(Actually) remove incorrect `*mut` cast in net-tokio
What the developer wrote
Authored by Matt Corallo
(Actually) remove incorrect `*mut` cast in net-tokio
In ae62fa377a0a139d937ce2c7d87d3eb1612732af we removed an incorrect
`&mut`, but failed to actually resolve the mut aliasing bug - there
remained a deref of a `*mut` which is similarly invalid. Here we
actually fix the bug and also DRY up code marginally.
Reported by Project Loupe.
What changed, and why it matters
This commit fixes a Rust unsafe-code bug in the lightning-net-tokio networking module. The previous patch removed an `&mut` reference but left a `*mut` pointer dereference that still created aliasing mutable access to the same memory, which is undefined behavior in Rust. The fix removes the duplicate unsafe dereference and reuses an existing safe helper function instead. The bug was reported by Project Loupe, an external security research group.
Treat as a security-relevant correctness fix. Users building or running LDK with the Tokio networking backend should upgrade to a release containing this commit. If backporting, ensure the earlier incomplete fix (ae62fa377a0a139d937ce2c7d87d3eb1612732af) is also present. Consider auditing other unsafe raw-pointer casts in lightning-net-tokio for similar aliasing issues.
Security signals we found
Undefined behavior via invalid `*mut` dereference and mutable aliasing in unsafe Rust
Concurrent waker clones may access the same raw pointer
External security researcher/group credited (Project Loupe)
Follow-up to a previous incomplete fix (ae62fa377a0a139d937ce2c7d87d3eb1612732af)
Evidence from the diff
In lightning-net-tokio/src/lib.rs, wake_socket_waker previously did unsafe { &*(orig_ptr as *mut mpsc::Sender<()>) } to obtain a reference and then called sender.try_send(()). This is a mutable aliasing violation: the same raw pointer may be accessed concurrently from multiple waker clones, and Rust’s aliasing rules require &* from a *mut to be unique for the duration of the reference. The commit replaces that with a call to the existing wake_socket_waker_by_ref(orig_ptr), which presumably performs the send through a shared/immutable reference path, then calls drop_socket_waker. This DRYs the code and removes the invalid *mut deref. The commit message explicitly states this is an aliasing bug fix and credits Project Loupe.
Changed components
lightning-net-tokio/src/lib.rsTokio-based LDK networking adapterSocket waker implementationInspect captured patch +1 / −2
diff --git a/lightning-net-tokio/src/lib.rs b/lightning-net-tokio/src/lib.rs
index 953fed6..1d853ce 100644
--- a/lightning-net-tokio/src/lib.rs
+++ b/lightning-net-tokio/src/lib.rs
@@ -663,8 +663,7 @@ fn clone_socket_waker(orig_ptr: *const ()) -> task::RawWaker {
// sending thread may have already gone away due to a socket close, in which case there's nothing
// to wake up anyway.
fn wake_socket_waker(orig_ptr: *const ()) {
- let sender = unsafe { &*(orig_ptr as *mut mpsc::Sender<()>) };
- let _ = sender.try_send(());
+ wake_socket_waker_by_ref(orig_ptr);
drop_socket_waker(orig_ptr);
}
fn wake_socket_waker_by_ref(orig_ptr: *const ()) {
Why this scored 59/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.