uvideo: track streaming ownership per-fd and free buffers on STREAMOFF
The driver shared a single streaming state and buffer pool across all
open file descriptors, so a second client (e.g. another browser tab)
could disrupt the first: its cleanup STREAMOFF would tear down the
active stream, and stale buffers prevented re-acquisition.
Add per-fd state via devfs cdevpriv tracking whether this fd started
streaming. STREAMOFF and close from a non-streaming fd are no-ops.
STREAMOFF from the streaming fd stops the stream and frees the buffers
so that a new fd can re-acquire the camera. DQBUF returns EPIPE
immediately when buffers are freed instead of waiting for a timeout.
uvideo: fix close/detach race on streaming teardown
detach() stopped streaming and called uvideo_vs_close() before
destroy_dev(), so a concurrent close() could race the teardown and call
uvideo_vs_close() a second time (double usbd_transfer_unsetup), and
mtx_destroy() could race a close still holding sc_mtx. sc_streaming
was also read without the lock in both paths.
Reorder detach() to call destroy_dev() first so all in-flight cdev
methods drain before any teardown. Read sc_streaming under sc_mtx in
both detach() and the last-close safety net.
uvideo: lock the mmap queue and read path
qbuf(), dqbuf() and read() manipulated sc_mmap_q / sc_mmap_cur /
sc_frames_ready without sc_mtx, racing with the USB transfer callbacks
(producer) that run under the mutex. This could corrupt the queue or
trigger use-after-free.
Take sc_mtx around qbuf(), use mtx_sleep() and protect the queue
operations in dqbuf(), and use mtx_sleep() with a snapshot of sc_fsize
in read().
Also reject S_FMT and S_PARM with EBUSY while streaming: both
re-negotiate the probe/commit controls with the device, which disrupts
the active USB transfers (a second client opening the device would
otherwise freeze the first one's stream).
uvideo: replace contigmalloc with OBJT_PHYS vm_object for mmap buffer
Allocate the mmap buffer via phys_pager_allocate() and map it into
kernel space with vm_map_find()/vm_map_wire(), instead of a custom
cdev_pager backed by contigmalloc. phys_pager_allocate() is required
over a bare vm_object_allocate(OBJT_PHYS) to initialise un_pager.phys.ops,
otherwise phys_pager_getpages() NULL-derefs during vm_map_wire().
Reviewed by: markj
Reported by: markj
Differential Revision: https://reviews.freebsd.org/D58394
uvideo: validate frame size before mmap buffer allocation
dwMaxVideoFrameSize comes from the USB probe/commit response and is not
validated. reqbufs() computed buf_size_total with signed int arithmetic
and no bound, so a bogus value could wrap the product to a small size
and yield a too-small buffer with a huge sc_mmap_buffer_size, causing
out-of-bounds writes from the USB transfer callbacks.
Bound the frame size against sc_max_fbuf_size and use overflow-checked
size_t arithmetic for the total and per-buffer offsets.
Reported by: emaste
uvideo: bounds-check frame interval reads against bLength
Frame interval data is read from device-supplied frame descriptors whose
bLength may be shorter than the number of intervals declared by
bFrameIntervalType. The continuous branch of uvideo_enum_fivals() read
three intervals unconditionally, and the discrete branch checked the
pointer but not the four bytes that UGETDW() reads, so a short or
malformed descriptor could read past bLength and leak adjacent kernel
memory to userspace. uvideo_vs_parse_desc_frame_max_rate() had the same
class of off-by-up-to-three-bytes read.
Compute the available bytes from bLength and validate before each read.
Reported by: emaste
powerpc64: enable extended error strings in GENERIC64* configs
These kernconfs were missed in the previous commit.
PR: 289236
Reviewed by: kib
Fixes: f38cbefef8090f3363e5685c5a3b30ffbf1d3ad0
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
tests/exterr_test: use ATF_REQUIRE_FEATURE to check exterr_strings
This keeps the skipped test message consistent with others.
Reviewed by: netchild
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
bind(2): Lookup local address in current FIB if '*.bind_all_fibs' is active
When a protocol-specific 'bind_all_fibs' tunable is set to 0, a
listening socket will only receive traffic originating from the FIB
it was bound to. However, there are no checks to determine whether
an address exists in the target FIB when binding the socket, which can
lead to a situation where a socket and the address it was bound to
belong to different FIBs.
Prevent this footgun by looking up the requested address in the current
FIB if 'bind_all_fibs' is active and returning an error if the address
does not exist.
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D58281
Reviewed by: glebius, pouria, markj
MFC after: 2 weeks
authpf(8) read_config() should chop off trailing white space
if administrator mistakenly types into configuration file
anchor=authpf_test
where 'authpf_test' is followed by white space, the authpf(8)
is going to use anchor 'authpf_test ' instead of the 'authpf_test'
which is defined in pf.conf(5) as 'anchor authpf_test/*'
issue kindly reported and patch submitted by
Avinash Duduskar <avinash.duduskar (_at_) gmail (_dot_) com>
OK sashan@
PR: 296958
MFC after: 1 week
Obtained from: OpenBSD, sashan <sashan at openbsd.org>, 2d12a8e44d
Sponsored by: Rubicon Communications, LLC ("Netgate")
exec: Avoid overflow when computing the size of the exec map
On a test system with 1024 cores the size of exec map exceeds 4GB, and
all of the operands in the size calculation are 32-bit integers.
Tested by: Jim Huang Chen <jim.chen.1827 at gmail.com>
MFC after: 1 week
Sponsored by: AMD (hardware)
snd_uaudio: Initialize mixer_lock with MTX_RECURSE
Fixes: fc9dc8482396 ("snd_uaudio: Lock usbd_transfer_start() in uaudio_mixer_ctl_set()")
PR: 296682
Sponsored by: The FreeBSD Foundation
MFC after: 3 days
(cherry picked from commit 954001a9dd363da9184706657eb34f9622bb220f)
loader: Allocate trampoline as EfiLoaderCode, not Data
Firmware on a test machine applied NX to non-code allocations, which
resulted in a fault when jumping to the trampoline.
Reviewed by: kib
Tested by: Jim Huang Chen <jim.chen.1827 at gmail.com>
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58383
exterror tests: harden the checks
Skip the message-content check on kernels that do not advertise the
exterr_strings feature, and pin the output format by clearing
EXTERROR_VERBOSE.
Reviewed by: kib
MFC after: 1 week
Assisted-by: Claude Code (Fable 5)
Differential Revision: https://reviews.freebsd.org/D58322
exterror: advertise error strings via kern.features.exterr_strings
Allow userland, in particular test cases for EXTERROR conversions,
to detect at run time whether extended errors include the
descriptive message strings, which depends on the EXTERR_STRINGS
kernel option and cannot be probed in any other way.
Reviewed by: kib
MFC after: 1 week
Assisted-by: Claude Code (Fable 5)
Differential Revision: https://reviews.freebsd.org/D58321
watchdog: Fix a couple type issues
* Force the type of the literal `1` passed to nstosbt() to ensure it's a
64-bit type (or larger). Otherwise it gets inconveniently typed to
int, resulting in truncation.
* Use `flsll()` when converting sbt to power-of-2-nanoseconds to fix
32-bit compatibility.
PR: 292616
Obtained from: Hewlett Packard Enterprise
Fixes: 26d6617f3 ("watchdog: Convert to using sbintime_t format")
(cherry picked from commit d08cb1dc17486920c1506f175d77259e0ac3f3a3)
