Take the kernel lock around pgo_refernce() call; not all of our uvm_object
implementations are mpsafe (in particular the vnode one). From Acts1631.
ok claudio@
Avoid using malloc(9) when walking lists of clocks, PHYs, mailboxes,
hardware locks and power domains. This helps avoiding sleeping in
DVACT_SUSPEND and DVACT_RESUME.
ok phessler@
Implement a different fix for the use-after-free in filt_procattach
from rev 1.207.
Instead of shuffling locks around take a process reference in this
code to prevent the process from exiting under us while sleeping
for the kqueue_ps_list_lock rwlock. This is the same solution that
was used for a similar issue in fork1.
Reported by Acts1631 and OpenAI
Patch provided by OpenAI
OK mvs@
Plug another mbuf leak. In ip6_forward in the ip6_forwarding == 2 case
the mbuf is not freed if it was not put through ipsec.
Unlike the similar IPv4 code in ip_output the version in ip6_forward
needs an m_freem call before the goto senderr.
OK jan@ mvs@
add Q flag/key to show pledge/chroot/unveil usage
Show promises in COMMAND and ps(1) state letters pertaining to pledge,
chroot and unveil usage in PRIV instead of TIME.
To quickly identify programs (un)aware of their privileges and thus
in extend the system's security.
A non-root user it not enough and alternatives like ps(1) -o state,pledge
in tree-mode or wrapped in watch(1) are not nearly as ergonomic as top(1).
p and P are already in use, Q has no meaning, but is free.
OK deraadt
vio: fix control queue handling during reset
At virtio_reset(), the features are reset, so we need to check for
control queue availability in a different way.
After reset, we first need to re-enable the control-queue before we can
use it for configuring multiqueue.
ok jan@
Work around RTL8125 and RTL8125B TX hang on short UDP frames.
These chips look for PTP messages in short UDP frames without regard
to IP fragmentation. A frame shorter than 175 bytes that reads port
319 or 320 at the UDP destination port offset with fewer than 47 bytes
of UDP data following hangs the TX.
Pad such frames to 47 bytes of UDP data in software. Also pad every
frame shorter than 60 bytes, since the chip doesn't checksum those
correctly, and compute the checksums in software for padded frames.
Problem reported and fix tested by Tomas Slobodnik.
httpd: convert imsg handling to imsg_get_ and remove IMSG_SIZE_CHECK macro
Second attempt, since the first one still had a bug. I overlooked the
fact that in "config_getserver", the imsg data was passed through
again to "config_getserver_config" and read there once more.
OK claudio@
fix up how aggr tries to scavange a flowid for the mbuf.
Samuel Thibault on misc@ noticed that aggr(4) wasn't balancing
traffic over ports like trunk(4) did, because aggr(4) relies on
mbuf flowids where trunk(4) parses and hashes packets onto ports
as a matter of course.
if the ports don't do RSS hashing and set a flowid, aggr(4) was
supposed to use the port interface index as a cheap way to populate
a flowid, which it did, but i forgot to also
SET(m->m_pkthdr.csum_flags, M_FLOWID).
this tweaks the use of flowids in the transmit path too. if a flowid
isnt set it'll fall back to the mbuf receive interface index. locally
generated traffic should have a flowid set most of the time cos
most traffic is tcp, and tcp generates flowid.
pf(4) pf_state_import() can be bit more paranoid
Add sanity check for queue priority assigned to state
via 'set prio' rule action. The priority must fit
to bounds used by kernel (<= IFQ_MAXPRIO)
Issue reported and patch submitted by Acts1631
OK renaud@, OK henning@
unveil: Limit count of visited covers to ps_uvvcount, this avoids an
infinite loop with a particular construction of unveils.
from Acts1631
from dgl@
this is errata/8.0/009_unveil.patch.sig
unveil: Limit count of visited covers to ps_uvvcount, this avoids an
infinite loop with a particular construction of unveils.
from Acts1631
from dgl@
this is errata/7.9/044_unveil.patch.sig
Prevent fq_codel panic from drop counter wrap
Sustained traffic through a congested fq_codel queue can wrap the
per-flow drop counter to zero, triggering the control_law() assertion
and panicking the kernel. Saturate drops and decrement a nonzero ldrops
to preserve the grace-period delta and prevent the wrap.
Issue reported by Acts1631.
from bket@; OK sashan@ claudio@
this is errata/8.0/008_pffq.patch.sig
Prevent fq_codel panic from drop counter wrap
Sustained traffic through a congested fq_codel queue can wrap the
per-flow drop counter to zero, triggering the control_law() assertion
and panicking the kernel. Saturate drops and decrement a nonzero ldrops
to preserve the grace-period delta and prevent the wrap.
Issue reported by Acts1631.
from bket@; OK sashan@ claudio@
this is errata/7.9/043_pffq.patch.sig
using sizeof is recommended practice
from deraadt@
remove comma after final SEE ALSO reference
from jsg@
isakmpd(8): Fix various remotely triggerable crashes
- Only accept authenticated DPD notifications with a well-formed payload.
- Check the notify payload length against the SPI size.
- Fail AES key setup on invalid key lengths.
- Reject encrypted messages whose length is zero or not a multiple
of the cipher block size.
- Do not free the caller's certificate in x509_cert_get_key().
- Do not run exchanges that are already finalized.
from hshoexer@; with markus@, some input from tb@, OK deraadt@
this is errata/8.0/006_isakmpd.patch.sig
Avoid infinite loop when parsing PFKEY replies
In bgpd, iked, isakmpd, ldpd and sasyncd we have similar code to
parse PFKEY replies from the kernel. To avoid an infinite loop on
malformed replies validate the SADB extension size.
For consistency with the other daemons rewrite the parsing loop of
iked.
sasyncd already validates the extension size, so no change needed.
from hshoexer@; OK claudio@ tb@ tobhe@
isakmpd(8): Fix NULL dereference in message_alloc_reply() callers
message_alloc_reply() dereferences the returned pointer of
message_alloc() without a NULL check. Add one so callers can handle
the failure.
Also add NULL checks at both call sites in exchange.c.
from hshoexer@; test & OK sthen@
isakmpd(8): Fix possible unaligned 32 bit read
When validating IPsec SPIs in a DELETE message, access to the
32 bit SPI value might be unaligned. On platforms requiring strict
[106 lines not shown]
