HomeFreeBSD

MFC r294565: sem: Don't free nameinfo that is still in list when open()

Description

MFC r294565: sem: Don't free nameinfo that is still in list when open()
fails.

This bug could be reproduced easily by calling sem_open() with O_CREAT |
O_EXCL on a semaphore that is already open in the process. The struct
sem_nameinfo would be freed while still in sem_list and later calls to
sem_open() or sem_close() could access freed memory.

PR: 206396

Details

Provenance
jillesAuthored on
Parents
rS294962: Merge ^/head r294777 through r294960.
Branches
Unknown
Tags
Unknown