mlx4core: Use-after-free causes a resource leak in flow-steering detach
mlx4_QP_FLOW_STEERING_DETACH_wrapper first removes the steering
rule (which results in freeing the rule structure), and then
references a field in this struct (the qp number) when releasing the
busy-status on the rule's qp.
Since this memory was freed, it could reallocated and changed.
Therefore, the qp number in the struct may be incorrect,
so that we are releasing the incorrect qp. This leaves the rule's qp
in the busy state (and could possibly release an incorrect qp as well).
Fix this by saving the qp number in a local variable, for use after
removing the steering rule.
Dimitry Andric [Mon, 13 Jun 2022 18:55:23 +0000 (20:55 +0200)]
Also define THR_PAGE_SIZE_MIN for mips
Commit 6173c7833be4, which cherry-picked commit c7904405a8d4 ("Remove
PAGE_SIZE from libthr") to stable/13 resulted in build errors on mips:
/usr/src/lib/libthr/thread/thr_barrier.c:40:50: error: use of undeclared identifier 'THR_PAGE_SIZE_MIN'
_Static_assert(sizeof(struct pthread_barrier) <= THR_PAGE_SIZE_MIN,
^
This is because c7904405a8d4 defined THR_PAGE_SIZE_MIN for all supported
architectures in main/14-CURRENT, but that list no longer includes mips.
Add a similar define for mips, so libthr can build successfully again.
Direct commit to stable/13, since main no longer has mips.
Doug Rabson [Mon, 30 May 2022 13:22:08 +0000 (14:22 +0100)]
pkgbase: Move pw to the runtime package
This allows building a container image with enough functionality for
downloading and installing packages without having to include the
utilities package.
Rick Macklem [Sat, 28 May 2022 22:48:40 +0000 (15:48 -0700)]
mount_nfs: Only create a mounttab file entry is nmount(2) succeeds
mount_nfs creates entries in the mounttab file and umount removes
them. Entries in the mounttab file ae used by rpc.umntall to
notify the NFS server that NFSv3 entries need to be removed when
they have not been removed by umount.
Without this patch, an enty will be created in the mounttab file,
even if the nmount(2) syscall fails for the mount. This patch
modifies the code so that the mounttab entry is only created
after nmount(2) succeeds.
This change only affects NFSv3 and only affects how showmount
displays NFSv3 mounts.
Rick Macklem [Fri, 27 May 2022 21:32:46 +0000 (14:32 -0700)]
nfscl: Add a diagnostic printf() for a "should never happen" case
When a NFSv4.1/4.2 session to the NFS server (not a pNFS DS) is
replaced, the old session should always be marked defunct by
nfsess_defunct being set non-zero.
However, the hang reported by the PR suggests that this might
be the case.
This patch adds a printf() to indicate this has somehow happened.
Rick Macklem [Fri, 27 May 2022 21:20:31 +0000 (14:20 -0700)]
nfscl: Do not handle NFSERR_BADSESSION in operation code
The NFSERR_BADSESSION reply from a NFSv4.1/4.2 server
is handled by newnfs_request(). It should not be handled
separately after newnfs_request() has returned.
These two cases were spotted during code inspection.
One of them should only redo what newnfs_request() already
did by the same "nfscl" thread. The other might have
resulted in recovery being done twice, but the code is
only used for "pnfs" mounts, so that would be rare.
Also, since NFSERR_BADSESSION should only be replied by
a server after the server reboots, this would be extremely
rare.
Rick Macklem [Sat, 30 Apr 2022 20:49:23 +0000 (13:49 -0700)]
nfscl: Add support for a NFSv4 AppendWrite RPC
For IO_APPEND VOP_WRITE()s, the code first does a
Getattr RPC to acquire the file's size, before it
can do the Write RPC.
Although NFS does not have an append write operation,
an NFSv4 compound can use a Verify operation to check
that the client's notion of the file's size is
correct, followed by the Write operation.
This patch modifies the NFSv4 client to use an Appendwrite
RPC, which does a Verify to check the file's size before
doing the Write. This avoids the need for a Getattr RPC
to preceed this RPC and reduces the RPC count by half for
IO_APPEND writes, so long as the client knows the file's
size.
The nfsd structure was moved from the stack to be malloc()'d,
since the kernel stack limit was being exceeded.
While here, fix the types of a few variables, although
there should not be any semantics change caused by these
type changes.
Rick Macklem [Fri, 8 Apr 2022 20:59:05 +0000 (13:59 -0700)]
nfscl: Add support for a NFSv4 AppendWrite RPC
For IO_APPEND VOP_WRITE()s, the code first does a
Getattr RPC to acquire the file's size, before it
can do the Write RPC.
Although NFS does not have an append write operation,
an NFSv4 compound can use a Verify operation to check
that the client's notion of the file's size is
correct, followed by the Write operation.
This patch modifies nfscl_wcc_data() to optionally
acquire the file's size, for use with an AppendWrite.
Although the "stuff" arguments are always NULL
(these were used for the Mac OSX port and should be
cleared out someday), make the argument to
nfscl_wcc_data() explicitly NULL for clarity.
This patch does not cause any semantics change until
the AppendWrite is added in a future commit.
Rick Macklem [Tue, 5 Apr 2022 15:11:37 +0000 (08:11 -0700)]
nfscl: Add support for a NFSv4 AppendWrite RPC
For IO_APPEND VOP_WRITE()s, the code first does a
Getattr RPC to acquire the file's size, before it
can do the Write RPC.
Although NFS does not have an append write operation,
an NFSv4 compound can use a Verify operation to check
that the client's notion of the file's size is
correct before doing the Write operation.
This patch prepares the NFSv4 client for such an
RPC, which will be added in a future commit.
Rick Macklem [Thu, 6 Jan 2022 22:18:36 +0000 (14:18 -0800)]
nfscl: Always invalidate buffers for append writes
kib@ reported a problem which was resolved by
reverting commit 867c27c23a5c, which changed the NFS
client to use direct RPCs to the server for
IO_APPEND writes. He also spotted that the
code only invalidated buffer cache buffers
when they were marked NMODIFIED (had been
written into).
This patch modifies the NFS VOP_WRITE() to
always invalidate the buffer cache buffers
and pages for the file when IO_APPEND is
specified. It also includes some cleanup
suggested by kib@.
Commit 867c27c23a5c enabled the n_directio_opens code
in open/close, which sets/clears NNONCACHE, for
IO_APPEND. This code should not be enabled unless
newnfs_directio_enable is non-zero.
This patch reverts that part of commit 867c27c23a5c.
A future patch that fixes the case where the
file that is being written IO_APPEND is mmap()'d.
Rick Macklem [Wed, 15 Dec 2021 16:35:48 +0000 (08:35 -0800)]
nfscl: Change IO_APPEND writes to direct I/O
IO_APPEND writes have always been very slow over NFS, due to
the need to acquire an up to date file size after flushing
all writes to the NFS server.
This patch switches the IO_APPEND writes to use direct I/O,
bypassing the buffer cache. As such, flushing of writes
normally only occurs when the open(..O_APPEND..) is done.
It does imply that all writes must be done synchronously
and must be committed to stable storage on the file server
(NFSWRITE_FILESYNC).
For a simple test program that does 10,000 IO_APPEND writes
in a loop, performance improved significantly with this patch.
For a UFS exported file system, the test ran 12x faster.
This drops to 3x faster when the open(2)/close(2) are done
for each loop iteration.
For a ZFS exported file system, the test ran 40% faster.
The much smaller improvement may have been because the ZFS
file system I tested against does not have a ZIL log and
does have "sync" enabled.
Note that IO_APPEND write performance is still much slower
than when done on local file systems.
Although this is a simple patch, it does result in a
significant semantics change, so I have given it a
large MFC time.
Bjoern A. Zeeb [Sun, 5 Jun 2022 18:07:48 +0000 (18:07 +0000)]
rtw88: plug various skb leaks in error cases
Based on manual inspection the skbs are not freed in those unlikely
cases, though all would give an error message so would have gone noticed
if happened.
While here fix a typo in one of these error messages.
Bjoern A. Zeeb [Sun, 5 Jun 2022 21:10:01 +0000 (21:10 +0000)]
LinuxKPI: 802.11: plug a ni leak in lkpi_sta_assoc_to_run()
In lkpi_sta_assoc_to_run() we are going through some code segments
twice (auth->assoc, assoc->authorized). The 2nd time we shall not
re-gain a reference on the net80211 node as otherwise it'll leak.
Likewise we do not have to re-set lsta and sta.
Bjoern A. Zeeb [Sun, 5 Jun 2022 18:04:57 +0000 (18:04 +0000)]
LinuxKPI: 802.11 plug mbuf leak in error cases
Manually free the mbuf in certain error cases from net80211 to not
leak it.
Note that the differences between ieee80211_input_mimo() and
ieee80211_input_mimo_all(), the former not consuming the mbuf while
the later does, is confusing.
Bjoern A. Zeeb [Sat, 4 Jun 2022 16:18:58 +0000 (16:18 +0000)]
iwlwifi: disable more MEI (Management Engine) code
It is unclear why this hasn't bothered anyone in months; I can only assume
optimization levels but it seems there were unresolved symbols in
iwlwifi after d9836fb4b9380e2ed1c38455fb31a3832b452671:
link_elf_obj: symbol iwl_mvm_send_roaming_forbidden_event undefined
Hide more of the currently unsupported (GPL-only) MEI (Management Engine)
code behind #ifdef to avoid this.
Reported by: dchagin
Tested by: dchagin
Sponsored by: The FreeBSD Foundation
Bjoern A. Zeeb [Wed, 18 May 2022 16:05:49 +0000 (16:05 +0000)]
iwlwifi: add sysctl to dump PCI IDs/ names / firmware-prefixes
Add a FreeBSD-specifc SYSCTL_PROC to dump the list of
PCI IDs / name / firmware-prefix which can be post-processed
for man pages (iwlwifi.4 and iwlwififw.4) or the wiki.
The output still yields duplicates depending on by what information
you need so one may wants to filter them out (try not to use sort/uniq).
Mark Johnston [Wed, 25 May 2022 00:17:04 +0000 (20:17 -0400)]
kqueue tests: Simplify the test runner
Just invoke the test program directly instead of trying to convert its
output to TAP format. The test suite is all or nothing; there's no way
to enumerate individual test cases, so there's no advantage in trying to
massage its output, and doing so throws away information that's useful
when diagnosing test failures.
Mark Johnston [Wed, 25 May 2022 00:16:32 +0000 (20:16 -0400)]
kqueue tests: Add new EVFILT_TIMER regression tests from upstream
One of the tests exposes the regression reported in PR 264131.
One test is disabled because FreeBSD does not support setting EV_ONESHOT
on an already-added periodic timer. Though, in this case the flag is
simply ignored, which isn't ideal.
One test is slightly modified to set EV_ADD when reconfiguring a
disabled timer per some commentary in PR 258412.
Ideally we would re-import the test suite from libkqueue but there is a
fair bit of divergence so this will require some effort. This just gets
us one small step closer while increasing test coverage.
Mark Johnston [Wed, 25 May 2022 00:14:33 +0000 (20:14 -0400)]
kevent: Fix an off-by-one in filt_timerexpire_l()
Suppose a periodic kevent timer fires close to its deadline, so that
now - kc->next is small. Then delta ends up being 1, and the next timer
deadline is set to (delta + 1) * kc->to, where kc->to is the timer
period. This means that the timer fires at half of the requested rate,
and the value returned in kn_data is similarly inaccurate.
PR: 264131
Fixes: 7cb40543e964 ("filt_timerexpire: do not iterate over the interval")
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Mark Johnston [Wed, 25 May 2022 00:14:10 +0000 (20:14 -0400)]
kqueue tests: Re-enable kqueue proc tests
- Some EVFILT_PROC bugs were fixed around the time that the tests were
disabled.
- I can't reproduce any failures locally.
- Jenkins logs referenced from the PR are gone, so let's re-enable the
tests and see whether a problem persists.
Andrew Turner [Sat, 21 May 2022 10:45:41 +0000 (11:45 +0100)]
Set mm before passing it to the UEFI firmware
When reading the UEFI memory map we pass in a pointer to the memory to
hold the map. Unfortunately it wasn't initialised before the first use
so clang decided it was undefined behaviour so the entire loop was
removed. This leads to everything in bi_load after this to also be
removed as dead code.
The next function after bi_load in the binary is efi_copy_init. The
above caused us to enter efi_copy_init with a return address of the
start of the function. Because of this it would enter an infinite
loop of calling the function, allocating memory, then returning to
the start of the function.
Andrew Turner [Mon, 9 May 2022 14:28:56 +0000 (15:28 +0100)]
Handle cas failure when the compare succeeds
When locking a priority inherit mutex we perform a compare and swap
operation to try and acquire the mutex. This may fail even when the
compare succeeds.
Check and handle this case.
PR: 263825
Reviewed by: kib, markj
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D35150
Andrew Turner [Thu, 7 Apr 2022 16:24:46 +0000 (17:24 +0100)]
Remove PAGE_SIZE from libthr
In libthr we use PAGE_SIZE when allocating memory with mmap and to check
various structs will fit into a single page so we can use this allocator
for them.
Ask the kernel for the page size on init for use by the page allcator
and add a new machine dependent macro to hold the smallest page size
the architecture supports to check the structure is small enough.
This allows us to use the same libthr on arm64 with either 4k or 16k
pages.
Reviewed by: kib, markj, imp
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D34984
Andrew Turner [Tue, 15 Mar 2022 17:05:48 +0000 (17:05 +0000)]
Move the arm64 DMAP creation to C
To simplify the creation of the direct map (DMAP) region on arm64 move
it from the pre-C code into pmap. This simplifies the DMAP creation
as we can use the notmal index macros, and should reduce the number
of pages needed to hold the level 1 tables to just those needed.
Reviewed by: alc, dch
Tested by: dch, kevans
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D34568
ibcore: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
The algorithm pre-allocates a cm_id since allocation cannot be done while
holding the cm.lock spinlock, however it doesn't free it on one error
path, leading to a memory leak.
mlx4core: Fix a memory leak when deleting slave's resources
mlx4_delete_all_resources_for_slave() in the resource tracker should free
all memory allocated for a slave. While releasing memory of fs_rule,
it misses releasing memory of fs_rule->mirr_mbox.
In function mlx4_opreq_action(), pointer "mailbox" is not released,
when mlx4_cmd_box() return and error, causing a memory leak bug.
Fix this issue by going to "out" label, mlx4_free_cmd_mailbox() can
free this pointer.
projects / FreeBSD / FreeBSD.git / log