aboutsummaryrefslogtreecommitdiff
path: root/tools/regression
diff options
context:
space:
mode:
authorJilles Tjoelker <jilles@FreeBSD.org>2016-01-22 14:52:31 +0000
committerJilles Tjoelker <jilles@FreeBSD.org>2016-01-22 14:52:31 +0000
commitafa04e4170378d8130154c606c0199a8de705a54 (patch)
treed88421ab67feaf6d316ac1cf7b5df3c38584a56a /tools/regression
parent636208024586d0fb3053105b200f5b2c41796d21 (diff)
downloadsrc-afa04e4170378d8130154c606c0199a8de705a54.tar.gz
src-afa04e4170378d8130154c606c0199a8de705a54.zip
sem: Don't free nameinfo that is still in list when open() fails.
This bug could be reproduced easily by calling sem_open() with O_CREAT | O_EXCL on a semaphore that is already open in the process. The struct sem_nameinfo would be freed while still in sem_list and later calls to sem_open() or sem_close() could access freed memory. PR: 206396 MFC after: 5 days
Notes
Notes: svn path=/head/; revision=294565
Diffstat (limited to 'tools/regression')
-rw-r--r--tools/regression/posixsem2/semtest.c35
1 files changed, 35 insertions, 0 deletions
diff --git a/tools/regression/posixsem2/semtest.c b/tools/regression/posixsem2/semtest.c
index b1255db83724..0879ff9fda78 100644
--- a/tools/regression/posixsem2/semtest.c
+++ b/tools/regression/posixsem2/semtest.c
@@ -7,6 +7,7 @@
#include <stdio.h>
#include <stdlib.h>
#include <err.h>
+#include <errno.h>
#include <fcntl.h>
#include <unistd.h>
@@ -14,6 +15,7 @@
int test_unnamed(void);
int test_named(void);
+int test_named2(void);
int
test_unnamed(void)
@@ -94,9 +96,42 @@ test_named(void)
}
int
+test_named2(void)
+{
+ sem_t *s, *s2, *s3;
+
+ printf("testing named process-shared semaphore, O_EXCL cases\n");
+ sem_unlink(SEM_NAME);
+ s = sem_open(SEM_NAME, O_CREAT | O_EXCL, 0777, 0);
+ if (s == SEM_FAILED)
+ err(1, "sem_open failed");
+ s2 = sem_open(SEM_NAME, O_CREAT | O_EXCL, 0777, 0);
+ if (s2 != SEM_FAILED)
+ errx(2, "second sem_open call wrongly succeeded");
+ if (errno != EEXIST)
+ err(3, "second sem_open call failed with wrong errno");
+
+ s3 = sem_open(SEM_NAME, 0);
+ if (s3 == SEM_FAILED)
+ err(4, "third sem_open call failed");
+ if (s != s3)
+ errx(5,
+"two sem_open calls for same semaphore do not return same address");
+ if (sem_close(s3))
+ err(6, "sem_close failed");
+
+ if (sem_close(s))
+ err(7, "sem_close failed");
+
+ printf("OK.\n");
+ return (0);
+}
+
+int
main(void)
{
test_unnamed();
test_named();
+ test_named2();
return (0);
}