linux: do not truncate the listxattr() size
listxattr() sized its buffer with min(), which truncates the 64-bit
size to 32 bits, so a size of 2^32 + k allocated k bytes while the
copy-out guard used the full size. The walk then read record lengths
past the buffer and copied kernel heap out to the caller, and could
panic the kernel. Any user can reach it through a user.* attribute on
a file it owns.
Use MIN(), and fail with EIO if a record runs past the data returned.
Reviewed by: adrian, markj
Approved by: adrian (mentor)
Differential Revision: https://reviews.freebsd.org/D61006
Signed-off-by: Nick Price <nprice at FreeBSD.org>
(cherry picked from commit fbe4835e6b1eec36103a5ce97efbab11b3b5fc72)
ktls: Check the record type message holds its byte
sosend_generic() read the TLS record type past a TLS_SET_RECORD_TYPE
control message holding only a cmsghdr, and sent that stale byte.
Approved by: markj
Fixes: b2e60773c6b0 ("Add kernel-side support for in-kernel TLS.")
Sponsored by: Netflix
(cherry picked from commit bd4975e5fb051c2b2e8d5218940b7e8ef87b5bdf)
lan867xphy: Add silicon rev C2 configuration
Rev C2 requires special configuration for "optimal performance" per
Microchip AN1699: LAN8670/1/2 Configuration Application Note.
Add MMD (MDIO Manageable Device) read/write helpers and an indirect read
function for Microchip's proprietary register access mechanism, and use
them to implement the register writes documented in Microchip's
application note.
It appears rev C1 may warrant the same configuration, based on the Linux
driver, but it is not mentioned in the application note and I have not
included it here.
Reviewed by: kbowling
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61268
TCP RACK: fix RSM computation for TCP fast open
When spitting an RSM containing the SYN and data, honor the
sequence number used by the SYN flag when computing the offset
in the socket buffer.
PR: 297006
Reviewed by: rrs, Peter Lei
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D61149
(cherry picked from commit ff066579fd7719a6361e7ce8cc9ade47517d242d)
linux: do not truncate the listxattr() size
listxattr() sized its buffer with min(), which truncates the 64-bit
size to 32 bits, so a size of 2^32 + k allocated k bytes while the
copy-out guard used the full size. The walk then read record lengths
past the buffer and copied kernel heap out to the caller, and could
panic the kernel. Any user can reach it through a user.* attribute on
a file it owns.
Use MIN(), and fail with EIO if a record runs past the data returned.
Reviewed by: adrian, markj
Approved by: adrian (mentor)
Differential Revision: https://reviews.freebsd.org/D61006
Signed-off-by: Nick Price <nprice at FreeBSD.org>
(cherry picked from commit fbe4835e6b1eec36103a5ce97efbab11b3b5fc72)
ktls: Check the record type message holds its byte
sosend_generic() read the TLS record type past a TLS_SET_RECORD_TYPE
control message holding only a cmsghdr, and sent that stale byte.
Approved by: markj
Fixes: b2e60773c6b0 ("Add kernel-side support for in-kernel TLS.")
Sponsored by: Netflix
(cherry picked from commit bd4975e5fb051c2b2e8d5218940b7e8ef87b5bdf)
netlink: Make room for the unfinished message when growing the buffer
When a message outgrows the writer's buffer, _nlmsg_refill_buffer()
allocates a larger one and moves the unfinished message there. The new
buffer was sized for the data about to be added alone, so with enough of
the message already written the caller wrote past its end and left it
with datalen > buflen. A 20-byte message plus an attribute of 8176
bytes got a buffer of 8192 bytes for 8200 bytes of data, and reading it
panicked an INVARIANTS kernel in nl_soreceive().
Size the new buffer for both, and add a ktest for it.
Reviewed by: glebius
Fixes: 7e5bf68495cc ("netlink: add netlink support")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60541
(cherry picked from commit 5180fce1cf7ec7430ccf2adb88358602e5ccee1e)
sound/midi: Pass the queue sizes as arguments to midi_init()
There is no reason to have kobj methods for this.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
sound/midi: Pair kobj_init() with kobj_delete()
kobj_init() bumps the class refcount, so without a matching
kobj_delete() it never drops to zero.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
sound/midi: Use size_t instead of int where appropriate
Also switch the affected min() calls to ulmin().
No functional change intended.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
sound/midi: Centralize snd_midi cleanup
midi_init()'s error path leaked both unit numbers and duplicated
existing code.
While here, drop the locking in midi_init(), because nothing can reach m
before make_dev() publishes it.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
sound/midi: Always notify the provider from midi_close()
Be consistent with midi_open() which also invokes the callback
unconditionally.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
sound/midi: Fix inverted POLLOUT test in midi_poll()
midi_queue_avail() returns the free space, so the test had it backwards.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
sound/midi: Do not return from midi_close() with the lock held
This was already fixed in midi_open().
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
sound/midi: Retire M_RXEN
It was always set and cleared together with M_RX and never tested on its
own, so it was redundant. The only thing that read it was midi_close()'s
check for whether the flags had changed, which can be reduced to a plain
FREAD test.
No functional change intended.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
sound/midi: Create the device node with make_dev_s()
make_dev(9) publishes the node before si_drv1 is assigned, so an open(2)
racing with midi_init() could dereference si_drv1 before it's set.
Triggering a UAF is not currently an issue because all cdevsw methods
check for NULL, but the fix makes it more robust in any case.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
sound/midi: Rename M_TXEN to M_TXPEND
The flag means that there is data queued to transmit, not that
transmission is enabled.
No functional change intended.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
snd_dummy: Do not use dummy_chan_io() as mpu401's interrupt handler
dummy_chan_io() runs with sc->lock held, but mpu401 calls its handler
from a callout with no mutex associated with it, so writing to the MIDI
device node caused a panic.
Give mpu401 its own handler, and leave MIDI to mpu401's timer instead of
the PCM callout.
Fixes: e963472ef853 ("snd_dummy: Initial MIDI support")
Sponsored by: The FreeBSD Foundation
uart: Set the bus space tag before parsing hw.uart.console
uart_cpu_getdev() lets hw.uart.console override the FDT, but
uart_getenv() maps an "mm:" address with uart_bus_space_mem, which is
only assigned after the FDT probe. On riscv and arm it is still NULL
at that point, so bus_space_map() faults before there is a console.
On riscv this happens on any EFI boot where the firmware provides an
SPCR table, since the loader turns it into hw.uart.console.
Initialize uart_bus_space_mem to fdtbus_bs_tag, as uart_cpu_arm64.c
does with &memmap_bus (See also 0624eddcffefe).
PR: 299089
Reviewed by: mhorne
MFC after: 1 week
Signed-off-by: Rick Richard <rick at sloservers.com>
(cherry picked from commit 9db8ae83e62e9a1391674a14b0b7d76de2e3c3f7)
uart: Set the bus space tag before parsing hw.uart.console
uart_cpu_getdev() lets hw.uart.console override the FDT, but
uart_getenv() maps an "mm:" address with uart_bus_space_mem, which is
only assigned after the FDT probe. On riscv and arm it is still NULL
at that point, so bus_space_map() faults before there is a console.
On riscv this happens on any EFI boot where the firmware provides an
SPCR table, since the loader turns it into hw.uart.console.
Initialize uart_bus_space_mem to fdtbus_bs_tag, as uart_cpu_arm64.c
does with &memmap_bus (See also 0624eddcffefe).
PR: 299089
Reviewed by: mhorne
MFC after: 1 week
Signed-off-by: Rick Richard <rick at sloservers.com>
(cherry picked from commit 9db8ae83e62e9a1391674a14b0b7d76de2e3c3f7)
hwpmc: refuse MOD_UNLOAD while PMC owners exist
Unloading hwpmc while processes own PMCs frees state they still use.
Return EBUSY instead. Use a try-lock on pmc_sx, since MOD_UNLOAD runs
with kld_sx held. MOD_SHUTDOWN still always cleans up.
Reviewed by: mhorne
MFC after: 1 week
Sponsored by: Advanced Micro Devices, Inc.
Differential Revision: https://reviews.freebsd.org/D60561
aq(4): arm PHY thermal shutdown from the admin poll
move thermal shutdown arming to the admin poll
this gives a more reasonable delay prior to the first attempt, and also
allows us to retry and make the option runtime-tuneable via a new
disable_thermal_arm sysctl
Approved by: adrian (mentor)
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D59593
Signed-off-by: Nick Price <nprice at FreeBSD.org>
(cherry picked from commit 75a1939f6360d4a329891e2075d18eef069db9bb)
