From dd54642a477b2c4f314e4c81009894949ec7bc18 Mon Sep 17 00:00:00 2001
From: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Fri, 8 May 2026 17:41:27 +0200
Subject: [PATCH] web: reject concurrent fgprof profiles with 500, aligning
 with pprof

Add a mutex around the fgprof handler so that only one profile can
run at a time. A second concurrent request returns 500 with an error
message matching the pprof behaviour for CPU profiling already in use.

Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
---
 web/web.go | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/web/web.go b/web/web.go
index 65da00ed18..51316e95c0 100644
--- a/web/web.go
+++ b/web/web.go
@@ -114,7 +114,10 @@ const (
 	Stopping
 )
 
-var fgprofHandler = fgprof.Handler()
+var (
+	fgprofHandler = fgprof.Handler()
+	fgprofMu      sync.Mutex
+)
 
 // withStackTracer logs the stack trace in case the request panics. The function
 // will re-raise the error which will then be handled by the net/http package.
@@ -636,6 +639,11 @@ func serveDebug(w http.ResponseWriter, req *http.Request) {
 	case "trace":
 		pprof.Trace(w, req)
 	case "fgprof":
+		if !fgprofMu.TryLock() {
+			http.Error(w, "Could not enable fgprof profiling: fgprof profiling already in use", http.StatusInternalServerError)
+			return
+		}
+		defer fgprofMu.Unlock()
 		fgprofHandler.ServeHTTP(w, req)
 	default:
 		req.URL.Path = "/debug/pprof/" + subpath