From owner-freebsd-bugs  Sun Mar 16 10:46:12 1997
Return-Path: <owner-bugs>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id KAA13226
          for bugs-outgoing; Sun, 16 Mar 1997 10:46:12 -0800 (PST)
Received: from godzilla.zeta.org.au (godzilla.zeta.org.au [203.2.228.19])
          by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id KAA13217
          for <freebsd-bugs@freefall.freebsd.org>; Sun, 16 Mar 1997 10:46:04 -0800 (PST)
Received: (from bde@localhost) by godzilla.zeta.org.au (8.8.3/8.6.9) id FAA11407; Mon, 17 Mar 1997 05:43:34 +1100
Date: Mon, 17 Mar 1997 05:43:34 +1100
From: Bruce Evans <bde@zeta.org.au>
Message-Id: <199703161843.FAA11407@godzilla.zeta.org.au>
To: freebsd-bugs@freefall.freebsd.org, roberto@keltia.freenix.fr
Subject: Re: bin/3004: "watch" causes a reboot when not given a tty name
Sender: owner-bugs@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

> > 	"watch" can cause the system to reboot without any trace

> It has been fixed in the current sources. 2.2 also have the fix (Jörg put
> it in the 2.2 branch). The problem was that watch tried to enable snoop
> mode on /dev/tty.

The real problem is in the kernel.  Applications should not be able to
cause a panic.

The problem in watch was actually that it tried to enable snoop mode
on the directory /dev/.  st_rdev is invalid for non-devices on ufs
file systems.  For directories and regular files, it is an alias for
the first block number in the file.  This block number happens to be
0xa40 for my /dev/, so watch eventually tried to enable snoop mode
on the cdev with major number 0xa (rwt).  I don't have a rwt device,
so the cdevsw for it is NULL.  The kernel paniced because devtotty()
doesn't check for NULL pointers.

Bruce