From owner-svn-src-stable-9@freebsd.org Sun Jun 25 06:55:44 2017 Return-Path: Delivered-To: svn-src-stable-9@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 673B5D8B08B; Sun, 25 Jun 2017 06:55:44 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 28E0116F0; Sun, 25 Jun 2017 06:55:44 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v5P6thF3060060; Sun, 25 Jun 2017 06:55:43 GMT (envelope-from delphij@FreeBSD.org) Received: (from delphij@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v5P6thTV060059; Sun, 25 Jun 2017 06:55:43 GMT (envelope-from delphij@FreeBSD.org) Message-Id: <201706250655.v5P6thTV060059@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: delphij set sender to delphij@FreeBSD.org using -f From: Xin LI Date: Sun, 25 Jun 2017 06:55:43 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r320326 - stable/9/lib/libc/rpc X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-9@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for only the 9-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Jun 2017 06:55:44 -0000 Author: delphij Date: Sun Jun 25 06:55:42 2017 New Revision: 320326 URL: https://svnweb.freebsd.org/changeset/base/320326 Log: MFC r320216: Fix use-after-free introduced in r300388. In r300388, endnetconfig() was called on nc_handle which would release the associated netconfig structure, which means tmpnconf->nc_netid would be a use-after-free. Solve this by doing endnetconfig() in return paths instead. Reported by: jemalloc via kevlo Reviewed by: cem, ngie (earlier version) Modified: stable/9/lib/libc/rpc/rpcb_clnt.c Directory Properties: stable/9/lib/libc/ (props changed) Modified: stable/9/lib/libc/rpc/rpcb_clnt.c ============================================================================== --- stable/9/lib/libc/rpc/rpcb_clnt.c Sun Jun 25 05:46:03 2017 (r320325) +++ stable/9/lib/libc/rpc/rpcb_clnt.c Sun Jun 25 06:55:42 2017 (r320326) @@ -508,14 +508,15 @@ try_nconf: hostname = IN6_LOCALHOST_STRING; } } - endnetconfig(nc_handle); if (tmpnconf == NULL) { + endnetconfig(nc_handle); rpc_createerr.cf_stat = RPC_UNKNOWNPROTO; mutex_unlock(&loopnconf_lock); return (NULL); } loopnconf = getnetconfigent(tmpnconf->nc_netid); /* loopnconf is never freed */ + endnetconfig(nc_handle); } mutex_unlock(&loopnconf_lock); client = getclnthandle(hostname, loopnconf, NULL); From owner-svn-src-stable-9@freebsd.org Mon Jun 26 19:40:12 2017 Return-Path: Delivered-To: svn-src-stable-9@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2E305D8FFBD; Mon, 26 Jun 2017 19:40:12 +0000 (UTC) (envelope-from davidcs@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id ED9942545; Mon, 26 Jun 2017 19:40:11 +0000 (UTC) (envelope-from davidcs@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v5QJeBw2073990; Mon, 26 Jun 2017 19:40:11 GMT (envelope-from davidcs@FreeBSD.org) Received: (from davidcs@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v5QJeAXh073987; Mon, 26 Jun 2017 19:40:10 GMT (envelope-from davidcs@FreeBSD.org) Message-Id: <201706261940.v5QJeAXh073987@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: davidcs set sender to davidcs@FreeBSD.org using -f From: David C Somayajulu Date: Mon, 26 Jun 2017 19:40:10 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r320371 - stable/9/sys/dev/qlxgbe X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-9@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for only the 9-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Jun 2017 19:40:12 -0000 Author: davidcs Date: Mon Jun 26 19:40:10 2017 New Revision: 320371 URL: https://svnweb.freebsd.org/changeset/base/320371 Log: MFC r320175 Add pkts_cnt_oversized to stats. Modified: stable/9/sys/dev/qlxgbe/ql_hw.c stable/9/sys/dev/qlxgbe/ql_hw.h Directory Properties: stable/9/ (props changed) stable/9/sys/ (props changed) Modified: stable/9/sys/dev/qlxgbe/ql_hw.c ============================================================================== --- stable/9/sys/dev/qlxgbe/ql_hw.c Mon Jun 26 19:36:24 2017 (r320370) +++ stable/9/sys/dev/qlxgbe/ql_hw.c Mon Jun 26 19:40:10 2017 (r320371) @@ -1554,6 +1554,8 @@ qla_rcv_stats(qla_host_t *ha, q80_rcv_stats_t *rstat) rstat->lro_flows_active); device_printf(dev, "%s: pkts_droped_unknown\t\t%" PRIu64 "\n", __func__, rstat->pkts_droped_unknown); + device_printf(dev, "%s: pkts_cnt_oversized\t\t%" PRIu64 "\n", + __func__, rstat->pkts_cnt_oversized); } static void Modified: stable/9/sys/dev/qlxgbe/ql_hw.h ============================================================================== --- stable/9/sys/dev/qlxgbe/ql_hw.h Mon Jun 26 19:36:24 2017 (r320370) +++ stable/9/sys/dev/qlxgbe/ql_hw.h Mon Jun 26 19:40:10 2017 (r320371) @@ -748,6 +748,7 @@ typedef struct _q80_rcv_stats { uint64_t lro_flows_deleted; uint64_t lro_flows_active; uint64_t pkts_droped_unknown; + uint64_t pkts_cnt_oversized; } __packed q80_rcv_stats_t; typedef struct _q80_xmt_stats {