Skip to content

LocatorCache::get_or_insert_with has TOCTOU window allowing duplicate side effects #399

@karthiknadig

Description

@karthiknadig

Summary

LocatorCache::get_or_insert_with in crates/pet-core/src/cache.rs uses a double-check locking pattern (read lock → compute → write lock → check again). Two threads can both pass the initial read-lock check, both call the closure f(), and only one insertion wins. If f() has side effects, they execute twice.

Concrete Example

In crates/pet-conda/src/lib.rs (line ~400), the mamba manager discovery inside the closure calls reporter.report_manager. The CacheReporter de-duplicates the reporting, but the get_mamba_manager process-spawning still executes twice.

Impact

Minor performance concern — not a correctness issue. The duplicate spawning is benign but wasteful.

Proposed Fix

Consider either:

  1. Accepting this as a known trade-off (add comment documenting it) since the double-check pattern avoids holding a write lock during computation
  2. Using a more granular per-key locking mechanism if spawning cost becomes measurable

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions