Home | History | Annotate | Download | only in kern
History log of /src/sys/kern/uipc_sem.c
RevisionDateAuthorComments
 1.62  06-Dec-2024  riastradh sys/kern/sys_socket.c, uipc_*.c: Sprinkle SET_ERROR dtrace probes.

PR kern/58378: Kernel error code origination lacks dtrace probes
 1.61  06-Dec-2024  riastradh sys/kern/sys_socket.c, uipc_*.c: Sort includes.

No functional change intended.
 1.60  14-Dec-2020  chs branches: 1.60.24;
when updating the per-uid "semcnt", decrement the counter for the uid
that created the ksem, not the uid of the process freeing the ksem.
fixes PR 55509.

Reported-by: syzbot+9d04b3ef2ca180ef9b06@syzkaller.appspotmail.com
 1.59  04-May-2020  riastradh branches: 1.59.2;
Release the collision if we find one.

Candidate fix for:

panic: lock error: Mutex: mutex_vector_enter,542: locking against myself: lock 0xffff8f611abd37e0 cpu 8 lwp 0xffff8f60a3c6a040
cpu8: Begin traceback...
vpanic() at netbsd:vpanic+0x178
snprintf() at netbsd:snprintf
lockdebug_abort() at netbsd:lockdebug_abort+0xe6
mutex_vector_enter() at netbsd:mutex_vector_enter+0x3c1
ksem_close_fop() at netbsd:ksem_close_fop+0x17
closef() at netbsd:closef+0x69
fd_free() at netbsd:fd_free+0x101
exit1() at netbsd:exit1+0x118
sys_exit() at netbsd:sys_exit+0x3d
syscall() at netbsd:syscall+0x299

Would be nice to have an automatic test for this. Since semids are
only 24 bits, we only need to create a few thousand of them to have a
high probability of collision. Maybe we should bump default semmax
while here...
 1.58  17-Dec-2019  ad ksem_sysinit(): more lossage.
 1.57  17-Dec-2019  ad Set ksem_max before installing the syscall package.
 1.56  15-Dec-2019  joerg PR 54619: Remove semaphore limit introduce as part of GSoC 2016 with
_SC_SEM_NSEMS_MAX. Report no limit for getconf(3). The ressource is
naturally limited by the backing file descriptor, so no separate limit
is necessary. Keep the accounting for debugging as it is part of the
sysctl ABI exposed by the kernel.
 1.55  01-Mar-2019  christos branches: 1.55.4;
PR/53998: Joel Bertrand: Limit the number of semaphores on a
per-user basis not a per-process. We cannot really keep track on
a per-process basis because a parent process can create the semaphore
and a child can free it taking credit for it. There is also a
similar issue about resource exhaustion if we limited the number
of lwps per process as opposed to per user (which we don't).
 1.54  21-Feb-2019  christos PR/53998: Joel Bertrand: Return ENOSPC when SEM_NSEMS_MAX is exceeded
instead of -1.
 1.53  05-Feb-2019  thorpej In ksem_close_fop(), if we get a pshared semaphore that's not already
been marked dead, make sure we mark it so if the owner proc is the proc
closing it. (This case can happen if a process sem_init()'s a pshared
semaphore and then exits without destroying it.)

Fixes kern/53942.
 1.52  03-Feb-2019  thorpej Implement support for "pshared" POSIX semaphores.

Fixes lib/53273 (and Firefox's multi-process tab feature).
 1.51  06-May-2018  christos branches: 1.51.2;
don't use pathbuf here; it is intertwined with vfs and gives rump heartburn.
 1.50  05-May-2018  christos don't use stack for name (requested by joerg)
 1.49  04-May-2018  christos bump the pathname size to NAME_MAX as POSIX wants.
 1.48  30-Nov-2017  christos branches: 1.48.2;
add fo_name so we can identify the fileops in a simple way.
 1.47  31-Oct-2016  maxv Memory leak, found by Mootja. By the way, we probably shouldn't be
returning -1 here.
 1.46  10-Jun-2016  christos branches: 1.46.2;
GSoC 2016: Charles Cui: add SEM_NSEMS_MAX
 1.45  24-Apr-2016  dholland Define SEM_VALUE_MAX in only one place.

Adding a whole extra header file just for this is not the optimal
solution... but stuffing it in with anything else exposes things that
otherwise wouldn't be.

Nothing in userland should use <sys/semaphore.h> directly, and if some
foolish third-party software should decide to do so anyway in spite of
the instructions to the contrary I will ruthlessly break it later when
the big kernel includes cleanup finally happens.

Reported by Kamil Rytarowski, and, as it turns out, also by Klaus
Heinz in 2008.
 1.44  09-Nov-2015  pgoyette Mark kern.posix.semcnt as READONLY - we don't want users changing the
internal value!
 1.43  09-Nov-2015  pgoyette Whether or not the semaphore code is loaded as a module or built-in, its
sysctl data belongs with the module code. Move it from kern/init_sysctl.c
to kern/uipc_sem.c

While here, add a new sysctl variable kern.posix.semcnt (current count of
semaphores) to complement the existing kern.posix.semmax (maximum number
of semaphores).
 1.42  05-Sep-2014  matt branches: 1.42.2;
Try not to use f_data, use f_{vnode,socket,pipe,mqueue,kqueue,ksem} to get
a correctly typed pointer.
 1.41  05-Sep-2014  matt Don't next structure and enum definitions.
Don't use C++ keywords new, try, class, private, etc.
 1.40  29-Mar-2013  christos Centralize the computation of struct timespec to the int timo.
Make lwp_park take the regular arguments for specifying what kind
of timeout we supply like clock_nanosleep(), namely clockid_t and flags.
 1.39  25-Nov-2012  christos expose ksem_t for fstat(8), and implement stat for future reference.
 1.38  13-Mar-2012  elad branches: 1.38.2;
Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls with
something meaningful. All relevant documentation has been updated or
written.

Most of these changes were brought up in the following messages:

http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html
http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html
http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html

Thanks to christos, manu, njoly, and jmmv for input.

Huge thanks to pgoyette for spinning these changes through some build
cycles and ATF.
 1.37  09-Mar-2012  joerg sem_open and friends should return EINVAL if the semaphore is not valid.
 1.36  08-Mar-2012  joerg Implement sem_timedwait.
 1.35  17-Apr-2011  rmind branches: 1.35.4; 1.35.8;
ksem_free: remove wrong assert.
 1.34  16-Apr-2011  rmind - Add nsems_total and track the use of all semaphores (not only named ones).
Prevents ksem module from unloading while anonymous semaphore(s) are in use.
- ksem_free: add few asserts.
 1.33  15-Apr-2011  rmind sys__ksem_close: use fd_close().
 1.32  14-Apr-2011  rmind Minor comment fix. Use fd_close() in sys__ksem_destroy(), it is cleaner.
 1.31  12-Apr-2011  rmind do_ksem_open: do not leak the file descriptor on error path.
sys__ksem_unlink: fix comment, release one lock ealier.
 1.30  11-Apr-2011  rmind Highly rewrite POSIX semaphore. Use file descriptor subsystem, greatly
simplify reference counting, and fix various bugs which existed before,
e.g. some incorrect locking or sem_unlink() not checking for permissions.
 1.29  14-Nov-2008  ad branches: 1.29.8; 1.29.10;
Replace semid_t with intptr_t. No function change. This is a libc/kernel
private interface and so the name change should not affect any third
party code.
 1.28  14-Nov-2008  ad Update a couple of comments.
 1.27  12-Nov-2008  ad Allow the POSIX semaphore code to be loaded as a module.
 1.26  22-Oct-2008  ad branches: 1.26.2;
Set kern.posix_semaphores are runtime so it can be a module.
 1.25  28-Apr-2008  martin branches: 1.25.2; 1.25.6;
Remove clause 3 and 4 from TNF licenses
 1.24  04-Jan-2008  ad branches: 1.24.6; 1.24.8; 1.24.10;
Start detangling lock.h from intr.h. This is likely to cause short term
breakage, but the mess of dependencies has been regularly breaking the
build recently anyhow.
 1.23  20-Dec-2007  dsl Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.
 1.22  06-Dec-2007  rmind branches: 1.22.4;
Increase the default limit of SEM_MAX, allow changing of limit
dynamically via sysctl. Closes PR/36979.
 1.21  15-Jun-2007  ad branches: 1.21.6; 1.21.8; 1.21.14; 1.21.16;
- ksem_proc_dtor: fix a use-after-free
- LOCK_ASSERT -> KASSERT
- Use kmem(9)
 1.20  09-Feb-2007  ad branches: 1.20.6; 1.20.8;
Merge newlock2 to head.
 1.19  04-Jan-2007  elad Consistent usage of KAUTH_GENERIC_ISSUSER.
 1.18  01-Nov-2006  yamt remove some __unused from function parameters.
 1.17  12-Oct-2006  christos - sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386
 1.16  08-Oct-2006  thorpej Add specificdata support to procs and lwps, each providing their own
wrappers around the speicificdata subroutines. Also:
- Call the new lwpinit() function from main() after calling procinit().
- Move some pool initialization out of kern_proc.c and into files that
are directly related to the pools in question (kern_lwp.c and kern_ras.c).
- Convert uipc_sem.c to proc_{get,set}specific(), and eliminate the p_ksems
member from struct proc.
 1.15  23-Jul-2006  ad branches: 1.15.4; 1.15.6;
Use the LWP cached credentials where sane.
 1.14  14-May-2006  elad integrate kauth.
 1.13  05-Mar-2006  cube branches: 1.13.2; 1.13.4; 1.13.6;
Change the way semid_t values are chosen. Instead of using kernel
addresses, use a uint32_t counter and the machinery to properly use it.
That makes the ksem_* system calls friendly for COMPAT_NETBSD32.

OK'd by thorpej@.
 1.12  24-Dec-2005  perry branches: 1.12.4; 1.12.6;
Remove leading __ from __(const|inline|signed|volatile) -- it is obsolete.
 1.11  11-Dec-2005  christos merge ktrace-lwp.
 1.10  26-Feb-2005  perry branches: 1.10.4;
nuke trailing whitespace
 1.9  14-Jul-2003  lukem branches: 1.9.8; 1.9.10;
add missing __KERNEL_RCSID()
 1.8  29-Jun-2003  fvdl branches: 1.8.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.
 1.7  28-Jun-2003  darrenr Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V
 1.6  16-May-2003  itojun use strlcpy. [fixed off-by-one in subr_prop.c]
 1.5  23-Apr-2003  matt Need to include <sys/sa.h> for <sys/syscall.h>
 1.4  01-Feb-2003  thorpej Add extensible malloc types, adapted from FreeBSD. This turns
malloc types into a structure, a pointer to which is passed around,
instead of an int constant. Allow the limit to be adjusted when the
malloc type is defined, or with a function call, as suggested by
Jonathan Stone.
 1.3  24-Jan-2003  thorpej Major overhaul of this code, fixing locking protocol issues and handling
of semaphores at fork time.
 1.2  20-Jan-2003  christos sys_ksem -> sys__ksem
 1.1  20-Jan-2003  christos add support for p1003.1b semaphores. From FreeBSD
 1.8.2.6  04-Mar-2005  skrll Sync with HEAD.

Hi Perry!
 1.8.2.5  21-Sep-2004  skrll Fix the sync with head I botched.
 1.8.2.4  18-Sep-2004  skrll Sync with HEAD.
 1.8.2.3  18-Aug-2004  skrll Revert to passing struct proc for {exit,exec}hook.
 1.8.2.2  03-Aug-2004  skrll Sync with HEAD
 1.8.2.1  02-Jul-2003  darrenr Apply the aborted ktrace-lwp changes to a specific branch. This is just for
others to review, I'm concerned that patch fuziness may have resulted in some
errant code being generated but I'll look at that later by comparing the diff
from the base to the branch with the file I attempt to apply to it. This will,
at the very least, put the changes in a better context for others to review
them and attempt to tinker with removing passing of 'struct lwp' through
the kernel.
 1.9.10.1  19-Mar-2005  yamt sync with head. xen and whitespace. xen part is not finished.
 1.9.8.1  29-Apr-2005  kent sync with -current
 1.10.4.6  21-Jan-2008  yamt sync with head
 1.10.4.5  07-Dec-2007  yamt sync with head
 1.10.4.4  03-Sep-2007  yamt sync with head.
 1.10.4.3  26-Feb-2007  yamt sync with head.
 1.10.4.2  30-Dec-2006  yamt sync with head.
 1.10.4.1  21-Jun-2006  yamt sync with head.
 1.12.6.2  01-Jun-2006  kardel Sync with head.
 1.12.6.1  22-Apr-2006  simonb Sync with head.
 1.12.4.1  09-Sep-2006  rpaulo sync with head
 1.13.6.1  24-May-2006  tron Merge 2006-05-24 NetBSD-current into the "peter-altq" branch.
 1.13.4.3  06-May-2006  christos - Move kauth_cred_t declaration to <sys/types.h>
- Cleanup struct ucred; forward declarations that are unused.
- Don't include <sys/kauth.h> in any header, but include it in the c files
that need it.

Approved by core.
 1.13.4.2  10-Mar-2006  elad generic_authorize() -> kauth_authorize_generic().
 1.13.4.1  08-Mar-2006  elad Adapt to kernel authorization KPI.
 1.13.2.3  11-Aug-2006  yamt sync with head
 1.13.2.2  24-May-2006  yamt sync with head.
 1.13.2.1  05-Mar-2006  yamt file uipc_sem.c was added on branch yamt-pdpolicy on 2006-05-24 10:58:42 +0000
 1.15.6.2  10-Dec-2006  yamt sync with head.
 1.15.6.1  22-Oct-2006  yamt sync with head
 1.15.4.5  30-Jan-2007  ad Remove support for SA. Ok core@.
 1.15.4.4  12-Jan-2007  ad Sync with head.
 1.15.4.3  29-Dec-2006  ad Checkpoint work in progress.
 1.15.4.2  18-Nov-2006  ad Sync with head.
 1.15.4.1  11-Sep-2006  ad - Convert some locks to mutexes and RW locks.
- Use the proclist_lock to protect pgrps and sessions in some places.
 1.20.8.1  11-Jul-2007  mjf Sync with head.
 1.20.6.3  15-Jul-2007  ad Sync with head.
 1.20.6.2  15-Jul-2007  ad Sync with head.
 1.20.6.1  21-Mar-2007  ad GC the simplelock/spinlock debugging stuff.
 1.21.16.2  26-Dec-2007  ad Sync with head.
 1.21.16.1  08-Dec-2007  ad Sync with head.
 1.21.14.3  18-Feb-2008  mjf Sync with HEAD.
 1.21.14.2  27-Dec-2007  mjf Sync with HEAD.
 1.21.14.1  08-Dec-2007  mjf Sync with HEAD.
 1.21.8.1  09-Jan-2008  matt sync with HEAD
 1.21.6.1  09-Dec-2007  jmcneill Sync with HEAD.
 1.22.4.2  08-Jan-2008  bouyer Sync with HEAD
 1.22.4.1  02-Jan-2008  bouyer Sync with HEAD
 1.24.10.2  04-May-2009  yamt sync with head.
 1.24.10.1  16-May-2008  yamt sync with head.
 1.24.8.1  18-May-2008  yamt sync with head.
 1.24.6.2  17-Jan-2009  mjf Sync with HEAD.
 1.24.6.1  02-Jun-2008  mjf Sync with HEAD.
 1.25.6.1  13-Dec-2008  haad Update haad-dm branch to haad-dm-base2.
 1.25.2.2  14-May-2008  wrstuden Per discussion with ad, remove most of the #include <sys/sa.h> lines
as they were including sa.h just for the type(s) needed for syscallargs.h.

Instead, create a new file, sys/satypes.h, which contains just the
types needed for syscallargs.h. Yes, there's only one now, but that
may change and it's probably more likely to change if it'd be difficult
to handle. :-)

Per discussion with matt at n dot o, add an include of satypes.h to
sigtypes.h. Upcall handlers are kinda signal handlers, and signalling
is the header file that's already included for syscallargs.h that
closest matches SA.

This shaves about 3000 lines off of the diff of the branch relative
to the base. That also represents about 18% of the total before this
checkin.

I think this reduction is very good thing.
 1.25.2.1  10-May-2008  wrstuden Initial checkin of re-adding SA. Everything except kern_sa.c
compiles in GENERIC for i386. This is still a work-in-progress, but
this checkin covers most of the mechanical work (changing signalling
to be able to accomidate SA's process-wide signalling and re-adding
includes of sys/sa.h and savar.h). Subsequent changes will be much
more interesting.

Also, kern_sa.c has received partial cleanup. There's still more
to do, though.
 1.26.2.1  19-Jan-2009  skrll Sync with HEAD.
 1.29.10.1  06-Jun-2011  jruoho Sync with HEAD.
 1.29.8.1  21-Apr-2011  rmind sync with head
 1.35.8.2  05-Apr-2012  mrg sync to latest -current.
 1.35.8.1  11-Mar-2012  mrg sync to latest -current
 1.35.4.3  22-May-2014  yamt sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
 1.35.4.2  16-Jan-2013  yamt sync with (a bit old) head
 1.35.4.1  17-Apr-2012  yamt sync with head
 1.38.2.3  03-Dec-2017  jdolecek update from HEAD
 1.38.2.2  23-Jun-2013  tls resync from head
 1.38.2.1  25-Feb-2013  tls resync with head
 1.42.2.4  05-Dec-2016  skrll Sync with HEAD
 1.42.2.3  09-Jul-2016  skrll Sync with HEAD
 1.42.2.2  29-May-2016  skrll Sync with HEAD
 1.42.2.1  27-Dec-2015  skrll Sync with HEAD (as of 26th Dec)
 1.46.2.1  04-Nov-2016  pgoyette Sync with HEAD
 1.48.2.1  21-May-2018  pgoyette Sync with HEAD
 1.51.2.2  08-Apr-2020  martin Merge changes from current as of 20200406
 1.51.2.1  10-Jun-2019  christos Sync with HEAD
 1.55.4.3  17-Aug-2022  martin Pull up following revision(s) (requested by chs in ticket #1501):

sys/kern/uipc_sem.c: revision 1.60

when updating the per-uid "semcnt", decrement the counter for the uid
that created the ksem, not the uid of the process freeing the ksem.
fixes PR 55509.
 1.55.4.2  05-May-2020  martin Pull up following revision(s) (requested by maya in ticket #888):

sys/kern/uipc_sem.c: revision 1.59

Release the collision if we find one.

Candidate fix for:
panic: lock error: Mutex: mutex_vector_enter,542: locking against myself: lock 0xffff8f611abd37e0 cpu 8 lwp 0xffff8f60a3c6a040
cpu8: Begin traceback...
vpanic() at netbsd:vpanic+0x178
snprintf() at netbsd:snprintf
lockdebug_abort() at netbsd:lockdebug_abort+0xe6
mutex_vector_enter() at netbsd:mutex_vector_enter+0x3c1
ksem_close_fop() at netbsd:ksem_close_fop+0x17
closef() at netbsd:closef+0x69
fd_free() at netbsd:fd_free+0x101
exit1() at netbsd:exit1+0x118
sys_exit() at netbsd:sys_exit+0x3d
syscall() at netbsd:syscall+0x299

Would be nice to have an automatic test for this. Since semids are
only 24 bits, we only need to create a few thousand of them to have a
high probability of collision. Maybe we should bump default semmax
while here...
 1.55.4.1  18-Dec-2019  martin Pull up following revision(s) (requested by joerg in ticket #572):

sys/kern/uipc_sem.c: revision 1.56
lib/libc/gen/sysconf.c: revision 1.43

PR 54619: Remove semaphore limit introduce as part of GSoC 2016 with
_SC_SEM_NSEMS_MAX. Report no limit for getconf(3). The ressource is
naturally limited by the backing file descriptor, so no separate limit
is necessary. Keep the accounting for debugging as it is part of the
sysctl ABI exposed by the kernel.
 1.59.2.1  03-Jan-2021  thorpej Sync w/ HEAD.
 1.60.24.1  02-Aug-2025  perseant Sync with HEAD

RSS XML Feed