Fix memory corruptions with sysv semaphores due to sleeps in copyin,
authormbuhl <mbuhl@openbsd.org>
Wed, 28 Sep 2022 13:21:13 +0000 (13:21 +0000)
committermbuhl <mbuhl@openbsd.org>
Wed, 28 Sep 2022 13:21:13 +0000 (13:21 +0000)
commit5bf1588a93fe615588d7fe6c66add7d7bc8f4c6a
treed66d3846d520eef584b23a5bff30f8d589fe7f52
parentfb511131b227ae5b04a9eb21f19d3f71d808424a
Fix memory corruptions with sysv semaphores due to sleeps in copyin,
copyout and malloc.  During a sleep another thread could delete the
semaphore (and possibly allocate another one at the same location
with different permissions) which would lead to an invalid access
after wake up.  Therefore check the semaphore pointer, the sequence,
the permissions and some values in seminfo after each sleep.
OK bluhm@
Reported-by: syzbot+60ba811fe2e8a6b0f975@syzkaller.appspotmail.com
sys/kern/sysv_sem.c