msdosfs: Silence a -Wmaybe-uninitialized false warning
GCC 12.5 gave the following warning. It's a false positive, but let's
silence it as it's easy to do.
```
/usr/src/sys/vfs/msdosfs/msdosfs_fat.c: In function 'freeclusterchain':
/usr/src/sys/vfs/msdosfs/msdosfs_fat.c:874:17: warning: 'bn' may be used uninitialized [-Wmaybe-uninitialized]
874 | updatefats(pmp, bp, bn);
| ^~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/vfs/msdosfs/msdosfs_fat.c:819:16: note: 'bn' was declared here
819 | u_long bn, bo, bsize, byteoffset;
| ^~
```
ena(4): Fix possible NULL deref in ena_com_create_and_store_tx_meta_desc()
get_sq_desc() may return NULL, so passing the return value to memset()
would cause a NULL deref. GCC 12.5 caught this and gave a
-Warray-bounds warning:
```
In file included from /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_plat.h:40,
from /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_com.h:38,
from /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.h:40,
from /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:34:
In function 'ena_com_create_and_store_tx_meta_desc',
inlined from 'ena_com_prepare_tx' at /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:409:3:
dragonfly/sys/systm.h:268:9: warning: '__builtin_memset' offset [0, 11] is out of the bounds [0, 0] [-Warray-bounds]
268 | __builtin_memset(__DEQUALIFY(void *, (ptr)), (c), (len))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:295:9: note: in expansion of macro 'memset'
295 | memset(meta_desc, 0x0, sizeof(struct ena_eth_io_tx_meta_desc));
| ^~~~~~
[3 lines not shown]
drm/i915: Fix -Wstringop-overflow and -Wstringop-override warnings
The fixes has been obtained from upstream Linux:
- https://github.com/gregkh/linux/commit/fec4d42724a1bf3dcba52307e55375fdb967b852
- https://github.com/gregkh/linux/commit/e7c6e405e171fb33990a12ecfd14e6500d9e5cf2
- https://github.com/gregkh/linux/commit/336feb502a715909a8136eb6a62a83d7268a353b
Fix warnings given by GCC 12.5, e.g.,
```
/usr/src/sys/dev/drm/i915/intel_dp.c: In function 'intel_dp_check_mst_status':
/usr/src/sys/dev/drm/i915/intel_dp.c:4299:30: warning: 'drm_dp_channel_eq_ok' reading 6 bytes from a region of size 4 [-Wstringop-overread]
4299 | !drm_dp_channel_eq_ok(&esi[10], intel_dp->lane_count)) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/dev/drm/i915/intel_dp.c:4299:30: note: referencing argument 1 of type 'const u8[6]' {aka 'const unsigned char[6]'}
In file included from /usr/src/sys/dev/drm/i915/intel_dp.c:40:
/usr/src/sys/dev/drm/i915/../../../dev/drm/include/drm/drm_dp_helper.h:955:6: note: in a call to function 'drm_dp_channel_eq_ok'
955 | bool drm_dp_channel_eq_ok(const u8 link_status[DP_LINK_STATUS_SIZE],
| ^~~~~~~~~~~~~~~~~~~~
[16 lines not shown]
drm: Fix pci_bus_read_config_byte() and pci_bus_read_config_word()
The container_of() used wrongly used '&bus' and thus bogus. Luckily,
these functions are only used by i830_overlay_clock_gating() and
i85x_get_cdclk(), both being very old Intel iGPUs.
Fix the code to directly use 'bus->self', which is properly initialized
in drm_init_pdev().
Cross-checked FreeBSD's version of these two functions, which also uses
'bus->self'.
Caught by GCC 12.5 with warnings:
```
In file included from /usr/src/sys/dev/drm/i915/../../../dev/drm/include/drm/drm_pci.h:35,
from /usr/src/sys/dev/drm/i915/../../../dev/drm/include/drm/drmP.h:79,
from /usr/src/sys/dev/drm/i915/i915_drv.h:47,
from /usr/src/sys/dev/drm/i915/intel_drv.h:33,
[24 lines not shown]
kern: Fix -Waddress warning in diskioctl()
This code was initially added in commit
c6ef65eafb251f9c905af44fd734cf8201087922, and I see no point of checking
'&dp->d_slice == NULL', which is always false. Just remove it to fix the
following -Waddress warning generated by GCC 12.5:
```
/usr/src/sys/kern/subr_disk.c: In function 'diskioctl':
/usr/src/sys/kern/subr_disk.c:1196:26: warning: the comparison will always evaluate as 'false' for the address of 'd_slice' will never be NULL [-Waddress]
1196 | if (&dp->d_slice == NULL || dp->d_slice == NULL ||
| ^~
In file included from /usr/src/sys/kern/subr_disk.c:92:
/usr/src/sys/sys/disk.h:140:34: note: 'd_slice' declared here
140 | struct diskslices *d_slice;
| ^~~~~~~
```
kern: Further clean up md5c.c and <sys/md5.h>
* No need to rename MD5Transform() and MD5Pad() to avoid libmd conflict,
because libmd has been removed in 2019.
* Use explicit_bzero() to zero sensitive 'x'.
* Remove unnecessary casts.
* Use standard 'uint32_t' instead of 'u_int32_t'.
* Remove obsolete code and comment from <sys/md5.h>.
kern: Fix -Wstringop-overflow warnings in md5c.c
GCC 12.5 generated the following warings for __kern__MD5Transform(). The
reasons was the passed parameter '&context->A' had size 4 (type uint32_t),
but the function would access 16 bytes (state[0..3]). The code used a
hack that the MD5_CTX struct defines A,B,C,D as continous members.
```
/usr/src/sys/kern/md5c.c: In function 'MD5Update':
/usr/src/sys/kern/md5c.c:174:17: warning: '__kern__MD5Transform' accessing 16 bytes in a region of size 4 [-Wstringop-overflow=]
174 | __kern__MD5Transform (&context->A, (char *)context->data);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/kern/md5c.c:174:17: note: referencing argument 1 of type 'u_int32_t[4]' {aka 'unsigned int[4]'}
/usr/src/sys/kern/md5c.c:174:17: note: referencing argument 2 of type 'const unsigned char[64]'
/usr/src/sys/kern/md5c.c:232:1: note: in a call to function '__kern__MD5Transform'
232 | __kern__MD5Transform (u_int32_t state[4], const unsigned char block[64])
| ^~~~~~~~~~~~~~~~~~~~
/usr/src/sys/kern/md5c.c:177:25: warning: '__kern__MD5Transform' accessing 16 bytes in a region of size 4 [-Wstringop-overflow=]
177 | __kern__MD5Transform (&context->A, &input[i]);
[7 lines not shown]
mfi(4): Fix a per-index entry test bug in mfi_ioctl()
The fixed test also matches its creation in bus_dmamap_load() in
mfi_stp_cmd().
FreeBSD made the same fix in commit
27dc50b0f0aab948e2cf60f2f50db1f36ca75054.
Caught by the following -Waddress warning from GCC 12.5:
```
/usr/src/sys/dev/raid/mfi/mfi.c: In function 'mfi_ioctl':
/usr/src/sys/dev/raid/mfi/mfi.c:3100:71: warning: the comparison will always evaluate as 'true' for the address of 'mfi_kbuff_arr_busaddr' will never be NULL [-Waddress]
3100 | if (sc->mfi_kbuff_arr_busaddr != 0)
| ^~
In file included from /usr/src/sys/dev/raid/mfi/mfi.c:81:
/usr/src/sys/dev/raid/mfi/mfivar.h:198:41: note: 'mfi_kbuff_arr_busaddr' declared here
198 | bus_addr_t mfi_kbuff_arr_busaddr[2];
| ^~~~~~~~~~~~~~~~~~~~~
```
kern: Use __builtin_return_address(0) to fix -Warray-bounds warnings
Fix the following -Warray-bounds warnings from GCC 12.5:
```
In function '_lockmgr_assert',
inlined from 'lockmgr_shared' at /usr/src/sys/kern/kern_lock.c:117:2:
/usr/src/sys/kern/kern_lock.c:97:17: warning: array subscript -1 is outside array bounds of 'struct lock[0]' [-Warray-bounds]
97 | panic("lockmgr %s from %p: called from interrupt, ipi, "
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
98 | "or hard code section",
| ~~~~~~~~~~~~~~~~~~~~~~~
99 | lkp->lk_wmesg, ((int **)&lkp)[-1]);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/kern/kern_slaballoc.c: In function 'kmem_slab_alloc':
/usr/src/sys/kern/kern_slaballoc.c:1750:9: warning: array subscript -1 is outside array bounds of 'vm_size_t[1]' {aka 'long unsigned int[1]'} [-Warray-bounds]
1750 | panic("kmem_slab_alloc: bad flags %08x (%p)",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[3 lines not shown]
if_ti: Fix -Waddress warnings from GCC 12.5
The 'ti_event_ring' and 'ti_tx_ring' are embedded arrays in
'struct ti_ring_data', so the checks were meaningless. In addition, the
'sc->ti_rdata' area is initialized in ti_attach(); it's always not
NULL after a successful attach. So just remove the checks to fix the
following warnings from GCC 12.5:
```
/usr/src/sys/dev/netif/ti/if_ti.c: In function 'ti_handle_events':
/usr/src/sys/dev/netif/ti/if_ti.c:508:41: warning: the comparison will always evaluate as 'false' for the address of 'ti_event_ring' will never be NULL [-Waddress]
508 | if (sc->ti_rdata->ti_event_ring == NULL)
| ^~
In file included from /usr/src/sys/dev/netif/ti/if_ti.c:116:
/usr/src/sys/dev/netif/ti/if_tireg.h:1076:33: note: 'ti_event_ring' declared here
1076 | struct ti_event_desc ti_event_ring[TI_EVENT_RING_CNT];
| ^~~~~~~~~~~~~
/usr/src/sys/dev/netif/ti/if_ti.c: In function 'ti_free_tx_ring':
/usr/src/sys/dev/netif/ti/if_ti.c:923:38: warning: the comparison will always evaluate as 'false' for the address of 'ti_tx_ring' will never be NULL [-Waddress]
[10 lines not shown]
wlan: Fix NULL deref bug in hwmp_discover()
The 'ni' is explicitly NULL, but IEEE80211_NOTE() expands to
ieee80211_note_mac() that would access 'ni->ni_macaddr', causing a NULL
deref. Fix it by porting the FreeBSD's fix: replacing IEEE80211_NOTE()
with IEEE80211_DPRINTF() without accessing 'ni'.
Caught by GCC 12.5 warning:
```
In file included from /usr/src/sys/netproto/802_11/wlan/ieee80211_hwmp.c:63:
/usr/src/sys/netproto/802_11/wlan/ieee80211_hwmp.c: In function 'hwmp_discover':
dragonfly/netproto/802_11/ieee80211_var.h:963:17: warning: 'ieee80211_note_mac' reading 6 bytes from a region of size 0 [-Wstringop-overread]
963 | ieee80211_note_mac(_vap, (_ni)->ni_macaddr, _fmt, __VA_ARGS__);\
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/netproto/802_11/wlan/ieee80211_hwmp.c:2137:33: note: in expansion of macro 'IEEE80211_NOTE'
2137 | IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP,
| ^~~~~~~~~~~~~~
dragonfly/netproto/802_11/ieee80211_var.h:963:17: note: referencing argument 2 of type 'const uint8_t[6]' {aka 'const unsigned char[6]'}
[9 lines not shown]
hammer2: Fix a NULL deref in hammer2_chain_lastdrop()
That is the no-parent case, i.e., parent is NULL, so it was an error
to access 'parent->core.spin'. Simply remove the hammer2_spin_unex()
call to fix the bug.
This bug was caught by the GCC 12.5 warning:
```
In file included from include/machine/atomic.h:7,
from /usr/src/sys/sys/systm.h:49,
from /usr/src/sys/vfs/hammer2/hammer2_chain.c:57:
In function 'atomic_add_int',
inlined from 'spin_unlock_quick' at /usr/src/sys/sys/spinlock2.h:170:2,
inlined from 'spin_unlock' at /usr/src/sys/sys/spinlock2.h:183:2,
inlined from 'hammer2_chain_lastdrop' at /usr/src/sys/vfs/hammer2/hammer2_chain.c:654:4,
inlined from 'hammer2_chain_drop' at /usr/src/sys/vfs/hammer2/hammer2_chain.c:359:13,
inlined from 'hammer2_chain_drop' at /usr/src/sys/vfs/hammer2/hammer2_chain.c:346:1:
./cpu/atomic.h:91:9: warning: array subscript 0 is outside array bounds of 'int[0]' [-Warray-bounds]
[12 lines not shown]
Revert "kern: Fix write-open "." or ".." to return EISDIR instead of EEXIST"
This reverts commit d5838e7c8154895375e3f278fa0c03a2b913132c.
That change broke mkdir() and maybe others, causing them to return
the wrong EISDIR instead of EEXIST. For example:
```
% mkdir .
mkdir: .: Is a directory
```
We'll need to fix the original issue in another way.
Reported-by: swildner, mneumann
setutxdb(3): Support UTX_DB_LASTLOGX to read last login records
Before this fix, setutxdb(3) returned EINVAL for choosing
UTX_DB_LASTLOGX, so getutxuser() was unable to get last login records
from the lastlogx(5) database. This exact problem caused sshd(8)
failing to print the 'Last login' message on login.
Fix setutxdb(3) to support UTX_DB_LASTLOGX. Note that the lastlogx(5)
database is a Berkeley DB hash keyed by uid and uses the 'lastlogx'
struct.
Assisted-by: DeepSeek-v4.1-flash (with Pi Coding Agent)
stand/cd9660: handle padding after advancing the record pointer
cd9660_open() walks a CD9660 directory by moving dp to the next record
and then adding the record length to the byte counter off. dp has
already moved, so off gets the next record's length, not the current
one. At the end of a directory this can leave off block-aligned after
the last real record, so the loop reads one sector past the directory
extent before it can observe the zero padding. The following sector can
be the start of another file; parsing its bytes as a directory record
can make the Rock Ridge/SUSP scanner loop without making progress and
hang the loader before the kernel.
Follow the FreeBSD fix from D8101 and handle padding immediately after
the advance: if the new record has zero length it is padding, so resync
off to the block boundary and continue. Otherwise add the new record
length.
Obtained-from: FreeBSD (review: https://reviews.freebsd.org/D8101)
Bug: https://bugs.dragonflybsd.org/issues/3446
if_loop: Clean up if_simloop() a bit
* Use M_ASSERTPKTHDR() avoid an ad-hoc KASSERT().
* Use 'uint32_t' instead of plain 'int' to handle the BPF header.
* Use m_adj() to strip the BPF header.
* Replace the KASSERT() with a kprintf() warning if the BPF-injected
packet is too short.
pututxline(3): Initialize the lastlogx struct for updlastlogx()
This doesn't fix a real bug, because the uninitialized fields in 'struct
lastlogx' are currently unused by updlastlogx(). Fix it to be
future-proof.
timeout(1): skip SIGTHR and warn on failed sigaction
timeout(1) installs a handler on every signal so it can forward them to
its child.
The handler loop runs in the parent after fork(), so aborting when a
sigaction() call fails leaves the command running untracked, without a
time limit and without signal forwarding. Skip SIGTHR, and warn instead
of aborting if any other sigaction() fails.
The SIGTHR is reserved by the thread library for thread cancellation.
sigaction() rejects it with EINVAL.
This is a regression revealed by the merge of libthread_xu with libc.
Bug: https://bugs.dragonflybsd.org/issues/3445
if_tun: Fix error handling, input validation and minor issues
* tunclone(): Handle unit allocation failure; rollback changes if
if_clone_create() fails.
* tuncreate(): Handle if_alloc() failure to not leak the 'sc'.
* tun_clone_create(): Simplify bitmap unit conflict, which is an
out-of-sync and shouldn't happen; rollback changes if tuncreate()
fails.
* tunifioctl(): Use ksnprintf() to avoid possible ifs->ascii overrun.
* tunifoutput_serialized():
- Drop packets if the interface is not up, like FreeBSD.
- Handle short or fragmented packets from BPF writes.
- Fix ifq_classify() by moving it after the BPF handling.
- Add IFNET_STAT_INC() for obytes.
* tunioctl():
- Validate MTU range, similar to the check done in if.c.
- Clear the IFF_MULTICAST bit.
* tunwrite(): Simplify and optimize mbuf chain building by using
m_uiomove(), which uses mbuf clusters to save allocations.
[5 lines not shown]
if_tun: Support to delegate per-interface /dev/tunN to normal users
The tun(4) interface doesn't support a 'net.link.tap.user_open' like
sysctl to allow normal users to use an created /dev/tunN, even this
device node has been chown'ed for the user. This made it impossible for
a normal user to use a tun(4) interface, e.g., in 'ssh -w' as mentioned
in commit 06d94267609af69188f670c64af6dce7c7dd45c9.
To fix this limitation, remove the root privilege check on the
per-interface /dev/tunN device nodes, so their access is determined by
the file permissions. Therefore, an admin can create an tun(4)
interface and delegate it to a normal user by changing the ownership,
e.g.,
$ ifconfig tun0 create
$ chown <user> /dev/tun0
Note that the default ownership for /dev/tunN has been changed from uucp:
dialer to root:wheel, avoiding the uucp user implicitly gaining access
[4 lines not shown]
sshd(8): Fix sshd_config installation failure in 'make distribution'
The nrelease/Makefile runs etc's 'make distribution' with a temporary
MAKEOBJDIRPREFIX, so sshd/Makefile.etc cannot use the 'sshd_config'
built along with buildworld.
This fixes the failure introduced by my previous commit
d715c6bde30c404dde667d6642819526181ddc8b.
hammer(8): Fix check_period() to handle DST for daily period
Converting rounded local midnights with mktime() can leave only 23 hours
between consecutive dates when daylight saving time starts. Fix it by
using timegm() that ignores DST offsets.
Reported-by: pavalos
Bug: https://bugs.dragonflybsd.org/issues/2526
if_run: simplify the revision comparison
Revisions below 0x0201 are also below 0x0211. Remove the redundant
comparison without changing which revisions take this branch.
Note: FreeBSD's and OpenBSD's if_run.c still have this redundant
condition.
Reported-by: dcb
Bug: https://bugs.dragonflybsd.org/issues/3018
