Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Queue needs bounds on its Send/Sync traits #88

Closed
ammaraskar opened this issue Nov 10, 2020 · 2 comments
Closed

Queue needs bounds on its Send/Sync traits #88

ammaraskar opened this issue Nov 10, 2020 · 2 comments

Comments

@ammaraskar
Copy link

Currently, it is possible to use mpsc_list::Queue and mpsc_list_v1::Queue to send across types that aren't safe to use in other threads. Due to the guarantee about there only being one popper, I think it should be Send/Sync when T is Send. Here's a demonstration with a data race using Cells:

#![forbid(unsafe_code)]

use may_queue::mpsc_list::Queue;

use std::cell::Cell;
use crossbeam_utils::thread;

#[derive(Debug, Clone, Copy)]
enum RefOrInt<'a> {
    Ref(&'a u64),
    Int(u64),
}
static SOME_INT: u64 = 123;

fn main() {
    let cell = Cell::new(RefOrInt::Ref(&SOME_INT));
    let queue = Queue::new();
    queue.push(&cell);

    thread::scope(|s| {
        s.spawn(move |_| {
            let smuggled_cell = queue.pop().unwrap();

            loop {
                // Repeatedly write Ref(&addr) and Int(0xdeadbeef) into the cell.
                smuggled_cell.set(RefOrInt::Ref(&SOME_INT));
                smuggled_cell.set(RefOrInt::Int(0xdeadbeef));
            }
        });

        loop {
            if let RefOrInt::Ref(addr) = cell.get() {
                // Hope that between the time we pattern match the object as a
                // `Ref`, it gets written to by the other thread.
                if addr as *const u64 == &SOME_INT as *const u64 {
                    continue;
                }

                // Due to the data race, obtaining Ref(0xdeadbeef) is possible
                println!("Pointer is now: {:p}", addr);
                println!("Dereferencing addr will now segfault: {}", *addr);
            }
        }
    });
}

which outputs:

Pointer is now: 0xdeadbeef

Return Code: -11 (SIGSEGV)

(Issue found by Rust group at @sslab-gatech)

@Xudong-Huang
Copy link
Owner

this should be fixed in release 0.3.19

@Xudong-Huang
Copy link
Owner

this should be fixed in release 0.3.19

VorpalBlade added a commit to VorpalBlade/advisory-db that referenced this issue Oct 25, 2024
According to Xudong-Huang/may#88, this has been fixed since a long time. Add the missing `patched`
alex pushed a commit to rustsec/advisory-db that referenced this issue Oct 25, 2024
According to Xudong-Huang/may#88, this has been fixed since a long time. Add the missing `patched`
VorpalBlade added a commit to VorpalBlade/advisory-db that referenced this issue Oct 25, 2024
According to Xudong-Huang/may#88, this was fixed in 0.3.19,
but that refers to the main "may" crate. The correct version for the "may_queue" sub crate
is 0.1.8 (based on manual checking the bounds for the affected type on docs.rs)
alex pushed a commit to rustsec/advisory-db that referenced this issue Oct 25, 2024
According to Xudong-Huang/may#88, this was fixed in 0.3.19,
but that refers to the main "may" crate. The correct version for the "may_queue" sub crate
is 0.1.8 (based on manual checking the bounds for the affected type on docs.rs)
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants