cloudflare / cloudflare/pingora
TinyUfo: evict race condition updating weights
- Dominant language
- Rust
- Stars
- 27.4k
- Forks
- 1.7k
- Avg merge
- 6h 22m
- Merged PRs (30d)
- 3
Description
## Describe the bug
An race condition exists while updating weights. Where one thread pushes an small Item while an concurrent thread evict that item before weight's added. Leading to an USize underflow which leads to `add with overflow` in evict_to_limit.
## TinyUfo info
**TinyUfo**: 0.6.0
**Rust version**: cargo 1.91.1 (ea2d97820 2025-10-10)
**Operating system version**: Debian 12.4
## Steps to reproduce
```rust
use tinyufo::TinyUfo;
use std::sync::Arc;
fn explode(id: usize, ufo: Arc>) {
let keys =(0..5).map(|keyid|format!("{}_{}", id, keyid)).collect::>();
let cnt = 0;
loop {
let value = format!("V_{}", cnt);
for key in &keys {
ufo.put(key.clone(), value.clone(), 1);
ufo.get(key); ufo.get(key);
}
}
}
fn main() {
let tufo = Arc::new(TinyUfo::::new(5, 5));
for n in 0..100 {
let myufo = tufo.clone();
let thread = std::thread::spawn(move || {
explode(n, myufo)
});
if n == 99 {
let _ = thread.join();
};
}
}
```
## Observed results
```
thread '' (2692814) panicked at tinyufo/src/lib.rs:248:15:
attempt to add with overflow
stack backtrace:
0: __rustc::rust_begin_unwind
at /rustc/07bdbaedc63094281483c40a88a1a8f2f8ffadc5/library/std/src/panicking.rs:690:5
1: core::panicking::panic_fmt
at /rustc/07bdbaedc63094281483c40a88a1a8f2f8ffadc5/library/core/src/panicking.rs:80:14
2: core::panicking::panic_const::panic_const_add_overflow
at /rustc/07bdbaedc63094281483c40a88a1a8f2f8ffadc5/library/core/src/panicking.rs:175:17
3: tinyufo::FiFoQueues::evict_to_limit
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/TinyUFO-0.6.0/src/lib.rs:255:15
4: tinyufo::FiFoQueues::admit
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/TinyUFO-0.6.0/src/lib.rs:189:40
5: tinyufo::TinyUfo::put
at /usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/TinyUFO-0.6.0/src/lib.rs:424:21
```
Contributor guide
Assessment
This issue has not been assessed yet.