From mboxrd@z Thu Jan  1 00:00:00 1970
From: erik quanstrom <quanstro@quanstro.net>
Date: Fri, 25 Sep 2009 00:34:23 -0400
To: 9fans@9fans.net
Message-ID: <0394dacaee5cc8e182b6c87f23bd1c8f@brasstown.quanstro.net>
In-Reply-To: <<f75780240909242033k11fb23a0o237f7dbedf9a7bee@mail.gmail.com>>
References: <<f75780240909242033k11fb23a0o237f7dbedf9a7bee@mail.gmail.com>>
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Subject: Re: [9fans] segattach off-by-one?
Topicbox-Message-UUID: 774b57e4-ead5-11e9-9d60-3106f5b1d025

(aside: "sig segattach" fails because nroff can elide
all leading space.  /n/sources/patch/signit

one could argue for replacing the \*? in
selecting files with \** but no functions
return a **.)

i think segattach is already correct.  consider this

#include <u.h>
#include <libc.h>

enum {
	Sz	= 0x1000,
};

void
main(void)
{
	uchar *base, *rb;

	base = (uchar*)0x10001001;
	rb = segattach(0, "shared", base, Sz - 10);
	print("%p\n", rb);
	base[0] = 'a';
	base[-1] = 'a';
	base[Sz - 2] = 'a';		/* note this does not fault, even though Sz - 10 was used */
>>	base[Sz - 1] = 'a';
	exits("");
}

% 8.out
10001000	# not 10001001.
81 8.out: checked 8 page table entries
8.out 81: suicide: sys: trap: fault write addr=0x10002000 pc=0x1073

if i were to have used rb and not base, this base[-1] would have
faulted but base[Sz - 1] would have been okay.  so i woud think
this is a misunderstanding of how segattach works.

if one wishes to disallow mapping the zero page this
condition should be changed:
	if(va != 0 && va >= USTKTOP)
		error(Ebadarg);
to
	if(va < BY2PG || va >= USTKTOP)

- erik