src/sys/dev, branch releng/10.2

- Use unsigned version of min() when handling arguments of SETFKEY ioctl.

2016-05-17T22:28:20Z

- Validate that user supplied control message length in sendmsg(2) is not negative. Security: SA-16:18 Security: CVE-2016-1886 Security: SA-16:19 Security: CVE-2016-1887 Submitted by: C Turt Approved by: so

o Fix OpenSSH xauth(1) command injection. [SA-16:14]

2016-03-16T22:31:04Z

o Fix incorrect argument validation in sysarch(2). [SA-16:15] o Fix Hyper-V KVP (Key-Value Pair) daemon indefinite sleep. [EN-16:04] o Fix hv_netvsc(4) incorrect TCP/IP checksums. [EN-16:05] Errata: FreeBSD-EN-16:04.hyperv Errata: FreeBSD-EN-16:05.hv_netvsc Security: FreeBSD-SA-16:14.openssh-xauth, CVE-2016-3115 Security: FreeBSD-SA-16:15.sysarch, CVE-2016-1885 Approved by: so

o Fix filemon and bmake meta-mode stability issues. [EN-16:01]

2016-01-14T09:10:46Z

o Fix invalid TCP checksums with pf(4). [EN-16:02.pf] o Fix YP/NIS client library critical bug. [EN-16:03.yplib] o Fix SCTP ICMPv6 error message vulnerability. [SA-16:01.sctp] o Fix ntp panic threshold bypass vulnerability. [SA-16:02.ntp] o Fix Linux compatibility layer incorrect futex handling. [SA-16:03.linux] o Fix Linux compatibility layer setgroups(2) system call. [SA-16:04.linux] o Fix TCP MD5 signature denial of service. [SA-16:05.tcp] o Fix insecure default bsnmpd.conf permissions. [SA-16:06.bsnmpd] Errata: FreeBSD-EN-16:01.filemon Errata: FreeBSD-EN-16:02.pf Errata: FreeBSD-EN-16:03.yplib Security: FreeBSD-SA-16:01.sctp, CVE-2016-1879 Security: FreeBSD-SA-16:02.ntp, CVE-2015-5300 Security: FreeBSD-SA-16:03.linux, CVE-2016-1880 Security: FreeBSD-SA-16:04.linux, CVE-2016-1881 Security: FreeBSD-SA-16:05.tcp, CVE-2016-1882 Security: FreeBSD-SA-16:06.bsnmpd, CVE-2015-5677 Approved by: so

MF-stable/10 r286263:

2015-08-04T00:11:38Z

Only match devices that belong to this driver. Approved by: re@ (gjb@)

MFC: r285843 (r286059 in stable/10)

2015-07-30T03:06:11Z

- Since r253161, uart_intr() abuses FILTER_SCHEDULE_THREAD for signaling uart_bus_attach() during its test that 20 iterations weren't sufficient for clearing all pending interrupts, assuming this means that hardware is broken and doesn't deassert interrupts. However, under pressure, 20 iterations also can be insufficient for clearing all pending interrupts, leading to a panic as intr_event_handle() tries to schedule an interrupt handler not registered. Solve this by introducing a flag that is set in test mode and otherwise restores pre-r253161 behavior of uart_intr(). The approach of additionally registering uart_intr() as handler as suggested in PR 194979 is not taken as that in turn would abuse special pccard and pccbb handling code of intr_event_handle(). [1] - Const'ify uart_driver_name. - Fix some minor style bugs. PR: 194979 [1] Reviewed by: marcel (earlier version) Approved by: re (gjb)

MFC r285928 Do not enable UDP checksum offloading when running on the

2015-07-30T02:22:38Z

Hyper-V on Windows Server 2012 and earlier hosts. Submitted by: whu Reviewed by: royger Approved by: re (gjb) Sponsored by: Microsoft OSTC Differential Revision: https://reviews.freebsd.org/D3102

MFS r285863 (jhb):

2015-07-29T00:57:54Z

Partially revert r284034. In particular, revert the final change in this MFC (281874). It broke suspend and resume on several Thinkpads (though not all) in 10 even though it works fine on the same laptops in HEAD. PR: 201239 Reported by: Kevin Oberman and several others Approved by: re (kib) Sponsored by: The FreeBSD Foundation

MFS r285918:

2015-07-27T17:53:11Z

MFC r285816: nvme: ensure csts.rdy bit is cleared before returning from nvme_ctrlr_disable Approved by: re (gjb) Sponsored by: Intel

MFS r285917:

2015-07-27T17:52:17Z

MFC r285815: nvme: properly handle case where pci_alloc_msix does not alloc all vectors Approved by: re (gjb) Sponsored by: Intel

MFS r285915:

2015-07-27T17:50:05Z

MFC r285767: nvd: set d_delmaxsize to full capacity of NVMe namespace The NVMe specification has no ability to specify a maximum delete size that is less than the full capacity of the namespace - so just using the namespace size is the correct value here. This fixes reported issues where ZFS trim on init looked like it was hanging the system - previously the default I/O max size (128KB on Intel NVMe controllers) was used for delete operations which worked out to only about 8MB/s. With this patch I can add an 800GB DC P3700 drive to a ZFS pool in about 15-20 seconds. Approved by: re (gjb) Sponsored by: Intel