CVS commit: [netbsd-7-0] src/sys/dev/ic
Module Name:src
Committed By: martin
Date: Tue Dec 17 16:35:28 UTC 2019
Modified Files:
src/sys/dev/ic [netbsd-7-0]: ath.c
Log Message:
Pull up following revision(s) (requested by christos in ticket #1718):
sys/dev/ic/ath.c: revision 1.129
Protect network ioctls from non-authorized users. (Ilja Van Sprundel)
To generate a diff of this commit:
cvs rdiff -u -r1.116 -r1.116.6.1 src/sys/dev/ic/ath.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/ic/ath.c
diff -u src/sys/dev/ic/ath.c:1.116 src/sys/dev/ic/ath.c:1.116.6.1
--- src/sys/dev/ic/ath.c:1.116 Thu Sep 12 12:17:53 2013
+++ src/sys/dev/ic/ath.c Tue Dec 17 16:35:28 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: ath.c,v 1.116 2013/09/12 12:17:53 martin Exp $ */
+/* $NetBSD: ath.c,v 1.116.6.1 2019/12/17 16:35:28 martin Exp $ */
/*-
* Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
@@ -41,7 +41,7 @@
__FBSDID("$FreeBSD: src/sys/dev/ath/if_ath.c,v 1.104 2005/09/16 10:09:23 ru Exp $");
#endif
#ifdef __NetBSD__
-__KERNEL_RCSID(0, "$NetBSD: ath.c,v 1.116 2013/09/12 12:17:53 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ath.c,v 1.116.6.1 2019/12/17 16:35:28 martin Exp $");
#endif
/*
@@ -69,6 +69,7 @@ __KERNEL_RCSID(0, "$NetBSD: ath.c,v 1.11
#include
#include
#include
+#include
#include
#include
@@ -5362,6 +5363,12 @@ ath_ioctl(struct ifnet *ifp, u_long cmd,
return copyout(&sc->sc_stats,
ifr->ifr_data, sizeof (sc->sc_stats));
case SIOCGATHDIAG:
+ error = kauth_authorize_network(curlwp->l_cred,
+ KAUTH_NETWORK_INTERFACE,
+ KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, KAUTH_ARG(cmd),
+ NULL);
+ if (error)
+ break;
error = ath_ioctl_diag(sc, (struct ath_diag *) ifr);
break;
default:
CVS commit: [netbsd-7-0] src/sys/dev/ic
Module Name:src
Committed By: snj
Date: Sat Aug 12 04:28:39 UTC 2017
Modified Files:
src/sys/dev/ic [netbsd-7-0]: ciss.c
Log Message:
Pull up following revision(s) (requested by mrg in ticket #1483):
sys/dev/ic/ciss.c: revision 1.37
Reject negative indices from userland.
To generate a diff of this commit:
cvs rdiff -u -r1.32 -r1.32.8.1 src/sys/dev/ic/ciss.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/ic/ciss.c
diff -u src/sys/dev/ic/ciss.c:1.32 src/sys/dev/ic/ciss.c:1.32.8.1
--- src/sys/dev/ic/ciss.c:1.32 Thu Oct 17 21:24:24 2013
+++ src/sys/dev/ic/ciss.c Sat Aug 12 04:28:39 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: ciss.c,v 1.32 2013/10/17 21:24:24 christos Exp $ */
+/* $NetBSD: ciss.c,v 1.32.8.1 2017/08/12 04:28:39 snj Exp $ */
/* $OpenBSD: ciss.c,v 1.68 2013/05/30 16:15:02 deraadt Exp $ */
/*
@@ -19,7 +19,7 @@
*/
#include
-__KERNEL_RCSID(0, "$NetBSD: ciss.c,v 1.32 2013/10/17 21:24:24 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ciss.c,v 1.32.8.1 2017/08/12 04:28:39 snj Exp $");
#include "bio.h"
@@ -1274,12 +1274,12 @@ ciss_ioctl(device_t dev, u_long cmd, voi
/* FALLTHROUGH */
case BIOCDISK:
bd = (struct bioc_disk *)addr;
- if (bd->bd_volid > sc->maxunits) {
+ if (bd->bd_volid < 0 || bd->bd_volid > sc->maxunits) {
error = EINVAL;
break;
}
ldp = sc->sc_lds[0];
- if (!ldp || (pd = bd->bd_diskid) > ldp->ndrives) {
+ if (!ldp || (pd = bd->bd_diskid) < 0 || pd > ldp->ndrives) {
error = EINVAL;
break;
}
@@ -1380,7 +1380,7 @@ ciss_ioctl_vol(struct ciss_softc *sc, st
int error = 0;
u_int blks;
- if (bv->bv_volid > sc->maxunits) {
+ if (bv->bv_volid < 0 || bv->bv_volid > sc->maxunits) {
return EINVAL;
}
ldp = sc->sc_lds[bv->bv_volid];
CVS commit: [netbsd-7-0] src/sys/dev/ic
Module Name:src
Committed By: snj
Date: Sat Aug 12 04:22:26 UTC 2017
Modified Files:
src/sys/dev/ic [netbsd-7-0]: isp_netbsd.c
Log Message:
Pull up following revision(s) (requested by mrg in ticket #1482):
sys/dev/ic/isp_netbsd.c: revision 1.89
Reject out-of-bounds channel index.
>From Ilja Van Sprundel.
To generate a diff of this commit:
cvs rdiff -u -r1.86 -r1.86.16.1 src/sys/dev/ic/isp_netbsd.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/ic/isp_netbsd.c
diff -u src/sys/dev/ic/isp_netbsd.c:1.86 src/sys/dev/ic/isp_netbsd.c:1.86.16.1
--- src/sys/dev/ic/isp_netbsd.c:1.86 Tue Aug 21 15:53:07 2012
+++ src/sys/dev/ic/isp_netbsd.c Sat Aug 12 04:22:26 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: isp_netbsd.c,v 1.86 2012/08/21 15:53:07 bouyer Exp $ */
+/* $NetBSD: isp_netbsd.c,v 1.86.16.1 2017/08/12 04:22:26 snj Exp $ */
/*
* Platform (NetBSD) dependent common attachment code for Qlogic adapters.
*/
@@ -33,7 +33,7 @@
*/
#include
-__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.86 2012/08/21 15:53:07 bouyer Exp $");
+__KERNEL_RCSID(0, "$NetBSD: isp_netbsd.c,v 1.86.16.1 2017/08/12 04:22:26 snj Exp $");
#include
#include
@@ -475,6 +475,10 @@ ispioctl(struct scsipi_channel *chan, u_
}
lim = local.count;
channel = local.channel;
+ if (channel >= isp->isp_nchan) {
+ retval = EINVAL;
+ break;
+ }
ua = *(isp_dlist_t **)addr;
uptr = &ua->wwns[0];
CVS commit: [netbsd-7-0] src/sys/dev/ic
Module Name:src
Committed By: snj
Date: Sat Aug 12 03:47:51 UTC 2017
Modified Files:
src/sys/dev/ic [netbsd-7-0]: bwi.c
Log Message:
Pull up following revision(s) (requested by mrg in ticket #1474):
sys/dev/ic/bwi.c: revision 1.32
Check for M_EXT in m->m_flags, whether m is NULL, after MCLGET.
>From Ilja Van Sprundel.
To generate a diff of this commit:
cvs rdiff -u -r1.24.4.1 -r1.24.4.1.2.1 src/sys/dev/ic/bwi.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/ic/bwi.c
diff -u src/sys/dev/ic/bwi.c:1.24.4.1 src/sys/dev/ic/bwi.c:1.24.4.1.2.1
--- src/sys/dev/ic/bwi.c:1.24.4.1 Tue Apr 21 04:55:15 2015
+++ src/sys/dev/ic/bwi.c Sat Aug 12 03:47:50 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: bwi.c,v 1.24.4.1 2015/04/21 04:55:15 snj Exp $ */
+/* $NetBSD: bwi.c,v 1.24.4.1.2.1 2017/08/12 03:47:50 snj Exp $ */
/* $OpenBSD: bwi.c,v 1.74 2008/02/25 21:13:30 mglocker Exp $ */
/*
@@ -48,7 +48,7 @@
#include
-__KERNEL_RCSID(0, "$NetBSD: bwi.c,v 1.24.4.1 2015/04/21 04:55:15 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: bwi.c,v 1.24.4.1.2.1 2017/08/12 03:47:50 snj Exp $");
#include
#include
@@ -8292,7 +8292,7 @@ bwi_newbuf(struct bwi_softc *sc, int buf
if (m == NULL)
return (ENOBUFS);
MCLGET(m, init ? M_WAITOK : M_DONTWAIT);
- if (m == NULL) {
+ if ((m->m_flags & M_EXT) == 0) {
error = ENOBUFS;
/*
CVS commit: [netbsd-7-0] src/sys/dev/ic
Module Name:src
Committed By: snj
Date: Sat Aug 12 03:44:15 UTC 2017
Modified Files:
src/sys/dev/ic [netbsd-7-0]: dm9000.c
Log Message:
Pull up following revision(s) (requested by mrg in ticket #1473):
sys/dev/ic/dm9000.c: revision 1.12
Check for MCLGET failure in dme_alloc_receive_buffer.
>From Ilja Van Sprundel.
To generate a diff of this commit:
cvs rdiff -u -r1.4.22.1 -r1.4.22.1.2.1 src/sys/dev/ic/dm9000.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/ic/dm9000.c
diff -u src/sys/dev/ic/dm9000.c:1.4.22.1 src/sys/dev/ic/dm9000.c:1.4.22.1.2.1
--- src/sys/dev/ic/dm9000.c:1.4.22.1 Fri Jan 2 20:24:14 2015
+++ src/sys/dev/ic/dm9000.c Sat Aug 12 03:44:15 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: dm9000.c,v 1.4.22.1 2015/01/02 20:24:14 martin Exp $ */
+/* $NetBSD: dm9000.c,v 1.4.22.1.2.1 2017/08/12 03:44:15 snj Exp $ */
/*
* Copyright (c) 2009 Paul Fleischer
@@ -1122,8 +1122,13 @@ dme_alloc_receive_buffer(struct ifnet *i
sizeof(struct ether_header);
/* All our frames have the CRC attached */
m->m_flags |= M_HASFCS;
- if (m->m_pkthdr.len + pad > MHLEN )
+ if (m->m_pkthdr.len + pad > MHLEN) {
MCLGET(m, M_DONTWAIT);
+ if ((m->m_flags & M_EXT) == 0) {
+ m_freem(m);
+ return NULL;
+ }
+ }
m->m_data += pad;
m->m_len = frame_length + (frame_length % sc->sc_data_width);
CVS commit: [netbsd-7-0] src/sys/dev/ic
Module Name:src
Committed By: snj
Date: Sat Aug 12 03:40:34 UTC 2017
Modified Files:
src/sys/dev/ic [netbsd-7-0]: dp83932.c
Log Message:
Pull up following revision(s) (requested by mrg in ticket #1472):
sys/dev/ic/dp83932.c: revision 1.41
Plug mbuf leak on MCLGET failure in sonic_rxintr.
>From Ilja Van Sprundel.
To generate a diff of this commit:
cvs rdiff -u -r1.36 -r1.36.8.1 src/sys/dev/ic/dp83932.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/ic/dp83932.c
diff -u src/sys/dev/ic/dp83932.c:1.36 src/sys/dev/ic/dp83932.c:1.36.8.1
--- src/sys/dev/ic/dp83932.c:1.36 Fri Oct 25 21:29:28 2013
+++ src/sys/dev/ic/dp83932.c Sat Aug 12 03:40:34 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: dp83932.c,v 1.36 2013/10/25 21:29:28 martin Exp $ */
+/* $NetBSD: dp83932.c,v 1.36.8.1 2017/08/12 03:40:34 snj Exp $ */
/*-
* Copyright (c) 2001 The NetBSD Foundation, Inc.
@@ -35,7 +35,7 @@
*/
#include
-__KERNEL_RCSID(0, "$NetBSD: dp83932.c,v 1.36 2013/10/25 21:29:28 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: dp83932.c,v 1.36.8.1 2017/08/12 03:40:34 snj Exp $");
#include
@@ -785,8 +785,10 @@ sonic_rxintr(struct sonic_softc *sc)
goto dropit;
if (len > (MHLEN - 2)) {
MCLGET(m, M_DONTWAIT);
-if ((m->m_flags & M_EXT) == 0)
+if ((m->m_flags & M_EXT) == 0) {
+ m_freem(m);
goto dropit;
+}
}
m->m_data += 2;
/*
CVS commit: [netbsd-7-0] src/sys/dev/ic
Module Name:src
Committed By: snj
Date: Sat Aug 12 03:29:51 UTC 2017
Modified Files:
src/sys/dev/ic [netbsd-7-0]: i82596.c
Log Message:
Pull up following revision(s) (requested by mrg in ticket #1471):
sys/dev/ic/i82596.c: revision 1.37
Null out sc_rx_mbuf[i] after m_freem to avoid double-free later.
>From Ilja Van Sprundel.
Also null out sc_tx_mbuf[i] after m_freem, out of paranoia.
XXX Not entirely clear to how tx mbufs are freed, but no way to test
this since it's ews4800mips- and hp700-only, so not keen to make any
more elaborate changes...
To generate a diff of this commit:
cvs rdiff -u -r1.31.4.1 -r1.31.4.1.2.1 src/sys/dev/ic/i82596.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/ic/i82596.c
diff -u src/sys/dev/ic/i82596.c:1.31.4.1 src/sys/dev/ic/i82596.c:1.31.4.1.2.1
--- src/sys/dev/ic/i82596.c:1.31.4.1 Sat Feb 21 19:27:49 2015
+++ src/sys/dev/ic/i82596.c Sat Aug 12 03:29:51 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: i82596.c,v 1.31.4.1 2015/02/21 19:27:49 martin Exp $ */
+/* $NetBSD: i82596.c,v 1.31.4.1.2.1 2017/08/12 03:29:51 snj Exp $ */
/*
* Copyright (c) 2003 Jochen Kunz.
@@ -43,7 +43,7 @@
*/
#include
-__KERNEL_RCSID(0, "$NetBSD: i82596.c,v 1.31.4.1 2015/02/21 19:27:49 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: i82596.c,v 1.31.4.1.2.1 2017/08/12 03:29:51 snj Exp $");
/* autoconfig and device stuff */
#include
@@ -754,6 +754,7 @@ iee_start(struct ifnet *ifp)
printf("%s: iee_start: can't allocate mbuf\n",
device_xname(sc->sc_dev));
m_freem(sc->sc_tx_mbuf[t]);
+sc->sc_tx_mbuf[t] = NULL;
t--;
continue;
}
@@ -763,6 +764,7 @@ iee_start(struct ifnet *ifp)
printf("%s: iee_start: can't allocate mbuf "
"cluster\n", device_xname(sc->sc_dev));
m_freem(sc->sc_tx_mbuf[t]);
+sc->sc_tx_mbuf[t] = NULL;
m_freem(m);
t--;
continue;
@@ -778,6 +780,7 @@ iee_start(struct ifnet *ifp)
printf("%s: iee_start: can't load TX DMA map\n",
device_xname(sc->sc_dev));
m_freem(sc->sc_tx_mbuf[t]);
+sc->sc_tx_mbuf[t] = NULL;
t--;
continue;
}
@@ -927,6 +930,7 @@ iee_init(struct ifnet *ifp)
printf("%s: iee_init: can't allocate mbuf"
" cluster\n", device_xname(sc->sc_dev));
m_freem(sc->sc_rx_mbuf[r]);
+sc->sc_rx_mbuf[r] = NULL;
err = 1;
break;
}
@@ -940,6 +944,7 @@ iee_init(struct ifnet *ifp)
printf("%s: iee_init: can't create RX "
"DMA map\n", device_xname(sc->sc_dev));
m_freem(sc->sc_rx_mbuf[r]);
+sc->sc_rx_mbuf[r] = NULL;
err = 1;
break;
}
@@ -949,6 +954,7 @@ iee_init(struct ifnet *ifp)
device_xname(sc->sc_dev));
bus_dmamap_destroy(sc->sc_dmat, sc->sc_rx_map[r]);
m_freem(sc->sc_rx_mbuf[r]);
+ sc->sc_rx_mbuf[r] = NULL;
err = 1;
break;
}
CVS commit: [netbsd-7-0] src/sys/dev/ic
Module Name:src
Committed By: martin
Date: Sun May 22 10:25:52 UTC 2016
Modified Files:
src/sys/dev/ic [netbsd-7-0]: gem.c
Log Message:
Pull up following revision(s) (requested by jdc in ticket #1170):
sys/dev/ic/gem.c: revision 1.105
PR kern/46083
Track the start of each packet, so that we set the "Start of Frame" bit in
all the relevant transmit descriptors when enqueing multiple packets.
Patch from Valery Ushakov, slightly modified by me to handle debug output.
Tested on macppc/6.x and sparc64/7.99.x.
To generate a diff of this commit:
cvs rdiff -u -r1.102 -r1.102.6.1 src/sys/dev/ic/gem.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/ic/gem.c
diff -u src/sys/dev/ic/gem.c:1.102 src/sys/dev/ic/gem.c:1.102.6.1
--- src/sys/dev/ic/gem.c:1.102 Sun Aug 10 16:44:35 2014
+++ src/sys/dev/ic/gem.c Sun May 22 10:25:52 2016
@@ -1,4 +1,4 @@
-/* $NetBSD: gem.c,v 1.102 2014/08/10 16:44:35 tls Exp $ */
+/* $NetBSD: gem.c,v 1.102.6.1 2016/05/22 10:25:52 martin Exp $ */
/*
*
@@ -37,7 +37,7 @@
*/
#include
-__KERNEL_RCSID(0, "$NetBSD: gem.c,v 1.102 2014/08/10 16:44:35 tls Exp $");
+__KERNEL_RCSID(0, "$NetBSD: gem.c,v 1.102.6.1 2016/05/22 10:25:52 martin Exp $");
#include "opt_inet.h"
@@ -1360,6 +1360,9 @@ gem_start(struct ifnet *ifp)
struct gem_txsoft *txs;
bus_dmamap_t dmamap;
int error, firsttx, nexttx = -1, lasttx = -1, ofree, seg;
+#ifdef GEM_DEBUG
+ int otxnext;
+#endif
uint64_t flags = 0;
if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
@@ -1370,10 +1373,12 @@ gem_start(struct ifnet *ifp)
* the first descriptor we'll use.
*/
ofree = sc->sc_txfree;
- firsttx = sc->sc_txnext;
+#ifdef GEM_DEBUG
+ otxnext = sc->sc_txnext;
+#endif
DPRINTF(sc, ("%s: gem_start: txfree %d, txnext %d\n",
- device_xname(sc->sc_dev), ofree, firsttx));
+ device_xname(sc->sc_dev), ofree, otxnext));
/*
* Loop through the send queue, setting up transmit descriptors
@@ -1478,7 +1483,8 @@ gem_start(struct ifnet *ifp)
/*
* Initialize the transmit descriptors.
*/
- for (nexttx = sc->sc_txnext, seg = 0;
+ firsttx = sc->sc_txnext;
+ for (nexttx = firsttx, seg = 0;
seg < dmamap->dm_nsegs;
seg++, nexttx = GEM_NEXTTX(nexttx)) {
@@ -1600,7 +1606,7 @@ gem_start(struct ifnet *ifp)
if (sc->sc_txfree != ofree) {
DPRINTF(sc, ("%s: packets enqueued, IC on %d, OWN on %d\n",
- device_xname(sc->sc_dev), lasttx, firsttx));
+ device_xname(sc->sc_dev), lasttx, otxnext));
/*
* The entire packet chain is set up.
* Kick the transmitter.
CVS commit: [netbsd-7-0] src/sys/dev/ic
Module Name:src Committed By: snj Date: Sat Dec 26 22:23:43 UTC 2015 Modified Files: src/sys/dev/ic [netbsd-7-0]: dwc_gmac_reg.h Log Message: Pull up following revision(s) (requested by jmcneill in ticket #1053): sys/dev/ic/dwc_gmac_reg.h: revision 1.15 Fix an off by one in the bit definition for RX store and forward mode. Pointed out by ganbold. While there add a few other bits of the same register. To generate a diff of this commit: cvs rdiff -u -r1.12.2.3 -r1.12.2.3.2.1 src/sys/dev/ic/dwc_gmac_reg.h Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/dev/ic/dwc_gmac_reg.h diff -u src/sys/dev/ic/dwc_gmac_reg.h:1.12.2.3 src/sys/dev/ic/dwc_gmac_reg.h:1.12.2.3.2.1 --- src/sys/dev/ic/dwc_gmac_reg.h:1.12.2.3 Tue Feb 3 08:11:21 2015 +++ src/sys/dev/ic/dwc_gmac_reg.h Sat Dec 26 22:23:43 2015 @@ -1,4 +1,4 @@ -/* $NetBSD: dwc_gmac_reg.h,v 1.12.2.3 2015/02/03 08:11:21 bouyer Exp $ */ +/* $NetBSD: dwc_gmac_reg.h,v 1.12.2.3.2.1 2015/12/26 22:23:43 snj Exp $ */ /*- * Copyright (c) 2013, 2014 The NetBSD Foundation, Inc. @@ -131,8 +131,13 @@ #define AWIN_GMAC_MII_IRQ __BIT(0) -#define GMAC_DMA_OP_RXSTOREFORWARD __BIT(24) /* start RX when a +#define GMAC_DMA_OP_DISABLECSDROP __BIT(26) /* disable dropping of + frames with TCP/IP + checksum errors */ +#define GMAC_DMA_OP_RXSTOREFORWARD __BIT(25) /* start RX when a full frame is available */ +#define GMAC_DMA_OP_DISABLERXFLUSH __BIT(24) /* Do not drop frames + when out of RX descr. */ #define GMAC_DMA_OP_TXSTOREFORWARD __BIT(21) /* start TX when a full frame is available */ #define GMAC_DMA_OP_FLUSHTX __BIT(20) /* flush TX fifo */
