Skip to content

Race leads to panic in oneshot::Sender::send() #4225

Closed
@acfoltzer

Description

@acfoltzer

Version

Reproduced with tokio 1.12.0 and 1.13.0

Platform

Linux hostname 5.11.0-38-generic #42~20.04.1-Ubuntu SMP Tue Sep 28 20:41:07 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

Description

There is a race between send(), try_recv(), and oneshot::Receiver::close(). The following program yields a panic roughly every 3 seconds on my 18c/36t workstation, compiled with Rust 1.56.1 in release mode:

#[tokio::main]
async fn main() {
    loop {
        let (tx, mut rx) = tokio::sync::oneshot::channel();
        tokio::spawn(async move {
            let _ = tx.send(());
        });
        tokio::spawn(async move {
            rx.close();
            let _ = rx.try_recv();
        });
    }
}

All of the panics occur when send() attempts inner.consume_value().unwrap(). For example:

thread 'tokio-runtime-worker' panicked at 'called `Option::unwrap()` on a `None` value', /home/acfoltzer/.cargo/registry/src/github.com-1ecc6299db9ec823/tokio-1.13.0/src/sync/oneshot.rs:498:50

I suspect this is a race where the rx.close(); rx.try_recv() happens between the if !inner.complete() check and the inner.consume_value().unwrap().

Metadata

Metadata

Assignees

Labels

A-tokioArea: The main tokio crateC-bugCategory: This is a bug.I-crashProblems and improvements related to program crashes/panics.I-unsound 💥A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessM-syncModule: tokio/sync

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions