Go version

go version go1.23.2 X:nocoverageredesign linux/amd64

Output of go env in your module/workspace:

GO111MODULE='off'
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/user/.cache/go-build'
GOENV='/home/user/.config/go/env'
GOEXE=''
GOEXPERIMENT='nocoverageredesign'
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/user/go-code/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/user/go-code'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/home/user/.cache/bazel/_bazel_ingo/b97476d719d716accead0f2d5b93104f/external/go_sdk'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/home/user/.cache/bazel/_bazel_ingo/b97476d719d716accead0f2d5b93104f/external/go_sdk/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.2 X:nocoverageredesign'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/user/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD=''
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1264229664=/tmp/go-build -gno-record-gcc-switches'

What did you do?

When a call to AllowN(t, n) succeeds, it always sets lim.last to t, even if t is before lim.last. This allows the rate limit to be exceeded: https://go.dev/play/p/uR8KvkVJGN8

Clearly this is a bug in line 389, where t should be updated to lim.last.

In practice, since calls to Allow call time.Now() before acquiring the limiter's lock, high lock contention increases the likelihood of AllowN being called with a time in the past, thus resetting lim.last to a past time and allowing more tokens to be acquired.

What did you see happen?

When calling Allow with many concurrent goroutines, the rate limit can easily be exceeded by a factor 5000.
For instance, 10k goroutines accessing Allow with a rate limit of 200 for 10 seconds produces something like:
Ok: 1445521
Block: 15612127
(in my test, goroutines sleep for ~25ms after Allow succeeds, and exponentially back off with 5/15/45/135/...ms on failures)

What did you expect to see?

After fixing the bug, I observed this:
Ok: 2992
Block: 16271193
I expected OK to be ~2000 (rate limit of 200 for 10 seconds), but this is much better then with the bug.