linux-kernel - [PATCH] ipc/sem.c: fix update sem_otime when calling sem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 22 Sep 2013 10:11:24 +0800
From:	Jia He <jiakernel@...il.com>
To:	linux-kernel@...r.kernel.org
Cc:	Davidlohr Bueso <davidlohr.bueso@...com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Rik van Riel <riel@...hat.com>,
	Manfred Spraul <manfred@...orfullife.com>,
	Al Viro <viro@...iv.linux.org.uk>, Jia He <jiakernel@...il.com>
Subject: [PATCH] ipc/sem.c: fix update sem_otime when calling sem_op in semaphore initialization

In commit 0a2b9d4c,the update of semaphore's sem_otime(last semop time)
was removed because he wanted to move setting sem->sem_otime to one
place. But after that, the initial semop() will not set the otime
because its sem_op value is 0(in semtimedop,will not change
otime if alter == 1).

the error case:
process_a(server)       process_b(client)
semget()
semctl(SETVAL)
semop()
                        semget()
                        setctl(IP_STAT)
                        for(;;) {               <--not successful here
                          check until sem_otime > 0
                        }

provide test codes here:
$cat server.c

int semid;
int main()
{
	int key;
	struct semid64_ds sem_info;
	union semun arg;
	struct sembuf sop;

	key = ftok(SEM_PATH,'a');
	semid = semget(key,1,IPC_CREAT|IPC_EXCL|00666);
	if(semid < 0)
		perror("server:semget");

	arg.val = 0;
	if(semctl(semid,0,SETVAL,arg) == -1)
	        perror("semctl setval error");

	sop.sem_num = 0;
	sop.sem_op = 0;
	sop.sem_flg = 0;
	if (semop(semid, &sop, 1) == -1)
		perror("semop error");

	sleep(30);

	if(semctl(semid, 0, IPC_RMID) == -1)
		perror("semctl IPC_RMID");
	else printf("remove sem ok\n");
}

$cat client.c
int semid;
int main()
{
	int i;
	int key;
	union semun arg;
	struct semid64_ds sem_info;

	key = ftok(SEM_PATH,'a');
	semid = semget(key,1,IPC_CREAT|00666);
	if(semid < 0)
		perror("client:semget");
	for (i = 0; i < MAX_TRIES; i++)
	{
		arg.buf = &sem_info;
		semctl(semid, 0, IPC_STAT, arg);
		if (sem_info.sem_otime != 0) break;
		sleep(1);
	}

	if(MAX_TRIES == i)
		printf("error in opening a existed sem\n");
	else
		printf("open exsited sem sucessfully\n");
	return 0;
}

the steps to test:
touch /tmp/my_sem
./server &
sleep 1
./client &

With the patch
1.test output:
error in opening a existed sem
2.cat /proc/sysvipc/sem
the field sem_otime is always zero

Without this patch
1.test output:
open exsited sem sucessfully
2.cat /proc/sysvipc/sem
the field sem_otime is not zero

Signed-off-by: Jia He <jiakernel@...il.com>
---
 ipc/sem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ipc/sem.c b/ipc/sem.c
index 69b6a21..8e01e76 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -590,6 +590,7 @@ static int perform_atomic_semop(struct sem_array *sma, struct sembuf *sops,
 		sop--;
 	}
 	
+	sma->sem_base[sops[0].sem_num].sem_otime = get_seconds();
 	return 0;
 
 out_of_range:
-- 
1.8.1.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/