Unlink multicast records when their interface is detached
Nothing dropped ifp->if_maddrlist at detach, so a socket that had
joined a group left its struct in_multi/in6_multi linked into the
ifnet that if_detach() then freed, holding a bare if_index. When the
socket finally dropped the membership, in_delmulti() resolved that
index; once if_idxmap_alloc() had wrapped the 16-bit space and handed
it to another interface, the TAILQ_REMOVE wrote through a tqe_prev
pointing into the freed ifnet and left the innocent interface tqh_last
pointing there too.
Unlink the records in in_ifdetach() and in6_ifdetach() and clear the
index; the sockets still reference them, so they are freed as before
when the last one goes away.
OK claudio@
Reported-by: syzbot+06aeb6036c2434fc1cd8 at syzkaller.appspotmail.com
Reported-by: syzbot+eefbaca0eb56be2757c2 at syzkaller.appspotmail.com
Reported-by: syzbot+f1e5d22909ea93b08bd4 at syzkaller.appspotmail.com
Refactor vmm(4) exit handling and correct RIP adjustment.
Make all exit handlers return a enum type that drives the vcpu run
loop instead of an errno that has overloaded semantic meaning.
Centralize and correct some RIP adjustment now that we have NRIPS
guaranteed on SVM systems. In some cases, vmm(4) was advancing RIP
when exceptions were being raised on a vcpu.
ok mlarkin@
Make writes of the hibernate signature go through the I/O page of the
piglet. This fixes a potential issue on arm64 where the kernel might
have been loaded into memory that isn't DMA reachable. It will also
help with implementing some future changes to make the side-effect free
I/O functions support hardware without cache-coherent DMA or IOMMUs.
ok deraadt@, mlarkin@
Add a few more fields directly to exec_package so that the front-end
and back-end of the ELF code doesn't need to communicate them via an
malloc'd structure. Much simpler.
ok kettenis