You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on May 10, 2022. It is now read-only.
Hi there, we (Rust group @sslab-gatech) are scanning crates on crates.io for potential soundness bugs. We noticed that the Queue object implements Send and Sync unconiditionally:
However, this should probably be bounded by T: Send in both, otherwise it allows sending types that should never be sent across threads such as Rc or references to cells. You can see an example of such a data-race with cells below:
#![forbid(unsafe_code)]use scottqueue::tlqueue::Queue;use std::cell::Cell;use crossbeam_utils::thread;// A simple tagged union used to demonstrate problems with data races in Cell.#[derive(Debug,Clone,Copy)]enumRefOrInt{Ref(&'static u64),Int(u64)}staticSOME_INT:u64 = 123;fnmain(){let cell = Cell::new(RefOrInt::Ref(&SOME_INT));let queue = Queue::new();
queue.push(&cell);
thread::scope(|s| {
s.spawn(|_| {let smuggled_cell = queue.pop().unwrap();loop{// Repeatedly write Ref(&addr) and Int(0xdeadbeef) into the cell.
smuggled_cell.set(RefOrInt::Ref(&SOME_INT));
smuggled_cell.set(RefOrInt::Int(0xdeadbeef));}});loop{ifletRefOrInt::Ref(addr) = cell.get(){// Hope that between the time we pattern match the object as a// `Ref`, it gets written to by the other thread.if addr as*constu64 == &SOME_INTas*constu64{continue;}println!("Pointer is now: {:p}", addr);println!("Dereferencing addr will now segfault: {}", *addr);}}});}
This outputs:
Pointer is now: 0xdeadbeef
Return Code: -11 (SIGSEGV)
The text was updated successfully, but these errors were encountered:
Once a fix is released to crates.io, please open a pull request to update the advisory with the patched version, or file an issue on the advisory database repository.
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Hi there, we (Rust group @sslab-gatech) are scanning crates on crates.io for potential soundness bugs. We noticed that the
Queue
object implementsSend
andSync
unconiditionally:rust-scottqueue/src/tlqueue.rs
Lines 27 to 28 in 875491d
However, this should probably be bounded by
T: Send
in both, otherwise it allows sending types that should never be sent across threads such asRc
or references to cells. You can see an example of such a data-race with cells below:This outputs:
The text was updated successfully, but these errors were encountered: