engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/whitepaper/outreach/dragonflybsd.md

2.9 KiB
Raw Blame History

DragonFly BSD — CWE-407 Disclosure Brief

2026-04-05 · 5 confirmed defects · All patched

Finding

Five O(N²) / O(N×k) algorithmic complexity defects across DragonFly BSD's network interface address lookup, multicast list management, and devfs device lookup infrastructure. All are linear scan patterns in hot paths where hash tables or direct pointer access should be used.

The Defects

dragonflybsd-0001 (HIGH): sys/net/if.c — ifa_ifwithaddr, ifa_ifwithnet, ifa_ifwithdstaddr

Two-level nested loop — outer for loop over ifnet_array (I interfaces), inner TAILQ_FOREACH over if_addrheads[mycpuid] (A addresses per interface). O(I×A) per call. Called from ip_dooptions() inside ip_input() — per-packet on source-routed traffic. At I=50, A=20: 1,000 comparisons per packet. Fix: per-CPU hash table keyed on (AF, address bytes) → ifaddr*. O(1) lookup.

dragonflybsd-0002 (MEDIUM): sys/net/if.c — if_delallmulti_serialized

Marker-walk (outer, N multicast entries) calls if_delmulti_serialized() for each, which re-scans the same list to find the entry by address comparison. O(N²) — the pointer is already in hand from the outer walk. Fix: add if_delmulti_ifma() accepting direct ifmultiaddr* pointer; skip the scan.

dragonflybsd-0003 (MEDIUM): sys/net/if.c — if_addmulti_serialized

Two sequential TAILQ_FOREACH scans over if_multiaddrs per call — duplicate check then link-layer mapping. O(N) per call × N calls in batch multicast join = O(N²) total. Fix: hash set on sockaddr for O(1) duplicate check.

dragonflybsd-0004 (MEDIUM): sys/vfs/devfs/devfs_core.c — devfs_destroy_related_worker

TAILQ_FOREACH over global devfs_dev_list with goto restart on each child found. O(N×C) where N=total devices, C=children of needle. Triggered on device detach (USB removal etc.). Fix: collect-then-destroy — single O(N) pass to collect children, then destroy without restart.

dragonflybsd-0005 (HIGH): sys/vfs/devfs/devfs_core.c — devfs_find_device_by_name_worker

Two sequential TAILQ_FOREACH scans — devfs_dev_list by name, then devfs_alias_list by alias. O(N) per /dev/ open or stat. Every device open goes through this path. Fix: hash tables keyed on device name string for both lists. O(1) average per open.

Contact

DragonFly BSD mailing list: kernel@dragonflybsd.org Project: https://www.dragonflybsd.org/ Bug tracker: https://bugs.dragonflybsd.org/

Status

All 5 defects patched as of 2026-04-05. Patches: dragonflybsd-0001-ifa-ifwithaddr-hash.patch, dragonflybsd-0002-if-delallmulti-direct-ptr.patch, dragonflybsd-0003-if-addmulti-hash-dedup.patch, dragonflybsd-0004-devfs-destroy-collect-then-destroy.patch, dragonflybsd-0005-devfs-find-device-hash.patch.

dragonflybsd-0001 and the parallel defect in NetBSD (netbsd-0001) share the same root cause — the ifa_ifwithaddr family of functions uses nested interface+address walks in both kernels.