https://gitlab.redox-os.org/redox-os/mio/blob/master/src/sys/unix/dlsym.rs#L19-46

    pub fn get(&self) -> Option<&F> {
        assert_eq!(mem::size_of::<F>(), mem::size_of::<usize>());
        unsafe {
            if self.addr.load(Ordering::SeqCst) == 0 {  // 1
                self.addr.store(fetch(self.name), Ordering::SeqCst);  // 2, 3
            }
            if self.addr.load(Ordering::SeqCst) == 1 {  // 4
                None
            } else {
                mem::transmute::<&AtomicUsize, Option<&F>>(&self.addr)
            }
        }
    }

This bug is an atomicity violation. addr is an AtomicUsize, which can be converted to a function reference in function get(). In the buggy code,

1. function get() first check if addr is 0.
2. If not then call fetch()
3. and store the returned value (1 or other) to addr.
4. Then it checks if addr is 1. If not, convert the addr into a function reference.

Because the struct is Sync (all its fields are Sync) and the function takes immutable self (&self) as parameter, the function can be called by two threads simultaneously and the following execution may occur:

But originally it should return None because tmp2 == 1