NetBSD Problem Report #60064

From www@netbsd.org  Sat Mar  7 19:07:47 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "R12" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 6205C1A923C
	for <gnats-bugs@gnats.NetBSD.org>; Sat,  7 Mar 2026 19:07:47 +0000 (UTC)
Message-Id: <20260307190746.4A1201A923D@mollari.NetBSD.org>
Date: Sat,  7 Mar 2026 19:07:46 +0000 (UTC)
From: pyhirricturtle@gmail.com
Reply-To: pyhirricturtle@gmail.com
To: gnats-bugs@NetBSD.org
Subject: vax: typo in compat_13_machdep.c: sp =- 8 should be sp -= 8
X-Send-Pr-Version: www-1.0
X-From4GNATS: "pyhirricturtle@gmail.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60064
>Category:       port-vax
>Synopsis:       vax: typo in compat_13_machdep.c: sp =- 8 should be sp -= 8
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-vax-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Mar 07 19:10:01 +0000 2026
>Last-Modified:  Sat Mar 07 19:15:01 +0000 2026
>Originator:     FireTurtle
>Release:        NetBSD 10 (also present in -current trunk)
>Organization:
>Environment:
System: NetBSD/vax
>Description:
In sys/arch/vax/vax/compat_13_machdep.c, function setupstack_oldsigcontext(), line 194:

    sp =- 8;

This is parsed by the C compiler as sp = (-8) -- i.e., assignment of the constant -8 to sp. The intended expression is sp -= 8 (subtract 8 from the stack pointer to make room for the trampoline PC).

The bug has been present since the file was created in 2009 (rev 1.1, committed by mjf). It corrupts the stack pointer during signal delivery on VAX when using the NetBSD 1.3 compat sigcontext path, setting sp to an absolute address of -8 (0xFFFFFFF8) rather than adjusting it relative to the current frame. Found by static analysis tooling. The COMPAT_13 signal delivery path is rarely exercised, which likely explains why the bug went undetected.
>How-To-Repeat:
Audit the source -- the intent from the surrounding comment ("Point stack pointer at pc in trampoline") makes it clear that subtraction is meant. The archaic =op syntax (pre-K&R C) is accepted silently by some compilers, masking the bug.
>Fix:
--- a/sys/arch/vax/vax/compat_13_machdep.c
+++ b/sys/arch/vax/vax/compat_13_machdep.c
@@ -191,7 +191,7 @@
 mutex_exit(p->p_lock);

 /* Point stack pointer at pc in trampoline.  */
-sp =- 8;
+sp -= 8;

 error = copyout(&tramp, (char *)tramp.scp - sizeof(tramp), sizeof(tramp)) != 0 ||
     copyout(&sigctx, (void *)tramp.scp, sizeof(sigctx)) != 0;

>Audit-Trail:
From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60064 CVS commit: src/sys/arch/vax/vax
Date: Sat, 7 Mar 2026 14:12:59 -0500

 Module Name:	src
 Committed By:	christos
 Date:		Sat Mar  7 19:12:58 UTC 2026

 Modified Files:
 	src/sys/arch/vax/vax: compat_13_machdep.c

 Log Message:
 PR/60064: FireTurtle: typo: sp =- 8 should be sp -= 8


 To generate a diff of this commit:
 cvs rdiff -u -r1.6 -r1.7 src/sys/arch/vax/vax/compat_13_machdep.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

Home	PR Database Search