HomeFreeBSD

sem: Don't free nameinfo that is still in list when open() fails.

Description

sem: Don't free nameinfo that is still in list when open() fails.

This bug could be reproduced easily by calling sem_open() with O_CREAT |
O_EXCL on a semaphore that is already open in the process. The struct
sem_nameinfo would be freed while still in sem_list and later calls to
sem_open() or sem_close() could access freed memory.

PR: 206396
MFC after: 5 days

Details

Provenance
jillesAuthored on
Parents
rS294564: r294563 was incomplete; re-add the client-side options as well.
Branches
Unknown
Tags
Unknown