java-topology/docs/tickets/dragonflybsd-0003.md

dragonflybsd-0003 — CWE-407: if_addmulti_serialized — O(N²) duplicate check + mapping scans

Severity: MEDIUM File: sys/net/if.c Function: if_addmulti_serialized CWE: CWE-407 Algorithmic Complexity

Defect

Two sequential TAILQ_FOREACH scans over if_multiaddrs per call — first for duplicate check, then for link-layer address mapping. O(N) per call × N calls in batch multicast join = O(N²) total.

/* scan 1: duplicate check */
TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
    if (sa_equal(ifma->ifma_addr, sa))
        goto found;
}

/* scan 2: find existing link-layer mapping */
TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
    if (sa_equal(ifma->ifma_lladdr, llsa))
        break;
}

Complexity: O(N) per call × N calls in batch = O(N²) total.

Scale

When joining a multicast group list of N=200 addresses, the combined duplicate check and link-layer scan cost grows quadratically. Triggered by multicast routing daemon startup or bulk IP_ADD_MEMBERSHIP socket operations.

Fix

Hash set on sockaddr (using existing sa_hash logic) for O(1) duplicate check. Eliminates both the linear duplicate scan and the separate link-layer scan with a single hash table keyed on address bytes.