DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2313

IIC_LOCK/IIC_UNLOCK are empty no-op macros - all shared state access is unsynchronized

Summary

IIC_LOCK(sc) and IIC_UNLOCK(sc) are defined as empty macros at :60-61 providing no mutual exclusion. All access to shared softc state (sc_count sc_addr sc_buffer sc_inbuf) completely unsynchronized. Concurrent access from multiple threads sharing fd or from exclusive-open race on sc_count can corrupt shared buffers and bypass exclusive-open check. iicopen checks sc_count>0 then increments - TOCTOU allows two threads to both see sc_count==0 and both open. iicwrite/iicread use shared sc_buffer/sc_inbuf without synchronization.

Discussion (0)

No comments yet.