-
Notifications
You must be signed in to change notification settings - Fork 0
Update Rust crate tokio to v1 [SECURITY] #25
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
d8581ad to
b38a44c
Compare
b38a44c to
09c2104
Compare
09c2104 to
75dbe53
Compare
ffee1e1 to
1924e14
Compare
1924e14 to
ecc447e
Compare
ecc447e to
724aec0
Compare
724aec0 to
4f8e5a3
Compare
4f8e5a3 to
b5e2143
Compare
b5e2143 to
71790fd
Compare
71790fd to
f86d778
Compare
f86d778 to
6ef2b16
Compare
6ef2b16 to
4bceacb
Compare
⚠ Artifact update problemRenovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below: File name: Cargo.lock |
4bceacb to
256e402
Compare
|
This PR contains the following updates:
0.2->1.0GitHub Vulnerability Alerts
GHSA-4q83-7cq4-p6wg
tokio::io::ReadHalf<T>::unsplitcan violate thePincontractThe soundness issue is described in the tokio/issues#5372
Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf)
is unusual, combined with the difficulty of making any arbitrary use-after-free
exploitable in Rust without doing a lot of careful alignment of data types in
the surrounding code.
The
tokiofeatureio-utilis also required to be enabled to trigger thissoundness issue.
Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e
and carllerche appropriately responding and fixing the soundness bug.
Tokio before 0.2.0 used
futures0.1 that did not havePin, so it is notaffected by this issue.
CVE-2021-45710
If a tokio::sync::oneshot channel is closed (via the oneshot::Receiver::close method), a data race may occur if the oneshot::Sender::send method is called while the corresponding oneshot::Receiver is awaited or calling try_recv.
When these methods are called concurrently on a closed channel, the two halves of the channel can concurrently access a shared memory location, resulting in a data race. This has been observed to cause memory corruption.
Note that the race only occurs when both halves of the channel are used after the Receiver half has called close. Code where close is not used, or where the Receiver is not awaited and try_recv is not called after calling close, is not affected.
GHSA-rr8g-9fpq-6wmg
The broadcast channel internally calls
cloneon the stored value when receiving it, and only requiresT:Send. This means that using the broadcast channel with values that areSendbut notSynccan trigger unsoundness if thecloneimplementation makes use of the value being!Sync.Thank you to Austin Bonander for finding and reporting this issue.
Release Notes
tokio-rs/tokio (tokio)
v1.18.5Compare Source
v1.18.4Compare Source
v1.18.3: Tokio v1.18.3Compare Source
1.18.3 (September 27, 2022)
This release removes the dependency on the
once_cellcrate to restore the MSRV of the 1.18.x LTS release. (#5048)v1.18.2: Tokio v1.18.2Compare Source
1.18.2 (May 5, 2022)
Add missing features for the
winapidependency. (#4663)v1.18.1: Tokio v1.18.1Compare Source
1.18.1 (May 2, 2022)
The 1.18.0 release broke the build for targets without 64-bit atomics when building with
tokio_unstable. This release fixes that. (#4649)v1.18.0: Tokio v1.18.0Compare Source
1.18.0 (April 27, 2022)
This release adds a number of new APIs in
tokio::net,tokio::signal, andtokio::sync. In addition, it adds new unstable APIs totokio::task(Idsfor uniquely identifying a task, and
AbortHandlefor remotely cancelling atask), as well as a number of bugfixes.
Fixed
#[track_caller]forspawn_blocking(#4616)selectmacro to process 64 branches (#4519)try_iomethods not calling Mio'stry_iointernally (#4582)Added
UdpSocket::peer_addr(#4611)try_read_bufmethod for named pipes (#4626)SignalKindHash/Eqimpls andc_intconversion (#4540)SIGRTMAX(#4555)watch::Sender::send_modifymethod (#4310)broadcast::Receiver::lenmethod (#4542)watch::Receiver::same_channelmethod (#4581)CloneforRecvErrortypes (#4560)Changed
mioto 0.8.1 (#4582)tokio::select!'s internalutilmodule (#4543)Vec::with_capacitywhen building runtime (#4553)Documented
tokio_unstable(#4524)Handle::current's docs to mentionEnterGuard(#4567)Signal::recvis cancel-safe (#4634)UnboundedReceiverclose docs (#4548)Unstable
The following changes only apply when building with
--cfg tokio_unstable:task::Idtype (#4630)AbortHandletype for cancelling tasks in aJoinSet(#4530],[#4640)
doc(cfg(...))attributes forJoinSet(#4531)AbortHandleRustDoc (#4545)v1.17.0: Tokio v1.17.0Compare Source
1.17.0 (February 15, 2022)
This release updates the minimum supported Rust version (MSRV) to 1.49,
the
miodependency to v0.8, and the (optional)parking_lotdependency to v0.12. Additionally, it contains several bug fixes, as
well as internal refactoring and performance improvements.
Fixed
sleepwith large durations (#4495)Instantarithmetic on platformswhere
Instant::nowis not monotonic (#4461)DuplexStreamnot participating in cooperative yielding(#4478)
JoinHandle(#4430)Changed
parking_lotdependency to v0.12.0 (#4459)miodependency to v0.8 (#4449)(#4480)
std::future::Readyinstead of our ownReadyfuture(#4271)
atomic::spin_loop_hintwithhint::spin_loop(#4491)
Documented
tokio::process::ChildStdin(#4479)Unstable
The following changes only apply when building with
--cfg tokio_unstable:tracingspans generated byspawn_local(#4483)JoinSetfor managing sets of tasks (#4335)v1.16.1: Tokio v1.16.1Compare Source
1.16.1 (January 28, 2022)
This release fixes a bug in #4428 with the change #4437.
v1.16.0: Tokio v1.16.0Compare Source
Fixes a soundness bug in
io::Take(#4428). The unsoundness is exposed whenleaking memory in the given
AsyncReadimplementation and then overwriting thesupplied buffer:
Also, this release includes improvements to the multi-threaded scheduler that
can increase throughput by up to 20% in some cases (#4383).
Fixed
io::Takein edge case (#4428)File::writeresults in awritesyscall when the runtime shuts down (#4316)wait_with_output(#4315)Sendfromparking_lot::*Guard(#4359)Added
TcpSocket::linger()andset_linger()(#4324)UnwindSafefor socket types (#4384)UnwindSafeforJoinHandle(#4418)watch::Receiver::has_changed()(#4342)oneshot::Receiver::blocking_recv()(#4334)RwLockblocking operations (#4425)Unstable
The following changes only apply when building with
--cfg tokio_unstablev1.15.0: Tokio v1.15.0Compare Source
Fixed
io::empty()(#4300)Changed
Added
Interval::reset()(#4248)AsyncFdReadyGuard(#4267)Command::as_std()(#4295)Added (unstable)
tokio::synctypes (#4302)v1.14.1: Tokio v1.14.1Compare Source
This release backports a bug fix from 1.16.1
Fixes a soundness bug in
io::Take(#4428). The unsoundness is exposed whenleaking memory in the given
AsyncReadimplementation and then overwriting thesupplied buffer:
Fixed
io::Takein edge case (#4428)v1.14.0: Tokio v1.14.0Compare Source
1.14.0 (November 15, 2021)
Fixed
mutpatterns inselect!(#4211)oneshot::Sender::sendand awaiting aoneshot::Receiverwhen the oneshot has been closed (#4226)AtomicWakerpanic safe (#3689)(#4213)
Added
RuntimeStats::busy_duration_total(#4179, #4223)Changed
copybuffer size to matchstd::io::copy(#4209)Documented
v1.13.1: Tokio v1.13.1Compare Source
1.13.1 (November 15, 2021)
This release fixes a data race when sending and receiving on a
closed
oneshotchannel (RUSTSEC-2021-0124).Fixed
oneshot::Sender::sendand awaiting aoneshot::Receiverwhen the oneshot has been closed (#4226)v1.13.0: Tokio v1.13.0Compare Source
1.13.0 (October 29, 2021)
Fixed
Notifyto clone the waker before locking its waiter list (#4129)Added
poll_{recv,send}_readymethods toudpanduds_datagram(#4131)try_*,readable,writable,ready, andpeer_addrmethods to split halves (#4120)blocking_locktoMutex(#4130)watch::Sender::send_replace(#3962, #4195)DebugforMutex<T>impl to unsizedT(#4134)Changed
copy_bidirectionalthatpoll_writeis sensible (#4125)select!(#4192)block_onwakeups better (#4157)Documented
try_join!(#4133)tokio/src/lib.rs(#4132)Interval::tickcancel safety (#4152)v1.12.0: Tokio v1.12.0Compare Source
1.12.0 (September 21, 2021)
Fixed
try_reserveerror is consistent withtry_send(#4119)spin_loop_hintinstead ofyield_now(#4115)SendErrorfield public (#4097)Added
AsyncSeekExt::rewind(#4107)block_onfutures (#4094)try_recvfor mpsc channels (#4113)Changed
LocalSetwhen using macro (#4027)Documented
poll_recv(#4117)PollSenderimplsSink(#4110)yield_now(#4091)v1.11.0: Tokio v1.11.0Compare Source
1.11.0 (August 31, 2021)
Fixed
fill_bufby not callingpoll_fill_buftwice (#4084)Added
watch::Sender::subscribe(#3800)from_stdtoChildStd*(#4045)Changed
Documented
v1.10.1: Tokio v1.10.1Compare Source
1.10.1 (August 24, 2021)
Fixed
v1.10.0: Tokio v1.10.0Compare Source
1.10.0 (August 12, 2021)
Added
(read|write)_f(32|64)[_le]methods (#4022)fill_bufandconsumetoAsyncBufReadExt(#3991)Child::raw_handle()on windows (#3998)Fixed
--cfg docsrs(#4020)io::copy(#4001)spin_loop_hintinstead ofyield_nowin mpsc (#4037)Changes
Documented
AsyncBufReadExt(#3997)watch::sendfails (#4021)v1.9.0: Tokio v1.9.0Compare Source
1.9.0 (July 19, 2021)
Added
TcpStream(#3888)TaskLocal::scope(#3273)Fixed
LocalSet(#3978)Changes
OnceCell(#3945)JoinError(#3959)v1.8.5: Tokio v1.8.5Compare Source
This release backports a bug fix from 1.16.1
Fixes a soundness bug in
io::Take(#4428). The unsoundness is exposed whenleaking memory in the given
AsyncReadimplementation and then overwriting thesupplied buffer:
Fixed
io::Takein edge case (#4428)v1.8.4: Tokio v1.8.4Compare Source
1.8.4 (November 15, 2021)
This release backports a bugfix for a data race when sending and receiving on a
closed
oneshotchannel ([RUSTSEC-2021-0124]) from v1.13.1.Fixed
oneshot::Sender::sendand awaiting aoneshot::Receiverwhen the oneshot has been closed (#4226)v1.8.3: Tokio v1.8.3Compare Source
1.8.3 (July 22, 2021)
This release backports two fixes from 1.9.0
Fixed
LocalSet(#3978)v1.8.2: Tokio 1.8.2Compare Source
Fixes a missed edge case from 1.8.1.
Fixed
v1.8.1: Tokio 1.8.1Compare Source
Forward ports 1.5.1 fixes.
Fixed
JoinHandle::abort(#3934)v1.8.0Compare Source
1.8.0 (July 2, 2021)
Added
get_{ref,mut}methods toAsyncFdReadyGuardandAsyncFdReadyMutGuard(#3807)BufWriter(#3163)NamedPipe{Client,Server}(#3866, #3899)watch::Receiver::borrow_and_update(#3813)From<T>forOnceCell<T>(#3877)Added (unstable)
tokio::task::Builder(#3881)Fixed
UnixStream(#3898)Documented
v1.7.3: Tokio 1.7.3Compare Source
Fixes a missed edge case from 1.7.2.
Fixed
v1.7.2: Tokio v1.7.2Compare Source
Forward ports 1.5.1 fixes.
Fixed
JoinHandle::abort(#3934)v1.7.1: Tokio v1.7.1Compare Source
Fixed
v1.7.0: Tokio v1.7.0Compare Source
1.7.0 (June 15, 2021)
Added
TcpSocketfromstd::net::TcpStreamconversion (#3838)receiver_counttowatch::Sender(#3729)sync::notify::Notifiedfuture publicly (#3840)Fixed
clippy::default_numeric_fallbacklint in generated code (#3831)mpsc::RecvErrortype (#3833)Documented
AsyncReadExt::read_buf(#3850)AsyncWrite::poll_write(#3820)v1.6.4: Tokio 1.6.4Compare Source
Fixes a missed edge case from 1.6.3.
Fixed
v1.6.3: Tokio v1.6.3Compare Source
Forward ports 1.5.1 fixes.
Fixed
JoinHandle::abort(#3934)v1.6.2: Tokio v1.6.2Compare Source
Fixes
time:advanceregression introduced in 1.6 (#3852)v1.6.1: Tokio v1.6.1Compare Source
This release reverts #3518 because it doesn't work on some kernels due to
a kernel bug. (#3803)
v1.6.0: Tokio v1.6.0Compare Source
1.6.0 (May 14, 2021)
Added
write_all_buftoAsyncWriteExt(#3737)AsyncSeekforBufReader,BufWriter, andBufStream(#3491)mpsc::Sender::{reserve_owned, try_reserve_owned}(#3704)MutexGuard::mapmethod that returns aMappedMutexGuard(#2472)Fixed
DuplexStreamclose (#3756)std::os::raw::c_intinstead oflibc::c_inton public API (#3774)notify_waiters(#3660)JoinHandlepanic message (#3727)time::advancefrom going too far (#3712)Documented
net::unix::datagrammodule from docs (#3775)Barrierdoc should use task, not thread (#3780)block_in_place(#3753)v1.5.1: Tokio v1.5.1Compare Source
Fixed
JoinHandle::abort(#3934)v1.5.0: Tokio v1.5.0Compare Source
1.5.0 (April 12, 2021)
Added
AsyncSeekExt::stream_position(#3650)AsyncWriteExt::write_vectored(#3678)copy_bidirectionalutility (#3572)IntoRawFdforTcpSocket(#3684)OnceCell(#3591)OwnedRwLockReadGuardandOwnedRwLockWriteGuard(#3340)Semaphore::is_closed(#3673)mpsc::Sender::capacity(#3690)RwLockmax reads (#3644)sync_scopeforLocalKey(#3612)Fixed
noaliasattributes on intrusive linked list (#3654)JoinHandle::abort()when called from other threads (#3672)oneshot::try_recv(#3674)Semaphorepermit overflow calculation (#3644)Documented
AsyncFd(#3635){Handle,Runtime}::block_on(#3628)Semaphoreis fair (#3693)v1.4.0: Tokio v1.4.0Compare Source
Added
select!(#3603)Handle::block_on(#3569)Fixed
block_onfuture (#3582)EnterGuardwithmust_use(#3609)Documented
PollSender(#3613)MutexFIFO explanation (#3615)v1.3.0: Tokio v1.3.0Compare Source
Added
unconstrained()opt-out (#3547)into_stdfor net types without it (#3509)same_channelmethod tompsc::Sender(#3532){try_,}acquire_many_ownedtoSemaphore(#3535)RwLockWriteGuard::mapandRwLockWriteGuard::try_map(#3348)Fixed
oneshot::Receiver::closeafter successfultry_recv(#3552)timeout(Duration::MAX)(#3551)Documented
read_until(#3536)AsyncRead::poll_readdoc (#3557)UdpSocketsplitting doc (#3517)LocalSetonnew_current_thread(#3508)join_allforBarrier(#3514)oneshot(#3592)notifytonotify_one(#3526)Sleepdoc (#3515)interval.rsandtime/mod.rsdocs (#3533)v1.2.0: Tokio v1.2.0Compare Source
Added
Signal::poll_recvmethod public (#3383)Fixed
test-utilpaused time fully deterministic (#3492)Documented
v1.1.1: Tokio v1.1.1Compare Source
Forward ports 1.0.3 fix.
Fixed
v1.1.0: Tokio v1.1.0Compare Source
Added
try_read_bufandtry_recv_buf(#3351)Sender::try_reservefunction (#3418)RwLocktry_readandtry_writemethods (#3400)ReadBuf::inner_mut(#3443)Changed
select!error message (#3352)read_to_end(#3426)Fixed
LocalSetonspawn_local(#3369)Documented
Streamwrappers intokio-stream(#3343)test-utilfeature is not enabled with full (#3397)AsyncFddocs about changes of the inner fd (#3430)Sleepis notUnpin(#3457)PollSemaphore(#3456)LocalSetexample (#3438)mpscdocumentation (#3458)v1.0.3: Tokio v1.0.3Compare Source
Fixed
v1.0.2: Tokio v1.0.2Compare Source
Fixed
read_to_end(#3428).v1.0.1: Tokio v1.0.1Compare Source
This release fixes a soundness hole caused by the combination of
RwLockWriteGuard::mapandRwLockWriteGuard::downgradeby removing themapfunction. This is a breaking change, but breaking changes are allowed under our semver policy when they are required to fix a soundness hole. (See this RFC for more.)Note that we have chosen not to do a deprecation cycle or similar because Tokio 1.0.0 was released two days ago, and therefore the impact should be minimal.
Due to the soundness hole, we have also yanked Tokio version 1.0.0.
Removed
RwLockWriteGuard::mapandRwLockWriteGuard::try_map(#3345)Fixed
v1.0.0: Tokio v1.0.0Compare Source
Commit to the API and long-term support.
Announcement and more details.
Fixed
watch(#3234).Changed
AsyncFd::with_io()totry_io()(#3306)*Exttraits in favor of conditionally defining the fn (#3264).Sleepis!Unpin(#3278).SocketAddrby value (#3125).TcpStream::poll_peektakesReadBuf(#3259).runtime::Builder::max_threads()tomax_blocking_threads()(#3287).current_threadruntime when callingtime::pause()(#3289).Removed
tokio::prelude(#3299).AsyncFd::with_poll()(#3306).{Tcp,Unix}Stream::shutdown()in favor ofAsyncWrite::shutdown()(#3298).tokio-streamuntilStreamis added tostd(#3277).try_recv()due to unexpected behavior (#3263).tracing-coreis not 1.0 yet (#3266).Added
poll_*fns toDirEntry(#3308).poll_*fns toio::Lines,io::Split(#3308)._mutmethod variants toAsyncFd(#3304).poll_*fns toUnixDatagram(#3223).UnixStreamreadiness and non-blocking ops (#3246).UnboundedReceiver::blocking_recv()(#3262).watch::Sender::borrow()(#3269).Semaphore::close()(#3065).poll_recvfns tompsc::Receiver,mpsc::UnboundedReceiver(#3308).poll_tickfn totime::Interval(#3316).v0.3.7Compare Source
v0.3.6: Tokio v0.3.6[Compare Source](
Configuration
📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.