svn commit: r294565 - in head: lib/libc/gen tools/regression/posixsem2

[Jilles Tjoelker]

Author: jilles
Date: Fri Jan 22 14:52:31 2016
New Revision: 294565
URL: https://svnweb.freebsd.org/changeset/base/294565

Log:
  sem: Don't free nameinfo that is still in list when open() fails.
  
  This bug could be reproduced easily by calling sem_open() with O_CREAT |
  O_EXCL on a semaphore that is already open in the process. The struct
  sem_nameinfo would be freed while still in sem_list and later calls to
  sem_open() or sem_close() could access freed memory.
  
  PR:		206396
  MFC after:	5 days

Modified:
  head/lib/libc/gen/sem_new.c
  head/tools/regression/posixsem2/semtest.c

Modified: head/lib/libc/gen/sem_new.c
==============================================================================
--- head/lib/libc/gen/sem_new.c	Fri Jan 22 14:22:11 2016	(r294564)
+++ head/lib/libc/gen/sem_new.c	Fri Jan 22 14:52:31 2016	(r294565)
@@ -177,8 +177,10 @@ _sem_open(const char *name, int flags, .
 		if (ni->name != NULL && strcmp(name, ni->name) == 0) {
 			fd = _open(path, flags | O_RDWR | O_CLOEXEC |
 			    O_EXLOCK, mode);
-			if (fd == -1 || _fstat(fd, &sb) == -1)
+			if (fd == -1 || _fstat(fd, &sb) == -1) {
+				ni = NULL;
 				goto error;
+			}
 			if ((flags & (O_CREAT | O_EXCL)) == (O_CREAT |
 			    O_EXCL) || ni->dev != sb.st_dev ||
 			    ni->ino != sb.st_ino) {

Modified: head/tools/regression/posixsem2/semtest.c
==============================================================================
--- head/tools/regression/posixsem2/semtest.c	Fri Jan 22 14:22:11 2016	(r294564)
+++ head/tools/regression/posixsem2/semtest.c	Fri Jan 22 14:52:31 2016	(r294565)
@@ -7,6 +7,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <err.h>
+#include <errno.h>
 #include <fcntl.h>
 #include <unistd.h>
 
@@ -14,6 +15,7 @@
 
 int test_unnamed(void);
 int test_named(void);
+int test_named2(void);
 
 int
 test_unnamed(void)
@@ -94,9 +96,42 @@ test_named(void)
 }
 
 int
+test_named2(void)
+{
+	sem_t *s, *s2, *s3;
+
+	printf("testing named process-shared semaphore, O_EXCL cases\n");
+	sem_unlink(SEM_NAME);
+	s = sem_open(SEM_NAME, O_CREAT | O_EXCL, 0777, 0);
+	if (s == SEM_FAILED)
+		err(1, "sem_open failed");
+	s2 = sem_open(SEM_NAME, O_CREAT | O_EXCL, 0777, 0);
+	if (s2 != SEM_FAILED)
+		errx(2, "second sem_open call wrongly succeeded");
+	if (errno != EEXIST)
+		err(3, "second sem_open call failed with wrong errno");
+
+	s3 = sem_open(SEM_NAME, 0);
+	if (s3 == SEM_FAILED)
+		err(4, "third sem_open call failed");
+	if (s != s3)
+		errx(5,
+"two sem_open calls for same semaphore do not return same address");
+	if (sem_close(s3))
+		err(6, "sem_close failed");
+
+	if (sem_close(s))
+		err(7, "sem_close failed");
+	
+	printf("OK.\n");
+	return (0);
+}
+
+int
 main(void)
 {
 	test_unnamed();
 	test_named();
+	test_named2();
 	return (0);
 }