Age | Commit message (Collapse) | Author |
|
|
|
ok jmatthew
|
|
detrunc()'s proc pointer argument may be passed to vinvalbuf(9), which
under certain conditions will pass the given proc pointer to
VOP_FSYNC(9), which always asserts that the given proc pointer is
equal to curproc.
msdosfs_write(), msdosfs_inactive(), createde(), and deextend() all
pass NULL for detrunc()'s proc pointer argument. I have no idea why.
If these detrunc() calls ever reach VOP_FSYNC(9) the kernel will
panic.
So, for example, any user with write access to an msdosfs partition
can panic the kernel by writing to the partition until they cause
ENOSPC. That particular panic looks like this:
panic: kernel diagnostic assertion "p == curproc" failed: file "/usr/src/sys/kern/vfs_vops.c", line 305
Stopped at db_enter+0xa: popq %rbp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*500294 8955 0 0x100003 0 1K ksh
db_enter() at db_enter+0xa
panic(ffffffff81f1b0cf) at panic+0xc4
__assert(ffffffff81fa361c,ffffffff81ee8329,131,ffffffff81f7229b) at assert+0x3b
VOP_FSYNC(fffffd8449a78b30,ffffffffffffffff,1,0) at VOP_FSYNC+Oxd6
vinvalbuf(fffffd8449a78b30,3,ffffffffffffffff,0,0,ffffffffffffffff) at vinvalbuf+0xd5
detrunc(ffff80000186f900,1fe,0,ffffffffffffffff,0) at detrunc+0x239
msdosfs_write(ffff800055774b98) at msdosf_write+0x4a4
VOP_WRITE(fffffd8449a78b30,ffff800055774d10,3,fffffd8370e8d5d0) at VOP_WRITE+0x59
vn_write(fffffd83c723b860,ffff800055774d10,0) at vn_write+0xc0
dofilewritev(ffff8000556ecfc0,1,ffff800055774d10,0.ffff800055774dc0) at dofilewritev+0x14d
sys_write(ffff8000556ecfc0,ffff800055774dd0,ffff800055774dc0) at sys_write+0x6a
syscall(ffff800055774e70) at syscall+0x39b
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffd8bf0, count: 2
This patch tweaks all the detrunc() calls in the aforementioned
msdosfs functions to pass curproc instead of a NULL pointer to
detrunc(). We don't appear to have curproc stashed anywhere in
msdosfs_write() or deextend(), so for those calls we explicitly pass
curproc.
This might have unforseen consequences I can't anticipate. However,
with this patch I can no longer panic the kernel by filling an msdosfs
partition, which seems like an improvement.
With advice from gnezdo@.
ok gnezdo@
|
|
|
|
softraid(4) patterns were never used since import in 2015
and only one out of APFS patterns are used.
Feedback on APFS krw
OK krw
|
|
from NetBSD back in 2000.
ok krw@
|
|
Tested by me.
|
|
ok jsg@, tobhe@, deraadt@
|
|
Current omissions in protocol support are notifications,
index (de)allocation, and agent capabilities.
Help testing sthen@
Feedback/tweaks/OK jmatthew@
|
|
from Varun Kumar E in GitHub issue 3307.
|
|
from and tested by jon@elytron.openbsd.amsterdam
|
|
|
|
from jon@elytron.openbsd.amsterdam
|
|
Fix putchar(3) handling and a number of other issues in the random(6)
code. In -e mode, avoid bias due to truncation of the return code to
8 bits. In default mode, actually treat the denominator as a floating
point number and print the line with a probability of 1 / denominator.
This allows e.g. printing 2/3 of stdin with 'random 1.5'.
Includes code for uniform random floats by Taylor R. Campbell from
https://mumble.net/~campbell/2014/04/28/uniform-random-float
and clz64() by me.
From lucic71 () bronze ! ctrl-c ! club, thanks.
ok deraadt
|
|
|
|
ok bluhm@
|
|
are protected by netlock. They are only used as shortcut in fast
timer.
Common prefix in mld6.c is mld6.
OK mvs@
|
|
for fragment entries was reached, pf_create_fragment() called
pf_flush_fragments() without lock. This could result in a crash.
Let PF_FRAG_LOCK() cover the whole pf_reassemble() function as
pf_nfrents++ was also missing the lock.
crash found and fix tested by Hrvoje Popovski; OK sashan@
|
|
ok bluhm@
|
|
on version. Fixes M2 Macbook Air 2022 which reports version 2 but only
uses 3 cells.
ok kettenis@
|
|
While here get rid of the unused returned value of uvmpd_scan_inactive().
ok jsg@, kn@
|
|
function may sleep, so holding a mutex is not possible. The same
list entry and rwlock is used for UDP multicast and raw IP delivery.
By adding a write lock, exclusive netlock is no longer necessary
for PCB notify and UDP and raw IP input.
OK mvs@
|
|
Explicitly forbidden in sections 2 and 5 of draft-ietf-sidrops-rpki-rsc-10.
looks good to claudio
|
|
|
|
libkern bzero doesn't have the 486 path but is otherwise the same
ok mlarkin@ deraadt@
|
|
ok daniel@
|
|
ok daniel@
|
|
ok bluhm@
|
|
|
|
about operations the daemon performs.
|
|
As with powerpc, powerpc64, and riscv64, on mips64 platforms we need
to isolate the clock interrupt schedule from the MD clock interrupt
code. To do this, we need to stop deferring clock interrupt work
until the next tick and instead defer the work until we logically
unmask the clock interrupt from splx(9).
Add a boolean (ci_clock_deferred) to the cpu_info struct to note
whether we need to trigger the clock interrupt by hand, and then
do so from splx(9) by calling md_triggerclock().
Currently md_triggerclock is only ever set to cp0_trigger_int5(). The
routine takes great care to ensure that INT5 has fired or will fire
before returning.
There are some loongson machines that use glxclk instead of CP0. They
can be switched to use CP0 later.
With input and advice from visa@ and miod@.
Compiled and extensively tested by visa@ and miod@ on various octeon
and loongson machines. No issues seen on octeon machines. miod@ saw
some odd things on loongsoon, but suggests that all issues are
probably unrelated to this patch.
Link: https://marc.info/?l=openbsd-tech&m=165929192702632&w=2
ok visa@, miod@
|
|
are status variables that can be used to avoid locking if timers
are not running. This should reduce contention on exclusive netlock.
OK kn@ mvs@
|
|
ok bluhm@
|
|
|
|
While more work is still required, this is sufficient to get ngtcp2 to
compile with QUIC and for curl to be able to make HTTP/3 requests.
ok tb@
|
|
ok tb@
|
|
This provides SSL_QUIC_METHOD (aka ssl_quic_method_st), which allows for
QUIC callback hooks to be passed to an SSL_CTX or SSL. This is largely
ported/adapted from BoringSSL.
It is worth noting that this struct is not opaque and the original
interface exposed by BoringSSL differs to the one they now use. The
original interface was copied by quictls and it appears that this API
will not be updated to match BoringSSL.
To make things even more challenging, at least one consumer does not use
named initialisers, making code completely dependent on the order in
which the function pointers are defined as struct members. In order to
try to support both variants, the set_read_secret/set_write_secret
functions are included, however they have to go at the end.
ok tb@
|
|
ok tb@
|
|
ok tb@
|
|
LibreSSL will not return these values, however software is starting to
check for these as return values from SSL_get_error().
ok tb@
|
|
ok bluhm@
|
|
For now they all run on softraid(4) on vnd(4) and do not require any
setup up-front, making it easy to spot bugs in MD code.
amd64 passes, sparc64 passes with the exception of "-r/mnt" usage,
as is done by the installer, when the softraid volume contains
more than one chunk. arm64 needs more love, still.
Will be hooked up per-arch soon.
OK anton
|
|
ok bluhm@
|
|
reassembly and IPv6 hob-by-hob header chain processing out of
ip_local() and ip6_local(), they are almost empty stubs. The check
for local deliver loop in ip_ours() and ip6_ours() is sufficient.
Recover mbuf offset and next protocol directly in ipintr() and
ip6intr().
OK mvs@
|
|
just like -r1.28 did for OF_getpropintarray()
ok kettenis@
|
|
buffer. Later it may be used to protect more of the PCB or socket.
In divert input replace the kernel lock with this mutex.
OK mvs@
|
|
|
|
- enable Tx/Rx aggregations of individual 802.11 frames on the USB bus
- in urtwn_fw_loadpage(), the maximum block size is 254 bytes rather than
196 bytes
- clear the interrupt status register
- no need to disable BAR for USB devices and set NAV limit
ok stsp@, jmatthew@
|
|
|
|
Mem1 -> SDRAM
Mem2 -> BIOS
These show up in pcidump as "Class: 05 Memory, Subclass: 00 RAM" which is
probably the reason for the Mem1/Mem2 names.
From NetBSD with tweaks from jsg@; also confirmed in the Transmeta BIOS
Programmer's Guide.
ok jsg@
|