From 8d5e9d2b21e573f2bcac068a8a438571171c4920 Mon Sep 17 00:00:00 2001
From: fatedier <fatedier@gmail.com>
Date: Fri, 23 Oct 2026 14:03:25 +0800
Subject: [PATCH] fix(client): use generation-local channels in
 UDPProxy.InWorkConn (#5585)

InWorkConn published readCh and sendCh into pxy fields while holding
pxy.mu, then read those same fields again after unlocking to start the
sender, reader and heartbeat goroutines and to call udp.Forwarder. Two
work connections installed concurrently made that unlocked read race
with the next generation's write to the same fields.

Create the channels as locals, publish them under the existing lock,
and use only those locals for the goroutines and the forwarder. The
fields stay guarded by pxy.mu, so Close still closes the current
generation. No behavior change for a single generation.

Add TestUDPProxyInWorkConnGenerationChannels, which drives two
InWorkConn calls concurrently so the race detector covers the field
accesses.
---
 client/proxy/udp.go      | 14 +++++----
 client/proxy/udp_test.go | 63 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 71 insertions(+), 6 deletions(-)
 create mode 100644 client/proxy/udp_test.go

diff --git a/client/proxy/udp.go b/client/proxy/udp.go
index d01d2c8e..e387da9c 100644
--- a/client/proxy/udp.go
+++ b/client/proxy/udp.go
@@ -108,8 +108,10 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 
 	pxy.mu.Lock()
 	pxy.workConn = workConn
-	pxy.readCh = make(chan *msg.UDPPacket, 1024)
-	pxy.sendCh = make(chan msg.Message, 1024)
+	readCh := make(chan *msg.UDPPacket, 1024)
+	sendCh := make(chan msg.Message, 1024)
+	pxy.readCh = readCh
+	pxy.sendCh = sendCh
 	pxy.closed = false
 	pxy.mu.Unlock()
 
@@ -160,10 +162,10 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 		}
 	}
 
-	go workConnSenderFn(payloadRW, pxy.sendCh)
-	go workConnReaderFn(payloadRW, pxy.readCh)
-	go heartbeatFn(pxy.sendCh)
+	go workConnSenderFn(payloadRW, sendCh)
+	go workConnReaderFn(payloadRW, readCh)
+	go heartbeatFn(sendCh)
 
 	// Call Forwarder with proxy protocol version (empty string means no proxy protocol)
-	udp.Forwarder(pxy.localAddr, pxy.readCh, pxy.sendCh, int(pxy.clientCfg.UDPPacketSize), pxy.cfg.Transport.ProxyProtocolVersion)
+	udp.Forwarder(pxy.localAddr, readCh, sendCh, int(pxy.clientCfg.UDPPacketSize), pxy.cfg.Transport.ProxyProtocolVersion)
 }
diff --git a/client/proxy/udp_test.go b/client/proxy/udp_test.go
new file mode 100644
index 00000000..13995172
--- /dev/null
+++ b/client/proxy/udp_test.go
@@ -0,0 +1,63 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build !frps
+
+package proxy
+
+import (
+	"context"
+	"net"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/msg"
+	"github.com/fatedier/frp/pkg/util/xlog"
+)
+
+func TestUDPProxyInWorkConnGenerationChannels(t *testing.T) {
+	cfg := &v1.UDPProxyConfig{ProxyBaseConfig: v1.ProxyBaseConfig{
+		Name: "udp", Type: "udp",
+		ProxyBackend: v1.ProxyBackend{LocalIP: "127.0.0.1", LocalPort: 9},
+	}}
+	pxy := NewUDPProxy(&BaseProxy{
+		baseCfg: &cfg.ProxyBaseConfig, clientCfg: &v1.ClientCommonConfig{UDPPacketSize: 1500},
+		xl: xlog.New(), ctx: context.Background(),
+	}, cfg).(*UDPProxy)
+	require.NoError(t, pxy.Run())
+	defer pxy.Close()
+
+	conn1, peer1 := net.Pipe()
+	defer conn1.Close()
+	defer peer1.Close()
+	conn2, peer2 := net.Pipe()
+	defer conn2.Close()
+	defer peer2.Close()
+
+	start := make(chan struct{})
+	var wg sync.WaitGroup
+	wg.Add(2)
+	inWorkConn := func(conn net.Conn) {
+		defer wg.Done()
+		<-start
+		pxy.InWorkConn(conn, &msg.StartWorkConn{})
+	}
+	go inWorkConn(conn1)
+	go inWorkConn(conn2)
+	close(start)
+	wg.Wait()
+}