From 40c50899af97120a73d04251c9a52fe5786aaa31 Mon Sep 17 00:00:00 2001 From: jilles Date: Wed, 27 Jan 2016 22:56:04 +0000 Subject: [PATCH] MFC r294565: sem: Don't free nameinfo that is still in list when open() fails. This bug could be reproduced easily by calling sem_open() with O_CREAT | O_EXCL on a semaphore that is already open in the process. The struct sem_nameinfo would be freed while still in sem_list and later calls to sem_open() or sem_close() could access freed memory. PR: 206396 git-svn-id: svn://svn.freebsd.org/base/stable/10@294963 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- lib/libc/gen/sem_new.c | 4 +++- tools/regression/posixsem2/semtest.c | 35 ++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+), 1 deletion(-) diff --git a/lib/libc/gen/sem_new.c b/lib/libc/gen/sem_new.c index 7b04ef092..243cebab3 100644 --- a/lib/libc/gen/sem_new.c +++ b/lib/libc/gen/sem_new.c @@ -176,8 +176,10 @@ _sem_open(const char *name, int flags, ...) if (ni->name != NULL && strcmp(name, ni->name) == 0) { fd = _open(path, flags | O_RDWR | O_CLOEXEC | O_EXLOCK, mode); - if (fd == -1 || _fstat(fd, &sb) == -1) + if (fd == -1 || _fstat(fd, &sb) == -1) { + ni = NULL; goto error; + } if ((flags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL) || ni->dev != sb.st_dev || ni->ino != sb.st_ino) { diff --git a/tools/regression/posixsem2/semtest.c b/tools/regression/posixsem2/semtest.c index b1255db83..0879ff9fd 100644 --- a/tools/regression/posixsem2/semtest.c +++ b/tools/regression/posixsem2/semtest.c @@ -7,6 +7,7 @@ #include #include #include +#include #include #include @@ -14,6 +15,7 @@ int test_unnamed(void); int test_named(void); +int test_named2(void); int test_unnamed(void) @@ -93,10 +95,43 @@ test_named(void) return (0); } +int +test_named2(void) +{ + sem_t *s, *s2, *s3; + + printf("testing named process-shared semaphore, O_EXCL cases\n"); + sem_unlink(SEM_NAME); + s = sem_open(SEM_NAME, O_CREAT | O_EXCL, 0777, 0); + if (s == SEM_FAILED) + err(1, "sem_open failed"); + s2 = sem_open(SEM_NAME, O_CREAT | O_EXCL, 0777, 0); + if (s2 != SEM_FAILED) + errx(2, "second sem_open call wrongly succeeded"); + if (errno != EEXIST) + err(3, "second sem_open call failed with wrong errno"); + + s3 = sem_open(SEM_NAME, 0); + if (s3 == SEM_FAILED) + err(4, "third sem_open call failed"); + if (s != s3) + errx(5, +"two sem_open calls for same semaphore do not return same address"); + if (sem_close(s3)) + err(6, "sem_close failed"); + + if (sem_close(s)) + err(7, "sem_close failed"); + + printf("OK.\n"); + return (0); +} + int main(void) { test_unnamed(); test_named(); + test_named2(); return (0); } -- 2.45.0