fdcopy(): properly update fd_freefile when skipping non-copyable fd
fd_freefile is maintained to fulfill the POSIX guarantee that the lowest
possible file descriptor is allocated on open. If we skip copying an
fd, it is a possible candidate for the lowest index.
First, the file descriptor installed with a kqueue created
without KQUEUE_CPONFORK missed this handling [*].
Second, fd_freefile should be updated only when the current fd index is
below it. A skipped fd above fd_freefile could raise it past a free slot.
PR: 300234 [*]
Reported by: Andrea Venturoli <freebsd at netfence.it>
Reviewed by: markj
Fixes: 1265516c5c61 ("struct file: add DFLAG_FORK, indicate copying on fork")
Fixes: 809f3121be66 ("fd: assign fd_freefile early when copying")
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D61054
ure: Handle SIOCGIFXMEDIA
The SIOCGIFXMEDIA ioctl is uesd to report extended Ethernet media
subtypes.
ure(4)commit d4cf41a99b40 added support for some newer devices and
added a special case to call ifmedia_ioctl() instead of uether_ioctl()
for those devices, but only for SIOCGIFMEDIA and SIOCSIFXMEDIA.
Fixes: d4cf41a99b40 ("Add support for RTL8153B, RTL8156 and RTL8156B to if_ure(4).")
Reviewed by: kbowling
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61049
e1000: Honor the common RSS hash-field policy
Use rss_gethashconfig() to select MRQC hash fields in both the em and
igb multiqueue paths, including kernels built without options RSS.
igb previously enabled UDP four-tuple hashing unconditionally, while
the stack defaults to hashing only the addresses unless
net.inet.rss.udp_4tuple is enabled. Honor that setting and include the
configured IPv6 extension-header address hash.
Limit the 82574 mapping to its supported fields. Its TCP/IPv6 selector
is bit 18, named IPV6_TCP_EX in the shared definitions; bit 21 and the
UDP selectors are reserved. Its default field selection is unchanged.
MFC after: 3 days
Sponsored by: BBOX.io
e1000: clear VFTA when last VLAN is removed
The conventional VLAN filter update skipped zero shadow words. Removing
the final VLAN represented by a VFTA word therefore left the hardware
bit programmed even though the software shadow was clear.
Pass the changed word to em_if_vlan_filter_write() and write it even
when its new value is zero. Retained nonzero words continue to be
replayed as before.
(cherry picked from commit a9305a6f50be89f22c7a469aeee4c3bea2086ace)
netgraph/ng_ksocket: Enter epoch on NG_SEND_DATA_ONLY
The work queued by ng_send_fn() is intentionally processed
outside of the epoch in ngthread().
It is ng_ksocket's responsibility to enter epoch if it decides
to send data from such work.
Reviewed by: glebius
Fixes: 104827151e2a ("ng_iface: don't recursively enter epoch ...")
Differential Revision: https://reviews.freebsd.org/D60589
(cherry picked from commit 67be955f6bd5d5b51fdee407969d1a7cde156f65)
ng_socket: plug node reference leak
There is no need to reference node in its constructor, the framework
already granted us a reference. This extraneous reference was later given
back on socket detach. However, if node is destroyed before the socket,
the node was leaked. This leak was harmless until VIMAGE, where
vnet_netgraph_uninit() would cycle through all nodes and shut them down
expecting them to not exist after the shutdown.
Fixes: 19284374970533e1aa04020d4f840e8877ed6266
(cherry picked from commit 4d3cbeb7b407e127a5364f86039745068fbfc61f)
ipfw/nat64: Fix type confusion panic when using wrong NAT64 instance type
Add etlv type validation to ipfw_nat64clat() and ipfw_nat64stl() to
verify that the retrieved instance is actually a nat64clat instance
before use.
All NAT64 instance types share the same srvstate[] array but have
different struct layouts.
Without type validation, using the wrong instance type with
a handler causes type confusion and kernel panic.
Signed-off-by: Teddy Engel <engel.teddy at gmail.com>
PR: 292023
Reviewed by: pouria
Pull Request: https://github.com/freebsd/freebsd-src/pull/2259
(cherry picked from commit 2e6b22abf44d99b84abf17fe25ca2e8f89716c04)
nat64lsn: Fix type confusion panic when using wrong NAT64 instance type
When an ipfw rule references a NAT64 instance by name using
'nat64lsn', the kernel looks up the instance in the shared
srvstate[] array without verifying the instance type.
If the named instance is actually a nat64clat or nat64stl
instance (created with 'nat64clat' or 'nat64stl'), the code
incorrectly casts the instance to nat64lsn_instance and
dereferences the ->cfg pointer, which causes a kernel panic.
The root cause is that all NAT64 instance types share the same
srvstate[] array but have different struct layouts.
For nat64lsn_instance, the field after 'no' is a pointer to nat64lsn_cfg.
For nat64clat_cfg, the same offset contains an embedded nat64_config struct.
Fix by adding a type check after NAT64_LOOKUP() to verify that the
instance's etlv matches IPFW_TLV_NAT64LSN_NAME before proceeding.
If the type doesn't match, return IP_FW_DENY to reject the packet
safely rather than crashing.
[8 lines not shown]
carp: fix global demotion counter to VRRP advertisements
When net.inet.carp.preempt=1 and a physical interface goes down, the global
V_carp_demotion counter is incremented. For CARP this was already reflected in
outgoing advertisements via DEMOTE_ADVSKEW(), but VRRP sent the raw
sc_vrrp_prio unchanged, so demotion had no effect.
Add DEMOTE_VRRP_PRIO(), a macro analogous to DEMOTE_ADVSKEW():
It subtracts V_carp_demotion from the configured priority and clamps the result
to [0, 254]. Priority 0 is VRRPv3's "resign" signal and causes backups to
preempt immediately. Priority 255 (IP address owner) is never demoted.
Reviewed by: kp
Approved by: kp
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D55558
(cherry picked from commit 9f71153aec0cb455cd49af6d4ca7e4c16fd45d7a)
pfil: Avoid potential mbuf tag leak
In '398254f9999e mbuf: simplify m_free' we removed tag processing
on m_free() of M_NOFREE mbufs. It is possible that a packet filter
could attach a tag to this stack mbuf and call m_free()
on it, meaning that 398254f9999e may have introduced a tag leak.
However,if a tag is attached without anyone calling m_free(), then
this leak was pre-existing.
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D60686
Fixes: 398254f9999e
Sponsored by: Netflix
(cherry picked from commit f4ff995e361fa72cea240c4dbac2d0931965c80f)
mbuf: simplify m_free
The check for (M_PKTHDR|M_NOFREE) was added by np@ in
"91d1b03d3617 Merge r254736 from user/np/cxl_tuning."
in order to support a clever rx mode optimization used
by cxgbe at the time. That optimization was removed in
46e1e307edb6 several years ago. This check is otherwise
unneeded and adds an extraneous test to every mbuf free,
so let's remove it.
Reviewed by: glebius, np
Differential Revision: https://reviews.freebsd.org/D60686
Sponsored by: Netflix
(cherry picked from commit 398254f9999eb1af5f0842570111d584aaf8d01a)
pf: fix a crash on sendfile()
The network layer must not pass unmapped (M_EXTPG) mbufs to if_output()
of network interfaces without IFCAP_MEXTPG. pf should convert these
mbufs by mb_unmapped_to_ext() for such interfaces but it didn't.
The problem had occurred on sendfile because sendfile system call
uses unmapped mbufs for the file data.
Reported by: feld
Reviewed by: kp, glebius
Differential Revision: https://reviews.freebsd.org/D58021
(cherry picked from commit 8a14fcd23a201944f3eb5086403d10cfe1fc128f)
netinet6: Fix check for pktinfo outgoing ifindex in route cache
lookup_route is only called for outgoing traffic, therefore
check nh_ifp index instead of nh_aifp as specified by RFC3542 sec 6.
Differential Revision: https://reviews.freebsd.org/D58544
(cherry picked from commit 7753a59fdf196fcbd8bb5706ad44bfc590bce0a9)
ktls: Fix capability checks in ktls_reset_receive_tag()
IFCAP2_RXTLS4 and IFCAP2_RXTLS6 are bit numbers, not masks, so
ktls_reset_receive_tag() tested if_capenable2 against 0 for IPv4 and against the
RXTLS4 bit for IPv6. An IPv4 connection with NIC receive TLS offload thus never
got a new receive tag after its packets moved to another interface, and fell
back to software decryption for good.
c721694 fixed the same checks in ktls_alloc_rcv_tag(); use IFCAP2_BIT() here
as well.
Fixes: fe8c78f ("ktls: Add full support for TLS RX offloading via network interface.")
Approved by: gallatin, kib
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60757
(cherry picked from commit 32a981471c0147ea494745477434807cf8b6dadb)
ktls: Take the receiving interface of each packet in sbappend_ktls_rx()
sbappend_ktls_rx() read the receiving interface of each packet header it
demotes from the chain's first mbuf, whose header it had zeroed on the first
pass. A chain of two packets or more thus had no interface, and a change of
input interface went unnoticed: the TLS receive tag stayed on the old interface
until a later append of one packet.
Read it from the packet being demoted, as the decrypted mark is.
Fixes: fe8c78f0d202 ("ktls: Add full support for TLS RX offloading via network interface.")
Approved by: gallatin
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60758
(cherry picked from commit c9599b80015a50e66c907dc667334a53bc234dab)
sendfile: Fix bug when using headers with SW KTLS offload
When using SW KTLS, we must account for the headers in sf_iodone()
in terms of either freeing or enqueuing them for TLS work.
Not doing so can lead to a situation where we enqueue only
the payload, and not the header, for encryption. Rather than
leaking the header, the socket is left "hung" with the header marked
M_NOTREADY.
Sponsored by: Netflix
Reviewed by: glebius, kib
Differential Revision: https://reviews.freebsd.org/D57134
(cherry picked from commit fd9af1e7084c550358d9598407f9ee7583e6a53f)
iwn: fix TX QoS AC -> TID mapping for A-MPDU selection
Map the packet QoS value to a TID before looking it up in the
per node + TID AMPDU state array.
The TX A-MPDU state used to be per-AC, but I changed it to be
per-TID because it /is/ negotiated per-TID. However this is
not aligned correctly and A-MPDU on eg the voice queue would
cause a mismatch and thus packets to get dropped.
(TIDs 8..15 are special and session based, not traffic QoS based.)
I noticed this because "ssh host" failed after a while, but
"telnet host 22" succeeded. It turned out that frames weren't
making it to the driver transmit path and I traced it
back to being dropped here. Traffic worked for a while until
A-MPDU TX was negotiated, and then all traffic on a TID
would fail until the 802.11 association was re-established.
[7 lines not shown]
iwm: mask closed_rb_num to the RX ring size
iwm_notif_intr() reads hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff and
loops while (sc->rxq.cur != hw) without masking hw to the ring size (512 entries
for 9000-series MQ RX, 256 for legacy). If the hardware reports a value at or
above the ring size, cur never equals hw: the loop walks stale ring entries
indefinitely and the write-pointer update uses a bogus index. Linux iwlwifi
masks the value (5eae443eb5e2) and OpenBSD has done the same since 9000-series
support was added (3287dca4fa10).
This was found while debugging an iwm crash on another BSD using the same
driver lineage (DragonFly, upstream bug 3449)
Locally tested:
* 7260, 9260, STA mode
PR: kern/299427
Submitted by: David Bidner <david at crap.solutions>
[4 lines not shown]
mwl: return ENOMEM when rx buffer allocation fails
The malloc() failure path returned error, which is 0 at this point,
so callers would treat the allocation failure as success.
Return ENOMEM instead to correctly propagate the out-of-memory condition.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D42282
(cherry picked from commit fa75c1cc242665d123ef5bf2f4ced2e076b35450)
ath: fix ath_buf leak if ath_tx_tag_crypto() returns an error
If ath_tx_tag_crypto() returns an error, then ath_tx_normal_setup()
should consume the mbuf and return an error, so the caller knows to
free the ath_buf. But it wasn't.
This fixes issues I've seen locally where a an AP VAP constantly hits
error conditions (due to other RF/PHY/MAC chipset issues which I haven't
yet figured out) and encryption fails because the station goes away
whilst something's being queued.
Locally tested:
* AR9380, AP mode (2G HT20, 5G HT20, 5G HT40)
(cherry picked from commit f7aad20db59210a4411559d07976a48809b3b0a7)
cxgbe(4): Fix assertion in timer calibration
The calibration callout is stopped when the adapter is marked off limits
but not when the adapter is merely stopped.
Sponsored by: Chelsio Communications
(cherry picked from commit afe55ae68e742ea5e5eb9e78cf68d570d458cd0d)
vtnet: Retry feature negotiation without offloads
A device is permitted to reject an otherwise valid subset of its
offered features by refusing to accept FEATURES_OK (VirtIO v1.3,
2.2.2). Apple's Virtualization.framework does this in practice;
it treats the offered CSUM/TSO offloads as all-or-nothing, while
vtnet's default request contains only part of that group because
of hw.vtnet.lro_disable that would drop the guest TSO bits, thus
negotiation fails and the device does not attach.
If FEATURES_OK is rejected, retry the negotiation once with every
offload-related feature stripped. Changing the feature set after
a failed FEATURES_OK requires re-initialising from device reset
(VirtIO v1.3, 3.1.1), so the retry goes through virtio_reinit().
A NIC without offloads is preferable to no NIC at all. Devices
that accept the initial feature set are unaffected, while those
that also reject the reduced set continue to fail attachment as
before.
[6 lines not shown]
if_axge: remove AXGE_RX_MII_ERR from packet dropping criteria
Packets received with the following configuration are associated with
AXGE_RX_MII_ERR, which looks legit since there's no AXGE_RX_CRC_ERR
or AXGE_RX_DROP_PKT attached:
axge0: <ASIX Elec. Corp. AX88179, rev 2.10/1.00, addr 3> on usbus0
miibus0: <MII bus> on axge0
rgephy0: <RTL8169S/8110S/8211 1000BASE-T media interface> PHY 3 on miibus0
rgephy0: OUI 0x00e04c, model 0x0011, rev. 5
rgephy0: none, 10baseT, 10baseT-FDX, 10baseT-FDX-flow, 100baseTX, 100baseTX-FDX, 100baseTX-FDX-flow, 1000baseT-FDX, 1000baseT-FDX-master, 1000baseT-FDX-flow, 1000baseT-FDX-flow-master, auto, auto-flow
Without this, 'dhclient ue0' never gets valid lease as all the DHCP
replies are dropped by the driver.
This behaviour is align with the reference driver provided by the
vendor(ASIX_USB_NIC_Linux_Driver_Source_v3.5.0.tar.bz2).
(cherry picked from commit 8011f6b0d8ba2ee18a60f3bd719f950081a474b3)
ure(4): Fix spurious link flaps from MII
A race condition in the MII layer causes spurious link down events.
In `statchg`, on link down, check if the PHY reports the link as
actually down using the BMSR register, if not, force the status of the
link to back up and restart TX. Do the same in a MII `linkchg` handler.
On actual link up, restart TX in case it went idle and down.
PR: 252165
Signed-off-by: Rafael Kitover <rkitover at gmail.com>
Reviewed by: pouria
Differential Revision: https://reviews.freebsd.org/D55682
(cherry picked from commit 33e0568d30a687b3bbd3f00fd9b323ff031e39a2)
re(4): harden re_watchdog() recovery and log controller state
Distinguish the two failure classes from the PR in a single log line
(ring indices, ISR/IMR, TXCFG, interrupt mode): lost interrupt vs
genuine DMA stall.
Bail out instead of re-initializing when the controller reads back
all-ones (fallen off the bus; reinit cannot help).
Re-assert the driver's existing ASPM-disabled policy before reinit,
since firmware/power transitions re-arming L0s/L1 is a documented
stall trigger.
Diagnostics-only on the recovered path; no fast-path change.
* Field diagnostics running on an RTL8168H production fleet; the log
format distinguishes lost-doorbell / DMA-stall / dead-controller
without a debug build.
[5 lines not shown]
