DragonFlyBSD/src 755c957 — sys/dev/raid/asr dptalign.h

asr(4): Fix bug of DPT_4_BYTES being wrongly defined as long (8 bytes)

Caught by GCC 12.5 with the following '-Warray-bounds' warnings:

```
In file included from /usr/src/sys/dev/raid/asr/asr.c:148:
/usr/src/sys/dev/raid/asr/asr.c: In function 'ASR_getStatus':
/usr/src/sys/dev/raid/asr/dptalign.h:277:26: warning: array subscript 'long unsigned int[4]' is partly outside array bounds of 'I2O_EXEC_STATUS_GET_MESSAGE[1]' {aka 'struct _I2O_EXEC_STATUS_GET_MESSAGE[1]'} [-Warray-bounds]
  277 |                          *((unsigned DPT_4_BYTES __FAR__ *)getUP1(x,y)) \
      |                          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/dev/raid/asr/i2odep.h:492:17: note: in expansion of macro 'setLU4'
  492 |                 setLU4((&(x)->ReplyBufferLength),0,y)
      |                 ^~~~~~
/usr/src/sys/dev/raid/asr/asr.c:614:9: note: in expansion of macro 'I2O_EXEC_STATUS_GET_MESSAGE_setReplyBufferLength'
  614 |         I2O_EXEC_STATUS_GET_MESSAGE_setReplyBufferLength(Message_Ptr,
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/dev/raid/asr/asr.c:599:41: note: at offset 32 into object 'Message' of size 36
  599 |         I2O_EXEC_STATUS_GET_MESSAGE     Message;
      |                                         ^~~~~~~

    [15 lines not shown]
DeltaFile
+4-2sys/dev/raid/asr/dptalign.h
+4-21 files

DragonFlyBSD/src 553dd9e — sys/dev/acpica acpi_pcib.c

acpica: Remove redundant checks to fix -Waddress warnings

The 'Source' field defined as a flexible array in a struct, so the
checks are always true.

Obtained from FreeBSD (commit d19b0f3ea51bc68a1c095176a7c491370d433cc0).

Fix the following '-Waddress' warnings given by GCC 12.5:

```
/usr/src/sys/dev/acpica/acpi_pcib.c: In function 'prt_attach_devices':
/usr/src/sys/dev/acpica/acpi_pcib.c:99:23: warning: the comparison will always evaluate as 'false' for the address of 'Source' will never be NULL [-Waddress]
   99 |     if (entry->Source == NULL || entry->Source[0] == '\0')
      |                       ^~
In file included from /usr/src/sys/contrib/dev/acpica/source/include/platform/acenv.h:298,
                 from /usr/src/sys/contrib/dev/acpica/source/include/acpi.h:164,
                 from /usr/src/sys/dev/acpica/acpi_pcib.c:38:
/usr/src/sys/contrib/dev/acpica/source/include/acrestyp.h:953:59: note: 'Source' declared here
  953 |                                     ACPI_FLEX_ARRAY(char, Source);

    [24 lines not shown]
DeltaFile
+3-4sys/dev/acpica/acpi_pcib.c
+3-41 files

DragonFlyBSD/src 4d3133c — sys/bus/firewire fwohci.c

firewire: Use a union to fix -Warray-bounds warning

GCC 12.5 generated the following '-Warray-bounds' warning because the
'struct fw_pkt' is larger than a 'uint32_t', so introduce a union to
help the aliasing and fix the warning.

This does fix a real bug, and the change is obtained from NetBSD (GitHub
commit a30bc076fe2f3e969d7451633acfceedb3412fa3: don't assign struct
pointers to smaller then structure regions of memory).

```
/usr/src/sys/bus/firewire/fwohci.c: In function 'fwohci_arcv_swap.isra':
/usr/src/sys/bus/firewire/fwohci.c:2598:33: warning: array subscript 'struct fw_pkt[0]' is partly outside array bounds of 'u_int32_t[1]' {aka 'unsigned int[1]'} [-Warray-bounds]
 2598 |         switch (fp0->mode.common.tcode) {
      |                 ~~~~~~~~~~~~~~~~^~~~~~
/usr/src/sys/bus/firewire/fwohci.c:2586:19: note: object 'ld0' of size 4
 2586 |         u_int32_t ld0;
      |                   ^~~
```
DeltaFile
+7-4sys/bus/firewire/fwohci.c
+7-41 files

DragonFlyBSD/src c7ab6e8 — sys/dev/netif/txp if_txp.c

if_txp: Fix -Waddress warning from GCC 12.5

Remove the dead condition to fix the following '-Waddress' warning:
```
/usr/src/sys/dev/netif/txp/if_txp.c: In function 'txp_rxring_empty':
/usr/src/sys/dev/netif/txp/if_txp.c:1082:39: warning: the comparison will always evaluate as 'false' for the pointer operand in 'sc->sc_rxbufs + (sizetype)((long unsigned int)i * 16)' must not be NULL [-Waddress]
 1082 |                 if (&sc->sc_rxbufs[i] == NULL)
      |                                       ^~
```
DeltaFile
+0-2sys/dev/netif/txp/if_txp.c
+0-21 files

DragonFlyBSD/src 8a0abbc — sys/vfs/devfs devfs_rules.c

devfs(5): Remove redundant checks to fix -Waddress warnings

The 'mntpoint', 'name' and 'linkname' fields are char arrays in
'struct devfs_rule_ioctl', so the warned checks were redundant. Remove
them to fix the '-Waddress' warnings given by GCC 12.5:

```
/usr/src/sys/vfs/devfs/devfs_rules.c: In function 'devfs_rule_alloc':
/usr/src/sys/vfs/devfs/devfs_rules.c:87:29: warning: the comparison will always evaluate as 'false' for the address of 'mntpoint' will never be NULL [-Waddress]
   87 |         if (templ->mntpoint == NULL)
      |                             ^~
In file included from /usr/src/sys/vfs/devfs/devfs_rules.c:44:
/usr/src/sys/sys/devfs_rules.h:74:17: note: 'mntpoint' declared here
   74 |         char    mntpoint[PATH_MAX];
      |                 ^~~~~~~~
/usr/src/sys/vfs/devfs/devfs_rules.c:100:33: warning: the comparison will always evaluate as 'false' for the address of 'name' will never be NULL [-Waddress]
  100 |                 if (templ->name == NULL)
      |                                 ^~
/usr/src/sys/sys/devfs_rules.h:76:17: note: 'name' declared here

    [29 lines not shown]
DeltaFile
+2-23sys/vfs/devfs/devfs_rules.c
+2-231 files

DragonFlyBSD/src 43fdc19 — sys/dev/disk/ahci ahci.c

ahci: Remove redundant conditions to fix -Waddress warnings

The 'ap_ata' field is a pointer array, so 'ap->ap_ata' represents the
address of the field, which is always not NULL.  Remove the redundant
checks to fix the '-Waddress' warnings given by GCC 12.5:

```
/usr/src/sys/dev/disk/ahci/ahci.c: In function 'ahci_port_free':
/usr/src/sys/dev/disk/ahci/ahci.c:1029:13: warning: the comparison will always evaluate as 'true' for the address of 'ap_ata' will never be NULL [-Waddress]
 1029 |         if (ap->ap_ata) {
      |             ^~
In file included from /usr/src/sys/dev/disk/ahci/ahci.c:54:
/usr/src/sys/dev/disk/ahci/ahci.h:488:34: note: 'ap_ata' declared here
  488 |         struct ata_port         *ap_ata[AHCI_MAX_PMPORTS];
      |                                  ^~~~~~
/usr/src/sys/dev/disk/ahci/ahci.c: In function 'ahci_port_hardstop':
/usr/src/sys/dev/disk/ahci/ahci.c:1831:21: warning: the comparison will always evaluate as 'true' for the address of 'ap_ata' will never be NULL [-Waddress]
 1831 |         for (i = 0; ap->ap_ata && i < AHCI_MAX_PMPORTS; ++i) {
      |                     ^~

    [4 lines not shown]
DeltaFile
+5-7sys/dev/disk/ahci/ahci.c
+5-71 files

DragonFlyBSD/src 07dc6fd — sys/dev/disk/nata atapi-cd.h

nata: Tweak 'struct dvd_miscauth' to fix -Warray-bounds warnings

GCC 12.5 gave the warnings because the actual allocated space was
smaller than sizeof(struct dvd_miscauth), which had the data[2048]
field.  There is no code depend on sizeof(struct dvd_miscauth), so turn
it into a flexible array to fix the -Warray-bounds warnings.

GCC 12.5 warnings example:
```
In function 'acd_send_key',
    inlined from 'acd_ioctl' at /usr/src/sys/dev/disk/nata/atapi-cd.c:756:14:
/usr/src/sys/dev/disk/nata/atapi-cd.c:1476:20: warning: array subscript 'struct dvd_miscauth[0]' is partly outside array bounds of 'unsigned char[8]' [-Warray-bounds]
 1476 |         d->data[0] = ai->region;
      |         ~~~~~~~~~~~^~~~~~~~~~~~
In file included from /usr/src/sys/dev/disk/nata/atapi-cd.c:42:
In function '__kmalloc',
    inlined from 'acd_send_key' at /usr/src/sys/dev/disk/nata/atapi-cd.c:1475:6,
    inlined from 'acd_ioctl' at /usr/src/sys/dev/disk/nata/atapi-cd.c:756:14:
/usr/src/sys/sys/malloc.h:280:32: note: object of size 8 allocated by '_kmalloc'

    [6 lines not shown]
DeltaFile
+1-1sys/dev/disk/nata/atapi-cd.h
+1-11 files

DragonFlyBSD/src 4fcf2e1 — sys/vfs/ext2fs ext2_lookup.c, sys/vfs/ufs ufs_lookup.c

ufs,ext2fs: Fix -Warray-bounds warnings from GCC 12.5

The code of using 'struct dirtemplate' in ufs_dirempty() and
ext2_dirempty() was added in 1983 the 4.4BSD era, with the intention of
reducing stack use then [1].  However, this optimization is no longer
need now as we have larger stack space, so revert to use the real
'struct direct' or 'struct ext2fs_direct_2' to silence the warnings.

While there, adjust the MINDIRSIZ definition and rename 'count' to
'resid' to clean up the code a bit.

[1] cleanup dirempty to cut down on stack space used and speed up a tad
    https://github.com/weiss/original-bsd/commit/de69dc11a62d21d77105282cc2d8b0cac21e1587

GCC 12.5 warnings example:
```
/usr/src/sys/vfs/ufs/ufs_lookup.c: In function 'ufs_dirempty':
/usr/src/sys/vfs/ufs/ufs_lookup.c:1076:23: warning: array subscript 'struct direct[0]' is partly outside array bounds of 'struct dirtemplate[1]' [-Warray-bounds]
 1076 |                 if (dp->d_reclen == 0)

    [5 lines not shown]
DeltaFile
+6-9sys/vfs/ufs/ufs_lookup.c
+6-9sys/vfs/ext2fs/ext2_lookup.c
+12-182 files

DragonFlyBSD/src eeca36f — sys/vfs/msdosfs msdosfs_fat.c

msdosfs: Silence a -Wmaybe-uninitialized false warning

GCC 12.5 gave the following warning. It's a false positive, but let's
silence it as it's easy to do.

```
/usr/src/sys/vfs/msdosfs/msdosfs_fat.c: In function 'freeclusterchain':
/usr/src/sys/vfs/msdosfs/msdosfs_fat.c:874:17: warning: 'bn' may be used uninitialized [-Wmaybe-uninitialized]
  874 |                 updatefats(pmp, bp, bn);
      |                 ^~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/vfs/msdosfs/msdosfs_fat.c:819:16: note: 'bn' was declared here
  819 |         u_long bn, bo, bsize, byteoffset;
      |                ^~
```
DeltaFile
+2-2sys/vfs/msdosfs/msdosfs_fat.c
+2-21 files

DragonFlyBSD/src eed3ec1 — sys/dev/virtual/amazon/ena/ena-com ena_eth_com.c

ena(4): Fix possible NULL deref in ena_com_create_and_store_tx_meta_desc()

get_sq_desc() may return NULL, so passing the return value to memset()
would cause a NULL deref.  GCC 12.5 caught this and gave a
-Warray-bounds warning:

```
In file included from /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_plat.h:40,
                 from /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_com.h:38,
                 from /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.h:40,
                 from /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:34:
In function 'ena_com_create_and_store_tx_meta_desc',
    inlined from 'ena_com_prepare_tx' at /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:409:3:
dragonfly/sys/systm.h:268:9: warning: '__builtin_memset' offset [0, 11] is out of the bounds [0, 0] [-Warray-bounds]
  268 |         __builtin_memset(__DEQUALIFY(void *, (ptr)), (c), (len))
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:295:9: note: in expansion of macro 'memset'
  295 |         memset(meta_desc, 0x0, sizeof(struct ena_eth_io_tx_meta_desc));
      |         ^~~~~~

    [3 lines not shown]
DeltaFile
+14-4sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c
+14-41 files

DragonFlyBSD/src c874e29 — sys/dev/drm/i915 intel_pm.c intel_dp.c

drm/i915: Fix -Wstringop-overflow and -Wstringop-override warnings

The fixes has been obtained from upstream Linux:
- https://github.com/gregkh/linux/commit/fec4d42724a1bf3dcba52307e55375fdb967b852
- https://github.com/gregkh/linux/commit/e7c6e405e171fb33990a12ecfd14e6500d9e5cf2
- https://github.com/gregkh/linux/commit/336feb502a715909a8136eb6a62a83d7268a353b

Fix warnings given by GCC 12.5, e.g.,

```
/usr/src/sys/dev/drm/i915/intel_dp.c: In function 'intel_dp_check_mst_status':
/usr/src/sys/dev/drm/i915/intel_dp.c:4299:30: warning: 'drm_dp_channel_eq_ok' reading 6 bytes from a region of size 4 [-Wstringop-overread]
 4299 |                             !drm_dp_channel_eq_ok(&esi[10], intel_dp->lane_count)) {
      |                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/dev/drm/i915/intel_dp.c:4299:30: note: referencing argument 1 of type 'const u8[6]' {aka 'const unsigned char[6]'}
In file included from /usr/src/sys/dev/drm/i915/intel_dp.c:40:
/usr/src/sys/dev/drm/i915/../../../dev/drm/include/drm/drm_dp_helper.h:955:6: note: in a call to function 'drm_dp_channel_eq_ok'
  955 | bool drm_dp_channel_eq_ok(const u8 link_status[DP_LINK_STATUS_SIZE],
      |      ^~~~~~~~~~~~~~~~~~~~

    [16 lines not shown]
DeltaFile
+12-1sys/dev/drm/i915/intel_dp.c
+2-2sys/dev/drm/i915/intel_pm.c
+14-32 files

DragonFlyBSD/src 1164de8 — sys/dev/drm/include/linux pci.h

drm: Fix pci_bus_read_config_byte() and pci_bus_read_config_word()

The container_of() used wrongly used '&bus' and thus bogus. Luckily,
these functions are only used by i830_overlay_clock_gating() and
i85x_get_cdclk(), both being very old Intel iGPUs.

Fix the code to directly use 'bus->self', which is properly initialized
in drm_init_pdev().

Cross-checked FreeBSD's version of these two functions, which also uses
'bus->self'.

Caught by GCC 12.5 with warnings:

```
In file included from /usr/src/sys/dev/drm/i915/../../../dev/drm/include/drm/drm_pci.h:35,
                 from /usr/src/sys/dev/drm/i915/../../../dev/drm/include/drm/drmP.h:79,
                 from /usr/src/sys/dev/drm/i915/i915_drv.h:47,
                 from /usr/src/sys/dev/drm/i915/intel_drv.h:33,

    [24 lines not shown]
DeltaFile
+2-2sys/dev/drm/include/linux/pci.h
+2-21 files

DragonFlyBSD/src ea82031 — sys/kern subr_disk.c

kern: Fix -Waddress warning in diskioctl()

This code was initially added in commit
c6ef65eafb251f9c905af44fd734cf8201087922, and I see no point of checking
'&dp->d_slice == NULL', which is always false.  Just remove it to fix the
following -Waddress warning generated by GCC 12.5:

```
/usr/src/sys/kern/subr_disk.c: In function 'diskioctl':
/usr/src/sys/kern/subr_disk.c:1196:26: warning: the comparison will always evaluate as 'false' for the address of 'd_slice' will never be NULL [-Waddress]
 1196 |         if (&dp->d_slice == NULL || dp->d_slice == NULL ||
      |                          ^~
In file included from /usr/src/sys/kern/subr_disk.c:92:
/usr/src/sys/sys/disk.h:140:34: note: 'd_slice' declared here
  140 |         struct diskslices       *d_slice;
      |                                  ^~~~~~~
```
DeltaFile
+1-1sys/kern/subr_disk.c
+1-11 files

DragonFlyBSD/src 800dd61 — sys/kern md5c.c, sys/sys md5.h

kern: Further clean up md5c.c and <sys/md5.h>

* No need to rename MD5Transform() and MD5Pad() to avoid libmd conflict,
  because libmd has been removed in 2019.
* Use explicit_bzero() to zero sensitive 'x'.
* Remove unnecessary casts.
* Use standard 'uint32_t' instead of 'u_int32_t'.
* Remove obsolete code and comment from <sys/md5.h>.
DeltaFile
+24-26sys/kern/md5c.c
+3-15sys/sys/md5.h
+27-412 files

DragonFlyBSD/src 8a4138a — sys/kern md5c.c

kern: Fix -Wstringop-overflow warnings in md5c.c

GCC 12.5 generated the following warings for __kern__MD5Transform(). The
reasons was the passed parameter '&context->A' had size 4 (type uint32_t),
but the function would access 16 bytes (state[0..3]).  The code used a
hack that the MD5_CTX struct defines A,B,C,D as continous members.

```
/usr/src/sys/kern/md5c.c: In function 'MD5Update':
/usr/src/sys/kern/md5c.c:174:17: warning: '__kern__MD5Transform' accessing 16 bytes in a region of size 4 [-Wstringop-overflow=]
  174 |                 __kern__MD5Transform (&context->A, (char *)context->data);
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/kern/md5c.c:174:17: note: referencing argument 1 of type 'u_int32_t[4]' {aka 'unsigned int[4]'}
/usr/src/sys/kern/md5c.c:174:17: note: referencing argument 2 of type 'const unsigned char[64]'
/usr/src/sys/kern/md5c.c:232:1: note: in a call to function '__kern__MD5Transform'
  232 | __kern__MD5Transform (u_int32_t state[4], const unsigned char block[64])
      | ^~~~~~~~~~~~~~~~~~~~
/usr/src/sys/kern/md5c.c:177:25: warning: '__kern__MD5Transform' accessing 16 bytes in a region of size 4 [-Wstringop-overflow=]
  177 |                         __kern__MD5Transform (&context->A, &input[i]);

    [7 lines not shown]
DeltaFile
+13-9sys/kern/md5c.c
+13-91 files

DragonFlyBSD/src 49272e5 — sys/dev/raid/mfi mfi.c

mfi(4): Fix a per-index entry test bug in mfi_ioctl()

The fixed test also matches its creation in bus_dmamap_load() in
mfi_stp_cmd().

FreeBSD made the same fix in commit
27dc50b0f0aab948e2cf60f2f50db1f36ca75054.

Caught by the following -Waddress warning from GCC 12.5:

```
/usr/src/sys/dev/raid/mfi/mfi.c: In function 'mfi_ioctl':
/usr/src/sys/dev/raid/mfi/mfi.c:3100:71: warning: the comparison will always evaluate as 'true' for the address of 'mfi_kbuff_arr_busaddr' will never be NULL [-Waddress]
 3100 |                                         if (sc->mfi_kbuff_arr_busaddr != 0)
      |                                                                       ^~
In file included from /usr/src/sys/dev/raid/mfi/mfi.c:81:
/usr/src/sys/dev/raid/mfi/mfivar.h:198:41: note: 'mfi_kbuff_arr_busaddr' declared here
  198 |         bus_addr_t                      mfi_kbuff_arr_busaddr[2];
      |                                         ^~~~~~~~~~~~~~~~~~~~~
```
DeltaFile
+1-1sys/dev/raid/mfi/mfi.c
+1-11 files

DragonFlyBSD/src c5b7852 — sys/kern kern_slaballoc.c kern_lock.c

kern: Use __builtin_return_address(0) to fix -Warray-bounds warnings

Fix the following -Warray-bounds warnings from GCC 12.5:

```
In function '_lockmgr_assert',
    inlined from 'lockmgr_shared' at /usr/src/sys/kern/kern_lock.c:117:2:
/usr/src/sys/kern/kern_lock.c:97:17: warning: array subscript -1 is outside array bounds of 'struct lock[0]' [-Warray-bounds]
   97 |                 panic("lockmgr %s from %p: called from interrupt, ipi, "
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   98 |                       "or hard code section",
      |                       ~~~~~~~~~~~~~~~~~~~~~~~
   99 |                       lkp->lk_wmesg, ((int **)&lkp)[-1]);
      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

/usr/src/sys/kern/kern_slaballoc.c: In function 'kmem_slab_alloc':
/usr/src/sys/kern/kern_slaballoc.c:1750:9: warning: array subscript -1 is outside array bounds of 'vm_size_t[1]' {aka 'long unsigned int[1]'} [-Warray-bounds]
 1750 |         panic("kmem_slab_alloc: bad flags %08x (%p)",
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    [3 lines not shown]
DeltaFile
+1-1sys/kern/kern_slaballoc.c
+1-1sys/kern/kern_lock.c
+2-22 files

DragonFlyBSD/src 59604bf — sys/dev/netif/ti if_ti.c

if_ti: Fix -Waddress warnings from GCC 12.5

The 'ti_event_ring' and 'ti_tx_ring' are embedded arrays in
'struct ti_ring_data', so the checks were meaningless.  In addition, the
'sc->ti_rdata' area is initialized in ti_attach(); it's always not
NULL after a successful attach.  So just remove the checks to fix the
following warnings from GCC 12.5:

```
/usr/src/sys/dev/netif/ti/if_ti.c: In function 'ti_handle_events':
/usr/src/sys/dev/netif/ti/if_ti.c:508:41: warning: the comparison will always evaluate as 'false' for the address of 'ti_event_ring' will never be NULL [-Waddress]
  508 |         if (sc->ti_rdata->ti_event_ring == NULL)
      |                                         ^~
In file included from /usr/src/sys/dev/netif/ti/if_ti.c:116:
/usr/src/sys/dev/netif/ti/if_tireg.h:1076:33: note: 'ti_event_ring' declared here
 1076 |         struct ti_event_desc    ti_event_ring[TI_EVENT_RING_CNT];
      |                                 ^~~~~~~~~~~~~
/usr/src/sys/dev/netif/ti/if_ti.c: In function 'ti_free_tx_ring':
/usr/src/sys/dev/netif/ti/if_ti.c:923:38: warning: the comparison will always evaluate as 'false' for the address of 'ti_tx_ring' will never be NULL [-Waddress]

    [10 lines not shown]
DeltaFile
+0-6sys/dev/netif/ti/if_ti.c
+0-61 files

DragonFlyBSD/src 95d8ade — sys/netproto/802_11/wlan ieee80211_hwmp.c

wlan: Fix NULL deref bug in hwmp_discover()

The 'ni' is explicitly NULL, but IEEE80211_NOTE() expands to
ieee80211_note_mac() that would access 'ni->ni_macaddr', causing a NULL
deref.  Fix it by porting the FreeBSD's fix: replacing IEEE80211_NOTE()
with IEEE80211_DPRINTF() without accessing 'ni'.

Caught by GCC 12.5 warning:

```
In file included from /usr/src/sys/netproto/802_11/wlan/ieee80211_hwmp.c:63:
/usr/src/sys/netproto/802_11/wlan/ieee80211_hwmp.c: In function 'hwmp_discover':
dragonfly/netproto/802_11/ieee80211_var.h:963:17: warning: 'ieee80211_note_mac' reading 6 bytes from a region of size 0 [-Wstringop-overread]
  963 |                 ieee80211_note_mac(_vap, (_ni)->ni_macaddr, _fmt, __VA_ARGS__);\
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/netproto/802_11/wlan/ieee80211_hwmp.c:2137:33: note: in expansion of macro 'IEEE80211_NOTE'
 2137 |                                 IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP,
      |                                 ^~~~~~~~~~~~~~
dragonfly/netproto/802_11/ieee80211_var.h:963:17: note: referencing argument 2 of type 'const uint8_t[6]' {aka 'const unsigned char[6]'}

    [9 lines not shown]
DeltaFile
+4-4sys/netproto/802_11/wlan/ieee80211_hwmp.c
+4-41 files

DragonFlyBSD/src fde6d85 — sys/vfs/hammer2 hammer2_chain.c

hammer2: Fix a NULL deref in hammer2_chain_lastdrop()

That is the no-parent case, i.e., parent is NULL, so it was an error
to access 'parent->core.spin'. Simply remove the hammer2_spin_unex()
call to fix the bug.

This bug was caught by the GCC 12.5 warning:

```
In file included from include/machine/atomic.h:7,
                 from /usr/src/sys/sys/systm.h:49,
                 from /usr/src/sys/vfs/hammer2/hammer2_chain.c:57:
In function 'atomic_add_int',
    inlined from 'spin_unlock_quick' at /usr/src/sys/sys/spinlock2.h:170:2,
    inlined from 'spin_unlock' at /usr/src/sys/sys/spinlock2.h:183:2,
    inlined from 'hammer2_chain_lastdrop' at /usr/src/sys/vfs/hammer2/hammer2_chain.c:654:4,
    inlined from 'hammer2_chain_drop' at /usr/src/sys/vfs/hammer2/hammer2_chain.c:359:13,
    inlined from 'hammer2_chain_drop' at /usr/src/sys/vfs/hammer2/hammer2_chain.c:346:1:
./cpu/atomic.h:91:9: warning: array subscript 0 is outside array bounds of 'int[0]' [-Warray-bounds]

    [12 lines not shown]
DeltaFile
+0-1sys/vfs/hammer2/hammer2_chain.c
+0-11 files

DragonFlyBSD/src 007001c — lib/libc/gen utmpx.c

libc: Minor style cleanups to utmpx.c
DeltaFile
+32-34lib/libc/gen/utmpx.c
+32-341 files

DragonFlyBSD/src 166068f — sys/kern vfs_nlookup.c

Revert "kern: Fix write-open "." or ".." to return EISDIR instead of EEXIST"

This reverts commit d5838e7c8154895375e3f278fa0c03a2b913132c.

That change broke mkdir() and maybe others, causing them to return
the wrong EISDIR instead of EEXIST. For example:

```
% mkdir .
mkdir: .: Is a directory
```

We'll need to fix the original issue in another way.

Reported-by: swildner, mneumann
DeltaFile
+1-1sys/kern/vfs_nlookup.c
+1-11 files

DragonFlyBSD/src 36cadcb — lib/libc/gen utmpx.c

pututxline(3): Improve lastlogx struct setup for updlastlogx()

* Additionally fill 'll_ss' field.
* Use bounded strlcpy() to be future-proof.
DeltaFile
+3-2lib/libc/gen/utmpx.c
+3-21 files

DragonFlyBSD/src 8010ac5 — lib/libc/gen endutxent.3 utmpx.c

setutxdb(3): Support UTX_DB_LASTLOGX to read last login records

Before this fix, setutxdb(3) returned EINVAL for choosing
UTX_DB_LASTLOGX, so getutxuser() was unable to get last login records
from the lastlogx(5) database.  This exact problem caused sshd(8)
failing to print the 'Last login' message on login.

Fix setutxdb(3) to support UTX_DB_LASTLOGX.  Note that the lastlogx(5)
database is a Berkeley DB hash keyed by uid and uses the 'lastlogx'
struct.

Assisted-by: DeepSeek-v4.1-flash (with Pi Coding Agent)
DeltaFile
+102-17lib/libc/gen/utmpx.c
+21-10lib/libc/gen/endutxent.3
+123-272 files

DragonFlyBSD/src 3693004 — stand/lib cd9660.c

stand/cd9660: handle padding after advancing the record pointer

cd9660_open() walks a CD9660 directory by moving dp to the next record
and then adding the record length to the byte counter off.  dp has
already moved, so off gets the next record's length, not the current
one.  At the end of a directory this can leave off block-aligned after
the last real record, so the loop reads one sector past the directory
extent before it can observe the zero padding.  The following sector can
be the start of another file; parsing its bytes as a directory record
can make the Rock Ridge/SUSP scanner loop without making progress and
hang the loader before the kernel.

Follow the FreeBSD fix from D8101 and handle padding immediately after
the advance: if the new record has zero length it is padding, so resync
off to the block boundary and continue.  Otherwise add the new record
length.

Obtained-from: FreeBSD (review: https://reviews.freebsd.org/D8101)
Bug: https://bugs.dragonflybsd.org/issues/3446
DeltaFile
+6-0stand/lib/cd9660.c
+6-01 files

DragonFlyBSD/src 332de8a — sys/net if_loop.c

if_loop: Clean up if_simloop() a bit

* Use M_ASSERTPKTHDR() avoid an ad-hoc KASSERT().
* Use 'uint32_t' instead of plain 'int' to handle the BPF header.
* Use m_adj() to strip the BPF header.
* Replace the KASSERT() with a kprintf() warning if the BPF-injected
  packet is too short.
DeltaFile
+17-9sys/net/if_loop.c
+17-91 files

DragonFlyBSD/src 40f785b — . Makefile_upgrade.inc, sys/net/tap if_tap.c if_tapvar.h

if_tun/if_tap: Merge if_tunvar.h/if_tapvar.h into if_tun.c/if_tap.c
DeltaFile
+0-69sys/net/tap/if_tapvar.h
+0-58sys/net/tun/if_tunvar.h
+26-1sys/net/tun/if_tun.c
+25-1sys/net/tap/if_tap.c
+2-0Makefile_upgrade.inc
+53-1295 files

DragonFlyBSD/src 024d1b0 — lib/libc/gen utmpx.c

pututxline(3): Initialize the lastlogx struct for updlastlogx()

This doesn't fix a real bug, because the uninitialized fields in 'struct
lastlogx' are currently unused by updlastlogx().  Fix it to be
future-proof.
DeltaFile
+1-0lib/libc/gen/utmpx.c
+1-01 files

DragonFlyBSD/src 7368265 — sys/net if.h

<net/if.h>: Fix a comment mistake for if_data.ifi_oqdrops
DeltaFile
+1-1sys/net/if.h
+1-11 files

DragonFlyBSD/src c87cb28 — sys/kern uipc_mbuf.c

mbuf: Minor code cleanup to m_adj()

Cross-checked with FreeBSD and they made the same change.
DeltaFile
+1-2sys/kern/uipc_mbuf.c
+1-21 files