sys: protect special device locks during vnode teardown
Special device advisory locking can race with vnode teardown and access
freed specinfo.
OpenAI reported the problem and supplied an initial patch; that patch
introduced a NULL dereference window by clearing v_specinfo while
leaving the vnode typed VCHR or VBLK across a sleep; it also left
teardown exposed to vnode recycling during the drain.
In other words the initial patch addressed one race, introduced another,
and left the vnode lifetime problem unfixed.
Here the reworked approach with large colaboration with claudio@ with
talks and inputs from deraadt@ and beck@.
Resolve and detach specinfo under lockf_lock, interrupt all pending
requests, and retain its storage until the drain completes. Keep VXLOCK
and the temporary vnode reference through teardown; set VBAD before
[3 lines not shown]
rpki-client: reimplement and fix cert inheritance checks
The current implementations of x509_inherits() and x509_any_inherits()
are a bit dumb because they re-parse the RFC 3779 extensions to figure
out if all (or any of) the resources inherit. That's quite expensive.
We have all this information already in struct cert, so let's use that.
In cert.c we have the strangely named cert_as_inherit() which requires
the presence of AS resources and checks that the ASIdentifiers are
marked inherit. (It should probably be called cert_ases_inherit())
A similar approach works for IPAddrBlocks. The main observation is that
inheritance applies to the entire address family. Since the IPAddrBlocks
are sorted by AF, of which there are two, we know that an inherit element
comes at the start or the end of the cert->ips[] array. This leads to
cheap and easy cert_all_ips_inherit() and cert_any_ip_inherits()
implementations.
[34 lines not shown]
rpki-client: add a check that IPv6 can't precede IPv4
RFC 3779 is unambiguous: "When both IPv4 and IPv6 addresses are specified,
the IPv4 addresses MUST precede the IPv6 addresses [...]", so add a check
that this is the case.
ok claudio
audio: Check the AUDIO_MIXER_* ioctl's index for negative values
While most drivers check their input (ex. azalia, uaudio, cmpci, envy
do), a driver like utvfu(4) may allow the AUDIO_MIXER_WRITE ioctl to
trigger an out-of-bounds heap write. This fix ensures that any
present or future low-level audio driver gets an index in its
supported range.
Report and proposed fix by Franz Bettag <franz at bett.ag>. Thanks!
shuffle nvgre packet processing to simplify nvgre ioctls.
nvgre_start could be called both with and without NET_LOCK, so it
had to try and coordinate with nvgre_up and _down without relying
on NET_LOCK, but then it also had to defer sending encapsulated
packets to a task so it could control the scope of NET_LOCK before
calling ip_output and ip6_output.
tom smyth reported issues with the nvgre_down coordination, which
led to restructuring this code.
nvgre now forces all transmit calls to be run from their own task
in the softnet threads, which in turn allows it to take NET_LOCK
itself and rely on it to coordinate access to the gre tunnel
configuration parameters. this simplifies nvgre_down, and also
allows us to remove the extra send task, because the NET_LOCK scope
is already known and controlled. packet reception is done as part
of the ip stack processing, so it already has NET_LOCK arounds its
use of the tunnel config.
[7 lines not shown]
Fix `findpr' dereference after context switch in sysctl_proc_vmmap().
Do the sleeping malloc() before process search. Take the reference on
found process descriptor to make concurrent exit1() wait us during the
sleep within fill_vmmap().
I moved the `oldlen' checks and `start' copyin() before process search
to make the error path shorter. This reorders the error path, but they
are just the passed parameters checks which are not related to
found process.
ok kirill
sys/swap: match swap block devices by device number
Prevent duplicate activation through aliases and retain the registered
vnode through the swapoff close.
Reported by miod@ and Yamasaki Yuu
Ok: claudio@
sys/ufshci: match against qcom,ufshc
Linux had drop jedec,ufs-2.0 compatibility in DTS for x1e80100 to use
only qcom,ufshc; adjust the code to make upgrade of DTB works.
OK: phessler@
Cleanup entity passing and remove the path string from it
There is no reason to split the uri into file and path anymore.
This is only used in one place for mfts and so it is better to
simplify all other code and adjust the generation of mft->path.
Also the parser can use a mft_filepath function to generate the
FS path to access files referenced by the mft.
OK tb@
Sort union by size since ISO C is a mine filed.
The initalizers introduced in C99 may only initialize the first
element of a union. If that one is not the largest member
then you may end up with uninitalized memory. In the end the
outcome depends on the compiler used which is just bananas.
OK tb@
