When you call kernel to (for example) open file, kernel returns file descriptor or error.

I would like to know what is smallest possible value of file descriptor returned by kernel.

The idea is to compare smallest value (or largest value of error code) to returned value in eax so we won't need to check every possible error if not necessary.

Hope you get the point.

linux kernel error codes are in range -4096 to 0. so you can do:

Are you shore?

Well, not 0, 0 is usually used to mean "all went well", but it is -4096 to -1 to indicate error as far as i know. Each one means a different error (although most syscalls probably wont implement all the error codes, just any which are relevant to what they are doing).

As for the lowest file descriptor which a syscall will return, it should technically be 0, if there is a syscall to return the stdin file descriptor.

FD Description
0 Stdin
1 Stdout
2 Stderr
3+ Used for files, pipes, threads.. anything which requires a file descriptor.

Aren't you just supposed to check for errors by "num < 0"? It'd be more work checking actual ranges then, and you could end up in trouble that way...

f0dder, are you talking about vid's code? It works, I'm still not convincing myself of how it works but after a few test it worked. Thanks for post it vid

f0dder, checking for < 0 will check between 0x8000000 and 0xFFFFFFFF (for 32-bits), which is much too large of a range, values returned are valid from 0 up to 0xFFFFEFFF, then between 0xFFFFF000 and 0xFFFFFFFF are the possible error values.

Are they, now?

If the code internally uses signed ints to represent errors, then I very much doubt this.

f0dder: this is following standards, not particular implementation of those standards. And standards AFAIK say that error code is -4096 to -1, which CAN be tested by one cmp

vid: okay - got a link to manpage, source file, or similar?

Just keep in mind that most C code probably checks for "<0", so...

f0dder: got logic.

In linux you have 3GB user-mode address space. What if mmap() returns you pointer above 2GB?

Also, from what i have read, even memory page xFFFFE000 to 0xFFFFEFFF is mapped. Then it seems logical to choose those values as error codes, which cannot act as pointer (those which immediately throw GPF)

f0dder: after some exploring... i realized it's probably not a standard. But still it is the logical range. <0 just wouldn't work well. And keep in mind "c code" is using libc, not linux kernel.

I thought this was about file descriptors - but I see it has been expanded to a more generic "kernel error returns"

Well, I've never bothered doing syscalls directly on *u*x (and I can't be bothered), so I wouldn't know if there's 100% generic rules... I'd be surprised if there were.

MAX_ERRNO is 4095, hence the error values are in the range -4095 .. -1.
Simply checking the sign (since 'test eax, eax' is smaller and faster than 'cmp eax, -4096') will work fine for almost all system calls.

but unfortunately, not for all. And using non-generic method you risk you will get used to it, and use it even when you shouldn't (like mmap).