Re: [9fans] segattach off-by-one?

[erik quanstrom <quanstro@quanstro.net>]

(aside: "sig segattach" fails because nroff can elide
all leading space.  /n/sources/patch/signit

one could argue for replacing the \*? in
selecting files with \** but no functions
return a **.)

i think segattach is already correct.  consider this

#include <u.h>
#include <libc.h>

enum {
	Sz	= 0x1000,
};

void
main(void)
{
	uchar *base, *rb;

	base = (uchar*)0x10001001;
	rb = segattach(0, "shared", base, Sz - 10);
	print("%p\n", rb);
	base[0] = 'a';
	base[-1] = 'a';
	base[Sz - 2] = 'a';		/* note this does not fault, even though Sz - 10 was used */
>>	base[Sz - 1] = 'a';
	exits("");
}

% 8.out
10001000	# not 10001001.
81 8.out: checked 8 page table entries
8.out 81: suicide: sys: trap: fault write addr=0x10002000 pc=0x1073

if i were to have used rb and not base, this base[-1] would have
faulted but base[Sz - 1] would have been okay.  so i woud think
this is a misunderstanding of how segattach works.

if one wishes to disallow mapping the zero page this
condition should be changed:
	if(va != 0 && va >= USTKTOP)
		error(Ebadarg);
to
	if(va < BY2PG || va >= USTKTOP)

- erik