java-topology/defects/hurd/hurd-0003.md

hurd-0003 — CWE-407: ports_interrupt_notified_rpcs — O(N) scan on every port death

Severity: MEDIUM File: libports/interrupt-notified-rpcs.c lines ~31–46 Function: ports_interrupt_notified_rpcs CWE: CWE-407 Algorithmic Complexity

Defect

Walks full _ports_notifications linked list on every dead-name notification (every time a watched port dies). Inner loop over np->reqs cancels pending RPCs.

for (np = _ports_notifications; np; np = np->next)    // O(N notifications)
  if (np->port == port && np->what == what)
    {
      struct rpc_notify *req;
      for (req = np->reqs; req; req = req->next_req)  // O(M requests)
        if (req->pending) { req->pending--; hurd_thread_cancel(...); }
      break;
    }

Complexity: O(N_notifications) per dead-name event. Port deaths cascade — one process crash fires many dead-name events simultaneously.

Fix

Same root cause as hurd-0002: hash _ports_notifications by (port, what). Both hurd-0002 and hurd-0003 are fixed by the same data structure change.