Path: utzoo!utgpu!watserv1!watmath!att!cbnewsl!sar0
From: sar0@cbnewsl.att.com (stephen.a.rago)
Newsgroups: ncr.sys.unix,comp.unix.wizards
Subject: Re: POLL(2) corrupts pollfd struct when nfds > NPOLLFILE
Summary: SVR3.2 fixes this problem
Keywords: SysV.3 poll(2)
Message-ID: <1990Jun10.034205.1344@cbnewsl.att.com>
Date: 10 Jun 90 03:42:05 GMT
References: <1300@adds.newyork.NCR.COM>
Followup-To: sar@attunix.att.com
Organization: AT&T Bell Laboratories
Lines: 19

In article <1300@adds.newyork.NCR.COM>, tanya@adds.newyork.NCR.COM (Tanya Katz) writes:
> 
> Calling poll(2) with nfds > NPOLLFILE causes corruption of the pollfd 
> structure at offsets > NPOLLFILE.
> The O/S we are using is Unix v.3 Release 1.01 for the NCR Tower 32/700.
> If nfds > NPOLLFILE, the kernel code loops through the pollfd array
> in chunks of NPOLLFILE.  The problem arises when copyin() is called 
> to copy user data into kernel space.
> If nfds > NPOLLFILE the pointer to the user pollfd structure is never 
> advanced and the copyin() routine always copies the same user data 
> into the kernel structure.
> When copyout() is called the user data, beginning with offsets > 
> NPOLLFILE, is overwritten with the data from the beginning of the table.
> Anyone have similar experiences?

Yeah, SVR3.2 fixes this problem.

Steve Rago
sar@attunix.att.com