MFC r294565: sem: Don't free nameinfo that is still in list when open()

fails.

This bug could be reproduced easily by calling sem_open() with O_CREAT |
O_EXCL on a semaphore that is already open in the process. The struct
sem_nameinfo would be freed while still in sem_list and later calls to
sem_open() or sem_close() could access freed memory.

PR:		206396

1 files changed, 35 insertions, 0 deletions

diff --git a/tools/regression/posixsem2/semtest.c b/tools/regression/posixsem2/semtest.c
index b1255db..0879ff9 100644
--- a/tools/regression/posixsem2/semtest.c
+++ b/tools/regression/posixsem2/semtest.c
@@ -7,6 +7,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <err.h>
+#include <errno.h>
 #include <fcntl.h>
 #include <unistd.h>
 
@@ -14,6 +15,7 @@
 
 int test_unnamed(void);
 int test_named(void);
+int test_named2(void);
 
 int
 test_unnamed(void)
@@ -94,9 +96,42 @@ test_named(void)
 }
 
 int
+test_named2(void)
+{
+	sem_t *s, *s2, *s3;
+
+	printf("testing named process-shared semaphore, O_EXCL cases\n");
+	sem_unlink(SEM_NAME);
+	s = sem_open(SEM_NAME, O_CREAT | O_EXCL, 0777, 0);
+	if (s == SEM_FAILED)
+		err(1, "sem_open failed");
+	s2 = sem_open(SEM_NAME, O_CREAT | O_EXCL, 0777, 0);
+	if (s2 != SEM_FAILED)
+		errx(2, "second sem_open call wrongly succeeded");
+	if (errno != EEXIST)
+		err(3, "second sem_open call failed with wrong errno");
+
+	s3 = sem_open(SEM_NAME, 0);
+	if (s3 == SEM_FAILED)
+		err(4, "third sem_open call failed");
+	if (s != s3)
+		errx(5,
+"two sem_open calls for same semaphore do not return same address");
+	if (sem_close(s3))
+		err(6, "sem_close failed");
+
+	if (sem_close(s))
+		err(7, "sem_close failed");
+	
+	printf("OK.\n");
+	return (0);
+}
+
+int
 main(void)
 {
 	test_unnamed();
 	test_named();
+	test_named2();
 	return (0);
 }