Soundness Bug in this crate because of Data Race

[lewismosciski]

Hi there!

We scanned the most popular libraries on crates.io and found some memory safety bugs in this library.

arc_str::ArcStr::leak

PoC

use arcstr::ArcStr;
use std::sync::{Arc, Barrier};
use std::thread;

fn main() {
    // Share one dynamic ArcStr across threads.
    let shared = Arc::new(ArcStr::try_alloc("AAAAAAAA").unwrap());

    let iters = 200usize;
    let start = Arc::new(Barrier::new(3));

    // Two threads race calling the safe public entry `ArcStr::leak(&self)`.
    // A third thread perturbs the refcount by cloning/dropping.
    let t_leak1 = {
        let s = shared.clone();
        let b = start.clone();
        thread::spawn(move || {
            b.wait();
            let mut acc = 0usize;
            for _ in 0..iters {
                let st: &'static str = s.leak(); // entry_call
                acc ^= st.as_bytes()[0] as usize;
                thread::yield_now();
            }
            acc
        })
    };

    let t_leak2 = {
        let s = shared.clone();
        let b = start.clone();
        thread::spawn(move || {
            b.wait();
            let mut acc = 0usize;
            for _ in 0..iters {
                let st: &'static str = s.leak(); // entry_call
                acc ^= st.len();
                thread::yield_now();
            }
            acc
        })
    };

    let t_churn = {
        let s = shared.clone();
        let b = start.clone();
        thread::spawn(move || {
            b.wait();
            for _ in 0..iters {
                let tmp1 = s.clone();
                let tmp2 = tmp1.clone();
                drop(tmp2);
                drop(tmp1);
                thread::yield_now();
            }
        })
    };

    start.wait();
    let _ = t_churn.join();
    let _ = t_leak1.join();
    let _ = t_leak2.join();
}

Miri Output

error: Undefined Behavior: Data race detected between (1) non-atomic write on thread `unnamed-2` and (2) non-atomic read on thread `unnamed-1` at alloc406
    --> /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/arcstr/1.2.0/arcstr-1.2.0/src/arc_str.rs:1293:9
     |
1293 |         *p.cast()
     |         ^^^^^^^^^ (2) just happened here
     |
help: and (1) occurred earlier here
    --> src/main.rs:40:40
     |
  40 |                 let st: &'static str = s.leak(); // entry_call
     |                                        ^^^^^^^^
     = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
     = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
     = note: BACKTRACE (of the first span) on thread `unnamed-1`:
     = note: inside `arcstr::arc_str::ThinInner::get_len_flag` at /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/arcstr/1.2.0/arcstr-1.2.0/src/arc_str.rs:1293:9: 1293:18
     = note: inside `arcstr::ArcStr::get_inner_len_flag` at /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/arcstr/1.2.0/arcstr-1.2.0/src/arc_str.rs:334:18: 334:58
     = note: inside `arcstr::ArcStr::has_static_lenflag` at /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/arcstr/1.2.0/arcstr-1.2.0/src/arc_str.rs:672:9: 672:34
     = note: inside `arcstr::ArcStr::leak` at /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/arcstr/1.2.0/arcstr-1.2.0/src/arc_str.rs:569:12: 569:42
note: inside closure
    --> src/main.rs:25:40
     |
  25 |                 let st: &'static str = s.leak(); // entry_call
     |                                        ^^^^^^^^

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error

We appreciate your work on this crate and hope this report helps improve its safety.