hselasky [Fri, 8 Dec 2017 15:30:59 +0000 (15:30 +0000)]
MFC r326362:
Disallow TUN and TAP character device IOCTLs to modify the network device
type to any value. This can cause page faults and panics due to accessing
uninitialized fields in the "struct ifnet" which are specific to the network
device type.
Found by: jau@iki.fi
PR: 223767
Sponsored by: Mellanox Technologies
hselasky [Fri, 20 Oct 2017 10:07:17 +0000 (10:07 +0000)]
MFC r324445:
When showing the sleepqueues from the in-kernel debugger,
properly dump all the sleepqueues and not just the first one
History:
It appears that in the commit which introduced the code,
r165272, the array indexes of "sq_blocked[0]" and "td_name[i]"
were interchanged. In r180927 "td_name[i]" was corrected to
"td_name[0]", but "sq_blocked[0]" was left unchanged.
davidcs [Thu, 19 Oct 2017 17:40:51 +0000 (17:40 +0000)]
MFC r324535
Add sanity checks in ql_hw_send() qla_send() to ensure that empty slots
in Tx Ring map to empty slot in Tx_buf array before Transmits. If the
checks fail further Transmission on that Tx Ring is prevented.
MFC r323824
1. ql_hw.c:
In ql_hw_send() return EINVAL when TSO framelength exceeds max
supported length by HW.(davidcs)
2. ql_os.c:
In qla_send() call bus_dmamap_unload before freeing mbuf or
recreating dmmamap.(davidcs)
In qla_fp_taskqueue() Add additional checks for IFF_DRV_RUNNING
Fix qla_clear_tx_buf() call bus_dmamap_sync() before freeing
mbuf.
dim [Tue, 5 Sep 2017 17:35:33 +0000 (17:35 +0000)]
MFC r323001:
In compiler-rt, a few assembler implementations for i386 floating point
conversion functions use SSE2 instructions, but these are not guarded by
#ifdef __SSE2__, and there is no implementation using general purpose
registers. For these functions, use the generic C variants instead,
otherwise they will cause SIGILL on older processors.
Reported by: bsdpr@phoe.frmug.org
PR: 221733
MFC r323014:
Follow-up to r323001: if the actually selected CPUTYPE is capable of
SSE2 instructions, we can use them.
davidcs [Mon, 28 Aug 2017 18:01:36 +0000 (18:01 +0000)]
MFC 322771
Upgrade FW to 5.4.66
sysctls to display stats, stats polled every 2 seconds
Modify QLA_LOCK()/QLA_UNLOCK() to not sleep after acquiring mtx_lock
Add support to turn OFF/ON error recovery following heartbeat failure for
debug purposes.
Set default max values to 32 Tx/Rx/SDS rings
hselasky [Tue, 15 Aug 2017 12:28:16 +0000 (12:28 +0000)]
MFC r322248:
Fix for mlx4en(4) to properly call m_defrag().
The m_defrag() function can only defrag mbuf chains which have a valid
mbuf packet header. In r291699 when the mlx4en(4) driver was converted
into using BUSDMA(9), the call to m_defrag() was moved after the part
of the transmit routine which strips the header from the mbuf chain.
This effectivly disabled the mbuf defrag mechanism and such packets
simply got dropped.
This patch removes the stripping of mbufs from a chain and loads all
mbufs using busdma. If busdma finds there are no segments, unload
the DMA map and free the mbuf right away, because that means all
data in the mbuf has been inlined in the TX ring. Else proceed
as usual.
Add a per-ring rounter for the number of defrag attempts and
make sure the oversized_packets counter gets zeroed while at it.
The counters are per-ring to avoid excessive cache misses in the
TX path.
hselasky [Mon, 7 Aug 2017 13:27:35 +0000 (13:27 +0000)]
MFC r321782:
Remove some dead statistics related code and a structure field from the
mlx4en driver which is used by its Linux counterpart, but not under
FreeBSD.
hselasky [Mon, 7 Aug 2017 12:59:32 +0000 (12:59 +0000)]
MFC r321986:
Change reject message type when destroying cm_id in ibore.
This patch fixes an interopability issue between FreeBSD and non-FreeBSD
systems when the connection establishment is aborted. Refer to the
initial commit in Linux, drivers/infiniband/core/cm.c,
for a more detailed description.
Obtained from: Linux
Sponsored by: Mellanox Technologies
MFC 321233
Raise the watchdog timer interval to 2 ticks, there by guaranteeing
that it fires between 1ms and 2ms. `
Treat two consecutive occurrences of Heartbeat failures as a legitimate
Heartbeat failure
MFC r320876:
Make sure the mlx4en RX DMA ring gets stamped with software ownership
in order to prevent the flow of QP to error in the firmware once
UPDATE_QP is called.
delphij [Sun, 25 Jun 2017 06:55:42 +0000 (06:55 +0000)]
MFC r320216: Fix use-after-free introduced in r300388.
In r300388, endnetconfig() was called on nc_handle which would release
the associated netconfig structure, which means tmpnconf->nc_netid
would be a use-after-free.
Solve this by doing endnetconfig() in return paths instead.
hselasky [Sun, 18 Jun 2017 11:50:09 +0000 (11:50 +0000)]
MFC r319972:
Use static device numbering instead of dynamic one when creating
mlx4en network interfaces. This prevents infinite unit number growth
typically when the mlx4en driver is used inside virtual machines which
support runtime PCI attach and detach.
hselasky [Sun, 4 Jun 2017 08:48:26 +0000 (08:48 +0000)]
MFC r319413:
Free hardware queue resource after port is stopped in the mlx4en(4)
driver. Else if the port is up the resource might still be busy and
the MTT free will fail.
hselasky [Sun, 4 Jun 2017 08:30:55 +0000 (08:30 +0000)]
MFC r319414:
Allow communication between functions on the same host when using the
mlx4en(4) driver in SRIOV mode.
Place a copy of the destination MAC address in the send WQE only under
SRIOV/eSwitch configuration or when the device is in selftest. This
allows communication between functions on the same host.
hselasky [Sat, 27 May 2017 08:28:51 +0000 (08:28 +0000)]
MFC r318820:
Increase the allowed maximum number of audio channels from 31 to 127
in the PCM feeder mixer. Without this change a value of 32 channels is
treated like zero, due to using a mask of 0x1f, causing a kernel
assert when trying to playback bitperfect 32-channel audio. Also
update the AWK script which is generating the division tables to
handle more than 18 channels. This commit complements r282650.
hselasky [Mon, 22 May 2017 08:20:50 +0000 (08:20 +0000)]
MFC r318531:
mlx4: Use the CQ quota for SRIOV when creating completion EQs
When creating EQs to handle CQ completion events for the PF or for
VFs, we create enough EQE entries to handle completions for the max
number of CQs that can use that EQ.
When SRIOV is activated, the max number of CQs a VF (or the PF) can
obtain is its CQ quota (determined by the Hypervisor resource
tracker). Therefore, when creating an EQ, the number of EQE entries
that the VF should request for that EQ is the CQ quota value (and not
the total number of CQs available in the firmware).
Under SRIOV, the PF, also must use its CQ quota, because the resource
tracker also controls how many CQs the PF can obtain.
Using the firmware total CQs instead of the CQ quota when creating EQs
resulted wasting MTT entries, due to allocating more EQEs than were
needed.
hselasky [Fri, 19 May 2017 12:56:18 +0000 (12:56 +0000)]
MFC r313555:
Flexible and asymmetric allocation of EQs and MSI-X vectors for PF/VFs.
Previously, the mlx4 driver queried the firmware in order to get the
number of supported EQs. Under SRIOV, since this was done before the
driver notified the firmware how many VFs it actually needs, the
firmware had to take into account a worst case scenario and always
allocated four EQs per VF, where one was used for events while the
others were used for completions. Now, when the firmware supports the
asymmetric allocation scheme, denoted by exposing num_sys_eqs > 0 (-->
MLX4_DEV_CAP_FLAG2_SYS_EQS), we use the QUERY_FUNC command to query
the firmware before enabling SRIOV. Thus we can get more EQs and MSI-X
vectors per function. Moreover, when running in the new
firmware/driver mode, the limitation that the number of EQs should be
a power of two is lifted.
Obtained from: Linux (dual BSD/GPLv2 licensed)
Submitted by: Dexuan Cui @ microsoft . com
Differential Revision: https://reviews.freebsd.org/D8867
Sponsored by: Mellanox Technologies
hselasky [Fri, 19 May 2017 12:42:33 +0000 (12:42 +0000)]
MFC r313556:
Change mlx4 QP allocation scheme.
When using Blue-Flame, BF, the QPN overrides the VLAN, CV, and SV
fields in the WQE. Thus, BF may only be used for QPNs with bits 6,7
unset.
The current ethernet driver code reserves a TX QP range with 256b
alignment.
This is wrong because if there are more than 64 TX QPs in use, QPNs >=
base + 65 will have bits 6/7 set.
This problem is not specific for the Ethernet driver, any entity that
tries to reserve more than 64 BF-enabled QPs should fail. Also, using
ranges is not necessary here and is wasteful.
The new mechanism introduced here will support reservation for "Eth
QPs eligible for BF" for all drivers: bare-metal, multi-PF, and VFs
(when hypervisors support WC in VMs). The flow we use is:
1. In mlx4_en, allocate Tx QPs one by one instead of a range allocation,
and request "BF enabled QPs" if BF is supported for the function
2. In the ALLOC_RES FW command, change param1 to:
a. param1[23:0] - number of QPs
b. param1[31-24] - flags controlling QPs reservation
Bit 31 refers to Eth blueflame supported QPs. Those QPs must have bits
6 and 7 unset in order to be used in Ethernet.
Bits 24-30 of the flags are currently reserved.
When a function tries to allocate a QP, it states the required
attributes for this QP. Those attributes are considered "best-effort".
If an attribute, such as Ethernet BF enabled QP, is a must-have
attribute, the function has to check that attribute is supported
before trying to do the allocation.
In a lower layer of the code, mlx4_qp_reserve_range masks out the bits
which are unsupported. If SRIOV is used, the PF validates those
attributes and masks out unsupported attributes as well. In order to
notify VFs which attributes are supported, the VF uses QUERY_FUNC_CAP
command. This command's mailbox is filled by the PF, which notifies
which QP allocation attributes it supports.
Obtained from: Linux (dual BSD/GPLv2 licensed)
Submitted by: Dexuan Cui @ microsoft . com
Differential Revision: https://reviews.freebsd.org/D8868
Sponsored by: Mellanox Technologies
davidcs [Mon, 15 May 2017 18:24:14 +0000 (18:24 +0000)]
MFC r317996
Fix bug where MTX_DEF lock was held while taskqueue_drain() was invoked.
Check IFF_DRV_RUNNING flag is set prior to calling ql_hw_set_multi()
rmacklem [Sun, 7 May 2017 20:32:07 +0000 (20:32 +0000)]
MFC: r317236
Fix the setting of atime for Linux client NFSv4 mounts.
The FreeBSD NFSv4 server did not set the attribute bit for TimeAccess in
the reply to an Open with exclusive_create, as required by the RFCs.
(This is required since the FreeBSD NFS server stores the create_verifier
in the va_atime attribute.)
As such, the Linux NFSv4 client did not set the TimeAccess (atime) in
the Setattr done in an RPC after the one with the Open/exclusive_create.
This patch fixes the server to set the TimeAccess bit in the reply.
I believe that storing the create_verifier in an extended attribute for
file systems that support extended attributes might be a good idea,
but I will wait for a discussion of this on the freebsd-fs@ email list
before considering committing a patch to do this.
MFC: r316667
Fix the NFSv4 client hndling of a stale write verifier in the Commit operation.
When the NFSv4 client Commit operation encountered a stale write verifier,
it erroneously mapped that to EIO. This could have caused recently written
data to be lost when a server crashes/reboots between an UNSTABLE write
and the subsequent commit. This patch fixes this.
The bug was only for the NFSv4 client and did not affect NFSv3.
MFC r316310
Update man page for commit r316309 "Add support for optional Soft LRO".
The driver provides the ability to select either HW or Software LRO, when
LRO is enabled (default HW LRO).
This includes a number of demangler fixes obtained from upstream
ELF Tool Chain.
PR: 200913
Sponsored by: The FreeBSD Foundation
MFC r284553 (by emaste):
Update libcxxrt upgrade instructions
The typeinfo file no longer exists upstream.
MFC r288830:
Add std::uncaught_exceptions() to libcxxrt (C++17, see N4152 and N4259).
This has also been submitted upstream.
MFC r288830:
Add std::uncaught_exceptions() to libcxxrt (C++17, see N4152 and N4259).
This has also been submitted upstream.
MFC r297299:
Compile libcxxrt as C++11, since it is only really used in combination
with libc++, which is also C++11. Also change one _Static_assert (which
is really C11) back into static_assert, like upstream.
This should help when compiling libcxxrt with newer versions of gcc,
which refuse to recognize any form of static assertions, if not
compiling for C++11 or higher.
While here, add -nostdinc++ to CFLAGS, to prevent picking up any C++
headers outside the source tree.
Interesting fixes: 3adaa2e Fix _Unwind_Exception cleanup functions 286776c Check exception cleanup function ptr before calling edda626 Correct exception specifications on new and delete operators
MFC r303157 (by emaste):
libcxxrt: add padding in __cxa_allocate_* to fix alignment
The addition of the referenceCount to __cxa_allocate_exception put the
unwindHeader at offset 0x58 in __cxa_exception, but it requires 16-byte
alignment. In order to avoid changing the current __cxa_exception ABI
(and thus breaking its consumers), add explicit padding in the
allocation routines (and account for it when freeing).
This is intended as a lower-risk change for FreeBSD 11. A "more correct"
fix should be prepared for upstream and -CURRENT.
Reviewed by: dim
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D7271
MFC r303400 (by emaste):
libcxxrt: fix demangling of wchar_t
'wchar_t' is 7 characters long, not 6. r303297 fixed this in libelftc,
but not the second copy of this file that we have in libcxxrt.
Interesting fixes which were not already merged: 0c7c611 Merge C++ demangler bug fixes from ELF Tool Chain (#40) 2b208d9 __cxa_demangle_gnu3: demangle 'z' as '...', not 'ellipsis' (#41)
dim [Fri, 24 Mar 2017 18:28:13 +0000 (18:28 +0000)]
Pull in r283944 from upstream libc++ trunk (by Eric Fiselier):
Fix std::pair on FreeBSD
Summary:
FreeBSD ships an old ABI for std::pair which requires that it have
non-trivial copy/move constructors. Currently the non-trivial
copy/move is achieved by providing explicit definitions of the
constructors. This is problematic because it means the constructors
don't SFINAE properly. In order to SFINAE copy/move constructors they
have to be explicitly defaulted and hense non-trivial.
This patch attempts to provide SFINAE'ing copy/move constructors for
std::pair while still making them non-trivial. It does this by adding
a base class with a non-trivial copy constructor and then allowing
pair's constructors to be generated by the compiler. This also allows
the constructors to be constexpr.
This should fix building www/chromium 57.0.2987.110 on stable/10 and
stable/9 without having to use -D_LIBCPP_TRIVIAL_PAIR_COPY_CTOR=1 (which
changes the ABI). Direct commit to stable/10 and stable/9, since head
already has libc++ 4.0, which includes this fix.
davidcs [Fri, 24 Mar 2017 03:17:59 +0000 (03:17 +0000)]
MFC r314365
1. state checks in bxe_tx_mq_start_locked() and bxe_tx_mq_start() to
sync threads during interface down or detach.
2. add sysctl to set pause frame parameters
3. increase max segs for TSO packets to BXE_TSO_MAX_SEGMENTS (32)
4. add debug messages for PHY
5. HW LRO support restricted to FreeBSD versions 8.x and above.
ngie [Mon, 20 Mar 2017 03:18:16 +0000 (03:18 +0000)]
MFC r315206:
bsnmpd: fix segfault when trans_insert_port(..) is called with multiple
out of order addresses
Move `port->transport` initialization before the TAILQ_FOREACH(..) loop
to ensure that the value is properly initialized before it's inserted
into the TAILQ.
hselasky [Tue, 14 Mar 2017 15:57:21 +0000 (15:57 +0000)]
MFC r314328:
Fix startup race initialising ACPI CM battery structures on MacBookPro.
During acpi_cmbat_attach() the acpi_cmbat_init_battery() notification
handler is registered. It has been observed this notification handler
can be called instantly, before the attach routine has returned. In
the notification handler there is a call to device_is_attached() which
returns false. Because the softc is set we know an attach is in
progress and the fix is simply to wait and try again in this case.
hselasky [Tue, 14 Mar 2017 15:52:01 +0000 (15:52 +0000)]
MFC r313941:
Make sure the thread constructor and destructor eventhandlers are
called for all threads belonging to a procedure. Currently the first
thread in a procedure is kept around as an optimisation step and is
never freed. Because the first thread in a procedure is never freed
nor allocated, its destructor and constructor callbacks are never
called which means per thread structures allocated by dtrace and the
Linux emulation layers for example, might be present for threads which
don't need these structures.
This patch adds a thread construction and destruction call for the
first thread in a procedure.
hselasky [Tue, 14 Mar 2017 15:30:46 +0000 (15:30 +0000)]
MFC r312424:
Fix problem with suspend and resume when using Skylake chipsets. Make
sure the XHCI controller is reset after halting it. The problem is
clearly a BIOS bug as the suspend and resume is failing without
loading the XHCI driver. The same happens when using Linux and the
XHCI driver is not loaded.
dim [Wed, 11 Jan 2017 21:01:49 +0000 (21:01 +0000)]
MFC r311688:
Fix logic error in gvinum's gv_set_sd_state()
With clang 4.0.0, I'm getting the following warnings:
sys/geom/vinum/geom_vinum_state.c:186:7: error: logical not is only
applied to the left hand side of this bitwise operator
[-Werror,-Wlogical-not-parentheses]
if (!flags & GV_SETSTATE_FORCE)
^ ~
The logical not operator should obiously be called after masking.
dim [Wed, 11 Jan 2017 20:45:27 +0000 (20:45 +0000)]
MFC r311649:
Fix the following clang 4.0.0 warning in ngatm's snmp_atm.c:
contrib/ngatm/snmp_atm/snmp_atm.c:173:6: error: logical not is only
applied to the left hand side of this bitwise operator
[-Werror,-Wlogical-not-parentheses]
if (!ifmr.ifm_status & IFM_AVALID) {
^ ~
Obviously, the masking needs to be done before the logical not
operation. Add parentheses to make it so.
1. define the CODE * as const
2. restructure function to eliminate warning about exiting with no return.
severity_map() never returns when it can't find an appropriate sysylog
facility, and it longjmp()'s away into error code handling. Keep this
behavior by stashing the facility value found during our search and
checking for -1 if found.
MFC r257405 (by sbruno):
Quiesce warning, which could be a bug IMO, by correctly defining the host_info
structure name
MFC r257406 (by sbruno):
Queisce warning about undeclared function usage.
yp_get_default_domain is defined in workaround.c but is not declared
in any header file. Tie the declaration to the same #define conditional
used when the function is called, NETGROUP
MFC r272949 (by pfg):
tcpd: complete function prototypes.
This clears up at least a build issues on mysql-server
ports. While here also replace some spaces with tabs
in our headers.
PR: 42336
MFC r272950 (by pfg):
tcpd.h: add prototype for hosts_ctl
According the hosts_access(3) man page the hosts_ctl() prototype
should be in tcpd.h. For now, follow other declarations and don't
add the arguments in the prototype.
Reference:
https://www.illumos.org/issues/4385
PR: 32808
MFC r311459:
Put proper prototypes in tcpd.h
Clang 4.0.0 complains about tcpd.h's not-really-prototypes, e.g.:
/usr/include/tcpd.h:75:24: error: this function declaration is not a prototype [-Werror,-Wstrict-prototypes]
extern int hosts_access(); /* access control */
^
To fix this, turn these declarations into real prototypes. While here,
garbage collect the incompatible rfc931() function from scaffold.c, as
it is never used.
Also remove unnecessary extern keywords from tcpd.h.
Noticed by: kib
MFC r311556:
After r311459, some ports can break, because a few of the newly added
prototypes in <tcpd.h> use FILE. Pull in a minimal forward declaration
of FILE from <stdio.h> to minimize impact. Sorry for the breakage.
pfg [Mon, 26 Dec 2016 16:45:00 +0000 (16:45 +0000)]
MFC r310367:
pax(1): Fix a bug with archives smaller than 512 bytes.
The problem here is that the archive is too short (< 512 bytes). The
buffer routines, try to read at least 512 bytes, even when we try to
determine what format file we have, which is wrong.
ed [Tue, 20 Dec 2016 08:01:17 +0000 (08:01 +0000)]
MFC r309650:
Properly sign extend the result of jrand48() and mrand48().
These functions are supposed to return a value between [-2^31, 2^31).
This doesn't seem to work on 64-bit systems, where we return a value
between [0, 3^32). Patch up the function to use proper casts to int32_t.
While there, fix some other style bugs.
trasz [Mon, 19 Dec 2016 18:31:22 +0000 (18:31 +0000)]
MFC r307774:
Fix libusb20_dev_get_desc(3) to use the "vendor product" order, not
"product vendor". This is consistent with how it's generally done.
The ordering is visible eg in usbconfig(8) output.
hselasky [Mon, 19 Dec 2016 09:54:59 +0000 (09:54 +0000)]
MFC r309400:
Fix for endless recursion in the ACPI GPE handler during boot.
When handling a GPE ACPI interrupt object the EcSpaceHandler()
function can be called which checks the EC_EVENT_SCI bit and then
recurse on the EcGpeQueryHandler() function. If there are multiple GPE
events pending the EC_EVENT_SCI bit will be set at the next call to
EcSpaceHandler() causing it to recurse again via the
EcGpeQueryHandler() function. This leads to a slow never ending
recursion during boot which prevents proper system startup, because
the EC_EVENT_SCI bit never gets cleared in this scenario.
The behaviour is reproducible with the ALASKA AMI in combination with
a newer Skylake based mainboard in the following way:
Enter BIOS and adjust the clock one hour forward. Save and exit the
BIOS. System fails to boot due to the above mentioned bug in
EcGpeQueryHandler() which was observed recursing multiple times.
This patch adds a simple recursion guard to the EcGpeQueryHandler()
function and also also adds logic to detect if new GPE events occurred
during the execution of EcGpeQueryHandler() and then loop on this
function instead of recursing.
dim [Sun, 18 Dec 2016 14:31:11 +0000 (14:31 +0000)]
MFC r310013 (by cperciva):
Check that blkfront devices have a non-zero number of sectors and a
non-zero sector size. Such a device would be a virtual disk of zero
bytes; clearly not useful, and not something we should try to attach.
As a fortuitous side effect, checking that these values are non-zero
here results in them not *becoming* zero later on the function. This
odd behaviour began with r309124 (clang 3.9.0) but is challenging to
debug; making any changes to this function whatsoever seems to affect
the llvm optimizer behaviour enough to make the unexpected zeroing of
the sector_size variable cease.
PR: 215209
Security: The potential for variables to unexpectedly become zero
has worrying consequences for security in general, but
not so much in this particular context.
MFC r310086:
In xbd_connect(), use correct scanf conversion specifiers for the
feature_barrier and feature_flush variables. Otherwise, adjacent
variables on the stack, such as sector_size, may be overwritten, with
disastrous results.
Note that I did not see a good reason to revert the addition of zero
checks introduced in r310013. Better safe than sorry.
dim [Mon, 12 Dec 2016 00:09:08 +0000 (00:09 +0000)]
Fix libllvmanalysis build failure after r309857: on stable/9, llvm is
compiled by gcc, and without -std=c++11, so the nullptr keyword is
unknown. Use the old-school plain zero syntax instead.
dim [Sun, 11 Dec 2016 19:58:13 +0000 (19:58 +0000)]
MFC r309722:
Pull in r281586 from upstream llvm trunk (by Wei Mi):
Add some shortcuts in LazyValueInfo to reduce compile time of
Correlated Value Propagation.
The patch is to partially fix PR10584. Correlated Value Propagation
queries LVI to check non-null for pointer params of each callsite. If
we know the def of param is an alloca instruction, we know it is
non-null and can return early from LVI. Similarly, CVP queries LVI to
check whether pointer for each mem access is constant. If the def of
the pointer is an alloca instruction, we know it is not a constant
pointer. These shortcuts can reduce the cost of CVP significantly.
glebius [Tue, 6 Dec 2016 18:54:04 +0000 (18:54 +0000)]
Merge r309639 from head:
Fix possible buffer overflow(s) in link_ntoa(3).
A specially crafted sockaddr_dl argument can trigger a static buffer overflow
in the libc library, with possibility to rewrite with arbitrary data following
static buffers that belong to other library functions.
glebius [Tue, 6 Dec 2016 18:52:33 +0000 (18:52 +0000)]
Merge r309638 from head:
When telnetd(8) composes argument list for login(1), an unexpected sequence
of memory allocation failures combined with insufficient error checking
could result in the construction and execution of an argument sequence that
was not intended.
Fix that treating malloc(3) failures as fatal condition.
dim [Tue, 6 Dec 2016 07:33:49 +0000 (07:33 +0000)]
MFC r309332:
Cleanup old debug dirs in delete-old-dirs target
Any .debug or .symbols files under /usr/lib/debug which correspond to
OLD_FILES entries in ObsoleteFiles.inc are also automatically cleaned up
by the delete-old target. Make this also apply to any OLD_DIRS entries.
brooks [Wed, 30 Nov 2016 01:41:40 +0000 (01:41 +0000)]
MFC r309027:
Allocate a struct ifreq rather than using a (wrong) computed size for
the BIOCSETIF ioctl.
The kernel always copies an entire struct ifreq and IPv4 addresses will
always fit in an ifreq.
On systems with pointers larger than 64-bits, the computed size will be
less than the size of struct ifreq, potentially resulting in the kernel
attempting to copyin memory from outside the allocation.
hselasky [Sat, 12 Nov 2016 17:32:22 +0000 (17:32 +0000)]
MFC r308437 and r308461:
Range check the jitter values to avoid bogus sample rate adjustments.
The expected deviation should not be more than 1Hz per second. The USB
v2.0 specification also mandates this requirement. Refer to chapter
5.12.4.2 about feedback.
Allow higher sample rates to have more jitter than lower ones.
rmacklem [Tue, 8 Nov 2016 21:57:49 +0000 (21:57 +0000)]
MFC: r307891
Fix the man page to reflect the change done by r307890 to mountd.c
so that the "-n" option uses the sysctl for the correct NFS server.
This is a content change.
rmacklem [Tue, 8 Nov 2016 21:52:55 +0000 (21:52 +0000)]
MFC: r307890
mountd(8) was erroneously setting the sysctl for the old NFS server
when the new/default NFS server was running, for the "-n" option.
This patch fixes the problem for stable/10 and stable/9.
Since the new NFS server uses vfs.nfsd.nfs_privport == 0 by default,
there wouldn't have been many users affected by the code not setting
it to 0 when the "-n" option was specified.
hselasky [Mon, 7 Nov 2016 09:23:07 +0000 (09:23 +0000)]
MFC r307518:
Fix device delete child function.
When detaching device trees parent devices must be detached prior to
detaching its children. This is because parent devices can have
pointers to the child devices in their softcs which are not
invalidated by device_delete_child(). This can cause use after free
issues and panic().
Device drivers implementing trees, must ensure its detach function
detaches or deletes all its children before returning.
While at it remove now redundant device_detach() calls before
device_delete_child() and device_delete_children(), mostly in
the USB controller drivers.
Tested by: Jan Henrik Sylvester <me@janh.de>
Reviewed by: jhb
Differential Revision: https://reviews.freebsd.org/D8070
projects / FreeBSD / stable / 9.git / log