routing: fix rtentry use-after-free in multipath route append
add_route_flags() drops the RIB lock and passes the existing entry,
rt_orig, to add_route_flags_mpath(). If a concurrent delete removes
the prefix in that window, the retry re-inserts rt_orig, which is
then freed while still linked, crashing later in rn_match().
Pass the new rt instead, return ENOENT when the prefix is gone and
RTM_F_CREATE is not set, and fix the rnd_orig NULL check.
Approved by: pouria
Fixes: c24a8f19c5d5 ("routing: fix rib_add_route_px()")
Differential Revision: https://reviews.freebsd.org/D60353
tests/netinet6: fix ndp_del_gu_success flakiness
The test pinged an unanswered address and then deleted the resulting
INCOMPLETE neighbor entry.
The kernel frees that entry after about 3s, so on a loaded VM,
ndp -d could run too late and fail with ENOENT.
Configure 2001:db8::2 on epair0b so the ping gets a reply and the
entry becomes REACHABLE.
Approved by: pouria
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60348
nfscl: Fix oddball cases for session slot release
We have identified some cases where silent slot loss can occur
when operations on NFS mounts are aborted. We experience this
when using NFSv4.2, but it likely also occurs with NFSv4.1.
A slot is acquired for compound operations by nfsv4_setsequence()
and freed by newnfs_request(). Any call path that abandons the
compound before reaching newnfs_request() loses the slot permanently.
We identified four call sites where this happens, one of
which where it actually does happen for us in a semi-reproducible
way, which allowed us to develop a candidate patch, attached.
The patch adds one function, nfsv4_freeunsentslot(), to
nfs_clcomsubs.c. It is called from each of the four call
sites: nfsrpc_writerpc(), nfsrpc_writeds(), and two in
nfsrpc_setextattr().
[11 lines not shown]
lib80211: fix build with eXpat 2.9.0
eXpat 2.9.0 deprecates XML_GetCurrentLineNumber() in favour of
XML_GetCurrentLineNumber64(). The new function behaves the same
as the old one but is not prone to 32 bit integer wrap-around.
sem test: avoid ETIMEDOUT races in the EINTR test cases
timedwait and clockwait_absolute_intr_remaining arm a 50ms SIGALRM and then
wait until an absolute deadline only 100ms in the future.
On a loaded VM the signal can be delivered more than 50ms late, so the wait
times out first.
Approved by: imp
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60347
da: Update trim stats with the periph lock held
Separate the updating the stats for the completion from the biodone for
each one.
Sponsored by: Netflix
Reviewed by: ali_mashtizadeh.com
Differential Revision: https://reviews.freebsd.org/D60156
ada: Update trim stats for every bio
Separate the updating the stats for the completion from the biodone for
each one.
Sponsored by: Netflix
Reviewed by: ali_mashtizadeh.com
Differential Revision: https://reviews.freebsd.org/D60157
cam: Rename cam_iosched_bio_complete to cam_iosched_bio_update_stats
The function updates scheduler statistics but does not complete the
bio. Rename it to avoid implying ownership of bio completion.
Sponsored by: Netflix
Reviewed by: ali_mashtizadeh.com
Differential Revision: https://reviews.freebsd.org/D60349
nda: Update trim stats with the periph lock held
Separate the updating the stats for the completion from the biodone for
each one.
Sponsored by: Netflix
Reviewed by: ali_mashtizadeh.com
Differential Revision: https://reviews.freebsd.org/D60155
pf: set the correct type for rule timeouts
PR: 298877
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 3c58e64369fd8124c83f1c7d63106bddca83fa1e)
camcontrol: Add Spectra Logic copyright
The majority of lines of code currently in fwdownload.c come from ken@'s
rework in commit 0e358df062dd ("Revamp camcontrol(8) fwdownload support
and add the opcodes subcommand."). Add the appropriate copyright.
Approved by: ken
riscv: support the new "riscv,isa-extensions" string-array.
Support the new "riscv,isa-extensions" property on RISC-V hart nodes
in FDT.
The "riscv,isa" property is deprecated, but cannot be removed because
doing so would break compatibility with existing DTBs. The new properties
replace it: "riscv,isa-base" describes the base ISA and
"riscv,isa-extensions" is a string array containing the supported ISA
extensions.
The "riscv,isa-extensions" property can be relatively large; on the
Spacemit K3 SoC it is approximately 300 bytes.
The FreeBSD OFW interface does not provide access to the underlying FDT
property data without copying it, and memory allocation is not possible
this early. So allocate a static buffer for the property instead.
Reuse the existing parse_riscv_isa() implementation to parse both the new
[5 lines not shown]
hwpmc: handle delayed IBS NMIs on Zen 6
On Zen 6, an extra IBS NMI can arrive after later samples. Keep the
credit until the empty NMI arrives, and handle fetch and op samples when
both are ready.
Reviewed by: mhorne
Fixes: 34b00ed041a4 ("hwpmc: fix IBS fetch and op NMI handling")
Fixes: e51ef8ae490f ("hwpmc: Initial support for AMD IBS")
Sponsored by: AMD
Differential Revision: https://reviews.freebsd.org/D60367
pmc.h: bump PMC_VERSION_MINOR
Bump for the addition of PMC_OP_GETCAPS and the recently added Intel
CPUs.
Sponsored by: The FreeBSD Foundation
(cherry picked from commit e39d3a6b32331437da6c13a4aeb67e5bcca67625)
