*BSD News Article 10335


Return to BSD News archive

Received: by minnie.vk1xwt.ampr.org with NNTP
	id AA7741 ; Mon, 25 Jan 93 12:21:02 EST
Xref: sserve comp.unix.bsd:10388 comp.bugs.4bsd:1930
Path: sserve!manuel.anu.edu.au!munnari.oz.au!spool.mu.edu!olivea!hal.com!decwrl!deccrl!news.crl.dec.com!news!nntpd.lkg.dec.com!decvax.dec.com!jtkohl
From: jtkohl@decvax.dec.com (John Kohl Base File System)
Newsgroups: comp.unix.bsd,comp.bugs.4bsd
Subject: syscall(2) broken on i386 + FIX
Message-ID: <1993Jan24.171107.9454@nntpd.lkg.dec.com>
Date: 24 Jan 93 17:11:07 GMT
Sender: usenet@nntpd.lkg.dec.com (USENET News System)
Organization: Digital Equipment Corporation
Lines: 33

This bug seems to derive from the Net/2 i386 BSD code; it's in BSD/386,
and probably also in 386BSD.

Description:
	syscall(2) doesn't work right.  It leaves $sp off by a word,
which can lead to disaster when it's called repeatedly (as it is in
XView3.0).

Repeat-By:
	Write a program that has a local variable on the stack;
initialize it, then call syscall() repeatedly.  Note that the value
eventually gets trashed when the stack works its way up over the
variable.
Fix:
*** /cdrom/usr/src/lib/libc/i386/sys/syscall.s	Wed Jan  1 16:22:58 1992
--- syscall.s	Sat Jan 23 01:24:01 1993
***************
*** 45,50 ****
--- 45,52 ----
  	pop	%eax	/* syscall number */
  	push	%ecx
  	LCALL(7,0)
+ 	push	%ecx	/* need to push a word to keep stack frame intact
+ 			   upon return; the word must be the return address. */
  	jb	1f
  	ret
  1:

--
John Kohl <jtkohl@zk3.dec.com> or <jtkohl@mit.edu>
working for but not representing:	Digital Equipment Corporation
Member of the League for Programming Freedom---get details: lpf@uunet.uu.net
(The above opinions are MINE.  Don't put my words in somebody else's mouth!)