Rather than allowing floating panes to remain outside the window and
invisible after resize, move them and resize them so they are fully
inside the window. GitHub issue 5582 from Noam Stolero.
rpki-client: change return 0 to goto out
This turns cms_parse_validate() into a single exit function and fixes
a return 0 that should have been return NULL since the last commit.
correct dma_tag_lookup() loop
drm_cd.cd_ndevs[] has pointers to drm_softc not drm_device
Currently, dma_tag_lookup() is only used by the apldcp/apldrm drivers.
At the start of the softc for both of those is struct platform_device.
If the loop doesn't match the the function argument is cast to
struct platform_device *, so the problem was not noticed.
discussed with kettenis@ and apldcp/apldrm tested on m1 mac mini
only allow an NFS server to set file type on a new vnode
Otherwise, a malicous server could aid a local user in avoiding access
controls.
This reverts nfs_subs.c rev 1.3. Which was part of a commit to fix the
use of automount with direct maps.
reported by Andrew Griffiths
from jsg@
this is errata/7.9/016_nfs.patch.sig
only allow an NFS server to set file type on a new vnode
Otherwise, a malicous server could aid a local user in avoiding access
controls.
This reverts nfs_subs.c rev 1.3. Which was part of a commit to fix the
use of automount with direct maps.
reported by Andrew Griffiths
from jsg@
this is errata/7.8/052_nfs.patch.sig
Clamp numeric arguments of terminal escape sequences to an arbitrary value of
100,000. The existing logic would happily process as many digits as provided,
which could make the values wraparound at 2**32, or be considered as negative
values if cast to a signed type, leading to incorrect processing.
Bug report by Acts1631.
from miod@
this is errata/7.9/017_wscons.patch.sig
Clamp numeric arguments of terminal escape sequences to an arbitrary value of
100,000. The existing logic would happily process as many digits as provided,
which could make the values wraparound at 2**32, or be considered as negative
values if cast to a signed type, leading to incorrect processing.
Bug report by Acts1631.
from miod@
this is errata/7.8/053_wscons.patch.sig
sys/uvm: validate anonymous object pager requests
uao_get() trusts the requested page range before allocating pages and
looking up swap slots; an invalid request can therefore allocate a page
outside the object and read beyond its swap slot array. Validate the
request before page lookup or allocation, preserving optional fault
clustering at the object boundary.
Reject nonpositive page counts and starting page indices outside the
object; require the entire range for PGO_ALLPAGES, or a centeridx within
both the request and the object otherwise. Compare against the remaining
page count in voff_t and derive pageidx from the validated firstpage,
avoiding overflow in the bounds check and unchecked narrowing.
Reported by Andrew Griffiths, thanks!
from kirill@; OK kettenis@
this is errata/7.9/018_shmat.patch.sig
sys/uvm: validate anonymous object pager requests
uao_get() trusts the requested page range before allocating pages and
looking up swap slots; an invalid request can therefore allocate a page
outside the object and read beyond its swap slot array. Validate the
request before page lookup or allocation, preserving optional fault
clustering at the object boundary.
Reject nonpositive page counts and starting page indices outside the
object; require the entire range for PGO_ALLPAGES, or a centeridx within
both the request and the object otherwise. Compare against the remaining
page count in voff_t and derive pageidx from the validated firstpage,
avoiding overflow in the bounds check and unchecked narrowing.
Reported by Andrew Griffiths, thanks!
from kirill@; OK kettenis@
this is errata/7.8/054_shmat.patch.sig
