rust-embedded / rust-embedded/heapless
Possible data race in the iteration of Stack's pop and UnionNode
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 2k
- Forks
- 253
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 1
Description
I will use the code from the LL-SC implementation, but the same applies to the CAS one.
Between the head load in line 89 and the read to get the next pointer in line 95, another thread could have started and successfully finished a try_pop. Back to the first thread, now the top points to an in-use node that can be written to, since the storage for the next pointer and the data are the same (i.e. it's an union) we now get a data race.
I will try to trigger it with loom and miri and then try to come up with a fix. The simplest solution seems to replace the UnionNode with StructNode. However, I hope I can find a solution that doesn't incur in more memory usage, specially since I was the one that came up with the union suggestion years ago...
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked src/pool/treiber/llsc.rs lines 84-116 and compare the corresponding CAS implementation, focusing on the head load and next-pointer read described in the report. Use loom and miri to reproduce or validate the suspected race; done means the iteration is race-free without an unresolved memory-safety regression.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- distributed-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100