CVS: cvs.openbsd.org: src
CVSROOT:/cvs Module name:src Changes by: sas...@cvs.openbsd.org 2019/10/21 17:02:05 Modified files: sys/net: bpf.c bpfdesc.h Log message: put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors Anton@ made problem crystal clear: I've been looking into a similar bpf panic reported by syzkaller, which looks somewhat related. The one reported by syzkaller is caused by issuing ioctl(SIOCIFDESTROY) on the interface which the packet filter is attached to. This will in turn invoke the following functions expressed as an inverted stacktrace: 1. bpfsdetach() 2. vdevgone() 3. VOP_REVOKE() 4. vop_generic_revoke() 5. vgonel() 6. vclean(DOCLOSE) 7. VOP_CLOSE() 8. bpfclose() Note that bpfclose() is called before changing the vnode type. In bpfclose(), the `struct bpf_d` is immediately removed from the global bpf_d_list list and might end up sleeping inside taskq_barrier(systq). Since the bpf file descriptor (fd) is still present and valid, another thread could perform an ioctl() on the fd only to fault since bpfilter_lookup() will return NULL. The vnode is not locked in this path either so it won't end up waiting on the ongoing vclean(). Steps to trigger the similar type of panic are straightforward, let there be two processes running concurrently: process A: while true ; do ifconfig tun0 up ; ifconfig tun0 destroy ; done process B: while true ; do tcpdump -i tun0 ; done panic happens within few secs (Dell PowerEdge 710) OK @visa, OK @anton
CVS: cvs.openbsd.org: src
CVSROOT:/cvs Module name:src Changes by: dera...@cvs.openbsd.org 2019/10/21 16:45:40 Modified files: distrib/sets/lists/man: mi Log message: sync
CVS: cvs.openbsd.org: src
CVSROOT:/cvs Module name:src Changes by: kette...@cvs.openbsd.org2019/10/21 14:53:11 Modified files: share/man/man4 : Makefile Added files: share/man/man4 : pwmbl.4 sxipwm.4 Log message: pwmbl(4) and sxipwm(4)
CVS: cvs.openbsd.org: src
CVSROOT:/cvs Module name:src Changes by: kette...@cvs.openbsd.org2019/10/21 14:52:33 Modified files: sys/arch/arm64/conf: GENERIC sys/dev/fdt: files.fdt Added files: sys/dev/fdt: pwmbl.c sxipwm.c Log message: Add sxipwm(4) and pwmbl(4). Thse two drivers together add support for the backlight controller on the Pinebook. ok patrick@, jsg@
CVS: cvs.openbsd.org: src
CVSROOT:/cvs Module name:src Changes by: j...@cvs.openbsd.org2019/10/21 10:45:48 Modified files: sys/dev/acpi : acpithinkpad.c Log message: On newer ThinkPads reporting HKEY version > 1, don't claim wscons backlight controls so that acpivout can. This allows using all of the fine-grained backlight BCL steps defined in ACPI (usually 100) instead of the dozen or so available through acpithinkpad's proprietary ACPI or CMOS interfaces. This is also needed for future amdgpu work.
CVS: cvs.openbsd.org: src
CVSROOT:/cvs Module name:src Changes by: j...@cvs.openbsd.org2019/10/21 10:32:51 Modified files: sys/dev/acpi : acpivout.c Log message: When incrementing or decrementing screen brightness, don't just adjust by 1 BCL level as there may be 100 levels. Find the next brightness level that is at least 5% up or down and use that. ok kettenis
CVS: cvs.openbsd.org: src
CVSROOT:/cvs Module name:src Changes by: k...@cvs.openbsd.org2019/10/21 07:09:52 Modified files: gnu/usr.bin/binutils/gdb: amd64obsd-tdep.c Log message: Fix backtrace across signals on amd64 okay guenther@ kettenis@
CVS: cvs.openbsd.org: src
CVSROOT:/cvs Module name:src Changes by: m...@cvs.openbsd.org2019/10/21 04:24:01 Modified files: sys/sys: proc.h sched.h sys/kern : kern_fork.c Log message: Move `p_estcpu' to the region copied during fork & kill scheduler_fork_hook(). While here reorder some fields in 'struct proc' to avoid size grow. ok bluhm@, visa@
CVS: cvs.openbsd.org: src
CVSROOT:/cvs Module name:src Changes by: m...@cvs.openbsd.org2019/10/21 04:06:31 Modified files: lib/librthread : synch.h Log message: Use process-private futexes to avoid the uvm_map lookup overhead. While here kill unused _wait() function. ok visa@
CVS: cvs.openbsd.org: src
CVSROOT:/cvs Module name:src Changes by: m...@cvs.openbsd.org2019/10/21 04:04:19 Modified files: lib/libc/thread: synch.h Log message: Kill unused _wait() function. ok visa@
CVS: cvs.openbsd.org: src
CVSROOT:/cvs Module name:src Changes by: m...@cvs.openbsd.org2019/10/21 04:02:41 Modified files: sys/dev/usb: usbdi.c Log message: Mark recycled USB `xfer' as NOT_STARTED to not confuse HCD abort methods. Prevent an infinite loop when aborting ulpt(4)'s pipe after an I/O error. Found by and ok stsp@
CVS: cvs.openbsd.org: src
CVSROOT:/cvs Module name:src Changes by: flor...@cvs.openbsd.org 2019/10/21 01:16:10 Modified files: sbin/unwind: frontend.c parse.y printconf.c unwind.c unwind.conf.5 unwind.h Log message: Optionally log blocked queries when using the block list. OK benno
