Received: from PACIFIC-CARRIER-ANNEX.MIT.EDU by po7.MIT.EDU (5.61/4.7) id AA21513; Sat, 2 Dec 95 12:08:08 EST
Received: from pain.lcs.mit.edu by MIT.EDU with SMTP
	id AB07617; Sat, 2 Dec 95 12:06:33 EST
Received: (from daemon@localhost) by pain.lcs.mit.edu (8.6.12/8.6.9) id LAA22684; Sat, 2 Dec 1995 11:05:05 -0500
Received: (from gnats@localhost) by pain.lcs.mit.edu (8.6.12/8.6.9) id LAA22676; Sat, 2 Dec 1995 11:05:02 -0500
Resent-Date: Sat, 2 Dec 1995 11:05:02 -0500
Resent-Message-Id: <199512021605.LAA22676@pain.lcs.mit.edu>
Resent-From: gnats@NetBSD.ORG (GNATS Management)
Resent-To: gnats-admin@pain.lcs.mit.edu
Resent-Cc: gnats-admin@pain.lcs.mit.edu, netbsd-bugs@NetBSD.ORG
Resent-Reply-To: gnats-bugs@NetBSD.ORG, drochner@zelz19.zel.kfa-juelich.de
Received: from zelz19.zel.kfa-juelich.de by pain.lcs.mit.edu (8.6.12/8.6.9) with ESMTP id KAA22612 for <gnats-bugs@gnats.netbsd.org>; Sat, 2 Dec 1995 10:48:04 -0500
Received: (from drochner@localhost) by zelz19.zel.kfa-juelich.de (8.6.12/8.6.12) id PAA09830; Sat, 2 Dec 1995 15:57:35 +0100
Message-Id: <199512021457.PAA09830@zelz19.zel.kfa-juelich.de>
Date: Sat, 2 Dec 1995 15:57:35 +0100
From: Matthias Drochner <drochner@zelz19.zel.kfa-juelich.de>
Reply-To: drochner@zelz19.zel.kfa-juelich.de
To: gnats-bugs@gnats.netbsd.org
X-Send-Pr-Version: 3.95
Subject: kern/1804: panics in ibcs2_sys_read
Sender: owner-netbsd-bugs@NetBSD.ORG
Precedence: list
X-Loop: netbsd-bugs@NetBSD.ORG


>Number:         1804
>Category:       kern
>Synopsis:       panics in ibcs2_sys_read
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Dec  2 11:05:01 1995
>Last-Modified:
>Originator:     Matthias Drochner
>Organization:
	KFA Juelich
>Release:        1.1
>Environment:
	NetBSD-1.1 (and -current) with COMPAT_IBCS2
System: NetBSD zelz19 1.1 NetBSD 1.1 (MIST) #11: Fri Dec 1 19:15:50 MET 1995 root@zelz19:/usr/src/sys/arch/i386/compile/MIST i386


>Description:
	SysV binaries which read directories by "read" can cause a panic.
	This is ether the "ibcs2_read" panic in line 516 of ibcs2_misc.c
	or a bad dereference of the bdp pointer in the same block.
>How-To-Repeat:
	run such binaries...
>Fix:
	In lines 506/507, the addition / subtraction of "off" seems unnecessary.
	This worked for me:
*** 504,509 ****
                goto out;
        }
!       inp = buf + off;
!       buflen -= off;
        outp = SCARG(uap, buf);
        resid = SCARG(uap, nbytes);
--- 504,509 ----
                goto out;
        }
!       inp = buf /* + off */;
! /*    buflen -= off; */
        outp = SCARG(uap, buf);
        resid = SCARG(uap, nbytes);

	Otherwise, the code is pretty identical to ibcs2_sys_getdents.
>Audit-Trail:
>Unformatted: