CopyCell allows concurrent use of non-Sync types through references

[ammaraskar]

Hi there, we (Rust group @sslab-gatech) are scanning crates on crates.io for potential soundness bugs. We noticed that the CopyCell object implements Send as long as the underlying type implements Copy.

However, one potential problem with this is that (non-mutable) references actually implement the Copy trait: https://doc.rust-lang.org/std/marker/trait.Copy.html#impl-Copy-71

This makes it possible, for example, to share Cells across threads by wrapping them in a CopyCell:

#![forbid(unsafe_code)]

use toolshed::CopyCell;

use std::cell::Cell;
use crossbeam_utils::thread;

fn main() {
    let cell = Cell::new(42);
    let copy_cell = CopyCell::new(&cell);

    thread::scope(|s| {
        s.spawn(move |_| {
            let smuggled_cell_ref = copy_cell.get();
            println!("Other Thread: {:p}", smuggled_cell_ref);
        });

        println!("Main Thread:  {:p}", &cell);
    });
}

Output:

Main Thread:  0x7ffe19babd1c
Other Thread: 0x7ffe19babd1c

Indicating that the same Cell is now usable across threads, potentially allowing for data races.

[Shnatsel]

Heads up: this issue has been included in the RustSec advisory database. It will be surfaced by tools such as cargo-audit or cargo-deny from now on.

Once a fix is released to crates.io, please open a pull request to update the advisory with the patched version, or file an issue on the advisory database repository.