ptrace: Propagate errors from set_fpregs()
Otherwise ptrace(PT_SETREGSET) will not return errors to userspace.
Fixes: cef05c5a62ba ("amd64: do not allow to set reserved bits in MXCSR for ptrace(PT_SETFPREGS)")
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D58577
uma: Fix KMSAN integration with malloc zones
In commit 459aa032e872 I dropped kmsan_mark() calls from malloc() on the
basis that UMA and kmem_malloc() would handle updates of the KMSAN
shadow map. However, I missed that UMA explicitly does not handle this.
Modify UMA to only omit origin map updates for malloc zones.
Fixes: 459aa032e872 ("malloc: Refactor redzone and sanitizer handling")
Reviewed by: rlibby
Differential Revision: https://reviews.freebsd.org/D58574
rc.d/bthidd: Correct load_kld invocations
Pass a single module name to load_kld for kbdmux and vkbd, allowing
bthidd_prestart to load both modules successfully.
Fixes: cfe1962a1925 (rc: Fix improper use of load_kld)
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
linuxkpi: Add xa_insert_irq wrapper
This just invokes xa_insert similar to other xa_*_irq wrappers.
Reviewed by: bz
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D58576
kld: Reject kernel modules with PT_LOAD segments where filesz > memsz
All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front.
Reported by: Jane Smith <thebugfixers at pm.me> (via D57785)
Reviewed by: jrtc27, kib
Differential Revision: https://reviews.freebsd.org/D58542
rtld: Reject ELF files with PT_LOAD or PT_TLS segments where filesz > memsz
All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front. The kernel already performs
this check for the PT_LOAD segments in the main binary and rtld in
imgact_elf.c.
Reviewed by: jrtc27, kib
Differential Revision: https://reviews.freebsd.org/D58541
stand: Improve error handling when loading ELF files
Previously all the 'goto out' statements after the image was loaded into
memory returned success rather than an error. This is despite comments
indicating some of these conditions were in fact errors, and some of
these error conditions (such as missing PT_DYNAMIC) are treated as errors
in the kernel linker.
In addition, when failing to looking up the symbols for the linker
set, those cases returned failure leaking memory (though it's clear
from the original code from commit ca49b3342d1e that only the second
failure was intended to be an actual error).
To avoid more confusion, move the assignment of `ret` to just before
the `out` label so that `goto out` always returns an error. This is a
more consistent pattern with other code in the tree that tends to use
labels for the error case.
Restructure some other code to avoid a few bogus errors.
[6 lines not shown]
stand: Remove a pointless goto
Commit 505222d35fea removed a batch of code that this goto used to skip
around.
Reviewed by: olce, kib, markj
Fixes: 505222d35fea ("Implement the long-awaited module->file cache database. A userland tool (kldxref(8)) keeps a cache of what modules and versions are inside what .ko files. I have tested this on both Alpha and i386.")
Differential Revision: https://reviews.freebsd.org/D58539
proc_realparent(): do not mark the child as orphan when reparenting to p_opptr pid
Reported and reviewed by: markj
Fixes: 8cef3c9b768a ("proc_realparent(): assert that an orphaned child has real parent != parent")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58566
kqueue: do not buffer the whole knote report when sizing it
kern_proc_kqueues_out() reported into an intermediate sbuf and copied the
result into the caller's.
A process that had leaked 468k kqueue descriptors wired 757 MB of M_SBUF
while dumping core, over roughly 9M reallocations, then copied the whole
thing again.
Reviewed by: adrian, markj
Differential Revision: https://reviews.freebsd.org/D58536
PR: 296835
MFC after: 1 week
bhyve: tpm: Avoid printing a message when clearing the cancel bit
Some drivers do this routinely, e.g., FreeBSD's tpm20 does this every
time it sends a command in tpmcrb_transmit(). This causes the console
to fill up with messages. Instead, only print a warning if the cancel
bit is set to one.
Reviewed by: corvink
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D52425
tests/libc: Fix fortify_source uio tests
Some of the preadv() and readv() tests were not initializing the iovecs
they pass to the system call. When the system call is expected to fail,
that's fine since the FORTIFY_SOURCE checks cause the process to be
aborted. However, in the rest of the test cases, the (p)readv() call
could cause spurious test failures, e.g., when an uninitialized iov
entry points to the current stack frame and the canary gets overwritten.
Modify the tests to explicitly initialize iov entries to avoid this.
The "iov" variants don't have this problem, so leave them alone.
Reviewed by: kevans
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58289
ppp: Reject invalid endpoint discriminator options
Per RFC1717 section 5.1.3, the option length must be at least three.
Processing an undersized option would trigger a large out-of-bounds
write.
PR: 271910
Reported by: Robert Morris
Reported by: Décio Brandão (0xDBJ)
Reviewed by: emaste
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58554
amd64: Mark the trapframe as initialized in ipi_bitmap_handler()
Fixes: fdc1f3450634 ("x86: change signatures of ipi_{bitmap,swi}_handler() to take pointer")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
malloc: Fix domainset usage in malloc_domainset() for large allocs
We should of course pass the provided domainset rather than copying what
plain malloc() does.
Fixes: 89deca0a3361 ("malloc: make malloc_large closer to standalone")
Reviewed by: rlibby
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58316
malloc: Refactor redzone and sanitizer handling
malloc_large() duplicates redzone and KASAN handling that is also
present in malloc() and malloc_domainset(). Refactor the
implementations to reduce this a bit.
Also normalize KMSAN map handling: make malloc() and malloc_domainset()
consistent, and do not update the KMSAN shadow map, as we can rely on
UMA and kmem_malloc() to handle that.
Reviewed by: rlibby
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58272
uma: Insert KASAN redzones after slab-allocated items
Without this, KASAN has the deficiency that inter-object overflows are
not detected most of the time[*] when keg_layout() is able to perfectly
pack a slab. Try to overcome this by adjusting the allocation size to
include a redzone following the object.
With this change, we automatically get a redzone following each item, so
any overflow into the redzone will trigger a panic. Most of UMA doesn't
need to know about this: at slab allocation time, the whole slab is
poisoned, and then kasan_mark_item_valid() will unpoison only the buffer
that is available to the consumer.
Note that in most zones, most objects will follow another object's
redzone, so there is some protection against underflow as well. It
might be worthwhile to provide a stronger guarantee here.
Add an assertion to item_ctor() that the returned item is properly
aligned. I couldn't see any pre-existing checks which verify this.
[5 lines not shown]
if_gif: Add netlink support with tests
Migrate to new if_clone KPI and implement netlink support
for gif(4). Also break GIFSOPTS ioctl logic out of gif_ioctl.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57666
ixgbe: clear VF head write-back state on reset
VF reset and FLR do not clear the transmit head write-back address
registers. A previous VF driver can therefore leave DMA write-back
enabled with a stale address for the next driver instance.
After consuming the reset request and disabling the VF queues, clear the
address registers for each queue belonging to that VF. Derive the queue
count from the active IOV mode so peer queue state is not touched.
Linux commit dbf231af81a7 documents the hardware behavior. The FreeBSD
implementation follows the local queue mapping and register interfaces.
MFC after: 1 week
ixgbe: dispatch PBA string reads through EEPROM ops
E610 installs a device-specific PBA string reader, but the public API
always calls the generic implementation. Dispatch through the EEPROM
operation table so device overrides are honored.
Initialize the generic operation for devices that use the ordinary
EEPROM representation.
Obtained from: Intel ix 3.4.39
MFC after: 1 week
ixgbe: fix host interface timeout detection
The host-interface polling loop was scaled from milliseconds to
microseconds, but its terminal test was left using the unscaled timeout.
Completion at that intermediate iteration can be reported as a timeout,
while actual expiry is not recognized and can accept stale status.
Test against the scaled loop bound used by the polling loop.
Fixes: f46d75c90f5f ("ixgbe: improve MDIO performance by reducing semaphore/IPC delays")
MFC after: 1 week
ixgbe: disable VF multicast reception for empty list
Clear ROMPE for an empty list and enable it only for a nonempty list.
FreeBSD already clears ROMPE when resetting a VF, so that part of the
DPDK change is not needed.
DPDK commit message
net/ixgbe: fix over using multicast table for VF
VMOLR.ROMPE allows a VF to receive packets matching the shared multicast
table. Leaving it enabled after the VF removes its last multicast
address lets PF or peer-VF table entries continue selecting that VF.
Signed-off-by: Wei Zhao <wei.zhao1 at intel.com>
Acked-by: Qi Zhang <qi.z.zhang at intel.com>
Obtained from: DPDK (dc5a6e7422)
MFC after: 1 week
ixgbe: check negotiated API for VF queue query
The GET_QUEUES handler switches on msg[0], which contains the mailbox
command rather than the negotiated API version. It therefore cannot
reject API 1.0 or an unnegotiated VF as intended.
Switch on the API version stored for the VF.
MFC after: 1 week
ixgbe: reject VF requests before CTS
A VF that sends a non-reset request before completing reset negotiation
has not received CTS. The PF ignores the request but currently reports
success, leaving the VF with a false view of the programmed state.
Return failure for the ignored request. This restores the behavior lost
when the mailbox helpers were renamed.
Fixes: 36c516b31136 ("ixgbe: update if_sriov to use the new mailbox apis")
MFC after: 1 week
ixgbe: avoid signed overflow in pause time calculation
pause_time is promoted to signed int before multiplication. Its default
value of 65535 multiplied by 65537 exceeds INT_MAX and triggers UBSAN,
even though the result is assigned to a u32.
Make the multiplier unsigned so the calculation has the intended u32
semantics. Linux commit 3b70683fc4d6 reported the failure in the generic
path and used the same mechanical correction. The 82598-specific flow
control operation contains the identical expression, so correct it as well.
MFC after: 1 week
