23 lines
1.2 KiB
Markdown
23 lines
1.2 KiB
Markdown
# UNDF: UNDF-2026-000000555
|
||
# tokio — CWE-407 Scan Result: CLEAN
|
||
|
||
**Date:** 2026-03-27
|
||
**Source:** https://github.com/tokio-rs/tokio (depth=1)
|
||
**Scanned:** `tokio/src/` (excluding test modules)
|
||
|
||
## Summary
|
||
|
||
No CWE-407 defects found in tokio's production code paths.
|
||
|
||
## Candidates Evaluated
|
||
|
||
| Location | Pattern | Verdict |
|
||
|----------|---------|---------|
|
||
| `runtime/scheduler/multi_thread/idle.rs:150` | `sleepers.contains(&worker_id)` | **DISQUALIFIED** — `sleepers` is bounded by `num_workers` (configured at runtime creation, typically 4–32). Single O(N) call, no outer loop. |
|
||
| `runtime/scheduler/multi_thread/idle.rs:133-141` | linear scan in `unpark_worker_by_id` | **DISQUALIFIED** — same bounded `sleepers` vec; exits on first match via `swap_remove`. |
|
||
| `io/ready.rs` | bitflag `.contains()` | **DISQUALIFIED** — bitmask arithmetic, not a Vec linear scan. |
|
||
| `signal/unix.rs:271` | `FORBIDDEN.contains(&signal)` | **DISQUALIFIED** — `FORBIDDEN` is a static bounded slice of forbidden signal numbers. |
|
||
|
||
## Conclusion
|
||
|
||
Tokio uses `LinkedList`, atomic state, and bounded `Vec` for scheduler internals. The sleeper list is bounded by worker count (set at startup). No unbounded linear membership tests in hot paths.
|