Unlink multicast records when their interface is detached
Nothing dropped ifp->if_maddrlist at detach, so a socket that had
joined a group left its struct in_multi/in6_multi linked into the
ifnet that if_detach() then freed, holding a bare if_index. When the
socket finally dropped the membership, in_delmulti() resolved that
index; once if_idxmap_alloc() had wrapped the 16-bit space and handed
it to another interface, the TAILQ_REMOVE wrote through a tqe_prev
pointing into the freed ifnet and left the innocent interface tqh_last
pointing there too.
Unlink the records in in_ifdetach() and in6_ifdetach() and clear the
index; the sockets still reference them, so they are freed as before
when the last one goes away.
OK claudio@
Reported-by: syzbot+06aeb6036c2434fc1cd8 at syzkaller.appspotmail.com
Reported-by: syzbot+eefbaca0eb56be2757c2 at syzkaller.appspotmail.com
Reported-by: syzbot+f1e5d22909ea93b08bd4 at syzkaller.appspotmail.com
Refactor vmm(4) exit handling and correct RIP adjustment.
Make all exit handlers return a enum type that drives the vcpu run
loop instead of an errno that has overloaded semantic meaning.
Centralize and correct some RIP adjustment now that we have NRIPS
guaranteed on SVM systems. In some cases, vmm(4) was advancing RIP
when exceptions were being raised on a vcpu.
ok mlarkin@
Make writes of the hibernate signature go through the I/O page of the
piglet. This fixes a potential issue on arm64 where the kernel might
have been loaded into memory that isn't DMA reachable. It will also
help with implementing some future changes to make the side-effect free
I/O functions support hardware without cache-coherent DMA or IOMMUs.
ok deraadt@, mlarkin@
Add a few more fields directly to exec_package so that the front-end
and back-end of the ELF code doesn't need to communicate them via an
malloc'd structure. Much simpler.
ok kettenis
Don't override ignored signals when setting up signal handlers
for readpassphrase(3), avoids spin when called with no controlling TTY,
in a background process group, and with SIGTTIN and/or SIGTTOU already
set to SIG_IGN by its parent.
Portable OpenSSH b3995; with/ok millert and guenther
daemon_logger makes no sense without rc_bg being set as well; so error out
if that's the case.
The tree is currently clean of these but it will prevent potential future
issues.
ok sthen@
switch from SUPERCOP ed25519 to libsodium
The libsodium implementation includes a number of strictness and
malleability checks over the original reference implementation we
have used to this point.
libsodium also offers a more traditional "detached" signature
verification API (SUPERCOP required the signature to be contiguous
with the signed data). Switch to this and avoid a bunch of fiddly
code.
ok markus, deraadt
Reset GSSAPI client state before authentication
Avoids situation where a partially-completed GSSAPI authentication attempt
can retain state that is subsequently used by a later attempt.
Report and feedback Moritz Theile, also reported by several others.
ok markus, deraadt
Correctly handle some options that accept "none"
Some options, including AuthorizedPrincipalsFile were documented as accepting
"none" as a way to disable them, however when overriddes by a ssh_config(5)
Match keyword, this argument was being interpreted as a literal file.
With Chris Rohlf in collaboration with Claude and Anthropic Research
ok markus, deraadt
Propagate authorized_keys "resrict" keyword
The "restrict" keyword was not pervasively being applied to TunnelForwarding
connections (which are administratively disabled by default). This is a
separate problem to the one fixed in openssh-10.5
reported by several people; ok markus, deraadt
Check key and CA sig type during key parsing
Checks key type and CA signature algorithm allowlists as early as
possible during public key deserialisation.
Use this in the client and server to reduce attack surface from
disallowed key/signature types.
With Chris Rohlf in collaboration with Claude and Anthropic Research
ok markus, deraadt
