diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-01-25 23:56:15 +0200 |
|---|---|---|
| committer | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-03-23 00:04:30 +0200 |
| commit | cda49299c93a3f5aa7e18dd1cf1d5943fc61d6d2 (patch) | |
| tree | 7bb945b4fcf97cc3c156dd46ee978b8495aa49af | |
| parent | 54bf5e394dbd909c5a57a7fbc25d8d7cff2896f3 (diff) | |
| download | accel-ppp-cda49299c93a3f5aa7e18dd1cf1d5943fc61d6d2.tar.gz accel-ppp-cda49299c93a3f5aa7e18dd1cf1d5943fc61d6d2.zip | |
ppp: classic TOCTOU, as uc_size not guarded by mutex
It was a micro-optimization to skip taking the mutex when uc_size was 0.
But because uc_size isnt atomic and wasnt read under the lock, it created a TOCTOU window.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
| -rw-r--r-- | accel-pppd/ppp/ppp.c | 14 |
1 files changed, 6 insertions, 8 deletions
diff --git a/accel-pppd/ppp/ppp.c b/accel-pppd/ppp/ppp.c index 2e91c2e4..cdafa6b3 100644 --- a/accel-pppd/ppp/ppp.c +++ b/accel-pppd/ppp/ppp.c @@ -143,15 +143,13 @@ int __export connect_ppp_channel(struct ppp_t *ppp) return 0; } - if (uc_size) { - pthread_mutex_lock(&uc_lock); - if (!list_empty(&uc_list)) { - uc = list_entry(uc_list.next, typeof(*uc), entry); - list_del(&uc->entry); - --uc_size; - } - pthread_mutex_unlock(&uc_lock); + pthread_mutex_lock(&uc_lock); + if (!list_empty(&uc_list)) { + uc = list_entry(uc_list.next, typeof(*uc), entry); + list_del(&uc->entry); + --uc_size; } + pthread_mutex_unlock(&uc_lock); if (uc) { ppp->unit_fd = uc->fd; |