drm: Improve dmabuf_close() and dma_buf_fd()
* Reset fp fields before releasing the dmabuf.
* Support O_CLOEXEC in dma_buf_fd().
Obtained-from: https://apollo.backplane.com/DFlyMisc/drm98.patch
Suggested-by: servik
bsd.sys.mk: Clean up a bit
* Remove the obsolete check for "_gccver >= 49" because gcc47 has been
removed.
* Remove the duplicate "CWARNFLAGS += -Werror" inside WFORMAT condition.
This is a minor behavior change, but I think it makes more sense for
FORMAT_AUDIT to control the -Wformat warnings without adding -Werror.
contrib/tre: Fix a use-after-free bug and a memory leak bug
The 'tags', 'pmatch' and 'states_seen' are interior pointers into a
single 'buf' allocation, so calling xfree() on each of them was a
use-after-free bug.
While there, there was another memory leak bug in handling 'buf'
allocation failure, where the previously allocated 'mem' was not freed
before return.
Fix both bugs by using 'goto error_exit' for proper memory free.
The use-after-free bug was caught by the '-Wuse-after-free' warnings
from GCC 12.5, e.g.,
```
In file included from /usr/src/lib/libc/../../contrib/tre/lib/tre-match-backtrack.c:78:
/usr/src/lib/libc/../../contrib/tre/lib/tre-match-backtrack.c: In function 'tre_tnfa_run_backtrack':
/usr/src/lib/libc/../../contrib/tre/lib/xmalloc.h:69:20: warning: pointer 'tmp_buf' used after 'free' [-Wuse-after-free]
69 | #define xfree(ptr) free(ptr)
[19 lines not shown]
Check required kvm(3) symbols before reading
Check required symbols in dconschat, ipcs, netstat and legacy pstat TTY
paths. Keep optional IPC subsystems usable. Check IPC reads and
allocations before using their data.
Use buffered IPC errors and report short reads explicitly instead of
relying on an error buffer that may not describe the incomplete read.
Bug: https://bugs.dragonflybsd.org/issues/3444
libkvm(3): clear failed lookups and report lookup errors
Clear requested symbol results before lookup. Keep the live failure
count and continue looking up later entries. Report lookup errors
without relying on the last errno, and preserve table errors in internal
callers.
Bug: https://bugs.dragonflybsd.org/issues/3444
kern: avoid reading a disk label while dumping
Checking an unlabelled dump slice can trigger a disk-label read through
normal buffered I/O. During a crash dump, that read can wait indefinitely
before the dump writer reaches its polled I/O path.
Skip the label read while dumping and use the slice bounds already held
in memory, keeping the normal label probe outside the dump path.
Bug: https://bugs.dragonflybsd.org/issues/3441
nd6: keep foreign-CPU neighbors off the timer and purge list
Route requests create neighbor entries on each network CPU, but timers
and purge run on CPU 0. Purging a foreign-CPU entry deletes the matching
local route and can follow its freed neighbor entry. Link only CPU 0
entries into the list and unlink only linked entries; keep other CPUs
route-local neighbor data.
Bug: https://bugs.dragonflybsd.org/issues/3439
pf.conf.5: describe IPv6 fragment filtering without reassembly
IPv6 fragments are filtered as the Fragment header protocol, not blocked
unconditionally. State that port/type rules cannot pass them and that a
broad pass rule does not enforce those restrictions.
Bug: https://bugs.dragonflybsd.org/issues/3438
pf: fix IPv6 fragment length checks
ip6_plen excludes the IPv6 header, but off includes it. Check packet and
fragment-header bounds, use matching length units, and reject misaligned
non-final fragments. Include pre-fragment extension headers in the
reassembled payload limit.
Bug: https://bugs.dragonflybsd.org/issues/3437
ndp(8): avoid deleting covering routes and report socket errors
RTM_GET can return a covering route for an absent neighbor. Require the
requested address and an NDP route before deletion. Return failure for
routing-socket write, read and reply errors, and pass deletion failure
to the exit status.
Bug: https://bugs.dragonflybsd.org/issues/3436
openssh: Update and refactor makefiles for 10.6p1 import
Highlights:
* New components: /usr/libexec/ssh-sk-helper and /usr/libexec/sshd-auth.
* Enabled the security key helper for the later FIDO/U2F support.
NOTE: That requires to import the libfido2 and libcbor libraries.
* Removed libprivate_ssh library; it has been refactored as an internal
library.
Major changes:
* Refactor lib/libssh to make it an internal library, rather than
previously as a private library.
* Sync the libssh.a source list with the vendor's makefile.
* The auto-generated config.h is copied as lib/libssh/config.h.auto, and
the final config.h is created with the makefile to apply our
corrections.
* Add the lib/libssh/Makefile.common to reduce duplicate code among all
the OpenSSH components.
Merge branch 'vendor/OPENSSH'
Upgrade OpenSSH from 9.8p1 to 10.6p1.
The last update didn't use the vendor branch, so the vendor branch
upgraded from 9.1p1 to 10.6p1, but the real update is 9.8p1 to 10.6p1.
bsd.crunchgen.mk: Make "depend" for internal libraries first
A program may depend on the output (e.g., a generated header) of
"make depend" of its internal libraries, so make "depend" for the
internal libraries first.
This is required by the forthcoming update to the libssh internal
library.
ifconfig(8): Fix false -Wuse-after-free warnings in ifwg.c
Tweak the code to fix the false -Wuse-after-free warnings in
wg_data_grow() from GCC 12.5:
```
/usr/src/sbin/ifconfig/ifwg.c: In function 'wg_data_grow':
/usr/src/sbin/ifconfig/ifwg.c:79:20: warning: pointer may be used after 'realloc' [-Wuse-after-free]
79 | aip_offset = (char *)wg_aip - (char *)wg_interface;
| ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sbin/ifconfig/ifwg.c:82:33: note: call to 'realloc' here
82 | wg_data.wgd_interface = realloc(wg_interface, wg_data.wgd_size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sbin/ifconfig/ifwg.c:78:21: warning: pointer may be used after 'realloc' [-Wuse-after-free]
78 | peer_offset = (char *)wg_peer - (char *)wg_interface;
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sbin/ifconfig/ifwg.c:82:33: note: call to 'realloc' here
82 | wg_data.wgd_interface = realloc(wg_interface, wg_data.wgd_size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[3 lines not shown]
csh(1): Silence -Wuse-after-free warnings from GCC 12.5
GCC 12.5 generates the following -Wuse-after-free warnings, which are
all false positives, so silence them for this vendor source. I'd like
to submit the code fixes to upstream and then do a vendor update.
```
/usr/src/bin/csh/csh/../../../contrib/tcsh-6/sh.func.c: In function 'iconv_catgets':
/usr/src/bin/csh/csh/../../../contrib/tcsh-6/sh.func.c:2600:34: warning: pointer may be used after 'realloc' [-Wuse-after-free]
2600 | dest = p + (dest - buf);
| ~~~~~~^~~~~~
In file included from /usr/src/bin/csh/csh/../../../contrib/tcsh-6/sh.func.c:32:
/usr/src/bin/csh/csh/../../../contrib/tcsh-6/sh.h:499:25: note: call to 'realloc' here
499 | # define xrealloc(p, i) realloc(p, i)
| ^~~~~~~~~~~~~
/usr/src/bin/csh/csh/../../../contrib/tcsh-6/sh.func.c:2597:26: note: in expansion of macro 'xrealloc'
2597 | if ((p = xrealloc(buf, buf_size * 2)) == NULL)
| ^~~~~~~~
/usr/src/bin/csh/csh/../../../contrib/tcsh-6/sh.proc.c: In function 'morecommand':
[22 lines not shown]
contrib/gcc-12: Silence -Wmaybe-uninitialized warning
GCC 12.5 would generate the following -Wmaybe-uninitialized warning for
expmed.cc, which defines the #pragma to force this diagnostic to be a
warning, so the GCC's own bootstrap that uses -Werror could succeed.
However, this #pragma makes this warning can't be silenced by a
-Wno-maybe-uninitialized option on the command line. So just modify the
source file to ignore it.
```
/usr/src/gnu/usr.bin/cc120/libbackend/../../../../contrib/gcc-12/gcc/expmed.cc: In function 'rtx_def* extract_bit_field_1(rtx, poly_uint64, poly_uint64, int, rtx, machine_mode, machine_mode, bool, bool, rtx_def**)':
/usr/src/gnu/usr.bin/cc120/libbackend/../../../../contrib/gcc-12/gcc/expmed.cc:1832:45: warning: '*(unsigned int*)((char*)&imode + offsetof(scalar_int_mode, scalar_int_mode::m_mode))' may be used uninitialized [-Wmaybe-uninitialized]
1832 | rtx sub = extract_bit_field_as_subreg (mode1, op0, imode,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~
1833 | bitsize, bitnum);
| ~~~~~~~~~~~~~~~~
/usr/src/gnu/usr.bin/cc120/libbackend/../../../../contrib/gcc-12/gcc/expmed.cc:1792:19: note: '*(unsigned int*)((char*)&imode + offsetof(scalar_int_mode, scalar_int_mode::m_mode))' was declared here
1792 | scalar_int_mode imode;
| ^~~~~
[6 lines not shown]
