svn commit: r303650 - head/sys/opencrypto

Author: cem Date: Mon Aug 1 22:57:03 2016 New Revision: 303650 URL: https://svnweb.freebsd.org/changeset/base/303650 Log: opencrypto AES-ICM: Fix heap corruption typo This error looks like it was a simple copy-paste typo in the original commit for this code (r275732). PR:

svn commit: r303648 - head/sys/ddb

Author: cem Date: Mon Aug 1 22:41:50 2016 New Revision: 303648 URL: https://svnweb.freebsd.org/changeset/base/303648 Log: Fix ddb "show proc" to show full arguments PR: 200052 Submitted by: Chang-Hsien Tsai Modified: head/sys/ddb/db_ps.c Modified: head/sys/ddb/db_ps.c

svn commit: r303310 - in head/sys: fs/devfs kern

Author: cem Date: Mon Jul 25 16:28:02 2016 New Revision: 303310 URL: https://svnweb.freebsd.org/changeset/base/303310 Log: devfs: Move most ioctl logic down to vnode layer Devfs' file layer ioctl is now just a thin shim around the vnode layer. Reviewed by: kib Sponsored by: EMC /

svn commit: r303122 - head/usr.bin/gcore

Author: cem Date: Thu Jul 21 00:53:14 2016 New Revision: 303122 URL: https://svnweb.freebsd.org/changeset/base/303122 Log: Mirror r303120 to gcore Sponsored by: EMC / Isilon Storage Division Modified: head/usr.bin/gcore/elfcore.c Modified: head/usr.bin/gcore/elfcore.c

svn commit: r303120 - head/sys/kern

Author: cem Date: Wed Jul 20 22:51:33 2016 New Revision: 303120 URL: https://svnweb.freebsd.org/changeset/base/303120 Log: imgact_elf: Rename the segment iterator to match reality The each_writable_segment routine evaluates segments on a slightly little more nuanced metric than simply

svn commit: r303118 - head/sys/kern

Author: cem Date: Wed Jul 20 22:46:56 2016 New Revision: 303118 URL: https://svnweb.freebsd.org/changeset/base/303118 Log: ANSI-fy imgact_elf.c Sponsored by: EMC / Isilon Storage Division Modified: head/sys/kern/imgact_elf.c Modified: head/sys/kern/imgact_elf.c

svn commit: r303114 - head/usr.bin/gcore

Author: cem Date: Wed Jul 20 22:03:45 2016 New Revision: 303114 URL: https://svnweb.freebsd.org/changeset/base/303114 Log: Add extended segment support to gcore A follow-up to r303099, D7255. Basically, apply the exact same change, with the exact same rationale, to gcore. gcore's

svn commit: r303105 - head/sys/kern

Author: cem Date: Wed Jul 20 18:11:22 2016 New Revision: 303105 URL: https://svnweb.freebsd.org/changeset/base/303105 Log: Fix DEBUG build on 64-bit arch after r303099 Reported by: Larry Rosenman Modified: head/sys/kern/imgact_elf.c Modified: head/sys/kern/imgact_elf.c

svn commit: r303099 - head/sys/kern

Author: cem Date: Wed Jul 20 16:59:36 2016 New Revision: 303099 URL: https://svnweb.freebsd.org/changeset/base/303099 Log: Extend ELF coredump to support more than 65535 segments The ELF e_phnum field is only 16 bits wide. To support more than 65535 segments (program headers), Sun's

svn commit: r303043 - in head: share/man/man4 sys/dev/vt sys/dev/vt/hw/fb

Author: cem Date: Tue Jul 19 19:20:47 2016 New Revision: 303043 URL: https://svnweb.freebsd.org/changeset/base/303043 Log: Increase vt(4) framebuffer maximum size And rename "DEFAULT" constants to the more accurate "MAX." PR: 210382 Submitted by: Felix Reviewed by:

svn commit: r302682 - head/sys/dev/ioat

Author: cem Date: Tue Jul 12 21:56:55 2016 New Revision: 302682 URL: https://svnweb.freebsd.org/changeset/base/302682 Log: ioat_reserve_space: Recheck quiescing flag after dropping submit lock Fix a minor bound check error while here (ring can only hold 1 << MAX_ORDER - 1 entries).

svn commit: r302685 - head/sys/dev/ioat

Author: cem Date: Tue Jul 12 21:57:02 2016 New Revision: 302685 URL: https://svnweb.freebsd.org/changeset/base/302685 Log: ioat(4): Add KTR trace for ioat_reset_hw Modified: head/sys/dev/ioat/ioat.c Modified: head/sys/dev/ioat/ioat.c

svn commit: r302683 - head/sys/dev/ioat

Author: cem Date: Tue Jul 12 21:56:57 2016 New Revision: 302683 URL: https://svnweb.freebsd.org/changeset/base/302683 Log: ioat(4): Assert against ring underflow Modified: head/sys/dev/ioat/ioat.c Modified: head/sys/dev/ioat/ioat.c

svn commit: r302680 - head/sys/dev/ioat

Author: cem Date: Tue Jul 12 21:56:49 2016 New Revision: 302680 URL: https://svnweb.freebsd.org/changeset/base/302680 Log: ioat(4): Export HW capabilities to consumers Modified: head/sys/dev/ioat/ioat.c head/sys/dev/ioat/ioat.h head/sys/dev/ioat/ioat_hw.h Modified:

svn commit: r302684 - head/sys/dev/ioat

Author: cem Date: Tue Jul 12 21:57:00 2016 New Revision: 302684 URL: https://svnweb.freebsd.org/changeset/base/302684 Log: ioat(4): Enhance KTR logging for descriptor completions Modified: head/sys/dev/ioat/ioat.c Modified: head/sys/dev/ioat/ioat.c

svn commit: r302681 - head/sys/dev/ioat

Author: cem Date: Tue Jul 12 21:56:52 2016 New Revision: 302681 URL: https://svnweb.freebsd.org/changeset/base/302681 Log: ioat(4): Remove force_hw_error sysctl; it does not work reliably Modified: head/sys/dev/ioat/ioat.c Modified: head/sys/dev/ioat/ioat.c

svn commit: r302686 - head/sys/dev/ioat

Author: cem Date: Tue Jul 12 21:57:05 2016 New Revision: 302686 URL: https://svnweb.freebsd.org/changeset/base/302686 Log: ioat(4): Check ring links at grow/shrink in INVARIANTS Modified: head/sys/dev/ioat/ioat.c Modified: head/sys/dev/ioat/ioat.c

svn commit: r302679 - head/sys/dev/ioat

Author: cem Date: Tue Jul 12 21:56:46 2016 New Revision: 302679 URL: https://svnweb.freebsd.org/changeset/base/302679 Log: ioat(4): Submitters pick up a shovel if queue is too full Before attempting to grow the ring. Modified: head/sys/dev/ioat/ioat.c head/sys/dev/ioat/ioat_internal.h

svn commit: r302678 - head/sys/dev/ioat

Author: cem Date: Tue Jul 12 21:56:34 2016 New Revision: 302678 URL: https://svnweb.freebsd.org/changeset/base/302678 Log: ioat(4): Don't shrink ring if active Modified: head/sys/dev/ioat/ioat.c Modified: head/sys/dev/ioat/ioat.c

svn commit: r302677 - head/sys/dev/ioat

Author: cem Date: Tue Jul 12 21:52:26 2016 New Revision: 302677 URL: https://svnweb.freebsd.org/changeset/base/302677 Log: ioat(4): Print some more useful information about the ring from ddb "show ioat" Modified: head/sys/dev/ioat/ioat.c Modified: head/sys/dev/ioat/ioat.c

svn commit: r302669 - head/sys/dev/ioat

Author: cem Date: Tue Jul 12 17:58:58 2016 New Revision: 302669 URL: https://svnweb.freebsd.org/changeset/base/302669 Log: ioat(4): Shrink using the correct timer Fix a typo introduced in r302352. Sponsored by: EMC / Isilon Storage Division Modified: head/sys/dev/ioat/ioat.c

svn commit: r302500 - head/bin/dd

Author: cem Date: Sat Jul 9 17:11:54 2016 New Revision: 302500 URL: https://svnweb.freebsd.org/changeset/base/302500 Log: dd(1): Enable access to SIZE_T_MAX character devices On machines where SIZE_T_MAX exceeds OFF_MAX (signed 64-bit), permit seeking character devices to negative off_t

svn commit: r302439 - head/sys/net

Author: cem Date: Fri Jul 8 17:04:21 2016 New Revision: 302439 URL: https://svnweb.freebsd.org/changeset/base/302439 Log: iflib: Fix typo in 'iflib_rx_miss_bufs' sysctl name It looks like these sysctls were copy-pasted from netmap. Most were changed from 'ixl_' prefix to 'iflib_', but

svn commit: r302354 - head/sys/dev/ioat

Author: cem Date: Tue Jul 5 20:53:32 2016 New Revision: 302354 URL: https://svnweb.freebsd.org/changeset/base/302354 Log: ioat(4): Block asynchronous work during HW reset Fix the race between ioat_reset_hw and ioat_process_events. HW reset isn't protected by a lock because it can

svn commit: r302353 - head/sys/dev/ioat

Author: cem Date: Tue Jul 5 20:52:35 2016 New Revision: 302353 URL: https://svnweb.freebsd.org/changeset/base/302353 Log: ioat(4): Serialize ioat_reset_hw invocations Reviewed by: markj Approved by: re Sponsored by: EMC / Isilon Storage Division Differential Revision:

svn commit: r302352 - head/sys/dev/ioat

Author: cem Date: Tue Jul 5 20:51:52 2016 New Revision: 302352 URL: https://svnweb.freebsd.org/changeset/base/302352 Log: ioat(4): Split timer into poll and shrink functions Poll should happen quickly, while shrink should happen infrequently. Protect is_completion_pending with

svn commit: r302262 - in head/sys/dev/usb: . quirk

Author: cem Date: Wed Jun 29 06:42:20 2016 New Revision: 302262 URL: https://svnweb.freebsd.org/changeset/base/302262 Log: USB: Add Garmin FR230 device quirk (broken INQUIRY) PR: 210544 Reviewed by: hps Approved by: re Modified: head/sys/dev/usb/quirk/usb_quirk.c

svn commit: r301751 - head/sys/kern

Author: cem Date: Thu Jun 9 18:27:41 2016 New Revision: 301751 URL: https://svnweb.freebsd.org/changeset/base/301751 Log: Add DDB command "kldstat" It prints much the same information as kldstat(8) without any arguments. Suggested by: jhibbits Sponsored by: EMC / Isilon Storage

svn commit: r301750 - head/sys/kern

Author: cem Date: Thu Jun 9 18:24:51 2016 New Revision: 301750 URL: https://svnweb.freebsd.org/changeset/base/301750 Log: kvprintf: Pad %*c to width, like %*s Sponsored by: EMC / Isilon Storage Division Modified: head/sys/kern/subr_prf.c Modified: head/sys/kern/subr_prf.c

svn commit: r301712 - head/sys/dev/ioat

Author: cem Date: Thu Jun 9 01:31:09 2016 New Revision: 301712 URL: https://svnweb.freebsd.org/changeset/base/301712 Log: ioat(4): Add ddb "show ioat " debugger command Sponsored by: EMC / Isilon Storage Division Modified: head/sys/dev/ioat/ioat.c Modified: head/sys/dev/ioat/ioat.c

svn commit: r301568 - in head/sys/cam: ata scsi

Author: cem Date: Tue Jun 7 20:33:55 2016 New Revision: 301568 URL: https://svnweb.freebsd.org/changeset/base/301568 Log: Fix memory leaks in (a|)daregister introduced in r298002 In the case where cam_iosched_init() fails, the ada and da softcs were leaked. Instead, free them.

svn commit: r301567 - head/sys/net

Author: cem Date: Tue Jun 7 20:26:00 2016 New Revision: 301567 URL: https://svnweb.freebsd.org/changeset/base/301567 Log: iflib: Improve cleanup on iflib_queues_alloc error path Fix some memory leaks. Some may remain. Reported by: Coverity Discussed with: mmacy CIDs:

svn commit: r301566 - head/sys/fs/nfsclient

Author: cem Date: Tue Jun 7 20:16:01 2016 New Revision: 301566 URL: https://svnweb.freebsd.org/changeset/base/301566 Log: nfs_clvfsops: Fix leading whitespace introduced in r299848 Replace spaces with tabs. No functional change. Sponsored by: EMC / Isilon Storage Division Modified:

svn commit: r301564 - head/sys/fs/nfsclient

Author: cem Date: Tue Jun 7 20:00:20 2016 New Revision: 301564 URL: https://svnweb.freebsd.org/changeset/base/301564 Log: nfs_clvfsops: Prevent strdup of stack garbage with bogus mount specs If strlen(hostp) was zero, the stack array 'nam' would never be initialized before being

svn commit: r301563 - head/sys/net

Author: cem Date: Tue Jun 7 19:49:08 2016 New Revision: 301563 URL: https://svnweb.freebsd.org/changeset/base/301563 Log: iflib: Fix potential leak in iflib_if_transmit Due to an accidental mismatch between allocation and release in the slow path of iflib_if_transmit, if a caller passed

svn commit: r301562 - head/sys/dev/acpica

Author: cem Date: Tue Jun 7 19:08:13 2016 New Revision: 301562 URL: https://svnweb.freebsd.org/changeset/base/301562 Log: Fix a minor leak in ACPI thermal Introduced in r301518. Reported by: Coverity CID: 1356266 Sponsored by: EMC / Isilon Storage Division Modified:

svn commit: r301300 - head/sys/dev/ioat

Author: cem Date: Sat Jun 4 04:14:06 2016 New Revision: 301300 URL: https://svnweb.freebsd.org/changeset/base/301300 Log: ioat(4): Always log capabilities on attach Different, relatively recent Intel Xeon hardware support radically different features. E.g., BDX support CRC32 while

svn commit: r301297 - head/sys/dev/ioat

Author: cem Date: Sat Jun 4 03:54:30 2016 New Revision: 301297 URL: https://svnweb.freebsd.org/changeset/base/301297 Log: ioat(4): Export the number of available channels Sponsored by: EMC / Isilon Storage Division Modified: head/sys/dev/ioat/ioat.c head/sys/dev/ioat/ioat.h

svn commit: r301296 - head/sys/dev/ioat

Author: cem Date: Sat Jun 4 03:52:19 2016 New Revision: 301296 URL: https://svnweb.freebsd.org/changeset/base/301296 Log: ioat(4): Make channel indices unsigned Sponsored by: EMC / Isilon Storage Division Modified: head/sys/dev/ioat/ioat.c head/sys/dev/ioat/ioat_internal.h Modified:

svn commit: r301160 - head/bin/ps

Author: cem Date: Wed Jun 1 19:54:05 2016 New Revision: 301160 URL: https://svnweb.freebsd.org/changeset/base/301160 Log: ps(1): Expand variables to match expanded fields ki_flag and ki_tdflag have been 'long', not 'int', since 2000 and 2005, respectively. Submitted by: Shawn Wills

svn commit: r301136 - head/lib/libthr/thread

Author: cem Date: Wed Jun 1 16:12:26 2016 New Revision: 301136 URL: https://svnweb.freebsd.org/changeset/base/301136 Log: libthr: Use formatted PANIC() No functional change, although _thread_printf() may be slightly less functional or render some values differently from libc

svn commit: r301135 - head/lib/libthr/thread

Author: cem Date: Wed Jun 1 16:11:09 2016 New Revision: 301135 URL: https://svnweb.freebsd.org/changeset/base/301135 Log: libthr: _thread_vprintf: Enhance support for %p, %#x No functional change. No ABI change. Reviewed by: kib Sponsored by: EMC / Isilon Storage Division

svn commit: r301134 - head/lib/libthr/thread

Author: cem Date: Wed Jun 1 16:09:56 2016 New Revision: 301134 URL: https://svnweb.freebsd.org/changeset/base/301134 Log: libthr: Add vprintf variant of _thread_printf, formatted PANIC() No ABI change. Reviewed by: kib Sponsored by: EMC / Isilon Storage Division Differential

svn commit: r300824 - head/lib/libmd

Author: cem Date: Fri May 27 05:31:14 2016 New Revision: 300824 URL: https://svnweb.freebsd.org/changeset/base/300824 Log: libmd: Work around C++'s inability to understand C Reported by: antoine@ (x265) Modified: head/lib/libmd/md5.h Modified: head/lib/libmd/md5.h

svn commit: r300822 - in head: contrib/gcc gnu/usr.bin/cc/cc_tools

Author: cem Date: Fri May 27 03:40:52 2016 New Revision: 300822 URL: https://svnweb.freebsd.org/changeset/base/300822 Log: gcc42: Fix minor C99 parse bug DR #289[0] came down and gcc4.2.1 was on the wrong side of history. Partially revert GCC r42574 (just remove the error) to rectify the

svn commit: r300774 - head/sys/sys

Author: cem Date: Thu May 26 20:37:49 2016 New Revision: 300774 URL: https://svnweb.freebsd.org/changeset/base/300774 Log: Ifndef KERNEL the userspace-only routines in sys/md[45].h A follow-up to r300773. Nothing in the kernel uses those definitions, but apparently libmd includes the

svn commit: r300773 - in head/sys: crypto crypto/aesni crypto/sha2 crypto/siphash kern sys

Author: cem Date: Thu May 26 19:29:29 2016 New Revision: 300773 URL: https://svnweb.freebsd.org/changeset/base/300773 Log: crypto routines: Hint minimum buffer sizes to the compiler Use the C99 'static' keyword to hint to the compiler IVs and output digest sizes. The keyword informs the

svn commit: r300634 - head/sys/boot/efi/loader

Author: cem Date: Wed May 25 00:13:01 2016 New Revision: 300634 URL: https://svnweb.freebsd.org/changeset/base/300634 Log: efi loader: Match format string to EFI_ERROR_CODE() Silence a format specifier warning. Sponsored by: EMC / Isilon Storage Division Modified:

svn commit: r300531 - head/sys/dev/ntb/ntb_hw

Author: cem Date: Mon May 23 19:46:58 2016 New Revision: 300531 URL: https://svnweb.freebsd.org/changeset/base/300531 Log: ntb_hw(4): Only record the first three MSIX vectors Don't overrun the msix_data array by reading the (unused) link state interrupt information. Reported by:

svn commit: r300223 - head/sys/vm

Author: cem Date: Thu May 19 17:54:14 2016 New Revision: 300223 URL: https://svnweb.freebsd.org/changeset/base/300223 Log: vm/vm_page.h: Fix trivial '-Wpointer-sign' warning pq_vcnt, as a count of real things, has no business being negative. It is only ever initialized by a u_int

svn commit: r300220 - head/sys/sys

Author: cem Date: Thu May 19 17:21:24 2016 New Revision: 300220 URL: https://svnweb.freebsd.org/changeset/base/300220 Log: sys/vmmeter.h: Fix trivial '-Wsign-compare' warning in common header Frankly, it doesn't make sense for vm_pageout_wakeup_thresh to have a negative value (it is only

svn commit: r300174 - head/sbin/dhclient

Author: cem Date: Wed May 18 23:41:55 2016 New Revision: 300174 URL: https://svnweb.freebsd.org/changeset/base/300174 Log: dhclient: Fix the trivial buffer overruns correctly A DHCP client identifier is simply the hardware type (one byte) concatenated with the hardware address (some

svn commit: r300172 - head/sbin/dhclient

Author: cem Date: Wed May 18 23:35:37 2016 New Revision: 300172 URL: https://svnweb.freebsd.org/changeset/base/300172 Log: Revert r299512 It broke client identifiers because I misunderstood the intent of the code. There is still a minor issue detected by Coverity (at least, I can't find

svn commit: r300100 - head/sys/dev/ntb/ntb_hw

Author: cem Date: Wed May 18 02:10:05 2016 New Revision: 300100 URL: https://svnweb.freebsd.org/changeset/base/300100 Log: ntb_hw(4): Add sysctls for administrative/test link config, state dev.ntb_hw.0.admin_up=0/1: Like ifconfig UP/DOWN. dev.ntb_hw.0.active=0/1: Like ifconfig 'status'

svn commit: r299574 - head/include

Author: cem Date: Thu May 12 22:13:12 2016 New Revision: 299574 URL: https://svnweb.freebsd.org/changeset/base/299574 Log: stdio.h: Fix function-type typedef style and use _types.h __ssize_t I'm still not sure why only Pypy runs into the error with the function typedefs. Fix it anyway.

svn commit: r299572 - head/lib/libc/stdio

Author: cem Date: Thu May 12 21:30:22 2016 New Revision: 299572 URL: https://svnweb.freebsd.org/changeset/base/299572 Log: libc: Actually export fopencookie(3) A follow-up to r299456. Sponsored by: EMC / Isilon Storage Division Modified: head/lib/libc/stdio/Symbol.map Modified:

svn commit: r299571 - in head: include sys/sys

Author: cem Date: Thu May 12 21:18:17 2016 New Revision: 299571 URL: https://svnweb.freebsd.org/changeset/base/299571 Log: Pollute more places with off64_t and add __off64_t Despite the private namespace, several broken ports depend on the __off64_t name for the type. Export it exactly

svn commit: r299515 - head/usr.sbin/rtadvd

Author: cem Date: Thu May 12 05:12:24 2016 New Revision: 299515 URL: https://svnweb.freebsd.org/changeset/base/299515 Log: rtadvd(8): Fix use-after-close in cm_handler_client cm_send() closes 'fd' on error. In that case, bail out early without trying to recv from or close 'fd' again.

svn commit: r299514 - head/sys/fs/nfsserver

Author: cem Date: Thu May 12 05:03:12 2016 New Revision: 299514 URL: https://svnweb.freebsd.org/changeset/base/299514 Log: nfsd: Fix use-after-free in NFS4 lock test service Trivial use-after-free where stp was freed too soon in the non-error path. To fix, simply move its release to the

svn commit: r299513 - head/usr.sbin/rtadvd

Author: cem Date: Thu May 12 04:54:32 2016 New Revision: 299513 URL: https://svnweb.freebsd.org/changeset/base/299513 Log: rtadvd(8): Don't use-after-free This whole block of code as committed fully formed in r224144. I'm not really sure what the intent was, but it seems plausible that

svn commit: r299512 - head/sbin/dhclient

Author: cem Date: Thu May 12 04:28:22 2016 New Revision: 299512 URL: https://svnweb.freebsd.org/changeset/base/299512 Log: dhclient: Fix some trivial buffer overruns There was some confusion about how to limit a hardware address to at most 16 bytes. In some cases it would overrun a byte

svn commit: r299511 - head/lib/libc/tests/stdio

Author: cem Date: Thu May 12 04:08:45 2016 New Revision: 299511 URL: https://svnweb.freebsd.org/changeset/base/299511 Log: print_positional_test: Fix misuse of wchar APIs These APIs take unit length, not byte length parameters. Reported by: Coverity CIDs: 1338543, 1338544,

svn commit: r299510 - head/lib/libmp

Author: cem Date: Thu May 12 03:53:20 2016 New Revision: 299510 URL: https://svnweb.freebsd.org/changeset/base/299510 Log: libmp: Fix trivial buffer overrun fgetln yields a non-NUL-terminated buffer and its length. This routine attempted to NUL-terminate it, but did not allocate space

svn commit: r299509 - head/usr.bin/rpcgen

Author: cem Date: Thu May 12 03:49:05 2016 New Revision: 299509 URL: https://svnweb.freebsd.org/changeset/base/299509 Log: rpcgen(1): Tag crash() routine as __dead2 for static analyzers Suggested by: Coverity CID: 1305464 Sponsored by: EMC / Isilon Storage Division Modified:

svn commit: r299508 - head/tests/sys/kern

Author: cem Date: Thu May 12 03:44:29 2016 New Revision: 299508 URL: https://svnweb.freebsd.org/changeset/base/299508 Log: kern_descrip_test: Fix trivial buffer overrun with readlink(2) Reported by: Coverity CID: 1229965, 1229972 Sponsored by: EMC / Isilon Storage Division

svn commit: r299507 - head/usr.sbin/rtadvd

Author: cem Date: Thu May 12 03:37:17 2016 New Revision: 299507 URL: https://svnweb.freebsd.org/changeset/base/299507 Log: rtadvd(8): Fix a typo in full msg receive logic Check against the size of the struct, not the pointer. Previously, a message with a cm_len between 9 and 23

svn commit: r299504 - head/sys/dev/sound/pci/hda

Author: cem Date: Thu May 12 02:46:29 2016 New Revision: 299504 URL: https://svnweb.freebsd.org/changeset/base/299504 Log: snd_hda(4): Don't pass bogus sizeof()s to unused sysctl arg2 parameter (again) More of the same sort of issue as r299503, just missed some sysctls added in a

svn commit: r299503 - head/sys/dev/sound/pci/hda

Author: cem Date: Thu May 12 02:41:38 2016 New Revision: 299503 URL: https://svnweb.freebsd.org/changeset/base/299503 Log: snd_hda(4): Don't pass bogus sizeof()s to unused sysctl arg2 parameter None of the sysctl handlers in hdaa use the arg2 parameter, so just pass zero instead.

svn commit: r299502 - head/lib/libc/tests/nss

Author: cem Date: Thu May 12 02:32:23 2016 New Revision: 299502 URL: https://svnweb.freebsd.org/changeset/base/299502 Log: nss/gethostby_test: fix broken vector iteration of gethostbyaddr h_aliases h_aliases is a NULL-terminated rather than fixed-length array. nitems() is not a valid

svn commit: r299496 - head/contrib/atf/atf-c/detail

Author: cem Date: Wed May 11 23:39:39 2016 New Revision: 299496 URL: https://svnweb.freebsd.org/changeset/base/299496 Log: atf map: Fix double-free in low memory error path If atf_list_append(, X, ) fails, X is freed. Don't free it again. If anyone wants to walk this patch upstream,

svn commit: r299495 - head/crypto/heimdal/lib/krb5

Author: cem Date: Wed May 11 23:25:59 2016 New Revision: 299495 URL: https://svnweb.freebsd.org/changeset/base/299495 Log: libkrb5: Fix potential double-free If krb5_make_principal fails, tmp_creds.server may remain a pointer to freed memory and then be double-freed. After freeing it

svn commit: r299494 - head/sys/kern

Author: cem Date: Wed May 11 23:16:11 2016 New Revision: 299494 URL: https://svnweb.freebsd.org/changeset/base/299494 Log: subr_vmem: Fix double-free in error case of vmem_create If vmem_init() fails, 'vm' is already destroyed and freed. Don't free it again. Reported by: Coverity

svn commit: r299493 - in head: share/man/man9 sys/dev/pci

Author: cem Date: Wed May 11 23:00:12 2016 New Revision: 299493 URL: https://svnweb.freebsd.org/changeset/base/299493 Log: Revert r299467 to fix the kernel build. $ svn merge -c -299467 . Approved by: build being broken for six hours Modified: head/share/man/man9/Makefile

svn commit: r299491 - head/usr.sbin/route6d

Author: cem Date: Wed May 11 22:33:20 2016 New Revision: 299491 URL: https://svnweb.freebsd.org/changeset/base/299491 Log: route6d(8): Fix potential double-free In the case that the subsequent sysctl(3) call failed, 'buf' could be free(3)ed repeatedly. It isn't clear to me that that

svn commit: r299490 - head/sbin/camcontrol

Author: cem Date: Wed May 11 22:25:14 2016 New Revision: 299490 URL: https://svnweb.freebsd.org/changeset/base/299490 Log: camcontrol(8): Fix another trivial double-free Reported by: Coverity CID: 1331222 Sponsored by: EMC / Isilon Storage Division Modified:

svn commit: r299489 - head/sbin/camcontrol

Author: cem Date: Wed May 11 22:22:49 2016 New Revision: 299489 URL: https://svnweb.freebsd.org/changeset/base/299489 Log: camcontrol(8): Fix trival double-free Reported by: Coverity CID: 1331223 Sponsored by: EMC / Isilon Storage Division Modified:

svn commit: r299484 - head/usr.bin/random

Author: cem Date: Wed May 11 22:04:28 2016 New Revision: 299484 URL: https://svnweb.freebsd.org/changeset/base/299484 Log: random(6): Fix double-close In the case where a file lacks a trailing newline, there is some "evil" code to reverse goto the tokenizing code ("make_token") for the

svn commit: r299476 - head/usr.bin/whois

Author: cem Date: Wed May 11 18:03:51 2016 New Revision: 299476 URL: https://svnweb.freebsd.org/changeset/base/299476 Log: whois(1): Fix potential double-close and logic mistakes Close the fd the poll error was detected on, rather than the last opened fd, to fix the double-close.

svn commit: r299473 - head/usr.bin/whois

Author: cem Date: Wed May 11 17:52:06 2016 New Revision: 299473 URL: https://svnweb.freebsd.org/changeset/base/299473 Log: whois(1): Pull out async multiple host connection code into a routine This logic was added to the whois() function in r281959, but could easily be its own routine.

svn commit: r299470 - head/usr.sbin/mixer

Author: cem Date: Wed May 11 17:27:27 2016 New Revision: 299470 URL: https://svnweb.freebsd.org/changeset/base/299470 Log: mixer(8): Style: Tag no-return usage() as __dead2 Coverity really should have figured this out from the exit(3) call at the end of the routine, but just make it

svn commit: r299466 - head/contrib/bsnmp/snmpd

Author: cem Date: Wed May 11 17:06:03 2016 New Revision: 299466 URL: https://svnweb.freebsd.org/changeset/base/299466 Log: bsnmpd: Fix size of trapsink::comm to match other community arrays This fixes a number of possible strcpy() buffer overruns between the various community strings in

svn commit: r299465 - head/contrib/bsnmp/snmp_usm

Author: cem Date: Wed May 11 16:54:34 2016 New Revision: 299465 URL: https://svnweb.freebsd.org/changeset/base/299465 Log: bsnmp: Don't overrun privkey buffer by copying wrong size The 'priv_key' array is SNMP_PRIV_KEY_SIZ bytes, not SNMP_AUTH_KEY_SIZ. Reported by: Coverity CIDs:

svn commit: r299461 - head/usr.sbin/makefs/ffs

Author: cem Date: Wed May 11 16:42:13 2016 New Revision: 299461 URL: https://svnweb.freebsd.org/changeset/base/299461 Log: ffs_bswap: Copy one UFS dinode member at a time No functional change. Reported by: Coverity CIDs: 974635, 974636, 977396, 977397, 977398, 977399

svn commit: r299460 - head/sbin/fsck_ffs

Author: cem Date: Wed May 11 16:20:23 2016 New Revision: 299460 URL: https://svnweb.freebsd.org/changeset/base/299460 Log: fsck_ffs: Don't overrun mount device buffer Maybe this case is impossible. Either way, when attempting to "/dev/"-prefix a non-global device name, check that we do

svn commit: r299459 - head/sys/cddl/compat/opensolaris/sys

Author: cem Date: Wed May 11 16:05:32 2016 New Revision: 299459 URL: https://svnweb.freebsd.org/changeset/base/299459 Log: compat/opensolaris: Don't redefined off64_t if already defined A follow-up to r299456. Reported by: gjb Sponsored by: EMC / Isilon Storage Division Modified:

svn commit: r299458 - head/usr.bin/gcore

Author: cem Date: Wed May 11 15:31:31 2016 New Revision: 299458 URL: https://svnweb.freebsd.org/changeset/base/299458 Log: Fix buffer overrun in gcore(1) NT_PRPSINFO Use size of destination buffer, rather than a constant that may or may not correspond to the source buffer, to restrict

svn commit: r299456 - in head: include lib/libc/stdio

Author: cem Date: Wed May 11 14:38:27 2016 New Revision: 299456 URL: https://svnweb.freebsd.org/changeset/base/299456 Log: libc: Add fopencookie(3) wrapper around funopen(3) Reviewed by: jhb, oshogbo Sponsored by: EMC / Isilon Storage Division Differential Revision:

svn commit: r299387 - head/sys/netipsec

Author: cem Date: Tue May 10 20:14:11 2016 New Revision: 299387 URL: https://svnweb.freebsd.org/changeset/base/299387 Log: netipsec: Fix minor style nit Coverity points out that 'continue' is equivalent to 'break' in a do {} while(false) loop. Reported by: Coverity CID:

svn commit: r299385 - head/usr.bin/sdiff

Author: cem Date: Tue May 10 20:09:40 2016 New Revision: 299385 URL: https://svnweb.freebsd.org/changeset/base/299385 Log: sdiff(1): Fix potential NULL deref in cleanup path In the presence of the --diff-pid argument, it is possible for 'diffpipe' to be NULL. Only fclose() it if it was

svn commit: r299098 - head/sys/boot/efi/libefi

Author: cem Date: Thu May 5 00:07:08 2016 New Revision: 299098 URL: https://svnweb.freebsd.org/changeset/base/299098 Log: efipart: Support an arbitrary number of partitions Don't crash if the user has more than 31 of them. A follow-up to r298230. Reviewed by: allanjude

svn commit: r298989 - in head: share/man/man4 sys/dev/ioat

Author: cem Date: Tue May 3 17:07:18 2016 New Revision: 298989 URL: https://svnweb.freebsd.org/changeset/base/298989 Log: ioat(4): Implement CRC and MOVECRC APIs And document them in ioat.4. Sponsored by: EMC / Isilon Storage Division Modified: head/share/man/man4/ioat.4

svn commit: r298988 - head/sys/dev/ioat

Author: cem Date: Tue May 3 17:06:33 2016 New Revision: 298988 URL: https://svnweb.freebsd.org/changeset/base/298988 Log: ioat(4): Add CRC descriptor structure Add CRC/MOVECRC operations, as well as the TEST and STORE variants. With these operations, a CRC32C can be computed over one

svn commit: r298987 - head/sys/dev/ioat

Author: cem Date: Tue May 3 17:05:58 2016 New Revision: 298987 URL: https://svnweb.freebsd.org/changeset/base/298987 Log: ioat(4): Limit descriptor allocation to low 40 bits The IOAT engine can only address the low 40 bits (1 TB) of physmem via the 'next descriptor' pointer. Restrict

svn commit: r298791 - head/sys/sys

Author: cem Date: Fri Apr 29 17:56:16 2016 New Revision: 298791 URL: https://svnweb.freebsd.org/changeset/base/298791 Log: PRINT_BUF_FLAGS: Remove removed DIRTY/PERSIST flags This is a follow-up to r298789, which removed the B_DIRTY and B_PERSISTENT flags. This changeset removes them

svn commit: r298678 - head/sys/kern

Author: cem Date: Wed Apr 27 00:10:32 2016 New Revision: 298678 URL: https://svnweb.freebsd.org/changeset/base/298678 Log: posix4_mib: Don't overrun facility_initialized array The facility_initialized and facility arrays are the same size and were intended to be indexed the same. I

svn commit: r298677 - head/sys/kern

Author: cem Date: Tue Apr 26 23:58:55 2016 New Revision: 298677 URL: https://svnweb.freebsd.org/changeset/base/298677 Log: subr_mbpool: Don't free bogus pointer in error paths An mbpool is allocated with a contiguous array of mbpages. Freeing an individual mbpage has never been valid.

svn commit: r298676 - head/sys/netipsec

Author: cem Date: Tue Apr 26 23:23:44 2016 New Revision: 298676 URL: https://svnweb.freebsd.org/changeset/base/298676 Log: netipsec: Don't leak memory when deep copy fails Reported by: Coverity CID: 1331693 Sponsored by: EMC / Isilon Storage Division Modified:

svn commit: r298675 - in head/sys: netinet netinet6

Author: cem Date: Tue Apr 26 23:13:48 2016 New Revision: 298675 URL: https://svnweb.freebsd.org/changeset/base/298675 Log: in_lltable_alloc and in6 copy: Don't leak LLE in error path Fix a memory leak in error conditions introduced in r292978. Reported by: Coverity CIDs:

svn commit: r298673 - head/sys/netinet

Author: cem Date: Tue Apr 26 23:02:18 2016 New Revision: 298673 URL: https://svnweb.freebsd.org/changeset/base/298673 Log: tcp_usrreq: Free allocated buffer in relock case The disgusting macro INP_WLOCK_RECHECK may early-return. In tcp_default_ctloutput() the TCP_CCALGOOPT case

svn commit: r298672 - head/sys/geom/part

Author: cem Date: Tue Apr 26 22:32:33 2016 New Revision: 298672 URL: https://svnweb.freebsd.org/changeset/base/298672 Log: g_part_bsd64: Delete duplicate/dead code RAW_PART is handled earlier in the loop. Reported by: Coverity CID: 1223201 Sponsored by: EMC / Isilon

<    1   2   3   4   5   >