xnu-2782.40.9.tar.gz

[apple/xnu.git] / bsd / kern / sysv_sem.c

diff --git a/bsd/kern/sysv_sem.c b/bsd/kern/sysv_sem.c
index 0e44029cf5fe7f87583e5979a38b0a8889c68773..418a4c6e00922fb0ccb43cf7c016d68ebb086949 100644 (file)
--- a/bsd/kern/sysv_sem.c
+++ b/bsd/kern/sysv_sem.c
@@ -444,7 +444,8 @@ grow_sem_pool(int new_pool_size)
        /* Update our id structures to point to the new semaphores */
        for(i = 0; i < seminfo.semmni; i++) {
                if (sema[i].u.sem_perm.mode & SEM_ALLOC)  /* ID in use */
        /* Update our id structures to point to the new semaphores */
        for(i = 0; i < seminfo.semmni; i++) {
                if (sema[i].u.sem_perm.mode & SEM_ALLOC)  /* ID in use */

-                       sema[i].u.sem_base += (new_sem_pool - sem_pool);
+                       sema[i].u.sem_base = new_sem_pool + 
+                               (sema[i].u.sem_base - sem_pool);

        }
 
        sem_free = sem_pool;
        }
 
        sem_free = sem_pool;


@@ -774,10 +775,12 @@ semctl(struct proc *p, struct semctl_args *uap, int32_t *retval)
 
                if (IS_64BIT_PROCESS(p)) {
                        struct user64_semid_ds semid_ds64;
 
                if (IS_64BIT_PROCESS(p)) {
                        struct user64_semid_ds semid_ds64;

+                       bzero(&semid_ds64, sizeof(semid_ds64));

                        semid_ds_kernelto64(&semakptr->u, &semid_ds64);
                        eval = copyout(&semid_ds64, user_arg.buf, sizeof(semid_ds64));
                } else {
                        struct user32_semid_ds semid_ds32;
                        semid_ds_kernelto64(&semakptr->u, &semid_ds64);
                        eval = copyout(&semid_ds64, user_arg.buf, sizeof(semid_ds64));
                } else {
                        struct user32_semid_ds semid_ds32;

+                       bzero(&semid_ds32, sizeof(semid_ds32));

                        semid_ds_kernelto32(&semakptr->u, &semid_ds32);
                        eval = copyout(&semid_ds32, user_arg.buf, sizeof(semid_ds32));
                }
                        semid_ds_kernelto32(&semakptr->u, &semid_ds32);
                        eval = copyout(&semid_ds32, user_arg.buf, sizeof(semid_ds32));
                }


@@ -853,12 +856,27 @@ semctl(struct proc *p, struct semctl_args *uap, int32_t *retval)
                        eval = EINVAL;
                        goto semctlout;
                }
                        eval = EINVAL;
                        goto semctlout;
                }

+               

                /*
                 * Cast down a pointer instead of using 'val' member directly
                 * to avoid introducing endieness and a pad field into the
                 * header file.  Ugly, but it works.
                 */
                /*
                 * Cast down a pointer instead of using 'val' member directly
                 * to avoid introducing endieness and a pad field into the
                 * header file.  Ugly, but it works.
                 */

-               semakptr->u.sem_base[semnum].semval = CAST_DOWN_EXPLICIT(int,user_arg.buf);
+               u_int newsemval = CAST_DOWN_EXPLICIT(u_int, user_arg.buf);
+               
+               /*
+                * The check is being performed as unsigned values to match 
+                * eventual destination
+                */ 
+               if (newsemval > (u_int)seminfo.semvmx)
+               {
+#ifdef SEM_DEBUG
+                       printf("Out of range sem value for set\n");
+#endif
+                       eval = ERANGE;
+                       goto semctlout;
+               }
+               semakptr->u.sem_base[semnum].semval = newsemval;

                semakptr->u.sem_base[semnum].sempid = p->p_pid;
                /* XXX scottl Should there be a MAC call here? */
                semundo_clear(semid, semnum);
                semakptr->u.sem_base[semnum].sempid = p->p_pid;
                /* XXX scottl Should there be a MAC call here? */
                semundo_clear(semid, semnum);


@@ -999,8 +1017,8 @@ semget(__unused struct proc *p, struct semget_args *uap, int32_t *retval)
                sema[semid].u.sem_perm._key = key;
                sema[semid].u.sem_perm.cuid = kauth_cred_getuid(cred);
                sema[semid].u.sem_perm.uid = kauth_cred_getuid(cred);
                sema[semid].u.sem_perm._key = key;
                sema[semid].u.sem_perm.cuid = kauth_cred_getuid(cred);
                sema[semid].u.sem_perm.uid = kauth_cred_getuid(cred);

-               sema[semid].u.sem_perm.cgid = cred->cr_gid;
-               sema[semid].u.sem_perm.gid = cred->cr_gid;
+               sema[semid].u.sem_perm.cgid = kauth_cred_getgid(cred);
+               sema[semid].u.sem_perm.gid = kauth_cred_getgid(cred);

                sema[semid].u.sem_perm.mode = (semflg & 0777) | SEM_ALLOC;
                sema[semid].u.sem_perm._seq =
                    (sema[semid].u.sem_perm._seq + 1) & 0x7fff;
                sema[semid].u.sem_perm.mode = (semflg & 0777) | SEM_ALLOC;
                sema[semid].u.sem_perm._seq =
                    (sema[semid].u.sem_perm._seq + 1) & 0x7fff;


@@ -1044,7 +1062,7 @@ semop(struct proc *p, struct semop_args *uap, int32_t *retval)
 {
        int semid = uap->semid;
        int nsops = uap->nsops;
 {
        int semid = uap->semid;
        int nsops = uap->nsops;

-       struct sembuf sops[MAX_SOPS];
+       struct sembuf sops[seminfo.semopm];

        register struct semid_kernel *semakptr;
        register struct sembuf *sopptr = NULL;  /* protected by 'semptr' */
        register struct sem *semptr = NULL;     /* protected by 'if' */
        register struct semid_kernel *semakptr;
        register struct sembuf *sopptr = NULL;  /* protected by 'semptr' */
        register struct sem *semptr = NULL;     /* protected by 'if' */


@@ -1084,13 +1102,23 @@ semop(struct proc *p, struct semop_args *uap, int32_t *retval)
                goto semopout;
        }
 
                goto semopout;
        }
 

-       if (nsops < 0 || nsops > MAX_SOPS) {
+       if (nsops < 0 || nsops > seminfo.semopm) {

 #ifdef SEM_DEBUG
 #ifdef SEM_DEBUG

-               printf("too many sops (max=%d, nsops=%d)\n", MAX_SOPS, nsops);
+               printf("too many sops (max=%d, nsops=%d)\n",
+                   seminfo.semopm, nsops);

 #endif
                eval = E2BIG;
                goto semopout;
        }
 #endif
                eval = E2BIG;
                goto semopout;
        }

+       
+       /*  OK for LP64, since sizeof(struct sembuf) is currently invariant */
+       if ((eval = copyin(uap->sops, &sops, nsops * sizeof(struct sembuf))) != 0) {
+#ifdef SEM_DEBUG
+               printf("eval = %d from copyin(%08x, %08x, %ld)\n", eval,
+                   uap->sops, &sops, nsops * sizeof(struct sembuf));
+#endif
+               goto semopout;
+       }

 
 #if CONFIG_MACF
        /*
 
 #if CONFIG_MACF
        /*


@@ -1110,15 +1138,6 @@ semop(struct proc *p, struct semop_args *uap, int32_t *retval)
                goto semopout;
 #endif
 
                goto semopout;
 #endif
 

-       /*  OK for LP64, since sizeof(struct sembuf) is currently invariant */
-       if ((eval = copyin(uap->sops, &sops, nsops * sizeof(struct sembuf))) != 0) {
-#ifdef SEM_DEBUG
-               printf("eval = %d from copyin(%08x, %08x, %ld)\n", eval,
-                   uap->sops, &sops, nsops * sizeof(struct sembuf));
-#endif
-               goto semopout;
-       }
-

        /*
         * Loop trying to satisfy the vector of requests.
         * If we reach a point where we must wait, any requests already
        /*
         * Loop trying to satisfy the vector of requests.
         * If we reach a point where we must wait, any requests already


@@ -1454,10 +1473,7 @@ semexit(struct proc *p)
                /* Maybe we should build a list of semakptr's to wake
                 * up, finish all access to data structures, release the
                 * subsystem lock, and wake all the processes.  Something
                /* Maybe we should build a list of semakptr's to wake
                 * up, finish all access to data structures, release the
                 * subsystem lock, and wake all the processes.  Something

-                * to think about.  It wouldn't buy us anything unless
-                * wakeup had the potential to block, or the syscall
-                * funnel state was changed to allow multiple threads
-                * in the BSD code at once.
+                * to think about.

                 */
 #ifdef SEM_WAKEUP
                        sem_wakeup((caddr_t)semakptr);
                 */
 #ifdef SEM_WAKEUP
                        sem_wakeup((caddr_t)semakptr);


@@ -1539,19 +1555,19 @@ out:
 
 /* SYSCTL_NODE(_kern, KERN_SYSV, sysv, CTLFLAG_RW, 0, "SYSV"); */
 extern struct sysctl_oid_list sysctl__kern_sysv_children;
 
 /* SYSCTL_NODE(_kern, KERN_SYSV, sysv, CTLFLAG_RW, 0, "SYSV"); */
 extern struct sysctl_oid_list sysctl__kern_sysv_children;

-SYSCTL_PROC(_kern_sysv, OID_AUTO, semmni, CTLTYPE_INT | CTLFLAG_RW,
+SYSCTL_PROC(_kern_sysv, OID_AUTO, semmni, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,

     &limitseminfo.semmni, 0, &sysctl_seminfo ,"I","semmni");
 
     &limitseminfo.semmni, 0, &sysctl_seminfo ,"I","semmni");
 

-SYSCTL_PROC(_kern_sysv, OID_AUTO, semmns, CTLTYPE_INT | CTLFLAG_RW,
+SYSCTL_PROC(_kern_sysv, OID_AUTO, semmns, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,

     &limitseminfo.semmns, 0, &sysctl_seminfo ,"I","semmns");
 
     &limitseminfo.semmns, 0, &sysctl_seminfo ,"I","semmns");
 

-SYSCTL_PROC(_kern_sysv, OID_AUTO, semmnu, CTLTYPE_INT | CTLFLAG_RW,
+SYSCTL_PROC(_kern_sysv, OID_AUTO, semmnu, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,

     &limitseminfo.semmnu, 0, &sysctl_seminfo ,"I","semmnu");
 
     &limitseminfo.semmnu, 0, &sysctl_seminfo ,"I","semmnu");
 

-SYSCTL_PROC(_kern_sysv, OID_AUTO, semmsl, CTLTYPE_INT | CTLFLAG_RW,
+SYSCTL_PROC(_kern_sysv, OID_AUTO, semmsl, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,

     &limitseminfo.semmsl, 0, &sysctl_seminfo ,"I","semmsl");
     
     &limitseminfo.semmsl, 0, &sysctl_seminfo ,"I","semmsl");
     

-SYSCTL_PROC(_kern_sysv, OID_AUTO, semume, CTLTYPE_INT | CTLFLAG_RW,
+SYSCTL_PROC(_kern_sysv, OID_AUTO, semume, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,

     &limitseminfo.semume, 0, &sysctl_seminfo ,"I","semume");
 
 
     &limitseminfo.semume, 0, &sysctl_seminfo ,"I","semume");
 
 


@@ -1634,9 +1650,11 @@ IPCS_sem_sysctl(__unused struct sysctl_oid *oidp, __unused void *arg1,
                 * descriptor to a 32 bit user one.
                 */
                if (!IS_64BIT_PROCESS(p)) {
                 * descriptor to a 32 bit user one.
                 */
                if (!IS_64BIT_PROCESS(p)) {

+                       bzero(&semid_ds32, sizeof(semid_ds32));

                        semid_ds_kernelto32(semid_dsp, &semid_ds32);
                        semid_dsp = &semid_ds32;
                } else {
                        semid_ds_kernelto32(semid_dsp, &semid_ds32);
                        semid_dsp = &semid_ds32;
                } else {

+                       bzero(&semid_ds64, sizeof(semid_ds64));

                        semid_ds_kernelto64(semid_dsp, &semid_ds64);
                        semid_dsp = &semid_ds64;
                }
                        semid_ds_kernelto64(semid_dsp, &semid_ds64);
                        semid_dsp = &semid_ds64;
                }


@@ -1662,7 +1680,7 @@ IPCS_sem_sysctl(__unused struct sysctl_oid *oidp, __unused void *arg1,
 }
 
 SYSCTL_DECL(_kern_sysv_ipcs);
 }
 
 SYSCTL_DECL(_kern_sysv_ipcs);

-SYSCTL_PROC(_kern_sysv_ipcs, OID_AUTO, sem, CTLFLAG_RW|CTLFLAG_ANYBODY,
+SYSCTL_PROC(_kern_sysv_ipcs, OID_AUTO, sem, CTLFLAG_RW | CTLFLAG_ANYBODY | CTLFLAG_LOCKED,

        0, 0, IPCS_sem_sysctl,
        "S,IPCS_sem_command",
        "ipcs sem command interface");
        0, 0, IPCS_sem_sysctl,
        "S,IPCS_sem_command",
        "ipcs sem command interface");