CVS commit: [netbsd-5] src/sys/miscfs/umapfs
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 06:02:48 UTC 2014
Modified Files:
src/sys/miscfs/umapfs [netbsd-5]: umap_vfsops.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #1921):
sys/miscfs/umapfs/umap_vfsops.c: revision 1.94
1) 'error' is returned while it does not even hold an error code. Which
means that zero is returned, and the kernel keeps mounting (and it
probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
check to ensure they are greater than zero. Since they are used to
compute the size of two copyin's, a user can control the copied size
by giving a negative value (like 128-2^29), and thus overwrite kernel
memory.
Both triggerable from root only.
To generate a diff of this commit:
cvs rdiff -u -r1.80.6.1 -r1.80.6.2 src/sys/miscfs/umapfs/umap_vfsops.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/miscfs/umapfs/umap_vfsops.c
diff -u src/sys/miscfs/umapfs/umap_vfsops.c:1.80.6.1 src/sys/miscfs/umapfs/umap_vfsops.c:1.80.6.2
--- src/sys/miscfs/umapfs/umap_vfsops.c:1.80.6.1 Fri Apr 25 15:43:51 2014
+++ src/sys/miscfs/umapfs/umap_vfsops.c Wed Aug 27 06:02:48 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: umap_vfsops.c,v 1.80.6.1 2014/04/25 15:43:51 sborrill Exp $ */
+/* $NetBSD: umap_vfsops.c,v 1.80.6.2 2014/08/27 06:02:48 msaitoh Exp $ */
/*
* Copyright (c) 1992, 1993
@@ -41,7 +41,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: umap_vfsops.c,v 1.80.6.1 2014/04/25 15:43:51 sborrill Exp $);
+__KERNEL_RCSID(0, $NetBSD: umap_vfsops.c,v 1.80.6.2 2014/08/27 06:02:48 msaitoh Exp $);
#include sys/param.h
#include sys/systm.h
@@ -152,9 +152,10 @@ umapfs_mount(mp, path, data, data_len)
/*
* Now copy in the number of entries and maps for umap mapping.
*/
- if (args-nentries MAPFILEENTRIES || args-gnentries GMAPFILEENTRIES) {
+ if (args-nentries 0 || args-nentries MAPFILEENTRIES ||
+ args-gnentries 0 || args-gnentries GMAPFILEENTRIES) {
vput(lowerrootvp);
- return (error);
+ return (EINVAL);
}
amp-info_nentries = args-nentries;
CVS commit: [netbsd-5-1] src/sys/miscfs/umapfs
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 06:04:17 UTC 2014
Modified Files:
src/sys/miscfs/umapfs [netbsd-5-1]: umap_vfsops.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #1921):
sys/miscfs/umapfs/umap_vfsops.c: revision 1.94
1) 'error' is returned while it does not even hold an error code. Which
means that zero is returned, and the kernel keeps mounting (and it
probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
check to ensure they are greater than zero. Since they are used to
compute the size of two copyin's, a user can control the copied size
by giving a negative value (like 128-2^29), and thus overwrite kernel
memory.
Both triggerable from root only.
To generate a diff of this commit:
cvs rdiff -u -r1.80.12.1 -r1.80.12.2 src/sys/miscfs/umapfs/umap_vfsops.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/miscfs/umapfs/umap_vfsops.c
diff -u src/sys/miscfs/umapfs/umap_vfsops.c:1.80.12.1 src/sys/miscfs/umapfs/umap_vfsops.c:1.80.12.2
--- src/sys/miscfs/umapfs/umap_vfsops.c:1.80.12.1 Mon Apr 28 16:03:16 2014
+++ src/sys/miscfs/umapfs/umap_vfsops.c Wed Aug 27 06:04:17 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: umap_vfsops.c,v 1.80.12.1 2014/04/28 16:03:16 sborrill Exp $ */
+/* $NetBSD: umap_vfsops.c,v 1.80.12.2 2014/08/27 06:04:17 msaitoh Exp $ */
/*
* Copyright (c) 1992, 1993
@@ -41,7 +41,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: umap_vfsops.c,v 1.80.12.1 2014/04/28 16:03:16 sborrill Exp $);
+__KERNEL_RCSID(0, $NetBSD: umap_vfsops.c,v 1.80.12.2 2014/08/27 06:04:17 msaitoh Exp $);
#include sys/param.h
#include sys/systm.h
@@ -152,9 +152,10 @@ umapfs_mount(mp, path, data, data_len)
/*
* Now copy in the number of entries and maps for umap mapping.
*/
- if (args-nentries MAPFILEENTRIES || args-gnentries GMAPFILEENTRIES) {
+ if (args-nentries 0 || args-nentries MAPFILEENTRIES ||
+ args-gnentries 0 || args-gnentries GMAPFILEENTRIES) {
vput(lowerrootvp);
- return (error);
+ return (EINVAL);
}
amp-info_nentries = args-nentries;
CVS commit: [netbsd-5-2] src/sys/miscfs/umapfs
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 06:04:00 UTC 2014
Modified Files:
src/sys/miscfs/umapfs [netbsd-5-2]: umap_vfsops.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #1921):
sys/miscfs/umapfs/umap_vfsops.c: revision 1.94
1) 'error' is returned while it does not even hold an error code. Which
means that zero is returned, and the kernel keeps mounting (and it
probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
check to ensure they are greater than zero. Since they are used to
compute the size of two copyin's, a user can control the copied size
by giving a negative value (like 128-2^29), and thus overwrite kernel
memory.
Both triggerable from root only.
To generate a diff of this commit:
cvs rdiff -u -r1.80.16.1 -r1.80.16.2 src/sys/miscfs/umapfs/umap_vfsops.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/miscfs/umapfs/umap_vfsops.c
diff -u src/sys/miscfs/umapfs/umap_vfsops.c:1.80.16.1 src/sys/miscfs/umapfs/umap_vfsops.c:1.80.16.2
--- src/sys/miscfs/umapfs/umap_vfsops.c:1.80.16.1 Mon Apr 28 16:05:37 2014
+++ src/sys/miscfs/umapfs/umap_vfsops.c Wed Aug 27 06:04:00 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: umap_vfsops.c,v 1.80.16.1 2014/04/28 16:05:37 sborrill Exp $ */
+/* $NetBSD: umap_vfsops.c,v 1.80.16.2 2014/08/27 06:04:00 msaitoh Exp $ */
/*
* Copyright (c) 1992, 1993
@@ -41,7 +41,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: umap_vfsops.c,v 1.80.16.1 2014/04/28 16:05:37 sborrill Exp $);
+__KERNEL_RCSID(0, $NetBSD: umap_vfsops.c,v 1.80.16.2 2014/08/27 06:04:00 msaitoh Exp $);
#include sys/param.h
#include sys/systm.h
@@ -152,9 +152,10 @@ umapfs_mount(mp, path, data, data_len)
/*
* Now copy in the number of entries and maps for umap mapping.
*/
- if (args-nentries MAPFILEENTRIES || args-gnentries GMAPFILEENTRIES) {
+ if (args-nentries 0 || args-nentries MAPFILEENTRIES ||
+ args-gnentries 0 || args-gnentries GMAPFILEENTRIES) {
vput(lowerrootvp);
- return (error);
+ return (EINVAL);
}
amp-info_nentries = args-nentries;
CVS commit: [netbsd-5] src/sys/dev/pci
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:14:06 UTC 2014 Modified Files: src/sys/dev/pci [netbsd-5]: pci_usrreq.c Log Message: Pull up following revision(s) (requested by riastradh in ticket #1922): sys/dev/pci/pci_usrreq.c1.26 via patch Fix to make pci(4) reject unaligned configuration register reads and writes before feeding them to a kassert in pci_conf_read/write or to a trap in the hardware itself. To generate a diff of this commit: cvs rdiff -u -r1.16.6.3 -r1.16.6.4 src/sys/dev/pci/pci_usrreq.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/dev/pci/pci_usrreq.c diff -u src/sys/dev/pci/pci_usrreq.c:1.16.6.3 src/sys/dev/pci/pci_usrreq.c:1.16.6.4 --- src/sys/dev/pci/pci_usrreq.c:1.16.6.3 Tue Sep 15 06:48:49 2009 +++ src/sys/dev/pci/pci_usrreq.c Wed Aug 27 06:14:05 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: pci_usrreq.c,v 1.16.6.3 2009/09/15 06:48:49 snj Exp $ */ +/* $NetBSD: pci_usrreq.c,v 1.16.6.4 2014/08/27 06:14:05 msaitoh Exp $ */ /* * Copyright 2001 Wasabi Systems, Inc. @@ -40,7 +40,7 @@ */ #include sys/cdefs.h -__KERNEL_RCSID(0, $NetBSD: pci_usrreq.c,v 1.16.6.3 2009/09/15 06:48:49 snj Exp $); +__KERNEL_RCSID(0, $NetBSD: pci_usrreq.c,v 1.16.6.4 2014/08/27 06:14:05 msaitoh Exp $); #include sys/param.h #include sys/conf.h @@ -83,7 +83,7 @@ pciioctl(dev_t dev, u_long cmd, void *da case PCI_IOC_BDF_CFGREAD: case PCI_IOC_BDF_CFGWRITE: if (bdfr-bus 255 || bdfr-device = sc-sc_maxndevs || - bdfr-function 7) + bdfr-function 7 || ISSET(bdfr-cfgreg.reg, 3)) return (EINVAL); tag = pci_make_tag(sc-sc_pc, bdfr-bus, bdfr-device, bdfr-function);
CVS commit: [netbsd-5-2] src/sys/dev/pci
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:17:06 UTC 2014 Modified Files: src/sys/dev/pci [netbsd-5-2]: pci_usrreq.c Log Message: Pull up following revision(s) (requested by riastradh in ticket #1922): sys/dev/pci/pci_usrreq.c1.26 via patch Fix to make pci(4) reject unaligned configuration register reads and writes before feeding them to a kassert in pci_conf_read/write or to a trap in the hardware itself. To generate a diff of this commit: cvs rdiff -u -r1.16.6.3 -r1.16.6.3.6.1 src/sys/dev/pci/pci_usrreq.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/dev/pci/pci_usrreq.c diff -u src/sys/dev/pci/pci_usrreq.c:1.16.6.3 src/sys/dev/pci/pci_usrreq.c:1.16.6.3.6.1 --- src/sys/dev/pci/pci_usrreq.c:1.16.6.3 Tue Sep 15 06:48:49 2009 +++ src/sys/dev/pci/pci_usrreq.c Wed Aug 27 06:17:06 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: pci_usrreq.c,v 1.16.6.3 2009/09/15 06:48:49 snj Exp $ */ +/* $NetBSD: pci_usrreq.c,v 1.16.6.3.6.1 2014/08/27 06:17:06 msaitoh Exp $ */ /* * Copyright 2001 Wasabi Systems, Inc. @@ -40,7 +40,7 @@ */ #include sys/cdefs.h -__KERNEL_RCSID(0, $NetBSD: pci_usrreq.c,v 1.16.6.3 2009/09/15 06:48:49 snj Exp $); +__KERNEL_RCSID(0, $NetBSD: pci_usrreq.c,v 1.16.6.3.6.1 2014/08/27 06:17:06 msaitoh Exp $); #include sys/param.h #include sys/conf.h @@ -83,7 +83,7 @@ pciioctl(dev_t dev, u_long cmd, void *da case PCI_IOC_BDF_CFGREAD: case PCI_IOC_BDF_CFGWRITE: if (bdfr-bus 255 || bdfr-device = sc-sc_maxndevs || - bdfr-function 7) + bdfr-function 7 || ISSET(bdfr-cfgreg.reg, 3)) return (EINVAL); tag = pci_make_tag(sc-sc_pc, bdfr-bus, bdfr-device, bdfr-function);
CVS commit: [netbsd-5-1] src/sys/dev/pci
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:17:32 UTC 2014 Modified Files: src/sys/dev/pci [netbsd-5-1]: pci_usrreq.c Log Message: Pull up following revision(s) (requested by riastradh in ticket #1922): sys/dev/pci/pci_usrreq.c1.26 via patch Fix to make pci(4) reject unaligned configuration register reads and writes before feeding them to a kassert in pci_conf_read/write or to a trap in the hardware itself. To generate a diff of this commit: cvs rdiff -u -r1.16.6.3 -r1.16.6.3.2.1 src/sys/dev/pci/pci_usrreq.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/dev/pci/pci_usrreq.c diff -u src/sys/dev/pci/pci_usrreq.c:1.16.6.3 src/sys/dev/pci/pci_usrreq.c:1.16.6.3.2.1 --- src/sys/dev/pci/pci_usrreq.c:1.16.6.3 Tue Sep 15 06:48:49 2009 +++ src/sys/dev/pci/pci_usrreq.c Wed Aug 27 06:17:31 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: pci_usrreq.c,v 1.16.6.3 2009/09/15 06:48:49 snj Exp $ */ +/* $NetBSD: pci_usrreq.c,v 1.16.6.3.2.1 2014/08/27 06:17:31 msaitoh Exp $ */ /* * Copyright 2001 Wasabi Systems, Inc. @@ -40,7 +40,7 @@ */ #include sys/cdefs.h -__KERNEL_RCSID(0, $NetBSD: pci_usrreq.c,v 1.16.6.3 2009/09/15 06:48:49 snj Exp $); +__KERNEL_RCSID(0, $NetBSD: pci_usrreq.c,v 1.16.6.3.2.1 2014/08/27 06:17:31 msaitoh Exp $); #include sys/param.h #include sys/conf.h @@ -83,7 +83,7 @@ pciioctl(dev_t dev, u_long cmd, void *da case PCI_IOC_BDF_CFGREAD: case PCI_IOC_BDF_CFGWRITE: if (bdfr-bus 255 || bdfr-device = sc-sc_maxndevs || - bdfr-function 7) + bdfr-function 7 || ISSET(bdfr-cfgreg.reg, 3)) return (EINVAL); tag = pci_make_tag(sc-sc_pc, bdfr-bus, bdfr-device, bdfr-function);
CVS commit: [netbsd-5] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:57:36 UTC 2014 Modified Files: src/doc [netbsd-5]: CHANGES-5.3 Log Message: Ticket 1912, 1919, 1921 and 1922. To generate a diff of this commit: cvs rdiff -u -r1.1.2.66 -r1.1.2.67 src/doc/CHANGES-5.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-5.3 diff -u src/doc/CHANGES-5.3:1.1.2.66 src/doc/CHANGES-5.3:1.1.2.67 --- src/doc/CHANGES-5.3:1.1.2.66 Fri Aug 15 22:55:21 2014 +++ src/doc/CHANGES-5.3 Wed Aug 27 06:57:36 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.3,v 1.1.2.66 2014/08/15 22:55:21 riz Exp $ +# $NetBSD: CHANGES-5.3,v 1.1.2.67 2014/08/27 06:57:36 msaitoh Exp $ A complete list of changes from the NetBSD 5.2 release to the NetBSD 5.3 release: @@ -967,3 +967,30 @@ share/zoneinfo/zone1970.tabpatch and zone1970.dat). [apb, ticket #1917] +etc/namedb/root.cache patch +doc/3RDPARTY patch + + Sync root.cache with the latest -current (rev. 1.18). + [taca, ticket #1912] + +sbin/ccdconfig/ccdconfig.c 1.54 via patch +sys/dev/ccd.c 1.152 via patch +sys/dev/ccdvar.h1.34 via patch + + Switch size_t to uint64_t in appropriate places to ensure that ccd(4) + works with component and total sizes of 2TB. + Make kernel print device information when a ccd configured. + Fix some typos in comments. + [sborrill, ticket #1919] + +sys/miscfs/umapfs/umap_vfsops.c 1.94 + + Fix a overflow and a memory corruption bug in umapfs. + [maxv, ticket #1921] + +sys/dev/pci/pci_usrreq.c 1.26 via patch + + Fix to make pci(4) reject unaligned configuration register reads and + writes before feeding them to a kassert in pci_conf_read/write or to a + trap in the hardware itself. + [riastradh, ticket #1922]
CVS commit: [netbsd-5-2] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:58:14 UTC 2014 Modified Files: src/doc [netbsd-5-2]: CHANGES-5.2.3 Log Message: Ticket 1912, 1921 and 1922. To generate a diff of this commit: cvs rdiff -u -r1.1.2.15 -r1.1.2.16 src/doc/CHANGES-5.2.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-5.2.3 diff -u src/doc/CHANGES-5.2.3:1.1.2.15 src/doc/CHANGES-5.2.3:1.1.2.16 --- src/doc/CHANGES-5.2.3:1.1.2.15 Fri Aug 15 23:07:24 2014 +++ src/doc/CHANGES-5.2.3 Wed Aug 27 06:58:14 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.2.3,v 1.1.2.15 2014/08/15 23:07:24 riz Exp $ +# $NetBSD: CHANGES-5.2.3,v 1.1.2.16 2014/08/27 06:58:14 msaitoh Exp $ A complete list of changes from the NetBSD 5.2.2 release to the NetBSD 5.2.3 release: @@ -225,3 +225,20 @@ share/zoneinfo/zone1970.tabpatch and zone1970.dat). [apb, ticket #1917] +etc/namedb/root.cache patch +doc/3RDPARTY patch + + Sync root.cache with the latest -current (rev. 1.18). + [taca, ticket #1912] + +sys/miscfs/umapfs/umap_vfsops.c 1.94 + + Fix a overflow and a memory corruption bug in umapfs. + [maxv, ticket #1921] + +sys/dev/pci/pci_usrreq.c 1.26 via patch + + Fix to make pci(4) reject unaligned configuration register reads and + writes before feeding them to a kassert in pci_conf_read/write or to a + trap in the hardware itself. + [riastradh, ticket #1922]
CVS commit: [netbsd-5-1] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:58:38 UTC 2014 Modified Files: src/doc [netbsd-5-1]: CHANGES-5.1.5 Log Message: Ticket 1912, 1921 and 1922. To generate a diff of this commit: cvs rdiff -u -r1.1.2.14 -r1.1.2.15 src/doc/CHANGES-5.1.5 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-5.1.5 diff -u src/doc/CHANGES-5.1.5:1.1.2.14 src/doc/CHANGES-5.1.5:1.1.2.15 --- src/doc/CHANGES-5.1.5:1.1.2.14 Fri Aug 15 23:03:35 2014 +++ src/doc/CHANGES-5.1.5 Wed Aug 27 06:58:38 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.1.5,v 1.1.2.14 2014/08/15 23:03:35 riz Exp $ +# $NetBSD: CHANGES-5.1.5,v 1.1.2.15 2014/08/27 06:58:38 msaitoh Exp $ A complete list of changes from the NetBSD 5.1.4 release to the NetBSD 5.1.5 release: @@ -225,3 +225,20 @@ share/zoneinfo/zone1970.tabpatch and zone1970.dat). [apb, ticket #1917] +etc/namedb/root.cache patch +doc/3RDPARTY patch + + Sync root.cache with the latest -current (rev. 1.18). + [taca, ticket #1912] + +sys/miscfs/umapfs/umap_vfsops.c 1.94 + + Fix a overflow and a memory corruption bug in umapfs. + [maxv, ticket #1921] + +sys/dev/pci/pci_usrreq.c 1.26 via patch + + Fix to make pci(4) reject unaligned configuration register reads and + writes before feeding them to a kassert in pci_conf_read/write or to a + trap in the hardware itself. + [riastradh, ticket #1922]
CVS commit: [netbsd-5] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 07:39:04 UTC 2014 Modified Files: src/doc [netbsd-5]: CHANGES-5.3 Log Message: s/a/an/ To generate a diff of this commit: cvs rdiff -u -r1.1.2.67 -r1.1.2.68 src/doc/CHANGES-5.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-5.3 diff -u src/doc/CHANGES-5.3:1.1.2.67 src/doc/CHANGES-5.3:1.1.2.68 --- src/doc/CHANGES-5.3:1.1.2.67 Wed Aug 27 06:57:36 2014 +++ src/doc/CHANGES-5.3 Wed Aug 27 07:39:04 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.3,v 1.1.2.67 2014/08/27 06:57:36 msaitoh Exp $ +# $NetBSD: CHANGES-5.3,v 1.1.2.68 2014/08/27 07:39:04 msaitoh Exp $ A complete list of changes from the NetBSD 5.2 release to the NetBSD 5.3 release: @@ -985,7 +985,7 @@ sys/dev/ccdvar.h1.34 via patch sys/miscfs/umapfs/umap_vfsops.c 1.94 - Fix a overflow and a memory corruption bug in umapfs. + Fix an overflow and a memory corruption bug in umapfs. [maxv, ticket #1921] sys/dev/pci/pci_usrreq.c 1.26 via patch
CVS commit: [netbsd-5-2] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 07:39:22 UTC 2014 Modified Files: src/doc [netbsd-5-2]: CHANGES-5.2.3 Log Message: s/a/an/ To generate a diff of this commit: cvs rdiff -u -r1.1.2.16 -r1.1.2.17 src/doc/CHANGES-5.2.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-5.2.3 diff -u src/doc/CHANGES-5.2.3:1.1.2.16 src/doc/CHANGES-5.2.3:1.1.2.17 --- src/doc/CHANGES-5.2.3:1.1.2.16 Wed Aug 27 06:58:14 2014 +++ src/doc/CHANGES-5.2.3 Wed Aug 27 07:39:22 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.2.3,v 1.1.2.16 2014/08/27 06:58:14 msaitoh Exp $ +# $NetBSD: CHANGES-5.2.3,v 1.1.2.17 2014/08/27 07:39:22 msaitoh Exp $ A complete list of changes from the NetBSD 5.2.2 release to the NetBSD 5.2.3 release: @@ -233,7 +233,7 @@ doc/3RDPARTY patch sys/miscfs/umapfs/umap_vfsops.c 1.94 - Fix a overflow and a memory corruption bug in umapfs. + Fix an overflow and a memory corruption bug in umapfs. [maxv, ticket #1921] sys/dev/pci/pci_usrreq.c 1.26 via patch
CVS commit: [netbsd-5-1] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 07:39:40 UTC 2014 Modified Files: src/doc [netbsd-5-1]: CHANGES-5.1.5 Log Message: s/a/an/ To generate a diff of this commit: cvs rdiff -u -r1.1.2.15 -r1.1.2.16 src/doc/CHANGES-5.1.5 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-5.1.5 diff -u src/doc/CHANGES-5.1.5:1.1.2.15 src/doc/CHANGES-5.1.5:1.1.2.16 --- src/doc/CHANGES-5.1.5:1.1.2.15 Wed Aug 27 06:58:38 2014 +++ src/doc/CHANGES-5.1.5 Wed Aug 27 07:39:40 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.1.5,v 1.1.2.15 2014/08/27 06:58:38 msaitoh Exp $ +# $NetBSD: CHANGES-5.1.5,v 1.1.2.16 2014/08/27 07:39:40 msaitoh Exp $ A complete list of changes from the NetBSD 5.1.4 release to the NetBSD 5.1.5 release: @@ -233,7 +233,7 @@ doc/3RDPARTY patch sys/miscfs/umapfs/umap_vfsops.c 1.94 - Fix a overflow and a memory corruption bug in umapfs. + Fix an overflow and a memory corruption bug in umapfs. [maxv, ticket #1921] sys/dev/pci/pci_usrreq.c 1.26 via patch
CVS commit: src/usr.bin/make
Module Name:src
Committed By: christos
Date: Wed Aug 27 08:50:38 UTC 2014
Modified Files:
src/usr.bin/make: suff.c
Log Message:
Make .INVISIBLE nodes be ignored by suffix transformations.
To generate a diff of this commit:
cvs rdiff -u -r1.71 -r1.72 src/usr.bin/make/suff.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/usr.bin/make/suff.c
diff -u src/usr.bin/make/suff.c:1.71 src/usr.bin/make/suff.c:1.72
--- src/usr.bin/make/suff.c:1.71 Sat Aug 23 11:05:40 2014
+++ src/usr.bin/make/suff.c Wed Aug 27 04:50:38 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: suff.c,v 1.71 2014/08/23 15:05:40 christos Exp $ */
+/* $NetBSD: suff.c,v 1.72 2014/08/27 08:50:38 christos Exp $ */
/*
* Copyright (c) 1988, 1989, 1990, 1993
@@ -69,14 +69,14 @@
*/
#ifndef MAKE_NATIVE
-static char rcsid[] = $NetBSD: suff.c,v 1.71 2014/08/23 15:05:40 christos Exp $;
+static char rcsid[] = $NetBSD: suff.c,v 1.72 2014/08/27 08:50:38 christos Exp $;
#else
#include sys/cdefs.h
#ifndef lint
#if 0
static char sccsid[] = @(#)suff.c 8.4 (Berkeley) 3/21/94;
#else
-__RCSID($NetBSD: suff.c,v 1.71 2014/08/23 15:05:40 christos Exp $);
+__RCSID($NetBSD: suff.c,v 1.72 2014/08/27 08:50:38 christos Exp $);
#endif
#endif /* not lint */
#endif
@@ -1712,7 +1712,7 @@ static Src *
SuffFindThem(Lst possible, Lst cleanup)
{
Src *i, *result, *parent;
-char *temp;
+char *tf;
result = NULL;
/*
@@ -1734,6 +1734,7 @@ SuffFindThem(Lst possible, Lst cleanup)
* possibilities are exhausted.
*/
while ((i = (Src *)Lst_DeQueue(possible)) != NULL) {
+ GNode *n;
if (parent != i-parent) {
SuffDebugChain(i-parent);
parent = i-parent;
@@ -1744,20 +1745,22 @@ SuffFindThem(Lst possible, Lst cleanup)
* XXX: should only targets with commands be accepted? The node
* exists even if it only has had extra dependencies added.
*/
- if (Targ_FindNode(i-file, TARG_NOCREATE) != NULL) {
+ if ((n = Targ_FindNode(i-file, TARG_NOCREATE)) != NULL) {
#ifdef DEBUG_SRC
fprintf(debug_file, remove %x from %x\n, i, possible);
#endif
- result = i;
- break;
- }
-
- if ((temp = Dir_FindFile(i-file, i-suff-searchPath)) != NULL) {
+ SuffDebug(: Node %s %x: , i-file, n-type);
+ if ((n-type OP_INVISIBLE) == 0) {
+ result = i;
+ break;
+ }
+ } else if ((tf = Dir_FindFile(i-file, i-suff-searchPath)) != NULL) {
result = i;
#ifdef DEBUG_SRC
fprintf(debug_file, remove %x from %x\n, i, possible);
#endif
- free(temp);
+ SuffDebug(: File %s %s: , i-file, tf);
+ free(tf);
break;
}
CVS commit: src/sys/lib/libkern/arch/m68k
Module Name:src
Committed By: christos
Date: Wed Aug 27 08:51:37 UTC 2014
Modified Files:
src/sys/lib/libkern/arch/m68k: Makefile.inc
Log Message:
use .INVISIBLE to hide random.S, instead of extra rules.
To generate a diff of this commit:
cvs rdiff -u -r1.32 -r1.33 src/sys/lib/libkern/arch/m68k/Makefile.inc
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/lib/libkern/arch/m68k/Makefile.inc
diff -u src/sys/lib/libkern/arch/m68k/Makefile.inc:1.32 src/sys/lib/libkern/arch/m68k/Makefile.inc:1.33
--- src/sys/lib/libkern/arch/m68k/Makefile.inc:1.32 Tue Mar 18 14:20:43 2014
+++ src/sys/lib/libkern/arch/m68k/Makefile.inc Wed Aug 27 04:51:37 2014
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.inc,v 1.32 2014/03/18 18:20:43 riastradh Exp $
+# $NetBSD: Makefile.inc,v 1.33 2014/08/27 08:51:37 christos Exp $
SRCS+= bswap16.S bswap32.S bswap64.S
SRCS+= memcmp.S memcpy.S memmove.S memset.S
@@ -10,9 +10,5 @@ SRCS+= ffs.S
.if defined(MACHINE_ARCH) (${MACHINE_ARCH} == m68000)
SRCS+= mulsi3.S divsi3.S udivsi3.S modsi3.S umodsi3.S
-.endif
-.if defined(MACHINE_ARCH) ${MACHINE_ARCH} == m68k
-SRCS+= random.S
-.else
-random.o random.po random.pico random.d: random.c
+random.S: .INVISIBLE
.endif
CVS commit: src/sys/external/bsd/drm2/dist/drm/i915
Module Name:src
Committed By: riastradh
Date: Wed Aug 27 13:21:15 UTC 2014
Modified Files:
src/sys/external/bsd/drm2/dist/drm/i915: i915_irq.c
Log Message:
Fix i915 locking around error handling.
To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c
diff -u src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c:1.6 src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c:1.7
--- src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c:1.6 Wed Jul 16 20:56:25 2014
+++ src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c Wed Aug 27 13:21:15 2014
@@ -1099,7 +1099,9 @@ static void notify_ring(struct drm_devic
{
unsigned long flags;
spin_lock_irqsave(dev_priv-irq_lock, flags);
- /* XXX Set a flag under the lock... */
+ /*
+ * XXX Set a flag under the lock or push the lock out to callers.
+ */
DRM_SPIN_WAKEUP_ALL(ring-irq_queue, dev_priv-irq_lock);
spin_unlock_irqrestore(dev_priv-irq_lock, flags);
}
@@ -1315,8 +1317,10 @@ static void snb_gt_irq_handler(struct dr
if (gt_iir (GT_BLT_CS_ERROR_INTERRUPT |
GT_BSD_CS_ERROR_INTERRUPT |
GT_RENDER_CS_MASTER_ERROR_INTERRUPT)) {
+ spin_lock(dev_priv-irq_lock);
i915_handle_error(dev, false, GT error interrupt 0x%08x,
gt_iir);
+ spin_unlock(dev_priv-irq_lock);
}
if (gt_iir GT_PARITY_ERROR(dev))
@@ -1589,9 +1593,11 @@ static void gen6_rps_irq_handler(struct
notify_ring(dev_priv-dev, dev_priv-ring[VECS]);
if (pm_iir PM_VEBOX_CS_ERROR_INTERRUPT) {
+ spin_lock(dev_priv-irq_lock);
i915_handle_error(dev_priv-dev, false,
VEBOX CS error interrupt 0x%08x,
pm_iir);
+ spin_unlock(dev_priv-irq_lock);
}
}
}
@@ -2357,6 +2363,8 @@ void i915_handle_error(struct drm_device
va_list args;
char error_msg[80];
+ assert_spin_locked(dev_priv-irq_lock);
+
va_start(args, fmt);
vscnprintf(error_msg, sizeof(error_msg), fmt, args);
va_end(args);
@@ -2734,6 +2742,8 @@ static void i915_hangcheck_elapsed(unsig
if (!i915.enable_hangcheck)
return;
+ spin_lock(dev_priv-irq_lock);
+
for_each_ring(ring, dev_priv, i) {
u64 acthd;
u32 seqno;
@@ -2747,9 +2757,7 @@ static void i915_hangcheck_elapsed(unsig
if (ring-hangcheck.seqno == seqno) {
if (ring_idle(ring, seqno)) {
ring-hangcheck.action = HANGCHECK_IDLE;
-
#ifdef __NetBSD__
-spin_lock(dev_priv-irq_lock);
if (DRM_SPIN_WAITERS_P(ring-irq_queue,
dev_priv-irq_lock)) {
if (!test_and_set_bit(ring-id, dev_priv-gpu_error.missed_irq_rings)) {
@@ -2765,7 +2773,6 @@ static void i915_hangcheck_elapsed(unsig
} else {
busy = false;
}
-spin_unlock(dev_priv-irq_lock);
#else
if (waitqueue_active(ring-irq_queue)) {
/* Issue a wake-up to catch stuck h/w. */
@@ -2845,6 +2852,8 @@ static void i915_hangcheck_elapsed(unsig
if (rings_hung)
return i915_handle_error(dev, true, Ring hung);
+ spin_unlock(dev_priv-irq_lock);
+
if (busy_count)
/* Reset timer case chip hangs without another request
* being added */
CVS commit: [netbsd-5] src/crypto/dist/openssl
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 13:29:56 UTC 2014
Modified Files:
src/crypto/dist/openssl/crypto/asn1 [netbsd-5]: a_object.c asn1.h
asn1_err.c
src/crypto/dist/openssl/crypto/objects [netbsd-5]: obj_dat.c
src/crypto/dist/openssl/ssl [netbsd-5]: d1_both.c s23_srvr.c s3_clnt.c
t1_lib.c
Log Message:
Pull up following revision(s) (requested by spz in ticket #1918):
crypto/dist/openssl/crypto/asn1/a_object.c patch
crypto/dist/openssl/crypto/asn1/asn1.h patch
crypto/dist/openssl/crypto/asn1/asn1_err.c patch
crypto/dist/openssl/crypto/objects/obj_dat.cpatch
crypto/dist/openssl/ssl/d1_both.c patch
crypto/dist/openssl/ssl/s23_srvr.c patch
crypto/dist/openssl/ssl/s3_clnt.c patch
crypto/dist/openssl/ssl/t1_lib.cpatch
Patches for the following vulnerabilities:
Information leak in pretty printing functions (CVE-2014-3508)
Double Free when processing DTLS packets (CVE-2014-3505)
DTLS memory exhaustion (CVE-2014-3506)
DTLS memory leak from zero-length fragments (CVE-2014-3507)
OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510)
Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509)
OpenSSL TLS protocol downgrade attack (CVE-2014-3511)
backported from the recent 1.0.1i OpenSSL release.
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.7 -r1.1.1.7.4.1 \
src/crypto/dist/openssl/crypto/asn1/a_object.c
cvs rdiff -u -r1.9.4.1 -r1.9.4.2 src/crypto/dist/openssl/crypto/asn1/asn1.h
cvs rdiff -u -r1.1.1.8.4.1 -r1.1.1.8.4.2 \
src/crypto/dist/openssl/crypto/asn1/asn1_err.c
cvs rdiff -u -r1.10 -r1.10.4.1 \
src/crypto/dist/openssl/crypto/objects/obj_dat.c
cvs rdiff -u -r1.3.4.3 -r1.3.4.4 src/crypto/dist/openssl/ssl/d1_both.c
cvs rdiff -u -r1.6 -r1.6.4.1 src/crypto/dist/openssl/ssl/s23_srvr.c
cvs rdiff -u -r1.12.4.4 -r1.12.4.5 src/crypto/dist/openssl/ssl/s3_clnt.c
cvs rdiff -u -r1.2.4.3 -r1.2.4.4 src/crypto/dist/openssl/ssl/t1_lib.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/crypto/dist/openssl/crypto/asn1/a_object.c
diff -u src/crypto/dist/openssl/crypto/asn1/a_object.c:1.1.1.7 src/crypto/dist/openssl/crypto/asn1/a_object.c:1.1.1.7.4.1
--- src/crypto/dist/openssl/crypto/asn1/a_object.c:1.1.1.7 Fri May 9 21:34:16 2008
+++ src/crypto/dist/openssl/crypto/asn1/a_object.c Wed Aug 27 13:29:56 2014
@@ -95,7 +95,7 @@ int a2d_ASN1_OBJECT(unsigned char *out,
if (num == 0)
return(0);
else if (num == -1)
- num=strlen(buf);
+ num=(int)strlen(buf);
p=buf;
c= *(p++);
@@ -239,7 +239,7 @@ int i2a_ASN1_OBJECT(BIO *bp, ASN1_OBJECT
if ((a == NULL) || (a-data == NULL))
return(BIO_write(bp,NULL,4));
- i=i2t_ASN1_OBJECT(buf,sizeof buf,a);
+ i=i2t_ASN1_OBJECT(buf,(int)sizeof buf,a);
if (i (int)(sizeof(buf) - 1))
{
p = OPENSSL_malloc(i + 1);
@@ -289,7 +289,21 @@ ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT
ASN1_OBJECT *ret=NULL;
const unsigned char *p;
unsigned char *data;
- int i;
+ int i, length;
+
+ /* Sanity check OID encoding.
+ * Need at least one content octet.
+ * MSB must be clear in the last octet.
+ * can't have leading 0x80 in subidentifiers, see: X.690 8.19.2
+ */
+ if (len = 0 || len INT_MAX || pp == NULL || (p = *pp) == NULL ||
+ p[len - 1] 0x80)
+ {
+ ASN1err(ASN1_F_C2I_ASN1_OBJECT,ASN1_R_INVALID_OBJECT_ENCODING);
+ return NULL;
+ }
+ /* Now 0 len = INT_MAX, so the cast is safe. */
+ length = (int)len;
/* only the ASN1_OBJECTs from the 'table' will have values
* for -sn or -ln */
@@ -300,28 +314,27 @@ ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT
}
else ret=(*a);
- p= *pp;
/* detach data from object */
data = (unsigned char *)ret-data;
ret-data = NULL;
/* once detached we can change it */
- if ((data == NULL) || (ret-length len))
+ if ((data == NULL) || (ret-length length))
{
ret-length=0;
if (data != NULL) OPENSSL_free(data);
- data=(unsigned char *)OPENSSL_malloc(len ? (int)len : 1);
+ data=(unsigned char *)OPENSSL_malloc(length);
if (data == NULL)
{ i=ERR_R_MALLOC_FAILURE; goto err; }
ret-flags|=ASN1_OBJECT_FLAG_DYNAMIC_DATA;
}
- memcpy(data,p,(int)len);
+ memcpy(data,p,length);
/* reattach data to object, after which it remains const */
ret-data =data;
- ret-length=(int)len;
+ ret-length=length;
ret-sn=NULL;
ret-ln=NULL;
/* ret-flags=ASN1_OBJECT_FLAG_DYNAMIC; we know it is dynamic */
- p+=len;
+ p+=length;
if (a != NULL) (*a)=ret;
*pp=p;
Index: src/crypto/dist/openssl/crypto/asn1/asn1.h
diff -u src/crypto/dist/openssl/crypto/asn1/asn1.h:1.9.4.1 src/crypto/dist/openssl/crypto/asn1/asn1.h:1.9.4.2
--- src/crypto/dist/openssl/crypto/asn1/asn1.h:1.9.4.1 Mon Mar 30 16:29:38 2009
+++ src/crypto/dist/openssl/crypto/asn1/asn1.h Wed Aug 27 13:29:56 2014
@@ -1314,6 +1314,7 @@
CVS commit: [netbsd-5-2] src/crypto/dist/openssl
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 13:30:49 UTC 2014
Modified Files:
src/crypto/dist/openssl/crypto/asn1 [netbsd-5-2]: a_object.c asn1.h
asn1_err.c
src/crypto/dist/openssl/crypto/objects [netbsd-5-2]: obj_dat.c
src/crypto/dist/openssl/ssl [netbsd-5-2]: d1_both.c s23_srvr.c
s3_clnt.c t1_lib.c
Log Message:
Pull up following revision(s) (requested by spz in ticket #1918):
crypto/dist/openssl/crypto/asn1/a_object.c patch
crypto/dist/openssl/crypto/asn1/asn1.h patch
crypto/dist/openssl/crypto/asn1/asn1_err.c patch
crypto/dist/openssl/crypto/objects/obj_dat.cpatch
crypto/dist/openssl/ssl/d1_both.c patch
crypto/dist/openssl/ssl/s23_srvr.c patch
crypto/dist/openssl/ssl/s3_clnt.c patch
crypto/dist/openssl/ssl/t1_lib.cpatch
Patches for the following vulnerabilities:
Information leak in pretty printing functions (CVE-2014-3508)
Double Free when processing DTLS packets (CVE-2014-3505)
DTLS memory exhaustion (CVE-2014-3506)
DTLS memory leak from zero-length fragments (CVE-2014-3507)
OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510)
Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509)
OpenSSL TLS protocol downgrade attack (CVE-2014-3511)
backported from the recent 1.0.1i OpenSSL release.
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.7 -r1.1.1.7.2.1 \
src/crypto/dist/openssl/crypto/asn1/a_object.c
cvs rdiff -u -r1.9.4.1 -r1.9.4.1.10.1 \
src/crypto/dist/openssl/crypto/asn1/asn1.h
cvs rdiff -u -r1.1.1.8.4.1 -r1.1.1.8.4.1.10.1 \
src/crypto/dist/openssl/crypto/asn1/asn1_err.c
cvs rdiff -u -r1.10 -r1.10.2.1 \
src/crypto/dist/openssl/crypto/objects/obj_dat.c
cvs rdiff -u -r1.3.4.2.6.1 -r1.3.4.2.6.2 \
src/crypto/dist/openssl/ssl/d1_both.c
cvs rdiff -u -r1.6 -r1.6.2.1 src/crypto/dist/openssl/ssl/s23_srvr.c
cvs rdiff -u -r1.12.4.3.4.1 -r1.12.4.3.4.2 \
src/crypto/dist/openssl/ssl/s3_clnt.c
cvs rdiff -u -r1.2.4.3 -r1.2.4.3.2.1 src/crypto/dist/openssl/ssl/t1_lib.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/crypto/dist/openssl/crypto/asn1/a_object.c
diff -u src/crypto/dist/openssl/crypto/asn1/a_object.c:1.1.1.7 src/crypto/dist/openssl/crypto/asn1/a_object.c:1.1.1.7.2.1
--- src/crypto/dist/openssl/crypto/asn1/a_object.c:1.1.1.7 Fri May 9 21:34:16 2008
+++ src/crypto/dist/openssl/crypto/asn1/a_object.c Wed Aug 27 13:30:49 2014
@@ -95,7 +95,7 @@ int a2d_ASN1_OBJECT(unsigned char *out,
if (num == 0)
return(0);
else if (num == -1)
- num=strlen(buf);
+ num=(int)strlen(buf);
p=buf;
c= *(p++);
@@ -239,7 +239,7 @@ int i2a_ASN1_OBJECT(BIO *bp, ASN1_OBJECT
if ((a == NULL) || (a-data == NULL))
return(BIO_write(bp,NULL,4));
- i=i2t_ASN1_OBJECT(buf,sizeof buf,a);
+ i=i2t_ASN1_OBJECT(buf,(int)sizeof buf,a);
if (i (int)(sizeof(buf) - 1))
{
p = OPENSSL_malloc(i + 1);
@@ -289,7 +289,21 @@ ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT
ASN1_OBJECT *ret=NULL;
const unsigned char *p;
unsigned char *data;
- int i;
+ int i, length;
+
+ /* Sanity check OID encoding.
+ * Need at least one content octet.
+ * MSB must be clear in the last octet.
+ * can't have leading 0x80 in subidentifiers, see: X.690 8.19.2
+ */
+ if (len = 0 || len INT_MAX || pp == NULL || (p = *pp) == NULL ||
+ p[len - 1] 0x80)
+ {
+ ASN1err(ASN1_F_C2I_ASN1_OBJECT,ASN1_R_INVALID_OBJECT_ENCODING);
+ return NULL;
+ }
+ /* Now 0 len = INT_MAX, so the cast is safe. */
+ length = (int)len;
/* only the ASN1_OBJECTs from the 'table' will have values
* for -sn or -ln */
@@ -300,28 +314,27 @@ ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT
}
else ret=(*a);
- p= *pp;
/* detach data from object */
data = (unsigned char *)ret-data;
ret-data = NULL;
/* once detached we can change it */
- if ((data == NULL) || (ret-length len))
+ if ((data == NULL) || (ret-length length))
{
ret-length=0;
if (data != NULL) OPENSSL_free(data);
- data=(unsigned char *)OPENSSL_malloc(len ? (int)len : 1);
+ data=(unsigned char *)OPENSSL_malloc(length);
if (data == NULL)
{ i=ERR_R_MALLOC_FAILURE; goto err; }
ret-flags|=ASN1_OBJECT_FLAG_DYNAMIC_DATA;
}
- memcpy(data,p,(int)len);
+ memcpy(data,p,length);
/* reattach data to object, after which it remains const */
ret-data =data;
- ret-length=(int)len;
+ ret-length=length;
ret-sn=NULL;
ret-ln=NULL;
/* ret-flags=ASN1_OBJECT_FLAG_DYNAMIC; we know it is dynamic */
- p+=len;
+ p+=length;
if (a != NULL) (*a)=ret;
*pp=p;
Index: src/crypto/dist/openssl/crypto/asn1/asn1.h
diff -u src/crypto/dist/openssl/crypto/asn1/asn1.h:1.9.4.1 src/crypto/dist/openssl/crypto/asn1/asn1.h:1.9.4.1.10.1
--- src/crypto/dist/openssl/crypto/asn1/asn1.h:1.9.4.1 Mon Mar 30 16:29:38 2009
+++
CVS commit: src/tests/lib/librumphijack
Module Name:src
Committed By: gson
Date: Wed Aug 27 13:32:16 UTC 2014
Modified Files:
src/tests/lib/librumphijack: t_asyncio.sh
Log Message:
The 4 second timeout of the invafd test case is not always enough when
running under qemu; increase it to 10 seconds.
To generate a diff of this commit:
cvs rdiff -u -r1.3 -r1.4 src/tests/lib/librumphijack/t_asyncio.sh
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/tests/lib/librumphijack/t_asyncio.sh
diff -u src/tests/lib/librumphijack/t_asyncio.sh:1.3 src/tests/lib/librumphijack/t_asyncio.sh:1.4
--- src/tests/lib/librumphijack/t_asyncio.sh:1.3 Sun Feb 20 23:45:46 2011
+++ src/tests/lib/librumphijack/t_asyncio.sh Wed Aug 27 13:32:16 2014
@@ -1,4 +1,4 @@
-# $NetBSD: t_asyncio.sh,v 1.3 2011/02/20 23:45:46 pooka Exp $
+# $NetBSD: t_asyncio.sh,v 1.4 2014/08/27 13:32:16 gson Exp $
#
# Copyright (c) 2011 The NetBSD Foundation, Inc.
# All rights reserved.
@@ -70,7 +70,7 @@ atf_test_case invafd cleanup
invafd_head()
{
atf_set descr poll on invalid rump fd
- atf_set timeout 4
+ atf_set timeout 10
}
invafd_body()
CVS commit: [netbsd-5-1] src/crypto/dist/openssl
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 13:32:35 UTC 2014
Modified Files:
src/crypto/dist/openssl/crypto/asn1 [netbsd-5-1]: a_object.c asn1.h
asn1_err.c
src/crypto/dist/openssl/crypto/objects [netbsd-5-1]: obj_dat.c
src/crypto/dist/openssl/ssl [netbsd-5-1]: d1_both.c s23_srvr.c
s3_clnt.c t1_lib.c
Log Message:
Pull up following revision(s) (requested by spz in ticket #1918):
crypto/dist/openssl/crypto/asn1/a_object.c patch
crypto/dist/openssl/crypto/asn1/asn1.h patch
crypto/dist/openssl/crypto/asn1/asn1_err.c patch
crypto/dist/openssl/crypto/objects/obj_dat.cpatch
crypto/dist/openssl/ssl/d1_both.c patch
crypto/dist/openssl/ssl/s23_srvr.c patch
crypto/dist/openssl/ssl/s3_clnt.c patch
crypto/dist/openssl/ssl/t1_lib.cpatch
Patches for the following vulnerabilities:
Information leak in pretty printing functions (CVE-2014-3508)
Double Free when processing DTLS packets (CVE-2014-3505)
DTLS memory exhaustion (CVE-2014-3506)
DTLS memory leak from zero-length fragments (CVE-2014-3507)
OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510)
Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509)
OpenSSL TLS protocol downgrade attack (CVE-2014-3511)
backported from the recent 1.0.1i OpenSSL release.
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.7 -r1.1.1.7.12.1 \
src/crypto/dist/openssl/crypto/asn1/a_object.c
cvs rdiff -u -r1.9.4.1 -r1.9.4.1.6.1 \
src/crypto/dist/openssl/crypto/asn1/asn1.h
cvs rdiff -u -r1.1.1.8.4.1 -r1.1.1.8.4.1.6.1 \
src/crypto/dist/openssl/crypto/asn1/asn1_err.c
cvs rdiff -u -r1.10 -r1.10.12.1 \
src/crypto/dist/openssl/crypto/objects/obj_dat.c
cvs rdiff -u -r1.3.4.2.2.1 -r1.3.4.2.2.2 \
src/crypto/dist/openssl/ssl/d1_both.c
cvs rdiff -u -r1.6 -r1.6.12.1 src/crypto/dist/openssl/ssl/s23_srvr.c
cvs rdiff -u -r1.12.4.2.2.2 -r1.12.4.2.2.3 \
src/crypto/dist/openssl/ssl/s3_clnt.c
cvs rdiff -u -r1.2.12.3 -r1.2.12.4 src/crypto/dist/openssl/ssl/t1_lib.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/crypto/dist/openssl/crypto/asn1/a_object.c
diff -u src/crypto/dist/openssl/crypto/asn1/a_object.c:1.1.1.7 src/crypto/dist/openssl/crypto/asn1/a_object.c:1.1.1.7.12.1
--- src/crypto/dist/openssl/crypto/asn1/a_object.c:1.1.1.7 Fri May 9 21:34:16 2008
+++ src/crypto/dist/openssl/crypto/asn1/a_object.c Wed Aug 27 13:32:35 2014
@@ -95,7 +95,7 @@ int a2d_ASN1_OBJECT(unsigned char *out,
if (num == 0)
return(0);
else if (num == -1)
- num=strlen(buf);
+ num=(int)strlen(buf);
p=buf;
c= *(p++);
@@ -239,7 +239,7 @@ int i2a_ASN1_OBJECT(BIO *bp, ASN1_OBJECT
if ((a == NULL) || (a-data == NULL))
return(BIO_write(bp,NULL,4));
- i=i2t_ASN1_OBJECT(buf,sizeof buf,a);
+ i=i2t_ASN1_OBJECT(buf,(int)sizeof buf,a);
if (i (int)(sizeof(buf) - 1))
{
p = OPENSSL_malloc(i + 1);
@@ -289,7 +289,21 @@ ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT
ASN1_OBJECT *ret=NULL;
const unsigned char *p;
unsigned char *data;
- int i;
+ int i, length;
+
+ /* Sanity check OID encoding.
+ * Need at least one content octet.
+ * MSB must be clear in the last octet.
+ * can't have leading 0x80 in subidentifiers, see: X.690 8.19.2
+ */
+ if (len = 0 || len INT_MAX || pp == NULL || (p = *pp) == NULL ||
+ p[len - 1] 0x80)
+ {
+ ASN1err(ASN1_F_C2I_ASN1_OBJECT,ASN1_R_INVALID_OBJECT_ENCODING);
+ return NULL;
+ }
+ /* Now 0 len = INT_MAX, so the cast is safe. */
+ length = (int)len;
/* only the ASN1_OBJECTs from the 'table' will have values
* for -sn or -ln */
@@ -300,28 +314,27 @@ ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT
}
else ret=(*a);
- p= *pp;
/* detach data from object */
data = (unsigned char *)ret-data;
ret-data = NULL;
/* once detached we can change it */
- if ((data == NULL) || (ret-length len))
+ if ((data == NULL) || (ret-length length))
{
ret-length=0;
if (data != NULL) OPENSSL_free(data);
- data=(unsigned char *)OPENSSL_malloc(len ? (int)len : 1);
+ data=(unsigned char *)OPENSSL_malloc(length);
if (data == NULL)
{ i=ERR_R_MALLOC_FAILURE; goto err; }
ret-flags|=ASN1_OBJECT_FLAG_DYNAMIC_DATA;
}
- memcpy(data,p,(int)len);
+ memcpy(data,p,length);
/* reattach data to object, after which it remains const */
ret-data =data;
- ret-length=(int)len;
+ ret-length=length;
ret-sn=NULL;
ret-ln=NULL;
/* ret-flags=ASN1_OBJECT_FLAG_DYNAMIC; we know it is dynamic */
- p+=len;
+ p+=length;
if (a != NULL) (*a)=ret;
*pp=p;
Index: src/crypto/dist/openssl/crypto/asn1/asn1.h
diff -u src/crypto/dist/openssl/crypto/asn1/asn1.h:1.9.4.1 src/crypto/dist/openssl/crypto/asn1/asn1.h:1.9.4.1.6.1
--- src/crypto/dist/openssl/crypto/asn1/asn1.h:1.9.4.1 Mon Mar 30 16:29:38 2009
+++
CVS commit: [netbsd-5-2] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:35:30 UTC 2014 Modified Files: src/doc [netbsd-5-2]: CHANGES-5.2.3 Log Message: Ticket 1918. To generate a diff of this commit: cvs rdiff -u -r1.1.2.17 -r1.1.2.18 src/doc/CHANGES-5.2.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-5.2.3 diff -u src/doc/CHANGES-5.2.3:1.1.2.17 src/doc/CHANGES-5.2.3:1.1.2.18 --- src/doc/CHANGES-5.2.3:1.1.2.17 Wed Aug 27 07:39:22 2014 +++ src/doc/CHANGES-5.2.3 Wed Aug 27 13:35:30 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.2.3,v 1.1.2.17 2014/08/27 07:39:22 msaitoh Exp $ +# $NetBSD: CHANGES-5.2.3,v 1.1.2.18 2014/08/27 13:35:30 msaitoh Exp $ A complete list of changes from the NetBSD 5.2.2 release to the NetBSD 5.2.3 release: @@ -242,3 +242,23 @@ sys/dev/pci/pci_usrreq.c 1.26 via patc writes before feeding them to a kassert in pci_conf_read/write or to a trap in the hardware itself. [riastradh, ticket #1922] + +crypto/dist/openssl/crypto/asn1/a_object.c patch +crypto/dist/openssl/crypto/asn1/asn1.h patch +crypto/dist/openssl/crypto/asn1/asn1_err.c patch +crypto/dist/openssl/crypto/objects/obj_dat.c patch +crypto/dist/openssl/ssl/d1_both.c patch +crypto/dist/openssl/ssl/s23_srvr.c patch +crypto/dist/openssl/ssl/s3_clnt.c patch +crypto/dist/openssl/ssl/t1_lib.c patch + + Patches for the following vulnerabilities: + - Information leak in pretty printing functions (CVE-2014-3508) + - Double Free when processing DTLS packets (CVE-2014-3505) + - DTLS memory exhaustion (CVE-2014-3506) + - DTLS memory leak from zero-length fragments (CVE-2014-3507) + - OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510) + - Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509) + - OpenSSL TLS protocol downgrade attack (CVE-2014-3511) + Backported from the recent 1.0.1i OpenSSL release. + [spz, ticket #1918]
CVS commit: [netbsd-5-1] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:35:45 UTC 2014 Modified Files: src/doc [netbsd-5-1]: CHANGES-5.1.5 Log Message: Ticket 1918. To generate a diff of this commit: cvs rdiff -u -r1.1.2.16 -r1.1.2.17 src/doc/CHANGES-5.1.5 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-5.1.5 diff -u src/doc/CHANGES-5.1.5:1.1.2.16 src/doc/CHANGES-5.1.5:1.1.2.17 --- src/doc/CHANGES-5.1.5:1.1.2.16 Wed Aug 27 07:39:40 2014 +++ src/doc/CHANGES-5.1.5 Wed Aug 27 13:35:45 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.1.5,v 1.1.2.16 2014/08/27 07:39:40 msaitoh Exp $ +# $NetBSD: CHANGES-5.1.5,v 1.1.2.17 2014/08/27 13:35:45 msaitoh Exp $ A complete list of changes from the NetBSD 5.1.4 release to the NetBSD 5.1.5 release: @@ -242,3 +242,23 @@ sys/dev/pci/pci_usrreq.c 1.26 via patc writes before feeding them to a kassert in pci_conf_read/write or to a trap in the hardware itself. [riastradh, ticket #1922] + +crypto/dist/openssl/crypto/asn1/a_object.c patch +crypto/dist/openssl/crypto/asn1/asn1.h patch +crypto/dist/openssl/crypto/asn1/asn1_err.c patch +crypto/dist/openssl/crypto/objects/obj_dat.c patch +crypto/dist/openssl/ssl/d1_both.c patch +crypto/dist/openssl/ssl/s23_srvr.c patch +crypto/dist/openssl/ssl/s3_clnt.c patch +crypto/dist/openssl/ssl/t1_lib.c patch + + Patches for the following vulnerabilities: + - Information leak in pretty printing functions (CVE-2014-3508) + - Double Free when processing DTLS packets (CVE-2014-3505) + - DTLS memory exhaustion (CVE-2014-3506) + - DTLS memory leak from zero-length fragments (CVE-2014-3507) + - OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510) + - Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509) + - OpenSSL TLS protocol downgrade attack (CVE-2014-3511) + Backported from the recent 1.0.1i OpenSSL release. + [spz, ticket #1918]
CVS commit: [netbsd-5] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:35:12 UTC 2014 Modified Files: src/doc [netbsd-5]: CHANGES-5.3 Log Message: Ticket 1918. To generate a diff of this commit: cvs rdiff -u -r1.1.2.68 -r1.1.2.69 src/doc/CHANGES-5.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-5.3 diff -u src/doc/CHANGES-5.3:1.1.2.68 src/doc/CHANGES-5.3:1.1.2.69 --- src/doc/CHANGES-5.3:1.1.2.68 Wed Aug 27 07:39:04 2014 +++ src/doc/CHANGES-5.3 Wed Aug 27 13:35:12 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.3,v 1.1.2.68 2014/08/27 07:39:04 msaitoh Exp $ +# $NetBSD: CHANGES-5.3,v 1.1.2.69 2014/08/27 13:35:12 msaitoh Exp $ A complete list of changes from the NetBSD 5.2 release to the NetBSD 5.3 release: @@ -994,3 +994,23 @@ sys/dev/pci/pci_usrreq.c 1.26 via patc writes before feeding them to a kassert in pci_conf_read/write or to a trap in the hardware itself. [riastradh, ticket #1922] + +crypto/dist/openssl/crypto/asn1/a_object.c patch +crypto/dist/openssl/crypto/asn1/asn1.h patch +crypto/dist/openssl/crypto/asn1/asn1_err.c patch +crypto/dist/openssl/crypto/objects/obj_dat.c patch +crypto/dist/openssl/ssl/d1_both.c patch +crypto/dist/openssl/ssl/s23_srvr.c patch +crypto/dist/openssl/ssl/s3_clnt.c patch +crypto/dist/openssl/ssl/t1_lib.c patch + + Patches for the following vulnerabilities: + - Information leak in pretty printing functions (CVE-2014-3508) + - Double Free when processing DTLS packets (CVE-2014-3505) + - DTLS memory exhaustion (CVE-2014-3506) + - DTLS memory leak from zero-length fragments (CVE-2014-3507) + - OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510) + - Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509) + - OpenSSL TLS protocol downgrade attack (CVE-2014-3511) + Backported from the recent 1.0.1i OpenSSL release. + [spz, ticket #1918]
CVS commit: [netbsd-5] src/sys/netinet6
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:44:34 UTC 2014 Modified Files: src/sys/netinet6 [netbsd-5]: ip6_output.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1920): sys/netinet6/ip6_output.c 1.158 via patch Fix a memory leak in calling setsockopt() on an INET6 socket. To generate a diff of this commit: cvs rdiff -u -r1.135.2.1 -r1.135.2.2 src/sys/netinet6/ip6_output.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/netinet6/ip6_output.c diff -u src/sys/netinet6/ip6_output.c:1.135.2.1 src/sys/netinet6/ip6_output.c:1.135.2.2 --- src/sys/netinet6/ip6_output.c:1.135.2.1 Mon Apr 20 22:56:04 2009 +++ src/sys/netinet6/ip6_output.c Wed Aug 27 13:44:34 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: ip6_output.c,v 1.135.2.1 2009/04/20 22:56:04 snj Exp $ */ +/* $NetBSD: ip6_output.c,v 1.135.2.2 2014/08/27 13:44:34 msaitoh Exp $ */ /* $KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $ */ /* @@ -62,7 +62,7 @@ */ #include sys/cdefs.h -__KERNEL_RCSID(0, $NetBSD: ip6_output.c,v 1.135.2.1 2009/04/20 22:56:04 snj Exp $); +__KERNEL_RCSID(0, $NetBSD: ip6_output.c,v 1.135.2.2 2014/08/27 13:44:34 msaitoh Exp $); #include opt_inet.h #include opt_inet6.h @@ -1794,6 +1794,8 @@ else \ optp = in6p-in6p_outputopts; error = ip6_pcbopt(optname, optbuf, optbuflen, optp, privileged, uproto); + + free(optbuf, M_IP6OPT); break; } #undef OPTSET
CVS commit: [netbsd-5] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:46:20 UTC 2014 Modified Files: src/doc [netbsd-5]: CHANGES-5.3 Log Message: Ticket 1920. To generate a diff of this commit: cvs rdiff -u -r1.1.2.69 -r1.1.2.70 src/doc/CHANGES-5.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-5.3 diff -u src/doc/CHANGES-5.3:1.1.2.69 src/doc/CHANGES-5.3:1.1.2.70 --- src/doc/CHANGES-5.3:1.1.2.69 Wed Aug 27 13:35:12 2014 +++ src/doc/CHANGES-5.3 Wed Aug 27 13:46:20 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.3,v 1.1.2.69 2014/08/27 13:35:12 msaitoh Exp $ +# $NetBSD: CHANGES-5.3,v 1.1.2.70 2014/08/27 13:46:20 msaitoh Exp $ A complete list of changes from the NetBSD 5.2 release to the NetBSD 5.3 release: @@ -1014,3 +1014,8 @@ crypto/dist/openssl/ssl/t1_lib.c patch - OpenSSL TLS protocol downgrade attack (CVE-2014-3511) Backported from the recent 1.0.1i OpenSSL release. [spz, ticket #1918] + +sys/netinet6/ip6_output.c 1.158 via patch + + Fix a memory leak in calling setsockopt() on an INET6 socket. + [maxv ticket #1920]
CVS commit: [netbsd-5-2] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:46:40 UTC 2014 Modified Files: src/doc [netbsd-5-2]: CHANGES-5.2.3 Log Message: Ticket 1920. To generate a diff of this commit: cvs rdiff -u -r1.1.2.18 -r1.1.2.19 src/doc/CHANGES-5.2.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-5.2.3 diff -u src/doc/CHANGES-5.2.3:1.1.2.18 src/doc/CHANGES-5.2.3:1.1.2.19 --- src/doc/CHANGES-5.2.3:1.1.2.18 Wed Aug 27 13:35:30 2014 +++ src/doc/CHANGES-5.2.3 Wed Aug 27 13:46:40 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.2.3,v 1.1.2.18 2014/08/27 13:35:30 msaitoh Exp $ +# $NetBSD: CHANGES-5.2.3,v 1.1.2.19 2014/08/27 13:46:40 msaitoh Exp $ A complete list of changes from the NetBSD 5.2.2 release to the NetBSD 5.2.3 release: @@ -262,3 +262,8 @@ crypto/dist/openssl/ssl/t1_lib.c patch - OpenSSL TLS protocol downgrade attack (CVE-2014-3511) Backported from the recent 1.0.1i OpenSSL release. [spz, ticket #1918] + +sys/netinet6/ip6_output.c 1.158 via patch + + Fix a memory leak in calling setsockopt() on an INET6 socket. + [maxv ticket #1920]
CVS commit: [netbsd-5-1] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:46:54 UTC 2014 Modified Files: src/doc [netbsd-5-1]: CHANGES-5.1.5 Log Message: Ticket 1920. To generate a diff of this commit: cvs rdiff -u -r1.1.2.17 -r1.1.2.18 src/doc/CHANGES-5.1.5 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-5.1.5 diff -u src/doc/CHANGES-5.1.5:1.1.2.17 src/doc/CHANGES-5.1.5:1.1.2.18 --- src/doc/CHANGES-5.1.5:1.1.2.17 Wed Aug 27 13:35:45 2014 +++ src/doc/CHANGES-5.1.5 Wed Aug 27 13:46:54 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.1.5,v 1.1.2.17 2014/08/27 13:35:45 msaitoh Exp $ +# $NetBSD: CHANGES-5.1.5,v 1.1.2.18 2014/08/27 13:46:54 msaitoh Exp $ A complete list of changes from the NetBSD 5.1.4 release to the NetBSD 5.1.5 release: @@ -262,3 +262,8 @@ crypto/dist/openssl/ssl/t1_lib.c patch - OpenSSL TLS protocol downgrade attack (CVE-2014-3511) Backported from the recent 1.0.1i OpenSSL release. [spz, ticket #1918] + +sys/netinet6/ip6_output.c 1.158 via patch + + Fix a memory leak in calling setsockopt() on an INET6 socket. + [maxv ticket #1920]
CVS commit: src/etc
Module Name:src
Committed By: apb
Date: Wed Aug 27 13:56:02 UTC 2014
Modified Files:
src/etc: security
Log Message:
Split some long lines.
To generate a diff of this commit:
cvs rdiff -u -r1.115 -r1.116 src/etc/security
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/etc/security
diff -u src/etc/security:1.115 src/etc/security:1.116
--- src/etc/security:1.115 Wed Nov 6 19:37:05 2013
+++ src/etc/security Wed Aug 27 13:56:02 2014
@@ -1,6 +1,6 @@
#!/bin/sh -
#
-# $NetBSD: security,v 1.115 2013/11/06 19:37:05 spz Exp $
+# $NetBSD: security,v 1.116 2014/08/27 13:56:02 apb Exp $
# from: @(#)security 8.1 (Berkeley) 6/9/93
#
@@ -339,7 +339,8 @@ if checkyesno check_group; then
awk -F: '{ print $1 }' $GRP | sort | uniq -d $OUTPUT
dupgroups=
for group in $(cat $OUTPUT) ; do
- gcount=$(awk -F: /$group/ { print \$1,\$3 } $GRP | sort -u | wc -l)
+ gcount=$(awk -F: /$group/ { print \$1,\$3 } $GRP |
+ sort -u | wc -l)
if [ $gcount -gt 1 ]; then
dupgroups=$dupgroups $group
fi
@@ -901,42 +902,52 @@ if checkyesno check_disklabels; then
migrate_file $file $work_dir/${file##*/}
done
- # generate list of old disklabels, fdisks wedges and remove them
- ls -1d $work_dir/disklabel.* $work_dir/fdisk.* $work_dir/wedges.* 2/dev/null |
+ # generate list of old disklabels, fdisks wedges,
+ # and remove them
+ ls -1d $work_dir/disklabel.* $work_dir/fdisk.* $work_dir/wedges.* \
+ 2/dev/null |
egrep -v '\.(backup|current)(,v)?$' $LABELS
xargs rm $LABELS
# generate disklabels of all disks excluding: cd dk fd md st
- disks=$(iostat -x | awk 'NR 1 $1 !~ /^[cfm]d|dk|st|nfs/ { print $1; }')
+ disks=$(iostat -x | awk \
+ 'NR 1 $1 !~ /^[cfm]d|dk|st|nfs/ { print $1; }')
for i in $disks; do
disklabel $i $work_dir/disklabel.$i 2/dev/null
done
# if fdisk is available, generate fdisks for: ed ld sd wd
if [ -x /sbin/fdisk ]; then
- disks=$(iostat -x | awk 'NR 1 $1 ~ /^[elsw]d/ { print $1; }')
+ disks=$(iostat -x | awk \
+ 'NR 1 $1 ~ /^[elsw]d/ { print $1; }')
for i in $disks; do
/sbin/fdisk $i $work_dir/fdisk.$i 2/dev/null
done
fi
- # if dkctl is available, generate dkctl listwedges for: ed ld sd wd cgd ofdisk ra rl raid
+ # if dkctl is available, generate dkctl listwedges
+ # for: ed ld sd wd cgd ofdisk ra rl raid
if [ -x /sbin/dkctl ]; then
- disks=$(iostat -x | awk 'NR 1 $1 ~ /^[elsw]d|cgd|ofdisk|r[al]|raid/ { print $1; }')
+ disks=$(iostat -x | awk \
+ 'NR 1 $1 ~ /^[elsw]d|cgd|ofdisk|r[al]|raid/
+ { print $1; }')
for i in $disks; do
- /sbin/dkctl $i listwedges $work_dir/wedges.$i 2/dev/null
+ /sbin/dkctl $i listwedges \
+ $work_dir/wedges.$i 2/dev/null
done
fi
# append list of new disklabels, fdisks and wedges
- ls -1d $work_dir/disklabel.* $work_dir/fdisk.* $work_dir/wedges.* 2/dev/null |
+ ls -1d $work_dir/disklabel.* $work_dir/fdisk.* $work_dir/wedges.* \
+ 2/dev/null |
egrep -v '\.(backup|current)(,v)?$' $LABELS
CHANGELIST=$LABELS $CHANGELIST
fi
if checkyesno check_lvm; then
-# generate list of existing LVM elements Physical Volumes, Volume Groups and Logical Volumes.
+# generate list of existing LVM elements Physical Volumes, Volume Groups
+# and Logical Volumes.
if [ -x /sbin/lvm ]; then
lvm pvdisplay -m $work_dir/lvm.pv 2/dev/null
lvm vgdisplay -m $work_dir/lvm.vg 2/dev/null
CVS commit: [netbsd-6] src
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 14:39:19 UTC 2014
Modified Files:
src/sbin/ccdconfig [netbsd-6]: ccdconfig.c
src/sys/dev [netbsd-6]: ccd.c ccdvar.h
Log Message:
Pull up following revision(s) (requested by sborrill in ticket #1113):
sbin/ccdconfig/ccdconfig.c 1.54 via patch
sys/dev/ccd.c 1.152 via patch
sys/dev/ccdvar.h1.34 via patch
Switch size_t to uint64_t in appropriate places to ensure that ccd(4)
works with component and total sizes of 2TB.
Make kernel print device information when a ccd configured.
Fix some typos in comments.
To generate a diff of this commit:
cvs rdiff -u -r1.51 -r1.51.4.1 src/sbin/ccdconfig/ccdconfig.c
cvs rdiff -u -r1.143 -r1.143.6.1 src/sys/dev/ccd.c
cvs rdiff -u -r1.32 -r1.32.10.1 src/sys/dev/ccdvar.h
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sbin/ccdconfig/ccdconfig.c
diff -u src/sbin/ccdconfig/ccdconfig.c:1.51 src/sbin/ccdconfig/ccdconfig.c:1.51.4.1
--- src/sbin/ccdconfig/ccdconfig.c:1.51 Sat Aug 27 16:29:51 2011
+++ src/sbin/ccdconfig/ccdconfig.c Wed Aug 27 14:39:19 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: ccdconfig.c,v 1.51 2011/08/27 16:29:51 joerg Exp $ */
+/* $NetBSD: ccdconfig.c,v 1.51.4.1 2014/08/27 14:39:19 msaitoh Exp $ */
/*-
* Copyright (c) 1996, 1997 The NetBSD Foundation, Inc.
@@ -33,7 +33,7 @@
#ifndef lint
__COPYRIGHT(@(#) Copyright (c) 1996, 1997\
The NetBSD Foundation, Inc. All rights reserved.);
-__RCSID($NetBSD: ccdconfig.c,v 1.51 2011/08/27 16:29:51 joerg Exp $);
+__RCSID($NetBSD: ccdconfig.c,v 1.51.4.1 2014/08/27 14:39:19 msaitoh Exp $);
#endif
#include sys/param.h
@@ -310,7 +310,7 @@ do_single(int argc, char **argv, int act
ui == 0 ? '(' : ' ', cp2,
ui == ccio.ccio_ndisks - 1 ? ')' : ',');
}
- printf(, %ld blocks , (long)ccio.ccio_size);
+ printf(, %ju blocks , (uintmax_t)ccio.ccio_size);
if (ccio.ccio_ileave != 0)
printf(interleaved at %d blocks\n, ccio.ccio_ileave);
else
Index: src/sys/dev/ccd.c
diff -u src/sys/dev/ccd.c:1.143 src/sys/dev/ccd.c:1.143.6.1
--- src/sys/dev/ccd.c:1.143 Sun Nov 13 23:02:46 2011
+++ src/sys/dev/ccd.c Wed Aug 27 14:39:19 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: ccd.c,v 1.143 2011/11/13 23:02:46 christos Exp $ */
+/* $NetBSD: ccd.c,v 1.143.6.1 2014/08/27 14:39:19 msaitoh Exp $ */
/*-
* Copyright (c) 1996, 1997, 1998, 1999, 2007, 2009 The NetBSD Foundation, Inc.
@@ -88,7 +88,11 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: ccd.c,v 1.143 2011/11/13 23:02:46 christos Exp $);
+__KERNEL_RCSID(0, $NetBSD: ccd.c,v 1.143.6.1 2014/08/27 14:39:19 msaitoh Exp $);
+
+#if defined(_KERNEL_OPT)
+#include opt_compat_netbsd.h
+#endif
#include sys/param.h
#include sys/systm.h
@@ -399,6 +403,22 @@ ccdinit(struct ccd_softc *cs, char **cpa
ccg-ccg_ntracks = 1;
ccg-ccg_nsectors = 1024 * (1024 / ccg-ccg_secsize);
ccg-ccg_ncylinders = cs-sc_size / ccg-ccg_nsectors;
+
+ if (cs-sc_ileave 0)
+ aprint_normal(%s: Interleaving %d component%s
+ (%d block interleave)\n, cs-sc_xname,
+ cs-sc_nccdisks, (cs-sc_nccdisks != 0 ? s : ),
+ cs-sc_ileave);
+ else
+ aprint_normal(%s: Concatenating %d component%s\n,
+ cs-sc_xname,
+ cs-sc_nccdisks, (cs-sc_nccdisks != 0 ? s : ));
+ for (ix = 0; ix cs-sc_nccdisks; ix++) {
+ ci = cs-sc_cinfo[ix];
+ aprint_normal(%s: %s (%ju blocks)\n, cs-sc_xname,
+ ci-ci_path, (uintmax_t)ci-ci_size);
+ }
+ aprint_normal(%s: total %ju blocks\n, cs-sc_xname, cs-sc_size);
/*
* Create thread to handle deferred I/O.
@@ -1029,6 +1049,46 @@ ccdioctl(dev_t dev, u_long cmd, void *da
cs = ccd_softc[unit];
uc = kauth_cred_get();
+/*
+ * Compat code must not be called if on a platform where
+ * sizeof (size_t) == sizeof (uint64_t) as CCDIOCSET will
+ * be the same as CCDIOCSET_60
+ */
+#ifndef _LP64
+ switch (cmd) {
+ case CCDIOCSET_60: {
+ struct ccd_ioctl ccionew;
+ struct ccd_ioctl_60 *ccio60 =
+ (struct ccd_ioctl_60 *)data;
+ ccionew.ccio_disks = ccio-ccio_disks;
+ ccionew.ccio_ndisks = ccio-ccio_ndisks;
+ ccionew.ccio_ileave = ccio-ccio_ileave;
+ ccionew.ccio_flags = ccio-ccio_flags;
+ ccionew.ccio_unit = ccio-ccio_unit;
+ error = ccdioctl(dev, CCDIOCSET, ccionew, flag, l);
+ if (!error) {
+ /* Copy data back, adjust types if necessary */
+ ccio60-ccio_disks = ccionew.ccio_disks;
+ ccio60-ccio_ndisks = ccionew.ccio_ndisks;
+ ccio60-ccio_ileave = ccionew.ccio_ileave;
+ ccio60-ccio_flags = ccionew.ccio_flags;
+ ccio60-ccio_unit = ccionew.ccio_unit;
+ ccio60-ccio_size = (size_t)ccionew.ccio_size;
+ }
+ return error;
+ }
+ break;
+
+ case CCDIOCCLR_60:
+ /*
+ * ccio_size member not used, so existing struct OK
+ * drop through to existing non-compat version
+ */
+ cmd = CCDIOCCLR;
+ break;
+ }
+#endif /* !_LP64*/
+
/*
CVS commit: [netbsd-6] src/sys/netinet6
Module Name:src Committed By: msaitoh Date: Wed Aug 27 14:44:42 UTC 2014 Modified Files: src/sys/netinet6 [netbsd-6]: ip6_output.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1114): sys/netinet6/ip6_output.c 1.158 via patch Fix a memory leak in calling setsockopt() on an INET6 socket. To generate a diff of this commit: cvs rdiff -u -r1.145 -r1.145.2.1 src/sys/netinet6/ip6_output.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/netinet6/ip6_output.c diff -u src/sys/netinet6/ip6_output.c:1.145 src/sys/netinet6/ip6_output.c:1.145.2.1 --- src/sys/netinet6/ip6_output.c:1.145 Sun Feb 5 00:41:15 2012 +++ src/sys/netinet6/ip6_output.c Wed Aug 27 14:44:42 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: ip6_output.c,v 1.145 2012/02/05 00:41:15 rmind Exp $ */ +/* $NetBSD: ip6_output.c,v 1.145.2.1 2014/08/27 14:44:42 msaitoh Exp $ */ /* $KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $ */ /* @@ -62,7 +62,7 @@ */ #include sys/cdefs.h -__KERNEL_RCSID(0, $NetBSD: ip6_output.c,v 1.145 2012/02/05 00:41:15 rmind Exp $); +__KERNEL_RCSID(0, $NetBSD: ip6_output.c,v 1.145.2.1 2014/08/27 14:44:42 msaitoh Exp $); #include opt_inet.h #include opt_inet6.h @@ -1781,6 +1781,8 @@ else \ optp = in6p-in6p_outputopts; error = ip6_pcbopt(optname, optbuf, optbuflen, optp, kauth_cred_get(), uproto); + + free(optbuf, M_IP6OPT); break; } #undef OPTSET
CVS commit: [netbsd-6-1] src/sys/netinet6
Module Name:src Committed By: msaitoh Date: Wed Aug 27 14:45:11 UTC 2014 Modified Files: src/sys/netinet6 [netbsd-6-1]: ip6_output.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1114): sys/netinet6/ip6_output.c 1.158 via patch Fix a memory leak in calling setsockopt() on an INET6 socket. To generate a diff of this commit: cvs rdiff -u -r1.145 -r1.145.8.1 src/sys/netinet6/ip6_output.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/netinet6/ip6_output.c diff -u src/sys/netinet6/ip6_output.c:1.145 src/sys/netinet6/ip6_output.c:1.145.8.1 --- src/sys/netinet6/ip6_output.c:1.145 Sun Feb 5 00:41:15 2012 +++ src/sys/netinet6/ip6_output.c Wed Aug 27 14:45:11 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: ip6_output.c,v 1.145 2012/02/05 00:41:15 rmind Exp $ */ +/* $NetBSD: ip6_output.c,v 1.145.8.1 2014/08/27 14:45:11 msaitoh Exp $ */ /* $KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $ */ /* @@ -62,7 +62,7 @@ */ #include sys/cdefs.h -__KERNEL_RCSID(0, $NetBSD: ip6_output.c,v 1.145 2012/02/05 00:41:15 rmind Exp $); +__KERNEL_RCSID(0, $NetBSD: ip6_output.c,v 1.145.8.1 2014/08/27 14:45:11 msaitoh Exp $); #include opt_inet.h #include opt_inet6.h @@ -1781,6 +1781,8 @@ else \ optp = in6p-in6p_outputopts; error = ip6_pcbopt(optname, optbuf, optbuflen, optp, kauth_cred_get(), uproto); + + free(optbuf, M_IP6OPT); break; } #undef OPTSET
CVS commit: [netbsd-6-0] src/sys/netinet6
Module Name:src Committed By: msaitoh Date: Wed Aug 27 14:45:59 UTC 2014 Modified Files: src/sys/netinet6 [netbsd-6-0]: ip6_output.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1114): sys/netinet6/ip6_output.c 1.158 via patch Fix a memory leak in calling setsockopt() on an INET6 socket. To generate a diff of this commit: cvs rdiff -u -r1.145 -r1.145.6.1 src/sys/netinet6/ip6_output.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/netinet6/ip6_output.c diff -u src/sys/netinet6/ip6_output.c:1.145 src/sys/netinet6/ip6_output.c:1.145.6.1 --- src/sys/netinet6/ip6_output.c:1.145 Sun Feb 5 00:41:15 2012 +++ src/sys/netinet6/ip6_output.c Wed Aug 27 14:45:59 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: ip6_output.c,v 1.145 2012/02/05 00:41:15 rmind Exp $ */ +/* $NetBSD: ip6_output.c,v 1.145.6.1 2014/08/27 14:45:59 msaitoh Exp $ */ /* $KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $ */ /* @@ -62,7 +62,7 @@ */ #include sys/cdefs.h -__KERNEL_RCSID(0, $NetBSD: ip6_output.c,v 1.145 2012/02/05 00:41:15 rmind Exp $); +__KERNEL_RCSID(0, $NetBSD: ip6_output.c,v 1.145.6.1 2014/08/27 14:45:59 msaitoh Exp $); #include opt_inet.h #include opt_inet6.h @@ -1781,6 +1781,8 @@ else \ optp = in6p-in6p_outputopts; error = ip6_pcbopt(optname, optbuf, optbuflen, optp, kauth_cred_get(), uproto); + + free(optbuf, M_IP6OPT); break; } #undef OPTSET
CVS commit: [netbsd-6] src/sys
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 14:53:26 UTC 2014
Modified Files:
src/sys/fs/ptyfs [netbsd-6]: ptyfs_vfsops.c
src/sys/miscfs/umapfs [netbsd-6]: umap_vfsops.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #1115):
sys/miscfs/umapfs/umap_vfsops.c: revision 1.94
sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.52
Overflow if *data_len == OSIZE and args-version = PTYFS_ARGSVERSION.
Sent on tech-kern@, ok christos@
1) 'error' is returned while it does not even hold an error code. Which
means that zero is returned, and the kernel keeps mounting (and it
probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
check to ensure they are greater than zero. Since they are used to
compute the size of two copyin's, a user can control the copied size
by giving a negative value (like 128-2^29), and thus overwrite kernel
memory.
Both triggerable from root only.
To generate a diff of this commit:
cvs rdiff -u -r1.42.18.2 -r1.42.18.3 src/sys/fs/ptyfs/ptyfs_vfsops.c
cvs rdiff -u -r1.86.14.1 -r1.86.14.2 src/sys/miscfs/umapfs/umap_vfsops.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/fs/ptyfs/ptyfs_vfsops.c
diff -u src/sys/fs/ptyfs/ptyfs_vfsops.c:1.42.18.2 src/sys/fs/ptyfs/ptyfs_vfsops.c:1.42.18.3
--- src/sys/fs/ptyfs/ptyfs_vfsops.c:1.42.18.2 Mon Apr 21 10:14:18 2014
+++ src/sys/fs/ptyfs/ptyfs_vfsops.c Wed Aug 27 14:53:26 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: ptyfs_vfsops.c,v 1.42.18.2 2014/04/21 10:14:18 bouyer Exp $ */
+/* $NetBSD: ptyfs_vfsops.c,v 1.42.18.3 2014/08/27 14:53:26 msaitoh Exp $ */
/*
* Copyright (c) 1992, 1993, 1995
@@ -38,7 +38,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: ptyfs_vfsops.c,v 1.42.18.2 2014/04/21 10:14:18 bouyer Exp $);
+__KERNEL_RCSID(0, $NetBSD: ptyfs_vfsops.c,v 1.42.18.3 2014/08/27 14:53:26 msaitoh Exp $);
#include sys/param.h
#include sys/systm.h
@@ -220,8 +220,10 @@ ptyfs_mount(struct mount *mp, const char
if (args == NULL)
return EINVAL;
- if (*data_len != sizeof *args *data_len != OSIZE)
- return EINVAL;
+ if (*data_len != sizeof *args) {
+ if (*data_len != OSIZE || args-version = PTYFS_ARGSVERSION)
+ return EINVAL;
+ }
if (UIO_MX (UIO_MX - 1)) {
log(LOG_ERR, ptyfs: invalid directory entry size);
Index: src/sys/miscfs/umapfs/umap_vfsops.c
diff -u src/sys/miscfs/umapfs/umap_vfsops.c:1.86.14.1 src/sys/miscfs/umapfs/umap_vfsops.c:1.86.14.2
--- src/sys/miscfs/umapfs/umap_vfsops.c:1.86.14.1 Mon Apr 21 10:14:18 2014
+++ src/sys/miscfs/umapfs/umap_vfsops.c Wed Aug 27 14:53:26 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: umap_vfsops.c,v 1.86.14.1 2014/04/21 10:14:18 bouyer Exp $ */
+/* $NetBSD: umap_vfsops.c,v 1.86.14.2 2014/08/27 14:53:26 msaitoh Exp $ */
/*
* Copyright (c) 1992, 1993
@@ -41,7 +41,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: umap_vfsops.c,v 1.86.14.1 2014/04/21 10:14:18 bouyer Exp $);
+__KERNEL_RCSID(0, $NetBSD: umap_vfsops.c,v 1.86.14.2 2014/08/27 14:53:26 msaitoh Exp $);
#include sys/param.h
#include sys/systm.h
@@ -155,9 +155,10 @@ umapfs_mount(struct mount *mp, const cha
/*
* Now copy in the number of entries and maps for umap mapping.
*/
- if (args-nentries MAPFILEENTRIES || args-gnentries GMAPFILEENTRIES) {
+ if (args-nentries 0 || args-nentries MAPFILEENTRIES ||
+ args-gnentries 0 || args-gnentries GMAPFILEENTRIES) {
vput(lowerrootvp);
- return (error);
+ return (EINVAL);
}
amp-info_nentries = args-nentries;
CVS commit: [netbsd-6-1] src/sys
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 14:59:06 UTC 2014
Modified Files:
src/sys/fs/ptyfs [netbsd-6-1]: ptyfs_vfsops.c
src/sys/miscfs/umapfs [netbsd-6-1]: umap_vfsops.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #1115):
sys/miscfs/umapfs/umap_vfsops.c: revision 1.94
sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.52
Overflow if *data_len == OSIZE and args-version = PTYFS_ARGSVERSION.
Sent on tech-kern@, ok christos@
1) 'error' is returned while it does not even hold an error code. Which
means that zero is returned, and the kernel keeps mounting (and it
probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
check to ensure they are greater than zero. Since they are used to
compute the size of two copyin's, a user can control the copied size
by giving a negative value (like 128-2^29), and thus overwrite kernel
memory.
Both triggerable from root only.
To generate a diff of this commit:
cvs rdiff -u -r1.42.18.1.4.1 -r1.42.18.1.4.2 src/sys/fs/ptyfs/ptyfs_vfsops.c
cvs rdiff -u -r1.86.20.1 -r1.86.20.2 src/sys/miscfs/umapfs/umap_vfsops.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/fs/ptyfs/ptyfs_vfsops.c
diff -u src/sys/fs/ptyfs/ptyfs_vfsops.c:1.42.18.1.4.1 src/sys/fs/ptyfs/ptyfs_vfsops.c:1.42.18.1.4.2
--- src/sys/fs/ptyfs/ptyfs_vfsops.c:1.42.18.1.4.1 Mon Apr 21 10:17:48 2014
+++ src/sys/fs/ptyfs/ptyfs_vfsops.c Wed Aug 27 14:59:06 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: ptyfs_vfsops.c,v 1.42.18.1.4.1 2014/04/21 10:17:48 bouyer Exp $ */
+/* $NetBSD: ptyfs_vfsops.c,v 1.42.18.1.4.2 2014/08/27 14:59:06 msaitoh Exp $ */
/*
* Copyright (c) 1992, 1993, 1995
@@ -38,7 +38,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: ptyfs_vfsops.c,v 1.42.18.1.4.1 2014/04/21 10:17:48 bouyer Exp $);
+__KERNEL_RCSID(0, $NetBSD: ptyfs_vfsops.c,v 1.42.18.1.4.2 2014/08/27 14:59:06 msaitoh Exp $);
#include sys/param.h
#include sys/systm.h
@@ -220,8 +220,10 @@ ptyfs_mount(struct mount *mp, const char
if (args == NULL)
return EINVAL;
- if (*data_len != sizeof *args *data_len != OSIZE)
- return EINVAL;
+ if (*data_len != sizeof *args) {
+ if (*data_len != OSIZE || args-version = PTYFS_ARGSVERSION)
+ return EINVAL;
+ }
if (UIO_MX (UIO_MX - 1)) {
log(LOG_ERR, ptyfs: invalid directory entry size);
Index: src/sys/miscfs/umapfs/umap_vfsops.c
diff -u src/sys/miscfs/umapfs/umap_vfsops.c:1.86.20.1 src/sys/miscfs/umapfs/umap_vfsops.c:1.86.20.2
--- src/sys/miscfs/umapfs/umap_vfsops.c:1.86.20.1 Mon Apr 21 10:17:48 2014
+++ src/sys/miscfs/umapfs/umap_vfsops.c Wed Aug 27 14:59:06 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: umap_vfsops.c,v 1.86.20.1 2014/04/21 10:17:48 bouyer Exp $ */
+/* $NetBSD: umap_vfsops.c,v 1.86.20.2 2014/08/27 14:59:06 msaitoh Exp $ */
/*
* Copyright (c) 1992, 1993
@@ -41,7 +41,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: umap_vfsops.c,v 1.86.20.1 2014/04/21 10:17:48 bouyer Exp $);
+__KERNEL_RCSID(0, $NetBSD: umap_vfsops.c,v 1.86.20.2 2014/08/27 14:59:06 msaitoh Exp $);
#include sys/param.h
#include sys/systm.h
@@ -155,9 +155,10 @@ umapfs_mount(struct mount *mp, const cha
/*
* Now copy in the number of entries and maps for umap mapping.
*/
- if (args-nentries MAPFILEENTRIES || args-gnentries GMAPFILEENTRIES) {
+ if (args-nentries 0 || args-nentries MAPFILEENTRIES ||
+ args-gnentries 0 || args-gnentries GMAPFILEENTRIES) {
vput(lowerrootvp);
- return (error);
+ return (EINVAL);
}
amp-info_nentries = args-nentries;
CVS commit: [netbsd-6-0] src/sys
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 14:59:22 UTC 2014
Modified Files:
src/sys/fs/ptyfs [netbsd-6-0]: ptyfs_vfsops.c
src/sys/miscfs/umapfs [netbsd-6-0]: umap_vfsops.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #1115):
sys/miscfs/umapfs/umap_vfsops.c: revision 1.94
sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.52
Overflow if *data_len == OSIZE and args-version = PTYFS_ARGSVERSION.
Sent on tech-kern@, ok christos@
1) 'error' is returned while it does not even hold an error code. Which
means that zero is returned, and the kernel keeps mounting (and it
probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
check to ensure they are greater than zero. Since they are used to
compute the size of two copyin's, a user can control the copied size
by giving a negative value (like 128-2^29), and thus overwrite kernel
memory.
Both triggerable from root only.
To generate a diff of this commit:
cvs rdiff -u -r1.42.18.1.2.1 -r1.42.18.1.2.2 src/sys/fs/ptyfs/ptyfs_vfsops.c
cvs rdiff -u -r1.86.18.1 -r1.86.18.2 src/sys/miscfs/umapfs/umap_vfsops.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/fs/ptyfs/ptyfs_vfsops.c
diff -u src/sys/fs/ptyfs/ptyfs_vfsops.c:1.42.18.1.2.1 src/sys/fs/ptyfs/ptyfs_vfsops.c:1.42.18.1.2.2
--- src/sys/fs/ptyfs/ptyfs_vfsops.c:1.42.18.1.2.1 Mon Apr 21 10:15:37 2014
+++ src/sys/fs/ptyfs/ptyfs_vfsops.c Wed Aug 27 14:59:22 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: ptyfs_vfsops.c,v 1.42.18.1.2.1 2014/04/21 10:15:37 bouyer Exp $ */
+/* $NetBSD: ptyfs_vfsops.c,v 1.42.18.1.2.2 2014/08/27 14:59:22 msaitoh Exp $ */
/*
* Copyright (c) 1992, 1993, 1995
@@ -38,7 +38,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: ptyfs_vfsops.c,v 1.42.18.1.2.1 2014/04/21 10:15:37 bouyer Exp $);
+__KERNEL_RCSID(0, $NetBSD: ptyfs_vfsops.c,v 1.42.18.1.2.2 2014/08/27 14:59:22 msaitoh Exp $);
#include sys/param.h
#include sys/systm.h
@@ -220,8 +220,10 @@ ptyfs_mount(struct mount *mp, const char
if (args == NULL)
return EINVAL;
- if (*data_len != sizeof *args *data_len != OSIZE)
- return EINVAL;
+ if (*data_len != sizeof *args) {
+ if (*data_len != OSIZE || args-version = PTYFS_ARGSVERSION)
+ return EINVAL;
+ }
if (UIO_MX (UIO_MX - 1)) {
log(LOG_ERR, ptyfs: invalid directory entry size);
Index: src/sys/miscfs/umapfs/umap_vfsops.c
diff -u src/sys/miscfs/umapfs/umap_vfsops.c:1.86.18.1 src/sys/miscfs/umapfs/umap_vfsops.c:1.86.18.2
--- src/sys/miscfs/umapfs/umap_vfsops.c:1.86.18.1 Mon Apr 21 10:15:37 2014
+++ src/sys/miscfs/umapfs/umap_vfsops.c Wed Aug 27 14:59:22 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: umap_vfsops.c,v 1.86.18.1 2014/04/21 10:15:37 bouyer Exp $ */
+/* $NetBSD: umap_vfsops.c,v 1.86.18.2 2014/08/27 14:59:22 msaitoh Exp $ */
/*
* Copyright (c) 1992, 1993
@@ -41,7 +41,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: umap_vfsops.c,v 1.86.18.1 2014/04/21 10:15:37 bouyer Exp $);
+__KERNEL_RCSID(0, $NetBSD: umap_vfsops.c,v 1.86.18.2 2014/08/27 14:59:22 msaitoh Exp $);
#include sys/param.h
#include sys/systm.h
@@ -155,9 +155,10 @@ umapfs_mount(struct mount *mp, const cha
/*
* Now copy in the number of entries and maps for umap mapping.
*/
- if (args-nentries MAPFILEENTRIES || args-gnentries GMAPFILEENTRIES) {
+ if (args-nentries 0 || args-nentries MAPFILEENTRIES ||
+ args-gnentries 0 || args-gnentries GMAPFILEENTRIES) {
vput(lowerrootvp);
- return (error);
+ return (EINVAL);
}
amp-info_nentries = args-nentries;
CVS commit: [netbsd-6] src/sys/compat/osf1
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 15:01:08 UTC 2014
Modified Files:
src/sys/compat/osf1 [netbsd-6]: osf1_file.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #1141):
sys/compat/osf1/osf1_file.c: revision 1.42
Ensure nbytes 0. Otherwise bad things may happen.
Compile-tested only.
ok christos@
To generate a diff of this commit:
cvs rdiff -u -r1.41 -r1.41.8.1 src/sys/compat/osf1/osf1_file.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/compat/osf1/osf1_file.c
diff -u src/sys/compat/osf1/osf1_file.c:1.41 src/sys/compat/osf1/osf1_file.c:1.41.8.1
--- src/sys/compat/osf1/osf1_file.c:1.41 Fri Jul 22 10:02:08 2011
+++ src/sys/compat/osf1/osf1_file.c Wed Aug 27 15:01:08 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: osf1_file.c,v 1.41 2011/07/22 10:02:08 njoly Exp $ */
+/* $NetBSD: osf1_file.c,v 1.41.8.1 2014/08/27 15:01:08 msaitoh Exp $ */
/*
* Copyright (c) 1999 Christopher G. Demetriou. All rights reserved.
@@ -58,7 +58,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: osf1_file.c,v 1.41 2011/07/22 10:02:08 njoly Exp $);
+__KERNEL_RCSID(0, $NetBSD: osf1_file.c,v 1.41.8.1 2014/08/27 15:01:08 msaitoh Exp $);
#if defined(_KERNEL_OPT)
#include opt_syscall_debug.h
@@ -133,7 +133,7 @@ osf1_sys_getdirentries(struct lwp *l, co
/* {
syscallarg(int) fd;
syscallarg(char *) buf;
- syscallarg(u_int) nbytes;
+ syscallarg(int) nbytes;
syscallarg(long *) basep;
} */
struct dirent *bdp;
@@ -151,6 +151,11 @@ osf1_sys_getdirentries(struct lwp *l, co
off_t *cookiebuf = NULL, *cookie;
int ncookies, fd;
+ if (SCARG(uap, nbytes) 0)
+ return EINVAL;
+ if (SCARG(uap, nbytes) == 0)
+ return 0;
+
fd = SCARG(uap, fd);
if ((error = fd_getvnode(fd, fp)) != 0)
return (error);
CVS commit: [netbsd-6-1] src/sys/compat/osf1
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 15:02:27 UTC 2014
Modified Files:
src/sys/compat/osf1 [netbsd-6-1]: osf1_file.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #1141):
sys/compat/osf1/osf1_file.c: revision 1.42
Ensure nbytes 0. Otherwise bad things may happen.
Compile-tested only.
ok christos@
To generate a diff of this commit:
cvs rdiff -u -r1.41 -r1.41.22.1 src/sys/compat/osf1/osf1_file.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/compat/osf1/osf1_file.c
diff -u src/sys/compat/osf1/osf1_file.c:1.41 src/sys/compat/osf1/osf1_file.c:1.41.22.1
--- src/sys/compat/osf1/osf1_file.c:1.41 Fri Jul 22 10:02:08 2011
+++ src/sys/compat/osf1/osf1_file.c Wed Aug 27 15:02:27 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: osf1_file.c,v 1.41 2011/07/22 10:02:08 njoly Exp $ */
+/* $NetBSD: osf1_file.c,v 1.41.22.1 2014/08/27 15:02:27 msaitoh Exp $ */
/*
* Copyright (c) 1999 Christopher G. Demetriou. All rights reserved.
@@ -58,7 +58,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: osf1_file.c,v 1.41 2011/07/22 10:02:08 njoly Exp $);
+__KERNEL_RCSID(0, $NetBSD: osf1_file.c,v 1.41.22.1 2014/08/27 15:02:27 msaitoh Exp $);
#if defined(_KERNEL_OPT)
#include opt_syscall_debug.h
@@ -133,7 +133,7 @@ osf1_sys_getdirentries(struct lwp *l, co
/* {
syscallarg(int) fd;
syscallarg(char *) buf;
- syscallarg(u_int) nbytes;
+ syscallarg(int) nbytes;
syscallarg(long *) basep;
} */
struct dirent *bdp;
@@ -151,6 +151,11 @@ osf1_sys_getdirentries(struct lwp *l, co
off_t *cookiebuf = NULL, *cookie;
int ncookies, fd;
+ if (SCARG(uap, nbytes) 0)
+ return EINVAL;
+ if (SCARG(uap, nbytes) == 0)
+ return 0;
+
fd = SCARG(uap, fd);
if ((error = fd_getvnode(fd, fp)) != 0)
return (error);
CVS commit: [netbsd-6-0] src/sys/compat/osf1
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 15:02:39 UTC 2014
Modified Files:
src/sys/compat/osf1 [netbsd-6-0]: osf1_file.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #1141):
sys/compat/osf1/osf1_file.c: revision 1.42
Ensure nbytes 0. Otherwise bad things may happen.
Compile-tested only.
ok christos@
To generate a diff of this commit:
cvs rdiff -u -r1.41 -r1.41.14.1 src/sys/compat/osf1/osf1_file.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/compat/osf1/osf1_file.c
diff -u src/sys/compat/osf1/osf1_file.c:1.41 src/sys/compat/osf1/osf1_file.c:1.41.14.1
--- src/sys/compat/osf1/osf1_file.c:1.41 Fri Jul 22 10:02:08 2011
+++ src/sys/compat/osf1/osf1_file.c Wed Aug 27 15:02:39 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: osf1_file.c,v 1.41 2011/07/22 10:02:08 njoly Exp $ */
+/* $NetBSD: osf1_file.c,v 1.41.14.1 2014/08/27 15:02:39 msaitoh Exp $ */
/*
* Copyright (c) 1999 Christopher G. Demetriou. All rights reserved.
@@ -58,7 +58,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: osf1_file.c,v 1.41 2011/07/22 10:02:08 njoly Exp $);
+__KERNEL_RCSID(0, $NetBSD: osf1_file.c,v 1.41.14.1 2014/08/27 15:02:39 msaitoh Exp $);
#if defined(_KERNEL_OPT)
#include opt_syscall_debug.h
@@ -133,7 +133,7 @@ osf1_sys_getdirentries(struct lwp *l, co
/* {
syscallarg(int) fd;
syscallarg(char *) buf;
- syscallarg(u_int) nbytes;
+ syscallarg(int) nbytes;
syscallarg(long *) basep;
} */
struct dirent *bdp;
@@ -151,6 +151,11 @@ osf1_sys_getdirentries(struct lwp *l, co
off_t *cookiebuf = NULL, *cookie;
int ncookies, fd;
+ if (SCARG(uap, nbytes) 0)
+ return EINVAL;
+ if (SCARG(uap, nbytes) == 0)
+ return 0;
+
fd = SCARG(uap, fd);
if ((error = fd_getvnode(fd, fp)) != 0)
return (error);
CVS commit: [netbsd-6] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 15:09:57 UTC 2014 Modified Files: src/doc [netbsd-6]: CHANGES-6.2 Log Message: Ticket 1113, 1114, 1115 and 1141. To generate a diff of this commit: cvs rdiff -u -r1.1.2.130 -r1.1.2.131 src/doc/CHANGES-6.2 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-6.2 diff -u src/doc/CHANGES-6.2:1.1.2.130 src/doc/CHANGES-6.2:1.1.2.131 --- src/doc/CHANGES-6.2:1.1.2.130 Sat Aug 16 00:56:58 2014 +++ src/doc/CHANGES-6.2 Wed Aug 27 15:09:57 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-6.2,v 1.1.2.130 2014/08/16 00:56:58 msaitoh Exp $ +# $NetBSD: CHANGES-6.2,v 1.1.2.131 2014/08/27 15:09:57 msaitoh Exp $ A complete list of changes from the 6.1 release until the 6.2 release: @@ -3685,3 +3685,29 @@ share/zoneinfo/zone1970.tabpatch and zone1970.dat). [apb, ticket #1107] +sbin/ccdconfig/ccdconfig.c 1.54 via patch +sys/dev/ccd.c 1.152 via patch +sys/dev/ccdvar.h1.34 via patch + + Switch size_t to uint64_t in appropriate places to ensure that ccd(4) + works with component and total sizes of 2TB. + Make kernel print device information when a ccd configured. + Fix some typos in comments. + [sborrill, ticket #1113] + +sys/netinet6/ip6_output.c 1.158 via patch + + Fix a memory leak in calling setsockopt() on an INET6 socket. + [maxv in ticket #1114] + +sys/fs/ptyfs/ptyfs_vfsops.c 1.52 +sys/miscfs/umapfs/umap_vfsops.c 1.94 + + Fix two overflows and a memory corruption bug in ptyfs and umapfs. + [maxv, ticket #1115] + +sys/compat/osf1/osf1_file.c 1.42 + + Fix a bug that a local user could crash the system by making the + kernel perform a zero-sized memory allocation in osf1. + [maxv, ticket #1141]
CVS commit: [netbsd-6-0] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 15:11:19 UTC 2014 Modified Files: src/doc [netbsd-6-0]: CHANGES-6.0.6 Log Message: Ticket 1114-1115 and 1141. To generate a diff of this commit: cvs rdiff -u -r1.1.2.22 -r1.1.2.23 src/doc/CHANGES-6.0.6 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-6.0.6 diff -u src/doc/CHANGES-6.0.6:1.1.2.22 src/doc/CHANGES-6.0.6:1.1.2.23 --- src/doc/CHANGES-6.0.6:1.1.2.22 Sat Aug 16 00:59:29 2014 +++ src/doc/CHANGES-6.0.6 Wed Aug 27 15:11:19 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-6.0.6,v 1.1.2.22 2014/08/16 00:59:29 msaitoh Exp $ +# $NetBSD: CHANGES-6.0.6,v 1.1.2.23 2014/08/27 15:11:19 msaitoh Exp $ A complete list of changes from the NetBSD 6.0.5 release to the NetBSD 6.0.6 release: @@ -1280,3 +1280,19 @@ share/zoneinfo/zone1970.tabpatch and zone1970.dat). [apb, ticket #1107] +sys/netinet6/ip6_output.c 1.158 via patch + + Fix a memory leak in calling setsockopt() on an INET6 socket. + [maxv in ticket #1114] + +sys/fs/ptyfs/ptyfs_vfsops.c 1.52 +sys/miscfs/umapfs/umap_vfsops.c 1.94 + + Fix two overflows and a memory corruption bug in ptyfs and umapfs. + [maxv, ticket #1115] + +sys/compat/osf1/osf1_file.c 1.42 + + Fix a bug that a local user could crash the system by making the + kernel perform a zero-sized memory allocation in osf1. + [maxv, ticket #1141]
CVS commit: [netbsd-6-1] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 15:10:59 UTC 2014 Modified Files: src/doc [netbsd-6-1]: CHANGES-6.1.5 Log Message: Ticket 1114-1115 and 1141. To generate a diff of this commit: cvs rdiff -u -r1.1.2.22 -r1.1.2.23 src/doc/CHANGES-6.1.5 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-6.1.5 diff -u src/doc/CHANGES-6.1.5:1.1.2.22 src/doc/CHANGES-6.1.5:1.1.2.23 --- src/doc/CHANGES-6.1.5:1.1.2.22 Sat Aug 16 00:58:45 2014 +++ src/doc/CHANGES-6.1.5 Wed Aug 27 15:10:59 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-6.1.5,v 1.1.2.22 2014/08/16 00:58:45 msaitoh Exp $ +# $NetBSD: CHANGES-6.1.5,v 1.1.2.23 2014/08/27 15:10:59 msaitoh Exp $ A complete list of changes from the NetBSD 6.1.4 release to the NetBSD 6.1.5 release: @@ -1280,3 +1280,19 @@ share/zoneinfo/zone1970.tabpatch and zone1970.dat). [apb, ticket #1107] +sys/netinet6/ip6_output.c 1.158 via patch + + Fix a memory leak in calling setsockopt() on an INET6 socket. + [maxv in ticket #1114] + +sys/fs/ptyfs/ptyfs_vfsops.c 1.52 +sys/miscfs/umapfs/umap_vfsops.c 1.94 + + Fix two overflows and a memory corruption bug in ptyfs and umapfs. + [maxv, ticket #1115] + +sys/compat/osf1/osf1_file.c 1.42 + + Fix a bug that a local user could crash the system by making the + kernel perform a zero-sized memory allocation in osf1. + [maxv, ticket #1141]
CVS commit: [netbsd-7] src/sys/compat/osf1
Module Name:src
Committed By: msaitoh
Date: Wed Aug 27 15:29:29 UTC 2014
Modified Files:
src/sys/compat/osf1 [netbsd-7]: osf1_file.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #54):
sys/compat/osf1/osf1_file.c: revision 1.42
Ensure nbytes 0. Otherwise bad things may happen.
Compile-tested only.
ok christos@
To generate a diff of this commit:
cvs rdiff -u -r1.41 -r1.41.28.1 src/sys/compat/osf1/osf1_file.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/compat/osf1/osf1_file.c
diff -u src/sys/compat/osf1/osf1_file.c:1.41 src/sys/compat/osf1/osf1_file.c:1.41.28.1
--- src/sys/compat/osf1/osf1_file.c:1.41 Fri Jul 22 10:02:08 2011
+++ src/sys/compat/osf1/osf1_file.c Wed Aug 27 15:29:29 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: osf1_file.c,v 1.41 2011/07/22 10:02:08 njoly Exp $ */
+/* $NetBSD: osf1_file.c,v 1.41.28.1 2014/08/27 15:29:29 msaitoh Exp $ */
/*
* Copyright (c) 1999 Christopher G. Demetriou. All rights reserved.
@@ -58,7 +58,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: osf1_file.c,v 1.41 2011/07/22 10:02:08 njoly Exp $);
+__KERNEL_RCSID(0, $NetBSD: osf1_file.c,v 1.41.28.1 2014/08/27 15:29:29 msaitoh Exp $);
#if defined(_KERNEL_OPT)
#include opt_syscall_debug.h
@@ -133,7 +133,7 @@ osf1_sys_getdirentries(struct lwp *l, co
/* {
syscallarg(int) fd;
syscallarg(char *) buf;
- syscallarg(u_int) nbytes;
+ syscallarg(int) nbytes;
syscallarg(long *) basep;
} */
struct dirent *bdp;
@@ -151,6 +151,11 @@ osf1_sys_getdirentries(struct lwp *l, co
off_t *cookiebuf = NULL, *cookie;
int ncookies, fd;
+ if (SCARG(uap, nbytes) 0)
+ return EINVAL;
+ if (SCARG(uap, nbytes) == 0)
+ return 0;
+
fd = SCARG(uap, fd);
if ((error = fd_getvnode(fd, fp)) != 0)
return (error);
CVS commit: src/sys/external/bsd/drm2/dist/drm/i915
Module Name:src
Committed By: riastradh
Date: Wed Aug 27 15:31:08 UTC 2014
Modified Files:
src/sys/external/bsd/drm2/dist/drm/i915: i915_irq.c
Log Message:
Fix two mistakes in previous.
- i915_error_wake_up is given irq_lock, so it need not take that.
- Unlock irq_lock on exit from i915_hangcheck_elapsed if ring_hung.
XXX This introduces the lock order irq_lock - pending_flip_lock.
How about just using irq_lock for pending flips?
To generate a diff of this commit:
cvs rdiff -u -r1.7 -r1.8 src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c
diff -u src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c:1.7 src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c:1.8
--- src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c:1.7 Wed Aug 27 13:21:15 2014
+++ src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c Wed Aug 27 15:31:08 2014
@@ -2138,11 +2138,10 @@ static void i915_error_wake_up(struct dr
* a gpu reset pending so that i915_error_work_func can acquire them).
*/
+ assert_spin_locked(dev_priv-irq_lock);
#ifdef __NetBSD__
- spin_lock(dev_priv-irq_lock);
for_each_ring(ring, dev_priv, i)
DRM_SPIN_WAKEUP_ALL(ring-irq_queue, dev_priv-irq_lock);
- spin_unlock(dev_priv-irq_lock);
spin_lock(dev_priv-pending_flip_lock);
DRM_SPIN_WAKEUP_ALL(dev_priv-pending_flip_queue,
@@ -2849,8 +2848,11 @@ static void i915_hangcheck_elapsed(unsig
}
}
- if (rings_hung)
- return i915_handle_error(dev, true, Ring hung);
+ if (rings_hung) {
+ i915_handle_error(dev, true, Ring hung);
+ spin_unlock(dev_priv-irq_lock);
+ return;
+ }
spin_unlock(dev_priv-irq_lock);
CVS commit: [netbsd-7] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 15:30:45 UTC 2014 Modified Files: src/doc [netbsd-7]: CHANGES-7.0 Log Message: Ticket 54. To generate a diff of this commit: cvs rdiff -u -r1.1.2.24 -r1.1.2.25 src/doc/CHANGES-7.0 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/doc/CHANGES-7.0 diff -u src/doc/CHANGES-7.0:1.1.2.24 src/doc/CHANGES-7.0:1.1.2.25 --- src/doc/CHANGES-7.0:1.1.2.24 Tue Aug 26 23:15:39 2014 +++ src/doc/CHANGES-7.0 Wed Aug 27 15:30:45 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-7.0,v 1.1.2.24 2014/08/26 23:15:39 riz Exp $ +# $NetBSD: CHANGES-7.0,v 1.1.2.25 2014/08/27 15:30:45 msaitoh Exp $ A complete list of changes from the initial NetBSD 7.0 branch on 11 Aug 2014 until the 7.0 release: @@ -393,3 +393,8 @@ sys/arch/sun3/dev/fd.c1.78 to memset(). [tsutsui, ticket #53] +sys/compat/osf1/osf1_file.c 1.42 + + Fix a bug that a local user could crash the system by making the + kernel perform a zero-sized memory allocation in osf1. + [maxv, ticket #54]
CVS commit: src/sys/external/bsd/drm2/linux
Module Name:src
Committed By: riastradh
Date: Wed Aug 27 16:05:38 UTC 2014
Modified Files:
src/sys/external/bsd/drm2/linux: linux_kmap.c
Log Message:
Convert linux_kmap_lock to an adaptive lock.
kmap/kunmap can't be used in interrupt context anyway, so there is no
need for this to be a spin lock.
To generate a diff of this commit:
cvs rdiff -u -r1.4 -r1.5 src/sys/external/bsd/drm2/linux/linux_kmap.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/external/bsd/drm2/linux/linux_kmap.c
diff -u src/sys/external/bsd/drm2/linux/linux_kmap.c:1.4 src/sys/external/bsd/drm2/linux/linux_kmap.c:1.5
--- src/sys/external/bsd/drm2/linux/linux_kmap.c:1.4 Fri Mar 28 23:22:27 2014
+++ src/sys/external/bsd/drm2/linux/linux_kmap.c Wed Aug 27 16:05:38 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: linux_kmap.c,v 1.4 2014/03/28 23:22:27 riastradh Exp $ */
+/* $NetBSD: linux_kmap.c,v 1.5 2014/08/27 16:05:38 riastradh Exp $ */
/*-
* Copyright (c) 2013 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: linux_kmap.c,v 1.4 2014/03/28 23:22:27 riastradh Exp $);
+__KERNEL_RCSID(0, $NetBSD: linux_kmap.c,v 1.5 2014/08/27 16:05:38 riastradh Exp $);
#include sys/types.h
#include sys/kmem.h
@@ -106,7 +106,7 @@ int
linux_kmap_init(void)
{
- /* IPL_VM is needed to block pmap_kenter_pa. */
+ /* IPL_VM since interrupt handlers use kmap_atomic. */
mutex_init(linux_kmap_atomic_lock, MUTEX_DEFAULT, IPL_VM);
linux_kmap_atomic_vaddr = uvm_km_alloc(kernel_map, PAGE_SIZE, 0,
@@ -115,7 +115,7 @@ linux_kmap_init(void)
KASSERT(linux_kmap_atomic_vaddr != 0);
KASSERT(!pmap_extract(pmap_kernel(), linux_kmap_atomic_vaddr, NULL));
- mutex_init(linux_kmap_lock, MUTEX_DEFAULT, IPL_VM);
+ mutex_init(linux_kmap_lock, MUTEX_DEFAULT, IPL_NONE);
rb_tree_init(linux_kmap_entries, linux_kmap_entry_ops);
return 0;
@@ -188,11 +188,11 @@ kmap(struct page *page)
lke-lke_paddr = paddr;
lke-lke_vaddr = vaddr;
- mutex_spin_enter(linux_kmap_lock);
+ mutex_enter(linux_kmap_lock);
struct linux_kmap_entry *const collision __unused =
rb_tree_insert_node(linux_kmap_entries, lke);
KASSERT(collision == lke);
- mutex_spin_exit(linux_kmap_lock);
+ mutex_exit(linux_kmap_lock);
KASSERT(!pmap_extract(pmap_kernel(), vaddr, NULL));
const int prot = (VM_PROT_READ | VM_PROT_WRITE);
@@ -208,12 +208,12 @@ kunmap(struct page *page)
{
const paddr_t paddr = VM_PAGE_TO_PHYS(page-p_vmp);
- mutex_spin_enter(linux_kmap_lock);
+ mutex_enter(linux_kmap_lock);
struct linux_kmap_entry *const lke =
rb_tree_find_node(linux_kmap_entries, paddr);
KASSERT(lke != NULL);
rb_tree_remove_node(linux_kmap_entries, lke);
- mutex_spin_exit(linux_kmap_lock);
+ mutex_exit(linux_kmap_lock);
const vaddr_t vaddr = lke-lke_vaddr;
kmem_free(lke, sizeof(*lke));
CVS commit: src/sys/external/bsd/drm2/linux
Module Name:src
Committed By: riastradh
Date: Wed Aug 27 16:06:38 UTC 2014
Modified Files:
src/sys/external/bsd/drm2/linux: linux_kmap.c
Log Message:
Simplify empty test for linux_kmap_entries.
To generate a diff of this commit:
cvs rdiff -u -r1.5 -r1.6 src/sys/external/bsd/drm2/linux/linux_kmap.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/external/bsd/drm2/linux/linux_kmap.c
diff -u src/sys/external/bsd/drm2/linux/linux_kmap.c:1.5 src/sys/external/bsd/drm2/linux/linux_kmap.c:1.6
--- src/sys/external/bsd/drm2/linux/linux_kmap.c:1.5 Wed Aug 27 16:05:38 2014
+++ src/sys/external/bsd/drm2/linux/linux_kmap.c Wed Aug 27 16:06:38 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: linux_kmap.c,v 1.5 2014/08/27 16:05:38 riastradh Exp $ */
+/* $NetBSD: linux_kmap.c,v 1.6 2014/08/27 16:06:38 riastradh Exp $ */
/*-
* Copyright (c) 2013 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: linux_kmap.c,v 1.5 2014/08/27 16:05:38 riastradh Exp $);
+__KERNEL_RCSID(0, $NetBSD: linux_kmap.c,v 1.6 2014/08/27 16:06:38 riastradh Exp $);
#include sys/types.h
#include sys/kmem.h
@@ -125,9 +125,8 @@ void
linux_kmap_fini(void)
{
- KASSERT(rb_tree_iterate(linux_kmap_entries, NULL, RB_DIR_RIGHT) ==
- NULL);
-#if 0/* XXX no rb_tree_destroy*/
+ KASSERT(RB_TREE_MIN(linux_kmap_entries) == NULL);
+#if 0/* XXX no rb_tree_destroy */
rb_tree_destroy(linux_kmap_entries);
#endif
mutex_destroy(linux_kmap_lock);
CVS commit: src/sys/external/bsd/drm2/linux
Module Name:src
Committed By: riastradh
Date: Wed Aug 27 16:09:16 UTC 2014
Modified Files:
src/sys/external/bsd/drm2/linux: linux_kmap.c
Log Message:
Assert sleepable in Linux kmap/kunmap.
To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 src/sys/external/bsd/drm2/linux/linux_kmap.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/external/bsd/drm2/linux/linux_kmap.c
diff -u src/sys/external/bsd/drm2/linux/linux_kmap.c:1.6 src/sys/external/bsd/drm2/linux/linux_kmap.c:1.7
--- src/sys/external/bsd/drm2/linux/linux_kmap.c:1.6 Wed Aug 27 16:06:38 2014
+++ src/sys/external/bsd/drm2/linux/linux_kmap.c Wed Aug 27 16:09:16 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: linux_kmap.c,v 1.6 2014/08/27 16:06:38 riastradh Exp $ */
+/* $NetBSD: linux_kmap.c,v 1.7 2014/08/27 16:09:16 riastradh Exp $ */
/*-
* Copyright (c) 2013 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: linux_kmap.c,v 1.6 2014/08/27 16:06:38 riastradh Exp $);
+__KERNEL_RCSID(0, $NetBSD: linux_kmap.c,v 1.7 2014/08/27 16:09:16 riastradh Exp $);
#include sys/types.h
#include sys/kmem.h
@@ -178,6 +178,9 @@ void *
kmap(struct page *page)
{
const paddr_t paddr = VM_PAGE_TO_PHYS(page-p_vmp);
+
+ ASSERT_SLEEPABLE();
+
const vaddr_t vaddr = uvm_km_alloc(kernel_map, PAGE_SIZE, 0,
(UVM_KMF_VAONLY | UVM_KMF_WAITVA));
KASSERT(vaddr != 0);
@@ -207,6 +210,8 @@ kunmap(struct page *page)
{
const paddr_t paddr = VM_PAGE_TO_PHYS(page-p_vmp);
+ ASSERT_SLEEPABLE();
+
mutex_enter(linux_kmap_lock);
struct linux_kmap_entry *const lke =
rb_tree_find_node(linux_kmap_entries, paddr);
CVS commit: src/sys/external/bsd/drm2/linux
Module Name:src Committed By: riastradh Date: Wed Aug 27 16:11:24 UTC 2014 Modified Files: src/sys/external/bsd/drm2/linux: linux_kmap.c Log Message: __diagused, not __unused. To generate a diff of this commit: cvs rdiff -u -r1.7 -r1.8 src/sys/external/bsd/drm2/linux/linux_kmap.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/external/bsd/drm2/linux/linux_kmap.c diff -u src/sys/external/bsd/drm2/linux/linux_kmap.c:1.7 src/sys/external/bsd/drm2/linux/linux_kmap.c:1.8 --- src/sys/external/bsd/drm2/linux/linux_kmap.c:1.7 Wed Aug 27 16:09:16 2014 +++ src/sys/external/bsd/drm2/linux/linux_kmap.c Wed Aug 27 16:11:24 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: linux_kmap.c,v 1.7 2014/08/27 16:09:16 riastradh Exp $ */ +/* $NetBSD: linux_kmap.c,v 1.8 2014/08/27 16:11:24 riastradh Exp $ */ /*- * Copyright (c) 2013 The NetBSD Foundation, Inc. @@ -30,7 +30,7 @@ */ #include sys/cdefs.h -__KERNEL_RCSID(0, $NetBSD: linux_kmap.c,v 1.7 2014/08/27 16:09:16 riastradh Exp $); +__KERNEL_RCSID(0, $NetBSD: linux_kmap.c,v 1.8 2014/08/27 16:11:24 riastradh Exp $); #include sys/types.h #include sys/kmem.h @@ -191,7 +191,7 @@ kmap(struct page *page) lke-lke_vaddr = vaddr; mutex_enter(linux_kmap_lock); - struct linux_kmap_entry *const collision __unused = + struct linux_kmap_entry *const collision __diagused = rb_tree_insert_node(linux_kmap_entries, lke); KASSERT(collision == lke); mutex_exit(linux_kmap_lock);
CVS commit: src/sys/external/bsd/drm2/linux
Module Name:src
Committed By: riastradh
Date: Wed Aug 27 16:19:54 UTC 2014
Modified Files:
src/sys/external/bsd/drm2/linux: linux_kmap.c
Log Message:
Tweak style.
No functional change intended. Assembly differences appear to be
only related to kassert line numbers.
To generate a diff of this commit:
cvs rdiff -u -r1.8 -r1.9 src/sys/external/bsd/drm2/linux/linux_kmap.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/external/bsd/drm2/linux/linux_kmap.c
diff -u src/sys/external/bsd/drm2/linux/linux_kmap.c:1.8 src/sys/external/bsd/drm2/linux/linux_kmap.c:1.9
--- src/sys/external/bsd/drm2/linux/linux_kmap.c:1.8 Wed Aug 27 16:11:24 2014
+++ src/sys/external/bsd/drm2/linux/linux_kmap.c Wed Aug 27 16:19:54 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: linux_kmap.c,v 1.8 2014/08/27 16:11:24 riastradh Exp $ */
+/* $NetBSD: linux_kmap.c,v 1.9 2014/08/27 16:19:54 riastradh Exp $ */
/*-
* Copyright (c) 2013 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: linux_kmap.c,v 1.8 2014/08/27 16:11:24 riastradh Exp $);
+__KERNEL_RCSID(0, $NetBSD: linux_kmap.c,v 1.9 2014/08/27 16:19:54 riastradh Exp $);
#include sys/types.h
#include sys/kmem.h
@@ -144,16 +144,13 @@ void *
kmap_atomic(struct page *page)
{
const paddr_t paddr = uvm_vm_page_to_phys(page-p_vmp);
+ vaddr_t vaddr;
mutex_spin_enter(linux_kmap_atomic_lock);
-
KASSERT(linux_kmap_atomic_vaddr != 0);
KASSERT(!pmap_extract(pmap_kernel(), linux_kmap_atomic_vaddr, NULL));
-
- const vaddr_t vaddr = linux_kmap_atomic_vaddr;
- const int prot = (VM_PROT_READ | VM_PROT_WRITE);
- const int flags = 0;
- pmap_kenter_pa(vaddr, paddr, prot, flags);
+ vaddr = linux_kmap_atomic_vaddr;
+ pmap_kenter_pa(vaddr, paddr, (VM_PROT_READ | VM_PROT_WRITE), 0);
pmap_update(pmap_kernel());
return (void *)vaddr;
@@ -178,10 +175,11 @@ void *
kmap(struct page *page)
{
const paddr_t paddr = VM_PAGE_TO_PHYS(page-p_vmp);
+ vaddr_t vaddr;
ASSERT_SLEEPABLE();
- const vaddr_t vaddr = uvm_km_alloc(kernel_map, PAGE_SIZE, 0,
+ vaddr = uvm_km_alloc(kernel_map, PAGE_SIZE, 0,
(UVM_KMF_VAONLY | UVM_KMF_WAITVA));
KASSERT(vaddr != 0);
@@ -197,9 +195,7 @@ kmap(struct page *page)
mutex_exit(linux_kmap_lock);
KASSERT(!pmap_extract(pmap_kernel(), vaddr, NULL));
- const int prot = (VM_PROT_READ | VM_PROT_WRITE);
- const int flags = 0;
- pmap_kenter_pa(vaddr, paddr, prot, flags);
+ pmap_kenter_pa(vaddr, paddr, (VM_PROT_READ | VM_PROT_WRITE), 0);
pmap_update(pmap_kernel());
return (void *)vaddr;
CVS commit: src/sys/external/bsd/drm2/linux
Module Name:src
Committed By: riastradh
Date: Wed Aug 27 16:41:50 UTC 2014
Modified Files:
src/sys/external/bsd/drm2/linux: linux_kmap.c
Log Message:
Use direct map if available in linux_kmap.
Yields 20% increase in glxgears framerate.
To generate a diff of this commit:
cvs rdiff -u -r1.9 -r1.10 src/sys/external/bsd/drm2/linux/linux_kmap.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/external/bsd/drm2/linux/linux_kmap.c
diff -u src/sys/external/bsd/drm2/linux/linux_kmap.c:1.9 src/sys/external/bsd/drm2/linux/linux_kmap.c:1.10
--- src/sys/external/bsd/drm2/linux/linux_kmap.c:1.9 Wed Aug 27 16:19:54 2014
+++ src/sys/external/bsd/drm2/linux/linux_kmap.c Wed Aug 27 16:41:50 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: linux_kmap.c,v 1.9 2014/08/27 16:19:54 riastradh Exp $ */
+/* $NetBSD: linux_kmap.c,v 1.10 2014/08/27 16:41:50 riastradh Exp $ */
/*-
* Copyright (c) 2013 The NetBSD Foundation, Inc.
@@ -30,13 +30,17 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: linux_kmap.c,v 1.9 2014/08/27 16:19:54 riastradh Exp $);
+__KERNEL_RCSID(0, $NetBSD: linux_kmap.c,v 1.10 2014/08/27 16:41:50 riastradh Exp $);
#include sys/types.h
#include sys/kmem.h
#include sys/mutex.h
#include sys/rbtree.h
+#ifdef __HAVE_MM_MD_DIRECT_MAPPED_PHYS
+#include dev/mm.h
+#endif
+
#include uvm/uvm_extern.h
#include linux/highmem.h
@@ -48,12 +52,6 @@ __KERNEL_RCSID(0, $NetBSD: linux_kmap.c
* use at a time.
*/
-/*
- * XXX Use direct-mapped physical pages where available, e.g. amd64.
- *
- * XXX ...or add an abstraction to uvm for this. (uvm_emap?)
- */
-
static kmutex_t linux_kmap_atomic_lock;
static vaddr_t linux_kmap_atomic_vaddr;
@@ -146,6 +144,11 @@ kmap_atomic(struct page *page)
const paddr_t paddr = uvm_vm_page_to_phys(page-p_vmp);
vaddr_t vaddr;
+#ifdef __HAVE_MM_MD_DIRECT_MAPPED_PHYS
+ if (mm_md_direct_mapped_phys(paddr, vaddr))
+ return (void *)vaddr;
+#endif
+
mutex_spin_enter(linux_kmap_atomic_lock);
KASSERT(linux_kmap_atomic_vaddr != 0);
KASSERT(!pmap_extract(pmap_kernel(), linux_kmap_atomic_vaddr, NULL));
@@ -161,6 +164,19 @@ kunmap_atomic(void *addr)
{
const vaddr_t vaddr = (vaddr_t)addr;
+#ifdef __HAVE_MM_MD_DIRECT_MAPPED_PHYS
+{
+ paddr_t paddr;
+ vaddr_t vaddr1;
+ bool ok __diagused;
+
+ ok = pmap_extract(pmap_kernel(), vaddr, paddr);
+ KASSERT(ok);
+ if (mm_md_direct_mapped_phys(paddr, vaddr1) vaddr1 == vaddr)
+ return;
+}
+#endif
+
KASSERT(mutex_owned(linux_kmap_atomic_lock));
KASSERT(linux_kmap_atomic_vaddr == vaddr);
KASSERT(pmap_extract(pmap_kernel(), vaddr, NULL));
@@ -179,6 +195,11 @@ kmap(struct page *page)
ASSERT_SLEEPABLE();
+#ifdef __HAVE_MM_MD_DIRECT_MAPPED_PHYS
+ if (mm_md_direct_mapped_phys(paddr, vaddr))
+ return (void *)vaddr;
+#endif
+
vaddr = uvm_km_alloc(kernel_map, PAGE_SIZE, 0,
(UVM_KMF_VAONLY | UVM_KMF_WAITVA));
KASSERT(vaddr != 0);
@@ -208,6 +229,15 @@ kunmap(struct page *page)
ASSERT_SLEEPABLE();
+#ifdef __HAVE_MM_MD_DIRECT_MAPPED_PHYS
+{
+ vaddr_t vaddr1;
+
+ if (mm_md_direct_mapped_phys(paddr, vaddr1))
+ return;
+}
+#endif
+
mutex_enter(linux_kmap_lock);
struct linux_kmap_entry *const lke =
rb_tree_find_node(linux_kmap_entries, paddr);
CVS commit: [netbsd-5-1] src/sys/netinet6
Module Name:src Committed By: msaitoh Date: Wed Aug 27 17:05:25 UTC 2014 Modified Files: src/sys/netinet6 [netbsd-5-1]: ip6_output.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1920): sys/netinet6/ip6_output.c 1.158 via patch Fix a memory leak in calling setsockopt() on an INET6 socket. To generate a diff of this commit: cvs rdiff -u -r1.135.2.1 -r1.135.2.1.6.1 src/sys/netinet6/ip6_output.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/netinet6/ip6_output.c diff -u src/sys/netinet6/ip6_output.c:1.135.2.1 src/sys/netinet6/ip6_output.c:1.135.2.1.6.1 --- src/sys/netinet6/ip6_output.c:1.135.2.1 Mon Apr 20 22:56:04 2009 +++ src/sys/netinet6/ip6_output.c Wed Aug 27 17:05:25 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: ip6_output.c,v 1.135.2.1 2009/04/20 22:56:04 snj Exp $ */ +/* $NetBSD: ip6_output.c,v 1.135.2.1.6.1 2014/08/27 17:05:25 msaitoh Exp $ */ /* $KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $ */ /* @@ -62,7 +62,7 @@ */ #include sys/cdefs.h -__KERNEL_RCSID(0, $NetBSD: ip6_output.c,v 1.135.2.1 2009/04/20 22:56:04 snj Exp $); +__KERNEL_RCSID(0, $NetBSD: ip6_output.c,v 1.135.2.1.6.1 2014/08/27 17:05:25 msaitoh Exp $); #include opt_inet.h #include opt_inet6.h @@ -1794,6 +1794,8 @@ else \ optp = in6p-in6p_outputopts; error = ip6_pcbopt(optname, optbuf, optbuflen, optp, privileged, uproto); + + free(optbuf, M_IP6OPT); break; } #undef OPTSET
CVS commit: [netbsd-5-2] src/sys/netinet6
Module Name:src Committed By: msaitoh Date: Wed Aug 27 17:06:10 UTC 2014 Modified Files: src/sys/netinet6 [netbsd-5-2]: ip6_output.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1920): sys/netinet6/ip6_output.c 1.158 via patch Fix a memory leak in calling setsockopt() on an INET6 socket. To generate a diff of this commit: cvs rdiff -u -r1.135.2.1 -r1.135.2.1.10.1 src/sys/netinet6/ip6_output.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/netinet6/ip6_output.c diff -u src/sys/netinet6/ip6_output.c:1.135.2.1 src/sys/netinet6/ip6_output.c:1.135.2.1.10.1 --- src/sys/netinet6/ip6_output.c:1.135.2.1 Mon Apr 20 22:56:04 2009 +++ src/sys/netinet6/ip6_output.c Wed Aug 27 17:06:10 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: ip6_output.c,v 1.135.2.1 2009/04/20 22:56:04 snj Exp $ */ +/* $NetBSD: ip6_output.c,v 1.135.2.1.10.1 2014/08/27 17:06:10 msaitoh Exp $ */ /* $KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $ */ /* @@ -62,7 +62,7 @@ */ #include sys/cdefs.h -__KERNEL_RCSID(0, $NetBSD: ip6_output.c,v 1.135.2.1 2009/04/20 22:56:04 snj Exp $); +__KERNEL_RCSID(0, $NetBSD: ip6_output.c,v 1.135.2.1.10.1 2014/08/27 17:06:10 msaitoh Exp $); #include opt_inet.h #include opt_inet6.h @@ -1794,6 +1794,8 @@ else \ optp = in6p-in6p_outputopts; error = ip6_pcbopt(optname, optbuf, optbuflen, optp, privileged, uproto); + + free(optbuf, M_IP6OPT); break; } #undef OPTSET
CVS commit: src/sys/arch/sparc64/dev
Module Name:src
Committed By: palle
Date: Wed Aug 27 19:02:17 UTC 2014
Modified Files:
src/sys/arch/sparc64/dev: ebus_mainbus.c
Log Message:
Use device_lookup() to locate device instances
To generate a diff of this commit:
cvs rdiff -u -r1.13 -r1.14 src/sys/arch/sparc64/dev/ebus_mainbus.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/arch/sparc64/dev/ebus_mainbus.c
diff -u src/sys/arch/sparc64/dev/ebus_mainbus.c:1.13 src/sys/arch/sparc64/dev/ebus_mainbus.c:1.14
--- src/sys/arch/sparc64/dev/ebus_mainbus.c:1.13 Sun Aug 24 19:06:14 2014
+++ src/sys/arch/sparc64/dev/ebus_mainbus.c Wed Aug 27 19:02:17 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: ebus_mainbus.c,v 1.13 2014/08/24 19:06:14 palle Exp $ */
+/* $NetBSD: ebus_mainbus.c,v 1.14 2014/08/27 19:02:17 palle Exp $ */
/* $OpenBSD: ebus_mainbus.c,v 1.7 2010/11/11 17:58:23 miod Exp $ */
/*
@@ -18,7 +18,7 @@
*/
#include sys/cdefs.h
-__KERNEL_RCSID(0, $NetBSD: ebus_mainbus.c,v 1.13 2014/08/24 19:06:14 palle Exp $);
+__KERNEL_RCSID(0, $NetBSD: ebus_mainbus.c,v 1.14 2014/08/27 19:02:17 palle Exp $);
#ifdef DEBUG
#define EDB_PROM 0x01
@@ -56,7 +56,7 @@ extern int ebus_debug;
#include dev/ebus/ebusvar.h
#include sparc64/dev/ebusvar.h
-extern struct cfdriver pyro_cd;
+#include ioconf.h
int ebus_mainbus_match(device_t, cfdata_t, void *);
void ebus_mainbus_attach(device_t, device_t, void *);
@@ -146,7 +146,7 @@ ebus_mainbus_attach(device_t parent, dev
*/
for (i = 0; i sc-sc_nintmap; i++) {
for (j = 0; j pyro_cd.cd_ndevs; j++) {
- device_t dt = pyro_cd.cd_devs[j];
+ device_t dt = device_lookup(pyro_cd, j);
psc = device_private(dt);
if (psc psc-sc_node == sc-sc_intmap[i].cnode) {
sc-sc_intmap[i].cintr |= psc-sc_ign;
@@ -337,7 +337,7 @@ XXX
int i;
for (i = 0; i pyro_cd.cd_ndevs; i++) {
- device_t dt = pyro_cd.cd_devs[i];
+ device_t dt = device_lookup(pyro_cd, i);
psc = device_private(dt);
if (psc psc-sc_ign == INTIGN(ihandle)) {
break;
CVS commit: src/sys/external/bsd/drm2/dist/drm/i915
Module Name:src Committed By: riastradh Date: Wed Aug 27 23:30:26 UTC 2014 Modified Files: src/sys/external/bsd/drm2/dist/drm/i915: i915_irq.c Log Message: Lock irq_lock around i915_error_wake_up in i915_error_work_func. To generate a diff of this commit: cvs rdiff -u -r1.8 -r1.9 src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c diff -u src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c:1.8 src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c:1.9 --- src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c:1.8 Wed Aug 27 15:31:08 2014 +++ src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c Wed Aug 27 23:30:26 2014 @@ -2249,7 +2249,9 @@ static void i915_error_work_func(struct * Note: The wake_up also serves as a memory barrier so that * waiters see the update value of the reset counter atomic_t. */ + spin_lock(dev_priv-irq_lock); i915_error_wake_up(dev_priv, true); + spin_unlock(dev_priv-irq_lock); } }
CVS commit: [netbsd-5] src/sys/miscfs/umapfs
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:02:48 UTC 2014 Modified Files: src/sys/miscfs/umapfs [netbsd-5]: umap_vfsops.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1921): sys/miscfs/umapfs/umap_vfsops.c: revision 1.94 1) 'error' is returned while it does not even hold an error code. Which means that zero is returned, and the kernel keeps mounting (and it probably ends up in a deadlock/memory corruption somewhere). 2) 'nentries' and 'gnentries' are int and user-controlled, and there's no check to ensure they are greater than zero. Since they are used to compute the size of two copyin's, a user can control the copied size by giving a negative value (like 128-2^29), and thus overwrite kernel memory. Both triggerable from root only. To generate a diff of this commit: cvs rdiff -u -r1.80.6.1 -r1.80.6.2 src/sys/miscfs/umapfs/umap_vfsops.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-1] src/sys/miscfs/umapfs
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:04:17 UTC 2014 Modified Files: src/sys/miscfs/umapfs [netbsd-5-1]: umap_vfsops.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1921): sys/miscfs/umapfs/umap_vfsops.c: revision 1.94 1) 'error' is returned while it does not even hold an error code. Which means that zero is returned, and the kernel keeps mounting (and it probably ends up in a deadlock/memory corruption somewhere). 2) 'nentries' and 'gnentries' are int and user-controlled, and there's no check to ensure they are greater than zero. Since they are used to compute the size of two copyin's, a user can control the copied size by giving a negative value (like 128-2^29), and thus overwrite kernel memory. Both triggerable from root only. To generate a diff of this commit: cvs rdiff -u -r1.80.12.1 -r1.80.12.2 src/sys/miscfs/umapfs/umap_vfsops.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-2] src/sys/miscfs/umapfs
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:04:00 UTC 2014 Modified Files: src/sys/miscfs/umapfs [netbsd-5-2]: umap_vfsops.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1921): sys/miscfs/umapfs/umap_vfsops.c: revision 1.94 1) 'error' is returned while it does not even hold an error code. Which means that zero is returned, and the kernel keeps mounting (and it probably ends up in a deadlock/memory corruption somewhere). 2) 'nentries' and 'gnentries' are int and user-controlled, and there's no check to ensure they are greater than zero. Since they are used to compute the size of two copyin's, a user can control the copied size by giving a negative value (like 128-2^29), and thus overwrite kernel memory. Both triggerable from root only. To generate a diff of this commit: cvs rdiff -u -r1.80.16.1 -r1.80.16.2 src/sys/miscfs/umapfs/umap_vfsops.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5] src/sys/dev/pci
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:14:06 UTC 2014 Modified Files: src/sys/dev/pci [netbsd-5]: pci_usrreq.c Log Message: Pull up following revision(s) (requested by riastradh in ticket #1922): sys/dev/pci/pci_usrreq.c1.26 via patch Fix to make pci(4) reject unaligned configuration register reads and writes before feeding them to a kassert in pci_conf_read/write or to a trap in the hardware itself. To generate a diff of this commit: cvs rdiff -u -r1.16.6.3 -r1.16.6.4 src/sys/dev/pci/pci_usrreq.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-1] src/sys/dev/pci
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:17:32 UTC 2014 Modified Files: src/sys/dev/pci [netbsd-5-1]: pci_usrreq.c Log Message: Pull up following revision(s) (requested by riastradh in ticket #1922): sys/dev/pci/pci_usrreq.c1.26 via patch Fix to make pci(4) reject unaligned configuration register reads and writes before feeding them to a kassert in pci_conf_read/write or to a trap in the hardware itself. To generate a diff of this commit: cvs rdiff -u -r1.16.6.3 -r1.16.6.3.2.1 src/sys/dev/pci/pci_usrreq.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-2] src/sys/dev/pci
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:17:06 UTC 2014 Modified Files: src/sys/dev/pci [netbsd-5-2]: pci_usrreq.c Log Message: Pull up following revision(s) (requested by riastradh in ticket #1922): sys/dev/pci/pci_usrreq.c1.26 via patch Fix to make pci(4) reject unaligned configuration register reads and writes before feeding them to a kassert in pci_conf_read/write or to a trap in the hardware itself. To generate a diff of this commit: cvs rdiff -u -r1.16.6.3 -r1.16.6.3.6.1 src/sys/dev/pci/pci_usrreq.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:57:36 UTC 2014 Modified Files: src/doc [netbsd-5]: CHANGES-5.3 Log Message: Ticket 1912, 1919, 1921 and 1922. To generate a diff of this commit: cvs rdiff -u -r1.1.2.66 -r1.1.2.67 src/doc/CHANGES-5.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-2] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:58:14 UTC 2014 Modified Files: src/doc [netbsd-5-2]: CHANGES-5.2.3 Log Message: Ticket 1912, 1921 and 1922. To generate a diff of this commit: cvs rdiff -u -r1.1.2.15 -r1.1.2.16 src/doc/CHANGES-5.2.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-1] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 06:58:38 UTC 2014 Modified Files: src/doc [netbsd-5-1]: CHANGES-5.1.5 Log Message: Ticket 1912, 1921 and 1922. To generate a diff of this commit: cvs rdiff -u -r1.1.2.14 -r1.1.2.15 src/doc/CHANGES-5.1.5 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-2] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 07:39:22 UTC 2014 Modified Files: src/doc [netbsd-5-2]: CHANGES-5.2.3 Log Message: s/a/an/ To generate a diff of this commit: cvs rdiff -u -r1.1.2.16 -r1.1.2.17 src/doc/CHANGES-5.2.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-1] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 07:39:40 UTC 2014 Modified Files: src/doc [netbsd-5-1]: CHANGES-5.1.5 Log Message: s/a/an/ To generate a diff of this commit: cvs rdiff -u -r1.1.2.15 -r1.1.2.16 src/doc/CHANGES-5.1.5 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/usr.bin/make
Module Name:src Committed By: christos Date: Wed Aug 27 08:50:38 UTC 2014 Modified Files: src/usr.bin/make: suff.c Log Message: Make .INVISIBLE nodes be ignored by suffix transformations. To generate a diff of this commit: cvs rdiff -u -r1.71 -r1.72 src/usr.bin/make/suff.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/sys/lib/libkern/arch/m68k
Module Name:src Committed By: christos Date: Wed Aug 27 08:51:37 UTC 2014 Modified Files: src/sys/lib/libkern/arch/m68k: Makefile.inc Log Message: use .INVISIBLE to hide random.S, instead of extra rules. To generate a diff of this commit: cvs rdiff -u -r1.32 -r1.33 src/sys/lib/libkern/arch/m68k/Makefile.inc Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/sys/external/bsd/drm2/dist/drm/i915
Module Name:src Committed By: riastradh Date: Wed Aug 27 13:21:15 UTC 2014 Modified Files: src/sys/external/bsd/drm2/dist/drm/i915: i915_irq.c Log Message: Fix i915 locking around error handling. To generate a diff of this commit: cvs rdiff -u -r1.6 -r1.7 src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5] src/crypto/dist/openssl
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:29:56 UTC 2014 Modified Files: src/crypto/dist/openssl/crypto/asn1 [netbsd-5]: a_object.c asn1.h asn1_err.c src/crypto/dist/openssl/crypto/objects [netbsd-5]: obj_dat.c src/crypto/dist/openssl/ssl [netbsd-5]: d1_both.c s23_srvr.c s3_clnt.c t1_lib.c Log Message: Pull up following revision(s) (requested by spz in ticket #1918): crypto/dist/openssl/crypto/asn1/a_object.c patch crypto/dist/openssl/crypto/asn1/asn1.h patch crypto/dist/openssl/crypto/asn1/asn1_err.c patch crypto/dist/openssl/crypto/objects/obj_dat.cpatch crypto/dist/openssl/ssl/d1_both.c patch crypto/dist/openssl/ssl/s23_srvr.c patch crypto/dist/openssl/ssl/s3_clnt.c patch crypto/dist/openssl/ssl/t1_lib.cpatch Patches for the following vulnerabilities: Information leak in pretty printing functions (CVE-2014-3508) Double Free when processing DTLS packets (CVE-2014-3505) DTLS memory exhaustion (CVE-2014-3506) DTLS memory leak from zero-length fragments (CVE-2014-3507) OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510) Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509) OpenSSL TLS protocol downgrade attack (CVE-2014-3511) backported from the recent 1.0.1i OpenSSL release. To generate a diff of this commit: cvs rdiff -u -r1.1.1.7 -r1.1.1.7.4.1 \ src/crypto/dist/openssl/crypto/asn1/a_object.c cvs rdiff -u -r1.9.4.1 -r1.9.4.2 src/crypto/dist/openssl/crypto/asn1/asn1.h cvs rdiff -u -r1.1.1.8.4.1 -r1.1.1.8.4.2 \ src/crypto/dist/openssl/crypto/asn1/asn1_err.c cvs rdiff -u -r1.10 -r1.10.4.1 \ src/crypto/dist/openssl/crypto/objects/obj_dat.c cvs rdiff -u -r1.3.4.3 -r1.3.4.4 src/crypto/dist/openssl/ssl/d1_both.c cvs rdiff -u -r1.6 -r1.6.4.1 src/crypto/dist/openssl/ssl/s23_srvr.c cvs rdiff -u -r1.12.4.4 -r1.12.4.5 src/crypto/dist/openssl/ssl/s3_clnt.c cvs rdiff -u -r1.2.4.3 -r1.2.4.4 src/crypto/dist/openssl/ssl/t1_lib.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-2] src/crypto/dist/openssl
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:30:49 UTC 2014 Modified Files: src/crypto/dist/openssl/crypto/asn1 [netbsd-5-2]: a_object.c asn1.h asn1_err.c src/crypto/dist/openssl/crypto/objects [netbsd-5-2]: obj_dat.c src/crypto/dist/openssl/ssl [netbsd-5-2]: d1_both.c s23_srvr.c s3_clnt.c t1_lib.c Log Message: Pull up following revision(s) (requested by spz in ticket #1918): crypto/dist/openssl/crypto/asn1/a_object.c patch crypto/dist/openssl/crypto/asn1/asn1.h patch crypto/dist/openssl/crypto/asn1/asn1_err.c patch crypto/dist/openssl/crypto/objects/obj_dat.cpatch crypto/dist/openssl/ssl/d1_both.c patch crypto/dist/openssl/ssl/s23_srvr.c patch crypto/dist/openssl/ssl/s3_clnt.c patch crypto/dist/openssl/ssl/t1_lib.cpatch Patches for the following vulnerabilities: Information leak in pretty printing functions (CVE-2014-3508) Double Free when processing DTLS packets (CVE-2014-3505) DTLS memory exhaustion (CVE-2014-3506) DTLS memory leak from zero-length fragments (CVE-2014-3507) OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510) Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509) OpenSSL TLS protocol downgrade attack (CVE-2014-3511) backported from the recent 1.0.1i OpenSSL release. To generate a diff of this commit: cvs rdiff -u -r1.1.1.7 -r1.1.1.7.2.1 \ src/crypto/dist/openssl/crypto/asn1/a_object.c cvs rdiff -u -r1.9.4.1 -r1.9.4.1.10.1 \ src/crypto/dist/openssl/crypto/asn1/asn1.h cvs rdiff -u -r1.1.1.8.4.1 -r1.1.1.8.4.1.10.1 \ src/crypto/dist/openssl/crypto/asn1/asn1_err.c cvs rdiff -u -r1.10 -r1.10.2.1 \ src/crypto/dist/openssl/crypto/objects/obj_dat.c cvs rdiff -u -r1.3.4.2.6.1 -r1.3.4.2.6.2 \ src/crypto/dist/openssl/ssl/d1_both.c cvs rdiff -u -r1.6 -r1.6.2.1 src/crypto/dist/openssl/ssl/s23_srvr.c cvs rdiff -u -r1.12.4.3.4.1 -r1.12.4.3.4.2 \ src/crypto/dist/openssl/ssl/s3_clnt.c cvs rdiff -u -r1.2.4.3 -r1.2.4.3.2.1 src/crypto/dist/openssl/ssl/t1_lib.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/tests/lib/librumphijack
Module Name:src Committed By: gson Date: Wed Aug 27 13:32:16 UTC 2014 Modified Files: src/tests/lib/librumphijack: t_asyncio.sh Log Message: The 4 second timeout of the invafd test case is not always enough when running under qemu; increase it to 10 seconds. To generate a diff of this commit: cvs rdiff -u -r1.3 -r1.4 src/tests/lib/librumphijack/t_asyncio.sh Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-1] src/crypto/dist/openssl
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:32:35 UTC 2014 Modified Files: src/crypto/dist/openssl/crypto/asn1 [netbsd-5-1]: a_object.c asn1.h asn1_err.c src/crypto/dist/openssl/crypto/objects [netbsd-5-1]: obj_dat.c src/crypto/dist/openssl/ssl [netbsd-5-1]: d1_both.c s23_srvr.c s3_clnt.c t1_lib.c Log Message: Pull up following revision(s) (requested by spz in ticket #1918): crypto/dist/openssl/crypto/asn1/a_object.c patch crypto/dist/openssl/crypto/asn1/asn1.h patch crypto/dist/openssl/crypto/asn1/asn1_err.c patch crypto/dist/openssl/crypto/objects/obj_dat.cpatch crypto/dist/openssl/ssl/d1_both.c patch crypto/dist/openssl/ssl/s23_srvr.c patch crypto/dist/openssl/ssl/s3_clnt.c patch crypto/dist/openssl/ssl/t1_lib.cpatch Patches for the following vulnerabilities: Information leak in pretty printing functions (CVE-2014-3508) Double Free when processing DTLS packets (CVE-2014-3505) DTLS memory exhaustion (CVE-2014-3506) DTLS memory leak from zero-length fragments (CVE-2014-3507) OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510) Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509) OpenSSL TLS protocol downgrade attack (CVE-2014-3511) backported from the recent 1.0.1i OpenSSL release. To generate a diff of this commit: cvs rdiff -u -r1.1.1.7 -r1.1.1.7.12.1 \ src/crypto/dist/openssl/crypto/asn1/a_object.c cvs rdiff -u -r1.9.4.1 -r1.9.4.1.6.1 \ src/crypto/dist/openssl/crypto/asn1/asn1.h cvs rdiff -u -r1.1.1.8.4.1 -r1.1.1.8.4.1.6.1 \ src/crypto/dist/openssl/crypto/asn1/asn1_err.c cvs rdiff -u -r1.10 -r1.10.12.1 \ src/crypto/dist/openssl/crypto/objects/obj_dat.c cvs rdiff -u -r1.3.4.2.2.1 -r1.3.4.2.2.2 \ src/crypto/dist/openssl/ssl/d1_both.c cvs rdiff -u -r1.6 -r1.6.12.1 src/crypto/dist/openssl/ssl/s23_srvr.c cvs rdiff -u -r1.12.4.2.2.2 -r1.12.4.2.2.3 \ src/crypto/dist/openssl/ssl/s3_clnt.c cvs rdiff -u -r1.2.12.3 -r1.2.12.4 src/crypto/dist/openssl/ssl/t1_lib.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-1] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:35:45 UTC 2014 Modified Files: src/doc [netbsd-5-1]: CHANGES-5.1.5 Log Message: Ticket 1918. To generate a diff of this commit: cvs rdiff -u -r1.1.2.16 -r1.1.2.17 src/doc/CHANGES-5.1.5 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-2] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:35:30 UTC 2014 Modified Files: src/doc [netbsd-5-2]: CHANGES-5.2.3 Log Message: Ticket 1918. To generate a diff of this commit: cvs rdiff -u -r1.1.2.17 -r1.1.2.18 src/doc/CHANGES-5.2.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:35:12 UTC 2014 Modified Files: src/doc [netbsd-5]: CHANGES-5.3 Log Message: Ticket 1918. To generate a diff of this commit: cvs rdiff -u -r1.1.2.68 -r1.1.2.69 src/doc/CHANGES-5.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5] src/sys/netinet6
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:44:34 UTC 2014 Modified Files: src/sys/netinet6 [netbsd-5]: ip6_output.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1920): sys/netinet6/ip6_output.c 1.158 via patch Fix a memory leak in calling setsockopt() on an INET6 socket. To generate a diff of this commit: cvs rdiff -u -r1.135.2.1 -r1.135.2.2 src/sys/netinet6/ip6_output.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:46:20 UTC 2014 Modified Files: src/doc [netbsd-5]: CHANGES-5.3 Log Message: Ticket 1920. To generate a diff of this commit: cvs rdiff -u -r1.1.2.69 -r1.1.2.70 src/doc/CHANGES-5.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-2] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:46:40 UTC 2014 Modified Files: src/doc [netbsd-5-2]: CHANGES-5.2.3 Log Message: Ticket 1920. To generate a diff of this commit: cvs rdiff -u -r1.1.2.18 -r1.1.2.19 src/doc/CHANGES-5.2.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-5-1] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 13:46:54 UTC 2014 Modified Files: src/doc [netbsd-5-1]: CHANGES-5.1.5 Log Message: Ticket 1920. To generate a diff of this commit: cvs rdiff -u -r1.1.2.17 -r1.1.2.18 src/doc/CHANGES-5.1.5 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/etc
Module Name:src Committed By: apb Date: Wed Aug 27 13:56:02 UTC 2014 Modified Files: src/etc: security Log Message: Split some long lines. To generate a diff of this commit: cvs rdiff -u -r1.115 -r1.116 src/etc/security Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-6] src
Module Name:src Committed By: msaitoh Date: Wed Aug 27 14:39:19 UTC 2014 Modified Files: src/sbin/ccdconfig [netbsd-6]: ccdconfig.c src/sys/dev [netbsd-6]: ccd.c ccdvar.h Log Message: Pull up following revision(s) (requested by sborrill in ticket #1113): sbin/ccdconfig/ccdconfig.c 1.54 via patch sys/dev/ccd.c 1.152 via patch sys/dev/ccdvar.h1.34 via patch Switch size_t to uint64_t in appropriate places to ensure that ccd(4) works with component and total sizes of 2TB. Make kernel print device information when a ccd configured. Fix some typos in comments. To generate a diff of this commit: cvs rdiff -u -r1.51 -r1.51.4.1 src/sbin/ccdconfig/ccdconfig.c cvs rdiff -u -r1.143 -r1.143.6.1 src/sys/dev/ccd.c cvs rdiff -u -r1.32 -r1.32.10.1 src/sys/dev/ccdvar.h Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-6] src/sys/netinet6
Module Name:src Committed By: msaitoh Date: Wed Aug 27 14:44:42 UTC 2014 Modified Files: src/sys/netinet6 [netbsd-6]: ip6_output.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1114): sys/netinet6/ip6_output.c 1.158 via patch Fix a memory leak in calling setsockopt() on an INET6 socket. To generate a diff of this commit: cvs rdiff -u -r1.145 -r1.145.2.1 src/sys/netinet6/ip6_output.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-6-1] src/sys/netinet6
Module Name:src Committed By: msaitoh Date: Wed Aug 27 14:45:11 UTC 2014 Modified Files: src/sys/netinet6 [netbsd-6-1]: ip6_output.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1114): sys/netinet6/ip6_output.c 1.158 via patch Fix a memory leak in calling setsockopt() on an INET6 socket. To generate a diff of this commit: cvs rdiff -u -r1.145 -r1.145.8.1 src/sys/netinet6/ip6_output.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-6-0] src/sys/netinet6
Module Name:src Committed By: msaitoh Date: Wed Aug 27 14:45:59 UTC 2014 Modified Files: src/sys/netinet6 [netbsd-6-0]: ip6_output.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1114): sys/netinet6/ip6_output.c 1.158 via patch Fix a memory leak in calling setsockopt() on an INET6 socket. To generate a diff of this commit: cvs rdiff -u -r1.145 -r1.145.6.1 src/sys/netinet6/ip6_output.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-6] src/sys
Module Name:src Committed By: msaitoh Date: Wed Aug 27 14:53:26 UTC 2014 Modified Files: src/sys/fs/ptyfs [netbsd-6]: ptyfs_vfsops.c src/sys/miscfs/umapfs [netbsd-6]: umap_vfsops.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1115): sys/miscfs/umapfs/umap_vfsops.c: revision 1.94 sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.52 Overflow if *data_len == OSIZE and args-version = PTYFS_ARGSVERSION. Sent on tech-kern@, ok christos@ 1) 'error' is returned while it does not even hold an error code. Which means that zero is returned, and the kernel keeps mounting (and it probably ends up in a deadlock/memory corruption somewhere). 2) 'nentries' and 'gnentries' are int and user-controlled, and there's no check to ensure they are greater than zero. Since they are used to compute the size of two copyin's, a user can control the copied size by giving a negative value (like 128-2^29), and thus overwrite kernel memory. Both triggerable from root only. To generate a diff of this commit: cvs rdiff -u -r1.42.18.2 -r1.42.18.3 src/sys/fs/ptyfs/ptyfs_vfsops.c cvs rdiff -u -r1.86.14.1 -r1.86.14.2 src/sys/miscfs/umapfs/umap_vfsops.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-6-0] src/sys
Module Name:src Committed By: msaitoh Date: Wed Aug 27 14:59:22 UTC 2014 Modified Files: src/sys/fs/ptyfs [netbsd-6-0]: ptyfs_vfsops.c src/sys/miscfs/umapfs [netbsd-6-0]: umap_vfsops.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1115): sys/miscfs/umapfs/umap_vfsops.c: revision 1.94 sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.52 Overflow if *data_len == OSIZE and args-version = PTYFS_ARGSVERSION. Sent on tech-kern@, ok christos@ 1) 'error' is returned while it does not even hold an error code. Which means that zero is returned, and the kernel keeps mounting (and it probably ends up in a deadlock/memory corruption somewhere). 2) 'nentries' and 'gnentries' are int and user-controlled, and there's no check to ensure they are greater than zero. Since they are used to compute the size of two copyin's, a user can control the copied size by giving a negative value (like 128-2^29), and thus overwrite kernel memory. Both triggerable from root only. To generate a diff of this commit: cvs rdiff -u -r1.42.18.1.2.1 -r1.42.18.1.2.2 src/sys/fs/ptyfs/ptyfs_vfsops.c cvs rdiff -u -r1.86.18.1 -r1.86.18.2 src/sys/miscfs/umapfs/umap_vfsops.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-6] src/sys/compat/osf1
Module Name:src Committed By: msaitoh Date: Wed Aug 27 15:01:08 UTC 2014 Modified Files: src/sys/compat/osf1 [netbsd-6]: osf1_file.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1141): sys/compat/osf1/osf1_file.c: revision 1.42 Ensure nbytes 0. Otherwise bad things may happen. Compile-tested only. ok christos@ To generate a diff of this commit: cvs rdiff -u -r1.41 -r1.41.8.1 src/sys/compat/osf1/osf1_file.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-6-1] src/sys/compat/osf1
Module Name:src Committed By: msaitoh Date: Wed Aug 27 15:02:27 UTC 2014 Modified Files: src/sys/compat/osf1 [netbsd-6-1]: osf1_file.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1141): sys/compat/osf1/osf1_file.c: revision 1.42 Ensure nbytes 0. Otherwise bad things may happen. Compile-tested only. ok christos@ To generate a diff of this commit: cvs rdiff -u -r1.41 -r1.41.22.1 src/sys/compat/osf1/osf1_file.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-6-0] src/sys/compat/osf1
Module Name:src Committed By: msaitoh Date: Wed Aug 27 15:02:39 UTC 2014 Modified Files: src/sys/compat/osf1 [netbsd-6-0]: osf1_file.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1141): sys/compat/osf1/osf1_file.c: revision 1.42 Ensure nbytes 0. Otherwise bad things may happen. Compile-tested only. ok christos@ To generate a diff of this commit: cvs rdiff -u -r1.41 -r1.41.14.1 src/sys/compat/osf1/osf1_file.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-6-1] src/sys
Module Name:src Committed By: msaitoh Date: Wed Aug 27 14:59:06 UTC 2014 Modified Files: src/sys/fs/ptyfs [netbsd-6-1]: ptyfs_vfsops.c src/sys/miscfs/umapfs [netbsd-6-1]: umap_vfsops.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1115): sys/miscfs/umapfs/umap_vfsops.c: revision 1.94 sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.52 Overflow if *data_len == OSIZE and args-version = PTYFS_ARGSVERSION. Sent on tech-kern@, ok christos@ 1) 'error' is returned while it does not even hold an error code. Which means that zero is returned, and the kernel keeps mounting (and it probably ends up in a deadlock/memory corruption somewhere). 2) 'nentries' and 'gnentries' are int and user-controlled, and there's no check to ensure they are greater than zero. Since they are used to compute the size of two copyin's, a user can control the copied size by giving a negative value (like 128-2^29), and thus overwrite kernel memory. Both triggerable from root only. To generate a diff of this commit: cvs rdiff -u -r1.42.18.1.4.1 -r1.42.18.1.4.2 src/sys/fs/ptyfs/ptyfs_vfsops.c cvs rdiff -u -r1.86.20.1 -r1.86.20.2 src/sys/miscfs/umapfs/umap_vfsops.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-6] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 15:09:57 UTC 2014 Modified Files: src/doc [netbsd-6]: CHANGES-6.2 Log Message: Ticket 1113, 1114, 1115 and 1141. To generate a diff of this commit: cvs rdiff -u -r1.1.2.130 -r1.1.2.131 src/doc/CHANGES-6.2 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-6-0] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 15:11:19 UTC 2014 Modified Files: src/doc [netbsd-6-0]: CHANGES-6.0.6 Log Message: Ticket 1114-1115 and 1141. To generate a diff of this commit: cvs rdiff -u -r1.1.2.22 -r1.1.2.23 src/doc/CHANGES-6.0.6 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-6-1] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 15:10:59 UTC 2014 Modified Files: src/doc [netbsd-6-1]: CHANGES-6.1.5 Log Message: Ticket 1114-1115 and 1141. To generate a diff of this commit: cvs rdiff -u -r1.1.2.22 -r1.1.2.23 src/doc/CHANGES-6.1.5 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-7] src/doc
Module Name:src Committed By: msaitoh Date: Wed Aug 27 15:30:45 UTC 2014 Modified Files: src/doc [netbsd-7]: CHANGES-7.0 Log Message: Ticket 54. To generate a diff of this commit: cvs rdiff -u -r1.1.2.24 -r1.1.2.25 src/doc/CHANGES-7.0 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/sys/external/bsd/drm2/dist/drm/i915
Module Name:src Committed By: riastradh Date: Wed Aug 27 15:31:08 UTC 2014 Modified Files: src/sys/external/bsd/drm2/dist/drm/i915: i915_irq.c Log Message: Fix two mistakes in previous. - i915_error_wake_up is given irq_lock, so it need not take that. - Unlock irq_lock on exit from i915_hangcheck_elapsed if ring_hung. XXX This introduces the lock order irq_lock - pending_flip_lock. How about just using irq_lock for pending flips? To generate a diff of this commit: cvs rdiff -u -r1.7 -r1.8 src/sys/external/bsd/drm2/dist/drm/i915/i915_irq.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-7] src/sys/compat/osf1
Module Name:src Committed By: msaitoh Date: Wed Aug 27 15:29:29 UTC 2014 Modified Files: src/sys/compat/osf1 [netbsd-7]: osf1_file.c Log Message: Pull up following revision(s) (requested by maxv in ticket #54): sys/compat/osf1/osf1_file.c: revision 1.42 Ensure nbytes 0. Otherwise bad things may happen. Compile-tested only. ok christos@ To generate a diff of this commit: cvs rdiff -u -r1.41 -r1.41.28.1 src/sys/compat/osf1/osf1_file.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/sys/external/bsd/drm2/linux
Module Name:src Committed By: riastradh Date: Wed Aug 27 16:05:38 UTC 2014 Modified Files: src/sys/external/bsd/drm2/linux: linux_kmap.c Log Message: Convert linux_kmap_lock to an adaptive lock. kmap/kunmap can't be used in interrupt context anyway, so there is no need for this to be a spin lock. To generate a diff of this commit: cvs rdiff -u -r1.4 -r1.5 src/sys/external/bsd/drm2/linux/linux_kmap.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/sys/external/bsd/drm2/linux
Module Name:src Committed By: riastradh Date: Wed Aug 27 16:06:38 UTC 2014 Modified Files: src/sys/external/bsd/drm2/linux: linux_kmap.c Log Message: Simplify empty test for linux_kmap_entries. To generate a diff of this commit: cvs rdiff -u -r1.5 -r1.6 src/sys/external/bsd/drm2/linux/linux_kmap.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/sys/external/bsd/drm2/linux
Module Name:src Committed By: riastradh Date: Wed Aug 27 16:09:16 UTC 2014 Modified Files: src/sys/external/bsd/drm2/linux: linux_kmap.c Log Message: Assert sleepable in Linux kmap/kunmap. To generate a diff of this commit: cvs rdiff -u -r1.6 -r1.7 src/sys/external/bsd/drm2/linux/linux_kmap.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/sys/external/bsd/drm2/linux
Module Name:src Committed By: riastradh Date: Wed Aug 27 16:11:24 UTC 2014 Modified Files: src/sys/external/bsd/drm2/linux: linux_kmap.c Log Message: __diagused, not __unused. To generate a diff of this commit: cvs rdiff -u -r1.7 -r1.8 src/sys/external/bsd/drm2/linux/linux_kmap.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/sys/external/bsd/drm2/linux
Module Name:src Committed By: riastradh Date: Wed Aug 27 16:19:54 UTC 2014 Modified Files: src/sys/external/bsd/drm2/linux: linux_kmap.c Log Message: Tweak style. No functional change intended. Assembly differences appear to be only related to kassert line numbers. To generate a diff of this commit: cvs rdiff -u -r1.8 -r1.9 src/sys/external/bsd/drm2/linux/linux_kmap.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
