devstat: Fix a kernel stack disclosure
The 16-byte "device_name" field was not zero-filled, so could contain
uninitialized stack data. Zero the whole struct, as that's the
prevailing pattern for this kind of conversion code, and it's more
robust in the face of future revisions to struct devstat.
Reviewed by: olce, kib
Reported by: Reo Shiseki
Fixes: a11d132f6c62 ("devstat: Provide 32-bit compatibility")
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59309
(cherry picked from commit 7cb1a76f88158fb690418336b736e66c238cd4f7)
iflib: Require sustained demand for TX watchdog
The restored watchdog arms when the outstanding descriptor count
grows, but then continues counting based only on the queue remaining
frozen. A single growth sample can therefore leave a quiet, nearly
empty queue armed until the watchdog resets the interface. Lockless
sampling of the queue counters can also manufacture the initial growth
sample.
This matches watchdog reports from I354 queues with 979 or 980 of
1022 usable descriptors still available. Neither queue was under
transmit backpressure when the reset flapped its link.
Keep the watchdog armed only while the outstanding count continues
to grow, the software ring is stalled, or the hardware ring is at
iflib's backpressure threshold. The last condition preserves hang
detection with simple-TX, which bypasses the software ring. A busy hang
still reaches the verdict while a frozen but quiet tail disarms. Retain
the final driver completion peek so a missed completion interrupt
[14 lines not shown]
mail/py-notmuch2: Fix value of PKGNAMESUFFIX
In commit db96db170fc4, the value of PKGNAMESUFFIX was accidentally
changed from 2 to 0. Fix this by setting it back to the correct value,
2, which renames the package back to py*-notmuch2.
Bump PORTREVISION, so the renamed package is reinstalled with a
corrected plist.
PR: 298122
Reported by: John Hein <jcfyecrayz at liamekaens.com>
Fixes: db96db170fc4 (mail/notmuch*: Update to 0.34.2)
Sponsored by: The FreeBSD Foundation
vmimage.subr: Use makefs -N
By default, makefs uses the host environment's user and group databases
when creating filesystems. This causes makefs to fail when trying to
create files owned by users or groups which don't exist in the host
environment, for example when creating a VM with packages pre-installed
which added their own users/groups.
Pass "-N ${DESTDIR}/etc" to makefs to point it at the user and group
databases from the image being created.
MFC after: 1 week
Sponsored by: Amazon
devel/Makefile: remove reference to moved port sfml
Fixes: dbfa9f04377fb4df340c26648cc09c9a8c3b1273
Reported by: "Edward Sanford Sutton, III" <mirror176 at hotmail.com>
oci: Install FreeBSD-pam in the runtime image
In 16.0/15.1, the PAM modules were split from FreeBSD-runtime into a
new FreeBSD-pam package. FreeBSD-runtime does not install FreeBSD-pam,
which means if a user starts from runtime, then installs sshd, sshd will
fail to authenticate users because of missing PAM modules.
Since FreeBSD-pam is relatively small (about 230kB on amd64), and is
already part of FreeBSD-set-minimal, add it to the runtime image as
well. Users who absolutely don't want this can still build their
own images without it.
MFC after: 1 week
Reviewed by: dfr
Reported by: Michael Johnson <ahze at ahze.net>
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59194
www/freenginx-devel: third-party modules management
- njs module security update to 1.0.1
Bump PORTREVISION.
Sponsored by: tipi.work
<ChangeLog>
nginx modules:
*) Security: fixed an access control bypass in js_access when an
asynchronous request body continuation threw an exception or
produced an unhandled rejection. Previously, nginx could continue
processing the request as though the js_access check had succeeded.
Thanks to Ta Duc Thien.
*) Security: fixed a worker process crash when reading
[48 lines not shown]
x11-wm/lxappearance-obconf: do not pollute RUN_DEPENDS
Currently it includes gmake, pkgconf and intltool as runtime dependencies
due to incorrect variables usage
Replaced the construction with an extra OTHER_DEPENDS variable
accordingly to 5.10.2. RUN_DEPENDS FreeBSD Porter's Handbook
Pull Request: https://github.com/freebsd/freebsd-ports/pull/607
syslogd: reap pipe children on config reload
On SIGHUP reload, closelogfiles() frees each F_PIPE filed even when its
pipe process is still running. close_filed() sets f_type to F_UNUSED
before the check, so the condition f_type != F_PIPE is always true and
the filed is freed while its process descriptor is still on the dead
queue and registered in the kqueue. When the child later exits, the
NOTE_EXIT handler dereferences the freed filed (use-after-free) and
never closes the process descriptor, leaving the pipe child as a
persistent zombie.
Capture whether the filed is a pipe with an active process descriptor
before calling close_filed(), and defer the free in that case so the
NOTE_EXIT handler can reap the child and free the filed.
Reviewed by: markj
Fixes: 95381c0139d6 (syslogd: Use process descriptors)
Differential Revision: https://reviews.freebsd.org/D59319
