[net.unix-wizards] Serious bug fixed: f_count

mike@Brl-Bmd.ARPA (03/06/83)

From:      Mike Muuss <mike@Brl-Bmd.ARPA>

In the definition of the file structure (h/file.h) you will find
the field f_count is a CHAR.  Change that to an INT (or SHORT, if
you are fastidious), and the problem you report should be solved.
May as well change f_flags to an INT at the same time, the excess
byte will be aligned away anyways, otherwise...

The problem may, of course, be caused by other things, but this
bug is the most likely.

To belabor the now obvious, when f_count transitions from 127 to 128,
it will be read back as -128 next time it's looked at.  Depending on
whether the code says f_count <= 0 or just f_count == 0, the problem
may be defered until the transition from 255 to 256, but...

All sites which have NPROC * NOFILE > 127 (or 255, depending) potentially
have this problem.  You all may wish to check this.

A cheap demonstration of the problem is to come up on a disk you don't care
for, single user, and keep typing "sh" <RETURN> -- ie, stacking up lots
of shells, each waiting for the next.  We found that after doing this
127/3 (43) times, the prompt "# " was written in the directory /dev.
Messy.
					Cheers,
					 -Mike