Repolode
Submit
BurtonQin

BurtonQin/lockbud

A static analyzer that detects deadlocks, use-after-free, invalid-free and possible panic locations in Rust projects.

View on GitHub
Stars
590
Forks
40
Open issues
7
Last commit
7 days ago

What is it?

lockbud is a static analysis tool for Rust that looks for concurrency and memory bugs without running the program. It tracks the lifetimes of lock guards across a crate's call graph to flag double-locks and conflicting lock orders that can lead to deadlocks, and it checks for atomicity violations and Condvar misuse. Memory detectors cover use-after-free and invalid-free, and a separate mode reports possible panic locations.

The tool is built on rustc internals and must be run with the same nightly toolchain it targets, currently nightly-2026-02-07. It can be invoked directly through a detect script or as a cargo subcommand (cargo lockbud), and it is also available as a Docker image and can run in CI. Lock support covers std::sync, parking_lot and spin Mutex and RwLock types.

The project is the artifact of a TSE'24 paper on real-world safety issues in Rust. The author notes that the memory and panic detectors produce many false positives from the standard library and dependencies, so filtering to your own crate with -l is recommended.

Key features

  • 01Detects double-lock and conflicting lock-order deadlocks for std, parking_lot and spin locks.
  • 02Reports use-after-free and invalid-free memory bugs.
  • 03Flags atomicity violations and Condvar misuse.
  • 04Lists possible panic locations in Rust code.
  • 05Runs as a standalone script, a cargo subcommand, or a Docker image.

Use cases

  • Auditing a Rust codebase that uses Mutex or RwLock for possible deadlocks before release.
  • Adding a deadlock check to CI pipelines via cargo lockbud or the Docker image.
  • Researching static detection techniques for Rust concurrency bugs.

Quick start

  1. 1

    Install the required nightly toolchain components

    rustup +nightly-2026-02-07 component add rust-src rustc-dev llvm-tools-preview
  2. 2

    Clone the repository

    git clone https://github.com/BurtonQin/lockbud.git
  3. 3

    Enter the project directory

    cd lockbud
  4. 4

    Install lockbud from the local source

    cargo +nightly-2026-02-07 install --path .

Things to know

  • Must be built with the exact rustc nightly version it supports, and the same version must be used to analyze your project.
  • Deadlock detection only covers std, parking_lot and spin Mutex and RwLock types.
  • Memory and panic detectors produce many false positives, and the panic detector reports nearly all panic locations.
  • Points-to analysis is imprecise, so results can include false positives.

In collections

Security scanners, audits & threat intel toolsConcurrency & async libraries

Topics

#rust#static-analysis#deadlock#concurrency#memory-safety#bug-detection#security#static-analyzer

FAQ

What is lockbud?
A static analyzer that detects deadlocks, use-after-free, invalid-free and possible panic locations in Rust projects. lockbud is a static analysis tool for Rust that looks for concurrency and memory bugs without running the program. It tracks the lifetimes of lock guards across a crate's call graph to flag double-locks and conflicting lock orders that can lead to deadlocks, and it checks for atomicity violations and Condvar misuse. Memory detectors cover use-after-free and invalid-free, and a separate mode reports possible panic locations.
Is lockbud free to use? What license does it have?
lockbud is open source under the BSD-3-Clause license. Check the license terms before using it in commercial products.
Is lockbud still maintained?
Actively maintained. The last commit to lockbud was on Nov 1, 2026.
What can I use lockbud for?
Auditing a Rust codebase that uses Mutex or RwLock for possible deadlocks before release. Adding a deadlock check to CI pipelines via cargo lockbud or the Docker image. Researching static detection techniques for Rust concurrency bugs.
How do I install lockbud?
Install the required nightly toolchain components: rustup +nightly-2026-02-07 component add rust-src rustc-dev llvm-tools-preview Clone the repository: git clone https://github.com/BurtonQin/lockbud.git Enter the project directory: cd lockbud Install lockbud from the local source: cargo +nightly-2026-02-07 install --path .
Where can I get lockbud?
The source code and installation instructions are on GitHub: https://github.com/BurtonQin/lockbud

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects