27 lines
1 KiB
Markdown
27 lines
1 KiB
Markdown
# hurd-0003 — CWE-407: ports_interrupt_notified_rpcs — O(N) scan on every port death
|
||
|
||
**Severity:** MEDIUM
|
||
**File:** `libports/interrupt-notified-rpcs.c` lines ~31–46
|
||
**Function:** `ports_interrupt_notified_rpcs`
|
||
**CWE:** CWE-407 Algorithmic Complexity
|
||
|
||
## Defect
|
||
|
||
Walks full `_ports_notifications` linked list on every dead-name notification (every time a watched port dies). Inner loop over `np->reqs` cancels pending RPCs.
|
||
|
||
```c
|
||
for (np = _ports_notifications; np; np = np->next) // O(N notifications)
|
||
if (np->port == port && np->what == what)
|
||
{
|
||
struct rpc_notify *req;
|
||
for (req = np->reqs; req; req = req->next_req) // O(M requests)
|
||
if (req->pending) { req->pending--; hurd_thread_cancel(...); }
|
||
break;
|
||
}
|
||
```
|
||
|
||
**Complexity:** O(N_notifications) per dead-name event. Port deaths cascade — one process crash fires many dead-name events simultaneously.
|
||
|
||
## Fix
|
||
|
||
Same root cause as hurd-0002: hash `_ports_notifications` by `(port, what)`. Both hurd-0002 and hurd-0003 are fixed by the same data structure change.
|