Fix a bug, when a specially crafted ICMPV6 MLD packet could lead
to an integer divide by zero panic in the kernel, if the kernel was
run with hz<1000.
Neither i386, pc98, amd64 or sparc64 are affected in the currently
supported branches and default configuration.
Submitted by: Miikka Saukko, Ossi Herrala and Jukka Taimisto from
the CROSS project at Codenomicon Ltd. via CERT-FI.
Reviewed by: bz, rwatson
Security: CVE-2008-2464
MFC after: 8 hours
das [Wed, 3 Sep 2008 07:23:57 +0000 (07:23 +0000)]
Merge gdtoa 20080831. This fixes several bugs, including an infinite
loop pointed out by cognet@ that occurs when calling strtod() with a
string representing a number between DBL_MAX and 2*DBL_MAX, when the
rounding mode is anything other than the default.
minor style(9) police: sort getopt options alphabetically. The
semi-logical segregation of 'b' and 'h' doesn't seem to make sense and
makes it harder to read.
kan [Wed, 3 Sep 2008 01:05:32 +0000 (01:05 +0000)]
Make sure internal rtld malloc routines are not called from unlocked
contexts as rtld's malloc is not thread safe and is only supposed to be
called with exclusive bind lock already held.
The originating PR submitted a patch on top of different pre-requisite
workaroud for unsafe dlopen calls, and the patch was midief slighlty to apply
to stock sources for the purpose of this commit. Running rtld malloc from
unlocked contexts is a bug on its own.
marius [Tue, 2 Sep 2008 21:13:54 +0000 (21:13 +0000)]
- USIII-based machines can consist of CPUs having different cache
sizes (and running at different frequencies) so move the cacheinfo
to the PCPU data. While at it, remove some redundant and/or unused
members from struct cacheinfo.
- In sparc64_init don't assume the first CPU node we find in the OFW
device tree is the BSP.
marius [Tue, 2 Sep 2008 21:06:28 +0000 (21:06 +0000)]
Bypass isa_probe_children(9) and directly call bus_generic_attach(9)
in order to avoid the invasive probes done by identify-routines of
ISA drivers, which may access unassigned addresses or those of
unrelated devices and thus in turn can trigger master/target aborts
as revealed by r182108 and ahc(4). I think that this is also the
cause of the hang previously seen on B100 blades during boot.
Bypassing isa_probe_children(9) also avoids adding ISA hints, which
just can be wrong for sparc64.
After the MPSAFE TTY import we support an additional rlimit, called
RLIMIT_NPTS. This limit allows you to cap the amount of pseudo-terminals
allocated by one user.
We forgot to add support for this limit to limits(1), which means it
crashed. Add the proper bits to make it work like it should.
Unfortunately not all shells actually implement the RLIMIT, so
unfortunately I suspect it to be broken with certain shells.
- When executing FreeBSD/amd64 binaries from FreeBSD/i386 or Linux/i386
processes, clear PCB_32BIT and PCB_GS32BIT bits [1].
- Reread the fs and gs bases from the msr unconditionally, not believing
the values in pcb_fsbase and pcb_gsbase, since usermode may reload
segment registers, invalidating the cache. [2].
Both problems resulted in the wrong fs base, causing wrong tls pointer
be dereferenced in the usermode.
Reported and tested by: Vyacheslav Bocharov <adeepv at gmail com> [1]
Reported by: Bernd Walter <ticsoat cicely7 cicely de>,
Artem Belevich <fbsdlist at src cx>[2]
Reviewed by: peter
MFC after: 3 days
Use size_t to store the return value of ttydisc_getc().
The ttydisc_getc() routine obtains a read length from ttyoutq_read().
For no valid reason, the current code stores this value in an int, and
returns a size_t. There is no need to perform this useless conversion.
Fix an ABI breakage found after the import that will be part of the
next version of sendmail. Putting it in now for the upcoming 7-BETA
and 6-BETA test releases.
The D_NEEDMINOR flag was introduced for drivers that do not actually
depend on storing a device unit/minor number, but require the ability to
address the cdevs by this number, which is used by clone_create().
The cpuctl(4) driver sets D_NEEDMINOR, even though it doesn't use the
clone_create() API. Remove the flag, because maybe we want to get rid of
it somewhere in the far future.
In rev. 1.17 (r33548) of msdosfs_fat.c, relative cluster numbers were
replaced by file relative sector numbers as the buffer block number when
zero-padding a file during extension. Revert the change, it causes wrong
blocks filled with zeroes on seeking beyond end of file.
PR: kern/47628
Submitted by: tegge
MFC after: 3 days
When setting error to EINVAL in 'fvp == tdvp' case, jump to out label,
because if not, the error will be later overwritten by
mac_vnode_check_rename_to() call.
Style: Use ARCHIVE_VERSION_NUMBER to conditionalize tests on
the particular libarchive version being tested instead of the
deprecated ARCHIVE_API_VERSION and ARCHIVE_VERSION_STAMP macros.
MfP4: set/unset tracking for atime, ctime, mtime, and size fields.
This generalizes the existing set/unset tracking for hardlink/symlink
fields and extends it to cover non-string fields. Eventually, this
will be further extended to cover most fields.
In particular, this is needed to correctly detect when time fields
are missing (for example, reading ustar archives doesn't set atime or
ctime) for proper time restore and is helpful when trying to determine
whether to overwrite data when restoring hardlinks.
obrien [Sun, 31 Aug 2008 23:38:28 +0000 (23:38 +0000)]
Turn cc_tools/Makefile and Makefile.tgt into a "linear" read. Shared
parts of the configuration aren't duplicated, and arch-specific exceptions
are made "in-place". Also clean up the FreeBSD/amd64 config a little.
gshapiro [Sun, 31 Aug 2008 18:21:15 +0000 (18:21 +0000)]
A no-op commit to simulate the effect of a forced commit so the file
has a new timestamp as needed for mergemaster. A more long term
solution to this is needed since svn doesn't support forced commits.
yar [Sun, 31 Aug 2008 14:27:59 +0000 (14:27 +0000)]
pkill(1) first appeared in /usr/bin, but later it was moved to /bin
for the convenience of rc.d. Now it has happily lived there for quite
a while. So move the pkill(1) source files from usr.bin to bin, too.
rwatson [Sun, 31 Aug 2008 13:16:45 +0000 (13:16 +0000)]
In UDPv6, reduce scope of global udbinfo lock during append to last
matching socket by dropping it before udp6_append(), and remove
duplicate unlocks of udbinfo and inpcb in sysctl return path.
ed [Sun, 31 Aug 2008 10:17:40 +0000 (10:17 +0000)]
Disable processing of output data after disabling scroll lock by force.
The syscons code disabled scroll lock inside sc_cnputs() if it's going
to print a system message. The code currently wants to process any TTY
output data as well, but we cannot do this, because the TTY lock is a
sleep mutex, while cnputs() picks up a spin mutex.
Disable the code for now. It solves a panic when a console message is
printed while scroll lock is enabled. One solution would be to
initialize a task structure here.
kientzle [Sun, 31 Aug 2008 07:06:02 +0000 (07:06 +0000)]
Make libarchive_test a little smarter about trying to find
its reference files when you don't specify -r. It now checks
a couple of likely nearby directories to see if any of them
have a particular known file.
imp [Sun, 31 Aug 2008 03:22:19 +0000 (03:22 +0000)]
All the other routines returned EIO from the param routine. Return it
from umodem and ufoma.
With these changes, umodem kinda works for me now. It certainly gets
past the "tip" bug that I found earlier where 115200 wasn't a valid
baud rate. This was "broken" in the mpsafetty commit, but in reality,
umodem was always broken.
csjp [Sat, 30 Aug 2008 20:58:34 +0000 (20:58 +0000)]
Improve the entropy of the source port randomization for network address
translation. It turns out this is useful for applications which require
source port randomization for security (i.e. dns servers).
marius [Sat, 30 Aug 2008 16:03:22 +0000 (16:03 +0000)]
- Read ASI_{D,I}TLB_DATA_ACCESS_REG twice in order to work around
errata of USIII and beyond (USIII erratum #19, USIII+ erratum #1,
USIIIi erratum #1).
- Use the cheetah PA mask in {d,i}tlb_va_to_pa_sun4u() for USIII
and beyond. This is done so that these functions will still mask
the debug bits of spitfire-class CPUs once we increase TD_PA_BITS
to match the number of bits used for the PA by cheetah-class CPUs.
- Change {d,i}tlb_enter_sun4u() to also set TLB_CTX_KERNEL as the
context of the mappings entered. This is more or less cosmetic as
TLB_CTX_KERNEL is 0.
- Now that we have to distinguish between different sun4u CPUs in
the loader anyway, no longer do trial and error when reading the
portid property.
stas [Sat, 30 Aug 2008 15:16:40 +0000 (15:16 +0000)]
- Try to look for MAC address in all SA registers, not only in the
first one. U-boot, for example, uses the second register to store
MAC.[1]
- Use random MAC address if none configured instead of failing.
attilio [Sat, 30 Aug 2008 13:20:35 +0000 (13:20 +0000)]
- Improve some witness_watch operability in code which does perform both
lock tracking and checks, doing just the former ones.
- Fix a bug where sysctl utility was printing crazy values when setting a
new value for debug.witness.watch [0]