Unlock KERN_HOSTNAME and KERN_DOMAINNAME sysctl paths.
Use the new hostname_mtx mutex to protect data. Use the temporary buffer
for exchange with userland. We have some areas outside sysctl layer
where we do read-only kernel-locked access to the hostname and the
domainname, so keep modification under two locks. The mutex could be
pushed in such areas later.
We also do hostname and domainname modification during kernel bootstrap
on diskless stations, but this happens at early startup before rootfs
mount.
ok deraadt
fill socket length
socket length needs to be set when building the various sockaddr
structures, otherwise m_add_sockaddr() is going to serialize exactly
zero bytes.
spotted by acts, thank you!
Fix .note.gnu.property values in ld -b binary invocations
ld.lld -b binary generated bogus .note.gnu.property values because in
such invocations there are no ELF object files to AND the -1 initial
value with. Use 0 as a starting value in that case.
Upstream PR: https://github.com/llvm/llvm-project/pull/238541
ok robert@ kettenis@
SEV-SNP: Register GHCB and handle #VC for unvalidated pages
More preparations for SEV-SNP: With SNP enabled, the GHCB page needs
to be registered with the hypervisor through the GHCB MSR protocol.
When we are an SNP enabled guest and touch a page that has not been
validated by us, the CPU delivers a #VC with error code
SVM_VMEXIT_PAGE_NOT_VALIDATED. In that case we panic.
vctrap() now takes the faulting address as an additional argument,
so vctrap_early() has to pass %cr2 in %r8. While there, also zero
the arguments sig and code: vctrap_early() is always in kernel mode,
so user is zero and they are never used.
ok mlarkin
pf(4): depleted source port pool for NAT starves other packets
The function pf_get_sport() in current selects the source port
number for network address translation (a.k.a. NAT). It basically
chooses a random source port and uses pf_find_state_all()
to check if the chosen port number is already in use for a particular NAT
address. If the port is already in use, pf_get_sport() selects
another port number and retries. This process continues as long
as the chosen port number collides with an existing address:port tuple.
The problem is that all this happens under the protection of
PF_LOCK(). This effectively stops pf(4) rule evaluation
for other packets that enter the firewall and have no state.
The fix introduces a limit on retries. The limit is set to 128.
If no free port number is found within 128 attempts, the function
gives up. The packet is dropped and PF_LOCK() is released so other
packets waiting for a rule check can be inspected by pf_test().
The issue was kindly reported and the fix submitted by Acts-1631.
[2 lines not shown]
raise the gem object size limit from 512M to 1.5G
volker@ reports that llama.cpp wants slightly more than 1G sized objects
when running on inteldrm (Raptor Lake).
libssl: stop inspecting cert signatures for seclevel
As pointed out by dadrian to OpenSSL in #31195, it makes no sense
to inspect our certificate's signatures. Our stack may not even
know the algorithms our CA used (think some PQ CA, for example).
What matters to us is that we don't use a key that is too weak,
so keep the check for that.
We do not currently inspect the peer's cert for strength either.
That may be an omission/bug.
On side effect of this removal is that we do no longer ensure that
a RSA-PSS cert has a salt length matching the hash length. That's
not really part of security, and if we care to restore this for
reasons of compliance, we should think about where to put it in
a way that throws a better error than 'ca md too weak'
Prompted by a report by semarie.
[2 lines not shown]
libssl: stop inspecting our cert chain for "security"
The chain signing our leaf cert is not crypto we ourselves use. The peer
can decide that the weak crypto is unacceptable if they care.
ok beck
Add tag tests
- test that a tag stays on a persistent connection
- test that a tag set at the start of each request resets the tag of a
persistent connection.
drm/amdgpu/powerplay: Align get_tonga_state_array() header with prototype
From Srinivasan Shanmugam
34bdda87c1890b18f0dc40211ec755e392168c6c in linux-6.18.y/6.18.61
4986757d3207383c052689532e505edccc6df7c8 in mainline linux
drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set
From Timur Kristof
b97686f158517c81b3936ac28b987cbdaf0b7f8e in linux-6.18.y/6.18.61
800ea86e83e137395eba54103e5c459c2bc9965f in mainline linux
drm/amd/display: guard dc_sink dereferences in MST mode validation
From Hari Mishal
5684a6c24c0d7c40ef2c4ccb3e4a64cffe76a791 in linux-6.18.y/6.18.61
217f64f348c90cba62164e7ff38e0ccf78a5ca09 in mainline linux
drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub()
From Alex Deucher
81a1c7eba334786aed6806a29699bd284fc12029 in linux-6.18.y/6.18.61
0bfb1bfc82e8fa386d4fad1caa5812b6afafa626 in mainline linux
drm/amdgpu: remove gart_window_lock usage from gmc v12
From Pierre-Eric Pelloux-Prayer
84cc155bf4cd4ab518bb91b517c1b760b0de6c04 in linux-6.18.y/6.18.61
c79cf5a7d903a16459846b4296fc3cd988837c54 in mainline linux
drm/amd/display: Fix fast updates on DCE 6.x
From Timur Kristof
bdb5784531b2148f00a5ff5df0fc61bceebf4525 in linux-6.18.y/6.18.61
88427119e1f039c8cdffd63726c136a986ef519f in mainline linux
drm/amdkfd: Avoid integer underflow in EOP ring size calculation.
From David Francis
3c97f7cb6c48826663648b6081b614c2befc8ac7 in linux-6.18.y/6.18.61
8ee521b8b189799e361d4233c5180ba56656d4d4 in mainline linux
