[illumos-gate merge]

commit 7271f09891bb39b64f2a58632c92c1456ed9cf31
    14625 Bhyve e82545 device emulation out-of-bounds write
commit 57cf819efa50a6a3b3a478c25a098c29722eb358
    14617 svc:/network/ipmp maintenance in shared IP zone
commit f7457249d2a760edca827e174adb0db578a87784
    14595 sd DLE events should cover the first two partitions

4 files changed, 36 insertions, 26 deletions

diff --git a/usr/src/cmd/bhyve/pci_e82545.c b/usr/src/cmd/bhyve/pci_e82545.c
index 25cf0a48e7..f4eaa0c93b 100644
--- a/usr/src/cmd/bhyve/pci_e82545.c
+++ b/usr/src/cmd/bhyve/pci_e82545.c
@@ -1279,9 +1279,7 @@ e82545_transmit(struct e82545_softc *sc, uint16_t head, uint16_t tail,
 			goto done;
 		}
 		if (sc->esc_txctx.cmd_and_length & E1000_TXD_CMD_TCP) {
-			if (hdrlen < ckinfo[1].ck_start + 14 ||
-			    (ckinfo[1].ck_valid &&
-			    hdrlen < ckinfo[1].ck_off + 2)) {
+			if (hdrlen < ckinfo[1].ck_start + 14) {
 				WPRINTF("TSO hdrlen too small for TCP fields "
 				    "(%d) -- dropped", hdrlen);
 				goto done;
@@ -1293,6 +1291,11 @@ e82545_transmit(struct e82545_softc *sc, uint16_t head, uint16_t tail,
 				goto done;
 			}
 		}
+		if (ckinfo[1].ck_valid && hdrlen < ckinfo[1].ck_off + 2) {
+			WPRINTF("TSO hdrlen too small for TCP/UDP fields "
+			    "(%d) -- dropped", hdrlen);
+			goto done;
+		}
 	}
 
 	/* Allocate, fill and prepend writable header vector. */
diff --git a/usr/src/cmd/cmd-inet/usr.lib/in.mpathd/net-ipmp b/usr/src/cmd/cmd-inet/usr.lib/in.mpathd/net-ipmp
index 565b80e374..4dbb84a5b8 100644
--- a/usr/src/cmd/cmd-inet/usr.lib/in.mpathd/net-ipmp
+++ b/usr/src/cmd/cmd-inet/usr.lib/in.mpathd/net-ipmp
@@ -22,7 +22,7 @@ if [ -z "$SMF_FMRI" ]; then
         exit $SMF_EXIT_ERR_NOSMF
 fi
 
-smf_configure_ip || exit $SMF_EXIT_ERR_FATAL
+smf_configure_ip || exit $SMF_EXIT_NODAEMON
 
 if /lib/inet/in.mpathd; then
         exit $SMF_EXIT_OK
diff --git a/usr/src/uts/common/io/blkdev/blkdev.c b/usr/src/uts/common/io/blkdev/blkdev.c
index 611666b0a1..847c7c58fc 100644
--- a/usr/src/uts/common/io/blkdev/blkdev.c
+++ b/usr/src/uts/common/io/blkdev/blkdev.c
@@ -1959,8 +1959,7 @@ bd_dle_sysevent_task(void *arg)
 		 * active zpools for child vdevs matching this physical path.
 		 * In order to catch both whole disk pools and those with an
 		 * EFI boot partition, generate separate sysevents for minor
-		 * node 'a' and 'b'. (By comparison, io/scsi/targets/sd.c sends
-		 * events for just 'a')
+		 * node 'a' and 'b'.
 		 */
 		for (char c = 'a'; c < 'c'; c++) {
 			path[n - 1] = c;
diff --git a/usr/src/uts/common/io/scsi/targets/sd.c b/usr/src/uts/common/io/scsi/targets/sd.c
index aa88a9c42f..dbfafe3f54 100644
--- a/usr/src/uts/common/io/scsi/targets/sd.c
+++ b/usr/src/uts/common/io/scsi/targets/sd.c
@@ -29,6 +29,7 @@
  * Copyright 2019 Joyent, Inc.
  * Copyright 2017 Nexenta Systems, Inc.
  * Copyright 2019 Racktop Systems
+ * Copyright 2022 OmniOS Community Edition (OmniOSce) Association.
  */
 /*
  * Copyright 2011 cyril.galibern@opensvc.com
@@ -19822,6 +19823,7 @@ sd_log_dev_status_event(struct sd_lun *un, char *esc, int km_flag)
 	int err;
 	char			*path;
 	nvlist_t		*attr_list;
+	size_t			n;
 
 	/* Allocate and build sysevent attribute list */
 	err = nvlist_alloc(&attr_list, NV_UNIQUE_NAME_TYPE, km_flag);
@@ -19838,30 +19840,36 @@ sd_log_dev_status_event(struct sd_lun *un, char *esc, int km_flag)
 		    "sd_log_dev_status_event: fail to allocate space\n");
 		return;
 	}
+
+	n = snprintf(path, MAXPATHLEN, "/devices");
+	(void) ddi_pathname(SD_DEVINFO(un), path + n);
+	n = strlen(path);
+	n += snprintf(path + n, MAXPATHLEN - n, ":x");
+
 	/*
-	 * Add path attribute to identify the lun.
-	 * We are using minor node 'a' as the sysevent attribute.
+	 * On receipt of this event, the ZFS sysevent module will scan
+	 * active zpools for child vdevs matching this physical path.
+	 * In order to catch both whole disk pools and those with an
+	 * EFI boot partition, generate separate sysevents for minor
+	 * node 'a' and 'b'.
 	 */
-	(void) snprintf(path, MAXPATHLEN, "/devices");
-	(void) ddi_pathname(SD_DEVINFO(un), path + strlen(path));
-	(void) snprintf(path + strlen(path), MAXPATHLEN - strlen(path),
-	    ":a");
+	for (char c = 'a'; c < 'c'; c++) {
+		path[n - 1] = c;
 
-	err = nvlist_add_string(attr_list, DEV_PHYS_PATH, path);
-	if (err != 0) {
-		nvlist_free(attr_list);
-		kmem_free(path, MAXPATHLEN);
-		SD_ERROR(SD_LOG_ERROR, un,
-		    "sd_log_dev_status_event: fail to add attribute\n");
-		return;
-	}
+		err = nvlist_add_string(attr_list, DEV_PHYS_PATH, path);
+		if (err != 0) {
+			SD_ERROR(SD_LOG_ERROR, un,
+			    "sd_log_dev_status_event: fail to add attribute\n");
+			break;
+		}
 
-	/* Log dynamic lun expansion sysevent */
-	err = ddi_log_sysevent(SD_DEVINFO(un), SUNW_VENDOR, EC_DEV_STATUS,
-	    esc, attr_list, NULL, km_flag);
-	if (err != DDI_SUCCESS) {
-		SD_ERROR(SD_LOG_ERROR, un,
-		    "sd_log_dev_status_event: fail to log sysevent\n");
+		err = ddi_log_sysevent(SD_DEVINFO(un), SUNW_VENDOR,
+		    EC_DEV_STATUS, esc, attr_list, NULL, km_flag);
+		if (err != DDI_SUCCESS) {
+			SD_ERROR(SD_LOG_ERROR, un,
+			    "sd_log_dev_status_event: fail to log sysevent\n");
+			break;
+		}
 	}
 
 	nvlist_free(attr_list);