sctp: improve handling of SO_SETFIB socket option
Since SCTP keeps fibnum in the SCTP protocol control block,
the code can't just defer the processing to the IPv4 or IPv6
layer. Therefore it needs to be implemented in the the SCTP
layer and it needs to call the socket layer function.
PR: 300091
Reviewed by: tuexen
Fixes: caccbaef8e26 ("socket: Move SO_SETFIB handling to protocol layers")
MFC after: 3 days
MFC to: stable/14
MFC to: stable/15
sound examples: trigger dsp devices via syncgroup
Triggering is only needed if device is in mmap mode, and in mmap example
the device is triggered as part of syncgroup. For non-mmap mode,
triggering is not needed at all. Triggering mmap'ed device too early
would start the IPTR/OPTR counters and that would cause those pointers
to be out of sync, so let syncgroup do the triggering once the device is
fully configured and ready for capture and playback.
MFC after: 1 week
Reviewed by: christos
Differential Revision: https://reviews.freebsd.org/D60839
(cherry picked from commit d3aa926bffd20e4ef0e12e3ee9af1707ad234cda)
amdsmu: Use devclass name instead of module name
The diagnostics array contained expected modules to be loaded but the
checking logic checked for if a devclass of that name existed instead.
Have the diagnostics array contain the devclass instead as well as the
module to load for the hint string.
Furthermore, check tha the number of devices is greater than 0 so that
leftover devclasses from unloaded modules don't skip the hint.
Reported by: emaste
Reviewed by: emaste
Fixes: 758578370f6b ("amdsmu: Hints on what to do if IP block blocking S0i3")
Sponsored by: The FreeBSD Foundation
Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/70
riscv: Map the DTB when it is outside the kernel's 1GB region
When the kernel is started directly by SBI firmware, locore.S maps only
the 1GB region that contains the kernel, and initriscv() reads the DTB
through that mapping at the physical address passed in a1. If the
firmware put the DTB in another 1GB region, as QEMU does with more than
1GB of RAM, fake_preload_metadata() faults before the console is up and
the kernel hangs.
Also map the 1GB region that contains the DTB.
This fixes direct kernel booting without FreeBSD loader(8).
PR: 299088
Reviewed by: mhorne
Fixes: bfb857546984 ("riscv: Construct an identity map in locore.S")
MFC after: 1 week
Signed-off-by: Rick Richard <rick at sloservers.com>
inotify: Open target the directory when adding a watch
When an application uses inotify to watch a directory,
vn_inotify_add_watch() reads the directory entries and does a name
lookup so as to induce the filesystem to create namecache entries.
Some filesystems expect the directory to be opened before VOP_READDIR
can be called, so do that.
PR: 299239
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60782
(cherry picked from commit de80428118101624aaeaae02d59665d1027ff10e)
bhyve: fix integer overflow in qXfer packet parser
doff + dlen overflows unsigned int when both values are close to UINT_MAX,
causing the wrong branch to execute and passing an unbounded length to
append_binary_data(). Rewrite the comparison to avoid the addition.
Reviewed by: markj
Fixes: f81cdf24ba54 ("bhyve: Add support for XML register definitions")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60847
(cherry picked from commit 5ce0ab7355264d38fcde4684f0a64347ec0f5234)
amd64/vmm: Don't advertise support for performance counters
vmm doesn't implement them, and after commit 2272fac218a8
("hwpmc: Add support for AMD-only IRPERF in hwpmc PERF class"), FreeBSD
guests fail to boot since they access the unimplemented IRPERF MSR.
MFC after: 1 week
(cherry picked from commit c83e075d72f62c91cb27dd644a62d6a6f5bd56ba)
tcp: Preserve borrowed ICMPv6 error mbufs
The TCP-over-UDP ICMP callback receives ip6c_m as a borrowed chain owned
by icmp6_notify_error. It used m_pulldown() to obtain a contiguous UDP
header even though that API frees the complete chain when the requested
range is unavailable. The callback could then return without
propagating the lost ownership, leaving raw ICMP delivery to read and
free a stale head.
Validate that the complete UDP header was quoted, copy it through the
chain with m_copydata(), and temporarily advance the parser offset
instead of consuming bytes from the caller-owned packet.
A remote sender can reach the old path when TCP UDP tunneling is enabled
by quoting the configured local UDP source port in an ICMPv6 error and
including only four through seven UDP-header bytes.
Signed-off-by: Andrew Griffiths <andrew at calif.io>
[5 lines not shown]
net: Fix handling of sockaddrs in the SIOC{ADD,DEL}MULTI handlers
The SIOCADDMULTI and SIOCDELMULTI handlers add or delete a link-layer
multicast address from an interface's multicast filter list. The
link-layer address is passed using the ifr_addr field of the request
structure.
struct ifreq's ifr_addr field is a struct sockaddr, which is a fair bit
smaller than struct sockaddr_dl (though big enough to hold an ethernet
address). Existing callers set the sockaddr length to
sizeof(struct sockaddr_dl), which is too large, and causes OOB accesses
when if_findmulti() is used to compare the address with others, or when
if_addmulti() makes a copy.
Fix this without breaking compatibility: copy the user-supplied address
into a sockaddr_dl on the stack, and use the latter for the respective
operation.
Also validate the sockaddr_dl internal length fields, suggested by zlei.
[9 lines not shown]
sysvshm: Fix locking in shm_prison_set()
We were not acquiring the global sysvshm lock when handling cleanup of
sysvshm segments. Acquire the lock in shm_prison_cleanup() instead, to
be consistent with the sysv semaphore code.
Reviewed by: jamie
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60030
(cherry picked from commit 546d15061962a8c45c779210969015e30124fe8d)
ipfilter: fix inverted range check on the lookup iterator unit
ipf_lookup_iterate() validates iter.ili_unit with
if (iter.ili_unit < IPL_LOGALL && iter.ili_unit > IPL_LOGMAX)
or alternatively,
if (iter.ili_unit < -1 && iter.ili_unit > 7)
ipf_lookup_add(), ipf_lookup_delete(), ipf_lookup_stats()
ipf_lookup_flush() validate with a ||
Submitted by calif.io for the OpenAI Patch The Planet program
Signed-off-by: Andrew Griffiths <andrew at calif.io>
Reviewed by: markj
MFC after: 1 week
[3 lines not shown]
jail: Fix a race in prison_deref()
If we're killing a jail which has some user refs pending, then we would
first drop our ref and then kill all processes in the prison. However,
it's possible for the prison to be freed before we finish that
operation, generally if the processes exit on their own before
prison_proc_iterate() returns.
Thus, defer the release of the prison refcount until after we've killed
all procs.
Reviewed by: jamie
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59984
(cherry picked from commit 79af745f4c29ab3df037fcf0a4b4fb1ea393825f)
netinet6: Fix the OSIOCAIFADDR_IN6 handler
We cannot simply treat a pointer to struct oin6_aliasreq as a pointer to
struct in6_aliasreq: the latter is larger. In particular, the store to
ifra->ifra_vhid is out of bounds.
Since OSIOCAIFADDR_IN6 does not need to copy data back out, it can
simply use a struct in6_ifaliasreq on the stack.
Reported by: Andrew <xxx.sys at protonmail.com>
Reviewed by: pouria
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60184
(cherry picked from commit c109a681456d03fc0737ca83487995e28b759e3b)
igmp: Deindent some code
No functional change intended.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 123342f3d2cccf432d3d0082097b6c97397ecc67)
ssp: Make the panic string more accurate
"stack overflow detected" sounds like the thread faulted because it
ran out of stack space.
Reported by: Andrew <xxx.sys at protonmail.com>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 0f4b7d28ccb5c8edd0e4aad8135a4356f8a31961)
icmp: Limit routing table updates to the FIB of the redirect
When we receive an ICMP redirect, rib_add_redirect() is used to apply
the redirect to all FIBs. This has been the case since support for
multiple FIBs was added. However, it seems rather dubious: the new
gateway might not be routable from all FIBs, and the validation done for
v4 redirects in icmp_verify_redirect_gateway() is only applied to the
FIB from which the redirect originated.
Modify the handler to apply the redirect only in the originating FIB.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Reviewed by: pouria, zlei, glebius, melifaro
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59567
(cherry picked from commit 01a95394abfdef2adb3216e74d88b9c33321260e)
igmp: Refresh the ip header pointer after m_pullup()
There is a chance that the m_pullup() call immediately above invalidated
the "ip" pointer, so refresh it as we do with the IGMP header.
Otherwise the test in igmp_input_v3_query() for whether the packet is an
IGMPv3 general query might use a pointer to a freed mbuf.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit dc47a6940d60d393b3d36ba0fc5cb84d06fafaea)
imgact_aout: Remove a prototype for a non-existent function
aout_coredump() was removed in commit 1eecfae3e53cb3.
No functional change intended.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 4523cbbfef79eb63e287d9ebd88d9f3ebd885ba1)
jail: Simplify refcount manipulation routines
- refcount_acquire() returns the old value, use that to assert that the
old value was non-zero.
- refcount_release() already asserts that the refcount value is
non-zero, so don't bother asserting that again in the jail code.
- Use __diagused instead of having separate implementations for
INVARIANTS and !INVARIANTS.
No functional change intended.
Reviewed by: jamie
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59983
(cherry picked from commit de6ee1fde8bbcc3dde643ae9f2122c8e2499fe29)
kasan: Fix the annotation for shadow map checks in atomic_load_*
atomic_load_* is a read, not a write. Otherwise KASAN will report a
use-after-free via atomic_load_* as a write rather than a read.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 0aa055edc17267c6e971d29cabeffed0b1c59c32)
amdsmu: Update diagnostics comments for Krackan Point
Krackan Point has the same quirks as the Phoenix SMU it would seem.
Reported by: emaste
Sponsored by: The FreeBSD Foundation
libc: Add a man page caveat about the `w` modifier
In-tree Clang is unaware of the N2680 fixed-width modifier `w` and emits
a warning when used.
PR: 299631
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D60939
amdsmu: Print detailed stats for KRACKAN_POINT
Testing on a Dell AMD Ryzen AI 5 PRO 435 laptop shows that the same
diagnostic information is valid.
Reviewed by: obiwac
Sponsored by: The FreeBSD Foundation
locate.1: clarify bytes vs. characters
The database stores bytes, not characters. Remove the historical
note about 7-bit storage. Also document that -i ignores case only
for ASCII letters.
Reviewed by: ziaee
MFC after: 3 days
(cherry picked from commit a03b051f238eb78cfccbe834b0cc206e66d566e5)
find.1: rewrite the -s flag section for clarity
Restructure the description of -s flag:
1. what the option does
2. why it is useful (deterministic order, streaming output)
3. how its results can differ from `find | sort'
Reviewed by: ziaee
MFC after: 3 days
(cherry picked from commit ad0f86694157c998fec500e9a553550976cbc100)
find.1: fix rendering of find -s example
The period here is part of the literal string in the example. Adding a
space caused the example to be quoted wrongly. Instead, a trailing
zero-width space keeps the linter mandoc -T happy.
Reviewed by: ziaee
Differential Revision: https://reviews.freebsd.org/D59353
(cherry picked from commit 3581b6db62b1a2146014b3196f18bde3fc33010d)
