Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!utgpu!water!watmath!clyde!cbosgd!ihnp4!ptsfa!ames!husc6!seismo!mimsy!chris
From: chris@mimsy.UUCP
Newsgroups: comp.unix.wizards
Subject: Re: /dev/stdin for 4.3?
Message-ID: <7036@mimsy.UUCP>
Date: Sun, 14-Jun-87 00:08:40 EDT
Article-I.D.: mimsy.7036
Posted: Sun Jun 14 00:08:40 1987
Date-Received: Tue, 16-Jun-87 01:04:53 EDT
References: <7359@brl-adm.ARPA> <5856@brl-smoke.ARPA> <15318@onfcanim.UUCP> <792@mcgill-vision.UUCP>
Organization: U of Maryland, Dept. of Computer Science, Coll. Pk., MD 20742
Lines: 64

In article <792@mcgill-vision.UUCP> mouse@mcgill-vision.UUCP (der Mouse)
gives an implementation of the `open' routine for the /dev/fd/n driver.
His has an interesting bug.  Try `cat /dev/fd/3', or run the following
program:

	main()
	{
		int fd, cc;
		extern int errno;

		(void) close(2);
		fd = open("/dev/stderr", 1);
		if (fd != 2) {
			printf("did not get stderr: fd=%d, errno=%d\n", fd,
				errno);
			exit(0);
		}
		if ((cc = write(2, "odd", 3)) != 3)
			printf("wrote %d instead of 3, errno=%d\n", cc, errno);
		exit(0);
	}

The problem is that in

	int fd = minor(dev);
	int rfd = u.u_r.r_val1;

`fd' is then equal to `rfd', so all the permission checks pass, and then

	u.u_ofile[rfd]->f_count --;

sets f_count to zero;

	u.u_ofile[rfd] = u.u_ofile[fd];

is a no-op;

	u.u_pofile[rfd] = u.u_pofile[fd] & ~UF_EXCLOSE;

is also a no-op; and

	u.u_ofile[fd]->f_count ++;

sets f_count back to 1.  The `write' then calls nodev.

This should not in fact break anything, but is an interesting
loophole that is closed in Fred Blonder's version.

As to this:

>I was not aware of any way to make a device which could be treated
>like a directory like that (/dev/fd/0).

There is nothing special going on here.

	# mkdir /dev/fd
	# cd /dev/fd
	# major=64		# or whatever cdevsw slot you have used
	# nofile=`egrep NOFILE /usr/include/sys/param.h | awk '{print $3}'`
	# for i in `awk "END {for(i=0;i<$nofile;i++)print i}"</dev/null`; do
	> mknod $i c $major $i; done
-- 
In-Real-Life: Chris Torek, Univ of MD Comp Sci Dept (+1 301 454 7690)
Domain:	chris@mimsy.umd.edu	Path:	seismo!mimsy!chris