James Graham <greywolf@starwolf.com> writes:

> My wonder was in the opposite direction, i.e. why are we segfaulting on it
> instead of returning EFAULT and letting userland deal with it?

Again, the kernel isn't dealing with user address space at all in the
current implementation of the pipe(2) call. It just returns a pair of
file descriptors in registers (or whatever the machine-dependent way
to return a pair of ints is), and libc wrapper code
(lib/libc/arch/whatever/sys/pipe.S) puts those two ints into the
user-provided array. It's that last bit of user-level code that
segfaults when you call pipe(0xdeadbeef) from your program.

        - Nathan