sndiod: Handle POLLERR
When a device is disconnected, poll(4) may return POLLERR. In this
case sndiod(8) must close the descriptor. Not doing so may cause the
event loop to spin.
Found by and help from weerd@.
Power the RTL8188CU/8192CU off in urtwn_stop().
urtwn_stop() left the chip running, so the chip was never reset between inits,
and under TX load the device could hang with "device timeout"; only a replug
recovered it.
Power the chip off on stop, ported from FreeBSD urtwn_r92c_power_off()
(R92C path mostly from NetBSD), so each init starts from the same state
as after a replug. Bring back the APSD_CTRL "Initialize MAC" step in
urtwn_r92c_power_on(), removed in r1.85 when nothing turned the MAC
off. RTL8188E/8188F/8192E are left alone.
Patch by Mikolaj Kucharski
Also tested by jmc@ and myself
pf(4): pf_state_insert() should update stack side key
pf_state_insert() should treat stack side state key (sks) in the same way
as it treats wire side state key (skw). The call to pf_state_key_attach()
may replace the sks with key which is present already in state tree.
Issue noticed and reported by Acts-1631
OK henning@ OK bluhm@
rpki-client: reject CustomerASID 0 in ASPAs
The customerASID element has type CAS ::= INTEGER (1..4294967295) with
section 3.2 of draft-ietf-sidrops-aspa-profile-30 explicitly saying
"The customerASID field contains a positive integer [...]".
as_id_parse() accepts all values in [0, UINT32_MAX], so we need to
exclude 0 explicitly.
ok claudio rcovelli
Move the carepo tree and its accounting to the parser process.
To properly account the validity of a MFT it requires that the carepo
tree is moved to the parser process. This is the first step. It moves
the tree add basic functions to add and check the count per repo and
it adds the required locking around the shared structure since the
parser is multithreaded.
OK tb@ job@
iked(8): Ignore IKEv1 messages when not configured
When there are no ikev1 rules in iked.conf defined, just drop ikev1
packets right away; no need to forward them to the ikev1 sub-process.
That matches the original iked behaviour.
ok op@ henning@
tcpdump(8): Do not loop infinitely on malformed OSPF packets
When printing a Link State Update with -v, the LSU loop trusts the
advertised LSA count and advances to the next LSA by the length field
of the LSA header. An LSA header with a length smaller than the
header itself makes the loop re-parse the same header up to 2^31
times, pinning tcpdump on one packet.
Reject an LSA whose length is smaller than the mandatory 20 byte
header in ospf_print_lsa() and ospf6_print_lsa(), where the length
is used to advance. The DD and LSAck printers only walk fixed size
headers and are unaffected.
Reported by Acts1631, thanks!
ok dlg@
vmd(8): Do not leak vm_kernel_path
When vm.conf is reloaded, vm_register() returns EALREADY and hands
back the existing VM, whose vm_kernel_path the parser then overwrites
without freeing the old string. Free it first. While there, also free
the parsed path when vm_register() fails or when running with -n, as it
is never handed over to a VM in those cases.
vm_remove() freed vm_kernel_path only if vm_from_config was not set.
However, the parser is the only place that assigns vm_kernel_path, and
it sets vm_from_config at the same time, so the path was never freed.
Free it unconditionally.
ok dv@
vmd(8): Keep SEV memory segments within a single memrange
sev_register_encryption() derived the host VA from find_gpa_range()
plus its own offset arithmetic and recorded the caller's length as
a flat span. A segment crossing a memrange boundary thus produced
a host VA range extending past the mapping it was taken from, which
was then handed to the PSP for in-place encryption.
Translate through hvaddr_mem() instead, which enforces that the
whole span lies within one memrange, and align address and length
to the AES-XTS block size before validating so the checked length
is the one sent to the PSP.
Also sort the recorded segments and merge overlapping ones before
LAUNCH_UPDATE_DATA. Segments sharing a 16-byte block (e.g. .symtab
and .strtab) or fully contained in another (.openbsd.randomdata
inside the rodata PT_LOAD) were otherwise encrypted twice, corrupting
the data. Adjacent but non-overlapping segments are kept apart,
as they may live in different memranges.
[4 lines not shown]
vmd: fix pty and file leaks in vm creation path.
1. During vm creation, vmd duplicates the pty fd to let the privileged
process handle cleanup after vm termination. This dup'd fd should
be closed in the error path otherwise it leaks.
2. The combination of `vmctl reload` with a vm using a bios or
kernel boot image will leak a file descriptor to the image file.
This was a regression caused by fixing a related problem. Mischa
Peters reported vmd reporting EMFILE errors and it turns out the
priv process was keeping the file open, but reload was overwriting
the variable with the fd number so teardown wasn't closing it.
There's no need to keep it open, so rewrite to not dup(2) and don't
have the priv process keep a copy of the fd number (the source of
the previous issue related to a race between close(2) on cleanup
and the imsg sending the fd to the vmm process.)
ok hshoexer@
rpki-client: remove the BN_CTX from the parser
Before threads were added to the parser, having a global BN_CTX was easy
enough. While it saves many small allocations, I don't think it's worth
the complexity.
A bignum is a struct containing a pointer to an array of words and then
four ints. Sequence numbers are at most 20 octets (fitting into 3 8-bit
words on 64 bits), so each seqnum requires at most 48 bytes. We can check
with two bignums instead of three without loss of clarity, so ultimately
we have all this complexity to avoid allocations of at most 96 bytes.
ok claudio job
Report our short OS name as "other" or "other-64" rather than "FreeBSD".
This makes recent versions of vcenter display the full OS name and version,
and older versions at least indicate whether the guest is amd64 or i386.
also tested by Ian McWilliam on fusion player and Kenneth Gober on esx 5.5
ok dlg@
drm/amdkfd: evict the queues only once for CRIU PROCESS_INFO
From Jesse Zhang
7f695fb47b4073d6bbd5bb9d5c4f969327641eab in linux-6.18.y/6.18.63
8f3ecda0ab42fb5ba7310fe848013d3eff31b416 in mainline linux
