ocs_fc: Fix config space bounds, double PRLI response and a stack overflow
Fix three unrelated problems found by security review of the driver.
ECD helper ioctl:
- OCS_ECD_HELPER_CFG_READ* and OCS_ECD_HELPER_CFG_WRITE* passed a user
supplied offset straight to pci_read_config() and pci_write_config().
Reject accesses that extend past PCIE_REGMAX, so that a wide access
starting in range cannot run past the end of config space.
- Use the real access width (1, 2 or 4 bytes) of the command for both
the BAR and the config space checks, rather than assuming 4 bytes, so
that narrow accesses at the very end of the BAR or config space are
not rejected while wider ones remain bounded.
PRLI:
- When a PRLI carries an FC-4 type other than the one the driver
supports, ocs_d_send_prli_rsp() sent an LS_RJT and started node
shutdown, but then fell through and sent a second response on the same
IO (another LS_RJT, or a PRLI LS_ACC when the initiator is accepted),
[19 lines not shown]
ocs_fc: Harden ioctl, XRI lookup and FCP command validation
Fix several issues found by security review of the driver.
ioctl:
- Require PRIV_DRIVER for all ocs ioctls and create the device node
with mode 0600, group wheel.
- Return the error from ocs_process_sli_config() to the caller.
Previously only ENXIO was propagated, so a failed validation or a
failed copyin() still issued the mailbox command, in the latter case
with a descriptor pointing at freed memory.
- Reject COMMON_WRITE_OBJECT when in_bytes exceeds
desired_write_length, and cap WRITE_OBJECT, READ_OBJECT,
READ_OBJECT_LIST and non-embedded mailbox buffers at
OCS_MAX_DMA_ALLOC, returning EINVAL.
- Use a 64-bit size for the non-embedded mailbox buffer to avoid
truncation of a user supplied length.
- Refuse to copy out more than the size of the DMA buffer allocated
for the command.
[19 lines not shown]
OCI: Remove dead code
We don't need to pick a repository URL when all we're doing is enabling
one which was specified in /etc/pkg/.
Reviewed by: dch, imp
Fixes: c73ae6734899 ("release/tools: use same pkg settings ...")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60868
(cherry picked from commit 93c05b743ea865bb87653e9ee5fbaa837c00eee7)
powerpc: Avoid deadlock when CPUs exchange threads
The PowerPC context switch waited for the incoming thread to leave
blocked_lock before releasing the outgoing thread. If two CPUs selected
each other's running threads concurrently, both CPUs waited for the
other to perform the release and neither could progress. This appeared
as intermittent boot hangs under QEMU MTTCG when taskqueue threads were
bound to opposite CPUs.
8df2e5421468 ("powerpc: put the isync inside the TD_LOCK()...")
attempted to fix the same hang by moving isync into the polling loop.
That did not address the circular wait: isync cannot cause either CPU to
execute the release store after the loop. It only added context
synchronization to failed iterations and changed timing. Move isync back
to the successful exit, which preserves acquire ordering for subsequent
context loads.
Match the ordering used by other architectures: publish the outgoing
thread's new lock before waiting for the incoming thread. Apply the
[22 lines not shown]
powerpc: Avoid deadlock when CPUs exchange threads
The PowerPC context switch waited for the incoming thread to leave
blocked_lock before releasing the outgoing thread. If two CPUs selected
each other's running threads concurrently, both CPUs waited for the
other to perform the release and neither could progress. This appeared
as intermittent boot hangs under QEMU MTTCG when taskqueue threads were
bound to opposite CPUs.
8df2e5421468 ("powerpc: put the isync inside the TD_LOCK()...")
attempted to fix the same hang by moving isync into the polling loop.
That did not address the circular wait: isync cannot cause either CPU to
execute the release store after the loop. It only added context
synchronization to failed iterations and changed timing. Move isync back
to the successful exit, which preserves acquire ordering for subsequent
context loads.
Match the ordering used by other architectures: publish the outgoing
thread's new lock before waiting for the incoming thread. Apply the
[22 lines not shown]
usr.bin/man: allow man(1) to search translated manpages in pure $man_lang subdirectory (+)
Currently our man(1) utility search manages only in $lang_country.$charset, $lang.$charset and,
as failover, in en.$charset which is historical behavior.
But nowadays most of ported software uses only $lang subdirectories for translated manpages
instead of use full locale notation, for example, share/ja/man1, share/de/man1, share/ru/man1.
In such cases, our man(1) utility cannot find any translated manpages and silently fallback to english version.
Add $man_lang in search path allows man(1) search and use translated manpages under historical and modern path traditions
MFC after: 1 day
MFC to: stable/15 stable/14
Reviewed by: ziaee, fernape
Approved by: fernape
Differential Revision: https://reviews.freebsd.org/D55805
sctp: improve handling of SO_SETFIB socket option
Since SCTP keeps fibnum in the SCTP protocol control block,
the code can't just defer the processing to the IPv4 or IPv6
layer. Therefore it needs to be implemented in the the SCTP
layer and it needs to call the socket layer function.
PR: 300091
Reviewed by: tuexen
Fixes: caccbaef8e26 ("socket: Move SO_SETFIB handling to protocol layers")
MFC after: 3 days
MFC to: stable/14
MFC to: stable/15
sound examples: trigger dsp devices via syncgroup
Triggering is only needed if device is in mmap mode, and in mmap example
the device is triggered as part of syncgroup. For non-mmap mode,
triggering is not needed at all. Triggering mmap'ed device too early
would start the IPTR/OPTR counters and that would cause those pointers
to be out of sync, so let syncgroup do the triggering once the device is
fully configured and ready for capture and playback.
MFC after: 1 week
Reviewed by: christos
Differential Revision: https://reviews.freebsd.org/D60839
(cherry picked from commit d3aa926bffd20e4ef0e12e3ee9af1707ad234cda)
amdsmu: Use devclass name instead of module name
The diagnostics array contained expected modules to be loaded but the
checking logic checked for if a devclass of that name existed instead.
Have the diagnostics array contain the devclass instead as well as the
module to load for the hint string.
Furthermore, check tha the number of devices is greater than 0 so that
leftover devclasses from unloaded modules don't skip the hint.
Reported by: emaste
Reviewed by: emaste
Fixes: 758578370f6b ("amdsmu: Hints on what to do if IP block blocking S0i3")
Sponsored by: The FreeBSD Foundation
Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/70
riscv: Map the DTB when it is outside the kernel's 1GB region
When the kernel is started directly by SBI firmware, locore.S maps only
the 1GB region that contains the kernel, and initriscv() reads the DTB
through that mapping at the physical address passed in a1. If the
firmware put the DTB in another 1GB region, as QEMU does with more than
1GB of RAM, fake_preload_metadata() faults before the console is up and
the kernel hangs.
Also map the 1GB region that contains the DTB.
This fixes direct kernel booting without FreeBSD loader(8).
PR: 299088
Reviewed by: mhorne
Fixes: bfb857546984 ("riscv: Construct an identity map in locore.S")
MFC after: 1 week
Signed-off-by: Rick Richard <rick at sloservers.com>
inotify: Open target the directory when adding a watch
When an application uses inotify to watch a directory,
vn_inotify_add_watch() reads the directory entries and does a name
lookup so as to induce the filesystem to create namecache entries.
Some filesystems expect the directory to be opened before VOP_READDIR
can be called, so do that.
PR: 299239
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60782
(cherry picked from commit de80428118101624aaeaae02d59665d1027ff10e)
bhyve: fix integer overflow in qXfer packet parser
doff + dlen overflows unsigned int when both values are close to UINT_MAX,
causing the wrong branch to execute and passing an unbounded length to
append_binary_data(). Rewrite the comparison to avoid the addition.
Reviewed by: markj
Fixes: f81cdf24ba54 ("bhyve: Add support for XML register definitions")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60847
(cherry picked from commit 5ce0ab7355264d38fcde4684f0a64347ec0f5234)
amd64/vmm: Don't advertise support for performance counters
vmm doesn't implement them, and after commit 2272fac218a8
("hwpmc: Add support for AMD-only IRPERF in hwpmc PERF class"), FreeBSD
guests fail to boot since they access the unimplemented IRPERF MSR.
MFC after: 1 week
(cherry picked from commit c83e075d72f62c91cb27dd644a62d6a6f5bd56ba)
tcp: Preserve borrowed ICMPv6 error mbufs
The TCP-over-UDP ICMP callback receives ip6c_m as a borrowed chain owned
by icmp6_notify_error. It used m_pulldown() to obtain a contiguous UDP
header even though that API frees the complete chain when the requested
range is unavailable. The callback could then return without
propagating the lost ownership, leaving raw ICMP delivery to read and
free a stale head.
Validate that the complete UDP header was quoted, copy it through the
chain with m_copydata(), and temporarily advance the parser offset
instead of consuming bytes from the caller-owned packet.
A remote sender can reach the old path when TCP UDP tunneling is enabled
by quoting the configured local UDP source port in an ICMPv6 error and
including only four through seven UDP-header bytes.
Signed-off-by: Andrew Griffiths <andrew at calif.io>
[5 lines not shown]
net: Fix handling of sockaddrs in the SIOC{ADD,DEL}MULTI handlers
The SIOCADDMULTI and SIOCDELMULTI handlers add or delete a link-layer
multicast address from an interface's multicast filter list. The
link-layer address is passed using the ifr_addr field of the request
structure.
struct ifreq's ifr_addr field is a struct sockaddr, which is a fair bit
smaller than struct sockaddr_dl (though big enough to hold an ethernet
address). Existing callers set the sockaddr length to
sizeof(struct sockaddr_dl), which is too large, and causes OOB accesses
when if_findmulti() is used to compare the address with others, or when
if_addmulti() makes a copy.
Fix this without breaking compatibility: copy the user-supplied address
into a sockaddr_dl on the stack, and use the latter for the respective
operation.
Also validate the sockaddr_dl internal length fields, suggested by zlei.
[9 lines not shown]
sysvshm: Fix locking in shm_prison_set()
We were not acquiring the global sysvshm lock when handling cleanup of
sysvshm segments. Acquire the lock in shm_prison_cleanup() instead, to
be consistent with the sysv semaphore code.
Reviewed by: jamie
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60030
(cherry picked from commit 546d15061962a8c45c779210969015e30124fe8d)
ipfilter: fix inverted range check on the lookup iterator unit
ipf_lookup_iterate() validates iter.ili_unit with
if (iter.ili_unit < IPL_LOGALL && iter.ili_unit > IPL_LOGMAX)
or alternatively,
if (iter.ili_unit < -1 && iter.ili_unit > 7)
ipf_lookup_add(), ipf_lookup_delete(), ipf_lookup_stats()
ipf_lookup_flush() validate with a ||
Submitted by calif.io for the OpenAI Patch The Planet program
Signed-off-by: Andrew Griffiths <andrew at calif.io>
Reviewed by: markj
MFC after: 1 week
[3 lines not shown]
jail: Fix a race in prison_deref()
If we're killing a jail which has some user refs pending, then we would
first drop our ref and then kill all processes in the prison. However,
it's possible for the prison to be freed before we finish that
operation, generally if the processes exit on their own before
prison_proc_iterate() returns.
Thus, defer the release of the prison refcount until after we've killed
all procs.
Reviewed by: jamie
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59984
(cherry picked from commit 79af745f4c29ab3df037fcf0a4b4fb1ea393825f)
netinet6: Fix the OSIOCAIFADDR_IN6 handler
We cannot simply treat a pointer to struct oin6_aliasreq as a pointer to
struct in6_aliasreq: the latter is larger. In particular, the store to
ifra->ifra_vhid is out of bounds.
Since OSIOCAIFADDR_IN6 does not need to copy data back out, it can
simply use a struct in6_ifaliasreq on the stack.
Reported by: Andrew <xxx.sys at protonmail.com>
Reviewed by: pouria
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60184
(cherry picked from commit c109a681456d03fc0737ca83487995e28b759e3b)
igmp: Deindent some code
No functional change intended.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 123342f3d2cccf432d3d0082097b6c97397ecc67)
ssp: Make the panic string more accurate
"stack overflow detected" sounds like the thread faulted because it
ran out of stack space.
Reported by: Andrew <xxx.sys at protonmail.com>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 0f4b7d28ccb5c8edd0e4aad8135a4356f8a31961)
icmp: Limit routing table updates to the FIB of the redirect
When we receive an ICMP redirect, rib_add_redirect() is used to apply
the redirect to all FIBs. This has been the case since support for
multiple FIBs was added. However, it seems rather dubious: the new
gateway might not be routable from all FIBs, and the validation done for
v4 redirects in icmp_verify_redirect_gateway() is only applied to the
FIB from which the redirect originated.
Modify the handler to apply the redirect only in the originating FIB.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Reviewed by: pouria, zlei, glebius, melifaro
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59567
(cherry picked from commit 01a95394abfdef2adb3216e74d88b9c33321260e)
igmp: Refresh the ip header pointer after m_pullup()
There is a chance that the m_pullup() call immediately above invalidated
the "ip" pointer, so refresh it as we do with the IGMP header.
Otherwise the test in igmp_input_v3_query() for whether the packet is an
IGMPv3 general query might use a pointer to a freed mbuf.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit dc47a6940d60d393b3d36ba0fc5cb84d06fafaea)
imgact_aout: Remove a prototype for a non-existent function
aout_coredump() was removed in commit 1eecfae3e53cb3.
No functional change intended.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 4523cbbfef79eb63e287d9ebd88d9f3ebd885ba1)
jail: Simplify refcount manipulation routines
- refcount_acquire() returns the old value, use that to assert that the
old value was non-zero.
- refcount_release() already asserts that the refcount value is
non-zero, so don't bother asserting that again in the jail code.
- Use __diagused instead of having separate implementations for
INVARIANTS and !INVARIANTS.
No functional change intended.
Reviewed by: jamie
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59983
(cherry picked from commit de6ee1fde8bbcc3dde643ae9f2122c8e2499fe29)
kasan: Fix the annotation for shadow map checks in atomic_load_*
atomic_load_* is a read, not a write. Otherwise KASAN will report a
use-after-free via atomic_load_* as a write rather than a read.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 0aa055edc17267c6e971d29cabeffed0b1c59c32)
