tcp: address PR295870
Fix accounting in the sequence space for a FIN bit potentially
piggy bagged during SACK loss recovery triggered transmissions.
Reviewed By: #transport, tuexen
Sponsored by: NetApp, Inc.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61312
link_elf_obj: fix an off-by-one in the symbol string table index check
link_elf_load_file() checks the symbol table's sh_link against
e_shnum with ">" instead of ">=", so a malformed object whose sh_link
equals e_shnum makes the linker read one entry past the section header
array before the sh_type check rejects it. Use ">=", as
link_elf_link_preload() already does.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61055
vmm: Emulate the byte forms of OR and AND with an immediate
Opcode 0x80 (group 1: r/m8, imm8) is in the decode table and
emulate_cmp() handles 80 /7, but emulate_or() and emulate_and() only
accept 0x81 and 0x83. An "or byte ptr [mem], imm8" or "and byte ptr
[mem], imm8" on emulated memory therefore fails with EINVAL and bhyve
stops the guest with "Failed to emulate instruction sequence
[ 80 ... ]". Seen with macOS: VoodooHDA starts the HDA controller's
CORB with "or byte [rax+0x4c], 2" (CORBCTL |= CORBRUN), and the guest
died at the first sound.
Accept 0x80 in both, with a one byte operand as emulate_cmp() does.
The file is shared with bhyve(8), so the fix covers the in-kernel
devices (HPET, local APIC without APICv, I/O APIC) and the user space
device models alike.
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Reviewed by: markj
[3 lines not shown]
link_elf_obj: guard reltab/relatab frees in link_elf_unload_file()
link_elf_unload_file() frees the per-section relocation tables by iterating
ef->nreltab / ef->nrelatab, but dereferences ef->reltab / ef->relatab
unconditionally. The counts are set while scanning the section headers, before
the tables are allocated, so an error on the load path reaches it with a
non-zero count and a NULL table, faulting on ef->relatab[0].rela. Reachable
from link_elf_load_file() once a valid relocation section has been counted,
e.g. a later section with sh_info >= e_shnum (D60937).
Guard the loops with the table pointer, as is already done for ef->progtab
above.
MFC after: 1 week
Reviewed by: markj, kib
Differential Revision: https://reviews.freebsd.org/D61140
link_elf_obj: bounds-check a relocation section's sh_info
sh_info is used to index the section header array without checking it
against e_shnum, so a malformed object can make the linker read out of
bounds. Reject such a file with ENOEXEC in both the preload and kldload
paths.
MFC after: 1 week
Reviewed by: kib, markj
Differential Revision: https://reviews.freebsd.org/D60937
gptzfsboot: Use snprintf() to format file names
The stack buffer in fs_list() can be overflowed if a file name is too
long.
Reported by: Yudi Yang <yudi.yang at rice.edu>
MFC after: 1 week
Mark Johnsons Claude code found a duplicate call to rack_check_reorder_ack() in rack.c
Mark's Claude code properly points out an interesting bug case where if a new block is
created from a sack aka
rsm |--------|
sackblk |--------->
Then when the new block is created rack_check_reorder_ack() is called and then called again when
the block is actually ack'ed. Proper thing is to *not* in this case call the function and only call
it at the processing to ACK. You leave the hookery side however since that is just transfering
the existing block pointers.
Differential Revision:https://reviews.freebsd.org/D61159
kern: Remove unreachable compat_freebsd8 FEATURE
COMPAT_FREEBSD8 does not exist as a kernel option, so this is dead code.
No functional change intended.
Fixes: e256f71389fb ("kernel: add missed FEATUREs compat_freebsd 8-14")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Reviewed by: kib
Pull-Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/80
(cherry picked from commit 9da2c05a748fd17757638e1a9e78215cdb8b80d0)
arm64 pmap: demote L3C pages in pmap_clear_modify()
When pmap_clear_modify() demotes a dirty L2 block mapping, it write
protects the L3 entry that maps "m", so that a subsequent write access
may repromote. However, since fd6cb031f577, the L3 entries created by
pmap_demote_l2_locked() may have ATTR_CONTIGUOUS set, and
pmap_clear_modify() was write protecting one L3 entry within an L3C page
while leaving the page's other L3 entries writeable with ATTR_CONTIGUOUS
still set. A TLB entry that a processor creates from any of those other
L3 entries may translate "m"'s virtual address and permit writes to "m"
without a fault. To fix this issue, as in pmap_remove_write(), demote
the L3C page before write protecting the L3 entry.
(cherry picked from commit 6d7960628f825f1eec0959d6000a79ca8a4ae927)
pci: restore resizable BAR sizes in pci_cfg_restore()
After a device reset, resizable BARs return to their default sizes.
Restore them to the sizes they had prior to reset.
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D61110
Approved by: adrian (mentor)
Signed-off-by: Nick Price <nprice at FreeBSD.org>
ppp: bound Predictor-1 decompression output
Pred1Input() decompressed CCP data into a MAX_MRU+2 mbuf with no limit
on the output, so a peer could expand a short compressed frame (up to
8:1) past the buffer and overflow adjacent heap. An input length below
4 also drove decompress() with a negative length.
Reject out-of-range input lengths and stop decompression at the
destination buffer size.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D61011
Approved by: adrian (mentor)
Signed-off-by: Nick Price <nprice at FreeBSD.org>
ppp: drop config packets whose options overrun the packet
fsm_readopt() advanced the decode cursor by the option length without
checking it against the end of the packet. A crafted LCP/CCP/IPCP
option could then make the Config-Reject/Nak echo copy past the
received packet into adjacent heap, disclosing heap bytes to the peer
before authentication.
Check the option framing once in fsm_Input() and drop the packet before
decoding per RFC1661
Reviewed by: adrian, markj
Differential Revision: https://reviews.freebsd.org/D61008
Approved by: adrian (mentor)
Signed-off-by: Nick Price <nprice at FreeBSD.org>
linux: do not truncate the listxattr() size
listxattr() sized its buffer with min(), which truncates the 64-bit
size to 32 bits, so a size of 2^32 + k allocated k bytes while the
copy-out guard used the full size. The walk then read record lengths
past the buffer and copied kernel heap out to the caller, and could
panic the kernel. Any user can reach it through a user.* attribute on
a file it owns.
Use MIN(), and fail with EIO if a record runs past the data returned.
Reviewed by: adrian, markj
Approved by: adrian (mentor)
Differential Revision: https://reviews.freebsd.org/D61006
Signed-off-by: Nick Price <nprice at FreeBSD.org>
xdr: Limit xdr_wrapstring
The previous commit (re)introduced the possibility that a malicious or
corrupt message can cause the receiver to allocate a very large amount
of memory before realizing that the message is much shorter than
claimed. Revert the change to xdr_wrapstring() to avoid this.
Fixes: d2018cedb414 ("xdr: Fix xdr_string")
Reported by: bjk@
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60898
iSCSI: Fast and per-session timeouts
Support per-session configurable ping (SCSI NOP) and login timeouts
similar to what is supported in the Linux iSCSI initiator configuration file.
Reduce iscsi timer granularity to 0.1 sec.
For backwards compatibility, when all timers are selected on integer numbers,
all status messages are unchanged. If the higher granularity is used, the
log messages include sub-second granularity.
The sysctl(3) interface has changed from pure int to string, in order to
support fractional seconds in a human-readable, dotted notation.
Reviewed By: #netapp, #manpages, jhb, pauamma_chezdork.com, siderop1_netapp.com
Sponsored by: NetApp, Inc.
Differential Revision: https://reviews.freebsd.org/D32540
