{"push_id":2541873556,"size":4,"distinct_size":4,"ref":"refs/heads/netbsd-6","head":"79e3d042dddaab4cf8ad89c84433749ab280a2ac","before":"ec271cdb26b1f4bfe4b44a4b77ce3492e7374bb8","commits":[{"sha":"d9c8744a60c8fbd8fc4629720fba75a07afa6712","author":{"name":"martin","email":"54669547a225ff20cba8b75a4adca540eef25858@netbsd.org"},"message":"Pull up following revision(s) (requested by maxv in ticket #1546):\n\n\tsys/netipsec/ipsec_output.c: revision 1.67,1.75 (via patch)\n\nStrengthen this check, to make sure there is room for an ip6_ext structure.\nSeems possible to crash m_copydata here (but I didn't test more than that).\n\nFix the checks in compute_ipsec_pos, otherwise m_copydata could crash. I\nalready fixed half of the problem two months ago in rev1.67, back then I\nthought it was not triggerable because each packet we emit is guaranteed\nto have correctly formed IPv6 options; but it is actually triggerable via\nIPv6 forwarding, we emit a packet we just received, and we don't sanitize\nits options before invoking IPsec.\n\nSince it would be wrong to just stop the iteration and continue the IPsec\nprocessing, allow compute_ipsec_pos to fail, and when it does, drop the\npacket entirely.","distinct":true,"url":"https://api.github.com/repos/IIJ-NetBSD/netbsd-src/commits/d9c8744a60c8fbd8fc4629720fba75a07afa6712"},{"sha":"85b44260e8047c26948e00101ce7b2390a8ccf26","author":{"name":"martin","email":"54669547a225ff20cba8b75a4adca540eef25858@netbsd.org"},"message":"Tickets #1546 and #1547","distinct":true,"url":"https://api.github.com/repos/IIJ-NetBSD/netbsd-src/commits/85b44260e8047c26948e00101ce7b2390a8ccf26"},{"sha":"d68bcf22511a53ca14adea827983c54e7fcdc5ab","author":{"name":"martin","email":"54669547a225ff20cba8b75a4adca540eef25858@netbsd.org"},"message":"Pull up following revision(s) (requested by maxv in ticket #1547):\n\n\tsys/kern/uipc_mbuf.c: revision 1.211 (via patch)\n\nModify m_defrag, so that it never frees the first mbuf of the chain. While\nhere use the given 'flags' argument, and not M_DONTWAIT.\n\nWe have a problem with several drivers: they poll an mbuf chain from their\nqueues and call m_defrag on them, but m_defrag could update the mbuf\npointer, so the mbuf in the queue is no longer valid. It is not easy to\nfix each driver, because doing pop+push will reorder the queue, and we\ndon't really want that to happen.\n\nThis problem was independently spotted by me, Kengo, Masanobu, and other\npeople too it seems (perhaps PR/53218).\n\nNow m_defrag leaves the first mbuf in place, and compresses the chain\nonly starting from the second mbuf in the chain.\n\nIt is important not to compress the first mbuf with hacks, because the\nstorage of this first mbuf may be shared with other mbufs.","distinct":true,"url":"https://api.github.com/repos/IIJ-NetBSD/netbsd-src/commits/d68bcf22511a53ca14adea827983c54e7fcdc5ab"},{"sha":"79e3d042dddaab4cf8ad89c84433749ab280a2ac","author":{"name":"martin","email":"54669547a225ff20cba8b75a4adca540eef25858@netbsd.org"},"message":"Fix entry for ticket #1547","distinct":true,"url":"https://api.github.com/repos/IIJ-NetBSD/netbsd-src/commits/79e3d042dddaab4cf8ad89c84433749ab280a2ac"}]}
{"actor":{"display_login":"ryo"}}