CVS commit: src/sys/arch/i386/conf

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Sat Jul 29 05:59:08 UTC 2017

Modified Files:
src/sys/arch/i386/conf: XEN3_DOM0 XEN3_DOMU

Log Message:
Disable COMPAT_386BSD_MBRPART on Xen - not enabled in GENERIC.


To generate a diff of this commit:
cvs rdiff -u -r1.114 -r1.115 src/sys/arch/i386/conf/XEN3_DOM0
cvs rdiff -u -r1.78 -r1.79 src/sys/arch/i386/conf/XEN3_DOMU

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/arch/i386/conf/XEN3_DOM0
diff -u src/sys/arch/i386/conf/XEN3_DOM0:1.114 src/sys/arch/i386/conf/XEN3_DOM0:1.115
--- src/sys/arch/i386/conf/XEN3_DOM0:1.114	Fri Jul 28 14:13:13 2017
+++ src/sys/arch/i386/conf/XEN3_DOM0	Sat Jul 29 05:59:08 2017
@@ -1,4 +1,4 @@
-#	$NetBSD: XEN3_DOM0,v 1.114 2017/07/28 14:13:13 maxv Exp $
+#	$NetBSD: XEN3_DOM0,v 1.115 2017/07/29 05:59:08 maxv Exp $
 #
 #	XEN3_0: Xen 3.0 domain0 kernel
 
@@ -93,7 +93,7 @@ options 	COMPAT_40	# NetBSD 4.0,
 options 	COMPAT_50	# NetBSD 5.0,
 options 	COMPAT_60	# NetBSD 6.0, and
 options 	COMPAT_70	# NetBSD 7.0 binary compatibility.
-options 	COMPAT_386BSD_MBRPART # recognize old partition ID
+#options 	COMPAT_386BSD_MBRPART # recognize old partition ID
 #options 	TCP_COMPAT_42	# 4.2BSD TCP/IP bug compat. Not recommended.
 
 options 	COMPAT_OSSAUDIO	# OSS (Voxware) audio driver compatibility

Index: src/sys/arch/i386/conf/XEN3_DOMU
diff -u src/sys/arch/i386/conf/XEN3_DOMU:1.78 src/sys/arch/i386/conf/XEN3_DOMU:1.79
--- src/sys/arch/i386/conf/XEN3_DOMU:1.78	Fri Jul 28 14:13:13 2017
+++ src/sys/arch/i386/conf/XEN3_DOMU	Sat Jul 29 05:59:08 2017
@@ -1,4 +1,4 @@
-# $NetBSD: XEN3_DOMU,v 1.78 2017/07/28 14:13:13 maxv Exp $
+# $NetBSD: XEN3_DOMU,v 1.79 2017/07/29 05:59:08 maxv Exp $
 
 include 	"arch/xen/conf/std.xen"
 
@@ -77,7 +77,7 @@ options 	COMPAT_40	# NetBSD 4.0,
 options 	COMPAT_50	# NetBSD 5.0,
 options 	COMPAT_60	# NetBSD 6.0, and
 options 	COMPAT_70	# NetBSD 7.0 binary compatibility.
-options 	COMPAT_386BSD_MBRPART # recognize old partition ID
+#options 	COMPAT_386BSD_MBRPART # recognize old partition ID
 #options 	TCP_COMPAT_42	# 4.2BSD TCP/IP bug compat. Not recommended.
 
 options 	COMPAT_OSSAUDIO	# OSS (Voxware) audio driver compatibility

CVS commit: src/sys/arch/i386/conf

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Sat Jul 29 05:59:08 UTC 2017

Modified Files:
src/sys/arch/i386/conf: XEN3_DOM0 XEN3_DOMU

Log Message:
Disable COMPAT_386BSD_MBRPART on Xen - not enabled in GENERIC.


To generate a diff of this commit:
cvs rdiff -u -r1.114 -r1.115 src/sys/arch/i386/conf/XEN3_DOM0
cvs rdiff -u -r1.78 -r1.79 src/sys/arch/i386/conf/XEN3_DOMU

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/dev

[Tetsuya Isaki]

Module Name:src
Committed By:   isaki
Date:   Sat Jul 29 05:55:58 UTC 2017

Modified Files:
src/sys/dev: audio.c

Log Message:
const-ify.


To generate a diff of this commit:
cvs rdiff -u -r1.376 -r1.377 src/sys/dev/audio.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/audio.c
diff -u src/sys/dev/audio.c:1.376 src/sys/dev/audio.c:1.377
--- src/sys/dev/audio.c:1.376	Sat Jul 29 03:05:51 2017
+++ src/sys/dev/audio.c	Sat Jul 29 05:55:58 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: audio.c,v 1.376 2017/07/29 03:05:51 isaki Exp $	*/
+/*	$NetBSD: audio.c,v 1.377 2017/07/29 05:55:58 isaki Exp $	*/
 
 /*-
  * Copyright (c) 2016 Nathanial Sloss 
@@ -148,7 +148,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: audio.c,v 1.376 2017/07/29 03:05:51 isaki Exp $");
+__KERNEL_RCSID(0, "$NetBSD: audio.c,v 1.377 2017/07/29 05:55:58 isaki Exp $");
 
 #ifdef _KERNEL_OPT
 #include "audio.h"
@@ -272,7 +272,7 @@ int	mix_read(void *);
 int	audio_check_params(struct audio_params *);
 
 void	audio_calc_blksize(struct audio_softc *, int, struct virtual_channel *);
-void	audio_fill_silence(struct audio_params *, uint8_t *, int);
+void	audio_fill_silence(const struct audio_params *, uint8_t *, int);
 int	audio_silence_copyout(struct audio_softc *, int, struct uio *);
 
 void	audio_init_ringbuffer(struct audio_softc *,
@@ -384,7 +384,7 @@ static int
 static int audio_set_params (struct audio_softc *, int, int,
 		 audio_params_t *, audio_params_t *,
 		 stream_filter_list_t *, stream_filter_list_t *,
-		 struct virtual_channel *);
+		 const struct virtual_channel *);
 static int
 audio_query_encoding(struct audio_softc *, struct audio_encoding *);
 static int audio_set_vchan_defaults(struct audio_softc *, u_int);
@@ -2681,7 +2681,7 @@ audio_calc_blksize(struct audio_softc *s
 }
 
 void
-audio_fill_silence(struct audio_params *params, uint8_t *p, int n)
+audio_fill_silence(const struct audio_params *params, uint8_t *p, int n)
 {
 	uint8_t auzero0, auzero1;
 	int nfill;
@@ -5824,7 +5824,7 @@ static int
 audio_set_params(struct audio_softc *sc, int setmode, int usemode,
 		 audio_params_t *play, audio_params_t *rec,
 		 stream_filter_list_t *pfil, stream_filter_list_t *rfil,
-		 struct virtual_channel *vc)
+		 const struct virtual_channel *vc)
 {
 	struct audio_chan *chan;
 	

CVS commit: src/sys/dev

[Tetsuya Isaki]

Module Name:src
Committed By:   isaki
Date:   Sat Jul 29 05:55:58 UTC 2017

Modified Files:
src/sys/dev: audio.c

Log Message:
const-ify.


To generate a diff of this commit:
cvs rdiff -u -r1.376 -r1.377 src/sys/dev/audio.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/netinet

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Sat Jul 29 05:48:16 UTC 2017

Modified Files:
src/sys/netinet: files.netinet

Log Message:
Remove TCP_COMPAT_42.


To generate a diff of this commit:
cvs rdiff -u -r1.27 -r1.28 src/sys/netinet/files.netinet

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/netinet

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Sat Jul 29 05:48:16 UTC 2017

Modified Files:
src/sys/netinet: files.netinet

Log Message:
Remove TCP_COMPAT_42.


To generate a diff of this commit:
cvs rdiff -u -r1.27 -r1.28 src/sys/netinet/files.netinet

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/netinet/files.netinet
diff -u src/sys/netinet/files.netinet:1.27 src/sys/netinet/files.netinet:1.28
--- src/sys/netinet/files.netinet:1.27	Tue Oct 13 21:28:35 2015
+++ src/sys/netinet/files.netinet	Sat Jul 29 05:48:16 2017
@@ -1,4 +1,4 @@
-#	$NetBSD: files.netinet,v 1.27 2015/10/13 21:28:35 rjs Exp $
+#	$NetBSD: files.netinet,v 1.28 2017/07/29 05:48:16 maxv Exp $
 
 defflag opt_tcp_debug.h		TCP_DEBUG
 defparam opt_tcp_debug.h	TCP_NDEBUG
@@ -8,7 +8,6 @@ defparam opt_inet_conf.h	SUBNETSARELOCAL
 
 defflagMROUTING
 defflagPIM
-defflagTCP_COMPAT_42
 
 defparam opt_tcp_space.h	TCP_RECVSPACE TCP_SENDSPACE
 

CVS commit: src/share/man/man4

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Sat Jul 29 05:46:29 UTC 2017

Modified Files:
src/share/man/man4: options.4

Log Message:
Remove TCP_COMPAT_42.


To generate a diff of this commit:
cvs rdiff -u -r1.467 -r1.468 src/share/man/man4/options.4

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/share/man/man4/options.4
diff -u src/share/man/man4/options.4:1.467 src/share/man/man4/options.4:1.468
--- src/share/man/man4/options.4:1.467	Mon Jul  3 21:30:58 2017
+++ src/share/man/man4/options.4	Sat Jul 29 05:46:29 2017
@@ -1,4 +1,4 @@
-.\"	$NetBSD: options.4,v 1.467 2017/07/03 21:30:58 wiz Exp $
+.\"	$NetBSD: options.4,v 1.468 2017/07/29 05:46:29 maxv Exp $
 .\"
 .\" Copyright (c) 1996
 .\" 	Perry E. Metzger.  All rights reserved.
@@ -30,7 +30,7 @@
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
 .\"
-.Dd March 9, 2017
+.Dd July 29, 2017
 .Dt OPTIONS 4
 .Os
 .Sh NAME
@@ -2012,21 +2012,6 @@ This can be useful if there is a desire 
 privileges to bind those ports, e.g., on firewalls.
 The security tradeoffs in doing this are subtle.
 This option should only be used by experts.
-.It Cd options TCP_COMPAT_42
-.Tn TCP
-bug compatibility with
-.Bx 4.2 .
-In
-.Bx 4.2 ,
-.Tn TCP
-sequence numbers were 32-bit signed values.
-Modern implementations of TCP use unsigned values.
-This option clamps the initial sequence number to start in
-the range 2^31 rather than the full unsigned range of 2^32.
-Also, under
-.Bx 4.2 ,
-keepalive packets must contain at least one byte or else
-the remote end would not respond.
 .It Cd options TCP_DEBUG
 Record the last
 .Em TCP_NDEBUG

CVS commit: src/share/man/man4

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Sat Jul 29 05:46:29 UTC 2017

Modified Files:
src/share/man/man4: options.4

Log Message:
Remove TCP_COMPAT_42.


To generate a diff of this commit:
cvs rdiff -u -r1.467 -r1.468 src/share/man/man4/options.4

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

audio null_filter (Re: CVS commit: src/sys/dev)

[Tetsuya Isaki]

Thanks nat@.  It works.
autoconfig succeeded and audioplay(1) also worked.
Please commit it.

# Although there is still another problem that the ring buffer
# management or somewhere is something wrong. :(

Can you describe audio(9) on cases using the special null_filter?

However, is it a correct solution to insert such an extra memcpy
filter?  It seems to me that it's trying to cover the first bug
with the second bug.

According to audio(9), we should pass the destination encoding
(ENCODING_ADPCM) as msm6258_slinear16_to_adpcm filter's parameter,
but msm6258_slinear16_to_adpcm filter seems to interrupt this
as source encoding (That is why I commited the diagnostic code
in sys/dev/ic/msm6258.c r1.18).  Therefore, I don't know details
but I can imagine that it works by inserting this null_filter.

Thanks,
---
Tetsuya Isaki <is...@pastel-flower.jp / is...@netbsd.org>

At Fri, 28 Jul 2017 09:58:37 +1000,
Nathanial Sloss wrote:
> Hi,
> 
> Please try the attached patch for vs(4) - It should auto configure now.
> 
> You'll need current sources from 20170728 with the changes to auconv with 
> null_filter.
> 
> NetBSD-8 is yet to be pulled up.
> 
> If the patch works - I'll commit it.
> 
> Best regards,
> 
> Nat
> 
> On Sun, 9 Jul 2017 22:52:46 Tetsuya Isaki wrote:
> > At Sun, 25 Jun 2017 02:47:28 +,
> > 
> > > Module Name:  src
> > > Committed By: nat
> > > Date: Sun Jun 25 02:47:28 UTC 2017
> > > 
> > > Modified Files:
> > >   src/sys/dev: audio.c
> > > 
> > > Log Message:
> > > Check validbits against precision in vchan_autoconfig.  At present
> > > validbits != precision is not supported.
> > > 
> > > This change will most likely break autoconfig on vs(4), for these
> > > machines the parameters can be set to the paramaters reported at attach
> > > time via sysctl.
> > 
> > Do you have any plan to revive it?
> > 
> > Thanks,
> > ---
> > Tetsuya Isaki <is...@pastel-flower.jp / is...@netbsd.org>
> [2 vs.c.diff ]
> Index: vs.c
> ===
> RCS file: /cvsroot/src/sys/arch/x68k/dev/vs.c,v
> retrieving revision 1.39
> diff -u -p -r1.39 vs.c
> --- vs.c  9 Jul 2017 12:49:26 -   1.39
> +++ vs.c  27 Jul 2017 23:45:17 -
> @@ -160,6 +160,8 @@ struct {
>  
>  #define NUM_RATE (sizeof(vs_l2r)/sizeof(vs_l2r[0]))
>  
> +extern stream_filter_factory_t null_filter;
> +
>  static int
>  vs_match(device_t parent, cfdata_t cf, void *aux)
>  {
> @@ -405,6 +407,12 @@ vs_set_params(void *hdl, int setmode, in
>   pfil->prepend(pfil, msm6258_slinear16_to_adpcm, play);
>   rfil->prepend(rfil, msm6258_adpcm_to_slinear16, play);
>  
> + play->validbits = 16;
> + play->precision = 16;
> +
> + pfil->prepend(pfil, null_filter, play);
> + rfil->prepend(rfil, null_filter, play);
> +
>   sc->sc_current.prate = rate;
>   sc->sc_current.rrate = rate;
>  

CVS commit: src/sys/netinet

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Sat Jul 29 05:08:48 UTC 2017

Modified Files:
src/sys/netinet: tcp_subr.c

Log Message:
Forgot to commit this file yesterday.


To generate a diff of this commit:
cvs rdiff -u -r1.270 -r1.271 src/sys/netinet/tcp_subr.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/netinet/tcp_subr.c
diff -u src/sys/netinet/tcp_subr.c:1.270 src/sys/netinet/tcp_subr.c:1.271
--- src/sys/netinet/tcp_subr.c:1.270	Fri Mar  3 07:13:06 2017
+++ src/sys/netinet/tcp_subr.c	Sat Jul 29 05:08:48 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: tcp_subr.c,v 1.270 2017/03/03 07:13:06 ozaki-r Exp $	*/
+/*	$NetBSD: tcp_subr.c,v 1.271 2017/07/29 05:08:48 maxv Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -91,12 +91,11 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: tcp_subr.c,v 1.270 2017/03/03 07:13:06 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tcp_subr.c,v 1.271 2017/07/29 05:08:48 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
 #include "opt_ipsec.h"
-#include "opt_tcp_compat_42.h"
 #include "opt_inet_csum.h"
 #include "opt_mbuftrace.h"
 #endif
@@ -201,11 +200,6 @@ int tcp_init_win_max[] = {
 int	tcp_init_win = TCP_INIT_WIN;
 int	tcp_init_win_local = TCP_INIT_WIN_LOCAL;
 int	tcp_mss_ifmtu = 0;
-#ifdef TCP_COMPAT_42
-int	tcp_compat_42 = 1;
-#else
-int	tcp_compat_42 = 0;
-#endif
 int	tcp_rst_ppslim = 100;	/* 100pps */
 int	tcp_ackdrop_ppslim = 100;	/* 100pps */
 int	tcp_do_loopback_cksum = 0;
@@ -702,10 +696,7 @@ tcp_respond(struct tcpcb *tp, struct mbu
 		if (m == NULL)
 			return (ENOBUFS);
 
-		if (tcp_compat_42)
-			tlen = 1;
-		else
-			tlen = 0;
+		tlen = 0;
 
 		m->m_data += max_linkhdr;
 		bcopy(mtod(mtemplate, void *), mtod(m, void *),
@@ -2347,16 +2338,6 @@ tcp_new_iss1(void *laddr, void *faddr, u
 		}
 	}
 
-	if (tcp_compat_42) {
-		/*
-		 * Limit it to the positive range for really old TCP
-		 * implementations.
-		 * Just AND off the top bit instead of checking if
-		 * is set first - saves a branch 50% of the time.
-		 */
-		tcp_iss &= 0x7fff;		/* XXX */
-	}
-
 	return (tcp_iss);
 }
 

CVS commit: src/sys/netinet

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Sat Jul 29 05:08:48 UTC 2017

Modified Files:
src/sys/netinet: tcp_subr.c

Log Message:
Forgot to commit this file yesterday.


To generate a diff of this commit:
cvs rdiff -u -r1.270 -r1.271 src/sys/netinet/tcp_subr.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/compat/common

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 04:08:47 UTC 2017

Modified Files:
src/sys/compat/common: if_43.c

Log Message:
Kill needless nested extern of vec_compat_cvtcmd/ioctl.

Already declared in if_43.h.


To generate a diff of this commit:
cvs rdiff -u -r1.13 -r1.14 src/sys/compat/common/if_43.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/common/if_43.c
diff -u src/sys/compat/common/if_43.c:1.13 src/sys/compat/common/if_43.c:1.14
--- src/sys/compat/common/if_43.c:1.13	Sat Nov  5 23:30:22 2016
+++ src/sys/compat/common/if_43.c	Sat Jul 29 04:08:47 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_43.c,v 1.13 2016/11/05 23:30:22 pgoyette Exp $	*/
+/*	$NetBSD: if_43.c,v 1.14 2017/07/29 04:08:47 riastradh Exp $	*/
 
 /*
  * Copyright (c) 1982, 1986, 1989, 1990, 1993
@@ -32,7 +32,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: if_43.c,v 1.13 2016/11/05 23:30:22 pgoyette Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_43.c,v 1.14 2017/07/29 04:08:47 riastradh Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_compat_netbsd.h"
@@ -289,9 +289,6 @@ static int (*orig_compat_ifioctl)(struct
 void
 if_43_init(void)
 {
-	extern u_long (*vec_compat_cvtcmd)(u_long);
-	extern int (*vec_compat_ifioctl)(struct socket *, u_long, u_long,
-	void *, struct lwp *);
 
 	orig_compat_cvtcmd = vec_compat_cvtcmd;
 	vec_compat_cvtcmd = compat_cvtcmd;

CVS commit: src/sys/compat/common

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 04:08:47 UTC 2017

Modified Files:
src/sys/compat/common: if_43.c

Log Message:
Kill needless nested extern of vec_compat_cvtcmd/ioctl.

Already declared in if_43.h.


To generate a diff of this commit:
cvs rdiff -u -r1.13 -r1.14 src/sys/compat/common/if_43.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 04:02:49 UTC 2017

Modified Files:
src/sys/compat/common: vfs_syscalls_43.c
src/sys/sys: vfs_syscalls.h

Log Message:
Declare mountcompatnames in sys/vfs_syscalls.h to kill nested extern.


To generate a diff of this commit:
cvs rdiff -u -r1.60 -r1.61 src/sys/compat/common/vfs_syscalls_43.c
cvs rdiff -u -r1.22 -r1.23 src/sys/sys/vfs_syscalls.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 04:02:49 UTC 2017

Modified Files:
src/sys/compat/common: vfs_syscalls_43.c
src/sys/sys: vfs_syscalls.h

Log Message:
Declare mountcompatnames in sys/vfs_syscalls.h to kill nested extern.


To generate a diff of this commit:
cvs rdiff -u -r1.60 -r1.61 src/sys/compat/common/vfs_syscalls_43.c
cvs rdiff -u -r1.22 -r1.23 src/sys/sys/vfs_syscalls.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/common/vfs_syscalls_43.c
diff -u src/sys/compat/common/vfs_syscalls_43.c:1.60 src/sys/compat/common/vfs_syscalls_43.c:1.61
--- src/sys/compat/common/vfs_syscalls_43.c:1.60	Fri Jul 28 15:34:06 2017
+++ src/sys/compat/common/vfs_syscalls_43.c	Sat Jul 29 04:02:49 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: vfs_syscalls_43.c,v 1.60 2017/07/28 15:34:06 riastradh Exp $	*/
+/*	$NetBSD: vfs_syscalls_43.c,v 1.61 2017/07/29 04:02:49 riastradh Exp $	*/
 
 /*
  * Copyright (c) 1989, 1993
@@ -37,7 +37,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: vfs_syscalls_43.c,v 1.60 2017/07/28 15:34:06 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vfs_syscalls_43.c,v 1.61 2017/07/29 04:02:49 riastradh Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_compat_netbsd.h"
@@ -524,8 +524,6 @@ static int
 sysctl_vfs_generic_conf(SYSCTLFN_ARGS)
 {
 struct vfsconf vfc;
-extern const char * const mountcompatnames[];
-extern int nmountcompatnames;
 	struct sysctlnode node;
 	struct vfsops *vfsp;
 	u_int vfsnum;
@@ -560,7 +558,6 @@ sysctl_vfs_generic_conf(SYSCTLFN_ARGS)
 void
 compat_sysctl_vfs(struct sysctllog **clog)
 {
-	extern int nmountcompatnames;
 
 	sysctl_createv(clog, 0, NULL, NULL,
 		   CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE,

Index: src/sys/sys/vfs_syscalls.h
diff -u src/sys/sys/vfs_syscalls.h:1.22 src/sys/sys/vfs_syscalls.h:1.23
--- src/sys/sys/vfs_syscalls.h:1.22	Sat Jan 25 02:28:31 2014
+++ src/sys/sys/vfs_syscalls.h	Sat Jul 29 04:02:49 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: vfs_syscalls.h,v 1.22 2014/01/25 02:28:31 christos Exp $*/
+/* $NetBSD: vfs_syscalls.h,v 1.23 2017/07/29 04:02:49 riastradh Exp $*/
 
 /*
  * Copyright (c) 2007, 2008, 2009 The NetBSD Foundation, Inc.
@@ -83,4 +83,7 @@ void	do_sys_sync(struct lwp *);
 int	chdir_lookup(const char *, int, struct vnode **, struct lwp *);
 void	change_root(struct cwdinfo *, struct vnode *, struct lwp *);
 
+extern const char *const mountcompatnames[];
+extern const int nmountcompatnames;
+
 #endif /* _SYS_VFS_SYSCALLS_H_ */

CVS commit: src/sys/dev/sbus

[Michael Lorenz]

Module Name:src
Committed By:   macallan
Date:   Sat Jul 29 03:32:00 UTC 2017

Modified Files:
src/sys/dev/sbus: mgx.c

Log Message:
make comment match code...


To generate a diff of this commit:
cvs rdiff -u -r1.10 -r1.11 src/sys/dev/sbus/mgx.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/sbus/mgx.c
diff -u src/sys/dev/sbus/mgx.c:1.10 src/sys/dev/sbus/mgx.c:1.11
--- src/sys/dev/sbus/mgx.c:1.10	Sat Jul 29 03:29:49 2017
+++ src/sys/dev/sbus/mgx.c	Sat Jul 29 03:32:00 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: mgx.c,v 1.10 2017/07/29 03:29:49 macallan Exp $ */
+/*	$NetBSD: mgx.c,v 1.11 2017/07/29 03:32:00 macallan Exp $ */
 
 /*-
  * Copyright (c) 2014 Michael Lorenz
@@ -29,7 +29,7 @@
 /* a console driver for the SSB 4096V-MGX graphics card */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: mgx.c,v 1.10 2017/07/29 03:29:49 macallan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: mgx.c,v 1.11 2017/07/29 03:32:00 macallan Exp $");
 
 #include 
 #include 
@@ -752,7 +752,7 @@ mgx_putchar_mono(void *cookie, int row, 
 	struct vcons_screen *scr = ri->ri_hw;
 	struct mgx_softc *sc = scr->scr_cookie;
 	void *s, *d;
-	uint32_t fg, bg, scratch = (sc->sc_stride * sc->sc_height + 31) & ~31;
+	uint32_t fg, bg, scratch = (sc->sc_stride * sc->sc_height + 7) & ~7;
 	int x, y, wi, he;
 
 	wi = font->fontwidth;
@@ -785,7 +785,7 @@ mgx_putchar_mono(void *cookie, int row, 
 	 * bitmaps need at least 16bit.
 	 */
 	sc->sc_buf = (sc->sc_buf + 1) & 3; /* rotate through 4 buffers */
-	scratch += sc->sc_buf * ((ri->ri_fontscale + 31) & ~31);
+	scratch += sc->sc_buf * ((ri->ri_fontscale + 7) & ~7);
 	s = WSFONT_GLYPH(c, font);
 	d = (uint8_t *)sc->sc_fbaddr + scratch;
 	memcpy(d, s, ri->ri_fontscale);

CVS commit: src/sys/dev/sbus

[Michael Lorenz]

Module Name:src
Committed By:   macallan
Date:   Sat Jul 29 03:32:00 UTC 2017

Modified Files:
src/sys/dev/sbus: mgx.c

Log Message:
make comment match code...


To generate a diff of this commit:
cvs rdiff -u -r1.10 -r1.11 src/sys/dev/sbus/mgx.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/dev/sbus

[Michael Lorenz]

Module Name:src
Committed By:   macallan
Date:   Sat Jul 29 03:29:49 UTC 2017

Modified Files:
src/sys/dev/sbus: mgx.c mgxreg.h

Log Message:
- use hardware to draw bitmap fonts
- while there enable font loading etc.


To generate a diff of this commit:
cvs rdiff -u -r1.9 -r1.10 src/sys/dev/sbus/mgx.c
cvs rdiff -u -r1.4 -r1.5 src/sys/dev/sbus/mgxreg.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/dev/sbus

[Michael Lorenz]

Module Name:src
Committed By:   macallan
Date:   Sat Jul 29 03:29:49 UTC 2017

Modified Files:
src/sys/dev/sbus: mgx.c mgxreg.h

Log Message:
- use hardware to draw bitmap fonts
- while there enable font loading etc.


To generate a diff of this commit:
cvs rdiff -u -r1.9 -r1.10 src/sys/dev/sbus/mgx.c
cvs rdiff -u -r1.4 -r1.5 src/sys/dev/sbus/mgxreg.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/sbus/mgx.c
diff -u src/sys/dev/sbus/mgx.c:1.9 src/sys/dev/sbus/mgx.c:1.10
--- src/sys/dev/sbus/mgx.c:1.9	Sat May  7 15:32:08 2016
+++ src/sys/dev/sbus/mgx.c	Sat Jul 29 03:29:49 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: mgx.c,v 1.9 2016/05/07 15:32:08 macallan Exp $ */
+/*	$NetBSD: mgx.c,v 1.10 2017/07/29 03:29:49 macallan Exp $ */
 
 /*-
  * Copyright (c) 2014 Michael Lorenz
@@ -29,7 +29,7 @@
 /* a console driver for the SSB 4096V-MGX graphics card */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: mgx.c,v 1.9 2016/05/07 15:32:08 macallan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: mgx.c,v 1.10 2017/07/29 03:29:49 macallan Exp $");
 
 #include 
 #include 
@@ -39,6 +39,7 @@ __KERNEL_RCSID(0, "$NetBSD: mgx.c,v 1.9 
 #include 
 #include 
 #include 
+#include 
 
 #include 
 #include 
@@ -85,7 +86,7 @@ struct mgx_softc {
 	u_char		sc_cmap_blue[256];
 	int		sc_cursor_x, sc_cursor_y;
 	int		sc_hotspot_x, sc_hotspot_y;
-	int		sc_video;
+	int		sc_video, sc_buf;
 	void (*sc_putchar)(void *, int, int, u_int, long);
 	struct vcons_screen sc_console_screen;
 	struct wsscreen_descr sc_defaultscreen_descr;
@@ -114,7 +115,8 @@ static int	mgx_wait_fifo(struct mgx_soft
 static void	mgx_bitblt(void *, int, int, int, int, int, int, int);
 static void 	mgx_rectfill(void *, int, int, int, int, long);
 
-static void	mgx_putchar(void *, int, int, u_int, long);
+static void	mgx_putchar_aa(void *, int, int, u_int, long);
+static void	mgx_putchar_mono(void *, int, int, u_int, long);
 static void	mgx_cursor(void *, int, int, int);
 static void	mgx_copycols(void *, int, int, int, int);
 static void	mgx_erasecols(void *, int, int, int, long);
@@ -295,7 +297,8 @@ mgx_attach(device_t parent, device_t sel
 		0, 0,
 		NULL,
 		8, 16,
-		WSSCREEN_WSCOLORS | WSSCREEN_HILIT,
+		WSSCREEN_WSCOLORS | WSSCREEN_HILIT | WSSCREEN_UNDERLINE |
+		WSSCREEN_RESIZE,
 		NULL
 	};
 	
@@ -315,6 +318,8 @@ mgx_attach(device_t parent, device_t sel
 
 	vcons_init(>vd, sc, >sc_defaultscreen_descr, _accessops);
 	sc->vd.init_screen = mgx_init_screen;
+	sc->vd.show_screen_cookie = >sc_gc;
+	sc->vd.show_screen_cb = glyphcache_adapt;
 
 	vcons_init_screen(>vd, >sc_console_screen, 1, );
 	sc->sc_console_screen.scr_flags |= VCONS_SCREEN_IS_STATIC;
@@ -331,6 +336,10 @@ mgx_attach(device_t parent, device_t sel
 	sc->sc_gc.gc_blitcookie = sc;
 	sc->sc_gc.gc_rop = ROP_SRC;
 
+	/* 
+	 * leave some room between visible screen and glyph cache for upload
+	 * buffers used by putchar_mono()
+	 */
 	glyphcache_init(>sc_gc,
 	sc->sc_height + 5,
 	(0x40 / sc->sc_stride) - sc->sc_height - 5,
@@ -535,6 +544,7 @@ mgx_setup(struct mgx_softc *sc, int dept
 	if (mgx_wait_fifo(sc, FIFO_AT24) == 0)
 		return;
 
+	sc->sc_buf = 0;
 	/* read name from sequencer */
 	for (i = 0; i < 8; i++) {
 		mgx_write_vga(sc, SEQ_INDEX, i + 0x11);
@@ -597,9 +607,12 @@ mgx_setup(struct mgx_softc *sc, int dept
 		default:
 			return; /* not supported */
 	}
+	mgx_wait_fifo(sc, 4);
 	mgx_write_1(sc, ATR_CLIP_CONTROL, 0);
 	mgx_write_1(sc, ATR_BYTEMASK, 0xff);
 	mgx_write_1(sc, ATR_PIXEL, reg);
+	mgx_write_4(sc, ATR_OFFSET, 0);
+	mgx_wait_fifo(sc, 4);
 	mgx_write_vga(sc, CRTC_INDEX, 0x13);
 	mgx_write_vga(sc, CRTC_DATA, stride & 0xff);
 	mgx_write_vga(sc, CRTC_INDEX, 0x1c);
@@ -609,6 +622,7 @@ mgx_setup(struct mgx_softc *sc, int dept
 	if (depth != MGX_DEPTH) 
 		mgx_rectfill(sc, 0, 0, sc->sc_width, sc->sc_height, 0);	
 
+	mgx_wait_fifo(sc, 4);
 	/* initialize hardware cursor stuff */
 	mgx_write_2(sc, ATR_CURSOR_ADDRESS, (sc->sc_fbsize - 1024) >> 10);
 	mgx_write_1(sc, ATR_CURSOR_ENABLE, 0);
@@ -685,7 +699,7 @@ mgx_rectfill(void *cookie, int x, int y,
 }
 
 static void
-mgx_putchar(void *cookie, int row, int col, u_int c, long attr)
+mgx_putchar_aa(void *cookie, int row, int col, u_int c, long attr)
 {
 	struct rasops_info *ri = cookie;
 	struct wsdisplay_font *font = PICK_FONT(ri, c);
@@ -709,6 +723,7 @@ mgx_putchar(void *cookie, int row, int c
 			mgx_rectfill(sc, x, y + he - 2, wi, 1, fg);
 		return;
 	}
+
 	rv = glyphcache_try(>sc_gc, c, x, y, attr);
 	if (rv != GC_OK) {
 		volatile uint32_t junk;
@@ -730,6 +745,74 @@ mgx_putchar(void *cookie, int row, int c
 }
 
 static void
+mgx_putchar_mono(void *cookie, int row, int col, u_int c, long attr)
+{
+	struct rasops_info *ri = cookie;
+	struct wsdisplay_font *font = PICK_FONT(ri, c);
+	struct vcons_screen *scr = ri->ri_hw;
+	struct mgx_softc *sc = scr->scr_cookie;
+	void *s, *d;
+	uint32_t fg, bg, scratch = (sc->sc_stride * sc->sc_height + 31) & ~31;

CVS commit: src/sys/dev

[Tetsuya Isaki]

Module Name:src
Committed By:   isaki
Date:   Sat Jul 29 03:05:51 UTC 2017

Modified Files:
src/sys/dev: audio.c audiovar.h

Log Message:
Improve audio_set_vchan_defaults().
- Correct confused input/output parameters.
- Remove sc->{sc_channels, sc_precision, sc_frequency}.  They are
  the same as sc->sc_vchan_params.{channels, precision, sample_rate}.
The input parameter of audio_set_vchan_defaults() is now only
sc->sc_vchan_params.

Fix PR kern/52437


To generate a diff of this commit:
cvs rdiff -u -r1.375 -r1.376 src/sys/dev/audio.c
cvs rdiff -u -r1.58 -r1.59 src/sys/dev/audiovar.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/audio.c
diff -u src/sys/dev/audio.c:1.375 src/sys/dev/audio.c:1.376
--- src/sys/dev/audio.c:1.375	Fri Jul 28 03:58:54 2017
+++ src/sys/dev/audio.c	Sat Jul 29 03:05:51 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: audio.c,v 1.375 2017/07/28 03:58:54 nat Exp $	*/
+/*	$NetBSD: audio.c,v 1.376 2017/07/29 03:05:51 isaki Exp $	*/
 
 /*-
  * Copyright (c) 2016 Nathanial Sloss 
@@ -148,7 +148,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: audio.c,v 1.375 2017/07/28 03:58:54 nat Exp $");
+__KERNEL_RCSID(0, "$NetBSD: audio.c,v 1.376 2017/07/29 03:05:51 isaki Exp $");
 
 #ifdef _KERNEL_OPT
 #include "audio.h"
@@ -387,8 +387,7 @@ static int audio_set_params (struct audi
 		 struct virtual_channel *);
 static int
 audio_query_encoding(struct audio_softc *, struct audio_encoding *);
-static int audio_set_vchan_defaults
-	(struct audio_softc *, u_int, const struct audio_format *);
+static int audio_set_vchan_defaults(struct audio_softc *, u_int);
 static int vchan_autoconfig(struct audio_softc *);
 int	au_get_lr_value(struct audio_softc *, mixer_ctrl_t *, int *, int *);
 int	au_set_lr_value(struct audio_softc *, mixer_ctrl_t *, int, int);
@@ -509,16 +508,6 @@ audioattach(device_t parent, device_t se
  	sc->sc_format[0].frequency_type = 1;
  	sc->sc_format[0].frequency[0] = 44100;
 
-	sc->sc_vchan_params.sample_rate = 44100;
-#if BYTE_ORDER == LITTLE_ENDIAN
-	sc->sc_vchan_params.encoding = AUDIO_ENCODING_SLINEAR_LE;
-#else
-	sc->sc_vchan_params.encoding = AUDIO_ENCODING_SLINEAR_BE;
-#endif
-	sc->sc_vchan_params.precision = 16;
-	sc->sc_vchan_params.validbits = 16;
-	sc->sc_vchan_params.channels = 2;
-
 	sc->sc_trigger_started = false;
 	sc->sc_rec_started = false;
 	sc->sc_dying = false;
@@ -535,9 +524,6 @@ audioattach(device_t parent, device_t se
 	vc->sc_lastinfovalid = false;
 	vc->sc_swvol = 255;
 	vc->sc_recswvol = 255;
-	sc->sc_frequency = 44100;
-	sc->sc_precision = 16;
-	sc->sc_channels = 2;
 
 	if (auconv_create_encodings(sc->sc_format, VAUDIO_NFORMATS,
 	>sc_encodings) != 0) {
@@ -4138,9 +4124,11 @@ audio_check_params(struct audio_params *
 	return 0;
 }
 
+/*
+ * set some parameters from sc->sc_vchan_params.
+ */
 static int
-audio_set_vchan_defaults(struct audio_softc *sc, u_int mode,
- const struct audio_format *format)
+audio_set_vchan_defaults(struct audio_softc *sc, u_int mode)
 {
 	struct audio_chan *chan;
 	struct virtual_channel *vc;
@@ -4154,38 +4142,30 @@ audio_set_vchan_defaults(struct audio_so
 		return EINVAL;
 	vc = chan->vc;
 
-	sc->sc_vchan_params.sample_rate = sc->sc_frequency;
-#if BYTE_ORDER == LITTLE_ENDIAN
-	sc->sc_vchan_params.encoding = AUDIO_ENCODING_SLINEAR_LE;
-#else
-	sc->sc_vchan_params.encoding = AUDIO_ENCODING_SLINEAR_BE;
-#endif
-	sc->sc_vchan_params.precision = sc->sc_precision;
-	sc->sc_vchan_params.validbits = sc->sc_precision;
-	sc->sc_vchan_params.channels = sc->sc_channels;
-
 	/* default parameters */
 	vc->sc_rparams = sc->sc_vchan_params;
 	vc->sc_pparams = sc->sc_vchan_params;
 	vc->sc_blkset = false;
 
 	AUDIO_INITINFO();
-	ai.record.sample_rate = sc->sc_frequency;
-	ai.record.encoding= format->encoding;
-	ai.record.channels= sc->sc_channels;
-	ai.record.precision   = sc->sc_precision;
+	ai.record.sample_rate = sc->sc_vchan_params.sample_rate;
+	ai.record.encoding= sc->sc_vchan_params.encoding;
+	ai.record.channels= sc->sc_vchan_params.channels;
+	ai.record.precision   = sc->sc_vchan_params.precision;
 	ai.record.pause	  = false;
-	ai.play.sample_rate   = sc->sc_frequency;
-	ai.play.encoding  = format->encoding;
-	ai.play.channels  = sc->sc_channels;
-	ai.play.precision = sc->sc_precision;
+	ai.play.sample_rate   = sc->sc_vchan_params.sample_rate;
+	ai.play.encoding  = sc->sc_vchan_params.encoding;
+	ai.play.channels  = sc->sc_vchan_params.channels;
+	ai.play.precision = sc->sc_vchan_params.precision;
 	ai.play.pause = false;
 	ai.mode		  = mode;
 
-	sc->sc_format[0].channels = sc->sc_channels;
-	sc->sc_format[0].precision = sc->sc_precision;
-	sc->sc_format[0].validbits = sc->sc_precision;
-	sc->sc_format[0].frequency[0] = sc->sc_frequency;
+	sc->sc_format[0].encoding = sc->sc_vchan_params.encoding;
+	sc->sc_format[0].channels = 

CVS commit: src/sys/dev

[Tetsuya Isaki]

Module Name:src
Committed By:   isaki
Date:   Sat Jul 29 03:05:51 UTC 2017

Modified Files:
src/sys/dev: audio.c audiovar.h

Log Message:
Improve audio_set_vchan_defaults().
- Correct confused input/output parameters.
- Remove sc->{sc_channels, sc_precision, sc_frequency}.  They are
  the same as sc->sc_vchan_params.{channels, precision, sample_rate}.
The input parameter of audio_set_vchan_defaults() is now only
sc->sc_vchan_params.

Fix PR kern/52437


To generate a diff of this commit:
cvs rdiff -u -r1.375 -r1.376 src/sys/dev/audio.c
cvs rdiff -u -r1.58 -r1.59 src/sys/dev/audiovar.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/compat/linux/common

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 02:31:22 UTC 2017

Modified Files:
src/sys/compat/linux/common: linux_time.c

Log Message:
Put suser check in the right function: settimeofday, not gettimeofday.

While here, remove wrong comment.

Noted by kre@.


To generate a diff of this commit:
cvs rdiff -u -r1.38 -r1.39 src/sys/compat/linux/common/linux_time.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/linux/common/linux_time.c
diff -u src/sys/compat/linux/common/linux_time.c:1.38 src/sys/compat/linux/common/linux_time.c:1.39
--- src/sys/compat/linux/common/linux_time.c:1.38	Sat Jul 29 01:14:59 2017
+++ src/sys/compat/linux/common/linux_time.c	Sat Jul 29 02:31:22 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: linux_time.c,v 1.38 2017/07/29 01:14:59 riastradh Exp $ */
+/*	$NetBSD: linux_time.c,v 1.39 2017/07/29 02:31:22 riastradh Exp $ */
 
 /*-
  * Copyright (c) 2001 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: linux_time.c,v 1.38 2017/07/29 01:14:59 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux_time.c,v 1.39 2017/07/29 02:31:22 riastradh Exp $");
 
 #include 
 #include 
@@ -79,9 +79,6 @@ linux_sys_gettimeofday(struct lwp *l, co
 	}
 
 	if (SCARG(uap, tzp)) {
-		if (kauth_authorize_generic(kauth_cred_get(),
-			KAUTH_GENERIC_ISSUSER, NULL) != 0)
-			return (EPERM);
 		error = copyout(_sys_tz, SCARG(uap, tzp), sizeof(linux_sys_tz));
 		if (error)
 			return (error);
@@ -105,11 +102,10 @@ linux_sys_settimeofday(struct lwp *l, co
 			return (error);
 	}
 
-	/*
-	 * If user is not the superuser, we returned
-	 * after the sys_settimeofday() call.
-	 */
 	if (SCARG(uap, tzp)) {
+		if (kauth_authorize_generic(kauth_cred_get(),
+			KAUTH_GENERIC_ISSUSER, NULL) != 0)
+			return (EPERM);
 		error = copyin(SCARG(uap, tzp), _sys_tz, sizeof(linux_sys_tz));
 		if (error)
 			return (error);

CVS commit: src/sys/compat/linux/common

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 02:31:22 UTC 2017

Modified Files:
src/sys/compat/linux/common: linux_time.c

Log Message:
Put suser check in the right function: settimeofday, not gettimeofday.

While here, remove wrong comment.

Noted by kre@.


To generate a diff of this commit:
cvs rdiff -u -r1.38 -r1.39 src/sys/compat/linux/common/linux_time.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/arch/newsmips/apbus

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 02:21:30 UTC 2017

Modified Files:
src/sys/arch/newsmips/apbus: if_sn.c

Log Message:
Avoid memory leak in sonic_get.

If this is the first time around, top is null and nothing else will
free m.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.38 -r1.39 src/sys/arch/newsmips/apbus/if_sn.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/arch/newsmips/apbus/if_sn.c
diff -u src/sys/arch/newsmips/apbus/if_sn.c:1.38 src/sys/arch/newsmips/apbus/if_sn.c:1.39
--- src/sys/arch/newsmips/apbus/if_sn.c:1.38	Wed Feb 22 09:45:16 2017
+++ src/sys/arch/newsmips/apbus/if_sn.c	Sat Jul 29 02:21:30 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_sn.c,v 1.38 2017/02/22 09:45:16 nonaka Exp $	*/
+/*	$NetBSD: if_sn.c,v 1.39 2017/07/29 02:21:30 riastradh Exp $	*/
 
 /*
  * National Semiconductor  DP8393X SONIC Driver
@@ -16,7 +16,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: if_sn.c,v 1.38 2017/02/22 09:45:16 nonaka Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_sn.c,v 1.39 2017/07/29 02:21:30 riastradh Exp $");
 
 #include "opt_inet.h"
 
@@ -1090,7 +1090,10 @@ sonic_get(struct sn_softc *sc, void *pkt
 		if (datalen >= MINCLSIZE) {
 			MCLGET(m, M_DONTWAIT);
 			if ((m->m_flags & M_EXT) == 0) {
-if (top) m_freem(top);
+if (top)
+	m_freem(top);
+else
+	m_freem(m);
 return 0;
 			}
 			len = MCLBYTES;

CVS commit: src/sys/arch/newsmips/apbus

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 02:21:30 UTC 2017

Modified Files:
src/sys/arch/newsmips/apbus: if_sn.c

Log Message:
Avoid memory leak in sonic_get.

If this is the first time around, top is null and nothing else will
free m.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.38 -r1.39 src/sys/arch/newsmips/apbus/if_sn.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/arch/mac68k/nubus

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 02:17:44 UTC 2017

Modified Files:
src/sys/arch/mac68k/nubus: if_netdock_nubus.c

Log Message:
Avoid memory leak in netdock_get.

If top is null, this is the first time through and nothing else will
free m.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.25 -r1.26 src/sys/arch/mac68k/nubus/if_netdock_nubus.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/arch/mac68k/nubus/if_netdock_nubus.c
diff -u src/sys/arch/mac68k/nubus/if_netdock_nubus.c:1.25 src/sys/arch/mac68k/nubus/if_netdock_nubus.c:1.26
--- src/sys/arch/mac68k/nubus/if_netdock_nubus.c:1.25	Thu Dec 15 09:28:03 2016
+++ src/sys/arch/mac68k/nubus/if_netdock_nubus.c	Sat Jul 29 02:17:44 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_netdock_nubus.c,v 1.25 2016/12/15 09:28:03 ozaki-r Exp $	*/
+/*	$NetBSD: if_netdock_nubus.c,v 1.26 2017/07/29 02:17:44 riastradh Exp $	*/
 
 /*
  * Copyright (C) 2000,2002 Daishi Kato 
@@ -43,7 +43,7 @@
 /***/
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: if_netdock_nubus.c,v 1.25 2016/12/15 09:28:03 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_netdock_nubus.c,v 1.26 2017/07/29 02:17:44 riastradh Exp $");
 
 #include 
 #include 
@@ -802,6 +802,8 @@ netdock_get(struct netdock_softc *sc, in
 			if ((m->m_flags & M_EXT) == 0) {
 if (top)
 	m_freem(top);
+else
+	m_freem(m);
 return (NULL);
 			}
 			len = MCLBYTES;

CVS commit: src/sys/arch/mac68k/nubus

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 02:17:44 UTC 2017

Modified Files:
src/sys/arch/mac68k/nubus: if_netdock_nubus.c

Log Message:
Avoid memory leak in netdock_get.

If top is null, this is the first time through and nothing else will
free m.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.25 -r1.26 src/sys/arch/mac68k/nubus/if_netdock_nubus.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/dev/pci

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:54:56 UTC 2017

Modified Files:
src/sys/dev/pci: if_ipw.c

Log Message:
Null out sbuf->m on failure to avoid double-free later.

>From Ilja Van Sprundel.

Also null out sbuf->map out of paranoia.


To generate a diff of this commit:
cvs rdiff -u -r1.64 -r1.65 src/sys/dev/pci/if_ipw.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/pci/if_ipw.c
diff -u src/sys/dev/pci/if_ipw.c:1.64 src/sys/dev/pci/if_ipw.c:1.65
--- src/sys/dev/pci/if_ipw.c:1.64	Tue May 23 02:19:14 2017
+++ src/sys/dev/pci/if_ipw.c	Sat Jul 29 01:54:56 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_ipw.c,v 1.64 2017/05/23 02:19:14 ozaki-r Exp $	*/
+/*	$NetBSD: if_ipw.c,v 1.65 2017/07/29 01:54:56 riastradh Exp $	*/
 /*	FreeBSD: src/sys/dev/ipw/if_ipw.c,v 1.15 2005/11/13 17:17:40 damien Exp 	*/
 
 /*-
@@ -29,7 +29,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: if_ipw.c,v 1.64 2017/05/23 02:19:14 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_ipw.c,v 1.65 2017/07/29 01:54:56 riastradh Exp $");
 
 /*-
  * Intel(R) PRO/Wireless 2100 MiniPCI driver
@@ -607,6 +607,7 @@ ipw_dma_alloc(struct ipw_softc *sc)
 		MCLGET(sbuf->m, M_DONTWAIT);
 		if (!(sbuf->m->m_flags & M_EXT)) {
 			m_freem(sbuf->m);
+			sbuf->m = NULL;
 			aprint_error_dev(sc->sc_dev, "could not allocate rx mbuf cluster\n");
 			error = ENOMEM;
 			goto fail;
@@ -619,6 +620,7 @@ ipw_dma_alloc(struct ipw_softc *sc)
 		if (error != 0) {
 			aprint_error_dev(sc->sc_dev, "could not create rxbuf dma map\n");
 			m_freem(sbuf->m);
+			sbuf->m = NULL;
 			goto fail;
 		}
 
@@ -626,7 +628,9 @@ ipw_dma_alloc(struct ipw_softc *sc)
 		sbuf->m, BUS_DMA_READ | BUS_DMA_NOWAIT);
 		if (error != 0) {
 			bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
+			sbuf->map = NULL;
 			m_freem(sbuf->m);
+			sbuf->m = NULL;
 			aprint_error_dev(sc->sc_dev, "could not map rxbuf dma memory\n");
 			goto fail;
 		}

CVS commit: src/sys/dev/pci

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:54:56 UTC 2017

Modified Files:
src/sys/dev/pci: if_ipw.c

Log Message:
Null out sbuf->m on failure to avoid double-free later.

>From Ilja Van Sprundel.

Also null out sbuf->map out of paranoia.


To generate a diff of this commit:
cvs rdiff -u -r1.64 -r1.65 src/sys/dev/pci/if_ipw.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/dev/pci

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:47:48 UTC 2017

Modified Files:
src/sys/dev/pci: if_et.c

Log Message:
Check for MCLGET failure in et_newbuf.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.14 -r1.15 src/sys/dev/pci/if_et.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/dev/pci

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:47:48 UTC 2017

Modified Files:
src/sys/dev/pci: if_et.c

Log Message:
Check for MCLGET failure in et_newbuf.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.14 -r1.15 src/sys/dev/pci/if_et.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/pci/if_et.c
diff -u src/sys/dev/pci/if_et.c:1.14 src/sys/dev/pci/if_et.c:1.15
--- src/sys/dev/pci/if_et.c:1.14	Thu Dec 15 09:28:05 2016
+++ src/sys/dev/pci/if_et.c	Sat Jul 29 01:47:48 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_et.c,v 1.14 2016/12/15 09:28:05 ozaki-r Exp $	*/
+/*	$NetBSD: if_et.c,v 1.15 2017/07/29 01:47:48 riastradh Exp $	*/
 /*	$OpenBSD: if_et.c,v 1.11 2008/06/08 06:18:07 jsg Exp $	*/
 /*
  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
@@ -37,7 +37,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: if_et.c,v 1.14 2016/12/15 09:28:05 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_et.c,v 1.15 2017/07/29 01:47:48 riastradh Exp $");
 
 #include "opt_inet.h"
 #include "vlan.h"
@@ -2026,6 +2026,10 @@ et_newbuf(struct et_rxbuf_data *rbd, int
 		if (m == NULL)
 			return (ENOBUFS);
 		MCLGET(m, init ? M_WAITOK : M_DONTWAIT);
+		if ((m->m_flags & M_EXT) == 0) {
+			m_freem(m);
+			return (ENOBUFS);
+		}
 		len = MCLBYTES;
 	} else {
 		MGETHDR(m, init ? M_WAITOK : M_DONTWAIT, MT_DATA);

CVS commit: src/sys/dev/ic

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:45:22 UTC 2017

Modified Files:
src/sys/dev/ic: i82596.c

Log Message:
Null out sc_rx_mbuf[i] after m_freem to avoid double-free later.

>From Ilja Van Sprundel.

Also null out sc_tx_mbuf[i] after m_freem, out of paranoia.

XXX Not entirely clear to how tx mbufs are freed, but no way to test
this since it's ews4800mips- and hp700-only, so not keen to make any
more elaborate changes...


To generate a diff of this commit:
cvs rdiff -u -r1.36 -r1.37 src/sys/dev/ic/i82596.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/ic/i82596.c
diff -u src/sys/dev/ic/i82596.c:1.36 src/sys/dev/ic/i82596.c:1.37
--- src/sys/dev/ic/i82596.c:1.36	Mon Feb 20 07:43:29 2017
+++ src/sys/dev/ic/i82596.c	Sat Jul 29 01:45:22 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: i82596.c,v 1.36 2017/02/20 07:43:29 ozaki-r Exp $ */
+/* $NetBSD: i82596.c,v 1.37 2017/07/29 01:45:22 riastradh Exp $ */
 
 /*
  * Copyright (c) 2003 Jochen Kunz.
@@ -43,7 +43,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: i82596.c,v 1.36 2017/02/20 07:43:29 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: i82596.c,v 1.37 2017/07/29 01:45:22 riastradh Exp $");
 
 /* autoconfig and device stuff */
 #include 
@@ -753,6 +753,7 @@ iee_start(struct ifnet *ifp)
 printf("%s: iee_start: can't allocate mbuf\n",
 device_xname(sc->sc_dev));
 m_freem(sc->sc_tx_mbuf[t]);
+sc->sc_tx_mbuf[t] = NULL;
 t--;
 continue;
 			}
@@ -762,6 +763,7 @@ iee_start(struct ifnet *ifp)
 printf("%s: iee_start: can't allocate mbuf "
 "cluster\n", device_xname(sc->sc_dev));
 m_freem(sc->sc_tx_mbuf[t]);
+sc->sc_tx_mbuf[t] = NULL;
 m_freem(m);
 t--;
 continue;
@@ -777,6 +779,7 @@ iee_start(struct ifnet *ifp)
 printf("%s: iee_start: can't load TX DMA map\n",
 device_xname(sc->sc_dev));
 m_freem(sc->sc_tx_mbuf[t]);
+sc->sc_tx_mbuf[t] = NULL;
 t--;
 continue;
 			}
@@ -926,6 +929,7 @@ iee_init(struct ifnet *ifp)
 printf("%s: iee_init: can't allocate mbuf"
 " cluster\n", device_xname(sc->sc_dev));
 m_freem(sc->sc_rx_mbuf[r]);
+sc->sc_rx_mbuf[r] = NULL;
 err = 1;
 break;
 			}
@@ -939,6 +943,7 @@ iee_init(struct ifnet *ifp)
 printf("%s: iee_init: can't create RX "
 "DMA map\n", device_xname(sc->sc_dev));
 m_freem(sc->sc_rx_mbuf[r]);
+sc->sc_rx_mbuf[r] = NULL;
 err = 1;
 break;
 			}
@@ -948,6 +953,7 @@ iee_init(struct ifnet *ifp)
 			device_xname(sc->sc_dev));
 			bus_dmamap_destroy(sc->sc_dmat, sc->sc_rx_map[r]);
 			m_freem(sc->sc_rx_mbuf[r]);
+			sc->sc_rx_mbuf[r] = NULL;
 			err = 1;
 			break;
 		}

CVS commit: src/sys/dev/ic

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:45:22 UTC 2017

Modified Files:
src/sys/dev/ic: i82596.c

Log Message:
Null out sc_rx_mbuf[i] after m_freem to avoid double-free later.

>From Ilja Van Sprundel.

Also null out sc_tx_mbuf[i] after m_freem, out of paranoia.

XXX Not entirely clear to how tx mbufs are freed, but no way to test
this since it's ews4800mips- and hp700-only, so not keen to make any
more elaborate changes...


To generate a diff of this commit:
cvs rdiff -u -r1.36 -r1.37 src/sys/dev/ic/i82596.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/dev/ic

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:34:49 UTC 2017

Modified Files:
src/sys/dev/ic: dp83932.c

Log Message:
Plug mbuf leak on MCLGET failure in sonic_rxintr.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.40 -r1.41 src/sys/dev/ic/dp83932.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/ic/dp83932.c
diff -u src/sys/dev/ic/dp83932.c:1.40 src/sys/dev/ic/dp83932.c:1.41
--- src/sys/dev/ic/dp83932.c:1.40	Tue May 23 02:19:14 2017
+++ src/sys/dev/ic/dp83932.c	Sat Jul 29 01:34:49 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: dp83932.c,v 1.40 2017/05/23 02:19:14 ozaki-r Exp $	*/
+/*	$NetBSD: dp83932.c,v 1.41 2017/07/29 01:34:49 riastradh Exp $	*/
 
 /*-
  * Copyright (c) 2001 The NetBSD Foundation, Inc.
@@ -35,7 +35,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: dp83932.c,v 1.40 2017/05/23 02:19:14 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: dp83932.c,v 1.41 2017/07/29 01:34:49 riastradh Exp $");
 
 
 #include 
@@ -786,8 +786,10 @@ sonic_rxintr(struct sonic_softc *sc)
 goto dropit;
 			if (len > (MHLEN - 2)) {
 MCLGET(m, M_DONTWAIT);
-if ((m->m_flags & M_EXT) == 0)
+if ((m->m_flags & M_EXT) == 0) {
+	m_freem(m);
 	goto dropit;
+}
 			}
 			m->m_data += 2;
 			/*

CVS commit: src/sys/dev/ic

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:34:49 UTC 2017

Modified Files:
src/sys/dev/ic: dp83932.c

Log Message:
Plug mbuf leak on MCLGET failure in sonic_rxintr.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.40 -r1.41 src/sys/dev/ic/dp83932.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/dev/ic

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:31:20 UTC 2017

Modified Files:
src/sys/dev/ic: dm9000.c

Log Message:
Check for MCLGET failure in dme_alloc_receive_buffer.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.11 -r1.12 src/sys/dev/ic/dm9000.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/dev/ic

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:31:20 UTC 2017

Modified Files:
src/sys/dev/ic: dm9000.c

Log Message:
Check for MCLGET failure in dme_alloc_receive_buffer.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.11 -r1.12 src/sys/dev/ic/dm9000.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/ic/dm9000.c
diff -u src/sys/dev/ic/dm9000.c:1.11 src/sys/dev/ic/dm9000.c:1.12
--- src/sys/dev/ic/dm9000.c:1.11	Thu Dec 15 09:28:05 2016
+++ src/sys/dev/ic/dm9000.c	Sat Jul 29 01:31:20 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: dm9000.c,v 1.11 2016/12/15 09:28:05 ozaki-r Exp $	*/
+/*	$NetBSD: dm9000.c,v 1.12 2017/07/29 01:31:20 riastradh Exp $	*/
 
 /*
  * Copyright (c) 2009 Paul Fleischer
@@ -1226,8 +1226,13 @@ dme_alloc_receive_buffer(struct ifnet *i
 		sizeof(struct ether_header);
 	/* All our frames have the CRC attached */
 	m->m_flags |= M_HASFCS;
-	if (m->m_pkthdr.len + pad > MHLEN )
+	if (m->m_pkthdr.len + pad > MHLEN) {
 		MCLGET(m, M_DONTWAIT);
+		if ((m->m_flags & M_EXT) == 0) {
+			m_freem(m);
+			return NULL;
+		}
+	}
 
 	m->m_data += pad;
 	m->m_len = frame_length + (frame_length % sc->sc_data_width);

CVS commit: src/sys/dev/ic

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:19:29 UTC 2017

Modified Files:
src/sys/dev/ic: bwi.c

Log Message:
Check for M_EXT in m->m_flags, whether m is NULL, after MCLGET.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.31 -r1.32 src/sys/dev/ic/bwi.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/ic/bwi.c
diff -u src/sys/dev/ic/bwi.c:1.31 src/sys/dev/ic/bwi.c:1.32
--- src/sys/dev/ic/bwi.c:1.31	Thu Feb  2 10:05:35 2017
+++ src/sys/dev/ic/bwi.c	Sat Jul 29 01:19:29 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: bwi.c,v 1.31 2017/02/02 10:05:35 nonaka Exp $	*/
+/*	$NetBSD: bwi.c,v 1.32 2017/07/29 01:19:29 riastradh Exp $	*/
 /*	$OpenBSD: bwi.c,v 1.74 2008/02/25 21:13:30 mglocker Exp $	*/
 
 /*
@@ -48,7 +48,7 @@
 
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: bwi.c,v 1.31 2017/02/02 10:05:35 nonaka Exp $");
+__KERNEL_RCSID(0, "$NetBSD: bwi.c,v 1.32 2017/07/29 01:19:29 riastradh Exp $");
 
 #include 
 #include 
@@ -8328,7 +8328,7 @@ bwi_newbuf(struct bwi_softc *sc, int buf
 	if (m == NULL)
 		return (ENOBUFS);
 	MCLGET(m, init ? M_WAITOK : M_DONTWAIT);
-	if (m == NULL) {
+	if ((m->m_flags & M_EXT) == 0) {
 		error = ENOBUFS;
 
 		/*

CVS commit: src/sys/compat/linux/common

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:14:59 UTC 2017

Modified Files:
src/sys/compat/linux/common: linux_time.c

Log Message:
Only let the superuser set the compat_linux timezone.

Not really keen to invent a new kauth cookie for this useless purpose.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.37 -r1.38 src/sys/compat/linux/common/linux_time.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/linux/common/linux_time.c
diff -u src/sys/compat/linux/common/linux_time.c:1.37 src/sys/compat/linux/common/linux_time.c:1.38
--- src/sys/compat/linux/common/linux_time.c:1.37	Mon Jan 13 10:33:03 2014
+++ src/sys/compat/linux/common/linux_time.c	Sat Jul 29 01:14:59 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: linux_time.c,v 1.37 2014/01/13 10:33:03 njoly Exp $ */
+/*	$NetBSD: linux_time.c,v 1.38 2017/07/29 01:14:59 riastradh Exp $ */
 
 /*-
  * Copyright (c) 2001 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: linux_time.c,v 1.37 2014/01/13 10:33:03 njoly Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux_time.c,v 1.38 2017/07/29 01:14:59 riastradh Exp $");
 
 #include 
 #include 
@@ -79,6 +79,9 @@ linux_sys_gettimeofday(struct lwp *l, co
 	}
 
 	if (SCARG(uap, tzp)) {
+		if (kauth_authorize_generic(kauth_cred_get(),
+			KAUTH_GENERIC_ISSUSER, NULL) != 0)
+			return (EPERM);
 		error = copyout(_sys_tz, SCARG(uap, tzp), sizeof(linux_sys_tz));
 		if (error)
 			return (error);

CVS commit: src/sys/compat/linux/common

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:14:59 UTC 2017

Modified Files:
src/sys/compat/linux/common: linux_time.c

Log Message:
Only let the superuser set the compat_linux timezone.

Not really keen to invent a new kauth cookie for this useless purpose.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.37 -r1.38 src/sys/compat/linux/common/linux_time.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/compat/ibcs2

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:14:00 UTC 2017

Modified Files:
src/sys/compat/ibcs2: ibcs2_stat.c

Log Message:
Little happy on the commit trigger.  Actually use the out label.


To generate a diff of this commit:
cvs rdiff -u -r1.49 -r1.50 src/sys/compat/ibcs2/ibcs2_stat.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/compat/ibcs2

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:14:00 UTC 2017

Modified Files:
src/sys/compat/ibcs2: ibcs2_stat.c

Log Message:
Little happy on the commit trigger.  Actually use the out label.


To generate a diff of this commit:
cvs rdiff -u -r1.49 -r1.50 src/sys/compat/ibcs2/ibcs2_stat.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/ibcs2/ibcs2_stat.c
diff -u src/sys/compat/ibcs2/ibcs2_stat.c:1.49 src/sys/compat/ibcs2/ibcs2_stat.c:1.50
--- src/sys/compat/ibcs2/ibcs2_stat.c:1.49	Sat Jul 29 01:05:54 2017
+++ src/sys/compat/ibcs2/ibcs2_stat.c	Sat Jul 29 01:14:00 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: ibcs2_stat.c,v 1.49 2017/07/29 01:05:54 riastradh Exp $	*/
+/*	$NetBSD: ibcs2_stat.c,v 1.50 2017/07/29 01:14:00 riastradh Exp $	*/
 /*
  * Copyright (c) 1995, 1998 Scott Bartram
  * All rights reserved.
@@ -27,7 +27,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.49 2017/07/29 01:05:54 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.50 2017/07/29 01:14:00 riastradh Exp $");
 
 #include 
 #include 
@@ -203,7 +203,7 @@ ibcs2_sys_statvfs(struct lwp *l, const s
 	mp = vp->v_mount;
 	sp = >mnt_stat;
 	if ((error = VFS_STATVFS(mp, sp)) != 0)
-		return (error);
+		goto out;
 	sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
 	error = cvt_statvfs(sp, (void *)SCARG(uap, buf),
 	sizeof(struct ibcs2_statvfs));

CVS commit: src/sys/compat/ibcs2

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:05:54 UTC 2017

Modified Files:
src/sys/compat/ibcs2: ibcs2_stat.c

Log Message:
Don't drop vnode ref until we're done with mount in ibcs2_stat(v)fs.

Nothing else guarantees the mount will stick around.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.48 -r1.49 src/sys/compat/ibcs2/ibcs2_stat.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/ibcs2/ibcs2_stat.c
diff -u src/sys/compat/ibcs2/ibcs2_stat.c:1.48 src/sys/compat/ibcs2/ibcs2_stat.c:1.49
--- src/sys/compat/ibcs2/ibcs2_stat.c:1.48	Fri Sep  5 09:21:54 2014
+++ src/sys/compat/ibcs2/ibcs2_stat.c	Sat Jul 29 01:05:54 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: ibcs2_stat.c,v 1.48 2014/09/05 09:21:54 matt Exp $	*/
+/*	$NetBSD: ibcs2_stat.c,v 1.49 2017/07/29 01:05:54 riastradh Exp $	*/
 /*
  * Copyright (c) 1995, 1998 Scott Bartram
  * All rights reserved.
@@ -27,7 +27,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.48 2014/09/05 09:21:54 matt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.49 2017/07/29 01:05:54 riastradh Exp $");
 
 #include 
 #include 
@@ -147,11 +147,13 @@ ibcs2_sys_statfs(struct lwp *l, const st
 		return (error);
 	mp = vp->v_mount;
 	sp = >mnt_stat;
-	vrele(vp);
 	if ((error = VFS_STATVFS(mp, sp)) != 0)
-		return (error);
+		goto out;
 	sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
-	return cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
+	error = cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
+out:
+	vrele(vp);
+	return (error);
 }
 
 int
@@ -200,12 +202,14 @@ ibcs2_sys_statvfs(struct lwp *l, const s
 		return (error);
 	mp = vp->v_mount;
 	sp = >mnt_stat;
-	vrele(vp);
 	if ((error = VFS_STATVFS(mp, sp)) != 0)
 		return (error);
 	sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
-	return cvt_statvfs(sp, (void *)SCARG(uap, buf),
-			   sizeof(struct ibcs2_statvfs));
+	error = cvt_statvfs(sp, (void *)SCARG(uap, buf),
+	sizeof(struct ibcs2_statvfs));
+out:
+	vrele(vp);
+	return error;
 }
 
 int

CVS commit: src/sys/compat/ibcs2

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Sat Jul 29 01:05:54 UTC 2017

Modified Files:
src/sys/compat/ibcs2: ibcs2_stat.c

Log Message:
Don't drop vnode ref until we're done with mount in ibcs2_stat(v)fs.

Nothing else guarantees the mount will stick around.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.48 -r1.49 src/sys/compat/ibcs2/ibcs2_stat.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Re: CVS commit: src/sys/netinet

[Robert Elz]

Date:Fri, 28 Jul 2017 19:16:41 +
From:"Maxime Villard" 
Message-ID:  <20170728191641.cf10cf...@cvs.netbsd.org>

  | Remove TCP_COMPAT_42. This feature is a workaround for a bug in the TCP
  | stack of BSD4.2. Having such features just does not make any sense,

These days, probably not, it isn't likely that there's still anyone
running unfixed 35 year old code any more.

  | and looking at the code, I'm not sure it actually works.

You didn't say which part you have doubts about.  If there was some
flaw in the sysctl setup, which no-one noticed because no-one uses it
any more, then I'd believe that's possible.

However, if you think the code to send the 4.2 compatible keepalive
packet was incorrect, you're mistaken, that part would have worked
just fine.

kre

CVS commit: src/doc

[Thomas Klausner]

Module Name:src
Committed By:   wiz
Date:   Fri Jul 28 22:53:32 UTC 2017

Modified Files:
src/doc: 3RDPARTY

Log Message:
expat-2.2.2 security fix release out.


To generate a diff of this commit:
cvs rdiff -u -r1.1459 -r1.1460 src/doc/3RDPARTY

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/doc

[Thomas Klausner]

Module Name:src
Committed By:   wiz
Date:   Fri Jul 28 22:53:32 UTC 2017

Modified Files:
src/doc: 3RDPARTY

Log Message:
expat-2.2.2 security fix release out.


To generate a diff of this commit:
cvs rdiff -u -r1.1459 -r1.1460 src/doc/3RDPARTY

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/doc/3RDPARTY
diff -u src/doc/3RDPARTY:1.1459 src/doc/3RDPARTY:1.1460
--- src/doc/3RDPARTY:1.1459	Fri Jul 28 19:31:59 2017
+++ src/doc/3RDPARTY	Fri Jul 28 22:53:32 2017
@@ -1,4 +1,4 @@
-#	$NetBSD: 3RDPARTY,v 1.1459 2017/07/28 19:31:59 wiz Exp $
+#	$NetBSD: 3RDPARTY,v 1.1460 2017/07/28 22:53:32 wiz Exp $
 #
 # This file contains a list of the software that has been integrated into
 # NetBSD where we are not the primary maintainer.
@@ -413,7 +413,7 @@ Notes:
 
 Package:	expat
 Version:	2.2.1
-Current Vers:	2.2.1
+Current Vers:	2.2.2
 Maintainer:	Expat Project
 Archive Site:	http://sourceforge.net/projects/expat/files/expat/
 Home Page:	http://www.libexpat.org/

Re: CVS commit: src/sys/netinet

[Paul Goyette]

On Fri, 28 Jul 2017, Maxime Villard wrote:


Module Name:src
Committed By:   maxv
Date:   Fri Jul 28 19:16:41 UTC 2017

Modified Files:
src/sys/netinet: tcp_timer.c tcp_usrreq.c tcp_var.h

Log Message:
Remove TCP_COMPAT_42. This feature is a workaround for a bug in the TCP
stack of BSD4.2. Having such features just does not make any sense, and
looking at the code, I'm not sure it actually works.


Update options(4) man page?



+--+--++
| Paul Goyette | PGP Key fingerprint: | E-mail addresses:  |
| (Retired)| FA29 0E3B 35AF E8AE 6651 | paul at whooppee dot com   |
| Kernel Developer | 0786 F758 55DE 53BA 7731 | pgoyette at netbsd dot org |
+--+--++

CVS commit: src/external/gpl3/gcc.old/dist/gcc/config/i386

[Maya Rashish]

Module Name:src
Committed By:   maya
Date:   Fri Jul 28 22:24:27 UTC 2017

Modified Files:
src/external/gpl3/gcc.old/dist/gcc/config/i386: i386.c

Log Message:
Apply upstream patch:
Incorrect codegen from rdseed intrinsic use (CVE-2017-11671)

We should not expand call arguments in between flags reg setting and
flags reg using instructions, as it may expand with flags reg
clobbering insn (ADD in this case).

Attached patch moves expansion out of the link. Also, change
zero-extension to non-flags reg clobbering sequence in case we perform
zero-extension with and.

2017-03-25  Uros Bizjak


To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 \
src/external/gpl3/gcc.old/dist/gcc/config/i386/i386.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/external/gpl3/gcc.old/dist/gcc/config/i386/i386.c
diff -u src/external/gpl3/gcc.old/dist/gcc/config/i386/i386.c:1.6 src/external/gpl3/gcc.old/dist/gcc/config/i386/i386.c:1.7
--- src/external/gpl3/gcc.old/dist/gcc/config/i386/i386.c:1.6	Sun Jul 23 01:11:06 2017
+++ src/external/gpl3/gcc.old/dist/gcc/config/i386/i386.c	Fri Jul 28 22:24:27 2017
@@ -39529,9 +39529,6 @@ ix86_expand_builtin (tree exp, rtx targe
   mode0 = DImode;
 
 rdrand_step:
-  op0 = gen_reg_rtx (mode0);
-  emit_insn (GEN_FCN (icode) (op0));
-
   arg0 = CALL_EXPR_ARG (exp, 0);
   op1 = expand_normal (arg0);
   if (!address_operand (op1, VOIDmode))
@@ -39539,6 +39536,10 @@ rdrand_step:
 	  op1 = convert_memory_address (Pmode, op1);
 	  op1 = copy_addr_to_reg (op1);
 	}
+
+  op0 = gen_reg_rtx (mode0);
+  emit_insn (GEN_FCN (icode) (op0));
+
   emit_move_insn (gen_rtx_MEM (mode0, op1), op0);
 
   op1 = gen_reg_rtx (SImode);
@@ -39547,8 +39548,20 @@ rdrand_step:
   /* Emit SImode conditional move.  */
   if (mode0 == HImode)
 	{
-	  op2 = gen_reg_rtx (SImode);
-	  emit_insn (gen_zero_extendhisi2 (op2, op0));
+	  if (TARGET_ZERO_EXTEND_WITH_AND
+	  && optimize_function_for_speed_p (cfun))
+	{
+	  op2 = force_reg (SImode, const0_rtx);
+
+	  emit_insn (gen_movstricthi
+			 (gen_lowpart (HImode, op2), op0));
+	}
+	  else
+	{
+	  op2 = gen_reg_rtx (SImode);
+
+	  emit_insn (gen_zero_extendhisi2 (op2, op0));
+	}
 	}
   else if (mode0 == SImode)
 	op2 = op0;
@@ -39580,9 +39593,6 @@ rdrand_step:
   mode0 = DImode;
 
 rdseed_step:
-  op0 = gen_reg_rtx (mode0);
-  emit_insn (GEN_FCN (icode) (op0));
-
   arg0 = CALL_EXPR_ARG (exp, 0);
   op1 = expand_normal (arg0);
   if (!address_operand (op1, VOIDmode))
@@ -39590,6 +39600,10 @@ rdseed_step:
 	  op1 = convert_memory_address (Pmode, op1);
 	  op1 = copy_addr_to_reg (op1);
 	}
+
+  op0 = gen_reg_rtx (mode0);
+  emit_insn (GEN_FCN (icode) (op0));
+
   emit_move_insn (gen_rtx_MEM (mode0, op1), op0);
 
   op2 = gen_reg_rtx (QImode);

CVS commit: src/external/gpl3/gcc.old/dist/gcc/config/i386

[Maya Rashish]

Module Name:src
Committed By:   maya
Date:   Fri Jul 28 22:24:27 UTC 2017

Modified Files:
src/external/gpl3/gcc.old/dist/gcc/config/i386: i386.c

Log Message:
Apply upstream patch:
Incorrect codegen from rdseed intrinsic use (CVE-2017-11671)

We should not expand call arguments in between flags reg setting and
flags reg using instructions, as it may expand with flags reg
clobbering insn (ADD in this case).

Attached patch moves expansion out of the link. Also, change
zero-extension to non-flags reg clobbering sequence in case we perform
zero-extension with and.

2017-03-25  Uros Bizjak


To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 \
src/external/gpl3/gcc.old/dist/gcc/config/i386/i386.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Re: CVS commit: src/sys/arch/amd64/conf

[Paul Goyette]

On Fri, 28 Jul 2017, Maxime Villard wrote:


Module Name:src
Committed By:   maxv
Date:   Fri Jul 28 16:10:29 UTC 2017

Modified Files:
src/sys/arch/amd64/conf: GENERIC XEN3_DOM0 XEN3_DOMU

Log Message:
After a careful review, and all things considered, disable compat43 by
default on amd64. The use case is limited, the potential for damage too
high, and it is safer to run a BSD4.3 binary on i386 since the kernel does
not have to go through netbsd32 - which may not correctly reproduce i386.


Should COMPAT43 also be removed from the default build of compat module?

See line #26 in src/sys/modules/netbsd/Makefile



+--+--++
| Paul Goyette | PGP Key fingerprint: | E-mail addresses:  |
| (Retired)| FA29 0E3B 35AF E8AE 6651 | paul at whooppee dot com   |
| Kernel Developer | 0786 F758 55DE 53BA 7731 | pgoyette at netbsd dot org |
+--+--++

CVS commit: src/external/gpl3/gcc/dist/gcc/config/i386

[Maya Rashish]

Module Name:src
Committed By:   maya
Date:   Fri Jul 28 22:23:05 UTC 2017

Modified Files:
src/external/gpl3/gcc/dist/gcc/config/i386: i386.c

Log Message:
Apply upstream patch:
Incorrect codegen from rdseed intrinsic use (CVE-2017-11671)

We should not expand call arguments in between flags reg setting and
flags reg using instructions, as it may expand with flags reg
clobbering insn (ADD in this case).

Attached patch moves expansion out of the link. Also, change
zero-extension to non-flags reg clobbering sequence in case we perform
zero-extension with and.

2017-03-25  Uros Bizjak  


To generate a diff of this commit:
cvs rdiff -u -r1.12 -r1.13 src/external/gpl3/gcc/dist/gcc/config/i386/i386.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/external/gpl3/gcc/dist/gcc/config/i386

[Maya Rashish]

Module Name:src
Committed By:   maya
Date:   Fri Jul 28 22:23:05 UTC 2017

Modified Files:
src/external/gpl3/gcc/dist/gcc/config/i386: i386.c

Log Message:
Apply upstream patch:
Incorrect codegen from rdseed intrinsic use (CVE-2017-11671)

We should not expand call arguments in between flags reg setting and
flags reg using instructions, as it may expand with flags reg
clobbering insn (ADD in this case).

Attached patch moves expansion out of the link. Also, change
zero-extension to non-flags reg clobbering sequence in case we perform
zero-extension with and.

2017-03-25  Uros Bizjak  


To generate a diff of this commit:
cvs rdiff -u -r1.12 -r1.13 src/external/gpl3/gcc/dist/gcc/config/i386/i386.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/external/gpl3/gcc/dist/gcc/config/i386/i386.c
diff -u src/external/gpl3/gcc/dist/gcc/config/i386/i386.c:1.12 src/external/gpl3/gcc/dist/gcc/config/i386/i386.c:1.13
--- src/external/gpl3/gcc/dist/gcc/config/i386/i386.c:1.12	Tue Jun  7 06:14:17 2016
+++ src/external/gpl3/gcc/dist/gcc/config/i386/i386.c	Fri Jul 28 22:23:05 2017
@@ -39529,9 +39529,6 @@ ix86_expand_builtin (tree exp, rtx targe
   mode0 = DImode;
 
 rdrand_step:
-  op0 = gen_reg_rtx (mode0);
-  emit_insn (GEN_FCN (icode) (op0));
-
   arg0 = CALL_EXPR_ARG (exp, 0);
   op1 = expand_normal (arg0);
   if (!address_operand (op1, VOIDmode))
@@ -39539,6 +39536,10 @@ rdrand_step:
 	  op1 = convert_memory_address (Pmode, op1);
 	  op1 = copy_addr_to_reg (op1);
 	}
+
+  op0 = gen_reg_rtx (mode0);
+  emit_insn (GEN_FCN (icode) (op0));
+
   emit_move_insn (gen_rtx_MEM (mode0, op1), op0);
 
   op1 = gen_reg_rtx (SImode);
@@ -39547,8 +39548,20 @@ rdrand_step:
   /* Emit SImode conditional move.  */
   if (mode0 == HImode)
 	{
-	  op2 = gen_reg_rtx (SImode);
-	  emit_insn (gen_zero_extendhisi2 (op2, op0));
+	  if (TARGET_ZERO_EXTEND_WITH_AND
+	  && optimize_function_for_speed_p (cfun))
+	{
+	  op2 = force_reg (SImode, const0_rtx);
+
+	  emit_insn (gen_movstricthi
+			 (gen_lowpart (HImode, op2), op0));
+	}
+	  else
+	{
+	  op2 = gen_reg_rtx (SImode);
+
+	  emit_insn (gen_zero_extendhisi2 (op2, op0));
+	}
 	}
   else if (mode0 == SImode)
 	op2 = op0;
@@ -39580,9 +39593,6 @@ rdrand_step:
   mode0 = DImode;
 
 rdseed_step:
-  op0 = gen_reg_rtx (mode0);
-  emit_insn (GEN_FCN (icode) (op0));
-
   arg0 = CALL_EXPR_ARG (exp, 0);
   op1 = expand_normal (arg0);
   if (!address_operand (op1, VOIDmode))
@@ -39590,6 +39600,10 @@ rdseed_step:
 	  op1 = convert_memory_address (Pmode, op1);
 	  op1 = copy_addr_to_reg (op1);
 	}
+
+  op0 = gen_reg_rtx (mode0);
+  emit_insn (GEN_FCN (icode) (op0));
+
   emit_move_insn (gen_rtx_MEM (mode0, op1), op0);
 
   op2 = gen_reg_rtx (QImode);

CVS commit: src/doc

[Thomas Klausner]

Module Name:src
Committed By:   wiz
Date:   Fri Jul 28 19:31:59 UTC 2017

Modified Files:
src/doc: 3RDPARTY

Log Message:
binutils-2.29 out.


To generate a diff of this commit:
cvs rdiff -u -r1.1458 -r1.1459 src/doc/3RDPARTY

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/doc/3RDPARTY
diff -u src/doc/3RDPARTY:1.1458 src/doc/3RDPARTY:1.1459
--- src/doc/3RDPARTY:1.1458	Thu Jul 27 18:12:07 2017
+++ src/doc/3RDPARTY	Fri Jul 28 19:31:59 2017
@@ -1,4 +1,4 @@
-#	$NetBSD: 3RDPARTY,v 1.1458 2017/07/27 18:12:07 jmcneill Exp $
+#	$NetBSD: 3RDPARTY,v 1.1459 2017/07/28 19:31:59 wiz Exp $
 #
 # This file contains a list of the software that has been integrated into
 # NetBSD where we are not the primary maintainer.
@@ -186,7 +186,7 @@ Todo[5]: Reconcile the doc directory.
 
 Package:	binutils
 Version:	2.27
-Current Vers:	2.28
+Current Vers:	2.29
 Maintainer:	FSF
 Archive Site:	ftp://ftp.gnu.org/gnu/binutils/
 Home Page:	http://www.gnu.org/software/binutils/

CVS commit: src/doc

[Thomas Klausner]

Module Name:src
Committed By:   wiz
Date:   Fri Jul 28 19:31:59 UTC 2017

Modified Files:
src/doc: 3RDPARTY

Log Message:
binutils-2.29 out.


To generate a diff of this commit:
cvs rdiff -u -r1.1458 -r1.1459 src/doc/3RDPARTY

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/arch

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Fri Jul 28 19:26:16 UTC 2017

Modified Files:
src/sys/arch/acorn32/conf: EB7500ATX GENERIC INSTALL LOWMEM_WSCONS NC
src/sys/arch/amd64/conf: ALL
src/sys/arch/amiga/conf: DRACO GENERIC GENERIC.in
src/sys/arch/epoc32/conf: GENERIC
src/sys/arch/hp300/conf: GENERIC INSTALL
src/sys/arch/mipsco/conf: GENERIC INSTALL RC3230
src/sys/arch/newsmips/conf: GENERIC
src/sys/arch/pmax/conf: GENERIC GENERIC64
src/sys/arch/prep/conf: GENERIC
src/sys/arch/sgimips/conf: GENERIC32_IP12 GENERIC32_IP2x GENERIC32_IP3x
GENERIC64_IP2x GENERIC64_IP3x
src/sys/arch/sun3/conf: DISKLESS DISKLESS3X GENERIC GENERIC3X INSTALL
INSTALL3X RAMDISK RAMDISK3X

Log Message:
Remove TCP_COMPAT_42 from the config files. Pass 1.


To generate a diff of this commit:
cvs rdiff -u -r1.61 -r1.62 src/sys/arch/acorn32/conf/EB7500ATX
cvs rdiff -u -r1.120 -r1.121 src/sys/arch/acorn32/conf/GENERIC
cvs rdiff -u -r1.76 -r1.77 src/sys/arch/acorn32/conf/INSTALL
cvs rdiff -u -r1.70 -r1.71 src/sys/arch/acorn32/conf/LOWMEM_WSCONS
cvs rdiff -u -r1.69 -r1.70 src/sys/arch/acorn32/conf/NC
cvs rdiff -u -r1.61 -r1.62 src/sys/arch/amd64/conf/ALL
cvs rdiff -u -r1.180 -r1.181 src/sys/arch/amiga/conf/DRACO
cvs rdiff -u -r1.314 -r1.315 src/sys/arch/amiga/conf/GENERIC
cvs rdiff -u -r1.132 -r1.133 src/sys/arch/amiga/conf/GENERIC.in
cvs rdiff -u -r1.13 -r1.14 src/sys/arch/epoc32/conf/GENERIC
cvs rdiff -u -r1.194 -r1.195 src/sys/arch/hp300/conf/GENERIC
cvs rdiff -u -r1.60 -r1.61 src/sys/arch/hp300/conf/INSTALL
cvs rdiff -u -r1.88 -r1.89 src/sys/arch/mipsco/conf/GENERIC
cvs rdiff -u -r1.30 -r1.31 src/sys/arch/mipsco/conf/INSTALL
cvs rdiff -u -r1.47 -r1.48 src/sys/arch/mipsco/conf/RC3230
cvs rdiff -u -r1.129 -r1.130 src/sys/arch/newsmips/conf/GENERIC
cvs rdiff -u -r1.190 -r1.191 src/sys/arch/pmax/conf/GENERIC
cvs rdiff -u -r1.24 -r1.25 src/sys/arch/pmax/conf/GENERIC64
cvs rdiff -u -r1.181 -r1.182 src/sys/arch/prep/conf/GENERIC
cvs rdiff -u -r1.29 -r1.30 src/sys/arch/sgimips/conf/GENERIC32_IP12
cvs rdiff -u -r1.108 -r1.109 src/sys/arch/sgimips/conf/GENERIC32_IP2x
cvs rdiff -u -r1.111 -r1.112 src/sys/arch/sgimips/conf/GENERIC32_IP3x
cvs rdiff -u -r1.4 -r1.5 src/sys/arch/sgimips/conf/GENERIC64_IP2x \
src/sys/arch/sgimips/conf/GENERIC64_IP3x
cvs rdiff -u -r1.72 -r1.73 src/sys/arch/sun3/conf/DISKLESS
cvs rdiff -u -r1.57 -r1.58 src/sys/arch/sun3/conf/DISKLESS3X \
src/sys/arch/sun3/conf/INSTALL3X
cvs rdiff -u -r1.172 -r1.173 src/sys/arch/sun3/conf/GENERIC
cvs rdiff -u -r1.126 -r1.127 src/sys/arch/sun3/conf/GENERIC3X
cvs rdiff -u -r1.58 -r1.59 src/sys/arch/sun3/conf/INSTALL
cvs rdiff -u -r1.53 -r1.54 src/sys/arch/sun3/conf/RAMDISK
cvs rdiff -u -r1.41 -r1.42 src/sys/arch/sun3/conf/RAMDISK3X

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/arch/acorn32/conf/EB7500ATX
diff -u src/sys/arch/acorn32/conf/EB7500ATX:1.61 src/sys/arch/acorn32/conf/EB7500ATX:1.62
--- src/sys/arch/acorn32/conf/EB7500ATX:1.61	Tue Dec 13 20:42:15 2016
+++ src/sys/arch/acorn32/conf/EB7500ATX	Fri Jul 28 19:26:15 2017
@@ -1,4 +1,4 @@
-#	$NetBSD: EB7500ATX,v 1.61 2016/12/13 20:42:15 christos Exp $
+#	$NetBSD: EB7500ATX,v 1.62 2017/07/28 19:26:15 maxv Exp $
 #
 #	EB7500ATX --- NetBSD/acorn32 complete configuration
 #
@@ -22,7 +22,7 @@ include		"arch/acorn32/conf/std.acorn32"
 
 options 	INCLUDE_CONFIG_FILE	# embed config file in kernel binary
 
-#ident		"EB7500ATX-$Revision: 1.61 $"
+#ident		"EB7500ATX-$Revision: 1.62 $"
 
 # estimated number of users
 maxusers	32
@@ -108,7 +108,6 @@ options 	COMPAT_16	# NetBSD 1.6,
 options 	COMPAT_20	# NetBSD 2.0,
 options 	COMPAT_30	# NetBSD 3.0, and
 options 	COMPAT_40	# NetBSD 4.0 binary compatibility.
-#options 	TCP_COMPAT_42	# 4.2BSD TCP/IP bug compat. Not recommended.
 options		COMPAT_BSDPTY	# /dev/[pt]ty?? ptys.
 
 # Shared memory options

Index: src/sys/arch/acorn32/conf/GENERIC
diff -u src/sys/arch/acorn32/conf/GENERIC:1.120 src/sys/arch/acorn32/conf/GENERIC:1.121
--- src/sys/arch/acorn32/conf/GENERIC:1.120	Tue Dec 13 20:42:15 2016
+++ src/sys/arch/acorn32/conf/GENERIC	Fri Jul 28 19:26:15 2017
@@ -1,4 +1,4 @@
-# 	$NetBSD: GENERIC,v 1.120 2016/12/13 20:42:15 christos Exp $
+# 	$NetBSD: GENERIC,v 1.121 2017/07/28 19:26:15 maxv Exp $
 #
 #	GENERIC --- NetBSD/acorn32 complete configuration
 #
@@ -22,7 +22,7 @@ include		"arch/acorn32/conf/std.acorn32"
 
 options 	INCLUDE_CONFIG_FILE	# embed config file in kernel binary
 
-#ident		"GENERIC-$Revision: 1.120 $"
+#ident		"GENERIC-$Revision: 1.121 $"
 
 # estimated number of users
 maxusers	32
@@ -121,7 +121,6 @@ options 	COMPAT_40	# NetBSD 4.0,
 options 	COMPAT_50	# NetBSD 5.0,
 options 	COMPAT_60	# NetBSD 6.0, and
 options 	COMPAT_70	# NetBSD 7.0 binary compatibility.
-#options 	TCP_COMPAT_42	# 4.2BSD TCP/IP bug compat. Not recommended.
 options		COMPAT_BSDPTY	# 

CVS commit: src/sys/arch

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Fri Jul 28 19:26:16 UTC 2017

Modified Files:
src/sys/arch/acorn32/conf: EB7500ATX GENERIC INSTALL LOWMEM_WSCONS NC
src/sys/arch/amd64/conf: ALL
src/sys/arch/amiga/conf: DRACO GENERIC GENERIC.in
src/sys/arch/epoc32/conf: GENERIC
src/sys/arch/hp300/conf: GENERIC INSTALL
src/sys/arch/mipsco/conf: GENERIC INSTALL RC3230
src/sys/arch/newsmips/conf: GENERIC
src/sys/arch/pmax/conf: GENERIC GENERIC64
src/sys/arch/prep/conf: GENERIC
src/sys/arch/sgimips/conf: GENERIC32_IP12 GENERIC32_IP2x GENERIC32_IP3x
GENERIC64_IP2x GENERIC64_IP3x
src/sys/arch/sun3/conf: DISKLESS DISKLESS3X GENERIC GENERIC3X INSTALL
INSTALL3X RAMDISK RAMDISK3X

Log Message:
Remove TCP_COMPAT_42 from the config files. Pass 1.


To generate a diff of this commit:
cvs rdiff -u -r1.61 -r1.62 src/sys/arch/acorn32/conf/EB7500ATX
cvs rdiff -u -r1.120 -r1.121 src/sys/arch/acorn32/conf/GENERIC
cvs rdiff -u -r1.76 -r1.77 src/sys/arch/acorn32/conf/INSTALL
cvs rdiff -u -r1.70 -r1.71 src/sys/arch/acorn32/conf/LOWMEM_WSCONS
cvs rdiff -u -r1.69 -r1.70 src/sys/arch/acorn32/conf/NC
cvs rdiff -u -r1.61 -r1.62 src/sys/arch/amd64/conf/ALL
cvs rdiff -u -r1.180 -r1.181 src/sys/arch/amiga/conf/DRACO
cvs rdiff -u -r1.314 -r1.315 src/sys/arch/amiga/conf/GENERIC
cvs rdiff -u -r1.132 -r1.133 src/sys/arch/amiga/conf/GENERIC.in
cvs rdiff -u -r1.13 -r1.14 src/sys/arch/epoc32/conf/GENERIC
cvs rdiff -u -r1.194 -r1.195 src/sys/arch/hp300/conf/GENERIC
cvs rdiff -u -r1.60 -r1.61 src/sys/arch/hp300/conf/INSTALL
cvs rdiff -u -r1.88 -r1.89 src/sys/arch/mipsco/conf/GENERIC
cvs rdiff -u -r1.30 -r1.31 src/sys/arch/mipsco/conf/INSTALL
cvs rdiff -u -r1.47 -r1.48 src/sys/arch/mipsco/conf/RC3230
cvs rdiff -u -r1.129 -r1.130 src/sys/arch/newsmips/conf/GENERIC
cvs rdiff -u -r1.190 -r1.191 src/sys/arch/pmax/conf/GENERIC
cvs rdiff -u -r1.24 -r1.25 src/sys/arch/pmax/conf/GENERIC64
cvs rdiff -u -r1.181 -r1.182 src/sys/arch/prep/conf/GENERIC
cvs rdiff -u -r1.29 -r1.30 src/sys/arch/sgimips/conf/GENERIC32_IP12
cvs rdiff -u -r1.108 -r1.109 src/sys/arch/sgimips/conf/GENERIC32_IP2x
cvs rdiff -u -r1.111 -r1.112 src/sys/arch/sgimips/conf/GENERIC32_IP3x
cvs rdiff -u -r1.4 -r1.5 src/sys/arch/sgimips/conf/GENERIC64_IP2x \
src/sys/arch/sgimips/conf/GENERIC64_IP3x
cvs rdiff -u -r1.72 -r1.73 src/sys/arch/sun3/conf/DISKLESS
cvs rdiff -u -r1.57 -r1.58 src/sys/arch/sun3/conf/DISKLESS3X \
src/sys/arch/sun3/conf/INSTALL3X
cvs rdiff -u -r1.172 -r1.173 src/sys/arch/sun3/conf/GENERIC
cvs rdiff -u -r1.126 -r1.127 src/sys/arch/sun3/conf/GENERIC3X
cvs rdiff -u -r1.58 -r1.59 src/sys/arch/sun3/conf/INSTALL
cvs rdiff -u -r1.53 -r1.54 src/sys/arch/sun3/conf/RAMDISK
cvs rdiff -u -r1.41 -r1.42 src/sys/arch/sun3/conf/RAMDISK3X

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/netinet

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Fri Jul 28 19:16:41 UTC 2017

Modified Files:
src/sys/netinet: tcp_timer.c tcp_usrreq.c tcp_var.h

Log Message:
Remove TCP_COMPAT_42. This feature is a workaround for a bug in the TCP
stack of BSD4.2. Having such features just does not make any sense, and
looking at the code, I'm not sure it actually works.


To generate a diff of this commit:
cvs rdiff -u -r1.91 -r1.92 src/sys/netinet/tcp_timer.c
cvs rdiff -u -r1.214 -r1.215 src/sys/netinet/tcp_usrreq.c
cvs rdiff -u -r1.178 -r1.179 src/sys/netinet/tcp_var.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/netinet/tcp_timer.c
diff -u src/sys/netinet/tcp_timer.c:1.91 src/sys/netinet/tcp_timer.c:1.92
--- src/sys/netinet/tcp_timer.c:1.91	Mon Jul 25 00:10:38 2016
+++ src/sys/netinet/tcp_timer.c	Fri Jul 28 19:16:41 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: tcp_timer.c,v 1.91 2016/07/25 00:10:38 knakahara Exp $	*/
+/*	$NetBSD: tcp_timer.c,v 1.92 2017/07/28 19:16:41 maxv Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -93,7 +93,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: tcp_timer.c,v 1.91 2016/07/25 00:10:38 knakahara Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tcp_timer.c,v 1.92 2017/07/28 19:16:41 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -564,19 +564,11 @@ tcp_timer_keep(void *arg)
 		 * correspondent TCP to respond.
 		 */
 		TCP_STATINC(TCP_STAT_KEEPPROBE);
-		if (tcp_compat_42) {
-			/*
-			 * The keepalive packet must have nonzero
-			 * length to get a 4.2 host to respond.
-			 */
-			(void)tcp_respond(tp, tp->t_template,
-			NULL, NULL, tp->rcv_nxt - 1,
-			tp->snd_una - 1, 0);
-		} else {
-			(void)tcp_respond(tp, tp->t_template,
-			NULL, NULL, tp->rcv_nxt,
-			tp->snd_una - 1, 0);
-		}
+
+		(void)tcp_respond(tp, tp->t_template,
+		NULL, NULL, tp->rcv_nxt,
+		tp->snd_una - 1, 0);
+
 		TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepintvl);
 	} else
 		TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepidle);

Index: src/sys/netinet/tcp_usrreq.c
diff -u src/sys/netinet/tcp_usrreq.c:1.214 src/sys/netinet/tcp_usrreq.c:1.215
--- src/sys/netinet/tcp_usrreq.c:1.214	Tue Jan 24 07:09:24 2017
+++ src/sys/netinet/tcp_usrreq.c	Fri Jul 28 19:16:41 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: tcp_usrreq.c,v 1.214 2017/01/24 07:09:24 ozaki-r Exp $	*/
+/*	$NetBSD: tcp_usrreq.c,v 1.215 2017/07/28 19:16:41 maxv Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -99,7 +99,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: tcp_usrreq.c,v 1.214 2017/01/24 07:09:24 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tcp_usrreq.c,v 1.215 2017/07/28 19:16:41 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -2152,12 +2152,6 @@ sysctl_net_inet_tcp_setup2(struct sysctl
 		   CTL_NET, pf, IPPROTO_TCP, TCPCTL_TSTAMP, CTL_EOL);
 	sysctl_createv(clog, 0, NULL, NULL,
 		   CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
-		   CTLTYPE_INT, "compat_42",
-		   SYSCTL_DESCR("Enable workarounds for 4.2BSD TCP bugs"),
-		   NULL, 0, _compat_42, 0,
-		   CTL_NET, pf, IPPROTO_TCP, TCPCTL_COMPAT_42, CTL_EOL);
-	sysctl_createv(clog, 0, NULL, NULL,
-		   CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
 		   CTLTYPE_INT, "cwm",
 		   SYSCTL_DESCR("Hughes/Touch/Heidemann Congestion Window "
 "Monitoring"),

Index: src/sys/netinet/tcp_var.h
diff -u src/sys/netinet/tcp_var.h:1.178 src/sys/netinet/tcp_var.h:1.179
--- src/sys/netinet/tcp_var.h:1.178	Fri Jul  7 01:37:34 2017
+++ src/sys/netinet/tcp_var.h	Fri Jul 28 19:16:41 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: tcp_var.h,v 1.178 2017/07/07 01:37:34 ozaki-r Exp $	*/
+/*	$NetBSD: tcp_var.h,v 1.179 2017/07/28 19:16:41 maxv Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -811,7 +811,6 @@ extern	int tcp_init_win;	/* initial wind
 extern	int tcp_init_win_local;	/* initial window for local nets */
 extern	int tcp_init_win_max[11];/* max sizes for values of tcp_init_win_* */
 extern	int tcp_mss_ifmtu;	/* take MSS from interface, not in_maxmtu */
-extern	int tcp_compat_42;	/* work around ancient broken TCP peers */
 extern	int tcp_cwm;		/* enable Congestion Window Monitoring */
 extern	int tcp_cwm_burstsize;	/* burst size allowed by CWM */
 extern	int tcp_ack_on_push;	/* ACK immediately on PUSH */
@@ -877,7 +876,6 @@ extern int tcp_autosndbuf_max;
 	{ 1, 0, _do_sack },			\
 	{ 1, 0, _do_win_scale },		\
 	{ 1, 0, _do_timestamps },		\
-	{ 1, 0, _compat_42 },		\
 	{ 1, 0, _cwm },			\
 	{ 1, 0, _cwm_burstsize },		\
 	{ 1, 0, _ack_on_push },		\

CVS commit: src/sys/netinet

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Fri Jul 28 19:16:41 UTC 2017

Modified Files:
src/sys/netinet: tcp_timer.c tcp_usrreq.c tcp_var.h

Log Message:
Remove TCP_COMPAT_42. This feature is a workaround for a bug in the TCP
stack of BSD4.2. Having such features just does not make any sense, and
looking at the code, I'm not sure it actually works.


To generate a diff of this commit:
cvs rdiff -u -r1.91 -r1.92 src/sys/netinet/tcp_timer.c
cvs rdiff -u -r1.214 -r1.215 src/sys/netinet/tcp_usrreq.c
cvs rdiff -u -r1.178 -r1.179 src/sys/netinet/tcp_var.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/compat/ibcs2

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 17:57:48 UTC 2017

Modified Files:
src/sys/compat/ibcs2: ibcs2_ioctl.c

Log Message:
Zero buffers in ibcs2 ioctl to avoid disclosing stack to userland.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.45 -r1.46 src/sys/compat/ibcs2/ibcs2_ioctl.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/compat/ibcs2

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 17:57:48 UTC 2017

Modified Files:
src/sys/compat/ibcs2: ibcs2_ioctl.c

Log Message:
Zero buffers in ibcs2 ioctl to avoid disclosing stack to userland.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.45 -r1.46 src/sys/compat/ibcs2/ibcs2_ioctl.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/ibcs2/ibcs2_ioctl.c
diff -u src/sys/compat/ibcs2/ibcs2_ioctl.c:1.45 src/sys/compat/ibcs2/ibcs2_ioctl.c:1.46
--- src/sys/compat/ibcs2/ibcs2_ioctl.c:1.45	Tue Jun 24 10:03:17 2008
+++ src/sys/compat/ibcs2/ibcs2_ioctl.c	Fri Jul 28 17:57:48 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $	*/
+/*	$NetBSD: ibcs2_ioctl.c,v 1.46 2017/07/28 17:57:48 riastradh Exp $	*/
 
 /*
  * Copyright (c) 1994, 1995 Scott Bartram
@@ -27,7 +27,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.46 2017/07/28 17:57:48 riastradh Exp $");
 
 #include 
 #include 
@@ -402,8 +402,10 @@ ibcs2_sys_ioctl(struct lwp *l, const str
 		if ((error = (*ctl)(fp, TIOCGETA, )) != 0)
 			goto out;
 
+		memset(, 0, sizeof(sts));
 		btios2stios(, );
 		if (SCARG(uap, cmd) == IBCS2_TCGETA) {
+			memset(, 0, sizeof(st));
 			stios2stio(, );
 			error = copyout(, SCARG(uap, data), sizeof(st));
 			if (error)
@@ -559,6 +561,7 @@ ibcs2_sys_gtty(struct lwp *l, const stru
 
 	fd_putfile(SCARG(uap, fd));
 
+	memset(, 0, sizeof(itb));
 	itb.sg_ispeed = tb.sg_ispeed;
 	itb.sg_ospeed = tb.sg_ospeed;
 	itb.sg_erase = tb.sg_erase;

CVS commit: src/sys/compat/svr4

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 17:52:47 UTC 2017

Modified Files:
src/sys/compat/svr4: svr4_stream.c

Log Message:
Check bounds in svr4_sys_putmsg.  Check more svr4_strmcmd bounds.

svr4 streams code is still a disaster.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.90 -r1.91 src/sys/compat/svr4/svr4_stream.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/svr4/svr4_stream.c
diff -u src/sys/compat/svr4/svr4_stream.c:1.90 src/sys/compat/svr4/svr4_stream.c:1.91
--- src/sys/compat/svr4/svr4_stream.c:1.90	Fri Jul 28 17:43:46 2017
+++ src/sys/compat/svr4/svr4_stream.c	Fri Jul 28 17:52:47 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: svr4_stream.c,v 1.90 2017/07/28 17:43:46 riastradh Exp $	 */
+/*	$NetBSD: svr4_stream.c,v 1.91 2017/07/28 17:52:47 riastradh Exp $	 */
 
 /*-
  * Copyright (c) 1994, 2008 The NetBSD Foundation, Inc.
@@ -39,7 +39,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: svr4_stream.c,v 1.90 2017/07/28 17:43:46 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: svr4_stream.c,v 1.91 2017/07/28 17:52:47 riastradh Exp $");
 
 #include 
 #include 
@@ -533,6 +533,11 @@ si_listen(file_t *fp, int fd, struct svr
 
 	if ((error = copyin(NETBSD32PTR(ioc->buf), , ioc->len)) != 0)
 		return error;
+	if (lst.offs < 0 ||
+	lst.len < 0 ||
+	lst.len > ioc->len ||
+	ioc->len - lst.len < lst.offs)
+		return EINVAL;
 
 	if (lst.cmd != SVR4_TI_OLD_BIND_REQUEST) {
 		DPRINTF(("si_listen: bad request %ld\n", lst.cmd));
@@ -777,7 +782,10 @@ ti_bind(file_t *fp, int fd, struct svr4_
 		DPRINTF(("ti_bind: bad request %ld\n", bnd.cmd));
 		return EINVAL;
 	}
-	if (bnd.offs < 0)
+	if (bnd.offs < 0 ||
+	bnd.len < 0 ||
+	bnd.len > ioc->len ||
+	ioc->len - bnd.len < bnd.offs)
 		return EINVAL;
 
 	switch (st->s_family) {
@@ -1434,7 +1442,10 @@ svr4_sys_putmsg(struct lwp *l, const str
 
 	if ((error = copyin(NETBSD32PTR(ctl.buf), , ctl.len)) != 0)
 		goto out;
-	if (sc.offs < 0) {
+	if (sc.offs < 0 ||
+	sc.len < 0 ||
+	sc.len > ctl.len ||
+	sc.offs > ctl.len - sc.len) {
 		error = EINVAL;
 		goto out;
 	}
@@ -1481,8 +1492,11 @@ svr4_sys_putmsg(struct lwp *l, const str
 			*retval = 0;
 			error = 0;
 			goto out;
-		}
-		else {
+		} else if (sc.len < sizeof(dev_t[2])) {
+			*retval = 0;
+			error = EINVAL;
+			goto out;
+		} else {
 			/* Maybe we've been given a device/inode pair */
 			dev_t *dev = SVR4_ADDROF();
 			svr4_ino_t *ino = (svr4_ino_t *) [1];

CVS commit: src/sys/compat/svr4

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 17:52:47 UTC 2017

Modified Files:
src/sys/compat/svr4: svr4_stream.c

Log Message:
Check bounds in svr4_sys_putmsg.  Check more svr4_strmcmd bounds.

svr4 streams code is still a disaster.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.90 -r1.91 src/sys/compat/svr4/svr4_stream.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/compat/svr4

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 17:43:46 UTC 2017

Modified Files:
src/sys/compat/svr4: svr4_stream.c

Log Message:
Feebly attempt to get this reference counting less bad.

This svr4 streams code is bad and it should feel bad.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.89 -r1.90 src/sys/compat/svr4/svr4_stream.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/compat/svr4

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 17:43:46 UTC 2017

Modified Files:
src/sys/compat/svr4: svr4_stream.c

Log Message:
Feebly attempt to get this reference counting less bad.

This svr4 streams code is bad and it should feel bad.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.89 -r1.90 src/sys/compat/svr4/svr4_stream.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/svr4/svr4_stream.c
diff -u src/sys/compat/svr4/svr4_stream.c:1.89 src/sys/compat/svr4/svr4_stream.c:1.90
--- src/sys/compat/svr4/svr4_stream.c:1.89	Fri Jul 28 16:55:48 2017
+++ src/sys/compat/svr4/svr4_stream.c	Fri Jul 28 17:43:46 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: svr4_stream.c,v 1.89 2017/07/28 16:55:48 riastradh Exp $	 */
+/*	$NetBSD: svr4_stream.c,v 1.90 2017/07/28 17:43:46 riastradh Exp $	 */
 
 /*-
  * Copyright (c) 1994, 2008 The NetBSD Foundation, Inc.
@@ -39,7 +39,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: svr4_stream.c,v 1.89 2017/07/28 16:55:48 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: svr4_stream.c,v 1.90 2017/07/28 17:43:46 riastradh Exp $");
 
 #include 
 #include 
@@ -1507,10 +1507,12 @@ svr4_sys_putmsg(struct lwp *l, const str
  	switch (st->s_cmd = sc.cmd) {
 	case SVR4_TI_CONNECT_REQUEST:	/* connect 	*/
 	 	KERNEL_UNLOCK_ONE(NULL);
+		fd_putfile(SCARG(uap, fd));
 		return do_sys_connect(l, SCARG(uap, fd), skp);
 
 	case SVR4_TI_SENDTO_REQUEST:	/* sendto 	*/
 	 	KERNEL_UNLOCK_ONE(NULL);
+		fd_putfile(SCARG(uap, fd));
 		msg.msg_name = skp;
 		msg.msg_namelen = skp->sa_len;
 		msg.msg_iov = 

CVS commit: src/sys/compat

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 17:38:36 UTC 2017

Modified Files:
src/sys/compat/svr4: svr4_signal.c
src/sys/compat/svr4_32: svr4_32_signal.c

Log Message:
Fix indexing of svr4 signals.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.66 -r1.67 src/sys/compat/svr4/svr4_signal.c
cvs rdiff -u -r1.28 -r1.29 src/sys/compat/svr4_32/svr4_32_signal.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/svr4/svr4_signal.c
diff -u src/sys/compat/svr4/svr4_signal.c:1.66 src/sys/compat/svr4/svr4_signal.c:1.67
--- src/sys/compat/svr4/svr4_signal.c:1.66	Sun Nov  9 18:16:55 2014
+++ src/sys/compat/svr4/svr4_signal.c	Fri Jul 28 17:38:35 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: svr4_signal.c,v 1.66 2014/11/09 18:16:55 maxv Exp $	 */
+/*	$NetBSD: svr4_signal.c,v 1.67 2017/07/28 17:38:35 riastradh Exp $	 */
 
 /*-
  * Copyright (c) 1994, 1998 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: svr4_signal.c,v 1.66 2014/11/09 18:16:55 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: svr4_signal.c,v 1.67 2017/07/28 17:38:35 riastradh Exp $");
 
 #include 
 #include 
@@ -72,6 +72,21 @@ void native_to_svr4_sigaction(const stru
 extern const int native_to_svr4_signo[];
 extern const int svr4_to_native_signo[];
 
+static int
+svr4_decode_signum(int signum, int *native_signo, int *sigcall)
+{
+
+	if (SVR4_SIGNO(signum) >= SVR4_NSIG)
+		return EINVAL;
+
+	if (native_signo)
+		*native_signo = svr4_to_native_signo[SVR4_SIGNO(signum)];
+	if (sigcall)
+		*sigcall = SVR4_SIGCALL(signum);
+
+	return 0;
+}
+
 static inline void
 svr4_sigfillset(svr4_sigset_t *s)
 {
@@ -173,6 +188,7 @@ svr4_sys_sigaction(struct lwp *l, const 
 	} */
 	struct svr4_sigaction nssa, ossa;
 	struct sigaction nbsa, obsa;
+	int native_signo;
 	int error;
 
 	if (SCARG(uap, nsa)) {
@@ -181,7 +197,12 @@ svr4_sys_sigaction(struct lwp *l, const 
 			return (error);
 		svr4_to_native_sigaction(, );
 	}
-	error = sigaction1(l, svr4_to_native_signo[SVR4_SIGNO(SCARG(uap, signum))],
+
+	error = svr4_decode_signum(SCARG(uap, signum), _signo, NULL);
+	if (error)
+		return error;
+
+	error = sigaction1(l, native_signo,
 	SCARG(uap, nsa) ?  : 0, SCARG(uap, osa) ?  : 0,
 	NULL, 0);
 	if (error)
@@ -216,16 +237,18 @@ svr4_sys_signal(struct lwp *l, const str
 		syscallarg(int) signum;
 		syscallarg(svr4_sig_t) handler;
 	} */
-	int signum = svr4_to_native_signo[SVR4_SIGNO(SCARG(uap, signum))];
+	int native_signo, sigcall;
 	struct proc *p = l->l_proc;
 	struct sigaction nbsa, obsa;
 	sigset_t ss;
 	int error;
 
-	if (signum <= 0 || signum >= SVR4_NSIG)
-		return (EINVAL);
+	error = svr4_decode_signum(SCARG(uap, signum), _signo,
+	);
+	if (error)
+		return error;
 
-	switch (SVR4_SIGCALL(SCARG(uap, signum))) {
+	switch (sigcall) {
 	case SVR4_SIGDEFER_MASK:
 		if (SCARG(uap, handler) == SVR4_SIG_HOLD)
 			goto sighold;
@@ -235,7 +258,7 @@ svr4_sys_signal(struct lwp *l, const str
 		nbsa.sa_handler = (sig_t)SCARG(uap, handler);
 		sigemptyset(_mask);
 		nbsa.sa_flags = 0;
-		error = sigaction1(l, signum, , , NULL, 0);
+		error = sigaction1(l, native_signo, , , NULL, 0);
 		if (error)
 			return (error);
 		*retval = (u_int)(u_long)obsa.sa_handler;
@@ -244,7 +267,7 @@ svr4_sys_signal(struct lwp *l, const str
 	case SVR4_SIGHOLD_MASK:
 	sighold:
 		sigemptyset();
-		sigaddset(, signum);
+		sigaddset(, native_signo);
 		mutex_enter(p->p_lock);
 		error = sigprocmask1(l, SIG_BLOCK, , 0);
 		mutex_exit(p->p_lock);
@@ -252,7 +275,7 @@ svr4_sys_signal(struct lwp *l, const str
 
 	case SVR4_SIGRELSE_MASK:
 		sigemptyset();
-		sigaddset(, signum);
+		sigaddset(, native_signo);
 		mutex_enter(p->p_lock);
 		error = sigprocmask1(l, SIG_UNBLOCK, , 0);
 		mutex_exit(p->p_lock);
@@ -262,11 +285,11 @@ svr4_sys_signal(struct lwp *l, const str
 		nbsa.sa_handler = SIG_IGN;
 		sigemptyset(_mask);
 		nbsa.sa_flags = 0;
-		return (sigaction1(l, signum, , 0, NULL, 0));
+		return (sigaction1(l, native_signo, , 0, NULL, 0));
 
 	case SVR4_SIGPAUSE_MASK:
 		ss = l->l_sigmask;	/* XXXAD locking */
-		sigdelset(, signum);
+		sigdelset(, native_signo);
 		return (sigsuspend1(l, ));
 
 	default:
@@ -392,9 +415,15 @@ svr4_sys_kill(struct lwp *l, const struc
 		syscallarg(int) signum;
 	} */
 	struct sys_kill_args ka;
+	int native_signo;
+	int error;
+
+	error = svr4_decode_signum(SCARG(uap, signum), _signo, NULL);
+	if (error)
+		return error;
 
 	SCARG(, pid) = SCARG(uap, pid);
-	SCARG(, signum) = svr4_to_native_signo[SVR4_SIGNO(SCARG(uap, signum))];
+	SCARG(, signum) = native_signo;
 	return sys_kill(l, , retval);
 }
 

Index: src/sys/compat/svr4_32/svr4_32_signal.c
diff -u src/sys/compat/svr4_32/svr4_32_signal.c:1.28 src/sys/compat/svr4_32/svr4_32_signal.c:1.29
--- src/sys/compat/svr4_32/svr4_32_signal.c:1.28	Mon Apr  4 23:07:06 2016
+++ src/sys/compat/svr4_32/svr4_32_signal.c	Fri 

CVS commit: src/sys/compat

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 17:38:36 UTC 2017

Modified Files:
src/sys/compat/svr4: svr4_signal.c
src/sys/compat/svr4_32: svr4_32_signal.c

Log Message:
Fix indexing of svr4 signals.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.66 -r1.67 src/sys/compat/svr4/svr4_signal.c
cvs rdiff -u -r1.28 -r1.29 src/sys/compat/svr4_32/svr4_32_signal.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/opencrypto

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 17:14:04 UTC 2017

Modified Files:
src/sys/opencrypto: ocryptodev.c

Log Message:
Avoid another userland-controlled integer overflow.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.10 -r1.11 src/sys/opencrypto/ocryptodev.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/opencrypto/ocryptodev.c
diff -u src/sys/opencrypto/ocryptodev.c:1.10 src/sys/opencrypto/ocryptodev.c:1.11
--- src/sys/opencrypto/ocryptodev.c:1.10	Fri Jul 28 14:16:29 2017
+++ src/sys/opencrypto/ocryptodev.c	Fri Jul 28 17:14:04 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: ocryptodev.c,v 1.10 2017/07/28 14:16:29 riastradh Exp $ */
+/*	$NetBSD: ocryptodev.c,v 1.11 2017/07/28 17:14:04 riastradh Exp $ */
 /*	$FreeBSD: src/sys/opencrypto/cryptodev.c,v 1.4.2.4 2003/06/03 00:09:02 sam Exp $	*/
 /*	$OpenBSD: cryptodev.c,v 1.53 2002/07/10 22:21:30 mickey Exp $	*/
 
@@ -69,7 +69,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: ocryptodev.c,v 1.10 2017/07/28 14:16:29 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ocryptodev.c,v 1.11 2017/07/28 17:14:04 riastradh Exp $");
 
 #include 
 #include 
@@ -127,6 +127,11 @@ ocryptof_ioctl(struct file *fp, u_long c
 		break;
 	case CIOCNGSESSION:
 		osgop = (struct ocrypt_sgop *)data;
+		if ((osgop->count <= 0) ||
+		(SIZE_MAX/sizeof(struct osession_n_op) < osgop->count)) {
+			error = EINVAL;
+			break;
+		}
 		osnop = kmem_alloc((osgop->count *
   sizeof(struct osession_n_op)), KM_SLEEP);
 		error = copyin(osgop->sessions, osnop, osgop->count *

CVS commit: src/sys/opencrypto

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 17:14:04 UTC 2017

Modified Files:
src/sys/opencrypto: ocryptodev.c

Log Message:
Avoid another userland-controlled integer overflow.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.10 -r1.11 src/sys/opencrypto/ocryptodev.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Re: CVS commit: src/sys

[Taylor R Campbell]

> Date: Fri, 28 Jul 2017 17:59:23 +0200
> From: Manuel Bouyer 
> 
> On Fri, Jul 28, 2017 at 03:34:07PM +, Taylor R Campbell wrote:
> > Log Message:
> > Fail, don't panic, on bad dirents from file system.
> > 
> > Controllable via puffs from userland.
> 
> I hope the filesystem code itself would still panic on a corrupted
> filesystem ? On a server I want a panic on filesystem errors like this.

The change I made only affects compat syscalls.  I didn't touch any
logic inside any file systems.

If there is a problem in the file system and the compat syscall would
have panicked, then a native syscall would simply return garbage to
the user.  My change doesn't affect this.

(Not garbage in the sense of uninitialized memory necessarily, but
whatever garbage some file system bug or corrupted disk yielded.)

CVS commit: src/sys/compat/svr4

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 16:57:12 UTC 2017

Modified Files:
src/sys/compat/svr4: svr4_lwp.c

Log Message:
Zero stack data before copyout.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.19 -r1.20 src/sys/compat/svr4/svr4_lwp.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/svr4/svr4_lwp.c
diff -u src/sys/compat/svr4/svr4_lwp.c:1.19 src/sys/compat/svr4/svr4_lwp.c:1.20
--- src/sys/compat/svr4/svr4_lwp.c:1.19	Mon Nov 23 00:46:07 2009
+++ src/sys/compat/svr4/svr4_lwp.c	Fri Jul 28 16:57:12 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: svr4_lwp.c,v 1.19 2009/11/23 00:46:07 rmind Exp $	*/
+/*	$NetBSD: svr4_lwp.c,v 1.20 2017/07/28 16:57:12 riastradh Exp $	*/
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: svr4_lwp.c,v 1.19 2009/11/23 00:46:07 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: svr4_lwp.c,v 1.20 2017/07/28 16:57:12 riastradh Exp $");
 
 #include 
 #include 
@@ -108,6 +108,8 @@ svr4_sys__lwp_info(struct lwp *l, const 
 	struct svr4_lwpinfo lwpinfo;
 	int error;
 
+	memset(, 0, sizeof(lwpinfo));
+
 	/* XXX NJWLWP */
 	TIMEVAL_TO_TIMESPEC(>l_proc->p_stats->p_ru.ru_stime, _stime);
 	TIMEVAL_TO_TIMESPEC(>l_proc->p_stats->p_ru.ru_utime, _utime);

CVS commit: src/sys/compat/svr4

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 16:57:12 UTC 2017

Modified Files:
src/sys/compat/svr4: svr4_lwp.c

Log Message:
Zero stack data before copyout.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.19 -r1.20 src/sys/compat/svr4/svr4_lwp.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/compat/svr4

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 16:55:48 UTC 2017

Modified Files:
src/sys/compat/svr4: svr4_stream.c

Log Message:
Fix some of the multitudinous holes in svr4 streams.

We should never have enabled this by default; it is a minefield.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.88 -r1.89 src/sys/compat/svr4/svr4_stream.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/svr4/svr4_stream.c
diff -u src/sys/compat/svr4/svr4_stream.c:1.88 src/sys/compat/svr4/svr4_stream.c:1.89
--- src/sys/compat/svr4/svr4_stream.c:1.88	Wed Apr 26 03:02:48 2017
+++ src/sys/compat/svr4/svr4_stream.c	Fri Jul 28 16:55:48 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: svr4_stream.c,v 1.88 2017/04/26 03:02:48 riastradh Exp $	 */
+/*	$NetBSD: svr4_stream.c,v 1.89 2017/07/28 16:55:48 riastradh Exp $	 */
 
 /*-
  * Copyright (c) 1994, 2008 The NetBSD Foundation, Inc.
@@ -39,7 +39,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: svr4_stream.c,v 1.88 2017/04/26 03:02:48 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: svr4_stream.c,v 1.89 2017/07/28 16:55:48 riastradh Exp $");
 
 #include 
 #include 
@@ -527,7 +527,8 @@ si_listen(file_t *fp, int fd, struct svr
 	if (st == NULL)
 		return EINVAL;
 
-	if (ioc->len > sizeof(lst))
+	if (ioc->len < offsetof(struct svr4_strmcmd, pad) ||
+	ioc->len > sizeof(lst))
 		return EINVAL;
 
 	if ((error = copyin(NETBSD32PTR(ioc->buf), , ioc->len)) != 0)
@@ -717,7 +718,9 @@ ti_getinfo(file_t *fp, int fd, struct sv
 
 	memset(, 0, sizeof(info));
 
-	if (ioc->len > sizeof(info))
+	/* tsdu is next after cmd, the only field we read */
+	if (ioc->len < offsetof(struct svr4_infocmd, tsdu) ||
+	ioc->len > sizeof(info))
 		return EINVAL;
 
 	if ((error = copyin(NETBSD32PTR(ioc->buf), , ioc->len)) != 0)
@@ -763,7 +766,8 @@ ti_bind(file_t *fp, int fd, struct svr4_
 		return EINVAL;
 	}
 
-	if (ioc->len > sizeof(bnd))
+	if (ioc->len < offsetof(struct svr4_strmcmd, pad) ||
+	ioc->len > sizeof(bnd))
 		return EINVAL;
 
 	if ((error = copyin(NETBSD32PTR(ioc->buf), , ioc->len)) != 0)
@@ -773,6 +777,8 @@ ti_bind(file_t *fp, int fd, struct svr4_
 		DPRINTF(("ti_bind: bad request %ld\n", bnd.cmd));
 		return EINVAL;
 	}
+	if (bnd.offs < 0)
+		return EINVAL;
 
 	switch (st->s_family) {
 	case AF_INET:
@@ -782,6 +788,9 @@ ti_bind(file_t *fp, int fd, struct svr4_
 		if (bnd.offs == 0)
 			goto reply;
 
+		if (ioc->len < sizeof(struct svr4_netaddr_in) ||
+		bnd.offs > ioc->len - sizeof(struct svr4_netaddr_in))
+			return EINVAL;
 		netaddr_to_sockaddr_in(sain, );
 
 		DPRINTF(("TI_BIND: fam %d, port %d, addr %x\n",
@@ -795,6 +804,9 @@ ti_bind(file_t *fp, int fd, struct svr4_
 		if (bnd.offs == 0)
 			goto reply;
 
+		if (ioc->len < sizeof(struct svr4_netaddr_un) ||
+		bnd.offs > ioc->len - sizeof(struct svr4_netaddr_un))
+			return EINVAL;
 		netaddr_to_sockaddr_un(saun, );
 
 		if (saun->sun_path[0] == '\0')
@@ -1412,7 +1424,8 @@ svr4_sys_putmsg(struct lwp *l, const str
 		goto out;
 	}
 
-	if (ctl.len > sizeof(sc)) {
+	if (ctl.len < offsetof(struct svr4_strmcmd, pad) ||
+	ctl.len > sizeof(sc)) {
 		DPRINTF(("putmsg: Bad control size %ld != %d\n",
 		(unsigned long)sizeof(struct svr4_strmcmd), ctl.len));
 		error = EINVAL;
@@ -1421,6 +1434,10 @@ svr4_sys_putmsg(struct lwp *l, const str
 
 	if ((error = copyin(NETBSD32PTR(ctl.buf), , ctl.len)) != 0)
 		goto out;
+	if (sc.offs < 0) {
+		error = EINVAL;
+		goto out;
+	}
 
 	switch (st->s_family) {
 	case AF_INET:
@@ -1723,8 +1740,16 @@ svr4_sys_getmsg(struct lwp *l, const str
 		if (ctl.len > sizeof(sc))
 			ctl.len = sizeof(sc);
 
+		if (ctl.len < offsetof(struct svr4_strmcmd, pad)) {
+			error = EINVAL;
+			goto out;
+		}
 		if ((error = copyin(NETBSD32PTR(ctl.buf), , ctl.len)) != 0)
 			goto out;
+		if (sc.offs < 0) {
+			error = EINVAL;
+			goto out;
+		}
 
 		msg.msg_name = NULL;
 		msg.msg_namelen = 0;

CVS commit: src/sys/compat/svr4

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 16:55:48 UTC 2017

Modified Files:
src/sys/compat/svr4: svr4_stream.c

Log Message:
Fix some of the multitudinous holes in svr4 streams.

We should never have enabled this by default; it is a minefield.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.88 -r1.89 src/sys/compat/svr4/svr4_stream.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/dev

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 16:30:41 UTC 2017

Modified Files:
src/sys/dev: vnd.c

Log Message:
Appease toxic bullshit warning from gcc.

If you have a better way to write a useful bounds check that happens
to always pass on LP64 but doesn't always on LP32, without making it
fail to compile on LP64 or making it an #ifdef conditional on LP32,
please put it in here instead.


To generate a diff of this commit:
cvs rdiff -u -r1.261 -r1.262 src/sys/dev/vnd.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/vnd.c
diff -u src/sys/dev/vnd.c:1.261 src/sys/dev/vnd.c:1.262
--- src/sys/dev/vnd.c:1.261	Fri Jul 28 16:22:01 2017
+++ src/sys/dev/vnd.c	Fri Jul 28 16:30:41 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: vnd.c,v 1.261 2017/07/28 16:22:01 riastradh Exp $	*/
+/*	$NetBSD: vnd.c,v 1.262 2017/07/28 16:30:41 riastradh Exp $	*/
 
 /*-
  * Copyright (c) 1996, 1997, 1998, 2008 The NetBSD Foundation, Inc.
@@ -91,7 +91,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.261 2017/07/28 16:22:01 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.262 2017/07/28 16:30:41 riastradh Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_vnd.h"
@@ -1303,9 +1303,20 @@ vndioctl(dev_t dev, u_long cmd, void *da
 			}
 			KASSERT(0 < vnd->sc_comp_blksz);
 			KASSERT(0 < vnd->sc_comp_numoffs);
-			if ((SIZE_MAX/sizeof(uint64_t) <
-vnd->sc_comp_numoffs) ||
-			(vattr.va_size < sizeof(struct vnd_comp_header)) ||
+			/*
+			 * @#^@!$& gcc -Wtype-limits refuses to let me
+			 * write SIZE_MAX/sizeof(uint64_t) < numoffs,
+			 * because the range of the type on amd64 makes
+			 * the comparisons always false.
+			 */
+#if SIZE_MAX <= UINT32_MAX*(64/CHAR_BIT)
+			if (SIZE_MAX/sizeof(uint64_t) < vnd->sc_comp_numoffs) {
+VOP_UNLOCK(nd.ni_vp);
+error = EINVAL;
+goto close_and_exit;
+			}
+#endif
+			if ((vattr.va_size < sizeof(struct vnd_comp_header)) ||
 			(vattr.va_size - sizeof(struct vnd_comp_header) <
 sizeof(uint64_t)*vnd->sc_comp_numoffs) ||
 			(UQUAD_MAX/vnd->sc_comp_blksz <

CVS commit: src/sys/dev

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 16:30:41 UTC 2017

Modified Files:
src/sys/dev: vnd.c

Log Message:
Appease toxic bullshit warning from gcc.

If you have a better way to write a useful bounds check that happens
to always pass on LP64 but doesn't always on LP32, without making it
fail to compile on LP64 or making it an #ifdef conditional on LP32,
please put it in here instead.


To generate a diff of this commit:
cvs rdiff -u -r1.261 -r1.262 src/sys/dev/vnd.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/dev

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 16:22:01 UTC 2017

Modified Files:
src/sys/dev: vnd.c

Log Message:
Fix indentation.  u_intN_t -> uintN_t.  ntohl -> be32toh.

No functional change intended.


To generate a diff of this commit:
cvs rdiff -u -r1.260 -r1.261 src/sys/dev/vnd.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/vnd.c
diff -u src/sys/dev/vnd.c:1.260 src/sys/dev/vnd.c:1.261
--- src/sys/dev/vnd.c:1.260	Fri Jul 28 16:19:20 2017
+++ src/sys/dev/vnd.c	Fri Jul 28 16:22:01 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: vnd.c,v 1.260 2017/07/28 16:19:20 riastradh Exp $	*/
+/*	$NetBSD: vnd.c,v 1.261 2017/07/28 16:22:01 riastradh Exp $	*/
 
 /*-
  * Copyright (c) 1996, 1997, 1998, 2008 The NetBSD Foundation, Inc.
@@ -91,7 +91,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.260 2017/07/28 16:19:20 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.261 2017/07/28 16:22:01 riastradh Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_vnd.h"
@@ -1267,34 +1267,34 @@ vndioctl(dev_t dev, u_long cmd, void *da
 #ifdef VND_COMPRESSION
 			struct vnd_comp_header *ch;
 			int i;
-			u_int32_t comp_size;
-			u_int32_t comp_maxsize;
+			uint32_t comp_size;
+			uint32_t comp_maxsize;
 
 			/* allocate space for compresed file header */
 			ch = malloc(sizeof(struct vnd_comp_header),
-			M_TEMP, M_WAITOK);
+			M_TEMP, M_WAITOK);
 
 			/* read compressed file header */
 			error = vn_rdwr(UIO_READ, nd.ni_vp, (void *)ch,
-			  sizeof(struct vnd_comp_header), 0, UIO_SYSSPACE,
-			  IO_UNIT|IO_NODELOCKED, l->l_cred, NULL, NULL);
+			sizeof(struct vnd_comp_header), 0, UIO_SYSSPACE,
+			IO_UNIT|IO_NODELOCKED, l->l_cred, NULL, NULL);
 			if (error) {
 free(ch, M_TEMP);
 VOP_UNLOCK(nd.ni_vp);
 goto close_and_exit;
 			}
 
-			if (ntohl(ch->block_size) == 0 ||
-			ntohl(ch->num_blocks) > UINT32_MAX - 1) {
+			if (be32toh(ch->block_size) == 0 ||
+			be32toh(ch->num_blocks) > UINT32_MAX - 1) {
 free(ch, M_TEMP);
 VOP_UNLOCK(nd.ni_vp);
 goto close_and_exit;
 			}
 
 			/* save some header info */
-			vnd->sc_comp_blksz = ntohl(ch->block_size);
+			vnd->sc_comp_blksz = be32toh(ch->block_size);
 			/* note last offset is the file byte size */
-			vnd->sc_comp_numoffs = ntohl(ch->num_blocks)+1;
+			vnd->sc_comp_numoffs = be32toh(ch->num_blocks) + 1;
 			free(ch, M_TEMP);
 			if (!DK_DEV_BSIZE_OK(vnd->sc_comp_blksz)) {
 VOP_UNLOCK(nd.ni_vp);
@@ -1325,14 +1325,14 @@ vndioctl(dev_t dev, u_long cmd, void *da
 			/* allocate space for all the compressed offsets */
 			__CTASSERT(UINT32_MAX <= UQUAD_MAX/sizeof(uint64_t));
 			vnd->sc_comp_offsets =
-			malloc(sizeof(u_int64_t) * vnd->sc_comp_numoffs,
-			M_DEVBUF, M_WAITOK);
+			malloc(sizeof(uint64_t) * vnd->sc_comp_numoffs,
+M_DEVBUF, M_WAITOK);
 
 			/* read in the offsets */
 			error = vn_rdwr(UIO_READ, nd.ni_vp,
-			  (void *)vnd->sc_comp_offsets,
-			  sizeof(u_int64_t) * vnd->sc_comp_numoffs,
-			  sizeof(struct vnd_comp_header), UIO_SYSSPACE,
+			(void *)vnd->sc_comp_offsets,
+			sizeof(uint64_t) * vnd->sc_comp_numoffs,
+			sizeof(struct vnd_comp_header), UIO_SYSSPACE,
 			  IO_UNIT|IO_NODELOCKED, l->l_cred, NULL, NULL);
 			if (error) {
 VOP_UNLOCK(nd.ni_vp);
@@ -1345,22 +1345,24 @@ vndioctl(dev_t dev, u_long cmd, void *da
 			comp_maxsize = 0;
 			for (i = 0; i < vnd->sc_comp_numoffs - 1; i++) {
 vnd->sc_comp_offsets[i] =
-  be64toh(vnd->sc_comp_offsets[i]);
-comp_size = be64toh(vnd->sc_comp_offsets[i + 1])
-  - vnd->sc_comp_offsets[i];
+be64toh(vnd->sc_comp_offsets[i]);
+comp_size =
+be64toh(vnd->sc_comp_offsets[i + 1])
+- vnd->sc_comp_offsets[i];
 if (comp_size > comp_maxsize)
 	comp_maxsize = comp_size;
 			}
 			vnd->sc_comp_offsets[vnd->sc_comp_numoffs - 1] =
-			  be64toh(vnd->sc_comp_offsets[vnd->sc_comp_numoffs - 1]);
+			be64toh(vnd->sc_comp_offsets[vnd->sc_comp_numoffs
+- 1]);
 
 			/* create compressed data buffer */
 			vnd->sc_comp_buff = malloc(comp_maxsize,
-			  M_DEVBUF, M_WAITOK);
+			M_DEVBUF, M_WAITOK);
 
 			/* create decompressed buffer */
 			vnd->sc_comp_decombuf = malloc(vnd->sc_comp_blksz,
-			  M_DEVBUF, M_WAITOK);
+			M_DEVBUF, M_WAITOK);
 			vnd->sc_comp_buffblk = -1;
 
 			/* Initialize decompress stream */
@@ -1371,7 +1373,7 @@ vndioctl(dev_t dev, u_long cmd, void *da
 			if (error) {
 if (vnd->sc_comp_stream.msg)
 	printf("vnd%d: compressed file, %s\n",
-	  unit, vnd->sc_comp_stream.msg);
+	unit, vnd->sc_comp_stream.msg);
 VOP_UNLOCK(nd.ni_vp);
 error = EINVAL;
 goto close_and_exit;

CVS commit: src/sys/dev

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 16:22:01 UTC 2017

Modified Files:
src/sys/dev: vnd.c

Log Message:
Fix indentation.  u_intN_t -> uintN_t.  ntohl -> be32toh.

No functional change intended.


To generate a diff of this commit:
cvs rdiff -u -r1.260 -r1.261 src/sys/dev/vnd.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/dev

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 16:19:20 UTC 2017

Modified Files:
src/sys/dev: vnd.c

Log Message:
Put in a litany of judicious bounds checks around vnd headers.

Thought I was done with this crap after I rewrote vndcompress(1)!

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.259 -r1.260 src/sys/dev/vnd.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/vnd.c
diff -u src/sys/dev/vnd.c:1.259 src/sys/dev/vnd.c:1.260
--- src/sys/dev/vnd.c:1.259	Sat Mar 25 07:00:33 2017
+++ src/sys/dev/vnd.c	Fri Jul 28 16:19:20 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: vnd.c,v 1.259 2017/03/25 07:00:33 pgoyette Exp $	*/
+/*	$NetBSD: vnd.c,v 1.260 2017/07/28 16:19:20 riastradh Exp $	*/
 
 /*-
  * Copyright (c) 1996, 1997, 1998, 2008 The NetBSD Foundation, Inc.
@@ -91,7 +91,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.259 2017/03/25 07:00:33 pgoyette Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.260 2017/07/28 16:19:20 riastradh Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_vnd.h"
@@ -1284,6 +1284,13 @@ vndioctl(dev_t dev, u_long cmd, void *da
 goto close_and_exit;
 			}
 
+			if (ntohl(ch->block_size) == 0 ||
+			ntohl(ch->num_blocks) > UINT32_MAX - 1) {
+free(ch, M_TEMP);
+VOP_UNLOCK(nd.ni_vp);
+goto close_and_exit;
+			}
+
 			/* save some header info */
 			vnd->sc_comp_blksz = ntohl(ch->block_size);
 			/* note last offset is the file byte size */
@@ -1294,20 +1301,29 @@ vndioctl(dev_t dev, u_long cmd, void *da
 error = EINVAL;
 goto close_and_exit;
 			}
-			if (sizeof(struct vnd_comp_header) +
-			  sizeof(u_int64_t) * vnd->sc_comp_numoffs >
-			  vattr.va_size) {
+			KASSERT(0 < vnd->sc_comp_blksz);
+			KASSERT(0 < vnd->sc_comp_numoffs);
+			if ((SIZE_MAX/sizeof(uint64_t) <
+vnd->sc_comp_numoffs) ||
+			(vattr.va_size < sizeof(struct vnd_comp_header)) ||
+			(vattr.va_size - sizeof(struct vnd_comp_header) <
+sizeof(uint64_t)*vnd->sc_comp_numoffs) ||
+			(UQUAD_MAX/vnd->sc_comp_blksz <
+vnd->sc_comp_numoffs - 1)) {
 VOP_UNLOCK(nd.ni_vp);
 error = EINVAL;
 goto close_and_exit;
 			}
 
 			/* set decompressed file size */
+			KASSERT(vnd->sc_comp_numoffs - 1 <=
+			UQUAD_MAX/vnd->sc_comp_blksz);
 			vattr.va_size =
 			((u_quad_t)vnd->sc_comp_numoffs - 1) *
 			 (u_quad_t)vnd->sc_comp_blksz;
 
 			/* allocate space for all the compressed offsets */
+			__CTASSERT(UINT32_MAX <= UQUAD_MAX/sizeof(uint64_t));
 			vnd->sc_comp_offsets =
 			malloc(sizeof(u_int64_t) * vnd->sc_comp_numoffs,
 			M_DEVBUF, M_WAITOK);

CVS commit: src/sys/dev

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 16:19:20 UTC 2017

Modified Files:
src/sys/dev: vnd.c

Log Message:
Put in a litany of judicious bounds checks around vnd headers.

Thought I was done with this crap after I rewrote vndcompress(1)!

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.259 -r1.260 src/sys/dev/vnd.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/share/man/man4/man4.pmax

[Thomas Klausner]

Module Name:src
Committed By:   wiz
Date:   Fri Jul 28 16:11:03 UTC 2017

Modified Files:
src/share/man/man4/man4.pmax: intro.4

Log Message:
New sentence, new line.


To generate a diff of this commit:
cvs rdiff -u -r1.21 -r1.22 src/share/man/man4/man4.pmax/intro.4

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/share/man/man4/man4.pmax/intro.4
diff -u src/share/man/man4/man4.pmax/intro.4:1.21 src/share/man/man4/man4.pmax/intro.4:1.22
--- src/share/man/man4/man4.pmax/intro.4:1.21	Fri Jul 28 15:58:24 2017
+++ src/share/man/man4/man4.pmax/intro.4	Fri Jul 28 16:11:03 2017
@@ -27,7 +27,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\"	$NetBSD: intro.4,v 1.21 2017/07/28 15:58:24 flxd Exp $
+.\"	$NetBSD: intro.4,v 1.22 2017/07/28 16:11:03 wiz Exp $
 .\"
 .Dd July 28, 2017
 .Dt INTRO 4 pmax
@@ -94,7 +94,8 @@ The following systems are supported:
 .Pp
 .Bl -tag -width speaker -offset indent -compact
 .It DECstation 2100 and 3100
-also known as "PMIN" and "PMAX". The 2100 and 3100 differ only in CPU clock
+also known as "PMIN" and "PMAX".
+The 2100 and 3100 differ only in CPU clock
 speed.
 .It DECsystem 5100
 also known as "MIPSMATE".

CVS commit: src/share/man/man4/man4.pmax

[Thomas Klausner]

Module Name:src
Committed By:   wiz
Date:   Fri Jul 28 16:11:03 UTC 2017

Modified Files:
src/share/man/man4/man4.pmax: intro.4

Log Message:
New sentence, new line.


To generate a diff of this commit:
cvs rdiff -u -r1.21 -r1.22 src/share/man/man4/man4.pmax/intro.4

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/arch/amd64/conf

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Fri Jul 28 16:10:29 UTC 2017

Modified Files:
src/sys/arch/amd64/conf: GENERIC XEN3_DOM0 XEN3_DOMU

Log Message:
After a careful review, and all things considered, disable compat43 by
default on amd64. The use case is limited, the potential for damage too
high, and it is safer to run a BSD4.3 binary on i386 since the kernel does
not have to go through netbsd32 - which may not correctly reproduce i386.


To generate a diff of this commit:
cvs rdiff -u -r1.461 -r1.462 src/sys/arch/amd64/conf/GENERIC
cvs rdiff -u -r1.136 -r1.137 src/sys/arch/amd64/conf/XEN3_DOM0
cvs rdiff -u -r1.75 -r1.76 src/sys/arch/amd64/conf/XEN3_DOMU

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/arch/amd64/conf

[Maxime Villard]

Module Name:src
Committed By:   maxv
Date:   Fri Jul 28 16:10:29 UTC 2017

Modified Files:
src/sys/arch/amd64/conf: GENERIC XEN3_DOM0 XEN3_DOMU

Log Message:
After a careful review, and all things considered, disable compat43 by
default on amd64. The use case is limited, the potential for damage too
high, and it is safer to run a BSD4.3 binary on i386 since the kernel does
not have to go through netbsd32 - which may not correctly reproduce i386.


To generate a diff of this commit:
cvs rdiff -u -r1.461 -r1.462 src/sys/arch/amd64/conf/GENERIC
cvs rdiff -u -r1.136 -r1.137 src/sys/arch/amd64/conf/XEN3_DOM0
cvs rdiff -u -r1.75 -r1.76 src/sys/arch/amd64/conf/XEN3_DOMU

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/arch/amd64/conf/GENERIC
diff -u src/sys/arch/amd64/conf/GENERIC:1.461 src/sys/arch/amd64/conf/GENERIC:1.462
--- src/sys/arch/amd64/conf/GENERIC:1.461	Sat Jul 22 13:03:54 2017
+++ src/sys/arch/amd64/conf/GENERIC	Fri Jul 28 16:10:28 2017
@@ -1,4 +1,4 @@
-# $NetBSD: GENERIC,v 1.461 2017/07/22 13:03:54 maxv Exp $
+# $NetBSD: GENERIC,v 1.462 2017/07/28 16:10:28 maxv Exp $
 #
 # GENERIC machine description file
 #
@@ -22,7 +22,7 @@ include 	"arch/amd64/conf/std.amd64"
 
 options 	INCLUDE_CONFIG_FILE	# embed config file in kernel binary
 
-#ident		"GENERIC-$Revision: 1.461 $"
+#ident		"GENERIC-$Revision: 1.462 $"
 
 maxusers	64		# estimated number of users
 
@@ -132,7 +132,7 @@ options 	COMPAT_40	# NetBSD 4.0,
 options 	COMPAT_50	# NetBSD 5.0,
 options 	COMPAT_60	# NetBSD 6.0, and
 options 	COMPAT_70	# NetBSD 7.0 binary compatibility.
-options 	COMPAT_43	# and 4.3BSD
+#options 	COMPAT_43	# and 4.3BSD
 #options 	COMPAT_386BSD_MBRPART # recognize old partition ID
 
 options 	COMPAT_OSSAUDIO

Index: src/sys/arch/amd64/conf/XEN3_DOM0
diff -u src/sys/arch/amd64/conf/XEN3_DOM0:1.136 src/sys/arch/amd64/conf/XEN3_DOM0:1.137
--- src/sys/arch/amd64/conf/XEN3_DOM0:1.136	Thu Jun 22 18:14:32 2017
+++ src/sys/arch/amd64/conf/XEN3_DOM0	Fri Jul 28 16:10:28 2017
@@ -1,4 +1,4 @@
-# $NetBSD: XEN3_DOM0,v 1.136 2017/06/22 18:14:32 khorben Exp $
+# $NetBSD: XEN3_DOM0,v 1.137 2017/07/28 16:10:28 maxv Exp $
 
 include 	"arch/amd64/conf/std.xen"
 
@@ -62,7 +62,7 @@ makeoptions	COPTS="-O2 -fno-omit-frame-p
 options DDB_COMMANDONENTER="trace;show registers"
 
 # Compatibility options
-options 	COMPAT_43	# 4.3BSD binary compatibility.
+#options 	COMPAT_43	# 4.3BSD binary compatibility.
 options 	COMPAT_15	# NetBSD 1.5,
 options 	COMPAT_16	# NetBSD 1.6,
 options 	COMPAT_20	# NetBSD 2.0,

Index: src/sys/arch/amd64/conf/XEN3_DOMU
diff -u src/sys/arch/amd64/conf/XEN3_DOMU:1.75 src/sys/arch/amd64/conf/XEN3_DOMU:1.76
--- src/sys/arch/amd64/conf/XEN3_DOMU:1.75	Sun May 21 06:19:37 2017
+++ src/sys/arch/amd64/conf/XEN3_DOMU	Fri Jul 28 16:10:28 2017
@@ -1,4 +1,4 @@
-# $NetBSD: XEN3_DOMU,v 1.75 2017/05/21 06:19:37 pgoyette Exp $
+# $NetBSD: XEN3_DOMU,v 1.76 2017/07/28 16:10:28 maxv Exp $
 
 include 	"arch/amd64/conf/std.xen"
 
@@ -54,7 +54,7 @@ makeoptions	COPTS="-O2 -fno-omit-frame-p
 options DDB_COMMANDONENTER="trace;show registers"
 
 # Compatibility options
-options 	COMPAT_43	# 4.3BSD binary compatibility.
+#options 	COMPAT_43	# 4.3BSD binary compatibility.
 options 	COMPAT_15	# NetBSD 1.5,
 options 	COMPAT_16	# NetBSD 1.6,
 options 	COMPAT_20	# NetBSD 2.0,
@@ -251,4 +251,3 @@ pseudo-device	nsmb			# experimental - SM
 
 # userland interface to drivers, including autoconf and properties retrieval
 pseudo-device	drvctl
-

Re: CVS commit: src/sys

[Manuel Bouyer]

On Fri, Jul 28, 2017 at 03:34:07PM +, Taylor R Campbell wrote:
> Log Message:
> Fail, don't panic, on bad dirents from file system.
> 
> Controllable via puffs from userland.

I hope the filesystem code itself would still panic on a corrupted
filesystem ? On a server I want a panic on filesystem errors like this.

-- 
Manuel Bouyer 
 NetBSD: 26 ans d'experience feront toujours la difference
--

CVS commit: src/share/man/man4/man4.pmax

[Felix Deichmann]

Module Name:src
Committed By:   flxd
Date:   Fri Jul 28 15:58:24 UTC 2017

Modified Files:
src/share/man/man4/man4.pmax: intro.4 sii.4

Log Message:
* sii(4) was never used in VAXstation 3100 (uses si(4) and is NCR-based).
* Reference scsi(4) in sii(4).
* Add more machines to pmax/intro(4).
* Small fixes.


To generate a diff of this commit:
cvs rdiff -u -r1.20 -r1.21 src/share/man/man4/man4.pmax/intro.4
cvs rdiff -u -r1.13 -r1.14 src/share/man/man4/man4.pmax/sii.4

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/share/man/man4/man4.pmax/intro.4
diff -u src/share/man/man4/man4.pmax/intro.4:1.20 src/share/man/man4/man4.pmax/intro.4:1.21
--- src/share/man/man4/man4.pmax/intro.4:1.20	Tue Jul 25 08:30:45 2017
+++ src/share/man/man4/man4.pmax/intro.4	Fri Jul 28 15:58:24 2017
@@ -27,9 +27,9 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\"	$NetBSD: intro.4,v 1.20 2017/07/25 08:30:45 wiz Exp $
+.\"	$NetBSD: intro.4,v 1.21 2017/07/28 15:58:24 flxd Exp $
 .\"
-.Dd February 17, 2017
+.Dd July 28, 2017
 .Dt INTRO 4 pmax
 .Os
 .Sh NAME
@@ -94,7 +94,8 @@ The following systems are supported:
 .Pp
 .Bl -tag -width speaker -offset indent -compact
 .It DECstation 2100 and 3100
-also known as "pmax". The 2100 and 3100 differ only in CPU clock speed.
+also known as "PMIN" and "PMAX". The 2100 and 3100 differ only in CPU clock
+speed.
 .It DECsystem 5100
 also known as "MIPSMATE".
 .It DECstation 5000/200
@@ -107,9 +108,9 @@ The 5000/1xx comes in 20 MHz, 25 MHz, an
 numbered appropriately.
 Two 12.5 MHz
 TURBOchannel slots are provided.
-.It DECstation 5000/2x
+.It DECstation 5000/xx
 also known as "Personal DECstation" or "MAXINE".
-The 5000/xx comes in 20 MHz and 25 MHz variants.
+The 5000/xx comes in 20 MHz, 25 MHz, and 33 MHz variants.
 A baseboard 1024x786 framebuffer, and two 12.5 MHz TURBOchannel slots
 are provided.
 .It DECstation 5000/240 and DECsystem 5900
@@ -137,7 +138,7 @@ baseboard or PMAZ-AA SCSI option card.
 baseboard audio on 5000/xx systems.
 .It dz
 serial driver for DEC custom four-port serial device (dc7085 DZ-11 clone)
-on the baseboard of DECstation 2100/31000, 5100, and 5000/200 systems.
+on the baseboard of DECstation 2100/3100, 5100, and 5000/200 systems.
 .It zsc
 serial driver for Zilog SCC asynchronous/synchronous devices on the
 baseboard of DECstation 5000-series systems (excluding 5000/200).
@@ -152,7 +153,7 @@ if support for baseboard devices or the 
 Pseudo-device driver supporting glass-tty console emulation on DEC
 framebuffers, DEC mice, and LK-201 family keyboards.
 .It sii
-DEC custom SCSI adaptor on DECstation 2100, 3100, 5100, and VAXstation 3100.
+DEC custom SCSI adaptor on DECstation 2100, 3100, and 5100.
 .It pm
 DECstation 2100/3100 baseboard framebuffer
 .It tc

Index: src/share/man/man4/man4.pmax/sii.4
diff -u src/share/man/man4/man4.pmax/sii.4:1.13 src/share/man/man4/man4.pmax/sii.4:1.14
--- src/share/man/man4/man4.pmax/sii.4:1.13	Tue Jul 25 03:51:41 2017
+++ src/share/man/man4/man4.pmax/sii.4	Fri Jul 28 15:58:24 2017
@@ -27,9 +27,9 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\"	$NetBSD: sii.4,v 1.13 2017/07/25 03:51:41 ryoon Exp $
+.\"	$NetBSD: sii.4,v 1.14 2017/07/28 15:58:24 flxd Exp $
 .\"
-.Dd February 17, 2017
+.Dd July 28, 2017
 .Dt SII 4 pmax
 .Os
 .Sh NAME
@@ -45,7 +45,7 @@ The
 driver provides support for the
 .Tn DEC
 SII SCSI adaptor ASIC used in
-the DECstation 2100, 3100, and 5100, and in the VAXstation 3100.
+the DECstation 2100, 3100, and 5100.
 .Pp
 The
 .Nm
@@ -65,6 +65,7 @@ to and from the DMA region.
 .Xr ch 4 ,
 .Xr pmax/ibus 4 ,
 .Xr pmax/intro 4 ,
+.Xr scsi 4 ,
 .Xr sd 4 ,
 .Xr st 4
 .Sh HISTORY

CVS commit: src/share/man/man4/man4.pmax

[Felix Deichmann]

Module Name:src
Committed By:   flxd
Date:   Fri Jul 28 15:58:24 UTC 2017

Modified Files:
src/share/man/man4/man4.pmax: intro.4 sii.4

Log Message:
* sii(4) was never used in VAXstation 3100 (uses si(4) and is NCR-based).
* Reference scsi(4) in sii(4).
* Add more machines to pmax/intro(4).
* Small fixes.


To generate a diff of this commit:
cvs rdiff -u -r1.20 -r1.21 src/share/man/man4/man4.pmax/intro.4
cvs rdiff -u -r1.13 -r1.14 src/share/man/man4/man4.pmax/sii.4

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/dev

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 15:52:53 UTC 2017

Modified Files:
src/sys/dev: vndvar.h

Log Message:
Tweak whitespace to make this definition more greppable.


To generate a diff of this commit:
cvs rdiff -u -r1.35 -r1.36 src/sys/dev/vndvar.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/dev/vndvar.h
diff -u src/sys/dev/vndvar.h:1.35 src/sys/dev/vndvar.h:1.36
--- src/sys/dev/vndvar.h:1.35	Sun Sep  6 06:00:59 2015
+++ src/sys/dev/vndvar.h	Fri Jul 28 15:52:53 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: vndvar.h,v 1.35 2015/09/06 06:00:59 dholland Exp $	*/
+/*	$NetBSD: vndvar.h,v 1.36 2017/07/28 15:52:53 riastradh Exp $	*/
 
 /*-
  * Copyright (c) 1996, 1997, 1998 The NetBSD Foundation, Inc.
@@ -147,8 +147,7 @@ struct vnd_softc {
 #define VNF_USE_VN_RDWR	0x1000	/* have to use vn_rdwr() */
 
 /* structure of header in a compressed file */
-struct vnd_comp_header
-{
+struct vnd_comp_header {
 	char preamble[128];
 	u_int32_t block_size;
 	u_int32_t num_blocks;

CVS commit: src/sys/dev

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 15:52:53 UTC 2017

Modified Files:
src/sys/dev: vndvar.h

Log Message:
Tweak whitespace to make this definition more greppable.


To generate a diff of this commit:
cvs rdiff -u -r1.35 -r1.36 src/sys/dev/vndvar.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/compat/ibcs2

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 15:51:35 UTC 2017

Modified Files:
src/sys/compat/ibcs2: ibcs2_exec_coff.c

Log Message:
Make sure we move forward over the buffer.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.28 -r1.29 src/sys/compat/ibcs2/ibcs2_exec_coff.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/compat/ibcs2

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 15:51:35 UTC 2017

Modified Files:
src/sys/compat/ibcs2: ibcs2_exec_coff.c

Log Message:
Make sure we move forward over the buffer.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.28 -r1.29 src/sys/compat/ibcs2/ibcs2_exec_coff.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/ibcs2/ibcs2_exec_coff.c
diff -u src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.28 src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.29
--- src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.28	Fri Jul 28 15:50:04 2017
+++ src/sys/compat/ibcs2/ibcs2_exec_coff.c	Fri Jul 28 15:51:35 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: ibcs2_exec_coff.c,v 1.28 2017/07/28 15:50:04 riastradh Exp $	*/
+/*	$NetBSD: ibcs2_exec_coff.c,v 1.29 2017/07/28 15:51:35 riastradh Exp $	*/
 
 /*
  * Copyright (c) 1994, 1995, 1998 Scott Bartram
@@ -35,7 +35,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.28 2017/07/28 15:50:04 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.29 2017/07/28 15:51:35 riastradh Exp $");
 
 #include 
 #include 
@@ -469,7 +469,8 @@ exec_ibcs2_coff_prep_zmagic(struct lwp *
 			/* path_index = slhdr->path_index * sizeof(long); */
 			entry_len = slhdr->entry_len * sizeof(long);
 
-			if (entry_len > len ||
+			if (entry_len < sizeof(struct coff_slhdr) ||
+			entry_len > len ||
 			strnlen(slhdr->sl_name, entry_len) == entry_len) {
 free(tbuf, M_TEMP);
 return ENOEXEC;

CVS commit: src/sys/compat/ibcs2

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 15:50:04 UTC 2017

Modified Files:
src/sys/compat/ibcs2: ibcs2_exec_coff.c

Log Message:
Make sure we have enough space in the buffer before reading it.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.27 -r1.28 src/sys/compat/ibcs2/ibcs2_exec_coff.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/ibcs2/ibcs2_exec_coff.c
diff -u src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.27 src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.28
--- src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.27	Fri Jul 28 15:47:23 2017
+++ src/sys/compat/ibcs2/ibcs2_exec_coff.c	Fri Jul 28 15:50:04 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: ibcs2_exec_coff.c,v 1.27 2017/07/28 15:47:23 riastradh Exp $	*/
+/*	$NetBSD: ibcs2_exec_coff.c,v 1.28 2017/07/28 15:50:04 riastradh Exp $	*/
 
 /*
  * Copyright (c) 1994, 1995, 1998 Scott Bartram
@@ -35,7 +35,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.27 2017/07/28 15:47:23 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.28 2017/07/28 15:50:04 riastradh Exp $");
 
 #include 
 #include 
@@ -454,6 +454,10 @@ exec_ibcs2_coff_prep_zmagic(struct lwp *
 		}
 		bufp = tbuf;
 		while (len) {
+			if (len < sizeof(struct coff_slhdr)) {
+free(tbuf, M_TEMP);
+return ENOEXEC;
+			}
 			slhdr = (struct coff_slhdr *)bufp;
 
 			if (slhdr->path_index > LONG_MAX / sizeof(long) ||

CVS commit: src/sys/compat/ibcs2

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 15:50:04 UTC 2017

Modified Files:
src/sys/compat/ibcs2: ibcs2_exec_coff.c

Log Message:
Make sure we have enough space in the buffer before reading it.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.27 -r1.28 src/sys/compat/ibcs2/ibcs2_exec_coff.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/compat/ibcs2

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 15:47:23 UTC 2017

Modified Files:
src/sys/compat/ibcs2: ibcs2_exec_coff.c

Log Message:
Check for NUL termination within the buffer we have.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.26 -r1.27 src/sys/compat/ibcs2/ibcs2_exec_coff.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/ibcs2/ibcs2_exec_coff.c
diff -u src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.26 src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.27
--- src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.26	Fri Oct 25 14:46:35 2013
+++ src/sys/compat/ibcs2/ibcs2_exec_coff.c	Fri Jul 28 15:47:23 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: ibcs2_exec_coff.c,v 1.26 2013/10/25 14:46:35 martin Exp $	*/
+/*	$NetBSD: ibcs2_exec_coff.c,v 1.27 2017/07/28 15:47:23 riastradh Exp $	*/
 
 /*
  * Copyright (c) 1994, 1995, 1998 Scott Bartram
@@ -35,7 +35,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.26 2013/10/25 14:46:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.27 2017/07/28 15:47:23 riastradh Exp $");
 
 #include 
 #include 
@@ -465,7 +465,8 @@ exec_ibcs2_coff_prep_zmagic(struct lwp *
 			/* path_index = slhdr->path_index * sizeof(long); */
 			entry_len = slhdr->entry_len * sizeof(long);
 
-			if (entry_len > len) {
+			if (entry_len > len ||
+			strnlen(slhdr->sl_name, entry_len) == entry_len) {
 free(tbuf, M_TEMP);
 return ENOEXEC;
 			}

CVS commit: src/sys/compat/ibcs2

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 15:47:23 UTC 2017

Modified Files:
src/sys/compat/ibcs2: ibcs2_exec_coff.c

Log Message:
Check for NUL termination within the buffer we have.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.26 -r1.27 src/sys/compat/ibcs2/ibcs2_exec_coff.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/arch/amd64/conf

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 15:40:38 UTC 2017

Modified Files:
src/sys/arch/amd64/conf: ALL

Log Message:
Add some more bogus compat options to amd64/ALL for compile-testing.


To generate a diff of this commit:
cvs rdiff -u -r1.60 -r1.61 src/sys/arch/amd64/conf/ALL

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys/arch/amd64/conf

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 15:40:38 UTC 2017

Modified Files:
src/sys/arch/amd64/conf: ALL

Log Message:
Add some more bogus compat options to amd64/ALL for compile-testing.


To generate a diff of this commit:
cvs rdiff -u -r1.60 -r1.61 src/sys/arch/amd64/conf/ALL

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/arch/amd64/conf/ALL
diff -u src/sys/arch/amd64/conf/ALL:1.60 src/sys/arch/amd64/conf/ALL:1.61
--- src/sys/arch/amd64/conf/ALL:1.60	Wed Jun 14 09:00:07 2017
+++ src/sys/arch/amd64/conf/ALL	Fri Jul 28 15:40:38 2017
@@ -1,4 +1,4 @@
-# $NetBSD: ALL,v 1.60 2017/06/14 09:00:07 pgoyette Exp $
+# $NetBSD: ALL,v 1.61 2017/07/28 15:40:38 riastradh Exp $
 # From NetBSD: GENERIC,v 1.787 2006/10/01 18:37:54 bouyer Exp
 #
 # ALL machine description file
@@ -17,7 +17,7 @@ include 	"arch/amd64/conf/std.amd64"
 
 options 	INCLUDE_CONFIG_FILE	# embed config file in kernel binary
 
-#ident		"ALL-$Revision: 1.60 $"
+#ident		"ALL-$Revision: 1.61 $"
 
 maxusers	64		# estimated number of users
 
@@ -160,6 +160,11 @@ options 	COMPAT_IBCS2	# binary compatibi
 options 	COMPAT_FREEBSD	# binary compatibility with FreeBSD
 options 	COMPAT_NDIS	# NDIS network driver
 options 	COMPAT_BSDPTY	# /dev/[pt]ty?? ptys.
+options 	COMPAT_OSF1	# OSF1 binary compatibility
+#options 	COMPAT_SVR4	# SVR4 binary compatibility (no amd64)
+#options 	COMPAT_SVR4_32	# SVR4 32-bit binary compatibility (no amd64)
+options 	COMPAT_ULTRIX	# DEC Ultrix binary compatibility
+options 	COMPAT_SUNOS	# SunOS 4.x binary compatibility
 
 # Wedge support
 options 	DKWEDGE_AUTODISCOVER	# Automatically add dk(4) instances

CVS commit: src/sys/kern

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 15:37:23 UTC 2017

Modified Files:
src/sys/kern: vfs_getcwd.c

Log Message:
Don't walk off the end of the dirent buffer.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.51 -r1.52 src/sys/kern/vfs_getcwd.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/kern/vfs_getcwd.c
diff -u src/sys/kern/vfs_getcwd.c:1.51 src/sys/kern/vfs_getcwd.c:1.52
--- src/sys/kern/vfs_getcwd.c:1.51	Thu Jun  1 02:45:13 2017
+++ src/sys/kern/vfs_getcwd.c	Fri Jul 28 15:37:23 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: vfs_getcwd.c,v 1.51 2017/06/01 02:45:13 chs Exp $ */
+/* $NetBSD: vfs_getcwd.c,v 1.52 2017/07/28 15:37:23 riastradh Exp $ */
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: vfs_getcwd.c,v 1.51 2017/06/01 02:45:13 chs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vfs_getcwd.c,v 1.52 2017/07/28 15:37:23 riastradh Exp $");
 
 #include 
 #include 
@@ -211,7 +211,8 @@ unionread:
 reclen = dp->d_reclen;
 
 /* check for malformed directory.. */
-if (reclen < _DIRENT_MINSIZE(dp)) {
+if (reclen < _DIRENT_MINSIZE(dp) ||
+reclen > len) {
 	error = EINVAL;
 	goto out;
 }

CVS commit: src/sys/kern

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 15:37:23 UTC 2017

Modified Files:
src/sys/kern: vfs_getcwd.c

Log Message:
Don't walk off the end of the dirent buffer.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.51 -r1.52 src/sys/kern/vfs_getcwd.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: src/sys

[Taylor R Campbell]

Module Name:src
Committed By:   riastradh
Date:   Fri Jul 28 15:34:07 UTC 2017

Modified Files:
src/sys/compat/common: vfs_syscalls_12.c vfs_syscalls_43.c
src/sys/compat/ibcs2: ibcs2_misc.c
src/sys/compat/linux/common: linux_file64.c linux_misc.c
src/sys/compat/linux32/common: linux32_dirent.c
src/sys/compat/osf1: osf1_file.c
src/sys/compat/sunos: sunos_misc.c
src/sys/compat/sunos32: sunos32_misc.c
src/sys/compat/svr4: svr4_misc.c
src/sys/compat/svr4_32: svr4_32_misc.c
src/sys/rump/kern/lib/libsys_sunos: rump_sunos_compat.c

Log Message:
Fail, don't panic, on bad dirents from file system.

Controllable via puffs from userland.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.33 -r1.34 src/sys/compat/common/vfs_syscalls_12.c
cvs rdiff -u -r1.59 -r1.60 src/sys/compat/common/vfs_syscalls_43.c
cvs rdiff -u -r1.113 -r1.114 src/sys/compat/ibcs2/ibcs2_misc.c
cvs rdiff -u -r1.58 -r1.59 src/sys/compat/linux/common/linux_file64.c
cvs rdiff -u -r1.238 -r1.239 src/sys/compat/linux/common/linux_misc.c
cvs rdiff -u -r1.17 -r1.18 src/sys/compat/linux32/common/linux32_dirent.c
cvs rdiff -u -r1.43 -r1.44 src/sys/compat/osf1/osf1_file.c
cvs rdiff -u -r1.170 -r1.171 src/sys/compat/sunos/sunos_misc.c
cvs rdiff -u -r1.77 -r1.78 src/sys/compat/sunos32/sunos32_misc.c
cvs rdiff -u -r1.157 -r1.158 src/sys/compat/svr4/svr4_misc.c
cvs rdiff -u -r1.77 -r1.78 src/sys/compat/svr4_32/svr4_32_misc.c
cvs rdiff -u -r1.1 -r1.2 \
src/sys/rump/kern/lib/libsys_sunos/rump_sunos_compat.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/common/vfs_syscalls_12.c
diff -u src/sys/compat/common/vfs_syscalls_12.c:1.33 src/sys/compat/common/vfs_syscalls_12.c:1.34
--- src/sys/compat/common/vfs_syscalls_12.c:1.33	Fri Jan 13 22:29:59 2017
+++ src/sys/compat/common/vfs_syscalls_12.c	Fri Jul 28 15:34:06 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: vfs_syscalls_12.c,v 1.33 2017/01/13 22:29:59 christos Exp $	*/
+/*	$NetBSD: vfs_syscalls_12.c,v 1.34 2017/07/28 15:34:06 riastradh Exp $	*/
 
 /*
  * Copyright (c) 1989, 1993
@@ -37,7 +37,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: vfs_syscalls_12.c,v 1.33 2017/01/13 22:29:59 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vfs_syscalls_12.c,v 1.34 2017/07/28 15:34:06 riastradh Exp $");
 
 #include 
 #include 
@@ -171,8 +171,10 @@ again:
 	for (cookie = cookiebuf; len > 0; len -= reclen) {
 		bdp = (struct dirent *)inp;
 		reclen = bdp->d_reclen;
-		if (reclen & 3)
-			panic(__func__);
+		if (reclen & 3) {
+			error = EIO;
+			goto out;
+		}
 		if (bdp->d_fileno == 0) {
 			inp += reclen;	/* it is a hole; squish it out */
 			if (cookie)

Index: src/sys/compat/common/vfs_syscalls_43.c
diff -u src/sys/compat/common/vfs_syscalls_43.c:1.59 src/sys/compat/common/vfs_syscalls_43.c:1.60
--- src/sys/compat/common/vfs_syscalls_43.c:1.59	Fri Jan 13 20:25:35 2017
+++ src/sys/compat/common/vfs_syscalls_43.c	Fri Jul 28 15:34:06 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: vfs_syscalls_43.c,v 1.59 2017/01/13 20:25:35 christos Exp $	*/
+/*	$NetBSD: vfs_syscalls_43.c,v 1.60 2017/07/28 15:34:06 riastradh Exp $	*/
 
 /*
  * Copyright (c) 1989, 1993
@@ -37,7 +37,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: vfs_syscalls_43.c,v 1.59 2017/01/13 20:25:35 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vfs_syscalls_43.c,v 1.60 2017/07/28 15:34:06 riastradh Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_compat_netbsd.h"
@@ -451,8 +451,10 @@ again:
 	for (cookie = cookiebuf; len > 0; len -= reclen) {
 		bdp = (struct dirent *)inp;
 		reclen = bdp->d_reclen;
-		if (reclen & 3)
-			panic(__func__);
+		if (reclen & 3) {
+			error = EIO;
+			goto out;
+		}
 		if (bdp->d_fileno == 0) {
 			inp += reclen;	/* it is a hole; squish it out */
 			if (cookie)

Index: src/sys/compat/ibcs2/ibcs2_misc.c
diff -u src/sys/compat/ibcs2/ibcs2_misc.c:1.113 src/sys/compat/ibcs2/ibcs2_misc.c:1.114
--- src/sys/compat/ibcs2/ibcs2_misc.c:1.113	Fri Sep  5 09:21:54 2014
+++ src/sys/compat/ibcs2/ibcs2_misc.c	Fri Jul 28 15:34:06 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: ibcs2_misc.c,v 1.113 2014/09/05 09:21:54 matt Exp $	*/
+/*	$NetBSD: ibcs2_misc.c,v 1.114 2017/07/28 15:34:06 riastradh Exp $	*/
 
 /*
  * Copyright (c) 1992, 1993
@@ -95,7 +95,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_misc.c,v 1.113 2014/09/05 09:21:54 matt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_misc.c,v 1.114 2017/07/28 15:34:06 riastradh Exp $");
 
 #include 
 #include 
@@ -427,8 +427,10 @@ again:
 	for (cookie = cookiebuf; len > 0; len -= reclen) {
 		bdp = (struct dirent *)inp;
 		reclen = bdp->d_reclen;
-		if (reclen & 3)
-			panic("ibcs2_getdents: bad reclen");
+		if (reclen & 3) {
+			error = EIO;
+			goto out;
+		}
 		if (cookie && (*cookie >> 32) != 0) {
 			compat_offseterr(vp, "ibcs2_getdents");
 			error = EINVAL;

Index: