src/sys/net, branch releng/5.3

Correct buffer overflow in the handling of LCP options in ppp(4)

2006-08-23T22:06:40Z

Security: FreeBSD-SA-06:18.ppp Approved by: so (cperciva)

If we are going to

2005-05-06T02:50:35Z

1. Copy a NULL-terminated string into a fixed-length buffer, and 2. copyout that buffer to userland, we really ought to 0. Zero the entire buffer first. Security: FreeBSD-SA-05:08.kmem Approved by: so (cperciva)

Zero the ifr.ifr_name buffer in ifconf() in order to avoid

2005-04-15T01:53:14Z

accidental disclosure of kernel memory to userland. Security: FreeBSD-SA-05:04.ifconf Approved by: so (cperciva)

Merge if.c:.211 and if_var.h:1.88 from HEAD to RELENG_5_3:

2004-10-30T22:01:43Z

date: 2004/10/30 09:39:13; author: rwatson; state: Exp; lines: +25 -0 Move if_handoff() from an inline in if_var.h to a function to if.c in orden to harden the ABI for 5.x; this will permit us to modify the locking in the ifnet packet dispatch without requiring drivers to be recompiled. MFC after: 3 days Discussed at: EuroBSDCon Developer's Summit Approved by: re (kensmith)

Merge if_var.h:1.87 from HEAD to RELENG_5_3:

2004-10-30T21:59:58Z

date: 2004/10/30 08:45:13; author: rwatson; state: Exp; lines: +5 -0 Add additional "spare" fields to 'struct ifnet' in order to improve the resistance of the network driver ABI to changes that will be required as we optimize locking. MFC after: 3 days Discussed at: Developer Summit Approved by: re (kensmith)

Merge if.c:1.210, if_var.h:1.85 from HEAD to RELENG_5_3:

2004-10-23T19:18:05Z

Define IFF_LOCKGIANT() and IFF_UNLOCKGIANT() macros, which conditionally acquire Giant if the passed interface has IFF_NEEDSGIANT set on it. Modify calls into (ifp)->if_ioctl() in if.c to use these macros in order to ensure that Giant is held. MFC after: 3 days Bumped into by: jmg Approved by: re (kensmith, scottl)

Merge kern_descrip.c:1.246, uipc_socket.c:1.214, uipc_usrreq.c:1.141,

2004-10-21T09:30:48Z

raw_cb.c:1.30, raw_usrreq.c:1.35, ddp_pcb.c:1.45, atm_socket.c:1.21, ng_btsocket_hci_raw.c:1.16, ng_btsocket_l2cap.c:1.14, ng_btsocket_l2cap_raw.c:1.13, ng_btsocket_rfcomm.c:1.13, in_pcb.c:1.156, tcp_subr.c:1.205, in6_pcb.c:1.61, ipx_pcb.c:1.29, ipx_usrreq.c:1.41, natm.c:1.35, socketvar.h:1.135 from HEAD to RELENG_5_3: Push acquisition of the accept mutex out of sofree() into the caller (sorele()/sotryfree()): - This permits the caller to acquire the accept mutex before the socket mutex, avoiding sofree() having to drop the socket mutex and re-order, which could lead to races permitting more than one thread to enter sofree() after a socket is ready to be free'd. - This also covers clearing of the so_pcb weak socket reference from the protocol to the socket, preventing races in clearing and evaluation of the reference such that sofree() might be called more than once on the same socket. This appears to close a race I was able to easily trigger by repeatedly opening and resetting TCP connections to a host, in which the tcp_close() code called as a result of the RST raced with the close() of the accepted socket in the user process resulting in simultaneous attempts to de-allocate the same socket. The new locking increases the overhead for operations that may potentially free the socket, so we will want to revise the synchronization strategy here as we normalize the reference counting model for sockets. The use of the accept mutex in freeing of sockets that are not listen sockets is primarily motivated by the potential need to remove the socket from the incomplete connection queue on its parent (listen) socket, so cleaning up the reference model here may allow us to substantially weaken the synchronization requirements. RELENG_5_3 candidate. MFC after: 3 days Reviewed by: dwhite Discussed with: gnn, dwhite, green Reported by: Marc UBM Bocklet Reported by: Vlad Approved by: re (scottl)

MFC:

2004-10-16T07:04:49Z

When harvesting entropy from an ethernet mbuf, do so before freeing the mbuf. Submitted by: rwatson Approved by: re

MFC 1.15: Correctly unregister netisr's.

2004-10-14T19:19:24Z

Approved by: re (scottl)

MFC r1.11: fail closed when lock acquisition would block.

2004-10-11T03:45:57Z

Approved by: re