POLL(2) corrupts pollfd struct when nfds > NPOLLFILE

Thread View: ncr.sys.unix

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by Tanya Katz Fri, 01 Jun 1990 16:58

Author: Tanya Katz
Date: Fri, 01 Jun 1990 16:58

30 lines
1505 bytes

Calling poll(2) with nfds > NPOLLFILE causes corruption of the pollfd 
structure at offsets > NPOLLFILE.

The O/S we are using is Unix v.3 Release 1.01 for the NCR Tower 32/700.

If nfds > NPOLLFILE, the kernel code loops through the pollfd array
in chunks of NPOLLFILE.  The problem arises when copyin() is called 
to copy user data into kernel space.

If nfds > NPOLLFILE the pointer to the user pollfd structure is never 
advanced and the copyin() routine always copies the same user data 
into the kernel structure.

When copyout() is called the user data, beginning with offsets > 
NPOLLFILE, is overwritten with the data from the beginning of the table.

Anyone have similar experiences?

-Tanya


#-------------------------------------------------#
| Tanya Katz                  (516) 231-5400 x430 |
|                                                 |
|	...uunet!ncrlnk!adds!tanya                |
| 	tanya.katz@adds.newyork.ncr.com           |
|                                                 |
| ADDS Inc, 100 Marcus Blvd, Hauppauge, NY 11788  |
#-------------------------------------------------#

Re: POLL(2) corrupts pollfd struct when nfds > NPOLLFILE

Author: stephen.a.rago
Date: Sun, 10 Jun 1990 03:42

19 lines
1369 bytes

In article <1300@adds.newyork.NCR.COM>, tanya@adds.newyork.NCR.COM (Tanya Katz) writes:
> 
> Calling poll(2) with nfds > NPOLLFILE causes corruption of the pollfd 
> structure at offsets > NPOLLFILE.
> The O/S we are using is Unix v.3 Release 1.01 for the NCR Tower 32/700.
> If nfds > NPOLLFILE, the kernel code loops through the pollfd array
> in chunks of NPOLLFILE.  The problem arises when copyin() is called 
> to copy user data into kernel space.
> If nfds > NPOLLFILE the pointer to the user pollfd structure is never 
> advanced and the copyin() routine always copies the same user data 
> into the kernel structure.
> When copyout() is called the user data, beginning with offsets > 
> NPOLLFILE, is overwritten with the data from the beginning of the table.
> Anyone have similar experiences?

Yeah, SVR3.2 fixes this problem.

Steve Rago
sar@attunix.att.com

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads