lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Sun, 22 Sep 2013 10:11:24 +0800
From:	Jia He <>
Cc:	Davidlohr Bueso <>,
	Andrew Morton <>,
	Rik van Riel <>,
	Manfred Spraul <>,
	Al Viro <>, Jia He <>
Subject: [PATCH] ipc/sem.c: fix update sem_otime when calling sem_op in semaphore initialization

In commit 0a2b9d4c,the update of semaphore's sem_otime(last semop time)
was removed because he wanted to move setting sem->sem_otime to one
place. But after that, the initial semop() will not set the otime
because its sem_op value is 0(in semtimedop,will not change
otime if alter == 1).

the error case:
process_a(server)       process_b(client)
                        for(;;) {               <--not successful here
                          check until sem_otime > 0

provide test codes here:
$cat server.c

int semid;
int main()
	int key;
	struct semid64_ds sem_info;
	union semun arg;
	struct sembuf sop;

	key = ftok(SEM_PATH,'a');
	semid = semget(key,1,IPC_CREAT|IPC_EXCL|00666);
	if(semid < 0)

	arg.val = 0;
	if(semctl(semid,0,SETVAL,arg) == -1)
	        perror("semctl setval error");

	sop.sem_num = 0;
	sop.sem_op = 0;
	sop.sem_flg = 0;
	if (semop(semid, &sop, 1) == -1)
		perror("semop error");


	if(semctl(semid, 0, IPC_RMID) == -1)
		perror("semctl IPC_RMID");
	else printf("remove sem ok\n");

$cat client.c
int semid;
int main()
	int i;
	int key;
	union semun arg;
	struct semid64_ds sem_info;

	key = ftok(SEM_PATH,'a');
	semid = semget(key,1,IPC_CREAT|00666);
	if(semid < 0)
	for (i = 0; i < MAX_TRIES; i++)
		arg.buf = &sem_info;
		semctl(semid, 0, IPC_STAT, arg);
		if (sem_info.sem_otime != 0) break;

	if(MAX_TRIES == i)
		printf("error in opening a existed sem\n");
		printf("open exsited sem sucessfully\n");
	return 0;

the steps to test:
touch /tmp/my_sem
./server &
sleep 1
./client &

With the patch
1.test output:
error in opening a existed sem /proc/sysvipc/sem
the field sem_otime is always zero

Without this patch
1.test output:
open exsited sem sucessfully /proc/sysvipc/sem
the field sem_otime is not zero

Signed-off-by: Jia He <>
 ipc/sem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ipc/sem.c b/ipc/sem.c
index 69b6a21..8e01e76 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -590,6 +590,7 @@ static int perform_atomic_semop(struct sem_array *sma, struct sembuf *sops,
+	sma->sem_base[sops[0].sem_num].sem_otime = get_seconds();
 	return 0;

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

Powered by blists - more mailing lists