Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CopyCell allows concurrent use of non-Sync types through references #12

Open
ammaraskar opened this issue Nov 15, 2020 · 1 comment
Open

Comments

@ammaraskar
Copy link

Hi there, we (Rust group @sslab-gatech) are scanning crates on crates.io for potential soundness bugs. We noticed that the CopyCell object implements Send as long as the underlying type implements Copy.

However, one potential problem with this is that (non-mutable) references actually implement the Copy trait: https://doc.rust-lang.org/std/marker/trait.Copy.html#impl-Copy-71

This makes it possible, for example, to share Cells across threads by wrapping them in a CopyCell:

#![forbid(unsafe_code)]

use toolshed::CopyCell;

use std::cell::Cell;
use crossbeam_utils::thread;

fn main() {
    let cell = Cell::new(42);
    let copy_cell = CopyCell::new(&cell);

    thread::scope(|s| {
        s.spawn(move |_| {
            let smuggled_cell_ref = copy_cell.get();
            println!("Other Thread: {:p}", smuggled_cell_ref);
        });

        println!("Main Thread:  {:p}", &cell);
    });
}

Output:

Main Thread:  0x7ffe19babd1c
Other Thread: 0x7ffe19babd1c

Indicating that the same Cell is now usable across threads, potentially allowing for data races.

@ammaraskar ammaraskar changed the title CopyCell allows synchronous use of non-Sync types through references CopyCell allows concurrent use of non-Sync types through references Jan 19, 2021
@Shnatsel
Copy link

Heads up: this issue has been included in the RustSec advisory database. It will be surfaced by tools such as cargo-audit or cargo-deny from now on.

Once a fix is released to crates.io, please open a pull request to update the advisory with the patched version, or file an issue on the advisory database repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants