Bug 25393

Summary: System panics, when user calls poll with parameters in wrong order
Product: Base System Reporter: ak03 <ak03>
Component: kernAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 5.0-CURRENT   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
file.diff none

Description ak03 2001-02-26 23:20:01 UTC
While trying to compile the new ksh93 updated recently by  Steve Price, I've
discovered that this port in its current form causes -CURRENT to panic. The
problem is with one of the tests ksh93 build system is running to determine
target system capabilities. Namely, it tries to check if poll functions takes
a pointer to the array of file descriptors as second parameter, i.e. it does
something like:

   poll(1, &fd, 0)

Kernel then tries to allocate memory for what it thinks is a very large array
of fd's and malloc panics machine because of insufficient kernel address space.
There are checks in the kernel which are supposed to prevent exactly this
problem, but they are not catching bogus 'nfds' value because 'nfds' variable
is defined as int and is treated as negative for huge values like pointer value.

Attached patch fixes the problem by defining nfds variable as u_int.

How-To-Repeat: 	main() {
            poll(1, &fd, 0);
        }
Comment 1 jlemon freebsd_committer freebsd_triage 2001-02-27 00:50:32 UTC
State Changed
From-To: open->closed

Functionally similar fix applied, thanks!