BSD Commit Log Search

   Fix a potential 1-byte buffer overflow in usbd_get_string_desc().  The code
   allows for a transfer of up to 255 bytes but the struct behind the
   usb_string_descriptor_t type is only 254 bytes.  This is because USB
   strings are UTF-16 and that leaves a single byte that can't be used in
   a meaningful way.  So truncating transfer to 254 bytes should not break
   devices that are already broken.  Found by Andrew Griffiths.

   ok jsg@, deraadt@

   Switch menus also to be attached to the window instead of an overlay and
   drawn as part of the client's scene. This means removing the popup menu.

   Convert display-panes away from an overlay and into a mode. This is
   another step on the road of getting rid of overlays altogether (they are
   full of special cases; popups and menus are to go also eventually). We
   lose some of the styling of borders but gain the ability to run
   display-panes in another pane (perhaps not hugely useful but one never
   knows). The -b flag goes away as no longer useful.

   Use SHA1Final() in libskey.

   S/KEY requires hash output in little endian form, while SHA-1 produces big
   endian output. Rather than using SHA1Pad() and then reaching into the SHA-1
   state directly, use SHA1Final() and then convert to little endian using
   be32toh/htole32.

   ok claudio@ millert@ tb@

   merge NSD 4.15.0

   import NSD 4.15.0, ok florian

   Improve name constraints URI host regress.

   Fix X.509 constraints URI host parsing.

   An authority in a URI is only terminated by a slash, question mark or hash,
   however the current code also included colons. This allows a specically
   crafted userinfo to bypass name constraints host checks. Additionally, IPv6
   literals may only be specified when enclosed with square brackets, which is
   not enforced.

   Rewrite parts of the host and IP parsing code to be more strict, fixing
   both of these issues in the process.

   Thanks to Jack Lloyd for reporting the userinfo bypass.

   ok tb@

   Typos and doc fixes, from Ben Boeckel.

   oops, no the bit is available

   0x08000000 is P_SUSPSIG, so also defining PS_avail0 to the same position
   is misleading

   Handle allocation failure and track correct mbuf length in IPComp.
   In swcr_compdec() m_copyback(M_NOWAIT) may fail, but the error is
   not checked.  The mbuf chain could be too short, but the expected
   length is returned as result.  Then ipcomp_input() will not set
   m->m_pkthdr.len to the actual length of the mbuf chain.  This only
   affects decompression, other cases do not need additional memory
   for enlarging.
   from bluhm@; OK deraadt@

   IPComp decompression must not overflow mbuf cluster.
   Check after decompressing an IPComp packet, that the content fits
   into a mbuf cluster.  m_copyback() assumes that it can allocate a
   single mbuf cluster to enlarge the mbuf chain.  That means the
   decompressed data must not exceed MAXMCLBYTES.  Prevent panic:
   m_clget: request for 67948 byte cluster.
   from bluhm@; reported by Homura Akemi, SecBuddyF, Tencent KeenLab; OK mvs@

   IPsec AH must contain replay counter.
   Before reading the replay counter from packet header in ah_input(),

    [10 lines not shown]

   Handle allocation failure and track correct mbuf length in IPComp.
   In swcr_compdec() m_copyback(M_NOWAIT) may fail, but the error is
   not checked.  The mbuf chain could be too short, but the expected
   length is returned as result.  Then ipcomp_input() will not set
   m->m_pkthdr.len to the actual length of the mbuf chain.  This only
   affects decompression, other cases do not need additional memory
   for enlarging.
   from bluhm@; OK deraadt@

   IPComp decompression must not overflow mbuf cluster.
   Check after decompressing an IPComp packet, that the content fits
   into a mbuf cluster.  m_copyback() assumes that it can allocate a
   single mbuf cluster to enlarge the mbuf chain.  That means the
   decompressed data must not exceed MAXMCLBYTES.  Prevent panic:
   m_clget: request for 67948 byte cluster.
   from bluhm@; reported by Homura Akemi, SecBuddyF, Tencent KeenLab; OK mvs@

   IPsec AH must contain replay counter.
   Before reading the replay counter from packet header in ah_input(),

    [10 lines not shown]

   run qwx_init() code under splnet()

   Run monitor exabgp session on new IP 10.12.57.5.

   10.12.57.2 is used in test1 and since exabgp retries immediatly the
   idleHoldTime of that peer goes up quickly and blocks further connects.
   Before this worked since bgpd sent the notification and the error count
   was not increased and with this immediate retries were possible.

   stop MHI channels and clear MHI event rings when the qwx interface goes down

   reset qwx mhi transfer ring "queued" counter to zero when restarting the ring

   do not zero the entire qwx sc->hal structure during resume

   The structure contains pointers to DMA allocations which are leaked and
   replaced by new allocations during resume if we zero the entire structure.
   At attach time, the structure comes pre-zeroed so an initial memset is
   not needed either.

   cleanup when nfsm_srvmtofh1() errors in nfsrv_rename()
   corrects vnode references and namei_pool leak
   reported by Andrew Griffiths of Calif
   from jsg@; initial diff from deraadt@ ok miod@

   remove use of struct nfsm_info in nfs_serv.c (the non-trivial part)
   from jsg@; with and ok miod@

   remove use of struct nfsm_info in nfs_serv.c
   from jsg@; with and ok miod@

   convert nfs_serv.c from nfsm_mtouio() to nfsd_mtouio()
   from jsg@; with and ok miod@

   convert nfs_serv.c from nfsm_strsiz() to nfsd_strsiz()
   from jsg@; with and ok miod@

   convert nfs_serv.c from nfsm_dissect() to nfsd_dissect()
   from jsg@; with and ok miod@

    [106 lines not shown]

   do not attempt to clean up qwx Tx rings which are uninitialized

   cleanup when nfsm_srvmtofh1() errors in nfsrv_rename()
   corrects vnode references and namei_pool leak
   reported by Andrew Griffiths of Calif
   from jsg@; initial diff from deraadt@ ok miod@

   remove use of struct nfsm_info in nfs_serv.c (the non-trivial part)
   from jsg@; with and ok miod@

   remove use of struct nfsm_info in nfs_serv.c
   from jsg@; with and ok miod@

   convert nfs_serv.c from nfsm_mtouio() to nfsd_mtouio()
   from jsg@; with and ok miod@

   convert nfs_serv.c from nfsm_strsiz() to nfsd_strsiz()
   from jsg@; with and ok miod@

   convert nfs_serv.c from nfsm_dissect() to nfsd_dissect()
   from jsg@; with and ok miod@

    [106 lines not shown]

   properly reset driver and device state if we fail to get RUNNING in qwx_init()

   remove pointless down/up dance in qwx_media_change()

   Already handled by qwx_ioctl() when ieee80211_ioctl() returns ENETRESET.

   ensure that qrtr_server state does not race with qwx device during power-on

   use the ioctl rwlock correctly in qwx_activate()

   ensure that rx_ring->bufs_max and freemap are always initialized correctly

   the qwx init task should not wait for the ioctl lock to become available

   Do not zeroize already zeroed buffer in sysctl_sysvipc(). The
   KERN_SYSVIPC_SEM_INFO case was a part of the big semaphores diff,
   KERN_SYSVIPC_SHM_INFO case to the next one.
   from mvs@; ok deraadt

   Replace semid_ds with semid_ds_kern for in-kernel sysv semaphore
   implementation.
   Note, the buffer used for userland dlivery in sysctl_sysvipc() was
   filled with zeros during allocation, we don't need extra zeroing.
   from mvs@; ok deraadt millert

   Make concurrent sys_msgrcv() wait until we finish message delivery. We
   left acquired message in the queue while we are sleeping in msg_copyout().
   Concurrent sys_msgrcv() could acquire and delete this message.
   Reported-by: syzbot+c80235d951da9769a00f at syzkaller.appspotmail.com
   from mvs@

   Restore msgrcv(2) MSG_NOERROR/E2BIG error path. Silently truncate
   message is not a good idea.

    [74 lines not shown]

   Do not zeroize already zeroed buffer in sysctl_sysvipc(). The
   KERN_SYSVIPC_SEM_INFO case was a part of the big semaphores diff,
   KERN_SYSVIPC_SHM_INFO case to the next one.
   from mvs@; ok deraadt

   Replace semid_ds with semid_ds_kern for in-kernel sysv semaphore
   implementation.
   Note, the buffer used for userland dlivery in sysctl_sysvipc() was
   filled with zeros during allocation, we don't need extra zeroing.
   from mvs@; ok deraadt millert

   Make concurrent sys_msgrcv() wait until we finish message delivery. We
   left acquired message in the queue while we are sleeping in msg_copyout().
   Concurrent sys_msgrcv() could acquire and delete this message.
   Reported-by: syzbot+c80235d951da9769a00f at syzkaller.appspotmail.com
   from mvs@

   Restore msgrcv(2) MSG_NOERROR/E2BIG error path. Silently truncate
   message is not a good idea.

    [74 lines not shown]

   do not silently ignore errors which occur in qwx_qmi_fw_init_done()