Pull up the following revisions(s) (requested by riastradh in ticket #1319):
sys/netinet/tcp_syncache.c: revision 1.8
tcp: Plug a 4-byte leak of kernel stack data through timestamps.
Addresses PR kern/60486
Pull up the following revisions(s) (requested by riastradh in ticket #1318):
sys/dist/pf/net/pf.c: revision 1.88
pf: Fix use-after-free in fragment reassembly.
PR kern/60485: pf(4): uaf in fragment reassembly
Pull up the following revisions(s) (requested by riastradh in ticket #1317):
sys/external/bsd/ipf/netinet/fil.c: revision 1.38
tests/ipf/t_filter_exec.sh: revision 1.9
tests/ipf/expected/ipv6.3: revision 1.2
tests/ipf/input/ipv6.3: revision 1.3
tests/ipf/t_filter_exec.sh: revision 1.10
ipfilter: Fix remotely triggerable null pointer dereference and
add an automatic test for it.
PR kern/60484: ipfilter: null pointer deref in icmp6 parsing
Pull up the following revisions(s) (requested by riastradh in ticket #2040):
sys/dist/pf/net/pf.c: revision 1.88
pf: Fix use-after-free in fragment reassembly.
PR kern/60485: pf(4): uaf in fragment reassembly
Pull up the following revisions(s) (requested by riastradh in ticket #2039):
sys/external/bsd/ipf/netinet/fil.c: revision 1.38
tests/ipf/t_filter_exec.sh: revision 1.9
tests/ipf/expected/ipv6.3: revision 1.2
tests/ipf/input/ipv6.3: revision 1.3
tests/ipf/t_filter_exec.sh: revision 1.10
ipfilter: Fix remotely triggerable null pointer dereference and
add an automatic test for it.
PR kern/60484: ipfilter: null pointer deref in icmp6 parsing
Pull up the following revisions(s) (requested by riastradh in ticket #2038):
sys/dev/hdaudio/hdaudio.c: revision 1.19
hdaudio(4): Apply access checks to ioctl commands so that
unprivileged users without write permission on /dev/hdaudioN can't
change the configuration.
PR kern/60492: hdaudio(4): setconfig is allowed unprivileged
Pull up the following revisions(s) (requested by riastradh in ticket #1316):
sys/dev/hdaudio/hdaudio.c: revision 1.19
hdaudio(4): Apply access checks to ioctl commands so that
unprivileged users without write permission on /dev/hdaudioN can't
change the configuration.
PR kern/60492: hdaudio(4): setconfig is allowed unprivileged
sppp: Add BPF-based packet filtering for dial-on-demand and idle-timeout
Introduce active/dialing filtering using BPF to if_spppsubr.c. This allows
sync PPP interfaces (e.g. pppoe(4)) to control which traffic triggers
dial-on-demand or keeps idle connections alive.
This option is similar to PPP_FILTER.
sppp: use RUN_ONCE(9) to initialize keepalive related resources
to prevent panics during concurrent attach/detach
- Initialize keepalive resources (e.g. spppq_lock and keepalive_ch)
once using RUN_ONCE(9) instead of the first attach.
- Do not free these resources on sppp_detach
NOTE:
We should release these resources in sppp_subr_modcmd(), but module
unloading/cleanup is not implemented yet.
It has been observed in the wild that some individual instances of
ISP10[24]0 controllers don't seem to like getting a 64-bit DMA address
from our driver (at least, there seems to be some sort of incorrect
handling vis a vis the RQSTYPE_A64 message in isp_intr()).
Upon inspection, it was noted that in isp_pci_dmasetup(), the decision
to use RQSTYPE_T3RQS vs RQSTYPE_T2RQS was conditional on sizeof(bus_addr_t)
being larger than sizeof(uint32_t).
However, this isn't the correct predicate; instead, the choice should
be dependent on what the largest value that bus_addr_t will have. As
it happans, the PCI layer makes a distinction between 32-bit and 64-bit
DMA windows, and isp_pci's use of the regular "pa->pa_dmat" would ensure
that the DMA address always fits within 32-bits. Therefore, there was
never a reason to use RQSTYPE_T3RQS, regardless of the size of bus_addr_t.
As such, we tweak the code to depend explicitly on a new isp_use_dma64
flag, which is initialized by the bus front-end according to the DMA
window selection that's been made.
[4 lines not shown]
Support for the 21142/21143 internal NWay block is structured like a
PHY driver, but it was overlooked when the ifmedia/mii layer gained a
locking protocol. Update it to avoid a recursive mutex acquisition
that can occur if the autonegotiation completes (very) quickly.
PR kern/60494
Always use snprintf for MPI_EVENT_INTEGRATED_RAID output. Keep better
track of the amount that we've already printed and increase the max
length to handle all string combinations (even if they shouldn't happen).
From a suggestion by kre.
