diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-01-25 23:56:15 +0200 |
|---|---|---|
| committer | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-02-06 17:34:54 +0200 |
| commit | 474eba540738838dbb9d21cc1eb705c6ef060b94 (patch) | |
| tree | e9dc339a3a54a2b94a75542c4f8febf1c17360dc | |
| parent | e81ef1824ca33aa977fda7fd0ef02052a5186675 (diff) | |
| download | accel-ppp-474eba540738838dbb9d21cc1eb705c6ef060b94.tar.gz accel-ppp-474eba540738838dbb9d21cc1eb705c6ef060b94.zip | |
ppp: classic TOCTOU, as uc_size not guarded by mutex
It was a micro-optimization to skip taking the mutex when uc_size was 0.
But because uc_size isnt atomic and wasnt read under the lock, it created a TOCTOU window.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
| -rw-r--r-- | accel-pppd/ppp/ppp.c | 14 |
1 files changed, 6 insertions, 8 deletions
diff --git a/accel-pppd/ppp/ppp.c b/accel-pppd/ppp/ppp.c index 2e91c2e4..cdafa6b3 100644 --- a/accel-pppd/ppp/ppp.c +++ b/accel-pppd/ppp/ppp.c @@ -143,15 +143,13 @@ int __export connect_ppp_channel(struct ppp_t *ppp) return 0; } - if (uc_size) { - pthread_mutex_lock(&uc_lock); - if (!list_empty(&uc_list)) { - uc = list_entry(uc_list.next, typeof(*uc), entry); - list_del(&uc->entry); - --uc_size; - } - pthread_mutex_unlock(&uc_lock); + pthread_mutex_lock(&uc_lock); + if (!list_empty(&uc_list)) { + uc = list_entry(uc_list.next, typeof(*uc), entry); + list_del(&uc->entry); + --uc_size; } + pthread_mutex_unlock(&uc_lock); if (uc) { ppp->unit_fd = uc->fd; |