vscsi.4, wsdisplay.4: add missing Dv tags to ioctl constants

[Scott Cheloha]

Hi,

Constants without the Dv styling stick out quite a bit in a browser.
This patch adds them to the ioctl constants in vscsi.4 and the two
lone constants without them in wsdisplay.4.

I also noticed that wsdisplay.4 is perhaps the only device driver
page not using Fa for its ioctl arguments, so it might make sense to
sneak in the missing Dvs as part of a patch that makes the switch
from Pq+Li to Fa (attached below with the vscsi.4 changes).

... but if that isn't the case, the following only adds the Dvs:

Index: share/man/man4/wsdisplay.4
===
RCS file: /cvs/src/share/man/man4/wsdisplay.4,v
retrieving revision 1.51
diff -u -p -r1.51 wsdisplay.4
--- share/man/man4/wsdisplay.4  1 Sep 2016 12:24:56 -   1.51
+++ share/man/man4/wsdisplay.4  12 Sep 2017 04:35:20 -
@@ -487,8 +487,8 @@ The
 field is set to the font resource to query.
 For the argument structure, see
 .Dv WSDISPLAYIO_LDFONT .
-.\" WSDISPLAYIO_DELFONT Pq Li struct wsdisplay_font
-.It WSDISPLAYIO_USEFONT Pq Li struct wsdisplay_font
+.\" Dv WSDISPLAYIO_DELFONT Pq Li struct wsdisplay_font
+.It Dv WSDISPLAYIO_USEFONT Pq Li struct wsdisplay_font
 Selects the font specified in the
 .Va name
 field.

--
Scott Cheloha

Index: share/man/man4/vscsi.4
===
RCS file: /cvs/src/share/man/man4/vscsi.4,v
retrieving revision 1.13
diff -u -p -r1.13 vscsi.4
--- share/man/man4/vscsi.4  28 Jun 2014 06:42:42 -  1.13
+++ share/man/man4/vscsi.4  12 Sep 2017 04:02:12 -
@@ -41,7 +41,7 @@ commands are provided to allow userland 
 them:
 .Pp
 .Bl -tag -width Ds -compact
-.It VSCSI_I2T Fa "struct vscsi_ioc_i2t *"
+.It Dv VSCSI_I2T Fa "struct vscsi_ioc_i2t *"
 Dequeue a SCSI command.
 If no SCSI commands are available to dequeue,
 .Xr ioctl 2
@@ -71,8 +71,8 @@ struct vscsi_ioc_i2t {
 };
 .Ed
 .Pp
-.It VSCSI_DATA_READ Fa "struct vscsi_ioc_data *"
-.It VSCSI_DATA_WRITE Fa "struct vscsi_ioc_data *"
+.It Dv VSCSI_DATA_READ Fa "struct vscsi_ioc_data *"
+.It Dv VSCSI_DATA_WRITE Fa "struct vscsi_ioc_data *"
 Read or write data in response to a SCSI command identified by tag.
 .Bd -literal -offset indent
 struct vscsi_ioc_data {
@@ -83,7 +83,7 @@ struct vscsi_ioc_data {
 };
 .Ed
 .Pp
-.It VSCSI_T2I Fa "struct vscsi_ioc_t2i *"
+.It Dv VSCSI_T2I Fa "struct vscsi_ioc_t2i *"
 Signal completion of a SCSI command identified by tag.
 .Bd -literal -offset indent
 struct vscsi_ioc_t2i {
@@ -98,8 +98,8 @@ struct vscsi_ioc_t2i {
 };
 .Ed
 .Pp
-.It VSCSI_REQPROBE Fa "struct vscsi_ioc_devevent *"
-.It VSCSI_REQDETACH Fa "struct vscsi_ioc_devevent *"
+.It Dv VSCSI_REQPROBE Fa "struct vscsi_ioc_devevent *"
+.It Dv VSCSI_REQDETACH Fa "struct vscsi_ioc_devevent *"
 Request a probe or a detach of the device at the addresses specified by the
 target and lun fields.
 .Bd -literal -offset indent
Index: share/man/man4/wsdisplay.4
===
RCS file: /cvs/src/share/man/man4/wsdisplay.4,v
retrieving revision 1.51
diff -u -p -r1.51 wsdisplay.4
--- share/man/man4/wsdisplay.4  1 Sep 2016 12:24:56 -   1.51
+++ share/man/man4/wsdisplay.4  12 Sep 2017 04:02:12 -
@@ -144,11 +144,11 @@ driver or by devices which use it.
 Their definitions are found in
 .In dev/wscons/wsconsio.h .
 .Bl -tag -width 4n
-.It Dv WSDISPLAYIO_GTYPE Pq Li u_int
+.It Dv WSDISPLAYIO_GTYPE Fa u_int
 Retrieve the type of the display.
 The list of types is in
 .In dev/wscons/wsconsio.h .
-.It Dv WSDISPLAYIO_GINFO Pq Li "struct wsdisplay_fbinfo"
+.It Dv WSDISPLAYIO_GINFO Fa "struct wsdisplay_fbinfo"
 Retrieve basic information about a framebuffer display.
 The returned structure is as follows:
 .Bd -literal -offset indent
@@ -174,7 +174,7 @@ indicates the number of color map entrie
 and
 .Dv WSDISPLAYIO_PUTCMAP .
 This call is likely to be unavailable on text-only displays.
-.It Dv WSDISPLAYIO_GETCMAP Pq Li "struct wsdisplay_cmap"
+.It Dv WSDISPLAYIO_GETCMAP Fa "struct wsdisplay_cmap"
 Retrieve the current color map from the display.
 This call needs the
 following structure set up beforehand:
@@ -206,7 +206,7 @@ color map.
 On all displays that support this call, values range from 0 for minimum
 intensity to 255 for maximum intensity, even if the display does not use
 eight bits internally to represent intensity.
-.It Dv WSDISPLAYIO_PUTCMAP Pq Li "struct wsdisplay_cmap"
+.It Dv WSDISPLAYIO_PUTCMAP Fa "struct wsdisplay_cmap"
 Change the display's color map.
 The argument structure is the same as for
 .Dv WSDISPLAYIO_GETCMAP ,
@@ -217,7 +217,7 @@ and
 .Va blue
 are taken as pointers to the values to use to set the color map.
 This call is not available on displays with fixed color maps.
-.It Dv WSDISPLAYIO_GVIDEO Pq Li u_int
+.It Dv WSDISPLAYIO_GVIDEO Fa u_int
 Get the current state of the display's video output.
 Possible values are:
 .Bl -tag -width 21n
@@ -226,12 +226,12 @@ The display is blanked.
 .It Dv 

Re: Open /dev/mem file failed when running as a root priviledge

[Ingo Schwarze]

Hi,

moving from misc@ to tech@ because you found a documentation bug.

Any OKs for the patch below?
  Ingo


Nan Xiao wrote on Tue, Sep 12, 2017 at 08:58:25AM +0800:

> I want to run dmidecode (https://github.com/mirror/dmidecode) on
> OpenBSD 6.1, but executing it will report following errors:
> 
> # ./dmidecode
> # dmidecode 3.1
> Scanning /dev/mem for entry point.
> /dev/mem: Operation not permitted
> 
> After single-step debugging, I find the error is from open /dev/mem:
> 
> if ((fd = open(filename, O_RDONLY)) == -1)
> {
>  if (errno != ENOENT)
>  perror(filename);
>  return NULL;
> }
> 
> I execute program as a root, and the attributes of `/dev/mem`:
> 
> # ls -lt /dev/mem
> crw-r-  1 root  kmem2,   0 Aug 25 18:38 /dev/mem



Index: lib/libc/gen/sysctl.3
===
RCS file: /cvs/src/lib/libc/gen/sysctl.3,v
retrieving revision 1.282
diff -u -p -r1.282 sysctl.3
--- lib/libc/gen/sysctl.3   10 Sep 2017 11:30:43 -  1.282
+++ lib/libc/gen/sysctl.3   12 Sep 2017 01:59:54 -
@@ -484,6 +484,8 @@ information.
 .Bl -tag -width "123456"
 .It Dv KERN_ALLOWKMEM Pq Va kern.allowkmem
 Allow userland processes access to
+.Pa /dev/mem
+and
 .Pa /dev/kmem .
 When running with a
 .Xr securelevel 7
Index: share/man/man7/securelevel.7
===
RCS file: /cvs/src/share/man/man7/securelevel.7,v
retrieving revision 1.29
diff -u -p -r1.29 securelevel.7
--- share/man/man7/securelevel.728 Sep 2016 17:58:17 -  1.29
+++ share/man/man7/securelevel.712 Sep 2017 01:59:54 -
@@ -66,7 +66,7 @@ securelevel may no longer be lowered exc
 .Pa /dev/mem
 and
 .Pa /dev/kmem
-may not be written to
+cannot be opened
 .It
 raw disk devices of mounted file systems are read-only
 .It
Index: share/man/man4/man4.alpha/mem.4
===
RCS file: /cvs/src/share/man/man4/man4.alpha/mem.4,v
retrieving revision 1.4
diff -u -p -r1.4 mem.4
--- share/man/man4/man4.alpha/mem.4 31 May 2007 19:19:53 -  1.4
+++ share/man/man4/man4.alpha/mem.4 12 Sep 2017 01:59:54 -
@@ -56,15 +56,18 @@ Kernel virtual memory is accessed via th
 in the same manner as
 .Pa /dev/mem .
 Only kernel virtual addresses that are currently mapped to memory are allowed.
-.Sh ALPHA
-On the
-.Tn alpha ,
-physical memory may be discontiguous;
+.Pp
+On the alpha, physical memory may be discontiguous;
 kernel virtual memory begins at
 .Li 0xfc23 .
 .Pp
-Writeability of these devices is controlled by the system
-.Xr securelevel 7 .
+Even with sufficient file system permissions,
+these devices can only be opened when the
+.Xr securelevel 7
+is insecure or when the
+.Va kern.allowkmem
+.Xr sysctl 3
+variable is set.
 .Sh FILES
 .Bl -tag -width /dev/kmem -compact
 .It /dev/mem
Index: share/man/man4/man4.amd64/mem.4
===
RCS file: /cvs/src/share/man/man4/man4.amd64/mem.4,v
retrieving revision 1.3
diff -u -p -r1.3 mem.4
--- share/man/man4/man4.amd64/mem.4 31 May 2007 19:19:53 -  1.3
+++ share/man/man4/man4.amd64/mem.4 12 Sep 2017 01:59:54 -
@@ -62,8 +62,13 @@ to
 The kernel virtual memory begins at address
 .Li 0x8000 .
 .Pp
-Writeability of these devices is controlled by the system
-.Xr securelevel 7 .
+Even with sufficient file system permissions,
+these devices can only be opened when the
+.Xr securelevel 7
+is insecure or when the
+.Va kern.allowkmem
+.Xr sysctl 3
+variable is set.
 .Sh FILES
 .Bl -tag -width Pa -compact
 .It Pa /dev/mem
Index: share/man/man4/man4.hppa/mem.4
===
RCS file: /cvs/src/share/man/man4/man4.hppa/mem.4,v
retrieving revision 1.2
diff -u -p -r1.2 mem.4
--- share/man/man4/man4.hppa/mem.4  31 May 2007 19:19:54 -  1.2
+++ share/man/man4/man4.hppa/mem.4  12 Sep 2017 01:59:54 -
@@ -50,13 +50,13 @@ Access to kernel virtual addresses not c
 On hppa, the physical memory range is always contiguous and starts at
 address 0; kernel virtual memory begins at address 0 as well.
 .Pp
-The writeability of the
-.Pa /dev/mem
-and
-.Pa /dev/kmem
-special files are controlled by the system
-.Xr securelevel 7 ,
-in addition to the filesystem permissions.
+Even with sufficient file system permissions,
+these devices can only be opened when the
+.Xr securelevel 7
+is insecure or when the
+.Va kern.allowkmem
+.Xr sysctl 3
+variable is set.
 .Sh FILES
 .Bl -tag -width /dev/kmem -compact
 .It Pa /dev/mem
Index: share/man/man4/man4.i386/mem.4
===
RCS file: /cvs/src/share/man/man4/man4.i386/mem.4,v
retrieving revision 1.9
diff -u -p -r1.9 mem.4
--- share/man/man4/man4.i386/mem.4  31 May 2007 19:19:55 -  1.9
+++ share/man/man4/man4.i386/mem.4  12 Sep 

Re: Remove DDB_STRUCTINFO

[David Gwynne]

> On 11 Sep 2017, at 20:01, Martin Pieuchot  wrote:
> 
> Now that dlg@ implemented 'show struct' using CTF, which makes it
> available in GENERIC kernel we can retire DDB_STRUCTINFO.
> 
> Diff below does that, ok?

it seems noone will miss the "show offset" command below, so ok.

> Index: ddb//db_command.c
> ===
> RCS file: /cvs/src/sys/ddb/db_command.c,v
> retrieving revision 1.76
> diff -u -p -r1.76 db_command.c
> --- ddb//db_command.c 6 Sep 2017 04:47:26 -   1.76
> +++ ddb//db_command.c 11 Sep 2017 09:03:36 -
> @@ -581,9 +581,6 @@ struct db_command db_show_cmds[] = {
>   { "nfsnode",db_nfsnode_print_cmd,   0,  NULL },
> #endif
>   { "object", db_object_print_cmd,0,  NULL },
> -#ifdef DDB_STRUCT
> - { "offset", db_struct_offset_cmd,   CS_OWN, NULL },
> -#endif
>   { "page",   db_page_print_cmd,  0,  NULL },
>   { "panic",  db_show_panic_cmd,  0,  NULL },
>   { "pool",   db_pool_print_cmd,  0,  NULL },

syslogd close *:514 sockets

[Alexander Bluhm]

Hi,

In the default configuration syslogd keeps two *:514 UDP sockets
open.

udp  0  0  *.514  *.*   
udp6 0  0  *.514  *.*   

Several people have asked me why they are in netstat output and
whether it is a security risk.  These sockets are used for sending
UDP packets if there is a UDP loghost in syslog.conf.  If syslogd
is started with -u, they can receive packets, otherwise they are
disabled with shutdown(SHUT_RD).

In case we do neither send nor receive, we can close them after
reading the config file.  This gives us a cleaner netstat output.

ok?

bluhm

Index: usr.sbin/syslogd/syslogd.c
===
RCS file: /data/mirror/openbsd/cvs/src/usr.sbin/syslogd/syslogd.c,v
retrieving revision 1.245
diff -u -p -r1.245 syslogd.c
--- usr.sbin/syslogd/syslogd.c  8 Aug 2017 14:23:23 -   1.245
+++ usr.sbin/syslogd/syslogd.c  11 Sep 2017 21:25:39 -
@@ -274,7 +274,7 @@ size_t  ctl_reply_offset = 0;   /* Number o
 char   *linebuf;
 int linesize;
 
-int fd_ctlconn, fd_udp, fd_udp6;
+int fd_ctlconn, fd_udp, fd_udp6, send_udp, send_udp6;
 struct event   *ev_ctlaccept, *ev_ctlread, *ev_ctlwrite;
 
 struct peer {
@@ -825,6 +825,20 @@ main(int argc, char *argv[])
event_add(ev_udp, NULL);
if (fd_udp6 != -1)
event_add(ev_udp6, NULL);
+   } else {
+   /*
+* If generic UDP file descriptors are used neither
+* for receiving nor for sending, close them.  Then
+* there is no useless *.514 in netstat.
+*/
+   if (fd_udp != -1 && !send_udp) {
+   close(fd_udp);
+   fd_udp = -1;
+   }
+   if (fd_udp6 != -1 && !send_udp6) {
+   close(fd_udp6);
+   fd_udp6 = -1;
+   }
}
for (i = 0; i < nbind; i++)
if (fd_bind[i] != -1)
@@ -2659,9 +2673,11 @@ cfline(char *line, char *progblock, char
if (strncmp(proto, "udp", 3) == 0) {
switch (f->f_un.f_forw.f_addr.ss_family) {
case AF_INET:
+   send_udp = 1;
f->f_file = fd_udp;
break;
case AF_INET6:
+   send_udp6 = 1;
f->f_file = fd_udp6;
break;
}

ifconfig: restore error during process_media_commands

[Dave Voutila]

Hi tech@,

Was reading through ifconfig.c today and noticed something odd (to me).

Very well could be my ignorance, but it looks like since rev 1.203
there's been an unused if statement around the ioctl call while
processing media commands. It very well could be by design to allow
execution to continue back in main(), but if so the if statement seems
unnecessary. (Since I don't know the intent here, I honestly can't
say.)

Here's a diff adding the original error back.

-Dave

Index: ifconfig.c
===
RCS file: /cvs/src/sbin/ifconfig/ifconfig.c,v
retrieving revision 1.348
diff -u -p -u -p -r1.348 ifconfig.c
--- ifconfig.c  29 Aug 2017 21:10:20 -  1.348
+++ ifconfig.c  11 Sep 2017 17:39:30 -
@@ -2449,7 +2449,7 @@ process_media_commands(void)
ifr.ifr_media = media_current;

if (ioctl(s, SIOCSIFMEDIA, (caddr_t)) < 0)
-   ;
+   err(1, "SIOCSIFMEDIA");
 }

 /* ARGSUSED */

Re: md5(1): use mono clock in time trial

[Todd C. Miller]

On Mon, 11 Sep 2017 16:19:02 +0200, Christian Weisgerber wrote:

> FreeBSD uses getrusage() to fetch the user time used.  I think that 
> makes more sense.
> 
> https://svnweb.freebsd.org/base/head/sbin/md5/md5.c?revision=307658=mark
> up#l293

Indeed.  There's no point in including system time in the measurement.

 - todd

Index: bin/md5/md5.c
===
RCS file: /cvs/src/bin/md5/md5.c,v
retrieving revision 1.91
diff -u -p -u -r1.91 md5.c
--- bin/md5/md5.c   22 May 2017 16:00:47 -  1.91
+++ bin/md5/md5.c   11 Sep 2017 15:48:29 -
@@ -24,6 +24,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -750,7 +751,8 @@ void
 digest_time(struct hash_list *hl, int times)
 {
struct hash_function *hf;
-   struct timeval start, stop, res;
+   struct rusage start, stop;
+   struct timeval res;
union ANY_CTX context;
u_int i;
u_char data[TEST_BLOCK_LEN];
@@ -769,13 +771,13 @@ digest_time(struct hash_list *hl, int ti
for (i = 0; i < TEST_BLOCK_LEN; i++)
data[i] = (u_char)(i & 0xff);
 
-   gettimeofday(, NULL);
+   getrusage(RUSAGE_SELF, );
hf->init();
for (i = 0; i < count; i++)
hf->update(, data, (size_t)TEST_BLOCK_LEN);
digest_end(hf, , digest, sizeof(digest), hf->base64);
-   gettimeofday(, NULL);
-   timersub(, , );
+   getrusage(RUSAGE_SELF, );
+   timersub(_utime, _utime, );
elapsed = res.tv_sec + res.tv_usec / 100.0;
 
(void)printf("\nDigest = %s\n", digest);

Re: malloc:check double free before canary

[Todd C. Miller]

On Mon, 11 Sep 2017 13:14:45 +0200, Otto Moerbeek wrote:

> A double free of a chunk corrupts the canary, but I prefer to see a
> double free error reported,

Makes sense.  OK millert@

 - todd

Re: md5(1): use mono clock in time trial

[Theo de Raadt]

> > On Sep 11, 2017, at 9:25 AM, Theo de Raadt  
> wrote:
> > 
> >> Scott Cheloha:
> >> 
> >>> Use a monotonic clock for the elapsed time trial.
> >> 
> >> FreeBSD uses getrusage() to fetch the user time used.  I think that 
> 
> >> makes more sense.
> >> 
> >> 
> https://svnweb.freebsd.org/base/head/sbin/md5/md5.c?revision=3D307658=markup#l293
> > 
> > The granularity is weak.  However you can stop such a process, then
> > let it continue, and get a reasonable assessment of the cputime it
> > actually used.  Which is perhaps closer to the stated goal.
> > 
> > Compared to that, CLOCK_MONOTONIC vs CLOCK_REALTIME vs whatever else
> > doesn't seem that valuable a change to me.  I'll note none of these
> > diffs come with a clear problem statement.
> 
> My thinking with the use of CLOCK_MONOTONIC was that it made the measured
> time immune to clock jumps and changes to the system time by root via
> settimeofday(2).
> 
> This gets us closer to what the time trial is trying to measure, even
> if root does something like resetting the system clock in the midst of
> the program's execution, which would make the output totally incorrect
> if we were using gettimeofday(2).

Huh?  Where do you get that?

It seems obvious the intent is performance of algorithm, rather than
"how busy is the machine".

Read naddy's comment again.

Re: md5(1): use mono clock in time trial

[Scott Cheloha]

> On Sep 11, 2017, at 9:25 AM, Theo de Raadt  wrote:
> 
>> Scott Cheloha:
>> 
>>> Use a monotonic clock for the elapsed time trial.
>> 
>> FreeBSD uses getrusage() to fetch the user time used.  I think that 
>> makes more sense.
>> 
>> https://svnweb.freebsd.org/base/head/sbin/md5/md5.c?revision=307658=markup#l293
> 
> The granularity is weak.  However you can stop such a process, then
> let it continue, and get a reasonable assessment of the cputime it
> actually used.  Which is perhaps closer to the stated goal.
> 
> Compared to that, CLOCK_MONOTONIC vs CLOCK_REALTIME vs whatever else
> doesn't seem that valuable a change to me.  I'll note none of these
> diffs come with a clear problem statement.

My thinking with the use of CLOCK_MONOTONIC was that it made the measured
time immune to clock jumps and changes to the system time by root via
settimeofday(2).

This gets us closer to what the time trial is trying to measure, even
if root does something like resetting the system clock in the midst of
the program's execution, which would make the output totally incorrect
if we were using gettimeofday(2).

--
Scott Cheloha

Re: md5(1): use mono clock in time trial

[Theo de Raadt]

> Scott Cheloha:
> 
> > Use a monotonic clock for the elapsed time trial.
> 
> FreeBSD uses getrusage() to fetch the user time used.  I think that 
> makes more sense.
> 
> https://svnweb.freebsd.org/base/head/sbin/md5/md5.c?revision=307658=markup#l293

The granularity is weak.  However you can stop such a process, then
let it continue, and get a reasonable assessment of the cputime it
actually used.  Which is perhaps closer to the stated goal.

Compared to that, CLOCK_MONOTONIC vs CLOCK_REALTIME vs whatever else
doesn't seem that valuable a change to me.  I'll note none of these
diffs come with a clear problem statement.

Re: md5(1): use mono clock in time trial

[Christian Weisgerber]

Scott Cheloha:

> Use a monotonic clock for the elapsed time trial.

FreeBSD uses getrusage() to fetch the user time used.  I think that 
makes more sense.

https://svnweb.freebsd.org/base/head/sbin/md5/md5.c?revision=307658=markup#l293

-- 
Christian "naddy" Weisgerber  na...@mips.inka.de

malloc:check double free before canary

[Otto Moerbeek]

Hi,

A double free of a chunk corrupts the canary, but I prefer to see a
double free error reported,

-Otto

Index: malloc.c
===
RCS file: /cvs/src/lib/libc/stdlib/malloc.c,v
retrieving revision 1.228
diff -u -p -r1.228 malloc.c
--- malloc.c10 Jul 2017 09:44:16 -  1.228
+++ malloc.c11 Sep 2017 11:07:05 -
@@ -1069,16 +1069,16 @@ find_chunknum(struct dir_info *d, struct
 
/* Find the chunk number on the page */
chunknum = ((uintptr_t)ptr & MALLOC_PAGEMASK) >> info->shift;
-   if (check && info->size > 0) {
-   validate_canary(d, ptr, info->bits[info->offset + chunknum],
-   info->size);
-   }
 
if ((uintptr_t)ptr & ((1U << (info->shift)) - 1))
wrterror(d, "modified chunk-pointer %p", ptr);
if (info->bits[chunknum / MALLOC_BITS] &
(1U << (chunknum % MALLOC_BITS)))
wrterror(d, "chunk is already free %p", ptr);
+   if (check && info->size > 0) {
+   validate_canary(d, ptr, info->bits[info->offset + chunknum],
+   info->size);
+   }
return chunknum;
 }
 

Re: Remove DDB_STRUCTINFO

[Jasper Lievisse Adriaanse]

On Mon, Sep 11, 2017 at 10:01:27AM +, Martin Pieuchot wrote:
> Now that dlg@ implemented 'show struct' using CTF, which makes it
> available in GENERIC kernel we can retire DDB_STRUCTINFO.
> 
> Diff below does that, ok?
I suggested the same dlg, so OK with me.

Cheers,
Jasper
 
> Index: conf/files
> ===
> RCS file: /cvs/src/sys/conf/files,v
> retrieving revision 1.651
> diff -u -p -r1.651 files
> --- conf/files11 Aug 2017 20:50:15 -  1.651
> +++ conf/files11 Sep 2017 09:56:09 -
> @@ -609,7 +609,6 @@ file ddb/db_lex.c ddb
>  file ddb/db_output.c ddb
>  file ddb/db_prof.c   ddb & ddbprof & !gprof
>  file ddb/db_run.cddb
> -file ddb/db_struct.c ddb & ddb_struct
>  file ddb/db_sym.cddb
>  file ddb/db_trap.c   ddb
>  file ddb/db_variables.c  ddb
> Index: ddb//db_command.c
> ===
> RCS file: /cvs/src/sys/ddb/db_command.c,v
> retrieving revision 1.76
> diff -u -p -r1.76 db_command.c
> --- ddb//db_command.c 6 Sep 2017 04:47:26 -   1.76
> +++ ddb//db_command.c 11 Sep 2017 09:03:36 -
> @@ -581,9 +581,6 @@ struct db_command db_show_cmds[] = {
>   { "nfsnode",db_nfsnode_print_cmd,   0,  NULL },
>  #endif
>   { "object", db_object_print_cmd,0,  NULL },
> -#ifdef DDB_STRUCT
> - { "offset", db_struct_offset_cmd,   CS_OWN, NULL },
> -#endif
>   { "page",   db_page_print_cmd,  0,  NULL },
>   { "panic",  db_show_panic_cmd,  0,  NULL },
>   { "pool",   db_pool_print_cmd,  0,  NULL },
> Index: ddb//db_struct.c
> ===
> RCS file: ddb//db_struct.c
> diff -N ddb//db_struct.c
> --- ddb//db_struct.c  1 Sep 2015 05:26:10 -   1.4
> +++ /dev/null 1 Jan 1970 00:00:00 -
> @@ -1,277 +0,0 @@
> -/*   $OpenBSD: db_struct.c,v 1.4 2015/09/01 05:26:10 jsg Exp $   */
> -
> -/*
> - * Copyright (c) 2009 Miodrag Vallat.
> - *
> - * Permission to use, copy, modify, and distribute this software for any
> - * purpose with or without fee is hereby granted, provided that the above
> - * copyright notice and this permission notice appear in all copies.
> - *
> - * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
> - * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
> - * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
> - * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
> - * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
> - * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
> - * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
> - */
> -
> -/*
> - * ddb routines to describe struct information
> - */
> -
> -#include 
> -#include 
> -
> -#include 
> -
> -#include 
> -#include 
> -#include 
> -#include 
> -#include 
> -#include 
> -#include 
> -
> -#include "db_structinfo.h"
> -
> -void db_struct_print_field(uint, int, db_expr_t);
> -
> -/*
> - * Flags to pass db_struct_printf().
> - */
> -
> -#define  DBSP_STRUCT_NAME0x01/* prepend struct name */
> -#define  DBSP_VALUE  0x02/* display field value */
> -
> -void
> -db_struct_print_field(uint fidx, int flags, db_expr_t baseaddr)
> -{
> - const struct ddb_field_info *field;
> - const struct ddb_struct_info *struc;
> - db_expr_t value;
> - uint tmp;
> - size_t namelen;
> - int width, basecol, curcol;
> - char tmpfmt[28];
> -
> - field = _field_info[fidx];
> - basecol = 0;
> -
> - if (ISSET(flags, DBSP_STRUCT_NAME)) {
> - struc = _struct_info[field->sidx];
> - namelen = strlen(ddb_structfield_strings + struc->name);
> - db_printf("%-30s ", ddb_structfield_strings + struc->name);
> - if (namelen > 30)
> - basecol += namelen + 1;
> - else
> - basecol += 30 + 1;
> - }
> -
> - namelen = strlen(ddb_structfield_strings + field->name);
> - if (field->nitems == 1) {
> - db_printf("%-30s ", ddb_structfield_strings + field->name);
> - if (namelen > 30)
> - basecol += namelen + 1;
> - else
> - basecol += 30 + 1;
> - } else {
> - width = 30 - 2;
> - tmp = field->nitems;
> - while (tmp != 0) {
> - width--;
> - tmp /= 10;
> - }
> - if (namelen >= width) {
> - db_printf("%s[%hu] ",
> - ddb_structfield_strings + field->name,
> - field->nitems);
> - basecol += 

Re: nm in free(): chunk canary corrupted 0x3e6e6845580 0x19@0x19

[Martin Pieuchot]

On 29/07/17(Sat) 21:56, Matthew Martin wrote:
> On Sat, Jul 29, 2017 at 10:43:23AM +0100, Stuart Henderson wrote:
> > I was just running nm over all of /usr/lib on a system with C in malloc
> > flags and ran into this.
> > 
> > $ MALLOC_OPTIONS=C nm -s libc.so.89.3.a
> 
> The bug seems to be in mmbr_name. First add one to len so there's space
> for the null with strlcpy. Second when advancing p to the end of the
> string, subtract one from len so that p points to the null not past the
> null. I believe the latter fixes the issue as the later *p = '\0'; wrote
> past the end of the allocation.

I agree with your analyse and your diff fixes the issue, ok mpi@

> diff --git nm.c nm.c
> index 5d2a1bfeb61..085c4152fc6 100644
> --- nm.c
> +++ nm.c
> @@ -310,7 +310,7 @@ mmbr_name(struct ar_hdr *arh, char **name, int baselen, 
> int *namelen, FILE *fp)
>   int len;
>  
>   i = atol(>ar_name[1]);
> - len = strlen([i]);
> + len = strlen([i]) + 1;
>   if (len > *namelen) {
>   p -= (long)*name;
>   if ((*name = realloc(*name, baselen+len)) == NULL)
> @@ -319,7 +319,7 @@ mmbr_name(struct ar_hdr *arh, char **name, int baselen, 
> int *namelen, FILE *fp)
>   p += (long)*name;
>   }
>   strlcpy(p, [i], len);
> - p += len;
> + p += len - 1;
>   } else
>  #ifdef AR_EFMT1
>   /*
> 

Remove DDB_STRUCTINFO

[Martin Pieuchot]

Now that dlg@ implemented 'show struct' using CTF, which makes it
available in GENERIC kernel we can retire DDB_STRUCTINFO.

Diff below does that, ok?

Index: conf/files
===
RCS file: /cvs/src/sys/conf/files,v
retrieving revision 1.651
diff -u -p -r1.651 files
--- conf/files  11 Aug 2017 20:50:15 -  1.651
+++ conf/files  11 Sep 2017 09:56:09 -
@@ -609,7 +609,6 @@ file ddb/db_lex.c   ddb
 file ddb/db_output.c   ddb
 file ddb/db_prof.c ddb & ddbprof & !gprof
 file ddb/db_run.c  ddb
-file ddb/db_struct.c   ddb & ddb_struct
 file ddb/db_sym.c  ddb
 file ddb/db_trap.c ddb
 file ddb/db_variables.cddb
Index: ddb//db_command.c
===
RCS file: /cvs/src/sys/ddb/db_command.c,v
retrieving revision 1.76
diff -u -p -r1.76 db_command.c
--- ddb//db_command.c   6 Sep 2017 04:47:26 -   1.76
+++ ddb//db_command.c   11 Sep 2017 09:03:36 -
@@ -581,9 +581,6 @@ struct db_command db_show_cmds[] = {
{ "nfsnode",db_nfsnode_print_cmd,   0,  NULL },
 #endif
{ "object", db_object_print_cmd,0,  NULL },
-#ifdef DDB_STRUCT
-   { "offset", db_struct_offset_cmd,   CS_OWN, NULL },
-#endif
{ "page",   db_page_print_cmd,  0,  NULL },
{ "panic",  db_show_panic_cmd,  0,  NULL },
{ "pool",   db_pool_print_cmd,  0,  NULL },
Index: ddb//db_struct.c
===
RCS file: ddb//db_struct.c
diff -N ddb//db_struct.c
--- ddb//db_struct.c1 Sep 2015 05:26:10 -   1.4
+++ /dev/null   1 Jan 1970 00:00:00 -
@@ -1,277 +0,0 @@
-/* $OpenBSD: db_struct.c,v 1.4 2015/09/01 05:26:10 jsg Exp $   */
-
-/*
- * Copyright (c) 2009 Miodrag Vallat.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * ddb routines to describe struct information
- */
-
-#include 
-#include 
-
-#include 
-
-#include 
-#include 
-#include 
-#include 
-#include 
-#include 
-#include 
-
-#include "db_structinfo.h"
-
-void   db_struct_print_field(uint, int, db_expr_t);
-
-/*
- * Flags to pass db_struct_printf().
- */
-
-#defineDBSP_STRUCT_NAME0x01/* prepend struct name */
-#defineDBSP_VALUE  0x02/* display field value */
-
-void
-db_struct_print_field(uint fidx, int flags, db_expr_t baseaddr)
-{
-   const struct ddb_field_info *field;
-   const struct ddb_struct_info *struc;
-   db_expr_t value;
-   uint tmp;
-   size_t namelen;
-   int width, basecol, curcol;
-   char tmpfmt[28];
-
-   field = _field_info[fidx];
-   basecol = 0;
-
-   if (ISSET(flags, DBSP_STRUCT_NAME)) {
-   struc = _struct_info[field->sidx];
-   namelen = strlen(ddb_structfield_strings + struc->name);
-   db_printf("%-30s ", ddb_structfield_strings + struc->name);
-   if (namelen > 30)
-   basecol += namelen + 1;
-   else
-   basecol += 30 + 1;
-   }
-
-   namelen = strlen(ddb_structfield_strings + field->name);
-   if (field->nitems == 1) {
-   db_printf("%-30s ", ddb_structfield_strings + field->name);
-   if (namelen > 30)
-   basecol += namelen + 1;
-   else
-   basecol += 30 + 1;
-   } else {
-   width = 30 - 2;
-   tmp = field->nitems;
-   while (tmp != 0) {
-   width--;
-   tmp /= 10;
-   }
-   if (namelen >= width) {
-   db_printf("%s[%hu] ",
-   ddb_structfield_strings + field->name,
-   field->nitems);
-   basecol += namelen + (30 - width) + 1;
-   } else {
-   db_printf("%s[%hu]%*s ",
-   ddb_structfield_strings + field->name,
-   field->nitems, width - (int)namelen, "");
-   /* namelen + 

post-clang Makefile.cross

[Martin Pieuchot]

Now that cc(1) is a link to clang(1) we need to explicitly set CC, CXX
and COMPILER_VERSION to cross-compile gcc4 architecture toolchains.

ok?

Index: Makefile.cross
===
RCS file: /cvs/src/Makefile.cross,v
retrieving revision 1.96
diff -u -p -r1.96 Makefile.cross
--- Makefile.cross  11 Aug 2017 19:36:37 -  1.96
+++ Makefile.cross  11 Sep 2017 09:22:30 -
@@ -83,10 +83,16 @@ CROSSGCC=   ${CROSSDIR}/.gcc_done
 .if !empty(CLANG_ARCH:M${_arch})
 COMPILER_VERSION=clang
 BUILD_CLANG=yes
+CC=clang
+CXX=clang++
 .elif !empty(GCC3_ARCH:M${_arch})
 COMPILER_VERSION=gcc3
+CC=gcc
+CXX=g++
 .else
 COMPILER_VERSION=gcc4
+CC=gcc
+CXX=g++
 .endif
 
 .if !empty(PIE_ARCH:M${_arch})
@@ -190,6 +196,7 @@ ${CROSSBINUTILS}:   ${CROSSINCLUDES}
PATH=${CROSSPATH} \
${MAKE} -f Makefile.bsd-wrapper depend && \
env CROSSDIR=${CROSSDIR} \
+   CC=${CC} CXX=${CXX} \
MAKEOBJDIR=obj.${MACHINE}.${TARGET} \
PIE_DEFAULT=${PIE_DEFAULT} \
TARGET_ARCH=${TARGET_ARCH} TARGET_CPU=${TARGET_CPU} \
@@ -228,7 +235,7 @@ ${CROSSGCC}:${CROSSBINUTILS}
MACHINE_ARCH=${TARGET_ARCH} \
${MAKE} obj)
(cd ${.CURDIR}/gnu/usr.bin/clang; \
-   CC=clang CXX=clang++ \
+   CC=${CC} CXX=${CXX} \
MAKEOBJDIR=obj.${MACHINE}.${TARGET} \
MACHINE_ARCH=${TARGET_ARCH} \
${MAKE} all)
@@ -258,6 +265,7 @@ ${CROSSGCC}:${CROSSBINUTILS}
MAKEOBJDIR=obj.${MACHINE}.${TARGET} \
TARGET_ARCH=${TARGET_ARCH} TARGET_CPU=${TARGET_CPU} \
CROSSDIR=${CROSSDIR} \
+   CC=${CC} CXX=${CXX} \
${MAKE} -f Makefile.bsd-wrapper all && \
env CROSSDIR=${CROSSDIR} DESTDIR=${CROSSDIR} 
MAKEOBJDIR=obj.${MACHINE}.${TARGET} \
PATH=${CROSSPATH} ${MAKE} -f Makefile.bsd-wrapper install)
@@ -286,6 +294,8 @@ ${CROSSGCC}:${CROSSBINUTILS}
PATH=${CROSSPATH} ${MAKE} depend  )
(cd ${.CURDIR}/gnu/usr.bin/cc; \
env CROSSDIR=${CROSSDIR} \
+   COMPILER_VERSION=${COMPILER_VERSION} \
+   CC=${CC} CXX=${CXX} \
PIE_DEFAULT=${PIE_DEFAULT} \
MAKEOBJDIR=obj.${MACHINE}.${TARGET} \
TARGET_ARCH=${TARGET_ARCH} TARGET_CPU=${TARGET_CPU} \
@@ -293,6 +303,7 @@ ${CROSSGCC}:${CROSSBINUTILS}
${MAKE} all )
(cd ${.CURDIR}/gnu/usr.bin/cc; \
env CROSSDIR=${CROSSDIR} DESTDIR=${CROSSDIR} \
+   COMPILER_VERSION=${COMPILER_VERSION} \
PIE_DEFAULT=${PIE_DEFAULT} \
MAKEOBJDIR=obj.${MACHINE}.${TARGET} \
TARGET_ARCH=${TARGET_ARCH} TARGET_CPU=${TARGET_CPU} \