Replace _pam_verbose_error() with a macro. This was the last difference
between our libpam and stock OpenPAM, meaning that it is now possible to
replace the base libpam with a hypothetical ports version of OpenPAM.
Don Lewis [Wed, 8 Jun 2016 09:40:06 +0000 (09:40 +0000)]
Don't leak addrinfo if ai->ai_addrlen <= minsiz test fails.
If the ai->ai_addrlen <= minsiz test fails, then freeaddrinfo()
does not get called to free the memory just allocated by getaddrinfo().
Fix by moving ai->ai_addrlen <= minsiz to a separate nested if
block, and keep freeaddrinfo() in the outer block so that freeaddrinfo()
will be called whenever getaddrinfo() succeeds.
Don Lewis [Wed, 8 Jun 2016 05:32:39 +0000 (05:32 +0000)]
Explicitly NUL terminate the buffer filled by fread().
The fix in r300649 was not sufficient to convince Coverity that the
buffer was NUL terminated, even with the buffer pre-zeroed. Swap
the size and nmemb arguments to fread() so that a valid lenght is
returned, which we can use to terminate the string in the buffer
at the correct location. This should also quiet the complaint about
the return value of fread() not being checked.
Old process credentials for setuid execve must not be dereferenced
when the process credentials were not changed. This can happen if an
error occured trying to activate the setuid binary. And on error, if
new credentials were not yet assigned, they must be freed to not
create the leak.
Use oldcred == NULL as the predicate to detect credential
reassignment.
Reported and tested by: pho
Sponsored by: The FreeBSD Foundation
Don Lewis [Wed, 8 Jun 2016 02:14:05 +0000 (02:14 +0000)]
Fix a (false positive?) Argument cannot be negative coverity defect.
Rather than guarding close(fd) with an fd >= 0 test and setting fd
to -1 when it is closed to avoid a potential double-close, just
move the close() call after the conditional "goto make_token". This
moves the close() call totally outside the loop to avoid the
possibility of calling it twice. This should also prevent a Coverity
warning about checking fd for validity after it was previously passed
to read().
CASPER_SERVICE_STDIO - Casper will not close the first three descriptors (stdin,
stdout and stderr) this can be helpful for debugging.
CASPER_SERVICE_FD - Capser will not close all other descriptors, this can
be useful for a filesystem service.
Conrad Meyer [Tue, 7 Jun 2016 19:49:08 +0000 (19:49 +0000)]
iflib: Fix potential leak in iflib_if_transmit
Due to an accidental mismatch between allocation and release in the slow path
of iflib_if_transmit, if a caller passed 9-16 mbufs to the routine, the mbuf
array would be leaked.
Fix the mismatch by removing the magic numbers in favor of nitems() on the
stack array. According to mmacy, this leak is unlikely.
Andrew Turner [Tue, 7 Jun 2016 18:50:36 +0000 (18:50 +0000)]
Start to clean MIDR values using the CPUID scheme. We don't need to know
the exact CPU we are running on to set the cpu functions. Relax the check
to ignore the CPU revision. Even so this may still be too specific.
Kurt Lidl [Tue, 7 Jun 2016 16:18:09 +0000 (16:18 +0000)]
Add blacklist support to sshd
Reviewed by: rpaulo
Approved by: rpaulo (earlier version of changes)
Relnotes: YES
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D5915
Support for compression has been available from July 2007 but it
was never imported due to concerns with patents once held by
STAC/HiFn. The issues have clearly been resolved so bring it
in now.
Special thanks to Brett Glass for preserving the code and
pointing documentation for the expiration case.
Ext2/3/4 manages generation numbers differently than UFS so adopt
some rules that should work well. When allocating a new inode,
make sure we generate a "good" random value specifically avoiding
zero.
Don't interfere with the numbers that are already generated in
the filesystem: ext2fs doesn't have the backwards compatibility
issues where there were no generation numbers.
This patch adds the missing pieces needed for device setup using the
mlx5en driver inside a virtual machine which is providing hardware
access through SR-IOV.
Adrian Chadd [Tue, 7 Jun 2016 04:22:18 +0000 (04:22 +0000)]
[ath3k] add a replacement ath3k firmware loading tool.
This is influenced by the ath3k driver from linux (circa 2013, this is
how long I've been sitting on this.)
It handles loading in firmware using the newer model, where it assembles
the right set of firmware blobs and board configuration based on the
device list and querying the device.
The older utility could only load in a single image - which sometimes
was ath3k-1.fw and sometimes was ath3k-2.fw. However, the ath3k maintainers
didn't want to keep adding in binaries that were just derivatives with a
separate board config, so they deleted ath3k-2.fw from the Linux firmware
repository and instead, well, did this.
Now, this has been tested against AR3011 and AR3012 NICs from the AR9285+BT
combo up through to the QCA9565+BT combo. It doesn't yet work with the
QCAFN222 NIC as that is some newer chip.
The firmware can be grabbed from https://github.com/erikarn/ath3kfw/ in
the share/firmware/ath3k directory. I'll update this utility over time
to support the newer firmware drops (newer than mid-2013) which should
pull in the QCNFA222 and subsequent chips.
Navdeep Parhar [Tue, 7 Jun 2016 00:27:55 +0000 (00:27 +0000)]
cxgbe(4): Track the state of the hardware traffic schedulers in the
driver. This works as long as everyone uses set_sched_class_params
to program them.
Bjoern A. Zeeb [Mon, 6 Jun 2016 22:59:58 +0000 (22:59 +0000)]
After tearing down the interface per-"domain" bits, set the data area
to NULL to avoid it being mis-treated on a possible re-attach but also
to get a clean NULL pointer derefence in case of errors due to
unexpected race conditions elsewhere in the code, e.g., callouts.
Obtained from: projects/vnet
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Eric van Gyzen [Mon, 6 Jun 2016 22:54:08 +0000 (22:54 +0000)]
newsyslog: Eliminate unnecessary sleep(10) when -R and -s are specified
After going through the signal work list, during which do_sigwork()
is called and essentially does nothing because -s and -R were
specified on the command line, newsyslog will sleep for 10 seconds
as the (verbose) code says: "Pause 10 seconds to allow daemon(s)
to close log file(s)".
However, the man page verbiage for -R (and -s) seems quite clear
that this sleep() is unnecessary because the daemon was expected
to have already closed the log file before calling newsyslog.
PR: 210020
Submitted by: David A. Bright <david_a_bright@dell.com>
MFC after: 1 week
Sponsored by: Dell Inc.
Differential Revision: https://reviews.freebsd.org/D6727
Navdeep Parhar [Mon, 6 Jun 2016 22:51:44 +0000 (22:51 +0000)]
cxgbe(4): Break up set_sched_class. Validate the channel number and
min/max rates against their actual limits (which are chip and port
specific) instead of hardcoded constants.
Bjoern A. Zeeb [Mon, 6 Jun 2016 20:57:24 +0000 (20:57 +0000)]
Implement a `show panic` command to DDB which will helpfully print the
panic string again if set, in case it scrolled out of the active
window. This avoids having to remember the symbol name.
Also add a show callout <addr> command to DDB in order to inspect
some struct callout fields in case of panics in the callout code.
This may help to see if there was memory corruption or to further
ease debugging problems.
Obtained from: projects/vnet
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Reviewed by: jhb (comment only on the show panic initally)
Differential Revision: https://reviews.freebsd.org/D4527
John Baldwin [Mon, 6 Jun 2016 20:28:53 +0000 (20:28 +0000)]
Defer the creation of ACPI thermal kthreads to a startup sysinit.
The SYSINIT runs at SI_SUB_KICK_SCHEDULER after the scheduler is fully
initialized and timers are working. This fixes booting in the
EARLY_AP_STARTUP case.
Kurt Lidl [Mon, 6 Jun 2016 20:00:13 +0000 (20:00 +0000)]
Update blacklist support in ftpd to clarify fd usage
The ftp daemon dups the control socket to stdin and uses that fd
throughout the code. Clarify this usage slightly by changing from
explicit use of "0" for the fd to a variable, to make it clear what
the zero represents in the non-blacklist code. Make the
blacklist_notify routine use STDIN_FILENO so as to have less of a
"magic number" feel to the code.
Reviewed by: cem
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D6716
Roger Pau Monné [Mon, 6 Jun 2016 15:01:24 +0000 (15:01 +0000)]
xen-netfront: fix initialization
A couple of mostly cosmetic fixes for the final initialization of netfront:
- Switch to "connected" state before starting to kick the rings.
- Correctly use "rxq" in the initialization loop (previously rxq was not
updated in the loop, and netfront would kick np->rxq[N] several times).
- Declare and define xn_connect as static, it's not used outside of this
file.
Reviewed by: Wei Liu <wei.liu2@citrix.com>
Sponsored by: Citrix Systems R&D
Differential revision: https://reviews.freebsd.org/D6657
Bjoern A. Zeeb [Mon, 6 Jun 2016 13:17:25 +0000 (13:17 +0000)]
In if_purgeaddrs() we cannot hold the lock over the entire loop
due to called functions (as in other parts of the stack, leave a comment).
Put around a lock the removal of the ifa from the list however to
reduce the possible race with other places.
Obtained from: projects/vnet
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Bjoern A. Zeeb [Mon, 6 Jun 2016 13:04:22 +0000 (13:04 +0000)]
Destroy the mutex last. In this case it should not matter, but
generally cleanup code might still acquire it thus try to be
consistent destroying locks late.
Obtained from: projects/vnet
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Bjoern A. Zeeb [Mon, 6 Jun 2016 12:49:47 +0000 (12:49 +0000)]
Provide a public interface to rt_flushifroutes which takes the address
family as an argument as well.
This will be used to cleanup individual protocols during VNET teardown.
Obtained from: projects/vnet
Sponsored by: The FreeBSD Foundation
In mediatek etherswitch support, functions mtkswitch_reg_write32_mt7621
and mtkswitch_reg_read32_mt7621 are called without locks held, so
lock assertions fail. Remove the lock assertions.
Marcelo Araujo [Mon, 6 Jun 2016 09:51:58 +0000 (09:51 +0000)]
Add support to priority code point (PCP) that is an 3-bit field
which refers to IEEE 802.1p class of service and maps to the frame
priority level.
Values in order of priority are: 1 (Background (lowest)),
0 (Best effort (default)), 2 (Excellent effort),
3 (Critical applications), 4 (Video, < 100ms latency),
5 (Video, < 10ms latency), 6 (Internetwork control) and
7 (Network control (highest)).
Example of usage:
root# ifconfig em0.1 create
root# ifconfig em0.1 vlanpcp 3
Note:
The review D801 includes the pf(4) part, but as discussed with kristof,
we won't commit the pf(4) bits for now.
The credits of the original code is from rwatson.
Differential Revision: https://reviews.freebsd.org/D801
Reviewed by: gnn, adrian, loos
Discussed with: rwatson, glebius, kristof
Tested by: many including Matthew Grooms <mgrooms__shrew.net>
Obtained from: pfSense
Relnotes: Yes
This change is needed because 'opt_rss.h' is included by multiple source
files and RSS macro is defined as 1 within the file during build process
if option RSS is enabled in the kernel.
Submitted by: Ivan Malov <Ivan.Malov at oktetlabs.ru>
Reviewed by: gnn
Sponsored by: Solarflare Communications, Inc.
Differential Revision: https://reviews.freebsd.org/D6718
projects / FreeBSD / FreeBSD.git / log