linux-kernel - [PATCH] ipc,sem: fix semctl(..., GETZCNT)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 9 May 2013 16:53:28 -0400
From:	Rik van Riel <riel@...hat.com>
To:	torvalds@...ux-foundation.org
Cc:	davidlohr.bueso@...com, akpm@...ux-foundation.org,
	linux-kernel@...r.kernel.org, koverstreet@...gle.com
Subject: [PATCH] ipc,sem: fix semctl(..., GETZCNT)

The semctl GETZCNT returns the number of semops waiting for the
specified semaphore to become zero.  After changeset 9f1bc2c,
the semops waiting on just one semaphore are waiting on that
semaphore's list.

In order to return the correct count, we have to walk that list
too, in addition to the sem_array's list for complex operations.

This bug broke dbench; it works again with this patch applied.

Signed-off-by: Rik van Riel <riel@...hat.com>
Reported-by: Kent Overstreet <koverstreet@...gle.com>
Tested-by: Kent Overstreet <koverstreet@...gle.com>
---
 ipc/sem.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/ipc/sem.c b/ipc/sem.c
index 899b598..04b264d 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -815,6 +815,13 @@ static int count_semzcnt (struct sem_array * sma, ushort semnum)
 	struct sem_queue * q;
 
 	semzcnt = 0;
+	list_for_each_entry(q, &sma->sem_base[semnum].sem_pending, list) {
+		struct sembuf * sops = q->sops;
+		BUG_ON(sops->sem_num != semnum);
+		if ((sops->sem_op == 0) && !(sops->sem_flg & IPC_NOWAIT))
+			semzcnt++;
+	}
+
 	list_for_each_entry(q, &sma->sem_pending, list) {
 		struct sembuf * sops = q->sops;
 		int nsops = q->nsops;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/