From owner-freebsd-bugs@FreeBSD.ORG  Sat Aug 19 20:29:03 2006
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
X-Original-To: freebsd-bugs@freebsd.org
Delivered-To: freebsd-bugs@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2F83B16A4DF
	for <freebsd-bugs@freebsd.org>; Sat, 19 Aug 2006 20:29:03 +0000 (UTC)
	(envelope-from kris@obsecurity.org)
Received: from elvis.mu.org (elvis.mu.org [192.203.228.196])
	by mx1.FreeBSD.org (Postfix) with ESMTP id EBC2043D45
	for <freebsd-bugs@freebsd.org>; Sat, 19 Aug 2006 20:29:02 +0000 (GMT)
	(envelope-from kris@obsecurity.org)
Received: from obsecurity.dyndns.org (elvis.mu.org [192.203.228.196])
	by elvis.mu.org (Postfix) with ESMTP id B82C81A4DD9;
	Sat, 19 Aug 2006 13:29:02 -0700 (PDT)
Received: by obsecurity.dyndns.org (Postfix, from userid 1000)
	id 16BCE53AAA; Sat, 19 Aug 2006 16:29:01 -0400 (EDT)
Date: Sat, 19 Aug 2006 16:29:00 -0400
From: Kris Kennaway <kris@obsecurity.org>
To: ?????? <shangjie.li@gmail.com>
Message-ID: <20060819202900.GI36605@xor.obsecurity.org>
References: <de71d27b0607260104g1ba570aci2c5980a55d1bb3bf@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <de71d27b0607260104g1ba570aci2c5980a55d1bb3bf@mail.gmail.com>
User-Agent: Mutt/1.4.2.2i
Cc: freebsd-bugs@freebsd.org
Subject: Re: semctl bug
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 19 Aug 2006 20:29:03 -0000

On Wed, Jul 26, 2006 at 04:04:06PM +0800, ?????? wrote:
> In file kern/sysv_sem.c:
> 554 __semctl(td, uap)
> 555         struct thread *td;
> 556         struct __semctl_args *uap;
> 557 {
> 558         int semid = uap->semid; <<<here  1
> 559         int semnum = uap->semnum;
> 560         int cmd = uap->cmd;
> 561         u_short *array;
> 562         union semun *arg = uap->arg;
> 563         union semun real_arg;
> 564         struct ucred *cred = td->td_ucred;
> 565         int i, rval, error;
> 566         struct semid_ds sbuf;
> 567         struct semid_kernel *semakptr;
> 568         struct mtx *sema_mtxp;
> 569         u_short usval, count;
> 570
> 571         DPRINTF(("call to semctl(%d, %d, %d, 0x%x)\n",
> 572             semid, semnum, cmd, arg));
> 573         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
> 574                 return (ENOSYS);
> 575
> 576         array = NULL;
> 577
> 578         switch(cmd) {
> 579         case SEM_STAT:
> 580                 if (semid < 0 || semid >= seminfo.semmni) <<<here 2
> 581                         return (EINVAL);
> 582                 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) 
> != 0)
> 583                         return (error);
> 584                 semakptr = &sema[semid];<<<here 3
> 
> >From line 558 to line 578, there must be a mechism to convert the
> sem_id to the internal sema array index. In fact, it was missing,
> which make the semctl syscall not work well. The  return valure of
> semget, the semaphore ID, is larger than 65535.  when test on line 580
> return  EINVAL in any case. Following code also using the semid which
> is from user directly as index of sema[] array.

Please submit a PR so this bug report is not lost.

Kris