-
Notifications
You must be signed in to change notification settings - Fork 1
Closed
Description
Currently AtomicBox implements the Sync/Send traits unconditionally:
Lines 92 to 93 in 5abe752
| unsafe impl<T: Sized> Sync for AtomicBox<T> {} | |
| unsafe impl<T: Sized> Send for AtomicBox<T> {} |
I think this should only be when T: Sized + Sync and T: Sized + Send respectively. Otherwise, this makes it possible to send across types that aren't safe to use across threads such as Cells. Here's a demonstration that causes a data-race:
#![forbid(unsafe_code)]
use abox::AtomicBox;
use std::cell::Cell;
use crossbeam_utils::thread;
#[derive(Debug, Clone, Copy)]
enum RefOrInt<'a> { Ref(&'a u64), Int(u64) }
static SOME_INT: u64 = 123;
fn main() {
let cell = Cell::new(RefOrInt::Ref(&SOME_INT));
let atomic_box = AtomicBox::new(&cell);
thread::scope(|s| {
s.spawn(move |_| {
let smuggled_cell = atomic_box.get();
loop {
// Repeatedly write Ref(&addr) and Int(0xdeadbeef) into the cell.
smuggled_cell.set(RefOrInt::Ref(&SOME_INT));
smuggled_cell.set(RefOrInt::Int(0xdeadbeef));
}
});
loop {
if let RefOrInt::Ref(addr) = cell.get() {
// Hope that between the time we pattern match the object as a
// `Ref`, it gets written to by the other thread.
if addr as *const u64 == &SOME_INT as *const u64 {
continue;
}
// Due to the data race, obtaining Ref(0xdeadbeef) is possible
println!("Pointer is now: {:p}", addr);
println!("Dereferencing addr will now segfault: {}", *addr);
}
}
});
}This outputs:
Pointer is now: 0xdeadbeef
Return Code: -11 (SIGSEGV)
(Issue found by @sslab-gatech's Rust group)
SkarlettSkarlettSkarlett
Metadata
Metadata
Assignees
Labels
No labels