From owner-freebsd-bugs@FreeBSD.ORG Fri May 16 09:50:16 2003 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E1CB237B401 for ; Fri, 16 May 2003 09:50:15 -0700 (PDT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id DF9DF43FB1 for ; Fri, 16 May 2003 09:50:14 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.9/8.12.9) with ESMTP id h4GGoEUp030843 for ; Fri, 16 May 2003 09:50:14 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.9/8.12.9/Submit) id h4GGoEVN030842; Fri, 16 May 2003 09:50:14 -0700 (PDT) Resent-Date: Fri, 16 May 2003 09:50:14 -0700 (PDT) Resent-Message-Id: <200305161650.h4GGoEVN030842@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Yar Tikhiy Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A6EA737B401 for ; Fri, 16 May 2003 09:47:24 -0700 (PDT) Received: from stylish.chem.msu.su (stylish.chem.msu.su [158.250.32.111]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6705A43F93 for ; Fri, 16 May 2003 09:47:23 -0700 (PDT) (envelope-from yar@stylish.chem.msu.su) Received: from stylish.chem.msu.su (localhost [127.0.0.1]) by stylish.chem.msu.su (8.12.9/8.12.9) with ESMTP id h4GGkeSM000678 for ; Fri, 16 May 2003 20:46:40 +0400 (MSD) (envelope-from yar@stylish.chem.msu.su) Received: (from yar@localhost) by stylish.chem.msu.su (8.12.9/8.12.9/Submit) id h4GGkdDS000677; Fri, 16 May 2003 20:46:39 +0400 (MSD) Message-Id: <200305161646.h4GGkdDS000677@stylish.chem.msu.su> Date: Fri, 16 May 2003 20:46:39 +0400 (MSD) From: Yar Tikhiy To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: kern/52338: fd(4) floppy disk driver & non-blocking I/O X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 May 2003 16:50:16 -0000 >Number: 52338 >Category: kern >Synopsis: fd(4) floppy disk driver & non-blocking I/O >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri May 16 09:50:14 PDT 2003 >Closed-Date: >Last-Modified: >Originator: Yar Tikhiy >Release: FreeBSD 5.1-BETA i386 >Organization: Moscow State University >Environment: System: FreeBSD stylish.chem.msu.su 5.1-BETA FreeBSD 5.1-BETA #1: Thu May 15 11:40:27 MSD 2003 yar@stylish.chem.msu.su:/usr/obj/usr/src/sys/STYLISH i386 >Description: If /dev/fdX has been opened in non-blocking mode, the inserted floppy type will never be autoselected. So trying to get its parameters through DIOCGSECTORSIZE or DIOCGMEDIASIZE will cause panic on dereferencing the NULL fd->ft pointer. And reading from or writing to its descriptor will result in the ENXIO (Device not configured) error. >How-To-Repeat: To see the panic, run the following test program on /dev/fd0: # ./fdtest /dev/fd0 ===================================================== #include #include #include #include #include #include int main(int argc, char **argv) { int fd; unsigned blksz; off_t medsz; if (argc < 2) errx(2, "Args!"); fd = open(argv[1], O_RDONLY | O_NDELAY); if (fd < 0) err(2, "open"); if (ioctl(fd, DIOCGSECTORSIZE, &blksz) < 0) err(2, "DIOCGSECTORSIZE"); if (ioctl(fd, DIOCGMEDIASIZE, &medsz) < 0) err(2, "DIOCGMEDIASIZE"); printf("%u %lld\n", blksz, medsz); close(fd); return (0); } ===================================================== And the following program, written in somewhat poor style, will demonstrate the read(2) bug: ===================================================== #include #include #include #include #include #include int main(int argc, char **argv) { int fd; unsigned blksz; off_t medsz; char buf[512]; if (argc < 2) errx(2, "Args!"); fd = open(argv[1], O_RDONLY | O_NDELAY); if (fd < 0) err(2, "open"); if (read(fd, buf, 512) < 512) err(2, "read"); close(fd); return (0); } ===================================================== >Fix: Not ready yet... >Release-Note: >Audit-Trail: >Unformatted: