# Risk map — tokio-rs/tokio

> Canonical page: https://codevetter.com/unpack/tokio/risk-map

# Risk map — tokio-rs/tokio

Scanned commit 2746c3ae26f8ac0af6023843a7f23d419c334efe (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source-observed contracts and explicitly identified hypotheses, not confirmed vulnerabilities. The most sensitive boundaries involve unsafe buffer access, reactor pointer lifetimes, scheduler shutdown, and externally visible filesystem/process effects. Cancellation and completion differ substantially between async tasks, blocking work, children, and buffered files. Changes to these areas require precise ownership and lifecycle reasoning beyond compilation.
- Reactor event tokens become ScheduledIo pointers through unsafe dereferencing; safety requires deregistration and exclusion of concurrent polling before those allocations can be freed. — [tokio/src/runtime/io/driver.rs#L219-L229](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/runtime/io/driver.rs#L219-L229)
- PollEvented casts uninitialized ReadBuf storage to a byte slice and assumes the returned bytes were initialized; TcpStream::poll_read_priv explicitly relies on the socket read contract. — [tokio/src/io/poll_evented.rs#L171-L180](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/io/poll_evented.rs#L171-L180) [tokio/src/io/poll_evented.rs#L215-L224](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/io/poll_evented.rs#L215-L224) [tokio/src/net/tcp/stream.rs#L1451-L1457](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/net/tcp/stream.rs#L1451-L1457)
- Started spawn_blocking tasks cannot be aborted, and shutdown can wait indefinitely; shutdown_timeout stops waiting without cancelling the underlying work. — [tokio/src/task/blocking.rs#L106-L120](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/task/blocking.rs#L106-L120)
- fs::write forwards caller paths to create/truncate or standard filesystem operations without a repository-root policy; File write acknowledgement, flush completion, and sync_all are distinct boundaries. — [tokio/src/fs/write.rs#L64-L69](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/fs/write.rs#L64-L69) [tokio/src/fs/write.rs#L98-L100](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/fs/write.rs#L98-L100) [tokio/src/fs/file.rs#L774-L796](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/fs/file.rs#L774-L796) [tokio/src/fs/file.rs#L317-L322](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/fs/file.rs#L317-L322)
- Child drop leaves processes running by default, Unix reaping is best effort, and wait_with_output accumulates each output stream in a Vec without a limit in that implementation. — [tokio/src/process/mod.rs#L199-L223](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/process/mod.rs#L199-L223) [tokio/src/process/mod.rs#L1446-L1463](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/process/mod.rs#L1446-L1463)
- On Unix, registering a signal replaces its default handler for the process lifetime; dropping the listener does not restore default SIGINT termination behavior. — [tokio/src/signal/ctrl_c.rs#L18-L34](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/signal/ctrl_c.rs#L18-L34)
- Allocation hypothesis: LengthDelimitedCodec checks the wire length before applying length_adjustment, then reserves the adjusted size; configuration therefore needs review when reasoning about memory bounds. (inferred) — [tokio-util/src/codec/length_delimited.rs#L526-L559](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio-util/src/codec/length_delimited.rs#L526-L559) [tokio-util/src/codec/length_delimited.rs#L706-L717](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio-util/src/codec/length_delimited.rs#L706-L717)
- Scheduler shutdown depends on closing both OwnedTasks and the injection queue; documented races otherwise permit stranded task references, and a Loom test exercises core handoff during shutdown. — [tokio/src/runtime/scheduler/multi_thread/worker.rs#L9-L57](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/runtime/scheduler/multi_thread/worker.rs#L9-L57) [tokio/src/runtime/tests/loom_multi_thread.rs#L80-L99](https://github.com/tokio-rs/tokio/blob/2746c3ae26f8ac0af6023843a7f23d419c334efe/tokio/src/runtime/tests/loom_multi_thread.rs#L80-L99)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)