Subject: kern/21230: wscons crash
To: None <gnats-bugs@gnats.netbsd.org>
From: None <o.vd.linden@quicknet.nl>
List: netbsd-bugs
Date: 04/19/2003 13:48:01
>Number:         21230
>Category:       kern
>Synopsis:       crash in wsemul_vt100_output_normal
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Apr 19 11:49:00 UTC 2003
>Closed-Date:
>Last-Modified:
>Originator:     Onno van der Linden
>Release:        NetBSD 1.6Q
>Organization:
	
>Environment:
	
	
System: NetBSD sheep 1.6Q NetBSD 1.6Q (SHEEP) #0: Sun Apr 6 16:29:49 MEST 2003 onno@sheep:/usr/src/sys/arch/i386/compile/SHEEP i386
Architecture: i386
Machine: i386
>Description:
	Here's the ddb stacktrace (only wrote down the function calls and
the offset in wsemul_vt100_output_normal)

wsemul_vt100_output_normal+0x66
wsemul_vt100_output
wsdisplaystart
ttstart
ttwrite
wsdisplaywrite
ufsspec_write
VOP_WRITE
vn_write
dofilewrite
sys_write
syscall_plain

>How-To-Repeat:
Don't know. I've seen this type of crash once or twice before but I have no
idea in what circumstances it occurs.
>Fix:

The crash occurs at offset 0x66

wsemul_vt100_output_normal+0x63: sall $2, %eax
wsemul_vt100_output_normal+0x66: movl 96(%eax,%ebx),%edx

ebx contains edp. eax is chartab0 or chartab1 which is used as an offset
into the u_int chartab_G array of size 4. It looks like this offset gets out
of control in rare circumstances.
>Release-Note:
>Audit-Trail:
>Unformatted: