>Number:         9299
>Category:       kern
>Synopsis:       SYSV IPC semaphores problem
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jan 26 09:03:02 2000
>Last-Modified:
>Originator:     Jason R. Thorpe
>Organization:
Numerical Aerospace Simulation Facility - NASA Ames
>Release:        1999/12/05
>Environment:
	
System: NetBSD dr-evil 1.4Q NetBSD 1.4Q (DR-EVIL) #278: Tue Jan 25 17:03:06 PST 2000 thorpej@dr-evil:/u1/netbsd/src/sys/arch/i386/compile/DR-EVIL i386


>Description:
	There is a proplem with SYSV IPC semaphores.  URA Hiroshi
	<ura@hiru.aoba.yokohama.jp> sent a message to current-users
	regarding this problem on Dec 14, 1999.  This PR contains
	his message, and has been put in the bugs database so that
	it won't get lost.

>How-To-Repeat:

[ Message to current-users follows ]

I have the same problem when I run the samba on my sparc running
NetBSD-current (1999/12/05).  

I wrote a attached test code by way of cheking semaphore. I got valid
results on PC running NetBSD-current (1999/12/05), but I got invaild
on sparc.


  case PC:
    pc% ./shmemtest.i386elf
    real user id = 12494
    real group id = 20
    effective user id = 12494
    effective group id = 20
    *** union ***
    semaphore user id = 12494
              group id = 20
              creator user id = 12494
              creator group id = 20
              mode = 1644 (932)
    *** varargs ***
    semaphore user id = 12494
              group id = 20
              creator user id = 12494
              creator group id = 20
              mode = 1644 (932)
    *** sleeping ***
    ^Z
    Suspended
    pc% bg
    [1]    ./shmemtest.i386elf &
    pc% ipcs -a
        <snip>
    Semaphores:
    T     ID     KEY        MODE       OWNER    GROUP  CREATOR   CGROUP \
    NSEMS   OTIME    CTIME
    s 458752    1114482 --rw-r--r--    12494       20    12494       20 \
    16no-entry 14:48:12

  case Sparc:
    sparc{1}% ./shmemtest.sparc 
    real user id = 12494
    real group id = 20
    effective user id = 12494
    effective group id = 20
    *** union ***
    semaphore user id = 20
              group id = 12494
              creator user id = 20
              creator group id = 932
              mode = 2200000 (589824)
    *** varargs ***
    semaphore user id = 12494
              group id = 20
              creator user id = 12494
              creator group id = 20
              mode = 1644 (932)
    *** sleeping ***
    ^Z
    Suspended
    sparc% bg
    [1]    ./shmemtest.sparc &
    sparc% ipcs -a
        <snip>
    Semaphores:
    T     ID     KEY        MODE       OWNER    GROUP  CREATOR   CGROUP \
    NSEMS   OTIME    CTIME
    s 589824    1114482 --rw-r--r--    12494       20    12494       20 \
    16no-entry 14:50:01


[ test program follows ]

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>

#include <sys/types.h>
#include <sys/ipc.h>
#include <sys/sem.h>

int
main(argc, argv)
        int argc;
        char *argv[];
{
        int sem_id;
        union {
                int val;
                struct semid_ds *buf;
                unsigned short *array;
        } sem_un;
        struct semid_ds sem_ds;

        printf("real user id = %d\n", getuid());
        printf("real group id = %d\n", getgid());
        printf("effective user id = %d\n", geteuid());
        printf("effective group id = %d\n", getegid());

        if ((sem_id = semget(0x110172, 0, 0)) < 0) {
                if ((sem_id = semget(0x110172, 16,
                                     IPC_CREAT | IPC_EXCL | 0644)) < 0) {
                        perror("semget");
                        exit(EXIT_FAILURE);
                }
        }

        printf("*** union ***\n");
        sem_un.buf = &sem_ds;
        if (semctl(sem_id, 0, IPC_STAT, sem_un) != 0) {
                perror("semctl");
                exit(EXIT_FAILURE);
        }

        printf("semaphore user id = %d\n"
               "          group id = %d\n"
               "          creator user id = %d\n"
               "          creator group id = %d\n"
               "          mode = %4o (%d)\n",
               sem_ds.sem_perm.uid, sem_ds.sem_perm.gid,
               sem_ds.sem_perm.cuid, sem_ds.sem_perm.cgid,
               sem_ds.sem_perm.mode, sem_ds.sem_perm.mode);

        printf("*** varargs ***\n");
        if (semctl(sem_id, 0, IPC_STAT, &sem_ds) != 0) {
                perror("semctl");
                exit(EXIT_FAILURE);
        }

        printf("semaphore user id = %d\n"
               "          group id = %d\n"
               "          creator user id = %d\n"
               "          creator group id = %d\n"
               "          mode = %4o (%d)\n",
               sem_ds.sem_perm.uid, sem_ds.sem_perm.gid,
               sem_ds.sem_perm.cuid, sem_ds.sem_perm.cgid,
               sem_ds.sem_perm.mode, sem_ds.sem_perm.mode);

        printf("*** sleeping ***\n");
        sleep(120);

        if (semctl(sem_id, 0, IPC_RMID, sem_un) != 0) {
                perror("semctl");
                exit(EXIT_FAILURE);
        }

        exit(EXIT_SUCCESS);
}

>Fix:
>Audit-Trail:
>Unformatted: