The PowerPC context switch waited for the incoming thread to leave
blocked_lock before releasing the outgoing thread. If two CPUs selected
each other's running threads concurrently, both CPUs waited for the
other to perform the release and neither could progress. This appeared
as intermittent boot hangs under QEMU MTTCG when taskqueue threads were
bound to opposite CPUs.
8df2e54214 ("powerpc: put the isync inside the TD_LOCK()...")
attempted to fix the same hang by moving isync into the polling loop.
That did not address the circular wait: isync cannot cause either CPU to
execute the release store after the loop. It only added context
synchronization to failed iterations and changed timing. Move isync back
to the successful exit, which preserves acquire ordering for subsequent
context loads.
Match the ordering used by other architectures: publish the outgoing
thread's new lock before waiting for the incoming thread. Apply the
correction to both 32-bit and 64-bit switch paths.
The 2015 change moved the release after the stack switch because the old
implementation continued through pmap_activate() and optional state
restoration on the outgoing thread's stack after making that thread
runnable. The switch path has since changed: after the release it only
polls wired td_lock state using registers, then immediately loads the
incoming PCB_SP before updating per-CPU state or making any calls.
cpu_switch() also runs with external and decrementer interrupts disabled
by spinlock_enter(). Thus this does not restore the post-release call
window that the 2015 change corrected.
Reviewed by: jhb, jhibbits
Approved by: jhb (mentor)
Fixes: 53607fe3cc ("Fix an extremely subtle concurrency bug...")
Fixes: 7a49d964d3 ("Merge r278429 from ppc64:")
Fixes: 8df2e54214 ("powerpc: put the isync inside the TD_LOCK()...")
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59742
(cherry picked from commit 0571d8a0cc)
doff + dlen overflows unsigned int when both values are close to UINT_MAX,
causing the wrong branch to execute and passing an unbounded length to
append_binary_data(). Rewrite the comparison to avoid the addition.
Reviewed by: markj
Fixes: f81cdf24ba ("bhyve: Add support for XML register definitions")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60847
(cherry picked from commit 5ce0ab7355)
When an application uses inotify to watch a directory,
vn_inotify_add_watch() reads the directory entries and does a name
lookup so as to induce the filesystem to create namecache entries.
Some filesystems expect the directory to be opened before VOP_READDIR
can be called, so do that.
PR: 299239
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60782
(cherry picked from commit de80428118)
vmm doesn't implement them, and after commit 2272fac218
("hwpmc: Add support for AMD-only IRPERF in hwpmc PERF class"), FreeBSD
guests fail to boot since they access the unimplemented IRPERF MSR.
MFC after: 1 week
(cherry picked from commit c83e075d72)
We cannot simply treat a pointer to struct oin6_aliasreq as a pointer to
struct in6_aliasreq: the latter is larger. In particular, the store to
ifra->ifra_vhid is out of bounds.
Since OSIOCAIFADDR_IN6 does not need to copy data back out, it can
simply use a struct in6_ifaliasreq on the stack.
Reported by: Andrew <[email protected]>
Reviewed by: pouria
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60184
(cherry picked from commit c109a68145)
The TCP-over-UDP ICMP callback receives ip6c_m as a borrowed chain owned
by icmp6_notify_error. It used m_pulldown() to obtain a contiguous UDP
header even though that API frees the complete chain when the requested
range is unavailable. The callback could then return without
propagating the lost ownership, leaving raw ICMP delivery to read and
free a stale head.
Validate that the complete UDP header was quoted, copy it through the
chain with m_copydata(), and temporarily advance the parser offset
instead of consuming bytes from the caller-owned packet.
A remote sender can reach the old path when TCP UDP tunneling is enabled
by quoting the configured local UDP source port in an ICMPv6 error and
including only four through seven UDP-header bytes.
Signed-off-by: Andrew Griffiths <[email protected]>
Reviewed by: pouria, tuexen, markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60143
(cherry picked from commit 80af0a32e4)
If we're killing a jail which has some user refs pending, then we would
first drop our ref and then kill all processes in the prison. However,
it's possible for the prison to be freed before we finish that
operation, generally if the processes exit on their own before
prison_proc_iterate() returns.
Thus, defer the release of the prison refcount until after we've killed
all procs.
Reviewed by: jamie
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59984
(cherry picked from commit 79af745f4c)
"stack overflow detected" sounds like the thread faulted because it
ran out of stack space.
Reported by: Andrew <[email protected]>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 0f4b7d28cc)
When we receive an ICMP redirect, rib_add_redirect() is used to apply
the redirect to all FIBs. This has been the case since support for
multiple FIBs was added. However, it seems rather dubious: the new
gateway might not be routable from all FIBs, and the validation done for
v4 redirects in icmp_verify_redirect_gateway() is only applied to the
FIB from which the redirect originated.
Modify the handler to apply the redirect only in the originating FIB.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Reviewed by: pouria, zlei, glebius, melifaro
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59567
(cherry picked from commit 01a95394ab)
There is a chance that the m_pullup() call immediately above invalidated
the "ip" pointer, so refresh it as we do with the IGMP header.
Otherwise the test in igmp_input_v3_query() for whether the packet is an
IGMPv3 general query might use a pointer to a freed mbuf.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit dc47a6940d)
The SIOCADDMULTI and SIOCDELMULTI handlers add or delete a link-layer
multicast address from an interface's multicast filter list. The
link-layer address is passed using the ifr_addr field of the request
structure.
struct ifreq's ifr_addr field is a struct sockaddr, which is a fair bit
smaller than struct sockaddr_dl (though big enough to hold an ethernet
address). Existing callers set the sockaddr length to
sizeof(struct sockaddr_dl), which is too large, and causes OOB accesses
when if_findmulti() is used to compare the address with others, or when
if_addmulti() makes a copy.
Fix this without breaking compatibility: copy the user-supplied address
into a sockaddr_dl on the stack, and use the latter for the respective
operation.
Also validate the sockaddr_dl internal length fields, suggested by zlei.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by: zlei, ae, glebius
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59919
(cherry picked from commit 10729d0ce1)
aout_coredump() was removed in commit 1eecfae3e5.
No functional change intended.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 4523cbbfef)
- refcount_acquire() returns the old value, use that to assert that the
old value was non-zero.
- refcount_release() already asserts that the refcount value is
non-zero, so don't bother asserting that again in the jail code.
- Use __diagused instead of having separate implementations for
INVARIANTS and !INVARIANTS.
No functional change intended.
Reviewed by: jamie
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59983
(cherry picked from commit de6ee1fde8)
We were not acquiring the global sysvshm lock when handling cleanup of
sysvshm segments. Acquire the lock in shm_prison_cleanup() instead, to
be consistent with the sysv semaphore code.
Reviewed by: jamie
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60030
(cherry picked from commit 546d150619)
ipf_lookup_iterate() validates iter.ili_unit with
if (iter.ili_unit < IPL_LOGALL && iter.ili_unit > IPL_LOGMAX)
or alternatively,
if (iter.ili_unit < -1 && iter.ili_unit > 7)
ipf_lookup_add(), ipf_lookup_delete(), ipf_lookup_stats()
ipf_lookup_flush() validate with a ||
Submitted by calif.io for the OpenAI Patch The Planet program
Signed-off-by: Andrew Griffiths <[email protected]>
Reviewed by: markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59726
(cherry picked from commit cb035c19c3)
atomic_load_* is a read, not a write. Otherwise KASAN will report a
use-after-free via atomic_load_* as a write rather than a read.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 0aa055edc1)
2026-10-26 14:12:14 +00:00
20 changed files with 138 additions and 124 deletions
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Minsoo Choo