Mon Dec 14 23:12:12 2020 UTC ()

when updating the per-uid "semcnt", decrement the counter for the uid
that created the ksem, not the uid of the process freeing the ksem.
fixes PR 55509.

Reported-by: syzbot+9d04b3ef2ca180ef9b06@syzkaller.appspotmail.com


(chs)

diff -r1.59 -r1.60 src/sys/kern/uipc_sem.c

--- src/sys/kern/uipc_sem.c 2020/05/04 13:58:48	1.59
+++ src/sys/kern/uipc_sem.c 2020/12/14 23:12:12	1.60

 @@ -1,14 +1,14 @@
-/*	$NetBSD: uipc_sem.c,v 1.59 2020/05/04 13:58:48 riastradh Exp $	*/
+/*	$NetBSD: uipc_sem.c,v 1.60 2020/12/14 23:12:12 chs Exp $	*/
 /*-
  * Copyright (c) 2011, 2019 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Mindaugas Rasiukevicius and Jason R. Thorpe.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -50,27 +50,27 @@
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 /*
  * Implementation of POSIX semaphore.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_sem.c,v 1.59 2020/05/04 13:58:48 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_sem.c,v 1.60 2020/12/14 23:12:12 chs Exp $");
 #include <sys/param.h>
 #include <sys/kernel.h>
 #include <sys/atomic.h>
 #include <sys/proc.h>
 #include <sys/lwp.h>
 #include <sys/ksem.h>
 #include <sys/syscall.h>
 #include <sys/stat.h>
 #include <sys/kmem.h>
 #include <sys/fcntl.h>
 #include <sys/file.h>
 @@ -459,66 +459,65 @@ ksem_create(lwp_t *l, const char *name,
 			return ENAMETOOLONG;
+		}
 		/* Name must start with a '/' but not contain one. */
 		if (*name != '/' || len < 2 || strchr(name + 1, '/') != NULL) {
 			return EINVAL;
+		}
 		kname = kmem_alloc(++len, KM_SLEEP);
 		strlcpy(kname, name, len);
 	} else {
 		kname = NULL;
 		len = 0;
+	}
 	chgsemcnt(kauth_cred_getuid(l->l_cred), 1);
 	ks = kmem_zalloc(sizeof(ksem_t), KM_SLEEP);
 	mutex_init(&ks->ks_lock, MUTEX_DEFAULT, IPL_NONE);
 	cv_init(&ks->ks_cv, "psem");
 	ks->ks_name = kname;
 	ks->ks_namelen = len;
 	ks->ks_mode = mode;
 	ks->ks_value = val;
 	ks->ks_ref = 1;
 	uc = l->l_cred;
 	ks->ks_uid = kauth_cred_geteuid(uc);
 	ks->ks_gid = kauth_cred_getegid(uc);
 	chgsemcnt(ks->ks_uid, 1);
 	atomic_inc_uint(&nsems_total);
 	*ksret = ks;
 	return 0;
+}
 static void
 ksem_free(ksem_t *ks)
+{
 	KASSERT(!cv_has_waiters(&ks->ks_cv));
 	chgsemcnt(ks->ks_uid, -1);
 	atomic_dec_uint(&nsems_total);
 	if (ks->ks_pshared_id) {
 		KASSERT(ks->ks_pshared_proc == NULL);
 		ksem_remove_pshared(ks);
+	}
 	if (ks->ks_name) {
 		KASSERT(ks->ks_namelen > 0);
 		kmem_free(ks->ks_name, ks->ks_namelen);
+	}
 	mutex_destroy(&ks->ks_lock);
 	cv_destroy(&ks->ks_cv);
 	kmem_free(ks, sizeof(ksem_t));
 	atomic_dec_uint(&nsems_total);
 	chgsemcnt(kauth_cred_getuid(curproc->p_cred), -1);
+}
 #define	KSEM_ID_IS_PSHARED(id)		\
 	(((id) & KSEM_MARKER_MASK) == KSEM_PSHARED_MARKER)
 static void
 ksem_release(ksem_t *ksem, int fd)
+{
 	bool destroy = false;
 	KASSERT(mutex_owned(&ksem->ks_lock));
 	KASSERT(ksem->ks_ref > 0);