An unvalidated futex waiter can consume wake(1) while a validated waiter remains blocked
@CvvT is already working on this.
Since Sep 2, 2026.
Assessment
This issue has not been assessed yet.
Description
One subtle issue found by Specula:
FutexManager::wait inserts a waiter into the futex bucket before it validates that the futex word still equals the expected value. FutexManager::wake(count=1) scans and counts matching queue entries without knowing whether a selected waiter has passed that validation. As a result, an unvalidated waiter can consume the single wake quota, return ImmediatelyWokenBecauseValueMismatch, and leave a validated waiter blocked.
See the full report for more details.
According to copilot, Linux uses a two-stage approach:
- Under the bucket lock, perform a no-fault read.
- If it faults, release the lock.
- Perform a normal fault-capable read to bring the page in.
- Reacquire the lock and repeat the comparison.
- Enqueue only while still holding that lock.
LiteBox currently inserts and then checks without holding the list lock across both operations, which avoids missed wakes but introduces the wake-consumption race we identified. LoanList already has a per-bucket mutex; its API just does not expose atomic check-and-insert. A robust LiteBox fix likely needs a distinct read_no_fault() operation. Using the existing read_at_offset() under the LoanList lock requires guaranteeing that it cannot block or re-enter lock-dependent code.
- Dominant language
- Rust
- Stars
- 2.7k
- Forks
- 144
- Avg merge
- 12h 21m
- Merged PRs (30d)
- 146
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/litebox
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
All issues in microsoft/litebox
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gitbutlerapp/gitbutler#15998 · 1 comment ·
-
bug triage:deciding
Difficulty 1/5 Under an hour Newbie friendliness 88/100
open-telemetry/otel-arrow#4132 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100