`313`	`// ProxyHealth checks the reachability of all workspace proxies.`
`314`	`314`	`ProxyHealth *proxyhealth.ProxyHealth`
`315`	`315`
`316`		`- entitlementsMu sync.RWMutex`
`317`		`- entitlements codersdk.Entitlements`
	`316`	`+ entitlementsUpdateMu sync.Mutex`
	`317`	`+ entitlementsMu sync.RWMutex`
	`318`	`+ entitlements codersdk.Entitlements`
`318`	`319`	`}`
`319`	`320`
`320`	`321`	`func (api *API) Close() error {`
`@@ -329,8 +330,8 @@ func (api *API) Close() error {`
`329`	`330`	`}`
`330`	`331`
`331`	`332`	`func (api *API) updateEntitlements(ctx context.Context) error {`
`332`		`- api.entitlementsMu.Lock()`
`333`		`- defer api.entitlementsMu.Unlock()`
	`333`	`+ api.entitlementsUpdateMu.Lock()`
	`334`	`+ defer api.entitlementsUpdateMu.Unlock()`
`334`	`335`
`335`	`336`	`entitlements, err := license.Entitlements(`
`336`	`337`	`ctx, api.Database,`
`@@ -457,6 +458,8 @@ func (api *API) updateEntitlements(ctx context.Context) error {`
`457`	`458`	`}`
`458`	`459`	`}`
`459`	`460`
	`461`	`+ api.entitlementsMu.Lock()`
	`462`	`+ defer api.entitlementsMu.Unlock()`
`460`	`463`	`api.entitlements = entitlements`
`461`	`464`	`api.AGPL.SiteHandler.Entitlements.Store(&entitlements)`
`462`	`465`