ctl.4: Document the assumption that CTL HA runs only on trusted networks
The CTL High Availablity clustering feature allows a pair of hosts to
implement transparent failover. The implementation uses a TCP
connection to exchange messages. There is no authentication mechanism
and the protocol itself embeds kernel pointers in the messages exchanged
between HA hosts. This property (of CTL_MSG_DATAMOVE messages
specifically), as well as insufficient validation of inbound messages,
mean that anyone able to access a CTL HA port is able to remotely
execute code on that host.
Provide a warning to this effect in the CTL man page.
Reported by: Ryan of Calif.io
Reviewed by: ziaee, ken, mav
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58622
rawip: Fix handling of checksums in rip6_input()
A v6 raw socket may ask the kernel to validate the checksum of an
inbound packet. If it does, and the validation fails, we discard the
packet, but this isn't really right: other raw sockets may wish to
receive a copy of the packet anyway.
Rework checksum handling to address this problem, and use a flag to
avoid computing the checksum more than once for a given packet.
Fixes: de2d47842e880281 ("SMR protection for inpcbs")
Reviewed by: pouria, glebius
Reported by: Yunzhi Ke
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58559
pseudofs: Don't purge the cache on shutdown
This is a waste of time and results in a use-after-free if linsysfs is
loaded and a USB network interface is in use, since USB devices are
disconnected at shutdown, which triggers a call into linsysfs, which
then tries to destroy a pseudofs node which has already been purged.
MFC after: 1 week
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58359
igc: defer sysctl-driven reinit to the admin task
igc_sysctl_eee() and igc_sysctl_dmac() called igc_if_init() directly.
Request the reset through iflib instead, and skipping while the interface
is down; the new value is picked up by the next init.
Unlike e1000, igc has no ASSERT_CTX_LOCK_HELD and no acquire_swflag
path, so the defect is silent here rather than an assertion failure.
While here also remove unnecessary igc_if_init uses:
iflib_if_init_locked() already runs after IFDI_RESUME and
IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped
IFDI_INIT that the following iflib_stop() undoes.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58629
e1000: defer sysctl-driven reinit to the admin task
Request the reset through iflib and let the admin task perform the
stop/init under the context lock, matching what the VF and SR-IOV paths
already do.
The assertion is compiled out without INVARIANTS, where the same write
instead resets the MAC and takes the ICH software flag while the queues
stay live and an ioctl or the admin task may be running.
While here also remove unnecessary em_if_init uses:
iflib_if_init_locked() already runs after IFDI_RESUME and
IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped
IFDI_INIT that the following iflib_stop() undoes.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58628
fusefs: fix error handling when reading a directory's sticky bit
When trying to delete or rename a file, fuse_vnop_lookup must check
whether its parent directory's sticky bit is set. Realistically, the
parent directory's attributes will almost always be cached. But it's
possible that they won't be, and in that case we must send a new
FUSE_GETATTR request to the server. If that request fails for some
reason, then we must fail the lookup. Prior to this change fusefs would
ignore failure of that request.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu of Tsinghua University
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57588
(cherry picked from commit b4af6a4cccc3b4b0ea461463196c258eb92ad2e5)
fusefs: only search for FREAD fufh in readdir
The extra search for an FEXEC fufh shall be removed, since readdir
is only supposed to be called on a directory opened with FREAD. The
sole exception is NFS, which will call VOP_READDIR with directories that
aren't open at all. fuse already has special code to handle that.
Also remove the fuse_filehandle_get_dir() function, since it's not
used anywhere else.
Signed-off-by: CismonX <admin at cismon.net>
Reviewed by: asomers
Pull Request: https://github.com/freebsd/freebsd-src/pull/1729
(cherry picked from commit 4179f1d9deed83977f159c8afea204293ef4c7d7)
Fix LOCAL_PEERCRED in 32-bit compat mode
Previously the cr_pid field would be incorrectly copied to userland, due
to a size mismatch between the structure as defined in 32-bit vs 64-bit
builds. Fix it by converting the structure before copying it to
userland.
PR: 294833
Sponsored by: ConnectWise
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D56675
(cherry picked from commit 1d24638d3e8875e4b99a4b5e39f4241e37221b3d)
linuxulator: fix SO_PEERCRED emulation after 1d24638d3e8
For Linux binaries, sopt->sopt_td may be null. And there's also no
need to check it, since struct l_ucred has the same layout on 32-bit
systems as on 64-bit ones.
[8 lines not shown]
ping: fix listing test cases when scapy is not installed
The ATF-python test program was attempting to list test cases that
require scapy. But it attempted to import the scapy module before the
test cases had been listed, resulting in an ImportError that kyua
interpreted as a test program crash.
Fix this behavior by handling that ImportError well enough to list test
cases, but not run them. If scapy isn't present, Kyua will refuse to
run the test cases. But it needs to be able to list them in order to
know to skip them.
Sponsored by: ConnectWise
Reviewed by: maxim
Differential Revision: https://reviews.freebsd.org/D56765
(cherry picked from commit 3e845b1090565912375c5578cf0399d27b7fa70c)
fusefs: better handling for low-memory conditions
Under conditions of low memory, getblk can fail. fusefs was not
handling those failures very systematically. It was always using
PCATCH, which appears to have been originally copy/pasted from the NFS
client code, but isn't always appropriate:
* During fuse_vnode_setsize_immediate, which can be called from many
different VOPs and from the vn_delayed_setsize mechanism, remove
PCATCH. Some of these callers cannot tolerate allocate failure.
* In fuse_inval_buf_range, don't assume that getblk will always succeed.
* When calling fuse_inval_buf_range from VOP_ALLOCATE,
VOP_COPY_FILE_RANGE, or VOP_WRITE (with IO_DIRECT), return EINTR if
the allocation fails.
* When calling fuse_inval_buf_range from VOP_DEALLOCATE, remove PCATCH.
This VOP must not fail with EINTR.
[8 lines not shown]
aio(4) tests: do not rely on (int *)-1 being invalid address
Explicitly mmap guard and use it as the invalid address instead.
(cherry picked from commit dc9a8d300ba5c4c319589d78231e9d0e76576cbf)
boot0cfg: Also allow a file as a trailing argument
Modify the disk check to allow arbitrary files as the trailing argument
instead of requiring a live GEOM disk provider.
This enables modifying a boot0 binary file in-place before flashing it
to a disk via gpart bootcode, or using it directly as an argument to
mkimg's partition specification, as these tools cannot directly adjust
the parameters of the boot0 boot manager.
Reviewed by: imp, jhb
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D57310
(cherry picked from commit 4007d914e7973bca8ac488ab50aca56964eed90f)
boot0cfg: Also allow a file as a trailing argument
Modify the disk check to allow arbitrary files as the trailing argument
instead of requiring a live GEOM disk provider.
This enables modifying a boot0 binary file in-place before flashing it
to a disk via gpart bootcode, or using it directly as an argument to
mkimg's partition specification, as these tools cannot directly adjust
the parameters of the boot0 boot manager.
Reviewed by: imp, jhb
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D57310
(cherry picked from commit 4007d914e7973bca8ac488ab50aca56964eed90f)
autofs_lookup(): busy the mount point around autofs_trigger()
Since autofs_lookup() calls into autofs_trigger_vn() to perform
automounting, and autofs_trigger_vn() unlocks the vnode, it is possible
for the unmount to start meantime. Then autofs_trigger() accesses freed
memory.
At this point, busy can be only done unblocking, and the transient
failure must abort the trigger operation. This would cause spurious
automounter errors, but at least should prevent accesses to the freed
memory.
PR: 294361
Reviewed by: markj, rew
Tested by: rew
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58626
ixl: enforce the assigned VF MAC address
When allow-set-mac is disabled, the MAC filter validation condition
rejects the assigned VF unicast address while allowing any different
unicast address. The equality test was accidentally inverted when this
code moved to the boolean address helper.
Accept multicast and the assigned unicast address, and reject other
unicast addresses as intended.
Fixes: 7d4dceec1030 ("ixl(4): Fix VLAN HW filtering")
(cherry picked from commit d2309d9d6dc6d5a9141314652d6c96ab46a9a62c)
ixl: enforce the assigned VF MAC address
When allow-set-mac is disabled, the MAC filter validation condition
rejects the assigned VF unicast address while allowing any different
unicast address. The equality test was accidentally inverted when this
code moved to the boolean address helper.
Accept multicast and the assigned unicast address, and reject other
unicast addresses as intended.
Fixes: 7d4dceec1030 ("ixl(4): Fix VLAN HW filtering")
(cherry picked from commit d2309d9d6dc6d5a9141314652d6c96ab46a9a62c)
iflib: clear the deferred TX descriptor state when a queue is stopped
Stopping an interface frees the queued mbufs and zeroes a transmit
queue's descriptor accounting, but the three counters that track
descriptors deferred to a later doorbell write or report-status
request are not cleared there: they only reach zero when the code
that acts on them runs. After a reset they therefore describe
descriptors that no longer exist, until enough new traffic flushes
them.
The consequences are small - one doorbell written from a stale
count, and a report-status request on the first packet after the
reset - but the state is simply wrong, and the transmit-hang check
in iflib_timer() reads one of them.
MFC after: 1 week
Assisted-by: Claude Code (Opus 5)
iflib: remove the unused TX queue state machine
The previous commit stopped using ift_qstatus and the IFLIB_QUEUE_*
states for the TX watchdog decision, leaving only dead stores.
Remove the field, the states, and all assignments. The byte the
field frees stays behind as explicit padding. No functional change.
Reviewed by: gallatin, markj
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D58282
Assisted-by: Claude Code (Fable 5, Opus 5)
iflib: restore TX watchdog functionality
Since f6afed726b00 the TX-hang check in iflib_timer() has required a
queue state other than IFLIB_QUEUE_IDLE, but nothing ever sets
IFLIB_QUEUE_WORKING, so IFLIB_QUEUE_HUNG has been unreachable ever
since: stalled TX queues are not detected, not reported, and not
reset - the TX watchdog of every iflib(4) driver has been dead code.
Instead of resurrecting the queue-state machine, detect the hang
directly. A transmit queue is frozen while it holds descriptors the
hardware has not reported as completed and none were reclaimed over a
timer period. Being frozen is not a fault: the hardware may defer
marking descriptors as completed indefinitely. The check therefore
arms only when a frozen queue also takes on new work, while the link
is up, no pause frames were received and no doorbell is pending; and
it acts only after the queue has stayed frozen for
net.iflib.tx_watchdog_periods consecutive periods. It then asks the
hardware through the driver's read-only credits peek
(isc_txd_credits_update with clear=false, the same call the mp_ring
[46 lines not shown]
