Bug in file read/write with forked file-descriptors

[Chris Torek]

In article <1989Sep22.160808.1407 at light.uucp> bvs at light.uucp (Bakul Shah)
writes:
>The problem is where fp->f_offset is updated once read/write is finished.
>It should be updated while the inode is locked.

This bug was fixed quite some time ago (perhaps in 4.3-tahoe, perhaps a
bit afterward).  Here is the fix.  Your lines numbers may not match.

*** /tmp/,RCSt1003823	Sat Sep 23 00:28:18 1989
--- /tmp/,RCSt2003823	Sat Sep 23 00:28:21 1989
***************
*** 4,8 ****
   * specifies the terms and conditions for redistribution.
   *
!  *	@(#)sys_inode.c	7.1 (Berkeley) 6/5/86
   */
  
--- 4,8 ----
   * specifies the terms and conditions for redistribution.
   *
!  *	@(#)sys_inode.c	7.5.1.1 (Berkeley) 11/24/87
   */
  
***************
*** 36,49 ****
  {
  	register struct inode *ip = (struct inode *)fp->f_data;
! 	int error;
  
! 	if ((ip->i_mode&IFMT) == IFREG) {
  		ILOCK(ip);
! 		if (fp->f_flag&FAPPEND && rw == UIO_WRITE)
! 			uio->uio_offset = fp->f_offset = ip->i_size;
! 		error = rwip(ip, uio, rw);
  		IUNLOCK(ip);
- 	} else
- 		error = rwip(ip, uio, rw);
  	return (error);
  }
--- 36,53 ----
  {
  	register struct inode *ip = (struct inode *)fp->f_data;
! 	int count, error;
  
! 	if ((ip->i_mode&IFMT) != IFCHR)
  		ILOCK(ip);
! 	if ((ip->i_mode&IFMT) == IFREG &&
! 	    (fp->f_flag&FAPPEND) &&
! 	    rw == UIO_WRITE)
! 		fp->f_offset = ip->i_size;
! 	uio->uio_offset = fp->f_offset;
! 	count = uio->uio_resid;
! 	error = rwip(ip, uio, rw);
! 	fp->f_offset += count - uio->uio_resid;
! 	if ((ip->i_mode&IFMT) != IFCHR)
  		IUNLOCK(ip);
  	return (error);
  }
***************
*** 148,152 ****
  			bn = fsbtodb(fs,
  			    bmap(ip, lbn, rw == UIO_WRITE ? B_WRITE: B_READ,
! 				(int)(on+n)));
  			if (u.u_error || rw == UIO_WRITE && (long)bn < 0)
  				return (u.u_error);
--- 152,156 ----
  			bn = fsbtodb(fs,
  			    bmap(ip, lbn, rw == UIO_WRITE ? B_WRITE: B_READ,
! 				(int)(on + n)));
  			if (u.u_error || rw == UIO_WRITE && (long)bn < 0)
  				return (u.u_error);
***************
*** 253,256 ****
--- 257,261 ----
  			    fp->f_flag));
  	}
+ 	/* NOTREACHED */
  }
  
***************
*** 319,323 ****
  	register struct file *fp;
  {
! 	register struct inode *ip = (struct inode *)fp->f_data;
  	dev_t dev;
  	int flag, mode;
--- 324,328 ----
  	register struct file *fp;
  {
! 	struct inode *ip = (struct inode *)fp->f_data;
  	dev_t dev;
  	int flag, mode;
***************
*** 331,335 ****
  	 * will prevent close.
  	 */
! 	fp->f_data = (caddr_t) 0;		/* XXX */
  	dev = (dev_t)ip->i_rdev;
  	mode = ip->i_mode & IFMT;
--- 336,340 ----
  	 * will prevent close.
  	 */
! 	fp->f_data = (caddr_t) 0;
  	dev = (dev_t)ip->i_rdev;
  	mode = ip->i_mode & IFMT;
***************
*** 364,368 ****
  		/*
  		 * We don't want to really close the device if it is mounted
! 		 * of if we're swapping on it.
  		 */
  /* MOUNT TABLE SHOULD HOLD INODE */
--- 369,373 ----
  		/*
  		 * We don't want to really close the device if it is mounted
! 		 * or if we're swapping on it.
  		 */
  /* MOUNT TABLE SHOULD HOLD INODE */
-- 
In-Real-Life: Chris Torek, Univ of MD Comp Sci Dept (+1 301 454 7163)
Domain:	chris at mimsy.umd.edu	Path:	uunet!mimsy!chris