From 4eadb8ff64ed92c1d9584a9f64ed673d2b9277c1 Mon Sep 17 00:00:00 2001
From: yuhan6665 <1588741+yuhan6665@users.noreply.github.com>
Date: Sun, 14 Sep 2025 23:33:23 -0400
Subject: [PATCH] Add mutex for vmess auth writer

Mutex is needed as we removed pipe in mux server.
The conn writer need to be guarded when multiple sub-connection writing back responses.
---
 common/crypto/auth.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/common/crypto/auth.go b/common/crypto/auth.go
index 6259e2a7..432f2189 100644
--- a/common/crypto/auth.go
+++ b/common/crypto/auth.go
@@ -4,6 +4,7 @@ import (
 	"crypto/cipher"
 	"crypto/rand"
 	"io"
+	"sync"
 
 	"github.com/xtls/xray-core/common"
 	"github.com/xtls/xray-core/common/buf"
@@ -231,6 +232,7 @@ type AuthenticationWriter struct {
 	sizeParser   ChunkSizeEncoder
 	transferType protocol.TransferType
 	padding      PaddingLengthGenerator
+	mu           sync.Mutex
 }
 
 func NewAuthenticationWriter(auth Authenticator, sizeParser ChunkSizeEncoder, writer io.Writer, transferType protocol.TransferType, padding PaddingLengthGenerator) *AuthenticationWriter {
@@ -336,6 +338,8 @@ func (w *AuthenticationWriter) writePacket(mb buf.MultiBuffer) error {
 
 // WriteMultiBuffer implements buf.Writer.
 func (w *AuthenticationWriter) WriteMultiBuffer(mb buf.MultiBuffer) error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
 	if mb.IsEmpty() {
 		eb, err := w.seal([]byte{})
 		common.Must(err)