java-topology/defects/hurd/hurd-0005.md

hurd-0005 — CWE-407: _ports_bucket_class_iterate — O(total_ports) global scan

Severity: MEDIUM File: libports/bucket-iterate.c lines ~41–80 Function: _ports_bucket_class_iterate (called as ports_class_iterate) CWE: CWE-407 Algorithmic Complexity

Defect

When used as ports_class_iterate, scans the global _ports_htable (all ports in all buckets) and filters by class pointer. The source file itself carries:

/* This is obscenely ineffecient. ihash and ports need to cooperate
   more closely to do it efficiently. */

HURD_IHASH_ITERATE (ht, arg) {
  struct port_info *const pi = arg;
  if (class == 0 || pi->class == class)   // O(1) pointer compare after O(total_ports) walk
    { refcounts_ref(...); p[n] = pi; n++; }
}

Complexity: O(total_ports) even when only a small class subset is needed.

Scale

Total ports in a busy Hurd system: potentially thousands (one per open file descriptor, translator instance, network connection). ports_class_iterate is called during inhibit/resume operations — exactly when the system is under load.

Fix

Maintain a per-class linked list or per-class hash table in port_class. ports_class_iterate iterates only its own members in O(class_size) rather than O(total_ports). This is what the source comment already asks for.