src/8/lib/libkvm/kvm_getswapinfo.3

362800

[ +2 -2 ]

diff (colored)

MFC r362623:

Fix copy/paste mistake in kvm_getswapinfo(3)

It seems this manpage was copied from kvm_getloadavg(3), but the
DIAGNOSTICS section was not updated completely. Update the section with
correct information about a return value of -1.

src/8/lib/msun/src/e_exp.c	352835	[ +2 -2 ]	diff (colored)
src/8/lib/msun/src/e_expf.c	352835	[ +2 -2 ]	diff (colored)
src/8/lib/msun/src/s_expm1.c	352835	[ +1 -1 ]	diff (colored)
src/8/lib/msun/src/s_expm1f.c	352835	[ +1 -1 ]	diff (colored)

MFC r352710:

Do not left-shift a negative number (inducing undefined behavior in
C/C++) in exp(3), expf(3), expm1(3) and expm1f(3) during intermediate
computations that compute the IEEE-754 bit pattern for |2**k| for
integer |k|.

The implementations of exp(3), expf(3), expm1(3) and expm1f(3) need to
compute IEEE-754 bit patterns for 2**k in certain places.  (k is an
integer and 2**k is exactly representable in IEEE-754.)

Currently they do things like 0x3FF0'0000+(k<<20), which is to say they
take the bit pattern representing 1 and then add directly to the
exponent field to get the desired power of two.  This is fine when k is
non-negative.

But when k<0 (and certain classes of input trigger this), this
left-shifts a negative number -- an operation with undefined behavior in
C and C++.

The desired semantics can be achieved by instead adding the
possibly-negative k to the IEEE-754 exponent bias to get the desired
exponent field, _then_ shifting that into its proper overall position.

(Note that in case of s_expm1.c and s_expm1f.c, there are SET_HIGH_WORD
and SET_FLOAT_WORD uses further down in each of these files that perform
shift operations involving k, but by these points k's range has been
restricted to 2 < k <= 56, and the shift operations under those
circumstances can't do anything that would be UB.)

Submitted by:	Jeff Walden, https://github.com/jswalden
Obtained from:	https://github.com/freebsd/freebsd/pull/411
Obtained from:	https://github.com/freebsd/freebsd/pull/412

src/8/sys/dev/sound/pci/csa.c

342468

[ +1 -0 ]

diff (colored)

MFC r338200: Adding device ID for Terratec SiXPack 5.1+.

src/8/sys/dev/sound/midi/sequencer.c

339723

[ +15 -2 ]

diff (colored)

MFC r339582:
Drop sequencer mutex around uiomove() and make sure we don't move more bytes
than is available, else a panic might happen.

Found by:		Peter Holm <peter@holm.cc>
Sponsored by:		Mellanox Technologies

src/8/sys/dev/sound/midi/sequencer.c

339718

[ +1 -1 ]

diff (colored)

MFC r339581:
Fix off-by-one which can lead to panics.

Found by:		Peter Holm <peter@holm.cc>
Sponsored by:		Mellanox Technologies

src/8/sys/amd64/amd64/elf_machdep.c

338756

[ +3 -0 ]

diff (colored)

MFC r309748 (by glebius):

Treat R_X86_64_PLT32 relocs as R_X86_64_PC32.

If we load a binary that is designed to be a library, it produces
relocatable code via assembler directives in the assembly itself
(rather than compiler options).  This emits R_X86_64_PLT32 relocations,
which are not handled by the kernel linker.

Submitted by:	gallatin
Reviewed by:	kib
PR:		231451

src/8/sys/dev/sound/pci/csa.c

338328

[ +1 -1 ]

diff (colored)

MFC r338038: Extending the delay cycles to give the codec more time to pump ADC data across the AC-link.

Without this patch, some CS4614 cards will need users to reload the driver manually or
the hardware won't be initialised properly. Something like:

	# kldload snd_csa
	# kldunload snd_csa
	# kldload snd_csa

Tested with:	Terratec SiXPack 5.1+

src/8/sys/dev/bxe/bxe.c

337513

[ +29 -13 ]

diff (colored)

MFC r336438

Fixes for  the following issues:
1. Fix taskqueues drain/free to fix panic seen when interface is being
   bought down and in parallel asynchronous link events happening.

2. Fix bxe_ifmedia_status()

Submitted by:Vaishali.Kulkarni@cavium.com and Anand.Khoje@cavium.com

src/8/sys/dev/bxe/bxe.c

333437

[ +5 -5 ]

diff (colored)

MFC r333004
Fix Issue with adding MUltiCast Addresses. When multicast addresses are
added/deleted, the delete the multicast addresses previously programmed
in HW and reprogram the new set of multicast addresses.

Submitted by:	Vaishali.Kulkarni@cavium.com

src/8/crypto/openssl/crypto/asn1/a_type.c	327537	[ +0 -2 ]	diff (colored)
src/8/crypto/openssl/crypto/asn1/tasn_dec.c	327537	[ +0 -2 ]	diff (colored)
src/8/crypto/openssl/crypto/asn1/tasn_enc.c	327537	[ +0 -2 ]	diff (colored)
src/8/crypto/openssl/crypto/bio/b_print.c	327537	[ +314 -264 ]	diff (colored)
src/8/crypto/openssl/crypto/bn/bn.h	327537	[ +24 -14 ]	diff (colored)
src/8/crypto/openssl/crypto/bn/bn_exp.c	327537	[ +52 -13 ]	diff (colored)
src/8/crypto/openssl/crypto/bn/bn_print.c	327537	[ +33 -24 ]	diff (colored)

MFS:	r295060, r296462, r296597-296598, r299053, r306229, r306335, r308200

Sync. OpenSSL with stable/9.

r295060 (delphij):
Fix OpenSSL SSLv2 ciphersuite downgrade vulnerability. [SA-16:11]

r296462, r296597-296598 (delphij):
Fix multiple OpenSSL vulnerabilities. [SA-16:12]

r299053 (delphij):
Fix several OpenSSL vulnerabilities. [SA-16:17]

r306229, r306335 (delphij):
Fix multiple OpenSSL vulnerabilities. [SA-16:26]

r308200 (delphij):
Fix OpenSSL remote DoS vulnerability. [SA-16:35]

Requested by:	danfe

src/8/crypto/openssl/CHANGES	327536	[ +14 -0 ]	diff (colored)
src/8/crypto/openssl/FAQ	327536	[ +0 -974 ]	diff (colored)

Merge OpenSSL 0.9.8zh.

Requested by:	danfe

src/8/contrib/gcclibs/include/objalloc.h	326795	[ +2 -2 ]	diff (colored)
src/8/contrib/gcclibs/libiberty/objalloc.c	326795	[ +9 -2 ]	diff (colored)

MFC r301291:

  libiberty: prevent integer overflow.

  Take care of very old bug leading to heap-buffer overflow by
  processing certain file headers via bfd binary.

  PR:		200888
  Obtained from:	OpenBSD

Approved by:	pfg

src/8/share/man/man4/tap.4	326694	[ +9 -2 ]	diff (colored)
src/8/share/man/man4/tun.4	326694	[ +9 -2 ]	diff (colored)
src/8/sys/net/if_tap.c	326694	[ +2 -1 ]	diff (colored)
src/8/sys/net/if_tun.c	326694	[ +2 -1 ]	diff (colored)

MFC r326362:
Disallow TUN and TAP character device IOCTLs to modify the network device
type to any value. This can cause page faults and panics due to accessing
uninitialized fields in the "struct ifnet" which are specific to the network
device type.

Found by:	jau@iki.fi
PR:		223767
Sponsored by:	Mellanox Technologies

src/8/sys/dev/sound/pcm/buffer.c	319068	[ +1 -0 ]	diff (colored)
src/8/sys/tools/sound/snd_fxdiv_gen.awk	319068	[ +5 -2 ]	diff (colored)

MFC r318860:
Declare the "snd_fxdiv_table" once. This shaves around 24Kbytes of
binary data from sound.ko and the kernel.

src/8/sys/dev/sound/pcm/feeder_mixer.c	318981	[ +4 -4 ]	diff (colored)
src/8/sys/tools/sound/snd_fxdiv_gen.awk	318981	[ +3 -3 ]	diff (colored)

MFC r318820:
Increase the allowed maximum number of audio channels from 31 to 127
in the PCM feeder mixer. Without this change a value of 32 channels is
treated like zero, due to using a mask of 0x1f, causing a kernel
assert when trying to playback bitperfect 32-channel audio. Also
update the AWK script which is generating the division tables to
handle more than 18 channels. This commit complements r282650.

src/8/share/man/man4/usb.4

318339

[ +1 -1 ]

diff (colored)

MFC r317584:
Correct manual page link to usbdi(9).

src/8/sys/fs/tmpfs/tmpfs.h	317883	[ +3 -0 ]	diff (colored)
src/8/sys/fs/tmpfs/tmpfs_vfsops.c	317883	[ +12 -4 ]	diff (colored)

MFC r230208, r230252, r234346:

  Add nfs export support to tmpfs(5)

  Return EOPNOTSUPP since we only support update mounts for NFS export.

  tmpfs: Allow update mounts only for certain options.
  Since r230208 update mounts were allowed if the list of mount options
  contained the "export" option. This is not correct as tmpfs doesn't really
  support updating all options.

src/8/sys/dev/bxe/bxe.c	315884	[ +250 -80 ]	diff (colored)
src/8/sys/dev/bxe/bxe.h	315884	[ +2 -3 ]	diff (colored)
src/8/sys/dev/bxe/bxe_elink.c	315884	[ +68 -3 ]	diff (colored)
src/8/sys/dev/bxe/bxe_stats.c	315884	[ +2 -0 ]	diff (colored)
src/8/sys/dev/bxe/bxe_stats.h	315884	[ +17 -0 ]	diff (colored)

MFC r314365
      1. state checks in bxe_tx_mq_start_locked() and bxe_tx_mq_start() to
         sync threads during interface down or detach.
      2. add sysctl to set pause frame parameters
      3. increase max segs for TSO packets to BXE_TSO_MAX_SEGMENTS (32)
      4. add debug messages for PHY
      5. HW LRO support restricted to FreeBSD versions 8.x and above.

Submitted by:	Vaishali.Kulkarni@cavium.com

src/8/sys/dev/acpica/acpi_cmbat.c

315266

[ +29 -5 ]

diff (colored)

MFC r314328:

Fix startup race initialising ACPI CM battery structures on MacBookPro.

During acpi_cmbat_attach() the acpi_cmbat_init_battery() notification
handler is registered. It has been observed this notification handler
can be called instantly, before the attach routine has returned. In
the notification handler there is a call to device_is_attached() which
returns false. Because the softc is set we know an attach is in
progress and the fix is simply to wait and try again in this case.

Reviewed by:		avg @

src/8/sys/kern/kern_proc.c

315262

[ +9 -0 ]

diff (colored)

MFC r313941:

Make sure the thread constructor and destructor eventhandlers are
called for all threads belonging to a procedure. Currently the first
thread in a procedure is kept around as an optimisation step and is
never freed. Because the first thread in a procedure is never freed
nor allocated, its destructor and constructor callbacks are never
called which means per thread structures allocated by dtrace and the
Linux emulation layers for example, might be present for threads which
don't need these structures.

This patch adds a thread construction and destruction call for the
first thread in a procedure.

Tested:			dtrace, linux emulation
Reviewed by:		kib @
Sponsored by:		Mellanox Technologies

src/8/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c

314713

[ +3 -0 ]

diff (colored)

MFC r314572:

Fix null pointer dereference in zfs_freebsd_setacl().

Prevents unprivileged users from panicking the kernel by calling
__acl_delete_*() on files or directories inside a ZFS mount.

src/8/sys/dev/acpica/acpi_ec.c

310256

[ +31 -9 ]

diff (colored)

MFC r309400:
Fix for endless recursion in the ACPI GPE handler during boot.

When handling a GPE ACPI interrupt object the EcSpaceHandler()
function can be called which checks the EC_EVENT_SCI bit and then
recurse on the EcGpeQueryHandler() function. If there are multiple GPE
events pending the EC_EVENT_SCI bit will be set at the next call to
EcSpaceHandler() causing it to recurse again via the
EcGpeQueryHandler() function. This leads to a slow never ending
recursion during boot which prevents proper system startup, because
the EC_EVENT_SCI bit never gets cleared in this scenario.

The behaviour is reproducible with the ALASKA AMI in combination with
a newer Skylake based mainboard in the following way:

Enter BIOS and adjust the clock one hour forward. Save and exit the
BIOS. System fails to boot due to the above mentioned bug in
EcGpeQueryHandler() which was observed recursing multiple times.

This patch adds a simple recursion guard to the EcGpeQueryHandler()
function and also also adds logic to detect if new GPE events occurred
during the execution of EcGpeQueryHandler() and then loop on this
function instead of recursing.

Reviewed by:		jhb

src/8/sys/dev/sound/usb/uaudio.c

308574

[ +16 -2 ]

diff (colored)

MFC r308437 and r308461:
Range check the jitter values to avoid bogus sample rate adjustments.
The expected deviation should not be more than 1Hz per second. The USB
v2.0 specification also mandates this requirement. Refer to chapter
5.12.4.2 about feedback.

Allow higher sample rates to have more jitter than lower ones.

PR:		208791

src/8/sys/dev/puc/puc.c	308404	[ +1 -2 ]	diff (colored)
src/8/sys/dev/usb/controller/at91dci_atmelarm.c	308404	[ +0 -6 ]	diff (colored)
src/8/sys/dev/usb/controller/atmegadci_atmelarm.c	308404	[ +0 -6 ]	diff (colored)
src/8/sys/dev/usb/controller/ehci_ixp4xx.c	308404	[ +0 -6 ]	diff (colored)
src/8/sys/dev/usb/controller/ehci_pci.c	308404	[ +0 -6 ]	diff (colored)
src/8/sys/dev/usb/controller/musb_otg_atmelarm.c	308404	[ +0 -6 ]	diff (colored)
src/8/sys/dev/usb/controller/ohci_pci.c	308404	[ +0 -6 ]	diff (colored)
src/8/sys/dev/usb/controller/uhci_pci.c	308404	[ +0 -6 ]	diff (colored)
src/8/sys/dev/usb/controller/uss820dci_atmelarm.c	308404	[ +0 -6 ]	diff (colored)
src/8/sys/dev/usb/controller/xhci_pci.c	308404	[ +0 -6 ]	diff (colored)
src/8/sys/dev/usb/usb_device.c	308404	[ +1 -3 ]	diff (colored)
src/8/sys/kern/subr_bus.c	308404	[ +5 -3 ]	diff (colored)
src/8/sys/mips/atheros/ar71xx_ehci.c	308404	[ +0 -6 ]	diff (colored)
src/8/sys/mips/atheros/ar71xx_ohci.c	308404	[ +0 -6 ]	diff (colored)
src/8/sys/mips/cavium/usb/octusb_octeon.c	308404	[ +0 -6 ]	diff (colored)
src/8/sys/mips/rmi/xls_ehci.c	308404	[ +0 -6 ]	diff (colored)

MFC r307518:
Fix device delete child function.

When detaching device trees parent devices must be detached prior to
detaching its children. This is because parent devices can have
pointers to the child devices in their softcs which are not
invalidated by device_delete_child(). This can cause use after free
issues and panic().

Device drivers implementing trees, must ensure its detach function
detaches or deletes all its children before returning.

While at it remove now redundant device_detach() calls before
device_delete_child() and device_delete_children(), mostly in
the USB controller drivers.

Tested by:		Jan Henrik Sylvester <me@janh.de>
Reviewed by:		jhb
Differential Revision:	https://reviews.freebsd.org/D8070

src/8/sys/dev/usb/input/ums.c

308397

[ +9 -3 ]

diff (colored)

MFC r308144 and r308165:
Fixes for virtual T-axis buttons.

Make sure the virtual T-axis buttons gets cleared for USB mice which has
less than 6 buttons.

Make sure the virtual T-axis buttons generate button release event(s)
for continuous tilting.

PR:	213919
PR:	213957

src/8/sys/dev/usb/serial/u3g.c	306959	[ +6 -5 ]	diff (colored)
src/8/sys/dev/usb/usbdevs	306959	[ +1 -0 ]	diff (colored)

MFC r306478:
Add new USB ID.

While at it remove some whitespaces.

Submitted by:	Jose Luis Duran <jlduran@gmail.com>
PR:		213110

src/8/sys/dev/usb/input/ums.c

305831

[ +2 -2 ]

diff (colored)

MFC r305590:
Correctly map the USB mouse tilt delta values into buttons 5 and 6
instead of 3 and 4 which is used for the scroll wheel, according to
X.org.

PR:		170358

src/8/sys/dev/usb/template/usb_template.c	305736	[ +2 -2 ]	diff (colored)
src/8/sys/dev/usb/usb_device.c	305736	[ +40 -4 ]	diff (colored)
src/8/sys/dev/usb/usb_device.h	305736	[ +4 -1 ]	diff (colored)
src/8/sys/dev/usb/usb_generic.c	305736	[ +7 -4 ]	diff (colored)
src/8/sys/dev/usb/usb_request.c	305736	[ +3 -12 ]	diff (colored)
src/8/sys/dev/usb/usb_transfer.c	305736	[ +2 -2 ]	diff (colored)
src/8/sys/dev/usb/usb_util.c	305736	[ +2 -2 ]	diff (colored)
src/8/sys/sys/param.h	305736	[ +1 -1 ]	diff (colored)

MFC r305421:
Resolve deadlock between device_detach() and usbd_do_request_flags()
by reviving the SX control request lock and refining which lock
protects the common scratch area in "struct usb_device".

The SX control request lock was removed by r246759 because it caused a
lock order reversal with the USB enumeration lock inside
usbd_transfer_setup() as a function of r246616. It was thought that
reducing the number of locks would resolve the LOR, but because some
USB device drivers use usbd_do_request_flags() inside callback
functions, like in taskqueues, a deadlock may occur when these are
drained from device_detach(). By restoring the SX control request
lock usbd_do_request_flags() is allowed to complete its execution
when a USB device driver is detaching. By using the SX control request
lock to protect the scratch area, the LOR introduced by r246616 is
also resolved.

Bump the FreeBSD version while at it to force recompilation of all USB
kernel modules.

Found by:	avos@

src/8/sys/dev/usb/input/ukbd.c

305647

[ +47 -7 ]

diff (colored)

MFC r303765 and r304571:
Keep a reference count on USB keyboard polling to allow recursive
cngrab() during a panic for example, similar to what the AT-keyboard
driver is doing.

Make the UKBD USB transfers double buffered and set them up one by one,
so they are memory independent which allows for handling panics
triggered by the keyboard driver itself, typically via CTRL+ALT+ESC
sequences. Or if the USB keyboard driver was processing a key at the
moment of panic. Allow UKBD to be attached while keyboard polling is active.

src/8/lib/libusb/libusb20.c

305643

[ +13 -2 ]

diff (colored)

MFC r305284:
Fix array size issue when using the pre-scaling feature for
ISOCHRONOUS USB transfers. Make sure enough length and buffer pointers
are allocated when setting up the libusb transfer structure to support
the maximum number of frames the kernel can handle.