ng_pppoe: fix m_pullup() logic
The clear intent here is to do m_pullup() if we _don't_ have two bytes.
Before the fix: a) m_pullup() was always called and did nothing; b) if a
node was ever supplied with a fragmented but otherwise correct mbuf, then
it would not handle PROT_LCP as intended.
Noticed by: zlei
Reviewed by: zlei, eugen_grosbein.net
Differential Revision: https://reviews.freebsd.org/D60788
Fixes: 28903f396af4b151e16ea606cda66a9244fb179f
(cherry picked from commit 4c72b1c36dda72b9ba8de593cac2c94e15f42bcf)
pf: Free the stack key when attaching it collides
pf_state_key_attach() attaches the wire key first and then the stack
key, setting sks to NULL before the second pass. When the stack key
collides with an existing state, the error path removes the wire key
again but then frees sks, which is NULL by then: the stack key leaks.
pfsync hits this. A peer that gets a plain state in a bulk update
before a redirected state whose stack key is the plain state's key
fails to import the redirected state, leaks its stack key, and leaks
another one with every later update of that state.
Free sk, the key of the pass that collided (skw on the wire pass), and
add a test.
Reviewed by: kp
Fixes: 371bd29d4b22 ("pf: fix potential state key leak")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60951
ipfw: declare the ipfw_nat64 module
The module declaration is necessary for 'kldstat -m' to see it,
and the rc(8) uses that to detect presence of ipfw_nat.
Submitted by: markj's Post-Commit LLM Review Service
Fixes: 9bcc1e97dda8e926483b81874884211bbe4f36e9
pf: Store the rounded source node hash size
hashalloc(9) rounds the requested size down to a power of two and writes
the result back, but pf_initialize() stored it into the mask, which the
next line overwrites from the unrounded size. With a
net.pf.source_nodes_hashsize that is not a power of two the mask is
larger than the table: pf_hashsrc() returns rows past its end, the row
walkers in pf_purge_expired_src_nodes() and the ioctl handlers run past
it, and pf_cleanup() frees it with the wrong size. The key and UDP
endpoint hashes already take the rounded size.
Reviewed by: glebius, kp
Fixes: cd5ff4e841fb ("pf: use hashalloc(9) for key, id, src-node and udp-endpoint hashes")
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60949
pf: Clear only the part of the packet descriptor that is read first
pf_init_pdesc() cleared the whole structure, 336 bytes on amd64, for
every packet and twice for a forwarded one. kif, m, pf_mtag, act and
the SCTP job list are set before they are read, so move them to the end
and clear only the 240 bytes before them. On amd64 that also stays
below the 256 bytes from which memset() switches to rep stosb.
Reviewed by: kp
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60948
linux: Preserve partial results from recvmmsg()
linux_recvmmsg_common() currently returns the error from the next
recvmsg() attempt even when one or more datagrams have already been
received and copied to userspace.
This is especially visible with non-blocking UDP sockets. After
receiving the first datagram, the next iteration commonly returns
EAGAIN. The syscall then reports EAGAIN instead of the number of
messages already stored in the mmsghdr array, causing applications to
discard successfully received packets.
This differs from Linux recvmmsg() semantics, where an error encountered
after receiving at least one message is deferred and the number of
received messages is returned.
Return the accumulated datagram count and clear the error whenever at
least one message was received. Preserve the original error when no
messages were received.
[10 lines not shown]
est: prevent divide-by-zero in est_msr_info
When hw.est.msr_info=1 is set, est_msr_info() extracts the bus clock
from MSR_PERF_STATUS upper bits. On secondary CPUs, the MSR may
contain zero in the frequency ratio field, causing a
divide-by-zero panic.
Observed in pre Skylake Intel cpu.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57614
(cherry picked from commit 021a190c88fc41f981a79fe6822bdafbcda14e99)
kqueue: do not buffer the whole knote report when sizing it
kern_proc_kqueues_out() reported into an intermediate sbuf and copied the
result into the caller's.
A process that had leaked 468k kqueue descriptors wired 757 MB of M_SBUF
while dumping core, over roughly 9M reallocations, then copied the whole
thing again.
Reviewed by: adrian, markj
Differential Revision: https://reviews.freebsd.org/D58536
PR: 296835
MFC after: 1 week
(cherry picked from commit ff97443beef614a12652cb96ccebe95e9046e82a)
if_fwsubr: remove ARP target hardware address trimming
Per RFC 2734 section 5, the 1394 ARP packet is a fixed 32-octet structure
with no target hardware address field.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57617
(cherry picked from commit 3ffd2baa268d298201d54c733dc0e635cc1dca9f)
smb(4): Add SMB Block Process Call command
Add support for the SMBus Block Process Call (bpcall) command. This
command writes a block of data to a slave device and reads a block of
data back in a single transaction, as defined in the SMBus 2.0
specification.
Add the SMB_BPCALL ioctl to the smb(4) character device to allow
userspace to issue Block Process Call transactions.
Implement ichsmb_bpcall() for the ICH SMBus controller using the
32-byte block buffer mode. Older ICH variants (ICH, ICH0, ICH2, ICH3)
that lack the block buffer feature will return SMB_ENOTSUPP.
The PIIX4 compatible hardware (intpm) does not support Block Process
Call at all and returns SMB_ENOTSUPP unconditionally.
This has been tested on several Beckhoff Industrial PCs using real
SMBus hardware. It has been tested on Tigerlake, Elkhart and
[5 lines not shown]
amd64: strictly enforce the caller's mode for FRED 64bit syscall handler in C
For FRED SYSCALL calls, check that the LM bit is set.
Note that this handler is redundant for 64bit mode since syscalls
are handled by the asm fast path. Intel CPUs raise #UD for SYSCALL
in the compatibility mode, and for AMD we set up the MSR_CSTAR to
fast_syscall32 for IDT case, which is nop. So practically it should only
matter if AMD CPUs with FRED enabled allow SYSCALL from compatibility
mode.
Reported and reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
sbin/nvmecontrol: fix signedness comparison warning
sector_size is guaranteed to be non-zero here, so cast to
uint32_t to match the comparison.
This fixes the [gcc14 build in CI][0]:
/workspace/src/sbin/nvmecontrol/format.c: In function 'find_lbaf':
/workspace/src/sbin/nvmecontrol/format.c:132:60: error: comparison of integer expressions of different signedness: 'uint32_t' {aka 'unsigned int'} and 'int' [-Werror=sign-compare]
132 | if (NVMEV(NVME_NS_DATA_LBAF_LBADS, format) != lbads ||
| ^~
[0] https://ci.freebsd.org/job/FreeBSD-main-amd64-gcc14_build/5051/
Reviewed by: imp
Fixes: b991e2dd824c ("nvmecontrol: support controller-wide sector sizes")
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
ipfw: fix off-by-one error in bdel()
After deleting an item from a sorted array, bdel() moves the tail
following it, but the size of the data to move was calculated with
an off-by-one error, causing memmove() to read one element past the
end of the array. This can happen when the table is full for ifidx
or numarray algorithms.
Obtained from: Yandex LLC
MFC after: 1 week
Sponsored by: Yandex LLC
newvers.sh: Report -dirty also with staged changes
We add -dirty to the uname version string if the tree does not match the
reported hash. Previously, staged but uncommitted changes were ignored.
Noted by naddy@ in D60606.
Reviewed by: cperciva, imp
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60722
(cherry picked from commit 617c700abae7aba74777fca137458395936f5053)
mkimg: Ignore redundant %align values
Partitions are trivially aligned to sector boundaries, so asking e.g.
for a partition to be aligned to a 64-byte boundary is pointless but
harmless. Treat it as such, with a warning (in case the request was
a mistake, e.g. requesting 1-byte instead of 1M-byte alignment) rather
than as an error.
Reviewed by: markj
Suggested by: markj
MFC after: 1 week
Sponsored by: Amazon
Differential Revision: https://reviews.freebsd.org/D60819
(cherry picked from commit da04cf02c96b97c587580b336fa527392467f689)
tests/sys/vfs: use LIBADD for libutil, don't clobber LDFLAGS
"LDFLAGS= -lutil" dropped LDFLAGS from make.conf for every test in the
directory.
Approved by: glebius
Fixes: c3ac06161dd5 ("nmount: Introduce the "check_fsid" option")
Sponsored by: Netflix
vmimage.subr: Support partition alignment
If VM_PARTALIGN is set, pass %${VM_PARTALIGN} to mkimg in the
specification of swap, config, root, and ESP partitions. (Boot
partitions are not aligned, both because they're small and in
case firmware makes assumptions about their locations.)
Reviewed by: lwhsu, imp
MFC after: 1 week
Sponsored by: Amazon
Differential Revision: https://reviews.freebsd.org/D60454
(cherry picked from commit f46269aba8a0bc2b60a0305bdafd8dfb42e0bb88)
