DF-2761
sys_setlogin mutates s_login while holding p_token SHARED — data race with concurrent setlogin/getlogin produces torn login names
| Field | Value |
|---|---|
| ID | DF-2761 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-667 Improper Locking |
| File | sys/kern/kern_prot.c |
| Lines | 1290-1292 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-08-30 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
sys_setlogin performs the s_login memcpy under lwkt_gettoken_shared(&p->p_token). Shared tokens do not exclude other shared holders: two privileged processes in the same session racing setlogin() write the full MAXLOGNAME array concurrently, and any getlogin() reader (also shared) can observe a torn mix. No memory unsafety; privilege-gated; purely locking-discipline/correctness (utmp/audit can read a garbage login name).
Recommended fix
Use the exclusive token for the writer (readers may stay shared):
lwkt_gettoken(&p->p_token); at :1290.
Timeline
- 2026-08-30 Discovered during pass-2 audit of kern_prot.c (GLM 5.3).
No comments yet.