mpich: CWE-407 scan result — CLEAN

Scan Date

2026-03-27

Scope

src/mpid/ch4/src/ — CH4 device interface, receive queues
src/mpid/ch3/src/ — CH3 device, communicator management
src/util/ — utility data structures
src/pm/hydra/nameserver/ — process manager nameserver

Findings

Linear patterns found

MPIDIG_recvq_search (src/mpid/ch4/src/mpidig_recvq.h:147): O(Q) linked-list scan of the posted/unexpected receive queue. This is an inherent property of MPI semantics: MPI_ANY_SOURCE and MPI_ANY_TAG wildcards make hash-based O(1) lookup impossible in the general case. This is a well-known tradeoff in MPI runtime design, not a fixable CWE-407 defect. The queue length Q is bounded by outstanding non-blocking receives per VCI; in practice Q < 10 000 for well-behaved applications.
MPIDI_CH3I_Comm_find (src/mpid/ch3/src/ch3u_comm.c:485): O(C) scan over the communicator list to find a communicator by context_id. Called only on the revoke packet path (fault-tolerance code), not in the normal message-passing hot path. C = number of active communicators, typically < 100. Not a hot-path defect.
Hydra nameserver (src/pm/hydra/nameserver/hydra_nameserver.c:234): O(P) scan over a publish_list linked list for MPI_Lookup_name / MPI_Publish_name / MPI_Unpublish_name. Called once per PMI name-service operation, not in a loop. P = number of published names. Not a hot path.

No outer-loop amplifier

None of the above linear scans are called from inside an outer loop over a large collection. The CWE-407 pattern requires a linear scan inside a loop, producing O(N²) or worse total cost.

Verdict

CLEAN — no CWE-407 defect. Linear recv-queue matching is inherent to MPI semantics; other linear scans are in cold startup/fault-tolerance paths over small bounded sets.

1.9 KiB Raw Blame History