lib/libc/gen/vis.c: revision 1.75-1.86
tests/lib/libc/gen/t_vis.c: revision 1.10-1.14
PR 56260: fix out-of-bounds stack read.
vis(3): Avoid nonportable MIN in portable code.
vis(3) tests: Add xfail test for encoding overflow.
From Kyle Evans <kevans%FreeBSD.org@localhost>.
PR lib/57573
vis(3) tests: Expand tests and diagnostic outputs on failure.
PR lib/57573
vis(3) tests: Test another overflow edge case.
Related to PR lib/57573.
vis(3): Make maxolen unsigned size_t, not ssize_t.
It is initialized once either to *dlen, which is unsigned size_t, or
to wcslen(start) * MB_MAX_LEN + 1, and wcslen returns unsigned size_t
too. So there appears to have never been any reason for this to be
signed.
Part of PR lib/57573.
vis(3): Make mbslength unsigned.
Sprinkle assertions and comments justifying the proposition that it
would never go negative if signed.
Obviates need to worry about mblength > SSIZE_MAX.
Prompted by PR lib/57573.
vis(3): Avoid arithmetic overflow before calloc(3).
Prompted by PR lib/57573.
vis(3): Call wcslen(start) only once.
It had better not change between these two times!
Prompted by PR lib/57573.
vis(3): Avoid potential arithmetic overflow in maxolen.
Can't easily prove that this overflow is impossible, so let's add a
check.
Prompted by PR lib/57573.
vis(3): Fix main part of PR lib/57573.
From Kyle Evans <kevans%FreeBSD.org@localhost>.
vis(3): Fix one more buffer overrun in an edge case.
PR lib/57573
vis(3): Sort includes. No functional change intended.
Prompted by PR lib/57573.
vis(3): Need <stdint.h> for SIZE_MAX, per C standard.
From Kyle Evans <kevans%FreeBSD.org@localhost>.
Followup to PR lib/57573.
vis(3): Per KNF, sys/param.h comes before sys/types.h.
Which is nice because that's also lexicographic.
etc/namedb/root.cache: revision 1.24
etc/namedb/root.cache: revision 1.25
etc/namedb/root.cache: revision 1.26
sync with most recent (no changes)
Update to 2019093001
Update to 2023112702 (November 27, 2023).
tests/lib/libc/sys/t_setrlimit.c: revision 1.8
tests/lib/libc/sys/t_setrlimit.c: revision 1.9
sys/kern/exec_subr.c: revision 1.86
t_setrlimit: Verify changing RLIMIT_STACK affects access to stack.
PR kern/57711
exec: Map noaccess part of stack with prot=NONE, maxprot=READ|WRITE.
This way, setrlimit(RLIMT_STACK) can grant READ|WRITE access when
increasing the stack size.
PR kern/57711
sys/dev/pci/mpii.c: revision 1.30
Fixes for PR kern/57133:
I can now explain why this assert is firing and have a fix for it. It is a regression introduced in R1.22 of mpii.c.
If a request comes in and the IOC returns a MPII_SCSIIO_STATUS_CHECK_COND condition, after
a successful transfer, or one that is a recovered error,
mpii(4) correctly sets the xs->error to XS_SENSE, but incorrectly sets xs->resid to 0 before
returning the xfer to the upper scsi layers. Once the upper layers get it, they notice the
XS_SENSE check condition and because it's a retryable error, they increment xs_requeuecnt, set
ERESTART and send the xfer request down to the mpii(4) layer again for a retry. What they do
not do is reset xs->resid equal to xs->datalen. When the xfer comes down to mpii(4) again, the
assert happens. The fix is for the mpii(4) driver to leave xs->resid alone when it encounters
a MPII_SCSIIO_STATUS_CHECK_COND condition.
This bug affects NetBSD-10, netbsd-9 and netbsd-8.
sys/dev/pci/pcidevs 1.1497
sys/dev/pci/if_wm.c 1.689,1.790-1.791 via patch
sys/dev/pci/if_wmreg.h 1.120 via patch
sys/dev/pci/if_wmvar.h 1.51
- Use 12K for packet buffer for jumbo frame on PCH2 and newer.
- Add new workaround for Tiger Lake and newer to avoid packet loss.
- Add I219{V,LM}({22,23}) devices (Raptor Lake).
sys/dev/pci/ixgbe/ix_txrx.c 1.103-1.104
sys/dev/pci/ixgbe/ixgbe.c 1.334-1.338,
1.341-1.344 via patch
sys/dev/pci/ixgbe/ixgbe.h 1.90-1.93
sys/dev/pci/ixgbe/ixgbe_82599.c 1.31-1.32
sys/dev/pci/ixgbe/ixgbe_api.c 1.29
sys/dev/pci/ixgbe/ixgbe_bypass.h 1.5
sys/dev/pci/ixgbe/ixgbe_common.c 1.46-1.47
sys/dev/pci/ixgbe/ixgbe_common.h 1.18
sys/dev/pci/ixgbe/ixgbe_dcb.c 1.14-1.15
sys/dev/pci/ixgbe/ixgbe_dcb_82598.c 1.13
sys/dev/pci/ixgbe/ixgbe_type.h 1.59-1.61
sys/dev/pci/ixgbe/ixgbe_x540.c 1.24
sys/dev/pci/ixgbe/ixgbe_x550.c 1.28
sys/dev/pci/ixgbe/ixv.c 1.187-1.192 via patch
- ixg(4): Add 82599 LS support once again.
- ixg(4): Filter out spurious link up indication more.
- ixg(4): Print DEVICE_CAPS register.
- ixg(4): Fix a bug that the number of queues is unintentionally
limited to a small number or wrong error message may be printed
when two devices' number of MSI-X vectors are different.
- Modify error message of wrong TX/RX descriptor size.
- Enable interrupt after setting IFF_RUNNING.
- Fix a bug that changing hw.ix[gv]X.qY.interrupt_rate would change
all devices all queues default interrupt rate.
- Cleanup the code.
sys/dev/pci/if_wm.c: revision 1.785
sys/dev/pci/if_wm.c: revision 1.786
sys/dev/pci/if_wm.c: revision 1.787
sys/dev/pci/if_wm.c: revision 1.788
sys/dev/pci/if_wm.c: revision 1.789
wm(4): Use SCVPC and HRMPC for 82575 and newer.
The SCVPC(SerDes/SGMII Code Violation Packet Count) register and the HRMPC
(Header Redirection Missed Packet Count) register were added in if_wm.c
rev. 1.776 but the location in the code were incorrect. Fix them.
wm(4): Add some info to some event counters.
- The difference between the RUC(Rx Undersize) and RFC(Rx Fragment) is whether
the CRC is valid or not.
- The difference between the ROC(Rx Oversize) and RJC(Rx Jabber) is whether
the CRC is valid or not.
- LENERRS(Length Errors) is for the length/type field <= 1500.
wm(4): the IAC(Interrupt Assertion Count) register is for 82571 and newer.
wm(4): Modify descriptions of flow control related event counters.
wm(4): Replace /* nothing */ to __nothing for evcnt macros
Prevent empty if bodies for !WM_EVENT_COUNTERS.
sys/dev/pci/ixgbe/ixgbe.c 1.327-1.332 via patch
sys/dev/pci/ixgbe/ixgbe.h 1.87-1.88
sys/dev/pci/ixgbe/ixv.c 1.184-1.185
sys/dev/pci/ixgbe/ix_txrx.c 1.101
sys/dev/pci/ixgbe/ixgbe_82599.c 1.30
sys/dev/pci/ixgbe/ixgbe_vf.c 1.32-1.33
sys/dev/pci/ixgbe/ixgbe_vf.h 1.18
sys/dev/pci/ixgbe/ixgbe_mbx.h 1.20
sys/dev/pci/ixgbe/ixgbe_type.h 1.57
- Reorder some event counters for readability.
- Rename some descriptions of event counters.
- Count Queue Bytes {Transmit, Receive} counter.
- Improve error check in ixgbe_check_mac_link_vf().
- Add new IXGBE_VF_GET_LINK_STATE message support.
The VF's link state can be forced to down by PF.
- Update FCTRL after writing multicast filter.
- Update comments.
libexec/ftpd/version.h: revision 1.80
NetBSD-ftpd 20230930
Update version to "NetBSD-ftpd 20230930" for changes:
- fix uninitialized memory usage in count_users()
- fix pam_set_item call with proper struct passed as PAM_SOCKADDR
libexec/ftpd/ftpd.c: revision 1.208
pam_set_item PAM_SOCKADDR expects sockaddr_storage structure
Instead, internal struct sockinet was used. Because it's length is shorter
than sockaddr_storage, libpam was copying also memory outside of sockinet
struct.
libexec/ftpd/conf.c: revision 1.65
Fix uninitialized memory usage in count_users()
If the file was previously empty, pids table is not set, the code however used
pids[0] which is uninitialized in this case. In some scenarios it may lead to
propagate garbage value from pids[0] to the file and cause writing outside of
allocated memory.
OK lukem@
libexec/ftpd/ftpd.c: revision 1.206
Treat failed chdir/chroot for guest and chroot accounts as fatal.
Also treat failed set{e,}(u,g}id calls as fatal.
Addresses CVE-2020-7468, via FreeBSD.
share/examples/wpa_supplicant/wpa_supplicant.conf: revision 1.4
wpa_supplicant.conf: fix connection string for Eduroam
"MSCHAPV2" must have an uppercase "V" in the connection string.
Reported by nebbionegiuseppe at gmail.com in PR misc/57634.
lib/libpam/modules/pam_krb5/pam_krb5.c: revision 1.32
pam_krb5: Fix PR lib/57631.
Loose ends in the fix for NetBSD-SA2023-006 that weren't caught by
review or, somehow, by my own testing. Evidently we need automatic
tests for this pam business.
sys/arch/i386/stand/efiboot/Makefile.efiboot: revision 1.22
sys/arch/i386/stand/efiboot/eficpufunc.c: revision 1.1
sys/arch/i386/stand/efiboot/eficpufunc.h: revision 1.1
sys/arch/i386/stand/efiboot/eficons.c: revision 1.13
sys/arch/i386/stand/efiboot/eficons.c: revision 1.14
efiboot/x86: Add serial console support via raw I/O port access
Unfortunately, some (most?) UEFI implementations do not support
com ports by ``Serial I/O Protocol''.
``PNP0501-0'' and friends are not recognized also.
In this case, if user explicitly requires to switch to serial
console by ``consdev'' command, try to use raw I/O port access.
Ugly, but what FreeBSD does, at least.
Proposed as PR port-amd64/57523
efiboot/x86: eficons.c: Explicitly include params.h for howmany()
NFC for -current and netbsd-10, but necessary for netbsd-[89] to
pull up raw IO serial port support (PR port-amd64/57523).
lib/libpam/modules/pam_ksu/pam_ksu.c: revision 1.11
pam_ksu(8): Allow homedir access during kuserok.
Otherwise, the default kuserok logic to look at ~targetuser/.k5login
would be blocked by the security measure to thwart NetBSD-SA2023-005.
(There are other ways, e.g. setting SYSTEM-K5LOGIN in /etc/krb5.conf
so the file is /etc/k5login.d/user instead of ~user/.k5login, but
that's not the default configuration and there are plenty of
deployments that rely on ~user/.k5login today.)
I reviewed libkrb5 for homedir access checks. There are three:
1. krb5_config_parse_file_multi, called only by:
- verify_krb5_conf -- not relevant
- krb5_config_parse_file -- not used here as far as I can tell,
only by libhdb ldap logic and test code in heimdal
- krb5_set_config_files -- used here only via krb5_init_context,
which is done at this point
2. plugin_get_hosts in krbhst.c, used to look up hosts for KDC I/O,
which shouldn't be happening at this point, so this is almost
certainly unreachable; also it only appears to control whether
some old plugin API can be used, long after we have read the krb5
config controlling which plugins are available, so this is
probably harmless
3. krb5_kuserok, which is the one we want to allow
Note: This will have to be updated again in the next Heimdal update,
which eliminates the global homedir access flag in favour of making
the default per-context homedir access flag conditional on !issuid.
crypto/external/bsd/openssl/dist/crypto/sparccpuid.S: revision 1.11
fix SPARC v8/v9 detection code.
this code uses a trick where the encoding on both v8 and v9 are
the same, and are not illegal instructions, but that the v9 one
has a detectable difference than v8.
the idea is that we perform a "subcc" (set condition codes) which
sets "%ccr" on v9, which is an unimplemented "%asr2" on v8, then
we read %ccr (v9) or %asr2 (v8), which will always be 0x99 on v9,
and .. is non-trapping but impleentation defined on v8.
for many implementations this returns the value of the %y reg.
as nothing actually sets %y in this path, it remains the value it
was most recently set to by something (anything), and if it just
happens to be 0x99 then the v9 paths will be taken on v8.
fix this by clearing the %y register before the potential read.
fixes PR port-sparc/57594. tested on ss20 and in qemu. this
version of the patch has been submitted upstream.
sys/dev/pci/if_wmvar.h: revision 1.50
sys/dev/pci/if_wm.c: revision 1.783,1.784 via patch
Delay sending LINK_STATE_UP to prevent dropping packets on I35[04] and I21[01].
Some (not all) systems use I35[04] or I21[01] don't send packet soon
after linkup. The MAC send a packet to the PHY and any error is not
observed. This behavior causes a problem that gratuitous ARP and/or
IPv6 DAD packet are silently dropped. To avoid this problem, don't
call mii_pollstat() here which will send LINK_STATE_UP notification
to the upper layer. Instead, mii_pollstat() will be called in
wm_gmii_mediastatus() or mii_tick() will be called in wm_tick().
Note that the similar workaround is in Linux's igb driver though it's
only for I21[01].
OK'd by hikaru@ and knakahara@.
Fix #ifdef WM_DEBUG code in wm_gmii_i82544_{read,write}reg_locked.
martin