Discovering goroutine leaks with Semgrep

Summary: Trail of Bits published a Semgrep rule for detecting goroutine leaks in Go, a bug class it says is common but seldom discussed and typically caused by incorrect use of unbuffered channels. The post cites a Kubernetes repository PR in which an API server crashed from a goroutine leak while running 1,496 goroutines, and notes Semgrep's inability to perform interprocedural analysis limits it to bugs contained within individual functions.
Key Takeaway: A goroutine leak only becomes visible after several accumulate, and the Kubernetes example shows the endpoint: an API server crash at 1,496 goroutines, which the post describes as a denial-of-service condition.

Read the original at Trail of Bits Blog ↗