iked: vroute: Validate routing socket replies
When parsing malformed RTM replies from the kernel vroute_process()
might walk beyond the response buffer. Therefore check msglen and
rtm_msglen cover the header, and bound every sa_len against the
remaining message and sizeof(struct sockaddr_storage) before copying.
From Andrew Griffiths, thanks!
rework how mbufs share references to external storage
previously mbufs that shared a reference to the same external storage
were linked together with a pair of lists, but operations on these
lists have to be serialised because different cpus can be working
on on mbufs that share the same external storage. this serialisation
was provided by a single global mutex, which has now become contended
when the kernel is doing a lot of work that relies on shared external
storage.
this diff replaces the links with an m_ext_refs struct that "proxies"
the external storage information on mbufs when that storage is first
shared between two mbufs. that struct contains a refcnt that's
increased if the external storage is shared again, and only when
the refcnt drops to zero is the external storage actually released
with the original free handler. these per shared storage refcnts
replace the global mutex for coordinating the "finalisation" and
actual free of the external storage.
[9 lines not shown]
Don't hardcode the disklabel partition of the EFI System Partition in the
code that mounts it to copy over the Apple firmware. use chicken scratches
provided by deraadt@ instead to find it.
Fixes a problem with copying the firmware when doing an install as reported
bu caspar@ (who also tested an earlier version of the chicken scratches).
ok deraadt@
add support for wakeup interrupts to bytgpio(4)
from John Troy who tested on a Lenovo IdeaPad 100S-11IBY
resuming from S0ix suspend with a lid open
ok kettenis@
Fix bug in prefix_evaluate handling of new prefixes.
If new is not eligible then prefix_peer(new) will blow up since new is NULL.
If the new prefix is eligible then clear old and old_pathid_tx and set
peer - the new path will be recorded in rde_enqueue_updates().
If the new prefix is not eligible then clear new but keep old and
old_pathid_tx. If old is also NULL then nothing changed and an early exit
happens. Else old sets peer and rde_enqueue_updates() records the withdraw.
Found by jsg@, OK tb@
Implement a simple rib entry pending paths queue.
Elements are added to the queue when rib entries are enqueued in
rde_enqueue_updates() for the EVAL_DEFAULT and EVAL_ALL cases.
The queue is then flushed once processed by peer_process_updates().
In rib_remove() assert that the queue is empty before free. This is
implied by the re_is_queued() check but that check only looks at the
pq_mode.
A specific path can only be enqueued once, only the last version matters.
In other words rapid withdraw and update actions will be aggregated into
a single action.
Nothing is currently using this data. This will follow next.
OK tb@