sysvsem: Fix another sequence number wraparound race

semop() may sleep waiting for a semaphore.  Upon waking up, it checks to
see if the set's sequence number has changed, indicating that the set
was removed.  The sequence number is not wide enough to prevent a false
negative due to wraparound, in which case the subsequent access of
`semakptr->u.__sem_base[sopptr->sem_num]` may be out of bounds.  This
race can be leveraged to elevate privileges.

Fix this by introducing a 64-bit sequence number for each semaphore
pool.  This is wide enough to make the race impossible to hit.  Allocate
a separate array for them, as we cannot really change the layout of
struct semid_kernel since some userspace tools (e.g., ipcrm(1)) embed
the layout.

While here, use semvalid() instead of open-coding its implementation,
convert a couple of flags to be bool, and use a better variable name to
store required permissions.

Approved by:	so
Security:	FreeBSD-SA-26:64.sysvsem
Security:	CVE-2026-58098
Reported by:	Reo Shiseki
Reported by:	Andrew Griffiths
Reviewed by:	kib
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D59347

0 files changed, 0 insertions, 0 deletions