tcp: minor cleanup
Several cleanups in tcp_input_with_port():
* Don't assign m twice.
* Don't reassign pointers without having done pullup().
* While there, change the type of isipv6 to bool, since it is used
that way.
No functional change intended.
Reported by: Hannes Elfert
Reviewed by: pouria, Timo Völker, Nick Banks
MFC after: 1 week
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D59142
zfskeys - only prompt if zfskeys and zfskeys_prompt are enabled
By default don't block booting with a prompt if a zpool needs a keyboard
password to unlock it. To enable prompting for keyboard password during
boot require:
zfskeys_enable="YES"
zfskeys_prompt_enable="YES"
to both be enabled. This returns to POLA of prior behaviour.
PR: 296130
Reviewed by: kevans
Differential Revision: https://reviews.freebsd.org/D57750
(cherry picked from commit 276a3dacdb60b65d65301aced5d8443cc5d27ea2)
netmap: Fix driver name handling
if_initname() requires the caller to ensure that the lifetime of the
interface's name buffer contains that of the ifnet itself.
netmap_vi_create() wasn't respecting that; we were instead passing the
stack-allocated buffer provided by the ioctl handler.
While here, add a check to avoid assuming that the caller-provided
buffer is nul-terminated.
Reported by: syzkaller
Reviewed by: vmaffione
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58676
(cherry picked from commit 800d5b7a8a4f5665ced0453e090f8d563366bd47)
netmap: Fix a race in kqueue registration
We need to acquire the netmap global lock earlier, to avoid racing with
the NETMAP_REQ_REGISTER ioctl handler.
Reported by: syzkaller
Reviewed by: vmaffione
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58677
(cherry picked from commit 6de818285f066c6705816674c671761dc09bff90)
openssh: Add date bump command to FREEBSD-upgrade instructions
Provide a convenient in-place sed edit command to update the FreeBSD
VersionAddendum dates with today's date.
Sponsored by: The FreeBSD Foundation
Revert "atomic: Implement atomic_{set,clear}_8 in _atomic_subword.h"
This commit fails to compile for powerpc64le. Just revert it as it's
only a cleanup motivated by adding support for KASAN to riscv.
This is a direct commit to stable/15.
This reverts commit 318915568443f1fdb65faab0f559c872f09628c6.
Reported by: jenkins
nvme: limit visible namespaces on Apple S3X
The Apple S3X controller exposes internal namespaces beyond NSID 1
that aren't meant to be visible to the OS. Added QUIRK_APPLE_S3X_NS1_ONLY
and nvme_ctrlr_num_namespaces()/nvme_ctrlr_nsid_visible() helpers, and
route namespace construction, notification, and AER namespace-changed
handling through them instead of a raw cdata.nn count.
MFC after: 1 week
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D58844
nvme: fix Apple S3X controller panic
Serialize S3X I/O and cap dtransfers while keeping namespace handling.
Select 64/128-byte submission queue entries explicitly and set
CC.IOSQES from the same value used for the software queue stride.
When fatal status is set, wait for pending PCIe transactions and then
force FLR so a wedged controller doesn't panic or timeout.
MFC: 1 week
PR: 296946
Fixes: 5e0ba47aa00e
Reviewed by: ngie, imp
Differential Revision: https://reviews.freebsd.org/D58821
unix/stream: fix instant panic w/o INVARIANTS
A stupid microoptimization I made leaving empty STAILQ inconsistent
is a brainfart that is related to much earlier version of this code,
where it was safe to do so.
Pointy hat to: glebius
Fixes: 69f61cee2efb1eec0640ca7de9b2d51599569a5d
(cherry picked from commit 82d8a5029a80a77166dca098b8fedb10d84e4e38)
unix/stream: fix a race with MSG_PEEK on SOCK_SEQPACKET with MSG_EOR
The pr_soreceive method first scans the buffer holding the both I/O sx(9)
and socket buffer mutex(9) and after figuring out how much needs to be
copied out drops the mutex. Since the other side may only append to the
buffer, it is safe to continue the operation holding the sx(9) only.
However, the code had a bug that it used pointer in the very last mbuf as
marker of the place where to stop. This worked both in a case when we
drain a buffer completely (marker points at NULL) and in a case when we
wanted to stop at MSG_EOR (marker points at next mbuf after MSG_EOR).
However, this pointer is not consistent after we dropped the socket buffer
mutex.
Rewrite the logic to use the data length as bounds for the copyout cycle.
Provide a test case that reproduces the race. Note that the race is very
hard to hit, thus test will pass on unmodified kernel as well. In a
virtual machine I needed to add tsleep(9) for 10 nanoseconds into the
middle of function to be able to reproduce.
[7 lines not shown]
uma: Avoid allocating from free buckets when KASAN is enabled
When uma_zalloc_arg() hits an empty alloc bucket in the per-CPU cache,
it tries swapping the alloc and free buckets in the hope that the free
bucket has some items available. If not, it has to lock the zone.
Disable this behaviour when KASAN is configured in order to further
defer reuse of freed items. This forces a free item to go to the
per-domain full bucket cache before it becomes accessible to the
allocator.
Reviewed by: rlibby
MFC after: 1 month
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58270
(cherry picked from commit 666eab3afc52bf20d57c24e98a6aa667433fb7c2)
uma: Enqueue full buckets in FIFO order when KASAN is configured
We want to defer reuse of free objects, and this is a trivial way to
promote that.
Suggested by: rlibby
Reviewed by: rlibby, alc
MFC after: 1 month
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58312
(cherry picked from commit 492cfbe9e2f831fff290e019dae66345146978bd)
uma: Make an effort to defer reuse of items when KASAN is enabled
When KASAN is configured, make uma_zfree_arg() free items to the per-CPU
free bucket, rather than to the alloc bucket. This means that the item
won't be recycled immediately the next time a thread goes to allocate an
item from that zone on the same CPU. In other words, the item will stay
in a quarantine state longer, which helps make KASAN's use-after-free
detection more reliable.
Reviewed by: rlibby
MFC after: 1 month
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58269
(cherry picked from commit 990989c31b4637a23e64598a3d9929079bb9a8de)
netmap: Fix a race in kqueue registration
We need to acquire the netmap global lock earlier, to avoid racing with
the NETMAP_REQ_REGISTER ioctl handler.
Reported by: syzkaller
Reviewed by: vmaffione
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58677
(cherry picked from commit 6de818285f066c6705816674c671761dc09bff90)
vm_object: Augment an assertion in vm_object_split()
In some private discussion it was pointed out that vm_object_split()'s
pattern of dropping the source object lock looks dangerous in that the
initial assumption that OBJ_ONEMAPPING is set may become false. In
practice I believe that the map lock holds this flag stable, but let's
assert that.
Reviewed by: alc, kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58766
(cherry picked from commit 12857d8f4269af7df85605b48ae5e7b2fd810fde)
malloc: Refactor redzone and sanitizer handling
malloc_large() duplicates redzone and KASAN handling that is also
present in malloc() and malloc_domainset(). Refactor the
implementations to reduce this a bit.
Also normalize KMSAN map handling: make malloc() and malloc_domainset()
consistent, and do not update the KMSAN shadow map, as we can rely on
UMA and kmem_malloc() to handle that.
Reviewed by: rlibby
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58272
(cherry picked from commit 459aa032e87275ebe10847592ea2ddea0c3ed693)
uma: Fix KMSAN integration with malloc zones
In commit 459aa032e872 I dropped kmsan_mark() calls from malloc() on the
basis that UMA and kmem_malloc() would handle updates of the KMSAN
shadow map. However, I missed that UMA explicitly does not handle this.
Modify UMA to only omit origin map updates for malloc zones.
Fixes: 459aa032e872 ("malloc: Refactor redzone and sanitizer handling")
Reviewed by: rlibby
Differential Revision: https://reviews.freebsd.org/D58574
(cherry picked from commit ea7d35526878ebf82f10080795e462d007485bf1)
uma: Factor out the implementations of uma_zfree_{arg,smr}()
The two function both free an item to a UMA zone, but uma_zfree_arg()
does so in such as way as to ensure that the item will be the first one
returned by a subsequent allocation, while uma_zfree_smr() must defer
reuse of the item and therefore never frees to the per-CPU alloc bucket.
When KASAN is enabled, we actually want uma_zfree_arg() to behave like
uma_zfree_smr(): to improve the reliability of use-after-free detection,
reuse of the newly freed item should be deferred for some time.
Refactor a bit to make it easier to improve KASAN along these lines:
introduce two helper functions, cache_free_item() and cache_free_smr(),
which handle most of the work of interacting with the per-CPU caches.
A subsequent commit will let uma_zfree_arg() use cache_free_smr() when
KASAN is enabled.
No functional change intended.
[6 lines not shown]
in_mcast: Fix uninitialized variable usage in inm_merge()
When the first loop in inm_merge() hits an error, generally because it
hit some limit on the number of source filters for a multicast group,
inm_merge() tries to atomically roll back changes to the group source
filter list.
To roll back, it iterates over the global source filter list for the
multicast group, starting at the last entry that we updated ("nims").
But, if we have not yet updated any entries, this variable is
uninitialized. Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM
doesn't visit any source filters in this case.
All of the above applies to the v6 case.
Reported by: Daniel Birtwhistle
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit b9db5a5b16477863654f92ec653e8464528ef981)
malloc: Fix domainset usage in malloc_domainset() for large allocs
We should of course pass the provided domainset rather than copying what
plain malloc() does.
Fixes: 89deca0a3361 ("malloc: make malloc_large closer to standalone")
Reviewed by: rlibby
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58316
(cherry picked from commit 0aca7ce7af35fdf87db2b8866c623b0c275ee3e9)
netmap: Fix driver name handling
if_initname() requires the caller to ensure that the lifetime of the
interface's name buffer contains that of the ifnet itself.
netmap_vi_create() wasn't respecting that; we were instead passing the
stack-allocated buffer provided by the ioctl handler.
While here, add a check to avoid assuming that the caller-provided
buffer is nul-terminated.
Reported by: syzkaller
Reviewed by: vmaffione
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58676
(cherry picked from commit 800d5b7a8a4f5665ced0453e090f8d563366bd47)
unix: Fix mchain handling in uipc_sosend_stream_or_seqpacket()
Empty mchains cannot be copied with simple assignment.
I think this bug is mostly harmless: if mcnext is empty, then it won't
be accessed again before it is reinitialized in the next loop iteration.
So the bug only trips an assertion in INVARIANTS kernels and won't be
visible otherwise.
Add a regression test which triggers this corner case.
Reported by: Jan Bramkamp
Fixes: d15792780760 ("unix: new implementation of unix/stream & unix/seqpacket")
Reviewed by: glebius
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58791
(cherry picked from commit 79e0b69ce8af7d115496991ef66e525a03e9f4fe)
uma: Insert KASAN redzones after slab-allocated items
Without this, KASAN has the deficiency that inter-object overflows are
not detected most of the time[*] when keg_layout() is able to perfectly
pack a slab. Try to overcome this by adjusting the allocation size to
include a redzone following the object.
With this change, we automatically get a redzone following each item, so
any overflow into the redzone will trigger a panic. Most of UMA doesn't
need to know about this: at slab allocation time, the whole slab is
poisoned, and then kasan_mark_item_valid() will unpoison only the buffer
that is available to the consumer.
Note that in most zones, most objects will follow another object's
redzone, so there is some protection against underflow as well. It
might be worthwhile to provide a stronger guarantee here.
Add an assertion to item_ctor() that the returned item is properly
aligned. I couldn't see any pre-existing checks which verify this.
[7 lines not shown]
unix: Fix some bugs in the SOCK_STREAM receive path
The main problem is with the handling of errors from unp_externalize().
It turns out that this was quite broken, and unfortunately it's easy to
trigger such errors (e.g., by setting a low per-process fd limit with
setrlimit()).
In non-peek mode, uipc_soreceive_stream_or_seqpacket() cuts a bunch of
mbufs from the head of the socket buffer, to be consumed by userspace.
When unp_externalize() returns an error, we splice the removed mbuf
chain back onto the head of the socket buffer. This is expensive, but
that's ok since such errors are rare.
The problem is that this cutting is not correctly implemented: it does
not clear the "next" pointer for the last mbuf in the chain, so it
still points to the first mbuf still resident in the socket buffer.
This means that mc_init_m() creates a chain that still includes the rest
of the socket buffer, so splicing the chain back into the socket buffer
does not work properly.
[16 lines not shown]
unix/stream: plug a corner case when control externalization failed
while peer has closed its end.
Reported by: syzbot+ffcc3612ea266e36604e at syzkaller.appspotmail.com
(cherry picked from commit 4548b9f3a8167a340a5086ed51a76d932c9ab3cc)
riscv/atomic: Provide some additional aliases
These are already available and having them defined helps keep the KASAN
atomic(9) interceptors uniform.
Reviewed by: mhorne
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58680
(cherry picked from commit 4f87828402912a7e451fdbe53161c68faa489128)
unix: Fix a missing initialization in uipc_sosend_stream_or_seqpacket()
This could be triggered by an in-kernel sender, of which I can't find
any examples.
Fixes: d15792780760 ("unix: new implementation of unix/stream & unix/seqpacket")
Reviewed by: glebius
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58673
(cherry picked from commit 6dfd710963da7fe6086bcfb705b32b6a3646848f)
