edarc / max7301 Goto Github PK

Hello fellow Rustacean,
we (Rust group @sslab-gatech) found a memory-safety/soundness issue in this crate while scanning Rust code on crates.io for potential vulnerabilities.

Issue Description

ImmediateIO and TransactionIO implement Sync for M: IOMutex<Expander<EI>>, EI: ExpanderInterface. This bound is seemingly unsound; it allows to send a reference of ImmediateIO or TransactionIO to another thread, and from there a mutable reference of Expander<EI> can be accessed through IOMutex APIs. This could result in a thread-safety violation when EI is a non-Send type.

We suggest to add an Expander<EI>: Send bound (or an equivalent EI: Send bound) to those Sync implementations, following the stdlib Mutex's Sync implementation.