sys: protect special device locks during vnode teardown
Special device advisory locking can race with vnode teardown and access
freed specinfo.
OpenAI reported the problem and supplied an initial patch; that patch
introduced a NULL dereference window by clearing v_specinfo while
leaving the vnode typed VCHR or VBLK across a sleep; it also left
teardown exposed to vnode recycling during the drain.
In other words the initial patch addressed one race, introduced another,
and left the vnode lifetime problem unfixed.
Here the reworked approach with large colaboration with claudio@ with
talks and inputs from deraadt@ and beck@.
Resolve and detach specinfo under lockf_lock, interrupt all pending
requests, and retain its storage until the drain completes. Keep VXLOCK
and the temporary vnode reference through teardown; set VBAD before
[3 lines not shown]
tcptrace: spring cleaning
The most important change replaces pcap_offline_read() with
pcap_dispatch(). Debian has had this diff for a while.
Then there are tons of format string warnings which are problematic on
LP64 where sizeof(long) != sizeof(int).
Replace malloc + wrongly sized memset with calloc
There were also some careless patches: an incorrectly terminated comment
and strcat -> strncat conversion with wrong size and no termination...
sthen uploaded the distfile to his mirror, so use this for SITES.
He also eyeballed the diff. Thanks.
update to got 0.131
- reword error message: "object format" is actually the "hash algorithm"
- fix blame regression tests for git >=2.56
- fix detection of passwd YP entries in gotsys-useradd
- remove support for .cvsignore files
- allow the global default hash algorithm to be changed to sha1 in gotsys.conf
- prevent tog crashing if work tree's base commit ID uses a bad hash algorithm
- allow work trees to be opened read-only by multiple got commands at a time
- always print a tab after the file name in unidiff headers, for Larry patch(1)
- prevent branches in protected branch namespaces from being rewound
- fix a wrong bounds check in recv_tree_entries()
- avoid pointless call to getpwnam() when gotd reloads
rpki-client: reimplement and fix cert inheritance checks
The current implementations of x509_inherits() and x509_any_inherits()
are a bit dumb because they re-parse the RFC 3779 extensions to figure
out if all (or any of) the resources inherit. That's quite expensive.
We have all this information already in struct cert, so let's use that.
In cert.c we have the strangely named cert_as_inherit() which requires
the presence of AS resources and checks that the ASIdentifiers are
marked inherit. (It should probably be called cert_ases_inherit())
A similar approach works for IPAddrBlocks. The main observation is that
inheritance applies to the entire address family. Since the IPAddrBlocks
are sorted by AF, of which there are two, we know that an inherit element
comes at the start or the end of the cert->ips[] array. This leads to
cheap and easy cert_all_ips_inherit() and cert_any_ip_inherits()
implementations.
[34 lines not shown]
rpki-client: add a check that IPv6 can't precede IPv4
RFC 3779 is unambiguous: "When both IPv4 and IPv6 addresses are specified,
the IPv4 addresses MUST precede the IPv6 addresses [...]", so add a check
that this is the case.
ok claudio
audio: Check the AUDIO_MIXER_* ioctl's index for negative values
While most drivers check their input (ex. azalia, uaudio, cmpci, envy
do), a driver like utvfu(4) may allow the AUDIO_MIXER_WRITE ioctl to
trigger an out-of-bounds heap write. This fix ensures that any
present or future low-level audio driver gets an index in its
supported range.
Report and proposed fix by Franz Bettag <franz at bett.ag>. Thanks!
shuffle nvgre packet processing to simplify nvgre ioctls.
nvgre_start could be called both with and without NET_LOCK, so it
had to try and coordinate with nvgre_up and _down without relying
on NET_LOCK, but then it also had to defer sending encapsulated
packets to a task so it could control the scope of NET_LOCK before
calling ip_output and ip6_output.
tom smyth reported issues with the nvgre_down coordination, which
led to restructuring this code.
nvgre now forces all transmit calls to be run from their own task
in the softnet threads, which in turn allows it to take NET_LOCK
itself and rely on it to coordinate access to the gre tunnel
configuration parameters. this simplifies nvgre_down, and also
allows us to remove the extra send task, because the NET_LOCK scope
is already known and controlled. packet reception is done as part
of the ip stack processing, so it already has NET_LOCK arounds its
use of the tunnel config.
[7 lines not shown]
Fix `findpr' dereference after context switch in sysctl_proc_vmmap().
Do the sleeping malloc() before process search. Take the reference on
found process descriptor to make concurrent exit1() wait us during the
sleep within fill_vmmap().
I moved the `oldlen' checks and `start' copyin() before process search
to make the error path shorter. This reorders the error path, but they
are just the passed parameters checks which are not related to
found process.
ok kirill
