vclean() sets VXLOCK and waits for v_lockcount to drain before taking
the vnode lock with LK_DRAIN. vn_lock() already woke that waiter when a
racing VOP_LOCK() succeeded, noticed VXLOCK, and had to drop the lock
again.
Do the same wakeup when the racing VOP_LOCK() fails. A failed attempt
still decrements v_lockcount, and if it was the last in flight attempt,
vclean() must be notified that the drain condition is satisfied.
Problem was that splicing holds the socket lock when it writes
so_sp, but unsplicing does not when it reads so_sp. So it may get
the new pointer, but PR_ZERO is not visible due to reordering. Then
so->so_sp->ssp_socket is garbage. Crash happend on octeon/mips64
during regress/sys/netinet/udpthread test run-unsplice.
When creating a splice from socket 1 to socket 2, kernel holds
socket buffer lock on so1->so_rcv and so2->so_snd and socket lock
on both while installing so_sp on so1 and so2. Concurrent sosplice()
on socket 2 has the opposite order, we hold sblock on so2->so_rcv,
sblock on so1->so_snd and solock on both sockets.
The unsplice thread of the source socket did hold sblock on so->so_rcv
only. So we did lockless so_sp check while concurrent sosplice()
thread installs so_sp on the same socket as drain, holding sblock
on so->so_snd.
Grabbing sblock on both so->so_srv and so->so_snd fixes the crash.
with and OK mvs@
From 537f3d3a7588d226b86590f97c4401107585e1ce Mon Sep 17 00:00:00 2001
From: Jakob Koschel <jakobkoschel@google.com>
Date: Thu, 5 Mar 2026 01:11:44 +0100
Subject: [PATCH] [SafeStack] Fix crashing with scalable TypeSizes (#180547)
On e.g. aarch64 the TypeSize of scalar types can have a size that is not
known at compile time.
Currently when safestack occurs those it simply crashes as described in
https://github.com/llvm/llvm-project/issues/175868.
syslogd(8) forks and execs its parent process to keep privileged
parts separated. This parent process can be easily implemented as
a separate program. It gets its own main() and minimal debug logging
functions. The splitted parent process image is smaller, especially
without additional libs.
Use additional directories to build both parts. The rcctl script
has to be adopted, as the parent process has a different name.
OK deraadt@
message_alloc_reply() dereferences the returned pointer of
message_alloc() without a NULL check. Add one so callers can handle
the failure.
Also add NULL checks at both call sites in exchange.c.
test & ok sthen
When validating IPsec SPIs in a DELETE message, access to the
32 bit SPI value might be unaligned. On platforms requiring strict
alignment, this would cause termination of isakmpd by signal.
To avoid this, memcpy(3) the SPI value to a local variable.
test & ok sthen
Similar to message_validate_delete() also validate in
ipsec_handle_leftover_payload() that the provided number of SPIs
actually fit in the payload. This is redundant as we already would
bail out in message_validate_delete().
test & ok sthen
The number of SPIs provided in a DELETE message is not properly
validated. This might cause a read beyond the message end. However,
the outside read is limited to 4 bytes for IPsec SAs and 16 bytes
for ISAKMP SAs. A crash is possible, but seems unlikely to me.
test & ok sthen
Check
- that a proposal payload fits within the outer SA payload,
- that the provided SPI and the following transform header fit within
the proposal, and
- transforms fit within the outer proposal payload.
It's already ensured that we never read outside the message. However,
within the message the mentioned payloads might be misinterpreted due
to malformed size values.
test & ok sthen
this indirectly calls intel_fbdev_blank(), which does
drm_fb_helper_blank() followed by intel_fbdev_invalidate()
avoids on screen garbage when wscons screen blanking is enabled on
mvs' Alder Lake and Gemini Lake machines.
jsing