Commit Graph

134889 Commits

Author SHA1 Message Date
emaste
753279d880 linuxulator: fix stack memory disclosure in linux_sigaltstack
admbugs:	765
Reported by:	Vlad Tsyrklevich <vlad@tsyrklevich.net>
Reviewed by:	andrew
MFC after:	1 day
Security:	Kernel memory disclosure
Sponsored by:   The FreeBSD Foundation
2019-01-21 16:25:40 +00:00
emaste
938cf74229 linuxulator: fix stack memory disclosure in linux_ioctl_termio
admbugs:	765
Reported by:	Vlad Tsyrklevich <vlad@tsyrklevich.net>
Reviewed by:	andrew
MFC after:	1 day
Security:	Kernel stack memory disclosure
Sponsored by:	The FreeBSD Foundation
2019-01-21 16:21:03 +00:00
emaste
294f2877ce linuxulator: fix stack memory disclosure in linux_ioctl_v4l
admbugs:	765
Reported by:	Vlad Tsyrklevich <vlad@tsyrklevich.net>
Reviewed by:	andrew
MFC after:	1 day
Security:	Kernel stack memory disclosure
Sponsored by:	The FreeBSD Foundation
2019-01-21 16:19:02 +00:00
kevans
386b062020 awg: fix soft reset failure with no link
U-Boot will leave the ephy reset de-asserted and the MAC soft reset will
fail on these boards with internal PHY and no link established. Toggle reset
again before proceeding to attach/init.

MFC after:	1 week
2019-01-21 14:35:36 +00:00
kevans
ccdd477cfa iwm(4): Fix possible null pointer indirection
Obtained from:	DragonFlyBSD (obtained from Haiku)
MFC after:	1 week
2019-01-21 01:45:35 +00:00
avos
4c57b4412f urtw(4): add length checks in Rx path.
- Check if buffer can contain Rx descriptor before accessing it.
- Verify upper / lower bounds for frame length.
- Do not pass too short frames into ieee80211_find_rxnode().

While here:
- Move cleanup to the function end.
- Reuse IEEE80211_IS_DATA() macro.

MFC after:	1 week
2019-01-21 00:53:38 +00:00
avos
3f3666ec28 iwn(4): drop return code from iwn_*attach functions (they cannot fail)
While here, add missing trace 'end' marker in iwn5000_attach().

MFC after:	1 week
2019-01-21 00:09:54 +00:00
avos
d4e79c0378 run(4): add more length checks in Rx path.
- Discard frames that are bigger than MCLBYTES (to prevent buffer overrun).
- Check buffer length before accessing its contents.
- Fix len <-> dmalen check - the last includes Rx Wireless information
structure size.
- Fix out-of-bounds read during Rx node search for ACK / CTS frames
(monitor mode only).

While here:
- Mark few suspicious places with comments.
- Move common cleanup to the function end.

MFC after:	1 week
2019-01-21 00:03:35 +00:00
np
e874bbce53 cxgbe(4): Clear the reply-pending status of a hashfilter when the reply
indicates an error.  Also, do not remove it twice from the hf list in
this case.

Submitted by:	Krishnamraju Eraparaju @ Chelsio
MFC after:	1 week
Sponsored by:	Chelsio Communicatons
2019-01-20 23:30:16 +00:00
gonzo
e723559a45 Add KBD_BOOTPROTO quirk for Logitech G510s USB keyboard
PR:		232136
Submitted by:	dgilbert@eicat.ca
MFC after:	1 week
2019-01-20 20:29:26 +00:00
avos
8f57d8136c Remove IEEE80211_AMPDU_AGE config option.
It is noop since r297774.
2019-01-20 15:17:56 +00:00
avos
97b3b273d7 net80211: resolve ioctl <-> detach race for ieee80211com structure
Since r287197 ieee80211com is a part of drivers softc; as a result,
after detach all pointers to it (iv_ic, ni_ic) are invalid. Most
possible users (tasks, interrupt handlers) are blocked / removed
when device is stopped; however, ioctl handlers were not tracked
and may crash if ieee80211com structure is accessed.

Since ieee80211com pointer access from ieee80211vap structure is not
protected by lock (constant after interface creation) and used in
many other places just use reference counting for ioctl handlers;
on detach set 'detached' flag and wait until reference counter goes to 0.

For HEAD ieee80211vap size was changed (__FreeBSD_version bumped);
however, in stable branches I'm going to split / reuse the last
iv_spare field for KBI stability.

Tested with:
 - rsu(4), SIOCSIFCAP (-rxcsum) ioctl;
 - rtwn_pci(4), SIOCG80211 / IEEE80211_IOC_HTPROTMODE ioctl.

MFC after:	1 week
2019-01-20 13:39:18 +00:00
gonzo
d62871964a [smbfs] Allow semicolon in mounts that support long names
Semicolon is a legal character in long names but not in 8.3 format.
Move it to respective character set.

PR:		140068
Submitted by:	tom@uffner.com
MFC after:	3 weeks
2019-01-20 05:52:16 +00:00
gonzo
7a9a7ddd80 [ifconfig] Print more WPS attributes in verbose "list scan" output
- Move WPS related defines to dedicated file
- Add handlers for more WPS attributes

PR:		217317
Submitted by:	J.R. Oldroyd <fbsd@opal.com>
MFC after:	3 weeks
2019-01-20 00:45:44 +00:00
tsoome
e71ca563ea ixgbe: this statement may fall through warnings with gcc
The recent gcc versions (7 and 8 at least) can check for switch case
statements for fall through (implicit-fallthrough). When fall through
is intentional, the default method for warning suppression is to place
comment /* FALLTHROUGH */ exactly before next case statement.

Differential Revision:	https://reviews.freebsd.org/D18577
2019-01-19 20:45:41 +00:00
avos
1270bd5e41 net80211: drop m_pullup call from ieee80211_crypto_decap.
For most wireless drivers Rx mbuf is allocated as one
contiguous chunk; only few are using chains for allocations -
but even then at least MCLBYTES (minus Rx descriptor size) is
available in the first mbuf.

In addition to the above, m_pullup was never called here - otherwise,
reallocation will break post-crypto_decap logic (ieee80211_decap,
ieee80211_deliver_data...), so just remove it; length check is left
in case if some truncated frame appears here.

PR:		234241
MFC after:	1 week
2019-01-19 16:04:26 +00:00
gonzo
4881e4aa99 [aic7xxx] Use correct product name 29320LPE instead of non-existent 39320LPE
The PCI id belongs to Adaptec 29320LPE controller. The same fix also was
merged[1] to OpenBSD driver ~6 years ago.

[1] https://github.com/openbsd/src/commit/f997b5

PR:		172133
Submitted by:	henning.petersen@t-online.de
MFC after:	 1 week
2019-01-19 05:31:48 +00:00
jhibbits
1ab2f0fd19 dpaa: fix 32-bit build
Book-E powerpc uses 64-bit vm_paddr_t, and 32-bit powerpc has 32-bit pointers,
so gcc errors with cast to pointer from integer of different size.  As this will
not actually be used in reality anyway, simply quiet the warning by casting
through uintptr_t.

MFC after:	3 weeks
MFC with:	r343168
2019-01-19 05:20:31 +00:00
jhibbits
c20f3fa6b6 powerpc/dpaa: Handle DMAP virtual addresses in DPAA
sendfile(2) appears to now use DMAP wherever possible.  These addresses are not
managed by pmap, so pmap_kextract() returns a 0 physical address, causing
failure.

This change fixes nginx running on P5020 SoC.

MFC after:	3 weeks
2019-01-19 04:54:12 +00:00
jhibbits
8161ca87dc powerpc: Fix opaque irq data initialization
The powerpc_intr structure is not zero-initialized, so on an invariants
build would panic in the xics driver with an invalid pointer.  Also fix the
xics driver to share the private data setup code between xics_enable() and
xics_bind().

Reported by:	Leonardo Bianconi
2019-01-19 04:47:19 +00:00
cem
e87da0fa26 vmm(4): Mask Spectre feature bits on AMD hosts
For parity with Intel hosts, which already mask out the CPUID feature
bits that indicate the presence of the SPEC_CTRL MSR, do the same on
AMD.

Eventually we may want to have a better support story for guests, but
for now, limit the damage of incorrectly indicating an MSR we do not yet
support.

Eventually, we may want a generic CPUID override system for
administrators, or for minimum supported feature set in heterogenous
environments with failover.  That is a much larger scope effort than
this bug fix.

PR:		235010
Reported by:	Rys Sommefeldt <rys AT sommefeldt.com>
Sponsored by:	Dell EMC Isilon
2019-01-18 23:54:51 +00:00
wulf
0a62e62d7a psm(4): detect Lenovo top-button clickpads
libinput has special handling for Lenovo ThinkPad *40 series, where it
treats clicks on the top button area as if they came from the TrackPoint:
https://wayland.freedesktop.org/libinput/doc/latest/t440-support.html

Detect these devices and set the corresponding evdev property.

Submitted by:		Greg V <greg@unrelenting.technology>
MFC after:		2 weeks
Differential Revision:	https://reviews.freebsd.org/D18676
2019-01-18 22:20:29 +00:00
brooks
8ba0807050 Make SIFTR work again after r342125 (D18443).
Correct a logic error.

Only disable when already enabled or enable when disabled.

Submitted by:	Richard Scheffenegger
Reviewed by:	Cheng Cui
Obtained from:	Cheng Cui
MFC after:	3 days
Differential Revision:	https://reviews.freebsd.org/D18885
2019-01-18 21:46:38 +00:00
gonzo
d06a69787c [usb] Add HID_IGNORE quirks for multiple UPS devices
Without HID_IGNORE quirk enabled these models appear in the system as a uhid
devices while NUT (Network UPS Tool) expects them to be ugen.

PR:		131521
Submitted by:	Naoyuki Tai <ntai@smartfruit.com>, John Bayly <john.bayly@tipstrade.net>
MFC after:	1 week
2019-01-18 21:00:54 +00:00
kib
23a6183735 i386/PAE busdma: allow more bounce pages.
If i386 has more than 4G of memory, allow the same number of busdma
bounce pages as for amd64.  In fact, in this case bouncing sometimes
is much heavier than on amd64.

Reviewed by:	markj
Tested by:	pho
Sponsored by:	The FreeBSD Foundation
MFC after:	2 weeks
Differential revision:	https://reviews.freebsd.org/D18854
2019-01-18 13:43:11 +00:00
kib
687d725a68 x86 busdma: fix mis-use of bus_addr_t where vm_paddr_t is assumed.
Right now bus_addr_t and vm_paddr_t are always aliased to the same
underlying integer type on x86, which makes the interchange hard to
detect.  Shortly, i386 kernel would use uint64_t for vm_paddr_t to
enable automatic use of PAE paging structures if hardware allows it,
while bus_addr_t would be extended to 64bit only when PAE option is
specified.

Fix all places that were identified as using bus_addr_t while page
address was assumed.  This was performed by testing the complete PAE
merging patch on machine with > 4G of RAM enabled.

Reviewed by:	markj
Tested by:	pho
Sponsored by:	The FreeBSD Foundation
MFC after:	2 weeks
Differential revision:	https://reviews.freebsd.org/D18854
2019-01-18 13:38:56 +00:00
kib
db5030058f MI VM: Make it possible to set size of superpage at boot instead of compile time.
In order to allow single kernel to use PAE pagetables on i386 if
hardware supports it, and fall back to classic two-level paging
structures if not, superpage code should be able to adopt to either 2M
or 4M superpages size.  There I make MI VM structures large enough to
track the biggest possible superpage, by allowing architecture to
define VM_NFREEORDER_MAX and VM_LEVEL_0_ORDER_MAX constants.
Corresponding VM_NFREEORDER and VM_LEVEL_0_ORDER symbols can be
defined as runtime values and must be less than the _MAX constants.
If architecture does not define _MAXs, it is assumed that _MAX ==
normal constant.

Reviewed by:	markj
Tested by:	pho (as part of the larger patch)
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D18853
2019-01-18 13:35:06 +00:00
kib
9c01c6857e nvdimm: initialize SPA uuids statically.
The SPA ids are published numbers, so it's safe (if not a bit
annoying) to copy them into a source file.

Submitted by:	D Scott Phillips <d.scott.phillips@intel.com>
Sponsored by:	Intel Corporation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D18733
2019-01-18 10:54:36 +00:00
kib
a2c54a9b2e nvdimm: add a driver for the NVDIMM root device
The NVDIMM root device is parent to the individual ACPI NVDIMM
devices.  Add a driver for the NVDIMM root device that can own
enumeration of NVDIMM devices as well as NVDIMM SPA ranges that the
system has.

Submitted by:	D Scott Phillips <d.scott.phillips@intel.com>
Sponsored by:	Intel Corporation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D18346
2019-01-18 10:45:27 +00:00
kp
9cbcdac441 pf: fix pfsync breaking carp
Fix missing initialisation of sc_flags into a valid sync state on clone which
breaks carp in pfsync.

This regression was introduce by r342051.

PR:		235005
Submitted by:	smh@FreeBSD.org
Pointy hat to:	kp
MFC after:	3 days
Differential Revision:	https://reviews.freebsd.org/D18882
2019-01-18 08:19:54 +00:00
gonzo
14fafba2ca [ata] Add workaround for KingDian S200 SSD crash on receiving TRIM command
- Add ADA_Q_NO_TRIM quirk to be used with the device that falsely advertise TRIM support
- Add ADA_Q_NO_TRIM entry for KingDian S200 SSD

PR:		222802
Submitted by:	Bertrand Petit <bsdpr@phoe.frmug.org>
MFC after:	1 week
2019-01-18 04:23:52 +00:00
cem
301370aa3e ioat(4): Set __result_use_check on ioat_acquire_reserve
Even M_WAITOK callers must check for failure.  For example, if the device is
quiescing, either due to automatic error-recovery induced reset, or due to
administrative detach, the routine will return ENXIO and the acquire
reference will not be held.  So, there is no mode in which it is safe to
assume the routine succeeds without checking.

Sponsored by:	Dell EMC Isilon
2019-01-17 23:21:02 +00:00
cem
2425e5de57 Add definitions for AMD Spectre/Meltdown CPUID information
No functional change, aside from printing recognized bits in CPU
identification.

The bits are documented in 111006-B "Indirect Branch Control Extension"[1] and
124441 "Speculative Store Bypass Disable."[2]

Notably missing (left as future work):
  * Integration with hw.spec_store_bypass_disable and hw_ssb_active flag,
    which are currently Intel-specific
  * Integration with hw_ibrs_active global flag, which are currently
    Intel-specific
  * SSB_NO integration in hw_ssb_recalculate()
  * Bhyve integration (PR 235010)

[1]:
https://developer.amd.com/wp-content/resources/111006-B_AMD64TechnologyIndirectBranchControlExtenstion_WP_7-18Update_FNL.pdf

[2]:
https://developer.amd.com/wp-content/resources/124441_AMD64_SpeculativeStoreBypassDisable_Whitepaper_final.pdf

PR:		235010 (related, but does not fix)
MFC after:	a week
2019-01-17 19:44:47 +00:00
kevans
191a9c704e Revert r343095
This was intended to fix the soft reset timeout on boot for OrangePi One/R1
with internal PHY, but seems to cause other problems later on due to soft
resetting around some state changes that may or may not make the NIC
non-functional.

Reverting this for now while a better solution is sought out.
2019-01-17 18:51:56 +00:00
mckusick
72a21ba0f6 Create new EINTEGRITY error with message "Integrity check failed".
An integrity check such as a check-hash or a cross-correlation failed.
The integrity error falls between EINVAL that identifies errors in
parameters to a system call and EIO that identifies errors with the
underlying storage media. EINTEGRITY is typically raised by intermediate
kernel layers such as a filesystem or an in-kernel GEOM subsystem when
they detect inconsistencies. Uses include allowing the mount(8) command
to return a different exit value to automate the running of fsck(8)
during a system boot.

These changes make no use of the new error, they just add it. Later
commits will be made for the use of the new error number and it will
be added to additional manual pages as appropriate.

Reviewed by:    gnn, dim, brueffer, imp
Discussed with: kib, cem, emaste, ed, jilles
Differential Revision: https://reviews.freebsd.org/D18765
2019-01-17 06:35:45 +00:00
kib
0dd0b09e39 Trim whitespace at EoL, use tabs instead of spaces for indent.
PR:  235004
Submitted by:	Jose Luis Duran <jlduran@gmail.com>
MFC after:	3 days
2019-01-17 05:15:25 +00:00
kib
23ffc0a0c1 Re-wrap long line after r341827.
Sponsored by:	The FreeBSD Foundation
MFC after:	3 days
2019-01-17 04:51:05 +00:00
gonzo
fd882434ad [usb] Add quirk for SmartG2 USB memory key
PR:		167001
Submitted by:	Daan Vreeken [PA4DAN] <Daan@vitsch.nl>
MFC after:	1 week
2019-01-16 22:29:34 +00:00
gonzo
407b0bb118 [mv] Fix invalid condition in fdt_fixup_ranges
Add parentheses to perform assignment before comparison. The prior
condition worked because fdt_parent_addr_cells returns 1 for the DTB
on which fdt_fixup_ranges is called and accidentally par_addr_cells
ends up to be set to the same value.

PR:		210705
Submitted by:	David Binderman <dcb314@hotmail.com>
MFC after:	1 week
2019-01-16 21:13:50 +00:00
glebius
35140f62be Fix mistake in r343030: move nswbuf calculation back to
kern_vfs_bio_buffer_alloc(), because in init_param2() nbuf
isn't really initialized yet.

Pointed out by:	bde
2019-01-16 20:20:38 +00:00
glebius
39991209c1 Do not reserve KVA for paging bufs in vm_ksubmap_init(), since now
they allocate it in pbuf_init(). This should have been done together
with r343030.
2019-01-16 20:14:16 +00:00
kevans
8dce51a92a awg: Move MAC soft reset to awg_init_locked to avoid soft reset timeout
From NetBSD: Since the MAC can get stuck in reset state with no link, ignore
reset timeouts and continue with initializing the device.

Fixes "soft reset timeout" issue at boot with no network cable plugged in.

awg_init may be called multiple times throughout normal interface usage, so
the tx/rx descriptor base address registers must be written after each MAC
reset and are moved as such.

This problem has been observed on FreeBSD, H3/H2+ devices with an internal
PHY (includes OrangePi R1, OrangePi One at least).

Reviewed by:	manu, ganbold
Obtained from:	NetBSD
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D18844
2019-01-16 14:42:33 +00:00
avos
97c057b459 iwn(4): (partially) rewrite A-MPDU Tx path
Generic Tx stats fixes:
- do not try to parse "aggregation status" for single frames; send them
to iwn_tx_done() instead;
- try to attach mbuf / node reference pair to reported BA events;
allows to fix reported status for ieee80211_tx_complete() and ifnet counters
(previously all A-MPDU frames were counted as failed - see PR 210211);
requires few more firmware bug workarounds;
- preserve short / long retry counters for wlan_amrr(4)
(disabled for now - causes significant performance degradation).
- Add new IWN_DEBUG_AMPDU debug category.
- Add one more check into iwn_tx_data() to prevent aggregation ring
overflow.
- Workaround 'seqno % 256' != 'current Tx slot' case (until D9195 is not
in the tree).
- Improve watchdog timer updates (previously watchdog check was omitted
when at least one frame was transmitted).
- Stop Tx when memory leak in currently used ring was detected (unlikely
to happen).
- Few other minor fixes.

Was previously tested with:
 - Intel 6205, STA mode (Tx aggregation behaves much better now).
 - Intel 4965AGN, STA mode (still unstable).

PR:		192641, 210211
Reviewed by:	adrian, dhw
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D10728
2019-01-16 12:33:06 +00:00
avos
9260667a71 rtwn(4): clear 'basic' rate bit before calculating RTS/CTS rate.
Rate tables have this bit set to indicate minimal set of basic rates;
however, it overlappes with MCS bit, so rate2ridx() will treat them as
an 11n rate.

Due to the current rates setup the issue can be reproduced only
in 5GHz band with 11n / protection enabled.

Tested with RTL8821AU, HOSTAP mode.

MFC after:	5 days
2019-01-16 12:11:29 +00:00
tuexen
eb82fa876e Limit the user-controllable amount of memory the kernel allocates
via IPPROTO_SCTP level socket options.

This issue was found by running syzkaller.

MFC after:	1 week
2019-01-16 11:33:47 +00:00
avos
8eccc44452 rtwn_usb(4): add new USB id for RTL8821AU
Reported by:	Mike Tancsa <mike@sentex.net>
Tested by:	Mike Tancsa <mike@sentex.net>
MFC after:	3 days
2019-01-16 10:33:51 +00:00
kib
c3c5050b82 Style(9) fixes for x86/busdma_bounce.c.
Remove extra parentheses.  Adjust indents and lines fill.

Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
2019-01-16 06:10:55 +00:00
kib
e972cbaed6 Remove unused prototype.
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
2019-01-16 05:51:03 +00:00
kib
a6ba8f5a54 Improve iflib busdma(9) KPI use.
- Specify BUS_DMA_NOWAIT for bus_dmamap_load() on rx refill, since
  callbacks are not supposed to be used.
- Match tso/non-tso tags to corresponding tx map operations.  Create
  separate tso maps for tx descriptors.  In particular, do not use
  non-tso tag to load, unload, or destroy a map created with tso tag.
- Add missed bus_dmamap_sync() calls.
  Submitted by: marius.

Reported and tested by:	pho
Reviewed by:	marius
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
2019-01-16 05:44:14 +00:00
kib
f34dbcf7d0 Implement shmat(2) flag SHM_REMAP.
Based on the description in Linux man page.

Reviewed by:	markj, ngie (previous version)
Sponsored by:	Mellanox Technologies
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D18837
2019-01-16 05:15:57 +00:00