emaste [Wed, 9 Jan 2019 18:42:40 +0000 (18:42 +0000)]
MFS12 r342378: Fix a regression in the TCP handling of received segments.
When receiving TCP segments the stack protects itself by limiting
the resources allocated for a TCP connections. This patch adds
an exception to these limitations for the TCP segement which is the next
expected in-sequence segment. Without this patch, TCP connections
may stall and finally fail in some cases of packet loss.
emaste [Wed, 19 Dec 2018 18:21:07 +0000 (18:21 +0000)]
MFS12 r342228: bootpd: validate hardware type
Due to insufficient validation of network-provided data it may have been
possible for a malicious actor to craft a bootp packet which could cause
a stack buffer overflow.
admbugs: 850
Reported by: Reno Robert
Reviewed by: markj
Approved by: so
Security: FreeBSD-SA-18:15.bootpd
Sponsored by: The FreeBSD Foundation
gjb [Fri, 7 Dec 2018 00:00:12 +0000 (00:00 +0000)]
- Switch releng/12.0 from RC3 to RELEASE.
- Add the anticipated 12.0-RELEASE date to UPDATING.
- Set a static __FreeBSD_version.
- This one goes to 12.
Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation
marius [Thu, 29 Nov 2018 22:00:20 +0000 (22:00 +0000)]
MFV: r341039, MFC: r341041, MF12: r341264
Import CK as of 21d3e319407d19dece16ee317c757ffc54a452bc, which makes its
sparcv9 atomics compatible with the FreeBSD kernel by using instructions
which access the appropriate address space.
Atomic operations within the kernel must access the nucleus address space
instead of the default primary one. Without this change but the increased
use of CK in the kernel, machines started to panic after some minutes of
uptime due to an unresolvable fault in ck_pr_cas_64_value().
marius [Thu, 29 Nov 2018 21:59:09 +0000 (21:59 +0000)]
MFC: r341016, MF12: r341261
- Add a belated UPDATING entry for the ixlv(4) -> iavf(4) rename in r339338.
- Likewise, add ixlv.4.gz to OLD_FILES,
- and link if_ixlv.ko to if_iavf.ko in order to aid a bit in the transition.
vangyzen [Wed, 28 Nov 2018 16:58:35 +0000 (16:58 +0000)]
MFS r341147
MFC r340995
Prevent kernel stack disclosure in signal delivery
On arm64 and riscv platforms, sendsig() failed to zero the signal
frame before copying it out to userspace. Zero it.
On arm, I believe all the contents of the frame were initialized,
so there was no disclosure. However, explicitly zero the whole frame
because that fact could inadvertently change in the future,
it's more clear to the reader, and I could be wrong in the first place.
Approved by: re (gjb)
Security: similar to FreeBSD-EN-18:12.mem and CVE-2018-17155
Sponsored by: Dell EMC Isilon
emaste [Fri, 23 Nov 2018 21:08:11 +0000 (21:08 +0000)]
MFS12 r340849, r340850, r340851:
MFC r340661 (rmacklem):
r304026 added code that started statistics gathering for an operation
before the operation number (the variable called "op") was sanity checked.
This patch moves the code down to below the range sanity check for "op".
MFC r340662 (rmacklem):
nfsm_advance() would panic() when the offs argument was negative.
The code assumed that this would indicate a corrupted mbuf chain, but
it could simply be caused by bogus RPC message data.
This patch replaces the panic() with a printf() plus error return.
MFC r340663 (rmacklem):
Improve sanity checking for the dircount hint argument to
NFSv3's ReaddirPlus and NFSv4's Readdir operations. The code
checked for a zero argument, but did not check for a very large value.
This patch clips dircount at the server's maximum data size.
gjb [Fri, 23 Nov 2018 16:32:27 +0000 (16:32 +0000)]
- Update releng/12.0 from RC1 to RC2 as part of the 12.0-RELEASE
cycle.
- Update the dvd1.iso pkg(8) configuration to use the release_0
package set to populate the dvd.
Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation
emaste [Thu, 22 Nov 2018 18:59:05 +0000 (18:59 +0000)]
MF12 r340697: Introduce src.conf knob to build userland with retpoline
MFC r339511: Introduce src.conf knob to build userland with retpoline
WITH_RETPOLINE enables -mretpoline vulnerability mitigation in userland
for CVE-2017-5715.
MFC r340099: libcompat: disable retpoline when building build tools
These are built with the host toolchain which may not support retpoline.
While here, move the MK_ overrides to a separate line and sort them
alphabetically to support future changes.
MFC r340650: Avoid retpolineplt with static linking
Statically linked binaries linked with -zretpolineplt crash at startup
as lld produces a broken PLT.
MFC r340652: rescue: set NO_SHARED in Makefile
The rescue binary is built statically via the Makefile generated by
crunchgen, but that does not trigger other shared/static logic in
bsd.prog.mk - in particular
PR: 233336
Reported by: Peter Malcom (r339511), Charlie Li (r340652)
Approved by: re (kib)
Sponsored by: The FreeBSD Foundation
marius [Thu, 22 Nov 2018 16:27:30 +0000 (16:27 +0000)]
MFC: r340656, MF12: r340759
Given that the idea of D15374 was to "make memmove a first class citizen",
provide a _MEMMOVE extension of _MEMCPY that deals with overlap based on
the previous bcopy(9) implementation and use the former for bcopy(9) and
memmove(9). This addresses my D15374 review comment, avoiding extra MOVs
in case of memmove(9) and trashing the stack pointer.
tijl [Thu, 22 Nov 2018 13:12:17 +0000 (13:12 +0000)]
MFS r340757:
Fix another user address dereference in linux_sendmsg syscall.
This was hidden behind the LINUX_CMSG_NXTHDR macro which dereferences its
second argument. Stop using the macro as well as LINUX_CMSG_FIRSTHDR. Use
the size field of the kernel copy of the control message header to obtain
the next control message.
tijl [Thu, 22 Nov 2018 13:09:42 +0000 (13:09 +0000)]
MFS r340755:
Do proper copyin of control message data in the Linux sendmsg syscall.
Instead of calling m_append with a user address, allocate an mbuf cluster
and copy data into it using copyin. For the SCM_CREDS case, instead of
zeroing a stack variable and appending that to the mbuf, zero part of the
mbuf cluster directly. One mbuf cluster is also the size limit used by
the FreeBSD sendmsg syscall (uipc_syscalls.c:sockargs()).
PR: 217901
Reviewed by: kib
Approved by: re (marius)
r340507:
libbe(3): rewrite init to support chroot usage
libbe(3) currently uses zfs_be_root and locates which of its children is
currently mounted at "/". This is reasonable, but not correct in the case of
a chroot, for two reasons:
- chroot root may be of a different zpool than zfs_be_root
- chroot root will not show up as mounted at "/"
Fix both of these by rewriting libbe_init to work from the rootfs down.
zfs_path_to_zhandle on / will resolve to the dataset mounted at the new
root, rather than the real root. From there, we can derive the BE root/pool
and grab the bootfs off of the new pool. This does no harm in the average
case, and opens up bectl to operating on different pools for scenarios where
one may be, for instance, updating a pool that generally gets re-rooted into
from a separate UFS root or zfs bootpool.
While here, I've also:
- Eliminated the check for /boot and / to be on the same partition. This
leaves one open to a setup where /boot (and consequently, kernel/modules)
are not included in the boot environment. This may very well be an
intentional setup done by someone that knows what they're doing, we should
not kill BE usage because of it.
- Eliminated the validation bits of BEs and snapshots that enforced
'mountpoint' to be "/" -- this broke when trying to operate on an imported
pool with an altroot, but we need not be this picky.
Reported by: philip
Reviewed by: philip, allanjude (previous version)
Tested by: philip
Differential Revision: https://reviews.freebsd.org/D18012
r340508:
libbe(3): Rewrite be_unmount to stop mucking with getmntinfo(2)
Go through the ZFS layer instead; given a BE, we can derive the dataset,
zfs_open it, then zfs_unmount. ZFS takes care of the dirty details and
likely gets it more correct than we did for more interesting setups.
r340592:
bectl(3)/libbe(3): Allow BE root to be specified
Add an undocumented -r option preceding the bectl subcommand to specify a BE
root to operate out of. This will remain undocumented for now, as some
caveats apply:
- BEs cannot be activated in the pool that doesn't contain the rootfs
- bectl create cannot work out of the box without the -e option right now,
since it defaults to the rootfs and cross-pool cloning doesn't work like
that (IIRC)
Plumb the BE root through to libbe(3) so that some things -can- be done to
it, e.g.
this aides in some upgrade setups where rootfs is not necessarily ZFS, and
also makes it easier/possible to regression-test bectl when combined with a
file-backed zpool.
r340593:
libbe(3): Properly account for altroot when creating new BEs
Previously we would blindly copy the 'mountpoint' property, which includes
the altroot. The altroot needs to be snipped off prior to setting it on the
new BE, though, or you'll end up with a new BE and a mountpoint of /mnt with
altroot=/mnt
r340594:
bectl(8): Add some regression tests
These tests operate on a file-backed zpool that gets created in the kyua
temp dir. root and ZFS support are both required for these tests. Current
tests cover create, destroy, export/import, jail, list (kind of), mount,
rename, and jail.
List tests should later be extended to cover formatting and the different
list flags, but for now only covers basic "are create/destroy actually
reflected properly"
r340635:
libbe(3): Handle non-ZFS rootfs better
If rootfs isn't ZFS, current version will emit an error claiming so and fail
to initialize libbe. As a consumer, bectl -r (undocumented) can be specified
to operate on a BE independently of whether on a UFS or ZFS root.
Unbreak this for the UFS case by only erroring out the init if we can't
determine a ZFS dataset for rootfs and no BE root was specified. Consumers
of libbe should take care to ensure that rootfs is non-empty if they're
trying to use it, because this could certainly be the case.
Some check is needed before zfs_path_to_zhandle because it will
unconditionally emit to stderr if the path isn't a ZFS filesystem, which is
unhelpful for our purposes.
This should also unbreak the bectl(8) tests on a UFS root, as is the case in
Jenkins' -test runs.
r340636:
bectl(8) tests: attempt to load the ZFS module
Observed in a CI test image, bectl_create test will run and be marked as
skipped because the module is not loaded. The first zpool invocation will
automagically load the module, but bectl_create is still skipped. Subsequent
tests all pass as expected because the module is now loaded and everything
is OK.
marius [Wed, 21 Nov 2018 19:49:21 +0000 (19:49 +0000)]
MFC: r340495, MF12: r340739
- Restore setting the clock for devices which support the default/legacy
transfer mode only (lost with r321385). [1]
- Similarly, don't try to set the power class on MMC devices that comply
to version 4.0 of the system specification but are operated in default/
legacy transfer or 1-bit bus mode as no power class is specified for
these cases. Trying to set a power class nevertheless resulted in an -
albeit harmless - error message.
amd64: tidy up memset to have rax set earlier for small sizes
amd64: finish the tail in memset with an overlapping store
amd64: align memset buffers to 16 bytes before using rep stos
amd64: convert libc bzero to a C func to avoid future bloat
amd64: sync up libc memset with the kernel version
amd64: handle small memset buffers with overlapping stores
Fix -DNO_CLEAN amd64 build after r340463
gjb [Mon, 19 Nov 2018 15:49:39 +0000 (15:49 +0000)]
MFS12 r340630:
Remove debugging options from amd64 MINIMAL [1] and riscv GENERIC
kernel configuration files. This should have been turned off when
stable/12 branched.
Submitted by: Harry Schmalzbauer [1]
Approved by: re (kib)
Sponsored by: The FreeBSD Foundation
asomers [Thu, 15 Nov 2018 19:06:07 +0000 (19:06 +0000)]
MFC r340314:
libjail: fix handling of allow.mount.fusefs in jailparam_init
fusefs is inconsistently named. The kernel module is named "fuse", but the
mount helper is named "mount_fusefs" and the jail(8) parameter is named
"allow.mount.fusefs". Special case it in libjail.
Reviewed by: jamie
Approved by: re (gjb)
Differential Revision: https://reviews.freebsd.org/D17929
vmaffione [Thu, 15 Nov 2018 18:51:37 +0000 (18:51 +0000)]
MFC :r340436
vtnet: fix netmap support
netmap(4) support for vtnet(4) was incomplete and had multiple bugs.
This commit fixes those bugs to bring netmap on vtnet in a functional state.
Changelist:
- handle errors returned by virtqueue_enqueue() properly (they were
previously ignored)
- make sure netmap XOR rest of the kernel access each virtqueue.
- compute the number of netmap slots for TX and RX separately, according to
whether indirect descriptors are used or not for a given virtqueue.
- make sure sglist are freed according to their type (mbufs or netmap
buffers)
- add support for mulitiqueue and netmap host (aka sw) rings.
- intercept VQ interrupts directly instead of intercepting them in txq_eof
and rxq_eof. This simplifies the code and makes it easier to make sure
taskqueues are not running for a VQ while it is in netmap mode.
- implement vntet_netmap_config() to cope with changes in the number of queues.
Sponsored by: Sunny Valley Networks
Differential Revision: https://reviews.freebsd.org/D17916
Approved by: re (gjb)
tuexen [Thu, 15 Nov 2018 17:25:32 +0000 (17:25 +0000)]
MFC r340361:
Fix printing of 64-bit counters on 32-bit ppc platforms.
Several statistic counters are uint64_t values and are printed by systat
using %lu. This results in displaying wrong numbers. Use PRIu64 instead.
While there, print variables of size_t using %zd.
Approved by: re (gjb@)
Differential Revision: https://reviews.freebsd.org/D17838
gjb [Thu, 15 Nov 2018 16:42:59 +0000 (16:42 +0000)]
MFC r340406:
The roff ascii.gz documentation installed to /usr/share/doc
was removed in r318881 when roff was removed from the base
system.
This results in the doc.txz distribution set containing a
single directory (./) which is empty.
Remove the "Additional documentation" option from the menu
selection of bsdinstall(8), as the plain-text documentation
installed in /usr/share/doc is installed as part of the
packageworld target.
The doc entry has not been removed from EXTRA_DISTRIBUTIONS
in Makefile.inc1, in case its removal triggers an issue with
freebsd-update(8), which is currently aware of the world/doc
component, so the empty doc.txz continues to be created as
a precaution.
Approved by: re (rgrimes)
Sponsored by: The FreeBSD Foundation
kevans [Thu, 15 Nov 2018 16:03:52 +0000 (16:03 +0000)]
MFC r340334: libbe(3): Set canmount properly when activating a new BE
The previously activated BE should have canmount=noauto set on it upon
activation of the new BE, but we previously did not touch canmount on either
old or new BE.
vangyzen [Wed, 14 Nov 2018 21:31:26 +0000 (21:31 +0000)]
MFC r340425 (by cem)
amdsmn(4)/amdtemp(4): Attach to Ryzen 2 hostbridges
As reported, tested, and patch supplied by Johannes.
There may be future work to do to support multiple sensors, but for now, any
sensor at all is a strict improvement for Ryzen 2 systems.
PR: 228480
Submitted by: Johannes Lundberg <johalun0 AT gmail.com> (earlier version)
Reported by: deischen@, Johannes, and numerous others
Early MFC approved by: cem
Approved by: re (kib)
Relnotes: yes
se [Wed, 14 Nov 2018 20:35:04 +0000 (20:35 +0000)]
MFC S340428: Prepare move of ctm from base to a port (misc/ctm) by:
- Adding a note to UPDATING
- Adding a note to the history section of the manpage ctm.1
- Adding a message printed to STDERR to the ctm program
This version is meant for release in FreeBSD-12.0 and should remain in
FreeBSD-12 over its life-time.
A follow-up commit will remove ctm from -CURRENT after the MFC to 12
has happened.
Approved by: re
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D17969
brooks [Mon, 12 Nov 2018 21:51:36 +0000 (21:51 +0000)]
MFC r340302:
Fix freebsd32 mknod(at).
As dev_t is now a 64-bit integer, it requires special handling as a
system call argument. 64-bit arguments are split between two 64-bit
integers due to the way arguments are promoted to allow reuse of most
system call implementations. They must be reassembled before use.
Further, 64-bit arguments at an odd offset (counting from zero) are
padded and slid to the next slot on powerpc and mips. Fix the
non-COMPAT11 system call by adding a freebsd32_mknodat() and
appropriately padded declerations.
The COMPAT11 system calls are fully compatible with the 64-bit
implementations so remove the freebsd32_ versions.
Use uint32_t consistently as the type of the old dev_t. This matches
the old definition.
brooks [Mon, 12 Nov 2018 18:23:51 +0000 (18:23 +0000)]
Regen after r340377: MFC r340272, r340274, r340294
r340272: Make __sysctl follow the freebsd32_foo convention.
r340274: Make freebsd32_umtx_op follow the freebsd32_foo convention.
r340294: Fix a number of bugs in freebsd32's capabilities.conf.
brooks [Mon, 12 Nov 2018 18:21:17 +0000 (18:21 +0000)]
MFC r340272, r340274, r340294
r340272:
Make __sysctl follow the freebsd32_foo convention.
Sponsored by: DARPA, AFRL
r340274:
Make freebsd32_umtx_op follow the freebsd32_foo convention.
Sponsored by: DARPA, AFRL
r340294:
Fix a number of bugs in freebsd32's capabilities.conf.
Bugs range from failure to update after changing syscall implementaion
names to using the wrong name. Somewhat confusingly, the name in
capabilities.conf is exactly the string that appears in syscalls.master,
not the name with a COMPAT* prefix which is the actual function name.
Found while making a change to use the default capabilities.conf.
shurd [Mon, 12 Nov 2018 16:28:07 +0000 (16:28 +0000)]
MFC r340310:
Fix first-packet completion
The first packet after the ring is initialized was never
completed as isc_txd_credits_update() would not include it in the
count of completed packets. This caused netmap to never complete
a batch. See PR 233022 for more details.
PR: 233022
Reported by: lev
Reviewed by: lev
Approved by: re (kib)
Sponsored by: Limelight Networks
Differential Revision: https://reviews.freebsd.org/D17931
shurd [Mon, 12 Nov 2018 16:08:14 +0000 (16:08 +0000)]
MFC r340236:
Fix rxcsum issue introduced in r338838
r338838 attempted to fix issues with rxcsum and rxcsum6.
However, the rxcsum bits were set as though if_setcapenablebit() was
being called, not if_togglecapenable() which is in use. As a result,
it was not possible to disable rxcsum when rxcsum6 was supported.
PR: 233004
Reported by: lev
Reviewed by: lev
Approved by: re (kib)
Sponsored by: Limelight Networks
Differential Revision: https://reviews.freebsd.org/D17881
dteske [Sun, 11 Nov 2018 06:05:28 +0000 (06:05 +0000)]
MFC r339971: Add new rc keywords: enable, disable, delete
This adds new keywords to rc/service to enable/disable a service's
rc.conf(5) variable and "delete" to remove the variable.
When the "service_delete_empty" variable in rc.conf(5) is set to "YES"
(default is "NO") an rc.conf.d file (in /etc/ or /usr/local/etc) is
deleted if empty after modification using "service $foo delete".
hselasky [Sat, 10 Nov 2018 10:30:01 +0000 (10:30 +0000)]
MFC r340212:
Sometimes the complete split packet may be queued too early and the
transaction translator will return a NAK. Ignore this message and
retry the complete split instead.
Approved by: re (kib)
Sponsored by: Mellanox Technologies
MFC r340100:
Do not use bzero() for the O_ICMP6TYPE opcode.
The buffer is already zeroed in compile_rule() function, and also it
may contain configured F_NOT flag in o.len field. This fixes the
filling for "not icmp6types" opcode.
MFC r340175:
Do not print "ip6" keyword in print_icmp6types() for O_ICMP6TYPE opcode.
It produces incompatibility when rules listing is used again to
restore saved ruleset, because "ip6" keyword produces separate opcode.
The kernel already has the check and only IPv6 packets will be checked
for matching.
jhb [Thu, 8 Nov 2018 22:39:38 +0000 (22:39 +0000)]
MFC 340164,340168,340170: Add custom cpu_lock_delay() for x86.
340164:
Add a KPI for the delay while spinning on a spin lock.
Replace a call to DELAY(1) with a new cpu_lock_delay() KPI. Currently
cpu_lock_delay() is defined to DELAY(1) on all platforms. However,
platforms with a DELAY() implementation that uses spin locks should
implement a custom cpu_lock_delay() doesn't use locks.
340168:
Add a delay_tsc() static function for when DELAY() uses the TSC.
This uses slightly simpler logic than the existing code by using the
full 64-bit counter and thus not having to worry about counter
overflow.
340170:
Add a custom implementation of cpu_lock_delay() for x86.
Avoid using DELAY() since it can try to use spin locks on CPUs without
a P-state invariant TSC. For cpu_lock_delay(), always use the TSC if
it exists (even if it is not P-state invariant) to delay for a
microsecond. If the TSC does not exist, read from I/O port 0x84 to
delay instead.
gjb [Thu, 8 Nov 2018 21:58:23 +0000 (21:58 +0000)]
MFC r340260 (emaste):
Avoid buffer underwrite in icmp_error
icmp_error allocates either an mbuf (with pkthdr) or a cluster depending
on the size of data to be quoted in the ICMP reply, but the calculation
failed to account for the additional padding that m_align may apply.
Include the ip header in the size passed to m_align. On 64-bit archs
this will have the net effect of moving everything 4 bytes later in the
mbuf or cluster. This will result in slightly pessimal alignment for
the ICMP data copy.
Also add an assertion that we do not move m_data before the beginning of
the mbuf or cluster.
Approved by: re (kib)
Security: CVE-2018-17156
Sponsored by: The FreeBSD Foundation
tijl [Thu, 8 Nov 2018 19:56:29 +0000 (19:56 +0000)]
MFC r340181, r340185:
On amd64 both Linux compat modules, linux.ko and linux64.ko, provide
linux_ioctl_(un)register_handler that allows other driver modules to
register ioctl handlers. The ioctl syscall implementation in each Linux
compat module iterates over the list of handlers and forwards the call to
the appropriate driver. Because the registration functions have the same
name in each module it is not possible for a driver to support both 32 and
64 bit linux compatibility.
Move the list of ioctl handlers to linux_common.ko so it is shared by
both Linux modules and all drivers receive both 32 and 64 bit ioctl calls
with one registration. These ioctl handlers normally forward the call
to the FreeBSD ioctl handler which can handle both 32 and 64 bit.
Keep the special COMPAT_LINUX32 ioctl handlers in linux.ko in a separate
list for now and let the ioctl syscall iterate over that list first.
Later, COMPAT_LINUX32 support can be added to the 64 bit ioctl handlers
via a runtime check for ILP32 like is done for COMPAT_FREEBSD32 and then
this separate list would disappear again. That is a much bigger effort
however and this commit is meant to be MFCable.
This enables linux64 support in x11/nvidia-driver*.
emaste [Wed, 7 Nov 2018 18:04:19 +0000 (18:04 +0000)]
MFC r340137: rtld: move relro enforcement after ifunc processing
Previously the combination of relro (implicit), -z now and ifunc use
resulted in a segfault when applying ifuncs after relro (test binary
here just calls amd64_get_fsbase()):
des [Wed, 7 Nov 2018 16:22:18 +0000 (16:22 +0000)]
MFH (r339812): add default value for local_unbound_tls
MFH (r339995): run unbound-anchor if root.key is empty (PR 232555)
MFH (r340037): turn off so-reuseport by default
shurd [Tue, 6 Nov 2018 20:46:00 +0000 (20:46 +0000)]
MFC r339861:
Drain grouptaskqueue of the gtask before detaching it.
taskqgroup_detach() would remove the task even if it was running or
enqueued, which could lead to panics (see D17404). With this change,
taskqgroup_detach() drains the task and sets a new flag which prevents the
task from being scheduled again.
I've added grouptask_block() and grouptask_unblock() to allow control
over the flag from other locations as well.