LibBSD | rtems_bsd_sysgen_read() reads a vnode out of a descriptor that has none (#104)

[Sang Woo Kim (@sngwkim915)]

Sang Woo Kim commented: https://gitlab.rtems.org/rtems/pkg/rtems-libbsd/-/work_items/104#note_155701


Correction to my report above: on the 14-branches this defect is latent, not observable. There v_type aliases the low byte of the iop's flags word, and a socket descriptor always carries FREAD|FWRITE, so no reachable flag combination reads as VDIR. The EINVAL I measured came from 6-freebsd-12, where the FreeBSD-12 vnode layout makes the same read land past the end of the iop. The fix in !153 / !154 (final commit) still applies on the 14-branches — the read itself is wrong and becomes live the moment the flag values or the vnode layout shift — but the symptom description in this issue should be read as 6-freebsd-12 only.

-- 
View it on GitLab: https://gitlab.rtems.org/rtems/pkg/rtems-libbsd/-/work_items/104#note_155701
You're receiving this email because of your account on gitlab.rtems.org. Unsubscribe from this thread: https://gitlab.rtems.org/-/sent_notifications/4-7ykszn0u3k7zinjewrl6kvbjj-k/unsubscribe | Manage all notifications: https://gitlab.rtems.org/-/profile/notifications | Help: https://gitlab.rtems.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rtems.org/pipermail/bugs/attachments/20260728/e3daea59/attachment.htm>