link_elf: bounds-check the DT_HASH offset
parse_dynamic() builds the symbol hash table at ef->address + d_ptr
without checking that d_ptr lies within the mapped image, so a crafted
DT_HASH entry causes an out-of-bounds read of the hash header. Reject
the object with ENOEXEC when the header does not fit in the image.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61323
link_elf_obj: validate section name offsets
A section name offset (sh_name) indexes the section name string table
without being checked against shstrcnt, and the result is passed to
strcmp(), so a corrupt object causes an out-of-bounds read. Check that
the table is NUL-terminated and that every sh_name lies within it, in
both the preload and file paths, and reject the object with ENOEXEC.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61338
link_elf_obj: bounds-check e_shstrndx in link_elf_load_file()
e_shstrndx is used to index the section header array after only being
checked against zero, so a malformed object can make the linker read up
to about 64K entries past the end of shdr[]. Reject such a file with
ENOEXEC, as link_elf_link_preload() already does.
Reported by: llm-postcr
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61321
link_elf_obj: validate symbol name offsets
A symbol name offset (st_name) indexes the string table in several
places without being checked against ddbstrcnt, so a corrupt object
causes an out-of-bounds read. Check that the string table is
NUL-terminated and that every st_name lies within it, in both the
preload and file paths, and reject the object with ENOEXEC.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61322
ipfilter: Remove erroneous ntohs()
The original commit was wrong. ipf_nat_builddivertmp() builds the UDP
template with the length in host byte order
M_DUP() copies that value unchanged. The old code was therefore correct.
It added fin_plen in host order and then did a single htons().
The original patch was discussed with Co-Pilot, which pointed out the
original bug. claude-opus-5-5 discovered the ntohs() error that
co-pilot suggested.
Interestingly this code had been running here for a couple of months.
Reported by: llm-postcr
Fixes: 72cc9e3766f4
ipfilter: Only recalculate the UDP header when we have one
When ipf_nat_out processes NAT_DIVERTOUT (ipnat rdr statements)
it also fixes the checksum in the UDP header. Test for a UDP header
before adjusting its length.
While we are here, the length in the UDP header must be converted
from network byte order to host byte order. Add the missing ntohs().
PR: 296944
MFC after: 3 days
libcasper: Use pdfork() for the zygote
Use pdfork(2) rather than fork(2) to fork the zygote, and close the
descriptor when the main loop terminates.
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: Qualys, Inc.
Reviewed by: oshogbo
Differential Revision: https://reviews.freebsd.org/D60176
pf tests: make return.py more robust
Sometimes ICMP echo packets get lost, so send more than one during
the sanity check. This should resolve the intermittent failure of the
return.py:TestReturn::test_tcp test.
PR: 300511
Sponsored by: Rubicon Communications, LLC ("Netgate")
intel/intel_pmc: Add support for Cannon Lake through Meteor Lake
Match the platform by CPU model and attach on acpi with PWRM at
0xfe000000; the PMC is not PCI-enumerable on these platforms.
SLP_S0_RES offsets and granularities follow each generation's PCH
Family Datasheet Volume 2. A mismatch between the LPIT residency
counter address and SLP_S0_RES is reported on attach.
Reviewed by: olce, adrian
Differential Revision: https://reviews.freebsd.org/D59596
nvme: Fix the data length in the Reservation Report command builder
nvme_ns_resv_report_cmd() put its length argument, which callers
supply in bytes, directly into cdw10. The NUMD field is a 0's
based count of dwords, so the command asked the controller to
transfer nearly four times the size of the supplied data buffer.
In practice controllers limit the transfer to the length described
by the PRP entries, which is why this worked in testing, but the
command was incorrect.
Convert the byte count to a 0's based dword count in the builder.
Reported by: llm-postcr
Fixes: 7a9e4375316b
MFC after: 1 week
Sponsored by: Spectra Logic
Co-authored-by: Claude Fable 5 <noreply at anthropic.com>
camcontrol: Don't close the CAM device in nvme_get_data()
nvme_get_data() closed the supplied CAM device on every error
path, but its callers either pass the device that main() opened
and closes, or close the device themselves, so an error resulted
in a double cam_close_device() and a double free. Move the error
path close into print_dev_nvme(), the one caller that opens its
own device, and leave the device alone in nvme_get_data().
This predates the recent camcontrol NVMe additions, but they added
more callers.
Reported by: llm-postcr
Fixes: 6ee13c54dad0
MFC after: 1 week
Sponsored by: Spectra Logic
Co-authored-by: Claude Fable 5 <noreply at anthropic.com>
camcontrol: Fix extended host identifier retrieval
The Get Features command for the host identifier always requested
the 64-bit form (cdw11 EXHID=0), but the decoding logic sized the
identifier from the controller's CTRATT extended host identifier
capability bit, or always treated it as 128 bits when -U was
given. On a controller supporting the extended host identifier,
the printed value did not match what was requested from the
controller.
Fetch the controller data before issuing the command, request the
extended form when the controller supports it, and decode the form
that was requested. Reject -U when the controller only supports
64-bit host identifiers, since an 8 byte value cannot be shown as
a UUID.
sys/cam/nvme/nvme_all.c,
sys/cam/nvme/nvme_all.h:
Add an exhid argument to nvme_get_feature_hostid(),
[17 lines not shown]
camcontrol: Require a reservation type for reserve, preempt and release
res_type was initialized to 0, but the checks that enforce the -T
argument for the reserve, preempt and release reservation actions
compare it against -1, so they could never fire and camcontrol
silently sent a reservation type of 0, which is invalid.
Initialize res_type to -1 so the checks work, and default the
reservation type to 0 for the release action's clear variant,
which does not take -T and ignores the field.
Reported by: llm-postcr
Fixes: ba75cf05727e
MFC after: 1 week
Sponsored by: Spectra Logic
Co-authored-by: Claude Fable 5 <noreply at anthropic.com>
camcontrol: Fix swapped protection information defaults in nvformat
When no -p or -l arguments are given, the nvformat subcommand fills
in the protection information type and location from the
namespace's current settings. The two were swapped: pi was taken
from the DPS metadata location bit and pil from the protection
information type field. Formatting a namespace with protection
information enabled would therefore silently change its PI
settings, and before the Format NVM command builder masked its
fields, a namespace with PI type 2 enabled would set bit 9 of
cdw10, turning the format into a user data erase.
Reported by: llm-postcr
Fixes: 80f090111ae4
MFC after: 1 week
Sponsored by: Spectra Logic
Co-authored-by: Claude Fable 5 <noreply at anthropic.com>
nvme: Restore the host memory buffer size calculation
When the nvme_ctrlr_cmd_set_feature() call in
nvme_ctrlr_hmb_enable() was rewritten for the widened Set Features
API, the HSIZE calculation reverted to dividing by a hard coded
4096 instead of the controller page size, undoing commit
3740a8db13ba. The Host Memory Buffer Size field is in units of
the current memory page size (CC.MPS), so the wrong size would be
programmed on controllers configured with a page size other than
4KB.
Reported by: llm-postcr
Fixes: 7a9e4375316b
MFC after: 1 week
Sponsored by: Spectra Logic
Co-authored-by: Claude Fable 5 <noreply at anthropic.com>
nvme: Mask the fields in the Format NVM command builder
nvme_admin_format_cmd() did not mask any of the fields it composes
into cdw10, so an out of range value in one field would corrupt
neighboring fields. In particular, an LBA format index greater
than 15 would bleed into the metadata settings and protection
information fields. It also had no support for LBA format indexes
above 15, which NVMe 2.0 encodes via the separate LBAFU field.
Mask all of the fields, and encode bits 5:4 of the LBA format index
in the LBAFU field (cdw10 bits 13:12).
Also reject out of range LBA format indexes in camcontrol's
nvformat global (-G) mode, which has no namespace data to validate
against. The per-namespace mode already validates the index
against NLBAF.
sys/dev/nvme/nvme.h:
Mask the SES, PIL, PI, MSET and LBAF fields in
[12 lines not shown]
nvme: Byte-swap the nsid in the Get/Set Features command builders
nvme_admin_get_feature_cmd() and nvme_admin_set_feature_cmd() stored
the namespace ID in the command without converting it to little
endian, unlike the other command building functions. Any caller
passing a non-zero namespace ID would send the wrong namespace ID on
big endian machines.
Reported by: llm-postcr
Fixes: 7a9e4375316b
MFC after: 1 week
Sponsored by: Spectra Logic
Co-authored-by: Claude Fable 5 <noreply at anthropic.com>
asmc: Use c99 initializers with for-loop counters to improve scoping
declared loop indices in the for statement
Index types are unchanged.
No functional change.
MFC After: 1 Week
Approved-by: ngie (co-mentor)
Reviewed by: ngie, imp
Differential Revision: https://reviews.freebsd.org/D61301
asmc: split the sysctl layer into asmcsysctl.c
Moved the dev.asmc.N tree out of asmc.c
No functional change
MFC After: 1 Week
Approved-by: ngie (co-mentor)
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D61300
asmc: split the PIO backend into asmcpio.c
Moved the inline PIO transactions out of the key transport routines,
which now only dispatch on sc_is_mmio, matching asmcmmio.c. getbyindex and
getinfo stay fused: PIO needs both halves under one hold of sc_mtx.
No functional change.
MFC After: 1 Week
Approved-by: ngie (co-mentor)
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D61296
asmc: split the debug key access into asmc_debug.c
Move the ASMC_DEBUG code out of asmc.c into a file compiled only when the
option is set, gated in files.amd64 the way acpi_debug gates the ACPICA
debugger sources. The module Makefile writes the define into opt_asmc.h so
every translation unit sees it; the old CFLAGS.asmc.c form covered one.
No functional change.
MFC After: 1 Week
Approved-by: ngie (co-mentor)
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D61294
krb5: Don't include libsys in LIBADD
This has the curious effect of placing libsys before libc in the link
order even though libc links against libsys. While this happens to
work currently, it is fragile and fails to link properly in some edge
cases.
Sponsored by: AFRL, DARPA
Differential Revision: https://reviews.freebsd.org/D60724
