From 289bb283b1d479e93512d6a795791fb62de1e8a1 Mon Sep 17 00:00:00 2001 From: Alexey Dolotov Date: Sat, 28 Mar 2026 22:52:39 +0300 Subject: [PATCH] fix: close connection on worker pool overflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the worker pool rejected a connection (ErrPoolOverload), the accepted net.Conn was never closed — leaking a file descriptor and TCP socket per rejected connection. Under sustained traffic spikes this compounds the problem: leaked descriptors reduce the capacity for new dials (including to the fronting domain), accelerating the failure cascade described in #378. --- mtglib/proxy.go | 1 + 1 file changed, 1 insertion(+) diff --git a/mtglib/proxy.go b/mtglib/proxy.go index 65f52ad..cb252ed 100644 --- a/mtglib/proxy.go +++ b/mtglib/proxy.go @@ -152,6 +152,7 @@ func (p *Proxy) Serve(listener net.Listener) error { case errors.Is(err, ants.ErrPoolClosed): return nil case errors.Is(err, ants.ErrPoolOverload): + conn.Close() //nolint: errcheck logger.Info("connection was concurrency limited") p.eventStream.Send(p.ctx, NewEventConcurrencyLimited()) }