From 474eba540738838dbb9d21cc1eb705c6ef060b94 Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Sun, 25 Jan 2026 23:56:15 +0200 Subject: ppp: classic TOCTOU, as uc_size not guarded by mutex It was a micro-optimization to skip taking the mutex when uc_size was 0. But because uc_size isnt atomic and wasnt read under the lock, it created a TOCTOU window. Signed-off-by: Denys Fedoryshchenko --- accel-pppd/ppp/ppp.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/accel-pppd/ppp/ppp.c b/accel-pppd/ppp/ppp.c index 2e91c2e4..cdafa6b3 100644 --- a/accel-pppd/ppp/ppp.c +++ b/accel-pppd/ppp/ppp.c @@ -143,15 +143,13 @@ int __export connect_ppp_channel(struct ppp_t *ppp) return 0; } - if (uc_size) { - pthread_mutex_lock(&uc_lock); - if (!list_empty(&uc_list)) { - uc = list_entry(uc_list.next, typeof(*uc), entry); - list_del(&uc->entry); - --uc_size; - } - pthread_mutex_unlock(&uc_lock); + pthread_mutex_lock(&uc_lock); + if (!list_empty(&uc_list)) { + uc = list_entry(uc_list.next, typeof(*uc), entry); + list_del(&uc->entry); + --uc_size; } + pthread_mutex_unlock(&uc_lock); if (uc) { ppp->unit_fd = uc->fd; -- cgit v1.2.3