From nobody Mon Jun 29 03:02:16 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpWKP0lYDz6jmND for ; Mon, 29 Jun 2026 03:02:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpWKN4k5mz3mPD for ; Mon, 29 Jun 2026 03:02:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782702136; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DU6gsP5PlGYQON54/ETot38zZYUXthAO+B1cmM/zYuU=; b=GKU1YfWqj1VjwJyQPqZUXpR3nW+imuC9EdjnLpCbjwgNg0piJSrhX812WV1fSCfGUlDfQw QlyjKT5ri/ytmU/2fS8RULE1vARfvwgL5c0jLLeUedSPn06gcZUvRNvwHGTY8svRJIPRNo tCx0cyxoXAwIelkC5hScX5k/fDHAe2E891S0qWkrzrJUR2DNZhtPHAarht5UmYQycgw+7d nLViF4cRAdyq9mwd+zHZvr1JDXjTJld20h/YgkiICedy796OhyoDnp4BvFgU44VRL+otBU Noh3jV6KJmiUR8Jg6Xbrw8r7layYFV9/zmF8NuO8mDdkH7bN9LSwgxmfK2zfTw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782702136; a=rsa-sha256; cv=none; b=c6qFt7Pq7MvEUwZusWa9m61hspWP1QtrUTDuuM4+zqiwxr9MNPgmRERAEQwaYN8MqtD0r3 OVos337Kg7w+VZuEq+bVNUzgMCcrk95z+O8HchUaVhEIrmem/sDZes++bQZS6QYopcJiC6 zcqgyVGqREnimDwbip7jS6muqmRGS55wLa4JwlOnB81Bg/qZ2AYMKMGCFR6dufGLGExksf PP3nUn5LTW2BVMPEPhyF3Rpw+GHhazIajS6ekYF0LmTHY0s1hlTVOvRZ96VE3UO0RBU0Rf Z4wlrkpDqaD/x/ypWANk784wlFSCXhNOCHWeN5ek2/PFV+rDZ1uqBl3Wd2v4Yw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782702136; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DU6gsP5PlGYQON54/ETot38zZYUXthAO+B1cmM/zYuU=; b=L2v2gjd4ptYS4nuMtcfjiLukGeQCtkwiIAOqTfnsJYATgW5JFhVuQmeIAyQmGs7kncRrNI i16Z3urDKfpNWblcaHwlwb2ex+rw8mBr4waUlhNDbgg1Pkotbp6rS6TRkqwNAyMb8qkmaI KcnMeunGpWwqrxCgcn7eJLwEmbM//SjI1sJ/tQKWXe0XRXVkbwwOt3I/Nf/lS7052CaRps uFr4eolQkeruIXDcVLX3rDzNLjUnFzGYCmLd9U5Yb532HKC8uEk33+FZauPm37Hq649c1t N/EEI+I1cwbcO+y0D8YGrimlT+qfy2Wz3LUujH4oUI/7Z0Ymc9y9aa2hSQ+GXw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpWKN39bfzfWk for ; Mon, 29 Jun 2026 03:02:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 30d1f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 03:02:16 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Tetlow Subject: git: 453cfe97276d - stable/15 - efitable: Fixup getopt args to reflect guid use. List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gordon X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 453cfe97276d2b2e6ffc4c851ae39b5927bd2385 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 03:02:16 +0000 Message-Id: <6a41e038.30d1f.262b9539@gitrepo.freebsd.org> The branch stable/15 has been updated by gordon: URL: https://cgit.FreeBSD.org/src/commit/?id=453cfe97276d2b2e6ffc4c851ae39b5927bd2385 commit 453cfe97276d2b2e6ffc4c851ae39b5927bd2385 Author: Gordon Tetlow AuthorDate: 2026-06-20 02:59:49 +0000 Commit: Gordon Tetlow CommitDate: 2026-06-29 03:01:35 +0000 efitable: Fixup getopt args to reflect guid use. Correct the manpage to reflect the preference for GUID vs UUID. Take the long version of --guid for the -g option. Sort the argument list while we are touching it. Reviewed by: imp Event: BSDCan 2026 Differential Revision: https://reviews.freebsd.org/D57695 (cherry picked from commit 3a4e049c38143980e472b2926abde3c7549530c4) --- usr.sbin/efitable/efitable.8 | 6 +++--- usr.sbin/efitable/efitable.c | 3 ++- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/usr.sbin/efitable/efitable.8 b/usr.sbin/efitable/efitable.8 index 52949abcb853..f0785d3ba7cf 100644 --- a/usr.sbin/efitable/efitable.8 +++ b/usr.sbin/efitable/efitable.8 @@ -32,7 +32,7 @@ .Nd dump UEFI tables .Sh SYNOPSIS .Nm -.Op Fl u Ar uuid | Fl t Ar name +.Op Fl g Ar guid | Fl t Ar name .Op Fl -libxo .Sh DESCRIPTION This program prints data from @@ -49,6 +49,8 @@ in a selection of different human and machine readable formats. See .Xr xo_options 7 for details on command line arguments. +.It Fl g Ar guid | Fl -guid Ar guid +Specify the GUID of the table to print. .It Fl t Ar name | Fl -table Ar name Specify the name of the table to print. Currently supported tables: @@ -61,8 +63,6 @@ EFI Memory Attributes Table .It Cm prop EFI Properties Table .El -.It Fl u Ar uuid | Fl -uuid Ar uuid -Specify the UUID of the table to print. .El .Sh HISTORY The diff --git a/usr.sbin/efitable/efitable.c b/usr.sbin/efitable/efitable.c index a506b4dea311..b9e3d424398a 100644 --- a/usr.sbin/efitable/efitable.c +++ b/usr.sbin/efitable/efitable.c @@ -75,8 +75,9 @@ main(int argc, char **argv) bool table_set = false; bool uuid_set = false; struct option longopts[] = { - { "uuid", required_argument, NULL, 'u' }, + { "guid", required_argument, NULL, 'g' }, { "table", required_argument, NULL, 't' }, + { "uuid", required_argument, NULL, 'u' }, { NULL, 0, NULL, 0 } }; From nobody Mon Jun 29 06:34:10 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc1t2bTTz6k59s for ; Mon, 29 Jun 2026 06:34:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc1t1csmz4Gd9 for ; Mon, 29 Jun 2026 06:34:10 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714850; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pKvXiqDI/HkQrphIlS92XcfucyBBvqeNMqVeiJjLHDc=; b=MSPkDlzoyJWUTLxHestsCFO+v2ld0JETUQm09ohn43f26jmSPoMmYBmgzp2l3RXyH93PNE 1nXV0o0+7J/Am84TqLx7OeFsjskQL73dJMvmuljWcSHkbEttcv79IrqNx9aB/GJBisEeRK dDBl5bBsqR9CDCH63+DowJ/G7SgSj6R5hnZDNrV0JKynE4ReSlzd1hJJDpp9nPCXx3eNZT Xr7F5Q/+S74wqSDyCBO+XmIOqUwGjmfm0Jlsi8P9R7mxQITLdtzDElpnyLthLK93sQQKRu 9wHu0K8TRbxTc2QWZjbXhNZLB2X7Cn+Rw9CT+4Jgeb3qK5TL0xQ9FcSHU3wKBQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714850; a=rsa-sha256; cv=none; b=OjvgfCzvT5ekfQwDIRXKBephmqvGj+AW1GFFOUkxicBbi7yZtEChFPlnoxEeGFRTBAMMYj A/T1RM0uVhnWy5h3RWybl1Qsy3NehzSs5oxHTKMmfSMscFUNu3LSR1BXxZP/+ZRMt2xtq9 HR3prW9LCI80Wt46icx2DpK4uznKeo8iDYtO8PwOpY7PxJrpdZMNVDXks2FwSaowwsLK8I 180gQ+Dptpdy44PW1Cp/t0LFKNbA5VW+jW/VaUQQQ/JwYgbJugGCdutYBOLrsnrTj4jxzK yaXTepppn4UA6QDCaVPMRl8eKAXdysSHQsFfuw64PW3PtiSmCgAaf6zEzeCi3g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714850; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pKvXiqDI/HkQrphIlS92XcfucyBBvqeNMqVeiJjLHDc=; b=ClDAcff4jvmz8Qx7ryoeY2TzVtmiIa6w3/B5NSyDatT3O0UcfQ4ns9MnP7XOiH5aOqSqq+ 6BFVgRg66ad0u8LmFlfd4DRD8xUj6YZGR1nCwj/R9RegKIpqUXgE5p54l+2FZgwM2KfgNW hVf8VoksmwGr3svF45thWubjhFtPFtPzcSL3EdG5HiUl9JT2LI1vddW9v2TJWJowNH4xJ4 wNnhhm6CyVvEMgNzvo9AGBJmsHYlK718/AOZuCqo9MjuOSYZRz7XctkTzS7K4Fo2csGRT7 kApsIZ7IQClyOS6Zo4vLjpCARGMk5xS04nPAVLm6EBIetqybuNjcTt/oCfkocw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc1t0V7kzm0Q for ; Mon, 29 Jun 2026 06:34:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46744 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:10 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: a792bb723609 - stable/15 - LinuxKPI: 802.11 suspend/resume: fix the is_pci_dev check List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a792bb723609c27857c8b7a267bd145617ece84e Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:10 +0000 Message-Id: <6a4211e2.46744.109b642a@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=a792bb723609c27857c8b7a267bd145617ece84e commit a792bb723609c27857c8b7a267bd145617ece84e Author: Bjoern A. Zeeb AuthorDate: 2026-05-30 21:33:51 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:50:03 +0000 LinuxKPI: 802.11 suspend/resume: fix the is_pci_dev check Shortly before I committed the works from a year ago, jhb added a function ("is_pci_device") so that the check against the devclass does not have to be coded in every driver. Use this instead in main (and stable/15 in case the works get MFCed). At the same time this fixes the check (the old one was wrong) as we attach to the LinuxKPI 802.11 driver, e.g., iwlwifi and thus we need to check the parent of the parent and not just the parent to be of the devclass "pci" in the identify bus function. The was the first error. The second was (and this is why it worked) that we checked for == instead of != and so the wrong check became true again. Discussed with: jhb Fixes: 11d69a4558de ("LinuxKPI: 802.11: add support for s/r") Sponsored by: The FreeBSD Foundation (cherry picked from commit d07460f194835410b6a0e99af6b9721b872fb009) --- sys/compat/linuxkpi/common/src/linuxkpi_80211_pm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sys/compat/linuxkpi/common/src/linuxkpi_80211_pm.c b/sys/compat/linuxkpi/common/src/linuxkpi_80211_pm.c index c69288bd5886..cf9384bf53f2 100644 --- a/sys/compat/linuxkpi/common/src/linuxkpi_80211_pm.c +++ b/sys/compat/linuxkpi/common/src/linuxkpi_80211_pm.c @@ -13,6 +13,7 @@ #include #include +#include #include "linux_80211.h" #include @@ -139,7 +140,7 @@ lkpi_80211_pm_identify(driver_t *driver, device_t parent) return; /* Make sure this is PCI for now. */ - if (device_get_devclass(parent) == devclass_find("pci")) + if (!is_pci_device(parent)) return; if (BUS_ADD_CHILD(parent, 0, driver->name, DEVICE_UNIT_ANY) == NULL) From nobody Mon Jun 29 06:34:11 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc1w0TJJz6k54J for ; Mon, 29 Jun 2026 06:34:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc1v2vMfz4Ggg for ; Mon, 29 Jun 2026 06:34:11 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714851; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Q9NF20jllPwTDli+avHMjFrhtPfay3S3LyXwEa13BsY=; b=DgrhwCWxce4nPqvLE40oPqwWNOP0Aargkx9mlaFwyzVw/zMfg0YPt88kP+ZqXvM+yDy9n1 5Ya3D5X2Mrm4YJoXGFOGcV8HW2YvjV9C4PdHZ52l0LhXsbaRoGEGM2dJudbus4FHua/OVr 2vzM+comcVWuipDS7fSRJMOebnRZZmS8jDxVStBuZ77BV+Dw2wCFGxmfukXTJmtvRxaEy5 Pn2iCzs4MN62luf7a2hgsYO2bHQolk5JDFtn2DRbCGwAZvV8zddplvY/aWMlo9WQDPRfvp MHFaJTFV4iWdd1PMQGdLu4TTqorOnP8a47Iq1VURv18983Wr6pVBqXrpqFQIYg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714851; a=rsa-sha256; cv=none; b=KU5brp/H5MwJ52p5NLLKWKcnq2iTrHbeEVKmuMdcod+ADqQczdI/QdcGlCD3tK39KaYWAY d9o/jytrLPzrD2b+uLz6CA/R2+mNdHVBfPXh8UnDBoOateKppGfctrMgOUBhRD2riNFvCJ IqAXQ9rmnmgKUa8fvgIK+5jlj57ZSNLE9IEr/0+kxg4+YwEtTCZt5cGxO11pb2lU0zFr8P dvchDRAgEJKRf1gOOKXHu4im7zmEVL2zi1ByX6AItjqdFZEgoHLjObRD7FvNQ9YwViK2LJ dpR0tQdGfn6jInkQCzSbsEag6BjXZhyzrd/Y5VmKO3tTR/yKaQ5uoIs9/ygN8Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714851; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Q9NF20jllPwTDli+avHMjFrhtPfay3S3LyXwEa13BsY=; b=neikUyJ5rH75mwrpXAZFUeh6rYfsNnIHfj0ryPWZeOwS6jyO6rNPMJQsH9d5uKBfcVna+E HBBTheJ0lOUSv1zF49aJxtVDmuR0bMYWGGOVPY+lpibgRiy85YlZq3Fhh+qq4t1c2DLHNc UQNepJrnvD+D1lRIjhoKvngz1DWNs+eNBm+mDjlcWlC59uQqhs6Fplws4hu8BcnOLBv/NJ wDdPlGHJB3mkm/MZAUVfopxxjQov7m4r+t7ggGigsp8xvlpOGq9Yam3wxcAvAmm65ZMlDn O56HhXCfTgHw42RZbIimmoLZRPhp/yaTlM2W1wgxVGUWOw0M1iozJ8/LPSr4Yw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc1v1CHtzmVB for ; Mon, 29 Jun 2026 06:34:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4727c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:11 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: ea1dfeca866c - stable/15 - LinuxKPi: idr: use macros for idr lock operations List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: ea1dfeca866c27da131d3752a62d61e179fd2860 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:11 +0000 Message-Id: <6a4211e3.4727c.3ec0a2da@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=ea1dfeca866c27da131d3752a62d61e179fd2860 commit ea1dfeca866c27da131d3752a62d61e179fd2860 Author: Bjoern A. Zeeb AuthorDate: 2026-02-17 03:06:19 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:51:01 +0000 LinuxKPi: idr: use macros for idr lock operations Our idr implementation is using a mtx lock which in the past has already caused problems (613723bac219c). In order to make it easier to tackle the problem start by factoring out all the operations related to the idr->lock into macros as we have often done in other parts of code as well. Sponsored by: The FreeBSD Foundation Reviewed by: wulf, emaste Differential Revision: https://reviews.freebsd.org/D55392 (cherry picked from commit b53eab322946e88fb95ea4e143d1147d3de18d04) --- sys/compat/linuxkpi/common/src/linux_idr.c | 67 +++++++++++++++++------------- 1 file changed, 37 insertions(+), 30 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_idr.c b/sys/compat/linuxkpi/common/src/linux_idr.c index 664177835c85..7e5f0d28867e 100644 --- a/sys/compat/linuxkpi/common/src/linux_idr.c +++ b/sys/compat/linuxkpi/common/src/linux_idr.c @@ -62,6 +62,13 @@ DPCPU_DEFINE_STATIC(struct linux_idr_cache, linux_idr_cache); */ static MALLOC_DEFINE(M_IDR, "idr", "Linux IDR compat"); +#define IDR_LOCK_INIT(_idr) mtx_init(&(_idr)->lock, "idr", NULL, MTX_DEF); +#define IDR_LOCK_DESTROY(_idr) mtx_destroy(&(_idr)->lock); +#define IDR_LOCK(_idr) mtx_lock(&(_idr)->lock); +#define IDR_UNLOCK(_idr) mtx_unlock(&(_idr)->lock); +#define IDR_LOCK_ASSERT(_idr) mtx_assert(&(_idr)->lock, MA_OWNED); +#define IDR_LOCK_INITALIZED(_idr) mtx_initialized(&(_idr)->lock) + static struct idr_layer * idr_preload_dequeue_locked(struct linux_idr_cache *lic) { @@ -168,7 +175,7 @@ void idr_init(struct idr *idr) { bzero(idr, sizeof(*idr)); - mtx_init(&idr->lock, "idr", NULL, MTX_DEF); + IDR_LOCK_INIT(idr); } /* Only frees cached pages. */ @@ -182,17 +189,17 @@ idr_destroy(struct idr *idr) * without a idr_init(). Check if this is the case. If we do not do this * then the mutex will panic while asserting that it is valid. */ - if (mtx_initialized(&idr->lock) == 0) + if (IDR_LOCK_INITALIZED(idr) == 0) return; idr_remove_all(idr); - mtx_lock(&idr->lock); + IDR_LOCK(idr); for (il = idr->free; il != NULL; il = iln) { iln = il->ary[0]; free(il, M_IDR); } - mtx_unlock(&idr->lock); - mtx_destroy(&idr->lock); + IDR_UNLOCK(idr); + IDR_LOCK_DESTROY(idr); } static void @@ -215,11 +222,11 @@ void idr_remove_all(struct idr *idr) { - mtx_lock(&idr->lock); + IDR_LOCK(idr); idr_remove_layer(idr->top, idr->layers - 1); idr->top = NULL; idr->layers = 0; - mtx_unlock(&idr->lock); + IDR_UNLOCK(idr); } static void * @@ -266,9 +273,9 @@ idr_remove(struct idr *idr, int id) { void *res; - mtx_lock(&idr->lock); + IDR_LOCK(idr); res = idr_remove_locked(idr, id); - mtx_unlock(&idr->lock); + IDR_UNLOCK(idr); return (res); } @@ -298,7 +305,7 @@ idr_replace(struct idr *idr, void *ptr, int id) void *res; int idx; - mtx_lock(&idr->lock); + IDR_LOCK(idr); il = idr_find_layer_locked(idr, id); idx = id & IDR_MASK; @@ -309,7 +316,7 @@ idr_replace(struct idr *idr, void *ptr, int id) res = il->ary[idx]; il->ary[idx] = ptr; } - mtx_unlock(&idr->lock); + IDR_UNLOCK(idr); return (res); } @@ -319,7 +326,7 @@ idr_find_locked(struct idr *idr, int id) struct idr_layer *il; void *res; - mtx_assert(&idr->lock, MA_OWNED); + IDR_LOCK_ASSERT(idr); il = idr_find_layer_locked(idr, id); if (il != NULL) res = il->ary[id & IDR_MASK]; @@ -333,9 +340,9 @@ idr_find(struct idr *idr, int id) { void *res; - mtx_lock(&idr->lock); + IDR_LOCK(idr); res = idr_find_locked(idr, id); - mtx_unlock(&idr->lock); + IDR_UNLOCK(idr); return (res); } @@ -345,7 +352,7 @@ idr_get_next(struct idr *idr, int *nextidp) void *res = NULL; int id = *nextidp; - mtx_lock(&idr->lock); + IDR_LOCK(idr); for (; id <= idr_max(idr); id++) { res = idr_find_locked(idr, id); if (res == NULL) @@ -353,7 +360,7 @@ idr_get_next(struct idr *idr, int *nextidp) *nextidp = id; break; } - mtx_unlock(&idr->lock); + IDR_UNLOCK(idr); return (res); } @@ -364,12 +371,12 @@ idr_pre_get(struct idr *idr, gfp_t gfp_mask) struct idr_layer *head; int need; - mtx_lock(&idr->lock); + IDR_LOCK(idr); for (;;) { need = idr->layers + 1; for (il = idr->free; il != NULL; il = il->ary[0]) need--; - mtx_unlock(&idr->lock); + IDR_UNLOCK(idr); if (need <= 0) break; for (head = NULL; need; need--) { @@ -385,7 +392,7 @@ idr_pre_get(struct idr *idr, gfp_t gfp_mask) } if (head == NULL) return (0); - mtx_lock(&idr->lock); + IDR_LOCK(idr); il->ary[0] = idr->free; idr->free = head; } @@ -435,7 +442,7 @@ idr_get_new_locked(struct idr *idr, void *ptr, int *idp) int idx; int id; - mtx_assert(&idr->lock, MA_OWNED); + IDR_LOCK_ASSERT(idr); error = -EAGAIN; /* @@ -506,9 +513,9 @@ idr_get_new(struct idr *idr, void *ptr, int *idp) { int retval; - mtx_lock(&idr->lock); + IDR_LOCK(idr); retval = idr_get_new_locked(idr, ptr, idp); - mtx_unlock(&idr->lock); + IDR_UNLOCK(idr); return (retval); } @@ -522,7 +529,7 @@ idr_get_new_above_locked(struct idr *idr, void *ptr, int starting_id, int *idp) int idx, sidx; int id; - mtx_assert(&idr->lock, MA_OWNED); + IDR_LOCK_ASSERT(idr); error = -EAGAIN; /* @@ -624,9 +631,9 @@ idr_get_new_above(struct idr *idr, void *ptr, int starting_id, int *idp) { int retval; - mtx_lock(&idr->lock); + IDR_LOCK(idr); retval = idr_get_new_above_locked(idr, ptr, starting_id, idp); - mtx_unlock(&idr->lock); + IDR_UNLOCK(idr); return (retval); } @@ -643,7 +650,7 @@ idr_alloc_locked(struct idr *idr, void *ptr, int start, int end) int error; int id; - mtx_assert(&idr->lock, MA_OWNED); + IDR_LOCK_ASSERT(idr); if (unlikely(start < 0)) return (-EINVAL); @@ -669,9 +676,9 @@ idr_alloc(struct idr *idr, void *ptr, int start, int end, gfp_t gfp_mask) { int retval; - mtx_lock(&idr->lock); + IDR_LOCK(idr); retval = idr_alloc_locked(idr, ptr, start, end); - mtx_unlock(&idr->lock); + IDR_UNLOCK(idr); return (retval); } @@ -680,13 +687,13 @@ idr_alloc_cyclic(struct idr *idr, void *ptr, int start, int end, gfp_t gfp_mask) { int retval; - mtx_lock(&idr->lock); + IDR_LOCK(idr); retval = idr_alloc_locked(idr, ptr, max(start, idr->next_cyclic_id), end); if (unlikely(retval == -ENOSPC)) retval = idr_alloc_locked(idr, ptr, start, end); if (likely(retval >= 0)) idr->next_cyclic_id = retval + 1; - mtx_unlock(&idr->lock); + IDR_UNLOCK(idr); return (retval); } From nobody Mon Jun 29 06:34:12 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc1w5BsWz6k59x for ; Mon, 29 Jun 2026 06:34:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc1w31gjz4Ggh for ; Mon, 29 Jun 2026 06:34:12 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714852; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Mn5QNnGJ8YOwBfRIF8wokZnQVCrpiXGHFythC18Q9y8=; b=S92IUvVU7Zi4GGJ500ES4q3ydneQct8sFk1wmFv0WSZirYmS9l6+DZSt3qLkGSNv60duPb mVQ8tNoXaUx+vCbB5hopoOPhi3s1Ud5rE72MjGoIUBHOdL+1jI/tfStgu73lwA6gIyLnF1 nr/KENNSseMYyw14agx+Zu9WuuSFAzitMkzsPxfASNoXc2i9cSOtaIQTwaxZuXZdoSL4zM 5uump2Lhpqi/QRvI03tEk6slLwALNovtKl6ANMZPrcqieeHjearcc5pfD+dyp02SHRqi4Z HjnmyHURAD5vEuwGNQOVxSulOfatp8Mw5UJB9suSERe9wcXrHzzIYTiBZutVEw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714852; a=rsa-sha256; cv=none; b=SlSlDtFruy+AkyLnrs9El3xFatu6YzPfBKQHQNWyQXtM2p5m69JEvkgzHSiWPpK24lyNTl yQlkWkkERCF+Qc399VjftKDNCp/f39DbkseMcIqEdx8p38apqIz0FS08SdeTh4wIiF81cC LyOZh0B5nJ22g6b0PteRDzgGclc6nQKb1Uyslcp0G7FfKgYURW6rTECV1VwyEPDU/xfjt2 oB17bCC5+7BigcNCLBY5kB1m40kO2BMFG2GDHk8DQg/bLe1IpF3odvTbylDvmOA/uvbBbL 5egPj2HwBBthMX9YdcL3G0NVbgQD9Jh9ZKlKFIkROK/V2r59xKHcfEbLHh1eog== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714852; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Mn5QNnGJ8YOwBfRIF8wokZnQVCrpiXGHFythC18Q9y8=; b=QRwiipQs1y44gulqsYEGe+2Ywe/5yAgtlYF3pmxL1DyTLX11N7KuQ/2dCiMhIeO3KrE0Yj nwYRSV8CIrz+q5uRkCUD0dOUimCTDU4/9RI15rvLAJtR4Mfw5Dpw6KDbLr3dkHQGggS5q6 zBWO72KJA/6GBAqw0hyuH8+EVV7iLlmDk7hbP6veLIs67O76dx/8WswDoYFk0E/Qnj4Wog nDzGdBl1kMAOxC0CWNrKWnpM7MrClBpDMcWW1cB6rqlVD1rqMk0onI5Rz3uCc7K0a9w5wo duZpDMHwmMe+3OIf3tJcWkNRuptYsx8ONB+BSc0KridYfeUDGSEYLPUQ6Q/w+Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc1w1dsqzmgZ for ; Mon, 29 Jun 2026 06:34:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46745 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:12 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 7c0c201d86d1 - stable/15 - LinuxKPI: 802.11: add three more driver downcalls List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 7c0c201d86d157217121908e46727c7879d184bb Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:12 +0000 Message-Id: <6a4211e4.46745.737b0eb7@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=7c0c201d86d157217121908e46727c7879d184bb commit 7c0c201d86d157217121908e46727c7879d184bb Author: Bjoern A. Zeeb AuthorDate: 2026-04-26 17:08:03 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:51:49 +0000 LinuxKPI: 802.11: add three more driver downcalls Add (*link_sta_rc_update), (*set_bitrate_mask), and (*sta_set_decap_offload) mac80211 driver downcalls in preparation for further work. Sponsored by: The FreeBSD Foundation (cherry picked from commit ba796102fefa24a1f97286bfeb0d762c16decdf4) --- sys/compat/linuxkpi/common/src/linux_80211.h | 7 +++ .../linuxkpi/common/src/linux_80211_macops.c | 57 ++++++++++++++++++++++ 2 files changed, 64 insertions(+) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.h b/sys/compat/linuxkpi/common/src/linux_80211.h index 89416edfae73..f33075b354d2 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.h +++ b/sys/compat/linuxkpi/common/src/linux_80211.h @@ -500,9 +500,16 @@ void lkpi_80211_mo_wake_tx_queue(struct ieee80211_hw *, struct ieee80211_txq *, void lkpi_80211_mo_sync_rx_queues(struct ieee80211_hw *); void lkpi_80211_mo_sta_pre_rcu_remove(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_sta *); +void lkpi_80211_mo_link_sta_rc_update(struct ieee80211_hw *, + struct ieee80211_vif *, struct ieee80211_link_sta *, + enum ieee80211_rate_control_changed_flags); +int lkpi_80211_mo_set_bitrate_mask(struct ieee80211_hw *, + struct ieee80211_vif *, const struct cfg80211_bitrate_mask *); int lkpi_80211_mo_set_key(struct ieee80211_hw *, enum set_key_cmd, struct ieee80211_vif *, struct ieee80211_sta *, struct ieee80211_key_conf *); +void lkpi_80211_mo_sta_set_decap_offload(struct ieee80211_hw *, + struct ieee80211_vif *, struct ieee80211_sta *, bool); int lkpi_80211_mo_ampdu_action(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_ampdu_params *); int lkpi_80211_mo_sta_statistics(struct ieee80211_hw *, struct ieee80211_vif *, diff --git a/sys/compat/linuxkpi/common/src/linux_80211_macops.c b/sys/compat/linuxkpi/common/src/linux_80211_macops.c index aa6b158b70a7..caee1e0db563 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211_macops.c +++ b/sys/compat/linuxkpi/common/src/linux_80211_macops.c @@ -745,6 +745,46 @@ lkpi_80211_mo_sta_pre_rcu_remove(struct ieee80211_hw *hw, lhw->ops->sta_pre_rcu_remove(hw, vif, sta); } +void +lkpi_80211_mo_link_sta_rc_update(struct ieee80211_hw *hw, + struct ieee80211_vif *vif, struct ieee80211_link_sta *link_sta, + enum ieee80211_rate_control_changed_flags rc_changed) +{ + struct lkpi_hw *lhw; + + lhw = HW_TO_LHW(hw); + if (lhw->ops->link_sta_rc_update == NULL) + return; + + LKPI_80211_TRACE_MO("hw %p vif %p link_sta %p rc_changed %#010x", + hw, vif, link_sta, rc_changed); + lhw->ops->link_sta_rc_update(hw, vif, link_sta, rc_changed); +} + +int +lkpi_80211_mo_set_bitrate_mask(struct ieee80211_hw *hw, + struct ieee80211_vif *vif, const struct cfg80211_bitrate_mask *br_mask) +{ + struct lkpi_hw *lhw; + int error; + + might_sleep(); + lockdep_assert_wiphy(hw->wiphy); + + lhw = HW_TO_LHW(hw); + if (lhw->ops->set_bitrate_mask == NULL) { + error = EOPNOTSUPP; + goto out; + } + + LKPI_80211_TRACE_MO("hw %p vif %p br_mask %p", + hw, vif, br_mask); + error = lhw->ops->set_bitrate_mask(hw, vif, br_mask); + +out: + return (error); +} + int lkpi_80211_mo_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, struct ieee80211_vif *vif, struct ieee80211_sta *sta, @@ -768,6 +808,23 @@ out: return (error); } +void +lkpi_80211_mo_sta_set_decap_offload(struct ieee80211_hw *hw, + struct ieee80211_vif *vif, struct ieee80211_sta *sta, + bool enable) +{ + struct lkpi_hw *lhw; + + lockdep_assert_wiphy(hw->wiphy); + + lhw = HW_TO_LHW(hw); + if (lhw->ops->sta_set_decap_offload == NULL) + return; + + LKPI_80211_TRACE_MO("hw %p vif %p sta %p enable %d", hw, vif, sta, enable); + lhw->ops->sta_set_decap_offload(hw, vif, sta, enable); +} + int lkpi_80211_mo_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, struct ieee80211_ampdu_params *params) From nobody Mon Jun 29 06:34:13 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc1x6LHKz6k5NJ for ; Mon, 29 Jun 2026 06:34:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc1x3bsWz4GQV for ; Mon, 29 Jun 2026 06:34:13 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714853; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=awV9364gwRktFPA0/ONeEi8x5BlnogNvKnfgXQa3HRg=; b=Q/lJDXK4ObrXw5F9ysIMlO2+McKgFuAkJ65d2BM438EG4S2U6WVuTAR1UAE69i0keAlrhf lel4HJkSxHdLT8TW9Bx6lwoBZxDdz2HsgEk9zrkcB5aYcWepG02KtxVaf7c9GjFLowq5r9 FocJh5+pU5e465f4+vJ5dBENT8V3S66nb0WF6VUvXqCN8evTeFaXi3cahB5pjz916paM8i qDgCb7SnGg75dfhYYhAUrK9PA1W/TsFhOunq7ppe9tB5/i3Obf3+UOND9Da1u5RCL6iVM1 dxPrrQ8EKy2fgFOhSsPgHxzDoR4wyuVVnjNMuaa0DPGM2TL8XlP38VTzZsIzjg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714853; a=rsa-sha256; cv=none; b=nYpT1dasgcy9rFH1CB0KzUb094G682bWmk8Z94342C/Uo+7g4sDFoRrKaNUdiQm2ZNmKcx 7HK8iJSVqvcVAJoV60xmeQ7nmgMPOhmBwV1lVGIUUHgWshBpQnbyEPX9k7yvq994QChqRF p4BEoKgBM4N1JBz+cctb5GLnzawGrMj5Wr8qAYKLEwTV7d0fAz3lZsS8NCcpH0vXxuFVjl 59OtQvLlY9RJLy40X4/enRfv4up3BcfHGrr7QaNGhoV7c0hKd5sQO5G/22WibjRrRGNaAT sPVfumXmWcS76nGJyVwsA7siohkko41k1Z4I9y5Fzbx4KS3KlMSZSuyRFh+1jg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714853; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=awV9364gwRktFPA0/ONeEi8x5BlnogNvKnfgXQa3HRg=; b=WaFpXatuk0HX2fAVPkzjaU9wHt/BVPPZ01a8uOqNNT30Bsb0fgXtCvh3n0nwhG0ArqaEmZ ko0G1YT518ngBXm865yx2u8Wh+UlE83B8Vmo3AMCBRwoNCP86b/VsKbMNROmsAcUySoaSz coJP9LNB9VXOTx/TWZWAFH6Z+prD2n8elo7HrM8eYR/vS6D5lK4S4YCaRAuK3Ge7bTcot5 QMn69iaaAyySfwe6gg8BJENf/I54Al2w9Fe1+aal3LjJjkyKjPymbV8OzP/c9nY8ATF0St CWQJ5j8h02GQ4UNKNxXZRJNIadLetRkStJNbqtqcnKWySazfv1T+xOd7Pta+fw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc1x2VzXzmk6 for ; Mon, 29 Jun 2026 06:34:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46996 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:13 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 19ee959ca1fc - stable/15 - LinuxKPI: 802.11: implement ieee80211_start_tx_ba_session() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 19ee959ca1fccb8b7d2c0f99decdc4fcdde249c4 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:13 +0000 Message-Id: <6a4211e5.46996.1205c141@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=19ee959ca1fccb8b7d2c0f99decdc4fcdde249c4 commit 19ee959ca1fccb8b7d2c0f99decdc4fcdde249c4 Author: Bjoern A. Zeeb AuthorDate: 2026-04-26 19:58:08 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:51:54 +0000 LinuxKPI: 802.11: implement ieee80211_start_tx_ba_session() Implement ieee80211_start_tx_ba_session() as a start for rtw8x (and select mt76 chipsets) to support more throughput. Sponsored by: The FreeBSD Foundation (cherry picked from commit fb97712a7f13b85ca707f52f206a2944ee66cf2c) --- sys/compat/linuxkpi/common/include/net/mac80211.h | 6 +- sys/compat/linuxkpi/common/src/linux_80211.c | 102 ++++++++++++++++++++++ 2 files changed, 105 insertions(+), 3 deletions(-) diff --git a/sys/compat/linuxkpi/common/include/net/mac80211.h b/sys/compat/linuxkpi/common/include/net/mac80211.h index 3c783d1f3c8a..c77d37e72fd1 100644 --- a/sys/compat/linuxkpi/common/include/net/mac80211.h +++ b/sys/compat/linuxkpi/common/include/net/mac80211.h @@ -1197,6 +1197,7 @@ void linuxkpi_ieee80211_schedule_txq(struct ieee80211_hw *, struct ieee80211_txq *, bool); void linuxkpi_ieee80211_handle_wake_tx_queue(struct ieee80211_hw *, struct ieee80211_txq *); +int linuxkpi_ieee80211_start_tx_ba_session(struct ieee80211_sta *, uint8_t, int); /* -------------------------------------------------------------------------- */ @@ -2118,10 +2119,9 @@ ieee80211_sta_eosp(struct ieee80211_sta *sta) } static __inline int -ieee80211_start_tx_ba_session(struct ieee80211_sta *sta, uint8_t tid, int x) +ieee80211_start_tx_ba_session(struct ieee80211_sta *sta, uint8_t tid, int timeout) { - TODO("rtw8x"); - return (-EINVAL); + return (linuxkpi_ieee80211_start_tx_ba_session(sta, tid, timeout)); } static __inline int diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index cade61e8446f..ad842ea7a7d2 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -6435,6 +6435,108 @@ net80211_only: } #endif +int +linuxkpi_ieee80211_start_tx_ba_session(struct ieee80211_sta *sta, uint8_t tid, + int timeout) +{ + struct lkpi_sta *lsta; + struct ieee80211_hw *hw; + struct lkpi_hw *lhw; + struct ieee80211_tx_ampdu *tap; + int worked; + + lsta = STA_TO_LSTA(sta); + + /* If tid is out of range, fail gracefully. */ + /* XXX-BZ are we limited to 8? */ + if (tid >= IEEE80211_NUM_TIDS) { + net80211_vap_printf(lsta->ni->ni_vap, "%s: tid %u out of range " + ">= %u\n", __func__, tid, IEEE80211_NUM_TIDS); + return (-EINVAL); + } + + hw = lsta->hw; + lhw = HW_TO_LHW(hw); + + /* No ampdu_action support, just error. */ + if (lhw->ops->ampdu_action == NULL) { + net80211_vap_printf(lsta->ni->ni_vap, "%s: (*ampdu_action) " + "not supported\n", __func__); + return (-ENOTSUPP); + } + + /* Does HW allow us to set this up? */ + if (!ieee80211_hw_check(hw, AMPDU_AGGREGATION)) { + net80211_vap_printf(lsta->ni->ni_vap, "%s: !AMPDU_AGGREGATION\n", + __func__); + return (-ENOTSUPP); + } + if (ieee80211_hw_check(hw, TX_AMPDU_SETUP_IN_HW)) { + net80211_vap_printf(lsta->ni->ni_vap, "%s: TX_AMPDU_SETUP_IN_HW\n", + __func__); + return (-EPERM); + } + + /* We need at least HT or higher support enabled. */ + if (!sta->deflink.ht_cap.ht_supported && + !sta->deflink.vht_cap.vht_supported && + !sta->deflink.he_cap.has_he && + !sta->deflink.eht_cap.has_eht) { + net80211_vap_printf(lsta->ni->ni_vap, "%s: HT or later not " + "supported\n", __func__); + return (-ENOTSUPP); + } + +#ifdef __notyet__ + /* + * We need some rate limiting/disabling in case we try too hard and + * get NACKed over and over. + * XXX-BZ This check should likely go to addba_req along with a counter. + */ + if (lsta->block_ba) + return (-EACCESS); +#endif + + /* XXX-BZ locking? */ + + /* Do we have a running session already? */ + tap = &lsta->ni->ni_tx_ampdu[tid]; + if (IEEE80211_AMPDU_REQUESTED(tap)) { + net80211_vap_printf(lsta->ni->ni_vap, "%s: " + "AMPDU requested/running\n", __func__); + return (-EINPROGRESS); + } + + /* Tell net80211 to setup an aggr sessions. */ + /* XXX-BZ we have no way to carry the timeout forward easily. */ + worked = ieee80211_ampdu_tx_request_ext(lsta->ni, tid); + TRACEOK("ieee80211_ampdu_tx_request_ext %d", worked); + + if (worked != 1) { + net80211_vap_printf(lsta->ni->ni_vap, "%s: " + "ieee80211_ampdu_tx_request_ext returned %d != 1\n", + __func__, worked); + return (-EINVAL); + } + + /* + * How do we make sure the EAPOL handshake has completed? + * Let ieee80211_output do it. + */ + if (1) { + /* Immediately trigger the setup and output of the action frame. */ + worked = ieee80211_ampdu_request(lsta->ni, tap); + if (worked != 1) { + net80211_vap_printf(lsta->ni->ni_vap, "%s: " + "ieee80211_ampdu_request returned %d != 1\n", + __func__, worked); + return (-EAGAIN); + } + } + + return (0); +} + static void lkpi_ic_getradiocaps_ht(struct ieee80211com *ic, struct ieee80211_hw *hw, uint8_t *bands, int *chan_flags, enum nl80211_band band) From nobody Mon Jun 29 06:34:08 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc1y3ycKz6k5HJ for ; Mon, 29 Jun 2026 06:34:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc1y0v49z4GSp for ; Mon, 29 Jun 2026 06:34:14 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714854; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=abxI+d90fUBYEkOBrdJHXR5rH58GJE/z068AXaBFNsQ=; b=Dz0vngdu42r2qSuu0jRZrvHggAHkrFUSRXhsVnmlqMqpGmcyzSqIJ2IBZCjZy+dpjiUySy 9yqR3/SQi0ZQlh0WZU3sRXEl5SI7qKhRRpWLG7MYN57VTwGTLh2jvAeGzUb5Jf7BfI5tGr j2Z0+NW/XBZuv/OLHL4d4STBcW7Hpdwbq1AVmIKoiy8L4KeDlp9K+IegRPHQQkxkDcY7Wh Ye148YDV8BkO/FgBeM65c1YphnnYOunQvV8sNqmZL3VJSuy5m1B0xykA57EgW26UG/lQw/ sZP/hT6l9gg0ntTWiBaQtw4Dc7JcZSjd+FUedVahpWrpxG8uD/i1keInQi+cCA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714854; a=rsa-sha256; cv=none; b=Ai5PxduHTZFYIo1RneSOLpED2E1Ks+8PnP7z5J37xS0IxPVF6puT2p2OcF7Wh4zDdrHWOG IY5q5zM0JfEHo9SLp72jzdTfXLzO6W3ycGAUp+mcWQm/MoF0jhr/KzR7Bszsuoj/ng3b3E 2EY9Hm8eMBxIvvYQMB0H+VC0/fAxW01e5gcy7uf8iEKU+LkVuNHQv5jptph+Xew1k6AsTe qFLqxtuv8bxg1kxi69mEgN5I+j6Ep/CdnZ4Ezphy8tS4oY410rPfba+BHPTvaprcuBltIQ u/BElcVpwYOZb09F8NmOqbuThmY3YaA+f+CENKJIycpL28QvoAPCAAp2plxNRA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714854; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=abxI+d90fUBYEkOBrdJHXR5rH58GJE/z068AXaBFNsQ=; b=YLmoMvTIeGwfzEZdZ0Lus0PxzuZRKl6YQjCBU11IjOFG7EeZRVa3rOPldZLAhTgAwprpYT XukUJcZyqbjaLlfNnAcFIhbW9Ot1m778So00WzAhPgVlYFDwPtUyaTvZTWkplql7oi1vXZ hdaDXkL6JKTAlW/ODi/QdbDqCU29Iw3/hdjHkqOg9SxM8lpDkWqd+5ejGmxzg8+4QN/HUp 12avhMr06n3uKr+ZGV7YnMQETxuI0RZVLg2ZwB20HS+DfHpnpbCJur6FxUbjXkG6Ec17RO TJxHVCui3+vnlrcIFI8cBNLxHMgDP/Aj2YNUZrP0g1MIDlTuprG3ZEQfCzjlfg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc1x6tg5zmRb for ; Mon, 29 Jun 2026 06:34:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46864 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:08 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: ofthecentury From: Bjoern A. Zeeb Subject: git: 41813a11bdca - stable/15 - rtwn/usb: add ID for D-Link DWA-121 rev B1 to rtwn RTL8188EU List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 41813a11bdca870497879178df17e61d089c0840 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:08 +0000 Message-Id: <6a4211e0.46864.19a7a083@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=41813a11bdca870497879178df17e61d089c0840 commit 41813a11bdca870497879178df17e61d089c0840 Author: ofthecentury AuthorDate: 2026-05-30 21:29:09 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:49:49 +0000 rtwn/usb: add ID for D-Link DWA-121 rev B1 to rtwn RTL8188EU Add the device ID to the usbdevs table in order to be able to use it in the rtwn/usb driver for the RTL8188EU attachment. (I adjusted the name to B1 compared to the original submission) PR: 291839 (cherry picked from commit 49b413c4b07016de4ee166779386f0f99b5aac6b) --- sys/dev/rtwn/usb/rtwn_usb_attach.h | 1 + sys/dev/usb/usbdevs | 1 + 2 files changed, 2 insertions(+) diff --git a/sys/dev/rtwn/usb/rtwn_usb_attach.h b/sys/dev/rtwn/usb/rtwn_usb_attach.h index cd5485b36678..ca12480c8f19 100644 --- a/sys/dev/rtwn/usb/rtwn_usb_attach.h +++ b/sys/dev/rtwn/usb/rtwn_usb_attach.h @@ -117,6 +117,7 @@ static const STRUCT_USB_HOST_ID rtwn_devs[] = { { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, RTWN_CHIP_RTL8188EU) } RTWN_RTL8188EU_DEV(ABOCOM, RTL8188EU), RTWN_RTL8188EU_DEV(ASUS, USBN10NANOB1), + RTWN_RTL8188EU_DEV(DLINK, DWA121B1), RTWN_RTL8188EU_DEV(DLINK, DWA123D1), RTWN_RTL8188EU_DEV(DLINK, DWA125D1), RTWN_RTL8188EU_DEV(EDIMAX, EW7811UN_V2), diff --git a/sys/dev/usb/usbdevs b/sys/dev/usb/usbdevs index 28d6e84e723c..3ea6986d5360 100644 --- a/sys/dev/usb/usbdevs +++ b/sys/dev/usb/usbdevs @@ -1789,6 +1789,7 @@ product DLINK DWA182C1 0x3315 DWA-182 rev C1 product DLINK DWA180A1 0x3316 DWA-180 rev A1 product DLINK DWA172A1 0x3318 DWA-172 rev A1 product DLINK DWA131E1 0x3319 DWA-131 rev E1 +product DLINK DWA121B1 0x331b DWA-121 rev B1 product DLINK DWA182D1 0x331c DWA-182 rev D1 product DLINK DWA181A1 0x331e DWA-181 rev A1 product DLINK DWL122 0x3700 DWL-122 From nobody Mon Jun 29 06:34:15 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc200gqnz6k5Yv for ; Mon, 29 Jun 2026 06:34:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc1z57qTz4Ggk for ; Mon, 29 Jun 2026 06:34:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714855; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=A4lH39u3mXE+pv/dnXqZa5mPY8+Crek6InSOF8DGwq0=; b=vEVyBgRF1eqS5+agsSFIBm+vqYrOS1Dn4qbah2tBDgo6VIv5gWP9lxb0JyDvmuP+c678So 67XC7dsUAHONTIhi7vqJBiK99y8r+8ecuqevr59SePUfcfX5X6iwLSnMTgk6tySq3wdGnP CsQFFwUVQkrIZKY8Vq6DVGswrffn91bAbGp8J0Qoy36N7bv/YSv3woC7i5lz+lGxeuhEZY Zt3YF/plDzY49r+B/q+doWoP11CxHo7GMZARJr6Df4RKhwWx8XzLz1Mmd7DHFaKU7RHQlr /Cf36xXQkY9wxove7vLHXaMTB+2Ru8+pha6cH+BypEWUI8H4J4s1E6Q4WAtyjg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714855; a=rsa-sha256; cv=none; b=Q9HouDMtEfY5QmFFTa6O4iB6CIjiRt18veBHPDWiKHedhiQWPcmG+R4l7cH3MafDREVW0T Uvym+ETom1Y0BJCgY2oqYxlOYEeFZIgBTffQ7ccyDEOBWB0DOoSNqAlQq1gglrd/RCYxJY M1LFilUUNPI6fOEb+yOiGjvUb/TnYt0xZrwyMgSoSv440sNMmJigZ8xvUKHjfAfbL7Cd1K fcIODQGYz/wn42yJy/WYOQaXwq+wiq6S23P1qXpSOnj4uOoDaX11yAUU+nN6aeEG391mYv 9aLS+ubRmpOKD3FJ20mwEMYXB56ZklK54JysSDS9F6LNJ5c36U6vAtd6BWoUeQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714855; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=A4lH39u3mXE+pv/dnXqZa5mPY8+Crek6InSOF8DGwq0=; b=oBw66h4dBQdREdz8gi2pUW/IXToCZSVWjSeWFQSppK7M6RloZ9WeN6SFGWJYViYuygwRSs 0ITImgkd6dU/XjITSn/wj06nr503iwKho6QtLJFZ+XM4fhyIHbEHLdOHVFBBZVqCLNnZYS BmW5PkGTWtyJrt92FHxy9O834/jMM/NEZidhThtedkntDMW5kf4JtQXaMLkDb7pTJNpNo6 MoKmtY0Ap3dVOoaHvwvSHDNBN8tf8eV6usux1le58sem9R1i9CAt5UswcfYv0eg16kpB3Z GOw1kfpLihWdU64DBacNQ21l3Y5ULU1Zqlh/pZTyh1a7O9acWCome+YF4JsHPA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc1z4D9PzmGt for ; Mon, 29 Jun 2026 06:34:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 459bd by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:15 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 89781f2723d6 - stable/15 - LinuxKPI: 802.11: adjust tracing for action/ampdu/addba functions List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 89781f2723d65b28d7c62c3e20a10d45638c951f Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:15 +0000 Message-Id: <6a4211e7.459bd.469f1744@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=89781f2723d65b28d7c62c3e20a10d45638c951f commit 89781f2723d65b28d7c62c3e20a10d45638c951f Author: Bjoern A. Zeeb AuthorDate: 2026-04-26 22:43:49 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:52:05 +0000 LinuxKPI: 802.11: adjust tracing for action/ampdu/addba functions Adjust the pure debug tracing to no longer be under HT and add more to the other functions we are interested in, so we can follow the calls more easily. Sponsored by: The FreeBSD Foundation (cherry picked from commit 22ac9be92d1da75989f67d6057a57c69b289b82d) --- sys/compat/linuxkpi/common/src/linux_80211.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 745b3872abe4..637e8dc9d282 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -6004,7 +6004,7 @@ lkpi_ic_recv_action(struct ieee80211_node *ni, const struct ieee80211_frame *wh, ic = ni->ni_ic; lhw = ic->ic_softc; - IMPROVE_HT("recv_action called; nothing to do in lkpi; make debugging"); + TRACEOK("recv_action called"); return (lhw->ic_recv_action(ni, wh, frm, efrm)); } @@ -6018,7 +6018,7 @@ lkpi_ic_send_action(struct ieee80211_node *ni, int category, int action, void *s ic = ni->ni_ic; lhw = ic->ic_softc; - IMPROVE_HT("send_action called; nothing to do in lkpi; make debugging"); + TRACEOK("send_action with action %d called", action); return (lhw->ic_send_action(ni, category, action, sa)); } @@ -6033,7 +6033,7 @@ lkpi_ic_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap) ic = ni->ni_ic; lhw = ic->ic_softc; - IMPROVE_HT("ieee80211_ampdu_enable called; nothing to do in lkpi for now; make debugging"); + TRACEOK("ieee80211_ampdu_enable called"); return (lhw->ic_ampdu_enable(ni, tap)); } @@ -6068,6 +6068,8 @@ lkpi_ic_addba_request(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap, lsta = ni->ni_drv_data; sta = LSTA_TO_STA(lsta); + TRACEOK("ADDBA REQ tid %u", tap->txa_tid); + if (!lsta->added_to_drv) { ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n", __func__, lsta, ni, sta); @@ -6128,6 +6130,8 @@ lkpi_ic_addba_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap lsta = ni->ni_drv_data; sta = LSTA_TO_STA(lsta); + TRACEOK("ADDBA RESP status %d (0 == SUCCESS) tid %u", status, tap->txa_tid); + if (!lsta->added_to_drv) { ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n", __func__, lsta, ni, sta); @@ -6246,6 +6250,8 @@ lkpi_ic_addba_response_timeout(struct ieee80211_node *ni, struct ieee80211_tx_am ic = ni->ni_ic; lhw = ic->ic_softc; + TRACEOK("ADDBA RESP TIMEO tid %u", tap->txa_tid); + IMPROVE_HT(); lhw->ic_addba_response_timeout(ni, tap); From nobody Mon Jun 29 06:34:16 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc211Vm4z6k5Kv for ; Mon, 29 Jun 2026 06:34:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc206GpTz4GQc for ; Mon, 29 Jun 2026 06:34:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714856; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sNjGHtUjpUuJi5EEuSsRtJHmQZfTWdhi1fN3RSFErT4=; b=wl97/ZgDsVf8K6OvJ6uaRZPXGP0gCWmiRwA99zt9xaGdUVtfv06NQK1/oX/QhvheP3SMFz lSTnRb3S61B7MiLpbbCFNPHqwI2UX/RIrxyAJ3KZjXeDWnwaevogz/DAkObSEU7Syc/Awm h1zxhevuAgppQuovMLvPhPh++Rdtjqpn2iwFIdjcoJqrHDtRhu6ssoGWDVNe/bTpOsWUmu 7RAPbwR805BLLqOjfMbWGuh8PSPPRHoF3jqXwkuj5CdZq09EFtfgS0zhFjea9/EcRl5Az4 Lz25eD7Dkyz3zG6gQEPwJ/Q2M+pRgBGU3f2LLiGfHi3wkzf+a30SnN/Kiw66IA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714856; a=rsa-sha256; cv=none; b=iqD6y9EWPpcjB+hpnf4/3JvPIyve/RdYbnTFJuCvoBGZAJI5Kr2q7mV/zXrt1/xbHeZCx6 SdazarSTzAdvLK0IQhKsWRcyVW9ySeBeIZUrqjiTGpfXIblnlcfbNiLb+TDzuwplLNXWCh gEyxk7ZV4q+HjhReJt2j1vbuhVyELdXq+u7bPIhure+UTL4zm0FHJF+SdC7ALSUMxUm1IV aSG7nD9I0p/xwE/3T3GL58eTyK7gfJrh0gYnwoddhkRl6plgArEj5nadFkNl2rN31ILqZc pCGPXFgo1X11CIXk0dmlC1S4oJpZKie6EQKGf1Iqg7hFAYzR6mYC/Mii1AOCzg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714856; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sNjGHtUjpUuJi5EEuSsRtJHmQZfTWdhi1fN3RSFErT4=; b=hudOr7Fo+e0BFbtHTZl7jH2awnDlk7GIF+X3d7wZWV3OVVYaDlPv/VIKcOYlY2NcuMJirf 7CbWITpr9E9p8QtmCIoeBBv4kch5+4M3QQHI4hN1xzHg+SGNFVLlDddGVEf6bEPiBtAvLe J0WrEocSa5DwEyIbswN+Us/8Bfm2qdIVNzMPxDrlThoGgrN/+S5tXlGcRRpN4dseyGHtMt oFq0PTcIbypInTo8VWxUhYry3D/qpjPVzL+IrJEWwTyi/SgEVk3dwJIRTiVjfLH3VhZPjP pDGN1qSD4tkdtNEr4SCuukD5Da+T1xa5ryfnwDlAcSi9JsxQ7C/yrGMxe1MLaQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2053LpzmRc for ; Mon, 29 Jun 2026 06:34:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45ab1 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:16 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: acd657aa2369 - stable/15 - LinuxKPI: 802.11: make *addba* work better List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: acd657aa236905b0d19e372e6e1176e6e81e8536 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:16 +0000 Message-Id: <6a4211e8.45ab1.6e968c34@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=acd657aa236905b0d19e372e6e1176e6e81e8536 commit acd657aa236905b0d19e372e6e1176e6e81e8536 Author: Bjoern A. Zeeb AuthorDate: 2026-04-27 00:48:06 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:52:09 +0000 LinuxKPI: 802.11: make *addba* work better Fill in more details for lkpi_ic_addba_request(), lkpi_ic_addba_response(), and lkpi_ic_addba_response_timeout(). Migrate the ltxq flags seen_dequeue and stopped to a bitfield and add %b support to log messages. This seemed the better approach after needing an additional stop field for BA while we have to hold packets from being transmitted. Sponsored by: The FreeBSD Foundation (cherry picked from commit 259efa730c3d5c52d6ef0faa1d57d66eea5afa8e) --- sys/compat/linuxkpi/common/src/linux_80211.c | 79 ++++++++++++++++++++++------ sys/compat/linuxkpi/common/src/linux_80211.h | 12 ++++- 2 files changed, 74 insertions(+), 17 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 637e8dc9d282..3039d18d7a42 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -891,8 +891,7 @@ lkpi_lsta_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN], } else { ltxq->txq.ac = ieee80211e_up_to_ac[tid & 7]; } - ltxq->seen_dequeue = false; - ltxq->stopped = false; + ltxq->flags = 0; ltxq->txq.vif = vif; ltxq->txq.tid = tid; ltxq->txq.sta = sta; @@ -2173,7 +2172,7 @@ lkpi_wake_tx_queues(struct ieee80211_hw *hw, struct ieee80211_sta *sta, continue; ltxq = TXQ_TO_LTXQ(sta->txq[tid]); - if (dequeue_seen && !ltxq->seen_dequeue) + if (dequeue_seen && (ltxq->flags & LKPI_TXQ_SEEN_DEQUEUE) == 0) continue; LKPI_80211_LTXQ_LOCK(ltxq); @@ -5787,8 +5786,8 @@ lkpi_80211_txq_tx_one(struct lkpi_sta *lsta, struct mbuf *m) if (sta->txq[tid] == NULL) continue; ltxq = TXQ_TO_LTXQ(sta->txq[tid]); - ic_printf(ic, " tid %d ltxq %p seen_dequeue %d stopped %d skb_queue_len %u\n", - tid, ltxq, ltxq->seen_dequeue, ltxq->stopped, skb_queue_len(<xq->skbq)); + ic_printf(ic, " tid %d ltxq %p flags %b skb_queue_len %u\n", + tid, ltxq, ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(<xq->skbq)); } } ieee80211_free_node(ni); @@ -6085,17 +6084,29 @@ lkpi_ic_addba_request(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap, params.tid = tap->txa_tid; params.amsdu = false; - IEEE80211_UNLOCK(ic); + /* We get called from if_transmit all the way up unlocked in net80211. */ + IEEE80211_UNLOCK_ASSERT(ic); wiphy_lock(hw->wiphy); error = lkpi_80211_mo_ampdu_action(hw, vif, ¶ms); wiphy_unlock(hw->wiphy); - IEEE80211_LOCK(ic); - if (error != 0) { + if (error == IEEE80211_AMPDU_TX_START_IMMEDIATE) { + ic_printf(ic, "%s: mo_ampdu_action returned AMPDU_TX_START_IMMEDIATE. " + "ni %p tap %p\n", __func__, ni, tap); + } else if (error != 0) { ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n", __func__, error, ni, tap); return (0); } + if (sta->txq[tap->txa_tid] != NULL) { + struct lkpi_txq *ltxq; + + ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]); + TRACEOK("ADDBA REQ ltxq tid %u flags %b qlen %d", tap->txa_tid, + ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(<xq->skbq)); + ltxq->flags |= LKPI_TXQ_STOPPED_BA; + } + return (lhw->ic_addba_request(ni, tap, dialogtoken, baparamset, batimeout)); } @@ -6165,17 +6176,27 @@ lkpi_ic_addba_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap params.amsdu = false; } - IEEE80211_UNLOCK(ic); + /* We are called all they way up from ieee80211_input* without lock. */ wiphy_lock(hw->wiphy); error = lkpi_80211_mo_ampdu_action(hw, vif, ¶ms); wiphy_unlock(hw->wiphy); - IEEE80211_LOCK(ic); if (error != 0) { ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n", __func__, error, ni, tap); return (0); } + if (sta->txq[tap->txa_tid] != NULL) { + struct lkpi_txq *ltxq; + + ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]); + TRACEOK("ADDBA RESP ltxq tid %u flags %b qlen %d", tap->txa_tid, + ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(<xq->skbq)); + ltxq->flags &= ~LKPI_TXQ_STOPPED_BA; + + lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tap->txa_tid], true); + } + IMPROVE_HT("who unleashes the TXQ? and when?, do we need to ni->ni_txseqs[tid] = tap->txa_start & 0xfff;"); return (lhw->ic_addba_response(ni, tap, status, baparamset, batimeout)); @@ -6246,14 +6267,40 @@ lkpi_ic_addba_response_timeout(struct ieee80211_node *ni, struct ieee80211_tx_am { struct ieee80211com *ic; struct lkpi_hw *lhw; + struct lkpi_sta *lsta; + struct ieee80211_sta *sta; ic = ni->ni_ic; lhw = ic->ic_softc; + lsta = ni->ni_drv_data; + sta = LSTA_TO_STA(lsta); TRACEOK("ADDBA RESP TIMEO tid %u", tap->txa_tid); IMPROVE_HT(); + if (!lsta->added_to_drv) { + ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n", + __func__, lsta, ni, sta); + goto n80211; + } + + /* We need to re-enable the txq and get packets out. */ + if (sta->txq[tap->txa_tid] != NULL) { + struct lkpi_txq *ltxq; + struct ieee80211_hw *hw; + + ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]); + TRACEOK("ADDBA RESP TIMEO ltxq tid %u flags %b qlen %d", + tap->txa_tid, ltxq->flags, LKPI_TXQ_FLAGS_BITS, + skb_queue_len(<xq->skbq)); + ltxq->flags &= ~LKPI_TXQ_STOPPED_BA; + + hw = LHW_TO_HW(lhw); + lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tap->txa_tid], true); + } + +n80211: lhw->ic_addba_response_timeout(ni, tap); } @@ -8586,14 +8633,14 @@ linuxkpi_ieee80211_tx_dequeue(struct ieee80211_hw *hw, IMPROVE("wiphy_lock? or assert?"); skb = NULL; ltxq = TXQ_TO_LTXQ(txq); - ltxq->seen_dequeue = true; + ltxq->flags |= LKPI_TXQ_SEEN_DEQUEUE; - if (ltxq->stopped) + if ((ltxq->flags & (LKPI_TXQ_STOPPED|LKPI_TXQ_STOPPED_BA)) != 0) goto stopped; lvif = VIF_TO_LVIF(ltxq->txq.vif); if (lvif->hw_queue_stopped[ltxq->txq.ac]) { - ltxq->stopped = true; + ltxq->flags |= LKPI_TXQ_STOPPED; goto stopped; } @@ -9096,10 +9143,10 @@ lkpi_ieee80211_wake_queues(struct ieee80211_hw *hw, int hwq) continue; ltxq = TXQ_TO_LTXQ(sta->txq[tid]); - if (!ltxq->stopped) + if ((ltxq->flags & LKPI_TXQ_STOPPED) == 0) continue; - ltxq->stopped = false; + ltxq->flags &= ~LKPI_TXQ_STOPPED; if (!skb_queue_empty(<xq->skbq)) lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tid], false); @@ -9239,6 +9286,8 @@ linuxkpi_ieee80211_next_txq(struct ieee80211_hw *hw, uint8_t ac) goto out; if (ltxq->txq_generation == lhw->txq_generation[ac]) goto out; + if ((ltxq->flags & (LKPI_TXQ_STOPPED|LKPI_TXQ_STOPPED_BA)) != 0) + goto out; IMPROVE("check AIRTIME_FAIRNESS"); diff --git a/sys/compat/linuxkpi/common/src/linux_80211.h b/sys/compat/linuxkpi/common/src/linux_80211.h index f33075b354d2..063be4251ccc 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.h +++ b/sys/compat/linuxkpi/common/src/linux_80211.h @@ -150,12 +150,20 @@ struct lkpi_radiotap_rx_hdr { struct lkpi_hw; +enum lkpi_txq_flags { + LKPI_TXQ_SEEN_DEQUEUE = 0x01, + LKPI_TXQ_STOPPED = 0x02, + LKPI_TXQ_STOPPED_BA = 0x04, +}; +#define LKPI_TXQ_FLAGS_BITS \ + "\010\1SEEN_DEQUEUE\2STOPPED\3STOPPED_BA" + struct lkpi_txq { TAILQ_ENTRY(lkpi_txq) txq_entry; struct mtx ltxq_mtx; - bool seen_dequeue; - bool stopped; + enum lkpi_txq_flags flags; + uint32_t txq_generation; struct sk_buff_head skbq; uint64_t frms_enqueued; From nobody Mon Jun 29 06:34:14 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc1y6MNXz6k54L for ; Mon, 29 Jun 2026 06:34:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc1y4yN8z4GK0 for ; Mon, 29 Jun 2026 06:34:14 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714854; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lK1GcSr4e4avOONR2gC84KedFeOJIYMwAhuOyDc3MNc=; b=Bnye8hTHA5v69soLeuQcXhOowIwA/uLiePbHRIcFqXKHM255p2NVIWU/TyJYzRlUtcS1lt 2vWXzQUzohhuN7svbc99HepzUZwiWA0hC4wyvEkmtrAuVU2cAZu90OZWFYNMKFtv7tCdxr HZ+Eexp7ZMf4BT8RluaQUGa7xLfxl4xnFh0goJMRIKakQMncXVlWioC2IqPMlQ3xOxN9iz Lj86/Ed8szGTnPi55x2lNrd2o8Gz4rKiwHloltBFjPCPNmffgfA19SUBtpCV5eTxbBoFsV nvY8w+g6jQrRpVXVLPZLhRHzPR1i2rzLpTHbSnxWJK8w3kBkpniliqyjNiTfuw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714854; a=rsa-sha256; cv=none; b=sXr3+IQU6ATM01l9tZ/K4JiK9cRV0Kc4kb4VQoD3kk62OUnbI1uZbNCz1Q7j/tItzvwvma FkT5D70Ew8GLbLRu6DHwWHNePzREP7rY4CzlU12ZHtQHi4K72J7RJWkwoniwY46MO6Ao7M KZitscrJtVLSgiGujIobeSOPFKCYocZKT5B7PBfmGk6ZqakDVeSQgGjUP5F37/o6YjCbH5 850RiBSDb1SbLxvEObFkqcSl+Fc7an5SjAvNbFUfHps6HOeJ59o73NcP8+8udC8c8WUt15 PjtpWnoUgz7wsvFX/7bnU2/yHZERPyyzlSFoDIa3R/JdxVr2/vRzhmiWFnWaPQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714854; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lK1GcSr4e4avOONR2gC84KedFeOJIYMwAhuOyDc3MNc=; b=hFYemtrm8cEWOB/vgf0ucpW+nXnaOmpKU3iHCkqXN9vMRX3Kj5epTOh3uEKgBCCA6RFrjG ZerPBGoUKGxBy+wCbHCKx8/x3DRiiJVYYy8ApK4u1VUGiKmti5ectI5yuv/E6+0/aDbgOf 6KYg0nMcGzvk7u0RWZVdc1/pLMT45NrNtopK8LX9B5K5NRP+culemDP6CIa2+5xiJ5dLUI CY+m//htTOsU//R9hpn7ZLeCsb1y2Nr9F3IgqLqaRFCw/uQk+yxnMpIwyhKY5DJCcNVkjk aVK9xI3zrfsogFAYiyDhjTeLJGEPPIaGsjHdHSvX7KCz/fwkMzQuw8tdsor5Lw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc1y3Mr8zmk7 for ; Mon, 29 Jun 2026 06:34:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44f70 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:14 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 7f3d78b819a9 - stable/15 - LinuxKPI: 802.11: add note about rate control support under boot -v List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 7f3d78b819a929c9d514e71ae128e7295b8a4279 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:14 +0000 Message-Id: <6a4211e6.44f70.56073fca@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=7f3d78b819a929c9d514e71ae128e7295b8a4279 commit 7f3d78b819a929c9d514e71ae128e7295b8a4279 Author: Bjoern A. Zeeb AuthorDate: 2026-04-26 20:04:46 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:52:00 +0000 LinuxKPI: 802.11: add note about rate control support under boot -v We currently do not support rate control in LinuxKPI. As more drivers and chipsets gain suppport for higher throughput add a note under bootverbose if we hit one of these cases (currently only older iwlwifi chipsets). Sponsored by: The FreeBSD Foundation (cherry picked from commit a993d281111bef7c760340321e372a7cb6a759a0) --- sys/compat/linuxkpi/common/src/linux_80211.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index ad842ea7a7d2..745b3872abe4 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -7068,6 +7068,12 @@ linuxkpi_ieee80211_ifattach(struct ieee80211_hw *hw) lkpi_enable_hw_scan(lhw); + /* Does the driver/firmware handle rate countrol? */ + /* Currently only older iwlwifi mvm devices are in this category. */ + if (bootverbose && !ieee80211_hw_check(hw, HAS_RATE_CONTROL)) + ic_printf(ic, "NOTE: rate control not supported by LinuxKPI; " + "expect low rates only\n"); + /* Does HW support Fragmentation offload? */ if (ieee80211_hw_check(hw, SUPPORTS_TX_FRAG)) ic->ic_flags_ext |= IEEE80211_FEXT_FRAG_OFFLOAD; From nobody Mon Jun 29 06:34:17 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc222n8tz6k5Ky for ; Mon, 29 Jun 2026 06:34:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc216qY5z4GdY for ; Mon, 29 Jun 2026 06:34:17 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714858; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TBDUH/COIsCvMaSjQZYqxgUhfxq9Optx6Ea4H5EJblc=; b=i8+g3NrAksMrW7GHNWUGWpEkdwh2HXGyy75e8Py9TvFiA4855nlCQZ+1P1/g+H3R5yLAYb WNPMrBvOZyfM0Uh30lHSMP3CV8ziI0Swr3noRNB3qkIoZ2P01mOHYxefQVlvq8Ci2wF1gM /wKKXbVAFmyQGg8HNZDsS2ZYmkzkt/1t3wO+lrTxakGTXzEqsuVD/hUuTYef/gm9cd5xwm dRIuL/HDSAeymKs9rJu3OWLmam0WQoQDTdocTOcgpTs+mSjPwH/gg54AMWGJwG20ta09/R ACkk3NeY7Feqn11s/fOnmL4DAPXdvXFujb6RdskQpejRbWBSbz2NF1ypWoUvFg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714858; a=rsa-sha256; cv=none; b=cH9TBZSVDAandf8ZNDFwIphtPPZyGla9NmMYwOW3u6vrfbXf5zaj2m7ZzBksicSMjbBrDv IOM5awyCe/R5VU9VR5gtKzNVH18zaphDeD6BffPW0w3FuZ3ui/DABOIa2ct1sc6bhDYwUr WyKRkRX0PunP/pZNEBBaZ0lk/AhBou0V/lnrOK4X3gYKgHsjgLjZYfLOK3zSmUzr9LA1RO PVODb5W/xnF3R/dbIJWSS2EknxlJCenunmHRrThYKiMWDpT9L9zuw0yf6v583OVWk1nilb CzbIWg+zMhTEOzSey2K8BIOGa+tgxNRahi+7LUjNC5Da5F6n2nBHHJlgsoo5Fw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714858; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TBDUH/COIsCvMaSjQZYqxgUhfxq9Optx6Ea4H5EJblc=; b=SGk5SeApFrynFFoLeJ1saUlBHg/GFyoaRjkNbdQRl/sdpYVRVRGhR+fFwYwDTAinyEc60v tSeye6BPNOpKeSWVFUvuGa2Umbtx2h7D1zdxpaoZZjKNnjG6Tbd51haCZvGG71788TywvA uq4wvxhGEmw2kuxw+MwVo/B3TgIQ3OXt3os+FwV33b57/ZSAKHa6jbcZBl9wop82lrfSjh fDlA8+0+i9yGsoByfF2mfT+2hxpcXC3a2wc6CjaU44Mu3amQ57bvYlPbc+oJZPAuPH2MMd YJtvQvCPbX6vhwpUeunsLY/GcsT06tt/uIYOlOKehI8+9JPSMbngEHXhiFrjpA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc215tqFzlmQ for ; Mon, 29 Jun 2026 06:34:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44f74 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:17 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 482d4b6e725f - stable/15 - LinuxKPI: 802.11: set flag if frame should be part of an A-MPDU List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 482d4b6e725f081c836ffa268e906bd161f66993 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:17 +0000 Message-Id: <6a4211e9.44f74.79d5b8b8@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=482d4b6e725f081c836ffa268e906bd161f66993 commit 482d4b6e725f081c836ffa268e906bd161f66993 Author: Bjoern A. Zeeb AuthorDate: 2026-04-27 00:55:27 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:52:14 +0000 LinuxKPI: 802.11: set flag if frame should be part of an A-MPDU In the output path where we are sending a frame to the driver mark it if it should be part of an A-MPDU based on its tid, type, and whether net80211 thinks that we are in the right state for this. Sponsored by: The FreeBSD Foundation (cherry picked from commit cda79e505e2120fe3b4c4f16cb18d92bf2e01e4e) --- sys/compat/linuxkpi/common/src/linux_80211.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 3039d18d7a42..81823e225627 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -5843,6 +5843,18 @@ lkpi_80211_txq_tx_one(struct lkpi_sta *lsta, struct mbuf *m) info->flags |= IEEE80211_TX_CTL_USE_MINRATE; /* mt76 */ } info->control.vif = vif; + + if (tid != IEEE80211_NONQOS_TID) { + struct ieee80211_tx_ampdu *tap; + + tap = &ni->ni_tx_ampdu[tid]; + if (ieee80211_is_data_qos(hdr->frame_control) && + !ieee80211_is_qos_nullfunc(hdr->frame_control) && + !is_multicast_ether_addr(hdr->addr1) && + IEEE80211_AMPDU_RUNNING(tap)) + info->flags |= IEEE80211_TX_CTL_AMPDU; + } + /* XXX-BZ info->control.rates */ #ifdef __notyet__ #ifdef LKPI_80211_HT From nobody Mon Jun 29 06:34:19 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc246Cm6z6k5HS for ; Mon, 29 Jun 2026 06:34:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc241BYXz4GKY for ; Mon, 29 Jun 2026 06:34:20 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714860; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4upGsMqs7uHw2LJrUTDZzKRejCzypfp08XdFthD3xig=; b=kZQkqOT71nNE5jPIG9EuAGAmnmL2Fa8CFNzF9B2la5aISKhFcBqw7ry7oi2zQ5NDH0Z6bZ Bzg8GKeoC1YEaJdgF6rT5Z9r3ETcXQ+9PjJcdJQTzuVf9J0nbob78jAHBT2fFd59u8SMRu yJTlBy5jPUA53qQoOMvRLRRhO/JVaOyk/u3kGBF2IveoXqv5mFrZKKW1HzUNoEXtmHV+ul V/5nQq2tBGdQ0lLIQf9XUkkJMdLchb5ScktK6sODyoQYJ8MYFznIuw90p0hprP7BKnQ/7K HnxODHeSm627AFJA6vF8+MrvN/rjvgOYHg8PCtfn07/EYqdIIpkMFEAeCg4syQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714860; a=rsa-sha256; cv=none; b=G+BmF/HKjvFt7dpuINEMvdxNRuAc2guf3/z4b9r+O1sfrvC5yh494Pk/3GGRjSRs8B48JZ 8DXYFHaDfl0wdWSUxT0LyH2WiA6Efurp/mkL5xIou6YfOj2x7VtM2Y4uNLQZWyE3PuXW3D nENI+p6n2kHdlJfCRTdo0PDa+JcQB1t29LE1DbiLQG5QwztY41Hg0iYsA7956Dw406K+0V iVVzHn4Y41FvkbUfxWuShy35g85HV00GCe7SDsjnbEsqoPxU/Sv9oA4MquqTJ5IkYBUWSS fJecCxeAeGPTGGZ7YGjjr9VnND+da8ABjqLdfbnzUaYrO9Orse15EcB4lJiRrQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714860; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4upGsMqs7uHw2LJrUTDZzKRejCzypfp08XdFthD3xig=; b=oKbYXClH5PkrIlZtSVj7mtrA9cNOoPG9rqkcTVrk5e1MS845xK7rxkffQ8X4t9bK8z12no FghCQJNfH3czNSr+PcPk3sGsdMqbWqqVSUUD7UtpnckR7YlRCg3c2XeTE718lEAJatU1+P OYLtIBFcQBFTnfo9ESn5lSw3+V7qsgF015yl2L5vYgwA/XpxypxJVUl0QATzfQPJEhI3cI XmEKf+CNQivTwqYhnTgshXAL7ThOLN30Yv0zkhCaiybSbofRounzNFdgLNAdc5chHsr3/+ tahZSGRasX7gNZyHsJdsuBpYY+LKbQNqLBDydm6FKZMWiw5tclh+5RMjtbvZZA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2400fWzmgw for ; Mon, 29 Jun 2026 06:34:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46749 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:19 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: b592f997f4ca - stable/15 - LinuxKPI: 802.11: set undefined link in TX control info List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: b592f997f4ca8522330937af8940976c942edf4b Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:19 +0000 Message-Id: <6a4211eb.46749.5dbd262e@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=b592f997f4ca8522330937af8940976c942edf4b commit b592f997f4ca8522330937af8940976c942edf4b Author: Bjoern A. Zeeb AuthorDate: 2026-06-10 11:55:21 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:52:23 +0000 LinuxKPI: 802.11: set undefined link in TX control info We are not doing MLO yet so set the undefined link bit in the TX info control message in case a driver checks if the TX would be link specific. Sposnored by: The FreeBSD Foundation (cherry picked from commit f54e9d1b299d73081b33ad3f60471dbb1b243cb3) --- sys/compat/linuxkpi/common/src/linux_80211.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 9dda56c77238..1882c2a12c09 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -5844,6 +5844,10 @@ lkpi_80211_txq_tx_one(struct lkpi_sta *lsta, struct mbuf *m) } info->control.vif = vif; + /* IMPROVE("MLO"); */ + info->control.flags |= + u32_encode_bits(IEEE80211_LINK_UNSPECIFIED, IEEE80211_TX_CTRL_MLO_LINK); + if (tid != IEEE80211_NONQOS_TID) { struct ieee80211_tx_ampdu *tap; From nobody Mon Jun 29 06:34:18 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc236hWpz6k5fl for ; Mon, 29 Jun 2026 06:34:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc230pWgz4GKN for ; Mon, 29 Jun 2026 06:34:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714859; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rH6hUDGANzj0ZM/1o1KfbNqPlBzJOGv8pFCCOdm7boM=; b=YOxzqW4xZXBcq3eI44zghIBGuu7DvsUDd5BbfIMuH/c9NnmN/0G8h+EN9RD39QGxMdSSxQ jc+M6gGjSgmoYbuQZvV4KkvlK6Xg+kJAMM4AnZXB7JWvPPU8ThiRVhLc5B6897qNqqIJOg lL5lihmlWLRjdZFbW8pCpjLvmxPiEaxotxN2MHfu04+ps18HD8RqgTvvOieYGM25YbcUNE wS4el0OVr22LU3b3X1tY10LbJHZ96TtHVWJZHUaytz6MN/+xU36JiPzgdZEo5BZ1ZNu0Kl 3UBd7QVh1AXPmqKW59I6xP69607tdknf+SaxIMgGtroqvV1L41N8Ze00LLUsYw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714859; a=rsa-sha256; cv=none; b=cymoMWpUj5A4gak1wLLD51NwuaaMPqb4q3hMexjgj+pr7pXjD4tgFhn4QNBMaIMkCAcpIk jwPk0ixpdOKBlqNCC/CCnU73qpFsJ9m4xTfX70gqpLPV+oQZYAq6KL/ODEUwIS/wnS5Smy WIJRlls5ZFUEaGP1o7fOygYL1sDImOy9F8OsgE2gjL91XfKgESIgTBOt066LwibQe5xDm0 omqwKuQergUOMffCAukL+sBOvQF8gYG3AVHOQDvgfxFye1yAj0brykigwYpi+dXRBTwVHZ y+t/mVXNf5cPgJLU6Y+pX6xKMZlngiGsbwzcgzGrjocKT2nWg0APZ/n/k0jeng== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714859; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rH6hUDGANzj0ZM/1o1KfbNqPlBzJOGv8pFCCOdm7boM=; b=UJrFvFTNwicfFkrILznYfdU6WpHr+esUNnmo8Uug+PNN4+k042rTig9jQUqnS4VkYdqAVI TpN4nEDjvQJxuG/jOo1k36Ev906buCZjIhUk066SxrbYtXTN+ysM4GV152ILHCV5xHgUkK dVbJxroHkYbO87uvFUIrVUQkPlqhO3vtP0iSCgvsiCraNtyHbwTylWcqgBWEEaiBf3DTx3 o93tO4RlO7xgfP1gi7lmiFjpbBqf70GCNf+x6cp6cRNwFy3VFTJfC8z7dBi5K5Mdw9B6ms Vdn2p+pHNcgM3d/PZj5J7VABzKlmF9FTTi8JBWZgc08P63j58dKQDnR3sp3i0Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc226Hhxzmk8 for ; Mon, 29 Jun 2026 06:34:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4699a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:18 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: c35adba00f29 - stable/15 - LinuxKPI: 802.11: add print masks for tx status flags List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: c35adba00f2923fe1e147b53f6e2be8118426ce2 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:18 +0000 Message-Id: <6a4211ea.4699a.7a801eb3@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=c35adba00f2923fe1e147b53f6e2be8118426ce2 commit c35adba00f2923fe1e147b53f6e2be8118426ce2 Author: Bjoern A. Zeeb AuthorDate: 2026-06-10 11:50:03 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:52:18 +0000 LinuxKPI: 802.11: add print masks for tx status flags Add print masks for tx status flags and use them in the TX tracing in order to more easily debug TX problems. As a result it was easier to determine that some dirver like the mt7921 (or mt76) do not always zero the status bits of the tx status information (it is a union with the control bits passed on TX) and thus we get bogus values back (rather than having flags in a different place than we thought). Sponsored by: The FreeBSD Foundation (cherry picked from commit 0cb3b9229876a2a83d217779cf5ecd09eb153fc3) --- sys/compat/linuxkpi/common/include/linux/ieee80211.h | 11 +++++++++++ sys/compat/linuxkpi/common/src/linux_80211.c | 8 ++++---- 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/sys/compat/linuxkpi/common/include/linux/ieee80211.h b/sys/compat/linuxkpi/common/include/linux/ieee80211.h index b8f29560f200..dede010c57de 100644 --- a/sys/compat/linuxkpi/common/include/linux/ieee80211.h +++ b/sys/compat/linuxkpi/common/include/linux/ieee80211.h @@ -466,9 +466,20 @@ enum ieee80211_tx_info_flags { IEEE80211_TX_CTL_STBC = BIT(20), } __packed; +#define IEEE80211_TX_INFO_FLAGS \ + "\010\1CTL_AMPDU\2CTL_ASSIGN_SEQ\3CTL_NO_ACK\4CTL_SEND_AFTER_DTIM" \ + "\5CTL_TX_OFFCHAN\6CTL_REQ_TX_STATUS" \ + "\7STATUS_EOSP\10STAT_ACK\11STAT_AMPDU\12STAT_AMPDU_NO_BACK" \ + "\13STAT_TX_FILTERED\14STAT_NOACK_TRANSMITTED" \ + "\15CTL_FIRST_FRAGMENT\16INTFL_DONT_ENCRYPT\17CTL_NO_CCK_RATE" \ + "\20CTL_INJECTED\21CTL_HW_80211_ENCAP\22CTL_USE_MINRATE" \ + "\23CTL_RATE_CTRL_PROBE\24CTL_LDPC\25CTL_STBC" + enum ieee80211_tx_status_flags { IEEE80211_TX_STATUS_ACK_SIGNAL_VALID = BIT(0), }; +#define IEEE80211_TX_STATUS_FLAGS \ + "\010\1ACK_SIGNAL_VALID" enum ieee80211_tx_control_flags { /* XXX TODO .. right shift numbers */ diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 81823e225627..9dda56c77238 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -8798,13 +8798,13 @@ linuxkpi_ieee80211_tx_status_ext(struct ieee80211_hw *hw, #ifdef LINUXKPI_DEBUG_80211 if (linuxkpi_debug_80211 & D80211_TRACE_TX) - printf("TX-STATUS: %s: hw %p skb %p status %d : flags %#x " + printf("TX-STATUS: %s: hw %p skb %p status %d : flags %b " "band %u hw_queue %u tx_time_est %d : " "rates [ %u %u %#x, %u %u %#x, %u %u %#x, %u %u %#x ] " "ack_signal %u ampdu_ack_len %u ampdu_len %u antenna %u " - "tx_time %u flags %#x " + "tx_time %u flags %b " "status_driver_data [ %p %p ]\n", - __func__, hw, skb, status, info->flags, + __func__, hw, skb, status, info->flags, IEEE80211_TX_INFO_FLAGS, info->band, info->hw_queue, info->tx_time_est, info->status.rates[0].idx, info->status.rates[0].count, info->status.rates[0].flags, @@ -8816,7 +8816,7 @@ linuxkpi_ieee80211_tx_status_ext(struct ieee80211_hw *hw, info->status.rates[3].flags, info->status.ack_signal, info->status.ampdu_ack_len, info->status.ampdu_len, info->status.antenna, - info->status.tx_time, info->status.flags, + info->status.tx_time, info->status.flags, IEEE80211_TX_STATUS_FLAGS, info->status.status_driver_data[0], info->status.status_driver_data[1]); #endif From nobody Mon Jun 29 06:34:22 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc265kGqz6k5ZD for ; Mon, 29 Jun 2026 06:34:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc262flXz4Gbr for ; Mon, 29 Jun 2026 06:34:22 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714862; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mjEySsAJLmkI6h95OSi5wpyUeG3eVWV9YcVwfJkqHYI=; b=gIZho80ycDu9iqYwH9alg5wEvTMEksfhP9tBThOTYlzP8hxKCiLjQaHWGW8WV13jhUCULd PIQLL0YQ6amnTDsKxaA+WSufQ9ACb13/1uEP9ovTYEP1ky/skdl+/RkhjvZyjwh+B0IBTB b8xHR6uHxjUWpEf7WIy3DIr9zlMe75+9wQDq4bamv8Mfxd8hvG4Q7wq+vcix4u7dN7b60x 1GJlR/hUIkwWnybUzyAGDKzGAjwQ5Di6lwMIL3Ucjrm+VBqBOBXaME/28EHiwTnP6ftsta TbjrH1Gxr++nPYOavo7fLMtE1O+SW+iRxhywt9P2gg/meL/GcCpBVDXdAuoCOA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714862; a=rsa-sha256; cv=none; b=FBZIuSUw8cwOuUqUK5VdC/w08EFJ5vSa2k9zyJ9scEvFvFdb2NxwH/64DRoCVrmeCrjVrQ I5Jrgxr6RYUuBIBPAojKUeay6H7Ve0Qs7NeDzIsU3VSXdcgaIfX45DuOJwzyZCHRr1okJO wLnnhPvGp4OPdI0+tvDFk6EKjAxtNXX5bPx+HWyB/OSEvsPsZOrmeYDSn7+BBV36nYfITn RrvBVSi62jKzf03BTm6yO8caom8u3YqDl+O4TDsPXahV4rJf+mqq0OugKS9LD1tS09f5tG Bfj4Ilz3a/ULT2ogNBbPs0IW5em19Z00uG5uzU1AEWKGT0sckUpkCkPbCEC0yA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714862; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mjEySsAJLmkI6h95OSi5wpyUeG3eVWV9YcVwfJkqHYI=; b=A3K9YkUvgCoj5Y2GPEV6gtDM9R4I5FlZl1X2vniIflM+hkUolaAH/RioDAuXz4i3kEAcPK TkjF8vxqGontvjgwxN3D+A/LA8BrgXwcOU9uU/xRwQOjloenVH1XfIF1rcBBXh44dzFtmc fL8xEFlTINqpQnbaZebe2B6m4u0LQAzKuMi7PX66ESwoWSkhyJCYegToEk1NRyu6dYXQSD pNJxIvUfdr+0LHvcUiVIHdYKk0L3cjvdvqBdDEzECMv9FHuO4eFiq3iw5+b/3ZlycQqehD mqZoT9V06f8Bd/m7EKs0OZKBLw7qbm7tjcPPBVCFtZu4fQU5hm4ONcJc0JScmg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc261dk3zmVH for ; Mon, 29 Jun 2026 06:34:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 47780 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:22 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 280b4c9f19a2 - stable/15 - LinuxKPI: 802.11: force update of net80211 crypto key flags List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 280b4c9f19a2a8e97ad0334296ba43842fcf7f97 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:22 +0000 Message-Id: <6a4211ee.47780.437c5cac@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=280b4c9f19a2a8e97ad0334296ba43842fcf7f97 commit 280b4c9f19a2a8e97ad0334296ba43842fcf7f97 Author: Bjoern A. Zeeb AuthorDate: 2026-06-13 11:25:42 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:53:00 +0000 LinuxKPI: 802.11: force update of net80211 crypto key flags Several drivers (rtw8x, mt76) do not announce the supported ciphers suites in the wiphy instance. This means we never populate net80211 ic_cryptocaps on device creation and thus not announcing any supported hw crypto offload forcing a fallback to software crypto. However when the mac80211 (*set_key) succeeds we know we can offload crypto. At that point the net80211 key flags have IEEE80211_KEY_SWCRYPT set which we want to clear. Historically the net80211 API does not allow this though there should be no ill side effects (base on a quick code inspection). We thus have to DECONST the key argument for now. It is expected that with MFP support this will need to become a common operation and the API will need to change as we will only get the information of some details from the driver on a per-cipher case when the (*set_key) downcall returns. Sponsored by: The FreeBSD Foundation (cherry picked from commit 31ded414b1282abdebcb24c18cc6dbebf84210f2) --- sys/compat/linuxkpi/common/src/linux_80211.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 1882c2a12c09..f612b559df99 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -1570,6 +1570,7 @@ lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k) struct ieee80211_sta *sta; struct ieee80211_node *ni; struct ieee80211_key_conf *kc; + struct ieee80211_key *wk; uint32_t lcipher; uint16_t exp_flags; uint8_t keylen; @@ -1699,6 +1700,16 @@ lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k) kc, kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS); #endif + /* + * Getting here means we support HW crypto offload. + * Some drivers do not set the wiphy [n_]cipher_suites and thus we + * never populate ic_cryptocaps. which means SWCRYPT will be set and we + * should disable this now (before possibly setting other SW flags + * again for when we need partial SW support). + */ + wk = __DECONST(struct ieee80211_key *, k); + wk->wk_flags &= ~IEEE80211_KEY_SWCRYPT; + exp_flags = 0; switch (kc->cipher) { case WLAN_CIPHER_SUITE_TKIP: @@ -1718,8 +1729,8 @@ lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k) #ifdef __notyet__ /* Do flags surgery; special see linuxkpi_ieee80211_ifattach(). */ if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) != 0) { - k->wk_flags &= ~(IEEE80211_KEY_NOMICMGT|IEEE80211_KEY_NOMIC); - k->wk_flags |= IEEE80211_KEY_SWMIC; + wk->wk_flags &= ~(IEEE80211_KEY_NOMICMGT|IEEE80211_KEY_NOMIC); + wk->wk_flags |= IEEE80211_KEY_SWMIC; ic->ic_cryptocaps &= ~IEEE80211_CRYPTO_TKIPMIC } #endif @@ -1742,9 +1753,9 @@ lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k) #ifdef __notyet__ /* Do flags surgery. */ if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) == 0) - k->wk_flags |= IEEE80211_KEY_NOIVMGT; + wk->wk_flags |= IEEE80211_KEY_NOIVMGT; if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0) - k->wk_flags |= IEEE80211_KEY_NOIV; + wk->wk_flags |= IEEE80211_KEY_NOIV; #endif ieee80211_free_node(ni); From nobody Mon Jun 29 06:34:23 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc275g1Zz6k5L4 for ; Mon, 29 Jun 2026 06:34:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc273bnLz4GfT for ; Mon, 29 Jun 2026 06:34:23 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714863; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JuEaeHXlOV96RhR44TMXBY9Y/r9ZWngASOKT8ZP4K2c=; b=UUxFi7mAhP9pgEq9kGJOku1BhdaQc1D/Atia8MfTPECgDbZdBGEyOkjkOdA4HF9PSzBLjc Df45pI8EilQ6Zow0HmqIoUrPloJTvLRaGPuhi3RA9sPoET1yT4WE0DRqMVu+i2NizUXW8Q 9uF489QFfj8Vlb/W1VK2wyDQJ66IG6daZfKcwsLcnuXrjfI/LSrloGJILxtks/58eKf/52 VX2Lsu339PaoLttCFhBEm5CfAJCe9SJLhDt3AnkJFCJeRauRXcabRRQwQVQxQTJ+1CWRea CLogx84YDtmF8fLMU/G1jtIYrwAzoKdx69oK5NW8o4+5h+hnwbWyD1L1/cCi9Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714863; a=rsa-sha256; cv=none; b=TDGt+1JSh8qlTg8KTFyFGwW69bH32vFIMzl7pBnhyamjV94dYysctrYPHu/+YNs0xyjro7 F9AcVkRKQQjO3q0bDqAuSB5024s5U+hlq2/wysBcAnTQ1PzZknnop1tTsQJ9KZmqaGwmXW 1fLYkXB5ikp124omW0oES0ci9DLHOSjNnu/2KLerZWc4MNuX5Peg++hEiw+Yu8qU+Gh7xJ awjrEGdmg7C3dOmVCMwDIgh+qprAuRYtjTyPMMK8LoJdEt0EWET0b1MO0jTGsVLEDetMYX jJs63ic0oQdcLs4yoWTICgwWEAsRvio3vwl5PXP07AowL3FyBaABO77mPBI7Sg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714863; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JuEaeHXlOV96RhR44TMXBY9Y/r9ZWngASOKT8ZP4K2c=; b=xqdEP18JOnjVsjKodALjHtMKBHmmCxP9vJMhG80YaTWV6lo5ALqp/eMhx9C8SgDmtvksw7 fzZAZ/Yac4Ewvp4sLZyj4jD5/m02gRC4w6/lzqT0VHswUQz7i0AHvhjSznnUxWj81SKjJP xipu+ZbS2C2P/3U4I+k21KBvl3LQ2IjhwrpJpYc3uYP8eY6DwLrmB8k3xfMTxYyXjG+FTZ EyjgR3YM8/0dCx0I+IkdzTmgJYAWLPLL24pPOwSWjrDRrOW0KnCanABRO80nRFk17GCmZN UwZQ6vDl9CQ9+kTSaff1a95tZRDjFSE6U+BIdpshpBvs/L8Ew5WRFoYF+0rv2Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc272TDXzmH0 for ; Mon, 29 Jun 2026 06:34:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46a89 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:23 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: fc1c1ff8e28f - stable/15 - mt76: mt7921: prevent PM from scheduling another delayed work on detach List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: fc1c1ff8e28f9f4bcbbd329d782930d1c4d76da9 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:23 +0000 Message-Id: <6a4211ef.46a89.5c719ee1@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=fc1c1ff8e28f9f4bcbbd329d782930d1c4d76da9 commit fc1c1ff8e28f9f4bcbbd329d782930d1c4d76da9 Author: Bjoern A. Zeeb AuthorDate: 2026-06-14 16:37:10 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:53:08 +0000 mt76: mt7921: prevent PM from scheduling another delayed work on detach Amongst others mt76_connac_pm_unref() is calling mt76_connac_power_save_sched() which will (normaly) re-schedule the pm_work. In various parts we also cancel that work, also during PCI detach ("shutdown", "remove" in LinuxKPI terms). However we also keep calling mt76_connac_pm_unref() in the detach path and thus we get to a point where we re-scheduled the work but then the device goes away. At that point LinuxKPI delayed work has a callput pending which is embedded in the work structure (pm_work). The moment we free the device that structure and callout is gone but the callout is still on the list and once that list is walked we panic. Simply prevent mt76_connac_power_save_sched() from getting to the point of possibly re-scheduling the pm_work by setting pm->enable to false in the beginning of the detach path. The are likely more paths which will need the same treatment as the code is by far anything from "symmetric" (that is the attach path is highly bus independent while the detach path is implemented per-bus). Also other chipsets share the same "logical paths" with their own names, so they will need this too once we get to them. Sponsored by: The FreeBSD Foundation (cherry picked from commit 009d92b25f7c2d6ddf3fb4202d0a6a4612a716f1) --- sys/contrib/dev/mediatek/mt76/mt7921/pci.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/sys/contrib/dev/mediatek/mt76/mt7921/pci.c b/sys/contrib/dev/mediatek/mt76/mt7921/pci.c index 46b59c4d0390..b70335aba6bf 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7921/pci.c +++ b/sys/contrib/dev/mediatek/mt76/mt7921/pci.c @@ -51,6 +51,17 @@ static void mt7921e_unregister_device(struct mt792x_dev *dev) if (dev->phy.chip_cap & MT792x_CHIP_CAP_WF_RF_PIN_CTRL_EVT_EN) wiphy_rfkill_stop_polling(hw->wiphy); +#if defined(__FreeBSD__) + /* + * Prevent scheduling ps_work again in mt76_connac_power_save_sched(). + * Otherwise upon shutdown we may have delayed work pending, which on + * FreeBSD means there is a callout running, but the ps_work will be + * freed along with the mt792x_dev and so there is a callout on a list + * which no longer exists. + */ + pm->enable = false; +#endif + cancel_work_sync(&dev->init_work); mt76_unregister_device(&dev->mt76); mt76_for_each_q_rx(&dev->mt76, i) From nobody Mon Jun 29 06:34:21 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2612hqz6k5cM for ; Mon, 29 Jun 2026 06:34:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc251vZwz4GkJ for ; Mon, 29 Jun 2026 06:34:21 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714861; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Yi1hCgjd5m1PsSQstuGXLpjE0aYyIyFl42hPbz12EuI=; b=BbJEN5XUKKGBNG6DTDJxHPBxR9WGsyG1NwOChzZpoC/Imnoga9TUBWk0epnOqwbWzECBtX wlQpz0HfxqW49QwJRuarD7mG/qC0+LNO+mlNA8yrZlO0iY2t6mcaSiE2AFqe5WCxl277Zb BwbZzahqwZVFSzgFcZ7VxmY2KiU8+f892DwYMXVAqkTPsodtAgxqGc9lirb2mFUZLHz+Tz xZjLdGdHxO2eN0KIl5m2GsG52gN9L3ZxYeujWn4YXNPnTiNk0f2pz7NNMObJTtDsznBS3T z/BaziksWGjDnB6sxCnothUgCVGlQfvpahdM8JBjbHzHZTsGaKq83mqhKwMLlQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714861; a=rsa-sha256; cv=none; b=IETLOPwW3BGxSfO3gh8euC2U9FquAY1ch/xLEvOCZAkx7fA6PYnOtQhLzelnFHG1J63wk+ QK2bo2YxVUNKSNFKo9fmQq9bDtarn4VQghDgFVwsb67zW9iE7BHrRa2NUWb+MaECFS224X 9eys1KXyTODzCsVCmRys6bXLSJCtQ1LO8BmJWZK7jjDncoTE6zOfZ27NESztN16kfhk81M qggPHM/pf5FCai/y5E7pMS6jSRsZ6Q4FMAdfHzXreM1FTbH2YDypUWLQXRSuLtBrXCsQEd JJLcofknq/6ek+9ENKh3K8gyN1ViVjmOPxnvZ+N27FqdRrVvMrHUwYoG2C2zsg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714861; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Yi1hCgjd5m1PsSQstuGXLpjE0aYyIyFl42hPbz12EuI=; b=IBcYPat0GpqkF9LddV6NZa+BRTb1KrH1w8/3oDS1NPEy8dy54Jnai4e3OTlmbIxczTLf3L KScCYdplvIgUY5ejbbbL35TDRfRhhmS3yERMUzoeL+3wKUevjnSrlK33fzqdIjLdVRsdlW OffwPd3X155vFIIUYjxFerLIUYYLS2AgSyPYeV/2Nmo8nSJiAHR2ul74OMyG54frN7sl6k h2Ut4ewAbo/MYI7LGcbGEGsVyXBi3SOgT2lN9ESMri1igT1Z54Lh+Hr7hqGQP9wxKlGTjf 3aUxQ6bKvoHLb6APXpRnpLV19lFpLKZ/809urzgCDV3LK1VgmuMc8Xwyccu8CA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc250p0Nzmmd for ; Mon, 29 Jun 2026 06:34:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46b0a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:21 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 7f0adc4da4cc - stable/15 - LinuxKPI: 802.11: improve hw_crypto key operations List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 7f0adc4da4ccedc21a63fe6d39a105d05d4424a3 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:21 +0000 Message-Id: <6a4211ed.46b0a.96cb72@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=7f0adc4da4ccedc21a63fe6d39a105d05d4424a3 commit 7f0adc4da4ccedc21a63fe6d39a105d05d4424a3 Author: Bjoern A. Zeeb AuthorDate: 2026-06-13 11:14:11 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:52:27 +0000 LinuxKPI: 802.11: improve hw_crypto key operations mt7921 would happily receive traffic (MC/BC) and decrypt it correctly when hw_crypto was used but TX would only have garbled data in frames. The problem came from the fact with keys for which we do not have an address the driver will pick the "sta" information from different places (driver view of sta or vif). In the downcall this is signalled by the sta argument being NULL as the linux keyconf has no address field. Us passing the sta for first the pairwise key and then also for the group key likely overwrote the pairwise key on the sta and allowed the MC/BC RX operations to succeed anyway (the observed behaviour). Software crypto was fully fine for mt7921 and showed no problems. Looking some other drivers: - iwlwifi/mld picks the ap_sta if the sta argument is NULL; thus it always worked with our previous logic and this went unnoticed. - rtw88 in rtw_sec_write_cam() decides whether to use the sta address or a broadcast address. - rtw89 in rtw89_cam_attach_sec_cam() picks the rtwsta_link if sta is not NULL and has follow-up logic checking on that. It is yet unclear if some of the MC problems observed on rtw8x stem from the same problem. Sponsored by: The FreeBSD Foundation (cherry picked from commit ff6c95d2c2dffbb024ad19ed306334a7993d964f) --- sys/compat/linuxkpi/common/src/linux_80211_macops.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/sys/compat/linuxkpi/common/src/linux_80211_macops.c b/sys/compat/linuxkpi/common/src/linux_80211_macops.c index caee1e0db563..b2e88719e103 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211_macops.c +++ b/sys/compat/linuxkpi/common/src/linux_80211_macops.c @@ -801,6 +801,22 @@ lkpi_80211_mo_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, goto out; } + /* + * Drivers will apply different logic depending on sta being set + * here or not and that depends on whether we have an address or + * not. wpa_spplucoant::driver_bsd::bsd_set_key() will set a + * broadcast address if we do not have one; further up in + * wpa_supplicant something presumably sets the broadcast address + * for group keys as well. + * We have to "undo" this here and set sta to NULL to avoid + * problems with hw_crypto in various drivers. + * We do this here so all set_key calls for (SET_KEY and DISABLE_KEY) + * are covered. + */ + MPASS(kc->_k != NULL); + if (is_broadcast_ether_addr(kc->_k->wk_macaddr)) + sta = NULL; + LKPI_80211_TRACE_MO("hw %p cmd %d vif %p sta %p kc %p", hw, cmd, vif, sta, kc); error = lhw->ops->set_key(hw, cmd, vif, sta, kc); From nobody Mon Jun 29 06:34:24 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc293437z6k5Cl for ; Mon, 29 Jun 2026 06:34:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc284NsYz4Gkp for ; Mon, 29 Jun 2026 06:34:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714864; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PxySXQej8+qvD6TVvJXEX9jj7COXZ4PFgYM8elrqnGY=; b=pTdzhUJ+xmw6JZ7uXu8TBjA/eNwEK6QSWW3OU3+O7iO0rpxXJVT+91+2bdZ+VoVjf4ojDa O1QJdgavD/Imz57uaGCiEMyhOwOGj4Shy00J+/Qpb4ZIpT0h13mojs+O+8B5huFjXpzPjS WpE+qGWKuvfc/AmKu0tWhkE9pcpAOQcW/WerW+FL1KFvz5CBDAxF59mOJwRu5XhGfvU08s b+webnGPAjixwc0Y6HySFLtEdqmQyAZuPnMN/HWHN4aVPfBtetXC21EyoYKzJrIBBHvyut R7yFud68lDuWwEa6Okn/zZlJ+4nN7wnBM9S1xikZICVaVX8UdwChMZhlrdwnSA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714864; a=rsa-sha256; cv=none; b=nwwbcSh52V6NmB176IvhvdtALjhuSMoQ6cGlr6rcQyXrjE7GDMV5Ti3wZO0L/BWyI8t3fV RAMsB1rRi5srHZmlSYUvcmTFKWn6LvKSv4ar/hwajlbuxiQbt7Ta+YzsKw+zq309/4Rfcd 5eZaMich/TD8WK4Pf108bihZE2Jn9PZ36ecLMb7+6XA25cphIxttAgAAk74Z602xfHubuK JkulnIlefqW7zB77kF0zYznlGfx3VrhPTbvFmu0f4CYrXda2oFgvKc+N2eg76yT40w2XiV DzSkHYd13p1UGxgpx1kTjYCBN03QbQNkMXmP0XTXShQf4Rxxbd3TR+kdKweHGA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714864; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PxySXQej8+qvD6TVvJXEX9jj7COXZ4PFgYM8elrqnGY=; b=CY4k4U9oO0YeqSJZxoEoaPDwu0u8VYoJyICpkXWP+lT7vMJQMu0O/ebpvq9PVychIWKK9x +4umDJMONr+jAIoe7Thd+tCDXDSQ7Ro5m4nvLbxJbI8UJch49mNW914ezEyZUEvfJz1vFb zfBy9MqpREpPOhtpf1ZdKZ8tIcUtdFN1hPufVOjZQLpLDVhJ3P5Nue+K/CZVTwqA7oVSl8 uPcnvwxd/J1xiodPC/A+SLRvM//KPgx2ET8Vj5O+c7sSlh6prwNhRajdLRAjCFNPK3VRrA ljuXngpZc0NZnevd8MA3VpiNZEGg3AYD51pob+vEp0GdohGsHsjU7z9UIA5vcw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc283GvSzmmf for ; Mon, 29 Jun 2026 06:34:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4689b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:24 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 328668cacd73 - stable/15 - linudebugfs: fix simple_attr_write_common() kernel buffer List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 328668cacd735bcdc5fbfe8dbd501e2830f0cc6b Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:24 +0000 Message-Id: <6a4211f0.4689b.249053b7@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=328668cacd735bcdc5fbfe8dbd501e2830f0cc6b commit 328668cacd735bcdc5fbfe8dbd501e2830f0cc6b Author: Bjoern A. Zeeb AuthorDate: 2026-06-10 11:04:20 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:53:14 +0000 linudebugfs: fix simple_attr_write_common() kernel buffer With 2cf15144daf7e we added a kernel buffer for parsing input copying the user buffer into that. The problem is that we only copy exactly as many bytes as the user supplied. printf 1 would have a write_size of 1, while echo 1 would have a write_size of 2 (1\n). But in order to check and parse we need a terminating '\0'. Overallocate the kernel buffer by 1 and make sure it is always '\0' terminated. Remove the check that the string needs to be of different length than the write_size as this will always fail unless the user passes in, e.g., "1\02\n\0" somehow in which case we won't bother as kstrto*ll() will not only handle the '\n' but also stop at '\0' and should be fine or it will fail and we will error. In theory we could use a static buffer here as well as we know a maximum possible length of digits plus \n and \0 and take a min of that buffer length and write_size and then error on a small buffer but given this is an optional debug interface, do not bother with any alloc (size). Fixes: 2cf15144daf7e ("lindebugfs: Pass user buffer pointers ..") Sponsored by: The FreeBSD Foundation Reviewed by: dumbbell Differential Revision: https://reviews.freebsd.org/D57522 (cherry picked from commit 3fa40c5eb8f57972bf0b329fd2d36af4d2700b8d) --- sys/compat/linuxkpi/common/src/linux_simple_attr.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_simple_attr.c b/sys/compat/linuxkpi/common/src/linux_simple_attr.c index e5514194cb33..54eac3bc65fa 100644 --- a/sys/compat/linuxkpi/common/src/linux_simple_attr.c +++ b/sys/compat/linuxkpi/common/src/linux_simple_attr.c @@ -163,15 +163,12 @@ simple_attr_write_common(struct file *filp, const char __user *ubuf, if (*ppos != 0 || write_size < 1) return (-EINVAL); - buf = malloc(write_size, M_LSATTR, M_WAITOK); + buf = malloc(write_size + 1, M_LSATTR, M_WAITOK); if (copy_from_user(buf, ubuf, write_size) != 0) { free(buf, M_LSATTR); return (-EFAULT); } - if (strnlen(buf, write_size) == write_size) { - free(buf, M_LSATTR); - return (-EINVAL); - } + buf[write_size] = '\0'; mutex_lock(&sattr->mutex); From nobody Mon Jun 29 06:34:26 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2C4B87z6k5cT for ; Mon, 29 Jun 2026 06:34:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2B5W5fz4GSf for ; Mon, 29 Jun 2026 06:34:26 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714866; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bNGxLm3GUWdHzuf3qzvTXLIfBZdPjxibYHzTkJBGJYI=; b=yIK+3RZb6GkKLsPe5DNDiVaSsKbGHuxiPUC8b6Bjl36X0Roe1ucUNqfvO6H9u6Z8EgFwMm MoQrcIBExFqD8An0fl/9DAsV6qVlaUvMPSUcgcPYQElZq4G7QTSaV9amVwcE5Iel9Do+w/ nkRccqMUaur28JGMoP/VYJJCS8zeMAaMGZKA7SW3xj2jHV0nCFCLnRUTpVKkpxArRB39x7 fAhEBlj3IjE1eKwxLcdO//zSTq1089pjll22+H+8sxYKq+k1vsHtuhRDE8E9V+B6N+5wiS Y1+ivkQoSwtAJ/W5QGZRwCePJ67JLtFL63kJPFqD2fmbfiqAH/RzVuOLlNnp9g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714866; a=rsa-sha256; cv=none; b=fw5a0wqX/dGk72FF9Iw4tnhcRg5m6hDrQdirTpiq/TAFWzF4c6YgIVJ2qCHYBVOsV7x5rh GgZMn+CG9teKnwv7Pw+zOypwXfa3ifk3mdmMBJx4nb8qd1S6+QHbtiQqi8f21N7wRIL0I5 D0DvO8AlkvN3aR7YoSl9CSjbnlcsziY5HQPlKR6cXnKiPR2SBkz/MeUQsPbywilGQAMTsO 7DwC76Y+YOMB4M4isu22JovLgQh5o8E3sF+nF1dKMt1fF2YwEH6v+vbVl8hympqwq63Nfy A/H9bHwCZdsViUN6yFleM59PoF1GvQi4/xz4LeMByI76TYmL5O8t5Ig9ZNfcJQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714866; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bNGxLm3GUWdHzuf3qzvTXLIfBZdPjxibYHzTkJBGJYI=; b=KlIxYUPiM+cmm11Migz6P+VwzUE9KsUTblc28qmv9veVCKR417qNAuE7sMeJ6g/+LPmyQ3 c1wXk+yJ4saQzSSZBiZuHkiTN++eU+b0cXMlEgQdH6UTM8bJ45u2WbREIFrF8MNrsv1jGg N+Ld6TYqfVo+mDiJiHJ255YmW1bOaX1jyqvZneXE705TbpVs3wdaz0K3KuAa9xSfBXuWja 2y5FV8sllrbWzqkME9ZSk4hZhbFZcExQnVEoepw5ZX8rwwTPDi+hCfO4sACblo/tRK6mI0 nn7OUYYxWCZ/OmTnCRP/pidZf6sgZHLPCcq+LJgxIWbiJu696R1WU56PM9/ncA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2B4VyFzmMf for ; Mon, 29 Jun 2026 06:34:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46869 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:26 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 2f6c1f9a9bbc - stable/15 - callout: ddb: resolve symbol of callout function List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 2f6c1f9a9bbc942db1b6ddc3f91189762e63286e Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:26 +0000 Message-Id: <6a4211f2.46869.1a8d4a02@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=2f6c1f9a9bbc942db1b6ddc3f91189762e63286e commit 2f6c1f9a9bbc942db1b6ddc3f91189762e63286e Author: Bjoern A. Zeeb AuthorDate: 2026-06-10 11:57:09 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:53:26 +0000 callout: ddb: resolve symbol of callout function In the ddb show callout function try to resolve the symbol of the callout function to improve debugging. In my case I went through various callouts from show ktr to check what they were and this saved me opening lldb/gdb next to it (and still having the old kernel as the panic to debug was upon reboot). Sponsored by: The FreeBSD Foundation Reviewed by: rlibby Differential Revision: https://reviews.freebsd.org/D57521 (cherry picked from commit b8ec4929e9f4c83bf02f412de1f9022b17abf867) --- sys/kern/kern_timeout.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sys/kern/kern_timeout.c b/sys/kern/kern_timeout.c index 0fa1af6ef5a7..1f97e4f813a1 100644 --- a/sys/kern/kern_timeout.c +++ b/sys/kern/kern_timeout.c @@ -1485,7 +1485,9 @@ _show_callout(struct callout *c) C_DB_PRINTF("%" PRId64, c_time); C_DB_PRINTF("%" PRId64, c_precision); C_DB_PRINTF("%p", c_arg); - C_DB_PRINTF("%p", c_func); + db_printf(" %s = %p (", "c_func", c->c_func); + db_printsym((db_addr_t)c->c_func, DB_STGY_ANY); + db_printf(")\n"); C_DB_PRINTF("%p", c_lock); C_DB_PRINTF("%#x", c_flags); C_DB_PRINTF("%#x", c_iflags); From nobody Mon Jun 29 06:34:25 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2B2JKzz6k5ZK for ; Mon, 29 Jun 2026 06:34:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc294lPYz4GnQ for ; Mon, 29 Jun 2026 06:34:25 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714865; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BNa2K3H+W/IeCYbAhM+2gYCd9UG02q337iBFc5RmWhc=; b=lDrVS4e01D9dwc0D/1VNTUhMSBhNaDjsC0uuer0SACLW6bbJTbXBPViPZTnofo7mnjFpob n7et0UBDsbETCDAhNqMXbYeYr0yB9t427HTN8k9mG5Cv9Sc/LGoR+56ooP+VA02Uuu5zi5 bTxFYajybjc4iIGj9DG+WyIU8w/wS0KaUPhhxjM8dUCERaqGGK/REbdE214QnH7d9l6JC2 X6tUdrNUjMvYBBo4P/UZDqrOsWFtdGmjaqO1kGxzNOJfQ8RwCJIQHKCZE5T84C8Wu3cfkX ugxnHryuCqKfX44RVjuZfJMMTXXm2jaq+t8ffsiGyrlSRQRMuvTQhBH3VfUNUw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714865; a=rsa-sha256; cv=none; b=XpCaAbMCyA4IcXIGT2iuLLz0XcKVnxmKahKn4BaGqHrRsA2cW7qOlIIEhCmTsxv+BbzWem vPmnpUjB2KuC0WiYJuA1c99/jbNRQVk6+M5/tzSx4AikouiNXWrU4YVdrUWILoKsKo09/r KhWr1KK7QPJy+nCxTpyrmhb80NtlaBPP8OLQq5R/Jb4Q1kOfCsZE41W2/nNsWDKJOU61lG OLxe8tPka9stn6SnSU6txTi/C0SX2Hlg5mTYcB6iNwBD++DQlEs8OV4zIb3CLEDbDZKy5s ZFGnMlaAg7ZEnR7seH40ezJvzgPlPB7IIcCAG5Zgt5WgX+fgRuyh5Xr7tStU7g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714865; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BNa2K3H+W/IeCYbAhM+2gYCd9UG02q337iBFc5RmWhc=; b=Ubx+w/yVqXljVmOh0DnAmS7q3IS5zM+WLtACcOw1lBQafsXDVkcjGk/UQCoV4QKxaO6kor Z6FClcBitZOnLaGT7F8994v9YxqORTX3KJ/KEp47rA941QuHbwl3M0cjptYpx+mdRXa3Ge JVAmGmeuqp6Mot7ypXjx1ELiK8dHtWh7YFu2nG1uozgft45CXTfpgSRlN+repCZ4Yd+/N0 ocZl4hbBpOfp+aT9CIaU1ran4kAI1RDmcDgS2W0SSZltOs9b+EbrquMBFNRUQjYkziBVqn hyX5YJIYO69PgW08kAwVlvsmauHggDme+VVjJIg8oy/0kj+osqpHanV6fsyVrQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc293pxvzmRh for ; Mon, 29 Jun 2026 06:34:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4699e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:25 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 2a3f125a39bd - stable/15 - lindebugfs: improve an error message List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 2a3f125a39bdbb39a5e238313166d7e59eeba0ce Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:25 +0000 Message-Id: <6a4211f1.4699e.2d17278@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=2a3f125a39bdbb39a5e238313166d7e59eeba0ce commit 2a3f125a39bdbb39a5e238313166d7e59eeba0ce Author: Bjoern A. Zeeb AuthorDate: 2026-06-10 11:18:47 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:53:21 +0000 lindebugfs: improve an error message In case the fill function fails do not report (read/write) but the actual operation only given we can easily determine it. Sponsored by: The FreeBSD Foundation Reviewed by: dumbbell, emaste Differential Revision: https://reviews.freebsd.org/D57523 (cherry picked from commit 84008e34ce5fb92c69b63cdf1ce2938c5006320b) --- sys/compat/lindebugfs/lindebugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/compat/lindebugfs/lindebugfs.c b/sys/compat/lindebugfs/lindebugfs.c index 88b92afd374a..89652b5685c4 100644 --- a/sys/compat/lindebugfs/lindebugfs.c +++ b/sys/compat/lindebugfs/lindebugfs.c @@ -191,8 +191,8 @@ debugfs_fill(PFS_FILL_ARGS) if (rc < 0) { #ifdef INVARIANTS - printf("%s:%d read/write failed with %zd\n", __func__, __LINE__, - rc); + printf("%s:%d %s failed with %zd\n", __func__, __LINE__, + (uio->uio_rw == UIO_READ) ? "read" : "write", rc); #endif return (-rc); } From nobody Mon Jun 29 06:34:27 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2D1Vfpz6k5LJ for ; Mon, 29 Jun 2026 06:34:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2C71R1z4Gl5 for ; Mon, 29 Jun 2026 06:34:27 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714868; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JKQhfqp+4PiO+xi6awzZ0Pc2jDVRuhCmvL5yKoQTKC0=; b=S/0XpNy5VJ/FNNUrgGppP8OOTjy3Gg7QZb5vjjOybdMGaO6laWvR8YpcQx/UUuKuAW7n+u Z4k7vjNne4NcWF2tSCwcZOuAVGYh3jeSF67uHnGtKreStlsjLp3s/Jp6QcY42OBs9zdway Lsw74xIFoWOAxQvJScfuIYG72QL2WAb4johX5ioiTn32+jhTEEe0KU3Lgjn2mzFs6gnMc7 bKDWxU8TnRsS4+letuDfJz4FDNoPSiuiMcYV/DoYGvlywPCtFepuZysJtqPSlPDCJKXOpV hKr0YusW5LZ5zKvg4eiBvPxhb1/JdfA9FC5QI0D+7GmRYe1teS2ypJvIh3EnTw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714868; a=rsa-sha256; cv=none; b=ebkH0SAR0hr9oFyPR0lw9x31AC0pQLko44nDnba6uooAMMU6+yJ9knKiz2crz15LlhpKsk uIVKaZh6bVi7dxA7UJnv4jQOG23SVPeQDhqOv6SssXReH/Q5qGy0mNJ0RvkxLowWn6GO8+ f0tiB6mx6kBUW5SC7BpsLcpfKr0Q86DIug9CHGoRNj/xihoRSBVVLTggOtBoyCkRsBnYnL uA6CiiMe0E56lX1suLe3ZhsXBLet8W/kuEnRF+8K5nI5M2bVe2cKtfakSqF+l4uoTLKBm3 glOs7wnGX+uTXKwRG5mYLF+g1VilvQ07cUWc3vDfyXRX0AhhyZh6sUqt2/QbFA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714868; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JKQhfqp+4PiO+xi6awzZ0Pc2jDVRuhCmvL5yKoQTKC0=; b=B0gVsy2EEhY1vQJ/uglCTHK7HQGmwPuLDScudYvLf5rWeG6jXNvumPcLX7Yr78+wCd6GYa qfLVLq5CHuOJyrANjPXc53oAGW0dj6Bh3LMGZ0ma508d1fd/ANNwk8EOiwtpUeZvwYfsfk 8Rg8gXYPuy5FGNlQ1c9heRvGmHUuZyk/TVkDo7YZoTsRpBAa72mlpBZt0RbldIOQIw7p2H kACHlwzuGk9WSRZrVMrk4Rn4ogiACg6ABs5RZX6n60yZRnQjULRpuvCEpG0+8oiAJUWdUL KFuq1MINxOjr9AktP3zVomqUmmRWC6b0qcekGVF4olpXQAGknpBERxbmeXlvjg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2C5M27zmkB for ; Mon, 29 Jun 2026 06:34:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4674d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:27 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 0acc685b19b9 - stable/15 - mt76: ensure net80211 com instance before returning from driver load List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 0acc685b19b9b3f3592bd28a0fa4ec753d9e6305 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:27 +0000 Message-Id: <6a4211f3.4674d.2900ddf3@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=0acc685b19b9b3f3592bd28a0fa4ec753d9e6305 commit 0acc685b19b9b3f3592bd28a0fa4ec753d9e6305 Author: Bjoern A. Zeeb AuthorDate: 2026-06-08 06:50:30 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:53:33 +0000 mt76: ensure net80211 com instance before returning from driver load Do as we have done for iwlwifi (f808c43ad923, bee60c989745) add a completion event for device registration which calls into 802.11 and creates the wifi "device" (net80211 com instance). This is needed as otherwise the deferred work in the mt76 drivers (mt7915, mt7921, mt7925, mt7996; but not the 7615 [*]) would make driver loading return before the wifi device is there. We would then continue, e.g., during rc startup and race possibly trying to create a vap (wlan interface) with the underlying device not being registered yet and fail. [*] the 7615 does not seem to do this asynchronously so is fine. Sponsored by: The FreeBSD Foundation Tested on: 7921, others to be tested at time (cherry picked from commit baf8561bdc3f39c542a82cd1235fbf4bf97b4310) --- sys/contrib/dev/mediatek/mt76/mac80211.c | 4 ++++ sys/contrib/dev/mediatek/mt76/mt76.h | 3 +++ sys/contrib/dev/mediatek/mt76/mt7915/init.c | 6 ++++++ sys/contrib/dev/mediatek/mt76/mt7921/init.c | 7 +++++++ sys/contrib/dev/mediatek/mt76/mt7925/init.c | 7 +++++++ sys/contrib/dev/mediatek/mt76/mt7996/init.c | 6 ++++++ 6 files changed, 33 insertions(+) diff --git a/sys/contrib/dev/mediatek/mt76/mac80211.c b/sys/contrib/dev/mediatek/mt76/mac80211.c index bd7aaeb4398e..1f38b7ad6697 100644 --- a/sys/contrib/dev/mediatek/mt76/mac80211.c +++ b/sys/contrib/dev/mediatek/mt76/mac80211.c @@ -814,6 +814,10 @@ int mt76_register_device(struct mt76_dev *dev, bool vht, set_bit(MT76_STATE_REGISTERED, &phy->state); sched_set_fifo_low(dev->tx_worker.task); +#if defined(__FreeBSD__) + complete(&dev->drv_start_complete); +#endif + return 0; } EXPORT_SYMBOL_GPL(mt76_register_device); diff --git a/sys/contrib/dev/mediatek/mt76/mt76.h b/sys/contrib/dev/mediatek/mt76/mt76.h index 840725b8b020..ca26a4e43b92 100644 --- a/sys/contrib/dev/mediatek/mt76/mt76.h +++ b/sys/contrib/dev/mediatek/mt76/mt76.h @@ -1026,6 +1026,9 @@ struct mt76_dev { } test_mtd; #endif struct workqueue_struct *wq; +#if defined(__FreeBSD__) + struct completion drv_start_complete; +#endif union { struct mt76_mmio mmio; diff --git a/sys/contrib/dev/mediatek/mt76/mt7915/init.c b/sys/contrib/dev/mediatek/mt76/mt7915/init.c index 4128942361ff..d87878f9a86e 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7915/init.c +++ b/sys/contrib/dev/mediatek/mt76/mt7915/init.c @@ -862,6 +862,9 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2) mt76_wr(dev, MT_INT_SOURCE_CSR, ~0); INIT_WORK(&dev->init_work, mt7915_init_work); +#if defined(__FreeBSD__) + init_completion(&dev->mt76.drv_start_complete); +#endif ret = mt7915_dma_init(dev, phy2); if (ret) @@ -1298,6 +1301,9 @@ int mt7915_register_device(struct mt7915_dev *dev) } ieee80211_queue_work(mt76_hw(dev), &dev->init_work); +#if defined(__FreeBSD__) + wait_for_completion(&dev->mt76.drv_start_complete); +#endif dev->recovery.hw_init_done = true; diff --git a/sys/contrib/dev/mediatek/mt76/mt7921/init.c b/sys/contrib/dev/mediatek/mt76/mt7921/init.c index dbbc9e945fe2..ece84a826ea4 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7921/init.c +++ b/sys/contrib/dev/mediatek/mt76/mt7921/init.c @@ -308,6 +308,9 @@ int mt7921_register_device(struct mt792x_dev *dev) INIT_WORK(&dev->reset_work, mt7921_mac_reset_work); INIT_WORK(&dev->init_work, mt7921_init_work); +#if defined(__FreeBSD__) + init_completion(&dev->mt76.drv_start_complete); +#endif INIT_WORK(&dev->phy.roc_work, mt7921_roc_work); timer_setup(&dev->phy.roc_timer, mt792x_roc_timer, 0); @@ -359,6 +362,10 @@ int mt7921_register_device(struct mt792x_dev *dev) queue_work(system_percpu_wq, &dev->init_work); +#if defined(__FreeBSD__) + wait_for_completion(&dev->mt76.drv_start_complete); +#endif + return 0; } EXPORT_SYMBOL_GPL(mt7921_register_device); diff --git a/sys/contrib/dev/mediatek/mt76/mt7925/init.c b/sys/contrib/dev/mediatek/mt76/mt7925/init.c index 31592775feb3..3b7c1668dc61 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7925/init.c +++ b/sys/contrib/dev/mediatek/mt76/mt7925/init.c @@ -228,6 +228,9 @@ int mt7925_register_device(struct mt792x_dev *dev) INIT_WORK(&dev->reset_work, mt7925_mac_reset_work); INIT_WORK(&dev->init_work, mt7925_init_work); +#if defined(__FreeBSD__) + init_completion(&dev->mt76.drv_start_complete); +#endif INIT_WORK(&dev->phy.roc_work, mt7925_roc_work); timer_setup(&dev->phy.roc_timer, mt792x_roc_timer, 0); @@ -282,6 +285,10 @@ int mt7925_register_device(struct mt792x_dev *dev) queue_work(system_percpu_wq, &dev->init_work); +#if defined(__FreeBSD__) + wait_for_completion(&dev->mt76.drv_start_complete); +#endif + return 0; } EXPORT_SYMBOL_GPL(mt7925_register_device); diff --git a/sys/contrib/dev/mediatek/mt76/mt7996/init.c b/sys/contrib/dev/mediatek/mt76/mt7996/init.c index 34f1df207f19..6568f77bba37 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7996/init.c +++ b/sys/contrib/dev/mediatek/mt76/mt7996/init.c @@ -1222,6 +1222,9 @@ static int mt7996_init_hardware(struct mt7996_dev *dev) } INIT_WORK(&dev->init_work, mt7996_init_work); +#if defined(__FreeBSD__) + init_completion(&dev->mt76.drv_start_complete); +#endif INIT_WORK(&dev->wed_rro.work, mt7996_wed_rro_work); INIT_LIST_HEAD(&dev->wed_rro.poll_list); spin_lock_init(&dev->wed_rro.lock); @@ -1736,6 +1739,9 @@ int mt7996_register_device(struct mt7996_dev *dev) #endif ieee80211_queue_work(mt76_hw(dev), &dev->init_work); +#if defined(__FreeBSD__) + wait_for_completion(&dev->mt76.drv_start_complete); +#endif dev->recovery.hw_init_done = true; From nobody Mon Jun 29 06:34:28 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2F5K5Pz6k5LL for ; Mon, 29 Jun 2026 06:34:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2D74Twz4Gcg for ; Mon, 29 Jun 2026 06:34:28 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714869; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PRM5tn/9l0OJTBkml/AIVZt8+hd12AToUXiO0cvSgfQ=; b=wx87NWiXbvzgAzTlJhw668LzavWRjhId+YrKN/CyWzTxrvgQkbDI1JhS/NZKW3wQg5/eE1 oqZnOOWvyAnu8We2WSXjCq+xhVKZxV6VgQS4HZP1TQA6c0OAsLmSCiDvPg9w/FQzNVLqxj JJdzfuQTqLFZvQsDq09fgBZba4lN5cqjfblwuclhQCRkXEXuXA0yGdxscRUjvW6GYaGrII oQMchxH2tdF25lHz6A43bmniDClPAssjk+Ye5Gq/1BjrV/NyIWGfNTuiGAwgZTKfDJwfQl 9TA1J6RlfuoZJiBm7M2E9aKQnlHIDO3qSTTGHZp9oLkpxe1SA+NVYwso4yrwsA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714869; a=rsa-sha256; cv=none; b=dXMNEuDiJ1GqW8/zMfn8X2uH6M18Qi9sZOwyEsagtuxGDezZhcSRLo7O3fnepjbEQpZLVa Elo+TN3c2AymVF2MhMA7bmr9jTJUbKrP9vgNHFuv6aAWTU/TaVUF/t2uSu8eOymO+7WBab qjo3TakiheHTT/M8qluWyIszS9yLq8QeQJKn3/JfRXauc7PTkSGbM0uEGku3QWYIvPv3kA retLx+fTT/It5fcRfEEkh8oJK6NkUsHRi4xj3PvRLyEyOZ1bTpr/WOe8m9TGk/j3ibgY1D M44vRGjHs4yopHUX0yjCJhFZ9Jh+4cNHDcMJ34DqFZxknVzQGMOd2tze05KONA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714869; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PRM5tn/9l0OJTBkml/AIVZt8+hd12AToUXiO0cvSgfQ=; b=bWoTHuG1+9lumAAS7ObYk6VHexACeMlWd0JN//20jI1RgWFBHyDP8A2Jvf7/GBbtt4w3lu 0hyF4p6SvPxSTWttZUgR9XPgTjFNE9cR25bU8HLa/4lVk+CXqJOtxazc8/stsU3+qjDpPd n5pg47NWIBhU4D1GNMX5Et0j20ZzBqZbcUq0y420fuvF4YgIdsYZhZtzwpnfETgRVxNVDB sNclkg5u+W/9OoZN0UsOCf+5GQi3o9Dj80cOeHlONwVYbGP0TS3xCQEDFttxEJMWODPe/4 mfKBGieNRdf5s9sAUmS1cDeSy09xlkq31JwhfbLEPhK4HdtJX27FPlNEdnCGtw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2D5tRbzmkC for ; Mon, 29 Jun 2026 06:34:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4686d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:28 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 7e31274a8624 - stable/15 - mt76: mt7921: terminate fw log messages with \n List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 7e31274a86246ea59d141840ff6303c3829ab209 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:28 +0000 Message-Id: <6a4211f4.4686d.22bd0e19@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=7e31274a86246ea59d141840ff6303c3829ab209 commit 7e31274a86246ea59d141840ff6303c3829ab209 Author: Bjoern A. Zeeb AuthorDate: 2026-06-10 11:22:44 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:53:41 +0000 mt76: mt7921: terminate fw log messages with \n In order to make the firmware messages spewed on the console readable write one message per line and not one very long line. Sponsored by: The FreeBSD Foundation (cherry picked from commit b662295ecb620b8ebf00188a111ff16701b0375d) --- sys/contrib/dev/mediatek/mt76/mt7921/mcu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sys/contrib/dev/mediatek/mt76/mt7921/mcu.c b/sys/contrib/dev/mediatek/mt76/mt7921/mcu.c index c553423e178c..908740f2a62a 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7921/mcu.c +++ b/sys/contrib/dev/mediatek/mt76/mt7921/mcu.c @@ -234,7 +234,11 @@ mt7921_mcu_debug_msg_event(struct mt792x_dev *dev, struct sk_buff *skb) if (!msg->content[i]) msg->content[i] = ' '; } +#if defined(__linux__) wiphy_info(mt76_hw(dev)->wiphy, "%.*s", len, msg->content); +#elif defined(__FreeBSD__) + wiphy_info(mt76_hw(dev)->wiphy, "%.*s\n", len, msg->content); +#endif } } From nobody Mon Jun 29 06:34:29 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2G4sp4z6k5Bm for ; Mon, 29 Jun 2026 06:34:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2G1BdHz4Gct for ; Mon, 29 Jun 2026 06:34:30 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714870; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FxxnaXKUlt/d8sw8ujXzetoqYMYjnlIojp/dTYAt/1w=; b=lsGWk5tL6gz1LTMh8RJKJKCZmXQpyK0gi+tTL1E3JWfE6Ww9LjuXYLH6HDDpYcHZ0ogvyr AbTGif/Var37SXd16misYg4Xc2+DIqAoVfoxD57xStyRUT1VhJ0nqrLD3EfuK7EnrNI2ou olB9vmZUEnWY2teUndo5kVflwwCNdanhsBJ0nrn/4WYxCjQIAAyGwvInqahwtN+knd8l+0 oFVvGjA/Nr7B9TDKPzlh7XgQZ6gyuuzwRerDNPZGPNdSUcGnw5E+DsT0EgN8YiJLD8iv8O Y/+xAoKkdlMIGJ6j42mK2EDuLNqztz8DG6zvnphMsfR/t4uA5nXLwW0I9/xu+Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714870; a=rsa-sha256; cv=none; b=KxzSJtAU7CzYtE8FJ7kUQOg+Ob3MK0BLI56Hze4NRX3Pn3FHEtXkribl+4m+0+ZLGBomHY 8kx6JB47nqcKJIaowVIPADVsW5sXo6pyTpEMgaHZMsEiReCdNrWQoWrEwvPPzN6GEQhihX 04EqxUQJPanoVqmBHZn6rUvMde+bTeLWN+JWz0EUpzsj1G9syHJtZ+b8gftabr/5h0tr04 Yqn5nmhleVXFpX4jZwkD5PexqSvDEqZAe7+t24ZsWcjgMgImnzA7JkfnWW0QbGemczwidA oftPPHy7lbvdG62qnfw1C0ZaVoIqNJ+W+JbET607coDBRd0Wa9aWNcWV2c2Inw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714870; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FxxnaXKUlt/d8sw8ujXzetoqYMYjnlIojp/dTYAt/1w=; b=wYHKWWFGJqReyiDPCx36JzelEgwMk0+iPYWtX3sg6igk7nFsy/+AU9JFnC20OxuafBs7K4 Okqjx1kt8Kn3mk1Z/OkmyEWHKtWNZsMRceQYpHVmCJh5fiOhsiUz35id1PUCNcIoHCSowX zIp13gBoIi0C88ox39tj/DFNo02RpV96qV0DgP4qxGQ+PEMdDZme758qGCs46No84RIrYL cksl/HM9mCQdlQ89Z1VjUdnfTki3uX+HXEnl1MPnzQxWhL7u5UnempkiRnZs+zbuwJrVbt +ExDq7F59LXOEIYoO2e0+//tju+vS+jSlVNvm6QaW0xTC00GsScY/agtWPPnEA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2F6fvgzmMg for ; Mon, 29 Jun 2026 06:34:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45ab5 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:29 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: e28a03447456 - stable/15 - mt76: mt7921: depend on lindebugfs and turn debugfs support on List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: e28a03447456c3eb528a171f70341952e1f4bf33 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:29 +0000 Message-Id: <6a4211f5.45ab5.3729620d@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=e28a03447456c3eb528a171f70341952e1f4bf33 commit e28a03447456c3eb528a171f70341952e1f4bf33 Author: Bjoern A. Zeeb AuthorDate: 2026-06-10 11:24:04 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:53:45 +0000 mt76: mt7921: depend on lindebugfs and turn debugfs support on Add the missing MODULE_DEPEND() calls for lindebugfs. It is unfortunate that they are shared code between various bus implementations. Ideally we would leave the MODULE_DEPEND() calls in the debugfs.c file instead of adding extra #ifdef guards to the bus attachment files. Turn debugfs support on for mt76(core) and the mt7921 module for now. Sponsonred by: The FreeBSD Foundation (cherry picked from commit 134e90e01da181a6048f0ca3368e466818def1b3) --- sys/contrib/dev/mediatek/mt76/debugfs.c | 3 +++ sys/contrib/dev/mediatek/mt76/mt7921/pci.c | 3 +++ sys/contrib/dev/mediatek/mt76/mt7921/usb.c | 3 +++ sys/modules/mt76/Makefile.inc | 2 +- sys/modules/mt76/mt7921/Makefile | 2 +- 5 files changed, 11 insertions(+), 2 deletions(-) diff --git a/sys/contrib/dev/mediatek/mt76/debugfs.c b/sys/contrib/dev/mediatek/mt76/debugfs.c index a5ac6ca86735..344ccdc98293 100644 --- a/sys/contrib/dev/mediatek/mt76/debugfs.c +++ b/sys/contrib/dev/mediatek/mt76/debugfs.c @@ -124,3 +124,6 @@ mt76_register_debugfs_fops(struct mt76_phy *phy, return dir; } EXPORT_SYMBOL_GPL(mt76_register_debugfs_fops); +#if defined(__FreeBSD__) +MODULE_DEPEND(mt76_core, lindebugfs, 1, 1, 1); +#endif diff --git a/sys/contrib/dev/mediatek/mt76/mt7921/pci.c b/sys/contrib/dev/mediatek/mt76/mt7921/pci.c index b70335aba6bf..901a10986e58 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7921/pci.c +++ b/sys/contrib/dev/mediatek/mt76/mt7921/pci.c @@ -609,4 +609,7 @@ MODULE_VERSION(mt7921_pci, 1); MODULE_DEPEND(mt7921_pci, mt76_core, 1, 1, 1); MODULE_DEPEND(mt7921_pci, linuxkpi, 1, 1, 1); MODULE_DEPEND(mt7921_pci, linuxkpi_wlan, 1, 1, 1); +#if defined(CONFIG_MT7921_DEBUGFS) +MODULE_DEPEND(mt7921_pci, lindebugfs, 1, 1, 1); +#endif #endif diff --git a/sys/contrib/dev/mediatek/mt76/mt7921/usb.c b/sys/contrib/dev/mediatek/mt76/mt7921/usb.c index 64881ef7cbf4..a02dd21ef557 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7921/usb.c +++ b/sys/contrib/dev/mediatek/mt76/mt7921/usb.c @@ -352,4 +352,7 @@ MODULE_DEPEND(mt7921_usb, mt76_core, 1, 1, 1); MODULE_DEPEND(mt7921_usb, linuxkpi, 1, 1, 1); MODULE_DEPEND(mt7921_usb, linuxkpi_wlan, 1, 1, 1); MODULE_DEPEND(mt7921_usb, linuxkpi_usb, 1, 1, 1); +#if defined(CONFIG_MT7921_DEBUGFS) +MODULE_DEPEND(mt7921_usb, lindebugfs, 1, 1, 1); +#endif #endif diff --git a/sys/modules/mt76/Makefile.inc b/sys/modules/mt76/Makefile.inc index 5aa19fe183af..72fcacab15cd 100644 --- a/sys/modules/mt76/Makefile.inc +++ b/sys/modules/mt76/Makefile.inc @@ -14,7 +14,7 @@ MT76_USB= 0 # General options for common code so drivers can check. MT76_ACPI?= 0 MT76_CONFIG_PM?= 0 -MT76_DEBUGFS?= 0 +MT76_DEBUGFS?= 1 MT76_SOC_WED?= 0 # Other diff --git a/sys/modules/mt76/mt7921/Makefile b/sys/modules/mt76/mt7921/Makefile index b6dbe88204a3..2cf55ac506c6 100644 --- a/sys/modules/mt76/mt7921/Makefile +++ b/sys/modules/mt76/mt7921/Makefile @@ -8,7 +8,7 @@ MT7921_PCI= 1 MT7921_SDIO= 0 MT7921_USB= 0 -MT7921_DEBUGFS= 0 +MT7921_DEBUGFS= 1 # Common stuff. SRCS+= init.c main.c mac.c mcu.c From nobody Mon Jun 29 06:34:30 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2J0N6cz6k5Hh for ; Mon, 29 Jun 2026 06:34:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2H0tDXz4GtZ for ; Mon, 29 Jun 2026 06:34:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714871; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9k9A7hRlv+LM6JUjRWEbyxg7UjXsTuS6vUNwd3t6b2s=; b=OUIhoS9+MdsLLa8ISLtbjEkQtx4A/ZJ8ytyuS/mQQVKSdpe9JZYMF0HXa3ewoFlFxry1J+ u08QiaWY797lJthIM+1FI0Ew7T5+m175chiKTQQwCMrwvtx2MBglSFO4gqarIpzWNCQZct oV+YpxyJ31QopjMlREi4p6S2voYlc9/13BUFZtOOiWepLpw54/KTECn1c68kd4ZLdeRPX7 cDDBQKhXVYMdmPYjTzKAA60HwXRaKfc2hMzg11a6wntzziHBZWfSA/x1jw9syI4rYHXNaC TDH+bK22BramveVloglNDwYyfj+Yy3Gem7dNZW65ygP4FFm7JpQu/ZG3TRvG1Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714871; a=rsa-sha256; cv=none; b=svYlqmrfZ27UlBJRM3dcMCbeqhCFUs7ypNefIoVI5z/Lx0GA242w44bD8KTs0XYUD9keoZ 75iCCmDKJegxIkvI3ivqdPJR+3PuhQoo9s5GZ+LmZxdR2Ks8r7e8gE70ieyJ6fnjXLLIug RqDWDNnCEmtzcAnj2r8JcQewlfqZ82Z+yIs1b56xMbJvYSqX2W+Tng2kXGqr7qfP1H7Yww FRCmQTD4DLpM1z96pgSam8SL83pQu0ay18IgrbtwH87n5OgyQC2X3W0WeeIsWniziSB0pC nTPZyi3vfLe9Sb9n/m6IkIKKA9IkY6eK5wbBq9Rg1Y8KhASY1VdPEf0mbNkN7Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714871; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9k9A7hRlv+LM6JUjRWEbyxg7UjXsTuS6vUNwd3t6b2s=; b=BVKCYvmyzlLSkEKxxNtAWUv4DHjwynGtEczdK0eYWB8nvHdDwNPKOeVkcZJ+oDvMgHOioy YTZHwWLeCoF2JC4CspHAAWlqVI1C9AhRllnxzDiSRnQf93rRa5RPkQLbjF6p2yPEQpvEZB 7bl7Blu7vu/kRgOc0rItyYHTpTRG21XsoQvqqI6x7Jgzp0fBN61D3Wjk7WNNoKeOIoPFwE uH3SDw4RE9xmojZMHCFhQaGd6NBhECD199GzEWM0zLZ1onsvuIrXfWQtBawZJt/4zYau2u DEXZHL3vBnJYv+1Ign46VvgYzM31UQy5VKzthbND8Q0TWuZKu2HSQXPNlaEMkA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2G7302zmRk for ; Mon, 29 Jun 2026 06:34:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 47022 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:30 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 4406a07e6f3e - stable/15 - LinuxKPI: 802.11: lock down mac80211 downcalls List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 4406a07e6f3e5844033061d7630fe731739faa18 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:30 +0000 Message-Id: <6a4211f6.47022.50b6d199@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=4406a07e6f3e5844033061d7630fe731739faa18 commit 4406a07e6f3e5844033061d7630fe731739faa18 Author: Bjoern A. Zeeb AuthorDate: 2026-06-05 10:22:38 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:53:51 +0000 LinuxKPI: 802.11: lock down mac80211 downcalls Add lock assertions and "might_sleep" annotations to various mac80211 operation downcalls into the driver. Make sure the code to these is all covered by locks--pushing more wiphy lock into the code--or lock assertions as well. Split up parts of the MC code up into an unlocked and locked version to avoid recurive locking. Sponsored by: The FreeBSD Foundation (cherry picked from commit 1c601bf516ebefb1670f5612316c501f2ae2654a) --- sys/compat/linuxkpi/common/src/linux_80211.c | 58 ++++++++++++++++++---- .../linuxkpi/common/src/linux_80211_macops.c | 19 +++++++ 2 files changed, 67 insertions(+), 10 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index f612b559df99..8e7e69833a00 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -511,6 +511,8 @@ lkpi_sync_chanctx_cw_from_rx_bw(struct ieee80211_hw *hw, enum ieee80211_sta_rx_bandwidth old_bw; uint32_t changed; + lockdep_assert_wiphy(hw->wiphy); + chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf, lockdep_is_held(&hw->wiphy->mtx)); if (chanctx_conf == NULL) @@ -749,6 +751,9 @@ lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, struct ieee80211_sta *sta, struct ieee80211_node *ni, bool updchnctx) { + if (updchnctx) + lockdep_assert_wiphy(hw->wiphy); + /* * Ensure rx_nss is at least 1 as otherwise drivers run into * unexpected problems. @@ -1944,7 +1949,7 @@ lkpi_ic_update_mcast_copy(void *arg, struct sockaddr_dl *sdl, u_int cnt) } static void -lkpi_update_mcast_filter(struct ieee80211com *ic) +lkpi_update_mcast_filter_locked(struct ieee80211com *ic) { struct lkpi_hw *lhw; struct ieee80211_hw *hw; @@ -1953,6 +1958,9 @@ lkpi_update_mcast_filter(struct ieee80211com *ic) bool scanning; lhw = ic->ic_softc; + hw = LHW_TO_HW(lhw); + + lockdep_assert_wiphy(hw->wiphy); LKPI_80211_LHW_SCAN_LOCK(lhw); scanning = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0; @@ -1967,7 +1975,6 @@ lkpi_update_mcast_filter(struct ieee80211com *ic) if (lhw->mc_all_multi || lhw->ops->prepare_multicast == NULL) flags |= FIF_ALLMULTI; - hw = LHW_TO_HW(lhw); mc = lkpi_80211_mo_prepare_multicast(hw, &lhw->mc_list); changed_flags = (lhw->mc_flags ^ flags) & FIF_FLAGS_MASK; @@ -1983,6 +1990,20 @@ lkpi_update_mcast_filter(struct ieee80211com *ic) LKPI_80211_LHW_MC_UNLOCK(lhw); } +static void +lkpi_update_mcast_filter(struct ieee80211com *ic) +{ + struct lkpi_hw *lhw; + struct ieee80211_hw *hw; + + lhw = ic->ic_softc; + hw = LHW_TO_HW(lhw); + + wiphy_lock(hw->wiphy); + lkpi_update_mcast_filter_locked(ic); + wiphy_unlock(hw->wiphy); +} + static enum ieee80211_bss_changed lkpi_update_dtim_tsf(struct ieee80211_vif *vif, struct ieee80211_node *ni, struct ieee80211vap *vap, const char *_f, int _l) @@ -2112,6 +2133,8 @@ lkpi_hw_conf_idle(struct ieee80211_hw *hw, bool new) int error; bool old; + lockdep_assert_wiphy(hw->wiphy); + old = hw->conf.flags & IEEE80211_CONF_IDLE; if (old == new) return; @@ -2129,8 +2152,12 @@ static enum ieee80211_bss_changed lkpi_disassoc(struct ieee80211_sta *sta, struct ieee80211_vif *vif, struct lkpi_hw *lhw) { - enum ieee80211_bss_changed changed; + struct ieee80211_hw *hw; struct lkpi_vif *lvif; + enum ieee80211_bss_changed changed; + + hw = LHW_TO_HW(lhw); + lockdep_assert_wiphy(hw->wiphy); changed = 0; sta->aid = 0; @@ -2141,7 +2168,7 @@ lkpi_disassoc(struct ieee80211_sta *sta, struct ieee80211_vif *vif, changed |= BSS_CHANGED_ASSOC; IMPROVE(); - lkpi_update_mcast_filter(lhw->ic); + lkpi_update_mcast_filter_locked(lhw->ic); /* * Executing the bss_info_changed(BSS_CHANGED_ASSOC) with @@ -2391,6 +2418,8 @@ lkpi_set_chanctx_conf(struct ieee80211_hw *hw, struct ieee80211_vif *vif, struct lkpi_chanctx *lchanctx; int error; + lockdep_assert_wiphy(hw->wiphy); + if (vif->bss_conf.chanctx_conf == chanctx_conf) { if (!changed_set) { IMPROVE("OBSOLETE?"); @@ -3069,7 +3098,7 @@ lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int lkpi_bss_info_change(hw, vif, bss_changed); /* Prepare_multicast && configure_filter. */ - lkpi_update_mcast_filter(vap->iv_ic); + lkpi_update_mcast_filter_locked(vap->iv_ic); out: wiphy_unlock(hw->wiphy); @@ -4192,12 +4221,13 @@ lkpi_ic_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], ic_printf(ic, "%s: conf_tx ac %u failed %d\n", __func__, ac, error); } - wiphy_unlock(hw->wiphy); bss_changed = BSS_CHANGED_QOS; lkpi_bss_info_change(hw, vif, bss_changed); /* Force MC init. */ - lkpi_update_mcast_filter(ic); + lkpi_update_mcast_filter_locked(ic); + + wiphy_unlock(hw->wiphy); ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid); @@ -4707,8 +4737,11 @@ lkpi_ic_scan_start(struct ieee80211com *ic) lvif = VAP_TO_LVIF(vap); vif = LVIF_TO_VIF(lvif); - if (vap->iv_state == IEEE80211_S_SCAN) + if (vap->iv_state == IEEE80211_S_SCAN) { + wiphy_lock(hw->wiphy); lkpi_hw_conf_idle(hw, false); + wiphy_unlock(hw->wiphy); + } LKPI_80211_LHW_SCAN_LOCK(lhw); lhw->scan_flags |= LKPI_LHW_SCAN_RUNNING; @@ -4961,7 +4994,8 @@ lkpi_ic_scan_start(struct ieee80211com *ic) return; } - lkpi_update_mcast_filter(ic); + wiphy_lock(hw->wiphy); + lkpi_update_mcast_filter_locked(ic); TRACE_SCAN(ic, "Starting HW_SCAN: scan_flags %b, " "ie_len %d, n_ssids %d, n_chan %d, common_ie_len %d [%d, %d]", lhw->scan_flags, LKPI_LHW_SCAN_BITS, hw_req->req.ie_len, @@ -4971,6 +5005,7 @@ lkpi_ic_scan_start(struct ieee80211com *ic) hw_req->ies.len[NL80211_BAND_5GHZ]); error = lkpi_80211_mo_hw_scan(hw, vif, hw_req); + wiphy_unlock(hw->wiphy); if (error != 0) { bool scan_done; int e; @@ -5116,8 +5151,11 @@ lkpi_ic_scan_end(struct ieee80211com *ic) /* Send PS to stop buffering if n80211 does not for us? */ - if (vap->iv_state == IEEE80211_S_SCAN) + if (vap->iv_state == IEEE80211_S_SCAN) { + wiphy_lock(hw->wiphy); lkpi_hw_conf_idle(hw, true); + wiphy_unlock(hw->wiphy); + } } /* diff --git a/sys/compat/linuxkpi/common/src/linux_80211_macops.c b/sys/compat/linuxkpi/common/src/linux_80211_macops.c index b2e88719e103..b07a2075491b 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211_macops.c +++ b/sys/compat/linuxkpi/common/src/linux_80211_macops.c @@ -218,6 +218,8 @@ lkpi_80211_mo_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif, struct lkpi_hw *lhw; int error; + lockdep_assert_wiphy(hw->wiphy); + /* * MUST NOT return EPERM as that is a "magic number 1" based on rtw88 * driver indicating hw_scan is not supported despite the ops call @@ -244,6 +246,8 @@ lkpi_80211_mo_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif) { struct lkpi_hw *lhw; + lockdep_assert_wiphy(hw->wiphy); + lhw = HW_TO_LHW(hw); if (lhw->ops->cancel_hw_scan == NULL) return; @@ -291,6 +295,8 @@ lkpi_80211_mo_prepare_multicast(struct ieee80211_hw *hw, struct lkpi_hw *lhw; u64 ptr; + /* This seems fine without the wiphy lock. */ + lhw = HW_TO_LHW(hw); if (lhw->ops->prepare_multicast == NULL) return (0); @@ -306,6 +312,8 @@ lkpi_80211_mo_configure_filter(struct ieee80211_hw *hw, unsigned int changed_fla { struct lkpi_hw *lhw; + lockdep_assert_wiphy(hw->wiphy); + lhw = HW_TO_LHW(hw); if (lhw->ops->configure_filter == NULL) return; @@ -429,6 +437,8 @@ lkpi_80211_mo_config(struct ieee80211_hw *hw, uint32_t changed) struct lkpi_hw *lhw; int error; + lockdep_assert_wiphy(hw->wiphy); + lhw = HW_TO_LHW(hw); if (lhw->ops->config == NULL) { error = EOPNOTSUPP; @@ -497,6 +507,9 @@ lkpi_80211_mo_add_chanctx(struct ieee80211_hw *hw, struct lkpi_chanctx *lchanctx; int error; + might_sleep(); + lockdep_assert_wiphy(hw->wiphy); + lhw = HW_TO_LHW(hw); if (lhw->ops->add_chanctx == NULL) { error = EOPNOTSUPP; @@ -520,6 +533,9 @@ lkpi_80211_mo_change_chanctx(struct ieee80211_hw *hw, { struct lkpi_hw *lhw; + might_sleep(); + lockdep_assert_wiphy(hw->wiphy); + lhw = HW_TO_LHW(hw); if (lhw->ops->change_chanctx == NULL) return; @@ -535,6 +551,9 @@ lkpi_80211_mo_remove_chanctx(struct ieee80211_hw *hw, struct lkpi_hw *lhw; struct lkpi_chanctx *lchanctx; + might_sleep(); + lockdep_assert_wiphy(hw->wiphy); + lhw = HW_TO_LHW(hw); if (lhw->ops->remove_chanctx == NULL) return; From nobody Mon Jun 29 06:34:32 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2J4nlpz6k5Bv for ; Mon, 29 Jun 2026 06:34:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2J1z8wz4H7C for ; Mon, 29 Jun 2026 06:34:32 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714872; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=D+kNle61iiU0gJmf2opbPDU8/Cj2ki4DvpFv+EzAQY4=; b=ZqlwlQwbTVDdU/YLTikkgbQu4fXBJ/MSTlh3ntmtfqxNZObgoyjR3y4wogxED0v6jvEgOg NagJXviNKg8AIJDevs79+A915FP9C/5/xsNHQjRLFY8UGgrYUk4XpbKGIjOI5jq+aX4W/8 A9KLYFp6ixBKw/HSKJDqwoCK9eTnuoCu931c3mDiZrlH+1H32ZSK/86jDyPzRJDINekaxk Jyz0+6fE1/lZxAC5V6uZ7huREF41cN18pGhUtsgZmcxcvXt9xxIXcFpYnxxV5HpE/UBRjD NLhVEzp/e5s64B8fTYXRDPjQhZxeGj4PDwxCfpxnpjkqotla02FxvbHygCCHpA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714872; a=rsa-sha256; cv=none; b=CTwhi5bF5JkWlltCKCs6XT8GibumWSwU1VRUPDTvCua1CCQJf8atQB0mWmcc59XX3I7wh2 sADZHVgTLor7X8bAf3l+ipRIWWaA697CuCsk3pDsd/l2Y3kCkTjIPnACssdXfBhf33fiz+ 8X7IndRYebLc9W0i9FH78GPBGrxzAAkuQyIVVu2Jfh1I/wFCb4Ks2se8f2RjLdZ2SA3Sgm pRa9uO2rr88crSbyELOnpUzHPbijfJQLSFS8i4/0/uGL40XebRugqSoLqS2TU7o/4d11AB 5vKH82gffw2pYCSa0fbza4NY5m4rKLJLS9BieFYG+rkgdovGLz0BjW6Wov+KiQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714872; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=D+kNle61iiU0gJmf2opbPDU8/Cj2ki4DvpFv+EzAQY4=; b=Zlr0sWUHGNWFi6VbkWxxf3UPtF/9A/mCtv9k2hrwsgepejbAf3XzeSKLHxdaJrAuTcdJ+t fqm++C7Qsl2zFXipWauDooJUf3zmQF9u7gWOkTlQCiAuIkYHzYeHnPK7wnJ9/ngVuGaoJL 2/D1D8eyFSqWlxM7qr7dSntxAc7RzSEmAOTugSQkLqZLssfPPE96tUUg4GPo1ejm2ZhA0N fTK27vfKi0mMmJ3DgoSJbBARwksJTOnTxmDq5VgaTwtDBmJc5tlKqnIhsA0kb8j4pFqXZk ZSduNSZCaSxtn4oof1PYafmZubsVp4xQiA+OwZh6DLJo+B96On2g1znbfMpmQw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2J0hfszmmg for ; Mon, 29 Jun 2026 06:34:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 47784 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:32 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 2b3a18dadf03 - stable/15 - LinuxKPI: add KERNEL_VERSION() macro List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 2b3a18dadf03c6235b5b3e798176a8cb452792b4 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:32 +0000 Message-Id: <6a4211f8.47784.7d4fb8a8@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=2b3a18dadf03c6235b5b3e798176a8cb452792b4 commit 2b3a18dadf03c6235b5b3e798176a8cb452792b4 Author: Bjoern A. Zeeb AuthorDate: 2026-06-13 11:08:00 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:53:57 +0000 LinuxKPI: add KERNEL_VERSION() macro Add a KERNEL_VERSION() macro which normally would be in linux/version.h. On Linux that file is auto-generated and we are supporting more than one Linux version in LinuxKPI anyway so any further defines in there would likely be wrong. Adding the macro helps to support (vendor/out of tree) drivers more easily which are supporting multiple Linux versions. Reviewed by: dumbbell Differential Revision: https://reviews.freebsd.org/D57590 (cherry picked from commit c5d6e2085a471cbb75cc7b88b37a2fe6276c16f8) --- sys/compat/linuxkpi/common/include/linux/kernel.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sys/compat/linuxkpi/common/include/linux/kernel.h b/sys/compat/linuxkpi/common/include/linux/kernel.h index afbd9208a410..3fcc6c1a925e 100644 --- a/sys/compat/linuxkpi/common/include/linux/kernel.h +++ b/sys/compat/linuxkpi/common/include/linux/kernel.h @@ -67,6 +67,9 @@ #include +#define KERNEL_VERSION(a,b,c) \ + (((a) << 16) + ((b) << 8) + ((c) > 255 ? 255 : (c))) + #define KERN_CONT "" #define KERN_EMERG "<0>" #define KERN_ALERT "<1>" From nobody Mon Jun 29 06:34:33 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2L02Xrz6k5jM for ; Mon, 29 Jun 2026 06:34:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2K2CsRz4Gtt for ; Mon, 29 Jun 2026 06:34:33 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714873; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mRHD+ToTx+2hGdJtwOh/5pM+yZVI0X/mZFRie6WRu7I=; b=ykcXXkw4h7HHu6YdImHwBa43uxujDalR6iHQZldN/CUPmfwlgdhsd/Uga+nbN9hJUWCoZv YCL25NTJJFlj1cbJq0n1g43Ilf4ZE4H6YJc+FRNe7wXQHvqQT43en3fbe9Ov4DJpelkwb5 C2ZBij7abbuXeK2B6M5FFBIO6qx73tH/OczIK8GL4Lp1UP9NgQaRvF/C3uMLXV1GMFz/VI jNPE5VvJ2rdwBbIG5wSp8AihePNAyjIneTGc7A1+mj2EIH8jQ+QxSDr9pbUQ/IlowQPogF +GopaSNfmYTtBFy+ldMAR/Lno+uDpZMWw7aRGVaP+iUQbY21RSBE9VioLwCDxQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714873; a=rsa-sha256; cv=none; b=dNQhVb9kg3Bnc0+cBV9+rCz4wksVdMF/h386CcjOfLgfwNDmApwFZS3ajjzVIcoq3sHx6U esdckUg9rwTzRbD5MX4N8aYt3Rczto6WkhmCbQw0a1Gyw2gDb+FojM6rJ/VWTDQfWd2zy6 VK94gIdEl1ZQhQTwXeUmXThDZ8pMMGisa1Ro8blcjgSdE5K53cpmvDoOR5TzS/D7ZOkGax S0sVOo+9+5muegGLpzrwCTLgAm4iUyR3Aly4kubytNICdBTFNZr+PcdZFMdQ1S1R9ntk/7 fPQRxrSrX3nJu5t29jeN/1yuRnfLiS9cUGIxnlnDRV4L8njFWPW4oJo0NZIv1Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714873; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mRHD+ToTx+2hGdJtwOh/5pM+yZVI0X/mZFRie6WRu7I=; b=tTrQDXjRorAl+1LbZ9/5Q7ngH/HbgMUwkPsgyBz3Vcavq/yhQea2+B+6qw1NkpqEWkg/jz n6m3QIV4U2nnBMuV/M/LzDkRnzdX2XUHVTS/bhI2zaSSNZeFVnqF/YRfTiBrNNQpnzXkIi RzI+a54mFZRAvTSUQjc8vlgFRnH8VjBT1hcizRupoDTULUkeGpMbYsVzysqL/lPd/O5RBc nSE3BsjQPmmfpcKBdrFkwsXhZNpiNc1TpxIISeZC2nep+xgtCpYhXZiKuW2KuZouSuqBWW Pm5tzjKq2onRn/MoJxsp/we4aI8tKXzmTzYtUueUkmD7Oy3ETU7OyJNhTNzI9Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2K1Df6zmkF for ; Mon, 29 Jun 2026 06:34:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46b0e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:33 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 3b3b73377b3e - stable/15 - LinuxKPI: scatterlist.h: implement sg_init_marker() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 3b3b73377b3efcda158fdd23375a7d341cf87ae5 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:33 +0000 Message-Id: <6a4211f9.46b0e.20b580ec@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=3b3b73377b3efcda158fdd23375a7d341cf87ae5 commit 3b3b73377b3efcda158fdd23375a7d341cf87ae5 Author: Bjoern A. Zeeb AuthorDate: 2026-02-03 18:29:09 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:54:01 +0000 LinuxKPI: scatterlist.h: implement sg_init_marker() Add sg_init_marker() which is needed by mt76 drivers USB attachment. Sponosored by: The FreeBSD Foundation Reviewed by: emaste, dumbbell Differential Revision: https://reviews.freebsd.org/D57594 (cherry picked from commit 3d0b6c69dced4936fccff6733912a0ef93214dbe) --- sys/compat/linuxkpi/common/include/linux/scatterlist.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sys/compat/linuxkpi/common/include/linux/scatterlist.h b/sys/compat/linuxkpi/common/include/linux/scatterlist.h index 537f5bebc5aa..0c2f8b62f9f5 100644 --- a/sys/compat/linuxkpi/common/include/linux/scatterlist.h +++ b/sys/compat/linuxkpi/common/include/linux/scatterlist.h @@ -188,6 +188,12 @@ sg_mark_end(struct scatterlist *sg) sg->page_link &= ~SG_PAGE_LINK_CHAIN; } +static inline void +sg_init_marker(struct scatterlist *sg, uint32_t num_sgs) +{ + sg_mark_end(&sg[num_sgs - 1]); +} + static inline void sg_init_table(struct scatterlist *sg, unsigned int nents) { From nobody Mon Jun 29 06:34:34 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2L6nrqz6k5ZX for ; Mon, 29 Jun 2026 06:34:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2L2zqFz4H7b for ; Mon, 29 Jun 2026 06:34:34 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714874; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=VEe8IozHFEOzJgTNZZoVV4DIO4H8D/6/v4P+2we7mV0=; b=MKaFXvWmK/CFJxcJpW5arpBXlAXgwkO78MK7+ZTo/pFcvpdI/vcjqVKrFqgC3aIa21QNlo fFqYcz+Ud2JhWeALaaaj0rqAm238S0AiPUpCYkfNZ0b9RJAlI6AgYgH8HTKEFvx49NtfSO vs6BZaYL5gwMhEkhUw8H/9KOrcmeBXhFTT1qtL3D0AtLKWK47NbpSOlfHIDpv0pZ4ZFBZT xibQAL6SInoF1c7WioRPfPFfnji2O5HDrKhq9KBd8U9gOBITr2VQg6Jor3vqlcHv9woyf4 LxBQ0cSlD5CsKVYScOeoRfnr97Kgza4I2QlA4oKJI5QfLF8gVZEOqFJcy+cLdw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714874; a=rsa-sha256; cv=none; b=cFfRxxAE4eTHKbcOvu/xSA54AlGrCQ3narTgAmlBDxLFzRZl6jHYBLZ8XBOwkKqreX8Ryq /rm8MB05EEUkWyAxeuRmLazD3u40q4mniTJ1J8f6aGQjLBYVGXyVQpH4RpLgCJ3RAndYpx u8/wRrVnwsbDn/ZF4X4qOq1Txfuu9areYbjO1IaP85JHytkViK1UVq21kRRunY7xBP8L7g 9tXvVz4XtST9G90ilpPs51MjBqH7Nyxj0oB+eCvrv4B7JTuneObDK1mKcB9UgNbgch9cOE 9eij0Y75r+PllyC78fvPYktwykKa5d0uibZvs3wLpGCaW2Ltg1qUTlqVyuwZGA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714874; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=VEe8IozHFEOzJgTNZZoVV4DIO4H8D/6/v4P+2we7mV0=; b=gZ0WCb/lZXwIw71IZbc7GtoA/QxtZkUZpf51ZcJ/c2SfrbhQ8IQwxpC3IUhQoqbFdAlmia 9L7jJpBDKnEbMOqqAa3ox43B5aDX3hh2XjbWarYax50VjP9fl7c8eRr5DoOZKvg2gXVDkz DFZukfuh8TOZqHeaKKPmIm8mICxEPGIHghsKPMOaBB3ypEeVpp7hior2/1zGxog/9N4wEX 2BW9PpeXg3sd4I8VhLdGKzCiF6/HKgU/8ONEWIHZPT5FVRl8nzDgLoS3jxDvhjc0O+b9Hp nJoctEbsywmYI1UfeNW51g320lpP8secIQamhTdfgV/AVCwq7GZQ8+eYVwW0EQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2L252pzmVN for ; Mon, 29 Jun 2026 06:34:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4712b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 729934499378 - stable/15 - mt76: mt7925: prevent PM from scheduling another delayed work on detach List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 729934499378cac231c0cfec66b16945ec577e59 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:34 +0000 Message-Id: <6a4211fa.4712b.4f558f26@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=729934499378cac231c0cfec66b16945ec577e59 commit 729934499378cac231c0cfec66b16945ec577e59 Author: Bjoern A. Zeeb AuthorDate: 2026-06-21 20:05:04 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:54:10 +0000 mt76: mt7925: prevent PM from scheduling another delayed work on detach This duplicates 009d92b25f7c from mt7921 which has the full description. Sponsored by: The FreeBSD Foundation (cherry picked from commit 482fda9814937691557ebadd0930535ff3d301b0) --- sys/contrib/dev/mediatek/mt76/mt7925/pci.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sys/contrib/dev/mediatek/mt76/mt7925/pci.c b/sys/contrib/dev/mediatek/mt76/mt7925/pci.c index d57e1aacf112..5831892dd1d4 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7925/pci.c +++ b/sys/contrib/dev/mediatek/mt76/mt7925/pci.c @@ -41,6 +41,11 @@ static void mt7925e_unregister_device(struct mt792x_dev *dev) if (dev->phy.chip_cap & MT792x_CHIP_CAP_WF_RF_PIN_CTRL_EVT_EN) wiphy_rfkill_stop_polling(hw->wiphy); +#if defined(__FreeBSD__) + /* See comment in mt7921. */ + pm->enable = false; +#endif + cancel_work_sync(&dev->init_work); mt76_unregister_device(&dev->mt76); mt76_for_each_q_rx(&dev->mt76, i) From nobody Mon Jun 29 06:34:37 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2Q0K2Yz6k5jW for ; Mon, 29 Jun 2026 06:34:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2P5gNVz4H8H for ; Mon, 29 Jun 2026 06:34:37 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714877; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZLXpnvD919QvsdVt4D+ZIY5qi7c6DmbZWbq7DMEsDqM=; b=k/jDA43+saW1B00NskdKsQ0MvBlNmOI5g01ZFr6VYy37hMQ16orCkN203C+Q5/r18o3NN+ G0/1W1qvr5AptlNMGqHnf+nvEMU2JamA8VEXaW1y14JZNbS1BeZAKKsMhD4CHPJz4iUuGW 3VCdAvwj6+vbeUWwNYPgQU7ZFjZt7YhoGB9NQzD1wh4M62abfLxRqp3Q8orZHO8dEsqwBc OgsoRaP3EdYkKxHIvBGvt6w9g838GHuR4zAfnpotcUyVfvJ1U4UaZ2yY/UIAyIDqohpfKu 2rReUEtkOAii79zKzszrl4CqWryA/eIaNiQBNmukeY5AY0siANfKZtdUAHf7NA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714877; a=rsa-sha256; cv=none; b=IQ1mm3T3c4b3CfRmGXumnotn6CMbr8R5FJ0wastp0+ZsCFUX3PTfbqom6e7qApQAWPGVPa JhY3H5BVo8s7jioRZpH+P556lw2Xy9vHpklGA2+KOV3pg8C5sSqZxen05Ld9jQKeEM2JLb Uqr1nRvpCQBROaxmL+SqZe7Ak09/gmLKVpJR7/626/FSKKBK1uVDhrMnM8qtQddACk9nlh O9xo877uI8O49F9Lw9zwxyTiQWu2m/TapjCDyoYd3Qc766cv2QnOLhTneM5g9Q13doN+Sl KQwOnU9WcUvYV3zBtRK2pEwnUVsUuujCIDZ+x0vA1aZh3N6mGGSnHA6+hLNEjg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714877; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZLXpnvD919QvsdVt4D+ZIY5qi7c6DmbZWbq7DMEsDqM=; b=YXhVXd8w9LbU5UZyN0WSVGdqRKLZcglPnMEA+XtZbZdv083C/k498kdogI/0u/Tv4NZwgd En3WCJuhb2bk3oYZ33fU46B+g5DnjBnseIkRNGlYYbZCkIMpBKCRALUVrw7CwboJkwZFBB RS2pjvv5r/slE5gGAsFXny2CLhqLnOEYhX5MCwT3kH9xcArnpAZhVzqUh9md3BC0Vysolb xnsvzOtPald1nHdC29itcm0qwDAUicEioii/KiEshcSQUAmnVbo/YYEAjrrYLbbJlKX9SV VVnDxI8BsPeiHS7hetzdL1AbRHgmv7pMScbtKlNBb+sIpi9uF9rjZeDTxvTozQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2P4TtfzmkH for ; Mon, 29 Jun 2026 06:34:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 449dc by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:37 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 848cb6b184fa - stable/15 - LinuxKPI: 802.11: add 11g check to lkpi_ic_getradiocaps() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 848cb6b184fab91315710ec755f31455684f3ecf Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:37 +0000 Message-Id: <6a4211fd.449dc.563a78de@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=848cb6b184fab91315710ec755f31455684f3ecf commit 848cb6b184fab91315710ec755f31455684f3ecf Author: Bjoern A. Zeeb AuthorDate: 2026-06-22 00:10:22 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:54:33 +0000 LinuxKPI: 802.11: add 11g check to lkpi_ic_getradiocaps() Replace an early comment with code and add a (simplified) 11g check. We make use of the annotated bitrate flags we added (see lkpi_wiphy_band_annotate()) and check if on the 2GHz band there are any bitrates which are 11g. Upon the first one found we do set the IEEE80211_MODE_11G to announce to net80211 that the 2.4Ghz channels may operate on 11g as well. Sponsored by: The FreeBSD Foundation (cherry picked from commit d4a529ad0d5638ad3e8d27815948b0a7c4628e3f) --- sys/compat/linuxkpi/common/src/linux_80211.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index f1ed22efb2e9..24819a970431 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -6726,18 +6726,28 @@ lkpi_ic_getradiocaps(struct ieee80211com *ic, int maxchan, if (hw->wiphy->bands[NL80211_BAND_2GHZ] != NULL) nchans = hw->wiphy->bands[NL80211_BAND_2GHZ]->n_channels; if (nchans > 0) { + struct ieee80211_supported_band *supband; + memset(bands, 0, sizeof(bands)); chan_flags = 0; setbit(bands, IEEE80211_MODE_11B); - /* XXX-BZ unclear how to check for 11g. */ + + /* Check for 11g (simplified). */ + supband = hw->wiphy->bands[NL80211_BAND_2GHZ]; + for (i = 0; i < supband->n_bitrates; i++) { + if ((supband->bitrates[i].flags & + IEEE80211_RATE_MANDATORY_G) != 0) { + setbit(bands, IEEE80211_MODE_11G); + break; + } + } IMPROVE("the bitrates may have flags?"); - setbit(bands, IEEE80211_MODE_11G); lkpi_ic_getradiocaps_ht(ic, hw, bands, &chan_flags, NL80211_BAND_2GHZ); - channels = hw->wiphy->bands[NL80211_BAND_2GHZ]->channels; + channels = supband->channels; for (i = 0; i < nchans && *n < maxchan; i++) { uint32_t nflags = 0; int cflags = chan_flags; From nobody Mon Jun 29 06:34:36 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2P2G9fz6k5PR for ; Mon, 29 Jun 2026 06:34:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2N4rRCz4H0c for ; Mon, 29 Jun 2026 06:34:36 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714876; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6u2PSCCbYKDuD/KQUXoATmPOm1cA+yCJc2+MlAxYrNE=; b=IHjYWdMAa4YRA4rB8iu+HZ2eT8UtMPpyujOtfs6F1xLAhKxYCRhQFtXjsmDDKf6oCn2AJB VPCX+ZoQGsyLc2+qiEBI0JoSH4ORHM0/ZapVU88Sc3XMcuukewv3iAgoa1LldRRORyBYXv LTEUrPdpuWh6nUWBjO7lj1f3kIG1o4q5LilOfB1NJucEJ0+zbVKqnxmu9Xvy76aaDiuLD8 3wd9bRAPeQBDoLTA/kInDYMqXtG63cFsLDIlD2DMDdhg/gQNU7vjMfCVOTEG/4B2tKcCXp bs1IuWWxtaM94RqylJGbBhXSX/U7NFVsLN01JTm/JkO8+MFLICFBIwG0E/JRAg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714876; a=rsa-sha256; cv=none; b=rfSx2MwYX9fflScyRiTlIOQg/i8NiFYiMQk9lGmHoGJYh9BdTt408thawFKHSQXGpY6v7y HTxnA5YNmjGPTGnB2U+2gFZqKjjU5XUAZJa9vpCevJChKApJ8oweMmfWG8z/oGSoq5sG2E +bjjH8qZEgAXKAPXAh3h7EmmoIHpJTfW4ZqWWS5gf5MOLQTriceLYFQWtQZewKyXuSmmZy OLrenjfhz2N+rEfu/wqiH2aZqavIeuaDc8wn/j9xUzRrM+zD0bdlTrIPfqGutXEl4kx89w GkhaCrSJwuEJuanHpxUQUMMGrjLJ94AGkmZbkAk76ch6XAxtanB5RbrWovDTlw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714876; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6u2PSCCbYKDuD/KQUXoATmPOm1cA+yCJc2+MlAxYrNE=; b=j+l5dJwXn+ZO19wfYsJjbYTYHKvPqcg1cA/j5CuAjDurGF0SNsi6eYJEc1yMrUdxcmC5z9 gwqUxbFqPjuxe1Pq2xYWLX3CzNuf0S43Y+0U/ncxiC+Ja4y4GvIjHNtUv/DS3BTtoAAaa+ cpqwAIdrTHdhLqwJgkujDCzAjk7pMc++TJmVFXoYhRvU6c3GsBMiAhIE4VZx80B+AGU2vG R4Y+3ygCR7fC2n8XmRmbtevDp6grWFExQSs5zhRaGVUq2o0I/ufM1WbRXAsoyJc2ZVJwkX THPk2Osy8MUb208eUtAwsEH72veY1vfJwVHFBKkArm87/hConoT0QquLNt8aEg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2N3fQLzlmX for ; Mon, 29 Jun 2026 06:34:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 47788 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:36 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 5f4cd6ca29ad - stable/15 - LinuxKPI: 802.11: add/improve/correct comments List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 5f4cd6ca29ad3d5ab96858eb1248a31eee3a4eb6 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:36 +0000 Message-Id: <6a4211fc.47788.2ad6c24f@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=5f4cd6ca29ad3d5ab96858eb1248a31eee3a4eb6 commit 5f4cd6ca29ad3d5ab96858eb1248a31eee3a4eb6 Author: Bjoern A. Zeeb AuthorDate: 2026-06-22 00:07:16 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:54:26 +0000 LinuxKPI: 802.11: add/improve/correct comments Adjust/add comments to clarify certain situations. No functional changes. Sponsored by: The FreeBSD Foundation (cherry picked from commit 08a78a296c840aa95ec13895c3c9bf1349becbae) --- sys/compat/linuxkpi/common/src/linux_80211.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 8e7e69833a00..f1ed22efb2e9 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -2985,7 +2985,7 @@ lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int IMPROVE("ponder some of this moved to ic_newassoc, scan_assoc_success, " "and to lesser extend ieee80211_notify_node_join"); - /* Finish assoc. (even if this is auth_to_run!) */ + /* Finish assoc. */ /* Update sta_state (AUTH to ASSOC) and set aid. */ KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not " "AUTH: %#x\n", __func__, lsta, lsta->state)); @@ -5908,7 +5908,7 @@ lkpi_80211_txq_tx_one(struct lkpi_sta *lsta, struct mbuf *m) info->flags |= IEEE80211_TX_CTL_AMPDU; } - /* XXX-BZ info->control.rates */ + /* XXX-BZ info->control.rates for non-HW rate control and injected packets. */ #ifdef __notyet__ #ifdef LKPI_80211_HT info->control.rts_cts_rate_idx= @@ -8508,6 +8508,7 @@ lkpi_wiphy_band_annotate(struct wiphy *wiphy) continue; } + /* Band bitrates are times 10; e.g., 55 is 5.5Mbit/s. */ for (i = 0; i < supband->n_bitrates; i++) { switch (band) { case NL80211_BAND_2GHZ: From nobody Mon Jun 29 06:34:35 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2M5PpVz6k5jS for ; Mon, 29 Jun 2026 06:34:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2M3qqcz4GvM for ; Mon, 29 Jun 2026 06:34:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714875; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2Bx8jg0aUSuYZGBayC7kSE2frPk4GSYxpWPcEM39rGs=; b=SobKtutRJAx+ViCQyZbd6wkU5Tz2MGmj8ZE7LVEa0mPgy2tHmQMPsnfFzfFJOh6hkYARp9 65l91ZUN0t2hn4JY31ypWvEslgWESteqgw/KuQu4MWQz2cc1qE549B3YWwiLKenplwk0pg 231Wl3G6I4hbejvWkFoUyec2oTlQsFckI6BYMpwFj4BDM5wAVGWChYpaH361UVq5fHPs0u FdRgfz4BgxejjrereSddw5CgxqOgck6drpmoKn+W7bjght5xK0oW9W12OzycPWDImYofSJ mPr1fCCpbN2I1BA2tTFx3dZ1ucEsEUqQBv48pSIpkfo/AJLQde/XKnWg9P0Raw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714875; a=rsa-sha256; cv=none; b=R7IKB35rqSg7sZ4RdSf+G2MKoLOrkzEpIkH/S56paxBeHdjD/VeDlHipaZ0zIQwXHksc8y kK91Xlb25Y+MYr2W77EUN/cJnqokVzAj/wgG1GV6nPnn7ErrkjrKP4qwNpV0kd0SEWVhiQ 4V3q9mcYCylIyZ0Jo8uNrvxkAKSY1ezhCDrIQH4iTtA11eVhTmEtWvPMsRIbUqAKmY4p62 /kdLwATUm7oIHyXqV6v3lz/1nqO1NpIJZO7WOZRbblV8c6+0CgWySfXS1npSjcZtk4DZPe rHLVlwzKm5wlAI9vJakQavgCH7Z+w9oN30XE7xMw/liL3U1JsoVe/GBIODZppQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714875; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2Bx8jg0aUSuYZGBayC7kSE2frPk4GSYxpWPcEM39rGs=; b=NGYBEMN3OxSiM221if2SkcxoM5a2W9Cl50q4Hicgs+mysA85OxXCVNNqg5MWp9L3+k1JR7 TADlcLvy2ZIMlDMMx4bWmjMHo/x5zZvI4uPDx1IisFbt+LwJfWE44VCiDur4TicJMU8Q1M RVgw0YSWrsd13KuR+m/GWp53NmsB0XmotnSS6c49C49FD+yKUGgfrio4+3ymQOy6Y1PFIe CTZlVHLn0EuyeCPT1lOjsZqZ83ABcYW3HKZjm8kQ0e/FYkUnJlJ7AGfj3XjEusNvOGp2dD M3b1FdQcuhy4PzDaYsvDnqXtINSGKtLZB7/KN97aHH2N5wIL3tfaKm62c+E9YA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2M2p8kzmkG for ; Mon, 29 Jun 2026 06:34:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46b12 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:35 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 717e9ec72d89 - stable/15 - LinuxKPI: 802.11: leave a comment for sta->rates (mt7615, ?) List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 717e9ec72d896d8c231b6f8a84871077f2042840 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:35 +0000 Message-Id: <6a4211fb.46b12.a1be9d6@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=717e9ec72d896d8c231b6f8a84871077f2042840 commit 717e9ec72d896d8c231b6f8a84871077f2042840 Author: Bjoern A. Zeeb AuthorDate: 2026-06-21 14:04:36 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:54:18 +0000 LinuxKPI: 802.11: leave a comment for sta->rates (mt7615, ?) While we currently try to fill most rates places (e.g., basic_rates, supp_rates, (*set_bitrate_mask)), sta->rates are not populated. They are likely managed by the 802.11 rate control code (given no ieee80211_hw_check HAS_RATE_CONTROL), which for use would be net80211, which will require some extra code just to manage that. At least Mediatek mt76 (mt7615) driver seems to fall into the category of this need. See about that once/if we get to it. Sponsored by: The FreeBSD Foundation (cherry picked from commit 557eed60d2a34d061350ac37acebe6686cd80d83) --- sys/compat/linuxkpi/common/include/net/mac80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/compat/linuxkpi/common/include/net/mac80211.h b/sys/compat/linuxkpi/common/include/net/mac80211.h index c77d37e72fd1..5555e14b06f9 100644 --- a/sys/compat/linuxkpi/common/include/net/mac80211.h +++ b/sys/compat/linuxkpi/common/include/net/mac80211.h @@ -747,7 +747,7 @@ struct ieee80211_sta { int max_amsdu_subframes; int mfp, smps_mode, tdls, tdls_initiator; struct ieee80211_txq *txq[IEEE80211_NUM_TIDS + 1]; /* iwlwifi: 8 and adds +1 to tid_data, net80211::IEEE80211_TID_SIZE */ - struct ieee80211_sta_rates *rates; /* some rcu thing? */ + struct ieee80211_sta_rates *rates; /* some rcu thing? */ /* mt7615, and? */ uint8_t addr[ETH_ALEN]; uint16_t aid; bool wme; From nobody Mon Jun 29 06:34:38 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2R2N8qz6k5PV for ; Mon, 29 Jun 2026 06:34:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2Q6SLFz4H8V for ; Mon, 29 Jun 2026 06:34:38 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714878; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uG05/4UPFHt82dFRJEXB8bIZ766jOFB5/txNzbHEzfE=; b=sPy/FZEcGrlpogHLTMc4m13QySPF8w1xVKf7OMxsMjJM5ra1NwjRoUErfcc7rGsDS8GVHo Zy5vJcITXIfjmNAAKJCzhSkdSRO4K5tGfsiM8v/OPpifxUE3aI5GSU01AWcdyn8Yzy058C Coe5g0BuBagMcONR+NIUxBPTDNaOdsjgla2dBdQp7oZY6z478X1mCNQD89+7+4VvtBFb9C 7MkjGnvK7fAC2dDWcTSHPzJyICzqLRO9mJXIyAz9ooj41lJvbeU8l1XHq0hEMEcgkP36dT r9/jPPr4djAFcAO+0zayuftmrwj4Z2Z/jtC+8Ran/kULzd3zN+ClPLIwZ378HQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714878; a=rsa-sha256; cv=none; b=lfbKxzdRPDva4VeCVFqc4J38xHp17bnYCBwATPP9m4eVLA23Pal5doGUrNhRBhlgJu2GZL Qkv/DzMQ7Ntcm05yb+FJKBhKThzxPn8KGlQjOJfOyxuVc0UepGpXHiOSDJHfn4yhUMMzhB TJBvDaVoduDmF7VkdzxOprqM9GQEJ1bGFU91TGwYENvO3s91wGpYjbK3uWNGBHIGuBFOhn vVXhRbnWa7ekTa+Jjg5xTnLQuAvvufSCjZ+f6jJ93YRdOdf6sSx5pY6IfrXR9UPTo699Z+ /B1Wy11fn3sDi18fhn10DaFWbX4TX6ACqZSgbQNRgIvPlx0ck7MfdiCq3P/HoQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714878; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uG05/4UPFHt82dFRJEXB8bIZ766jOFB5/txNzbHEzfE=; b=o9627h4w2AytZtqRcxAyF/Cc9Xr51fIEAYF2efJ2KNcdR7IOUaP3f9//5S81Y8Htc47YmZ E4pGv+PODUS/2BV50oqyNZK6uBKAKkf2QI60MuB8uLQSPLP9O1VTX6FPy+hrrv54bXLZVz kCJzrlPHhf2X8ed7yX+u1L7QS/tdGxA6U/ij6KD+Zi44zEOHRHxqXsIMYSZ2xqdjGTsvUM dk/5M/uTAL7G9zUChblQ/AqLs86/4tCE824SRUJjwRBfKAlDRAWpnUdWYfVi9KfBjZhEUS Lzka65C/E2Qa7rCc6n/gulEIHe1RDz3lc4tPwYF7qrHEaEiOmyVoG3/LvjimYQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2Q5C28zmRl for ; Mon, 29 Jun 2026 06:34:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4712f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:38 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: a31e3e0d61e5 - stable/15 - LinuxKPI: 802.11: introduce TRACE_RATES() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a31e3e0d61e5250478b6f59c9c31485fa7a9cb68 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:38 +0000 Message-Id: <6a4211fe.4712f.59371841@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=a31e3e0d61e5250478b6f59c9c31485fa7a9cb68 commit a31e3e0d61e5250478b6f59c9c31485fa7a9cb68 Author: Bjoern A. Zeeb AuthorDate: 2026-06-22 00:17:26 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:54:37 +0000 LinuxKPI: 802.11: introduce TRACE_RATES() Add a tracing bit for tracing rates related changes introduced in followup commits. Sponsored by: The FreeBSD Foundation (cherry picked from commit b58d8df5829233ced7024c30a0a979e2e0a722fd) --- sys/compat/linuxkpi/common/src/linux_80211.h | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.h b/sys/compat/linuxkpi/common/src/linux_80211.h index 063be4251ccc..91751c0b4de5 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.h +++ b/sys/compat/linuxkpi/common/src/linux_80211.h @@ -74,6 +74,7 @@ #define D80211_TRACEX_DUMP (D80211_TRACE_TX_DUMP|D80211_TRACE_RX_DUMP) #define D80211_TRACE_STA 0x00010000 #define D80211_TRACE_HW_CRYPTO 0x00020000 +#define D80211_TRACE_RATES 0x00040000 #define D80211_TRACE_MO 0x00100000 #define D80211_TRACE_MODE 0x0f000000 #define D80211_TRACE_MODE_HT 0x01000000 @@ -90,9 +91,15 @@ if (linuxkpi_debug_80211 & D80211_SCAN_BEACON) \ printf("%s:%d: %s SCAN " fmt "\n", \ __func__, __LINE__, ic->ic_name, ##__VA_ARGS__) +#define TRACE_RATES(fmt, ...) \ + if (linuxkpi_debug_80211 & D80211_TRACE_RATES) \ + printf("%s:%d: LKPI80211 RATES " fmt "\n", \ + __func__, __LINE__, ##__VA_ARGS__); + #else #define TRACE_SCAN(...) do {} while (0) #define TRACE_SCAN_BEACON(...) do {} while (0) +#define TRACE_RATES(...) do {} while(0) #endif #define IMPROVE_TXQ(...) \ From nobody Mon Jun 29 06:34:40 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2T4wcKz6k5Ll for ; Mon, 29 Jun 2026 06:34:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2T0cLxz4HD9 for ; Mon, 29 Jun 2026 06:34:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=c3epl2HjrzEyXuG+VvRzZgaTzXCPY/0YvoMfS9vTaNU=; b=PZTh0j3UbA15xrhgynOzX0Xj/HIhKzlal7pzwWQwtmEn/cSYANDi8Py7ivtJz8Lcw9PsYB Phnwa0Y0uFaY1xQnfrIlgYxyadiE09gnZQSn0jNGYRVGg+Ykk9U6CIsTmw3R+aVFlP7X3x j29jy9vbgN7XGU3RTSLW0W2mzXRxLz41pFixn5hnEALzg754y7/KrOUFg2D3a2EKkrFq3a flWZCe5BcGm+nYlj8nZOJNa0BTIvZPCOj0KvFkar2ZLqoltccMsZftPyoXjAtpK2q7ns1i LL0rUrUd4TqXxoPLuiqivkGdfMFs9TB0wUUiw4/W5/yngTf319xUQFymoY1nAw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714881; a=rsa-sha256; cv=none; b=K9dpWz84UNHWHzuHh5XS0wdieUnpKoA2Q9cZ5U0uAcPHlRJGdSMJBttBeijQB55i3bDEiD jLAE+HNgdAIVoaU37YY0hT8B+mK4vacwM91LVP3UU5ukirgvuRcKYq+yaIZvxJrT/J2fI6 z44m9Y9cCBdr0uz6lPfmVqEcle1/9Fy8TFwC+Je86rXNDFoo/AiOdey4/yPjJRfE1Poo5q C3NzCTHbUbLfqMq686MasrlmgEnj7Ps+LE6+pOq0sBqjAQRHvU4t3ue4TZn5L1h3sg3OlZ MnOvid6ZORsLr+c/BLmA1xq31ouEanlHIiQ4+47+tiVIcydto7SEhnn19vN6Jw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=c3epl2HjrzEyXuG+VvRzZgaTzXCPY/0YvoMfS9vTaNU=; b=Ke2Yybo+03B+zzE7nBow0Nf32tcR08DHj8cX3SqC9Ysj4YxHDtKdax1pjnscyEDx3efqUL 3igenH3gLxU9zhEl8ZtM8C07jERITVWHJMh2oa2HnLb7cmTlGTH1VvhvYavMlqgIAVUFTF TmlrHgl+0YWtMQ3FF0mSJ4jtptqIi1Leh1tZ/4rh8tFh0AoR6ZlKHcBzHRJGZH7W66/8LI tXuH3a2ujKnEXSH4aEV/o3C7Asi0uVkDybFTn6sOnWlUiEcxqk7w5SvVQnRWWG9POV90Wm FA9zMigxwZETg39RJP8UCdK8bKWFCs6dkHqkFZZC+MyKGpv3sAQxfAwrh3DU2Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2S6kmXzmh3 for ; Mon, 29 Jun 2026 06:34:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44dd1 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:40 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 1cb6a2a2deb6 - stable/15 - LinuxKPI: 802.11: make lkpi_sta_sync_from_ni() return bss_changes List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 1cb6a2a2deb6bef711b51ae3bf3ca67eda3429f5 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:40 +0000 Message-Id: <6a421200.44dd1.2e1579b1@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=1cb6a2a2deb6bef711b51ae3bf3ca67eda3429f5 commit 1cb6a2a2deb6bef711b51ae3bf3ca67eda3429f5 Author: Bjoern A. Zeeb AuthorDate: 2026-06-17 14:37:42 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:54:46 +0000 LinuxKPI: 802.11: make lkpi_sta_sync_from_ni() return bss_changes This is a preparatory change with no functional changes. Sponosred by: The FreeBSD Foundation (cherry picked from commit 038489e46ea3e77484ea85c4369610ba3ee8381b) --- sys/compat/linuxkpi/common/src/linux_80211.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 8a761be3d6fd..777caa6d14e4 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -746,14 +746,17 @@ skip_bw: } #endif -static void +static enum ieee80211_bss_changed lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, struct ieee80211_sta *sta, struct ieee80211_node *ni, bool updchnctx) { + enum ieee80211_bss_changed bss_changed; if (updchnctx) lockdep_assert_wiphy(hw->wiphy); + bss_changed = 0; + /* * Ensure rx_nss is at least 1 as otherwise drivers run into * unexpected problems. @@ -776,6 +779,8 @@ lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, */ if (updchnctx) lkpi_sync_chanctx_cw_from_rx_bw(hw, vif, sta); + + return (bss_changed); } #if 0 @@ -940,7 +945,7 @@ lkpi_lsta_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN], sta->deflink.rx_nss = 1; sta->deflink.sta = sta; - lkpi_sta_sync_from_ni(hw, vif, sta, ni, false); + (void)lkpi_sta_sync_from_ni(hw, vif, sta, ni, false); IMPROVE("he, eht, bw_320, ... smps_mode, .."); @@ -3064,8 +3069,9 @@ lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int IMPROVE("net80211 does not consider node authorized"); } + bss_changed = 0; IMPROVE("Is this the right spot, has net80211 done all updates already?"); - lkpi_sta_sync_from_ni(hw, vif, sta, ni, true); + bss_changed |= lkpi_sta_sync_from_ni(hw, vif, sta, ni, true); /* Update thresholds. */ hw->wiphy->frag_threshold = vap->iv_fragthreshold; @@ -3093,7 +3099,6 @@ lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int */ IMPROVE("Need that bssid setting, and the keys"); - bss_changed = 0; bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__); lkpi_bss_info_change(hw, vif, bss_changed); From nobody Mon Jun 29 06:34:39 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2S48Nmz6k5gd for ; Mon, 29 Jun 2026 06:34:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2S05hRz4H5p for ; Mon, 29 Jun 2026 06:34:40 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714880; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PBqvtXof5wGCMkamoiM09JJbU+aled29HfNTokZFAUI=; b=lfpOv4kSvJ0yjQ85JwSjKY0vbIejieJI4Pgl/Tq0ITZfjc1f9J22PbHTBsXQH5BVZCyvpL zcjSkQc2rX67376rSozcy+nORh3fDuYQ6e/g1HjBQo5w89r3sqwlg+3iuS8IMZRzp0ERBC Kzjd73O+/VwTa2rUdy9591g7ubYNqem1zgfzVIvmG7xicGtMXTPMLxiaN/uHhn3eCQ5lW2 JaasLYQR2hHPO8ED8qQIMXVQKwyCJCq8tP3qY5Ew06RiGY8nN8m41J7OX65ZOOEE60whNK wGgE5KBK0BFp6mFadafns6okZ8TXZkEmfT94Hua3MPrRbIC3uwDv9hraBMim8g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714880; a=rsa-sha256; cv=none; b=b1ciVDHgNjNmU/ZLdcbQ7SwFcAKopO+gQOkmJrjuKretcKDaHuHIl8kPx+pWBSQWJ9FQT7 fScasUEwCFvF4nWdoCf30mDRUinMlSy0ofZWMdGZPewR0a6JE+GRT0XujJbq/y1mHODWqB crVGlqHB2yT89CThTR/wXrlwUaa3vTbutOYSAWfdP0zH0BzHcU/vPkEmW2CL3qZp1ihjco dVR7iag6jqRBj9LhCeqVnGzvbVOSsN7xN718nbbETLglf3HQ9Z55/PcsYdI9PjNZZJqjHn m4IbuUks1DjpSDXcgdPahdUnCauKm+4QYKYfVcBVxVbJU7y/pDSqdf7ZlelOBw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714880; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PBqvtXof5wGCMkamoiM09JJbU+aled29HfNTokZFAUI=; b=xBPKMeGtnnkkMGOH5eKL0JcpNXnv2T0WHt3He1UIfhj/xMZOgpDpewLNi70vy9esAQ+SG7 OroRBq6mtl4BtQiyQijZoEuZ/BOZ7tOJuJDv1x8sQz/60iIUhmVQl4sT7AlxS64HR7FyqE LCEuEgShe4W449j5+J6+mvIKxzZOnEupcJ8Whs2ks4WLyZ5ulywwaLvx1+G9A4GYoANoRN oMKj8cFBr7PDq0t/kc+ICKoLmOSlKIH44+g3p8KZGDokzbNSdekdB1gi2Auwx8c9dBgDN7 2ET5Pmfch83DtS2kXDX1cAieqMkl7celtVRVUHEWWgsKC86iD6kW96LuYcS+FQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2R63fCzmH9 for ; Mon, 29 Jun 2026 06:34:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 47800 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:39 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: c17a6e0f8787 - stable/15 - LinuxKPI: 802.11: initalize br_mask and basic_rates for each vap List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: c17a6e0f87871885cb698451ff1f1b0864da3cc9 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:39 +0000 Message-Id: <6a4211ff.47800.7e01f58a@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=c17a6e0f87871885cb698451ff1f1b0864da3cc9 commit c17a6e0f87871885cb698451ff1f1b0864da3cc9 Author: Bjoern A. Zeeb AuthorDate: 2026-06-22 00:27:21 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:54:41 +0000 LinuxKPI: 802.11: initalize br_mask and basic_rates for each vap During vap creating we inialize most [l]vif related variables. Add a br_mask (bit rate mask) to the lvif and setup the legacy component as it seems to be static. Given we are looping over the bands, also initialize the bss_conf basic_rates. At this point we only have all bitrates for the band or the mandatory bitrates for the band available. In order to not hint usage of possibly unsupported bit rates set it up with the manadatory bit rates only, which should get us through the mgmt frames, etc. to get to assoc state. By then we will do updates. Sponsored by: The FreeBSD Foundation (cherry picked from commit 7bf2eec68a293a22f332fc1592dffaa4ed9f0809) --- sys/compat/linuxkpi/common/src/linux_80211.c | 45 +++++++++++++++++++++++++++- sys/compat/linuxkpi/common/src/linux_80211.h | 1 + 2 files changed, 45 insertions(+), 1 deletion(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 24819a970431..8a761be3d6fd 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -4081,6 +4081,7 @@ lkpi_ic_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], struct ieee80211_vif *vif; struct ieee80211_tx_queue_params txqp; enum ieee80211_bss_changed bss_changed; + enum nl80211_band band; struct sysctl_oid *node; size_t len; int error, i; @@ -4103,8 +4104,50 @@ lkpi_ic_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], refcount_init(&lvif->nt_unlocked, 0); lvif->lvif_bss_synched = false; vap = LVIF_TO_VAP(lvif); - vif = LVIF_TO_VIF(lvif); + + /* + * Setup legacy br_mask here. We will call (*set_bitrate_mask) + * elsewhere to announce it to the driver but it is a static + * setup. + * Also setup basic_rates with just the mandatory rates for the + * current band (if avail). + */ + for (band = 0; band < NUM_NL80211_BANDS; band++) { + struct ieee80211_supported_band *supband; + uint32_t rate_mandatory;; + + supband = hw->wiphy->bands[band]; + if (supband == NULL || supband->n_bitrates == 0) + continue; + + /* Per-band legacy br_mask. */ + lvif->br_mask.control[band].legacy = (1 << supband->n_bitrates) - 1; + + /* basic_rates for the current band. */ + if (hw->conf.chandef.chan == NULL || + hw->conf.chandef.chan->band != band) + continue; + + switch (band) { + case NL80211_BAND_2GHZ: + /* We have to assume 11g support here. */ + rate_mandatory = IEEE80211_RATE_MANDATORY_G | + IEEE80211_RATE_MANDATORY_B; + break; + case NL80211_BAND_5GHZ: + rate_mandatory = IEEE80211_RATE_MANDATORY_A; + break; + default: + continue; + } + + for (i = 0; i < supband->n_bitrates; i++) { + if ((supband->bitrates[i].flags & rate_mandatory) != 0) + vif->bss_conf.basic_rates |= BIT(i); + } + } + memcpy(vif->addr, mac, IEEE80211_ADDR_LEN); vif->p2p = false; vif->probe_req_reg = false; diff --git a/sys/compat/linuxkpi/common/src/linux_80211.h b/sys/compat/linuxkpi/common/src/linux_80211.h index 91751c0b4de5..8d6b0a23cad3 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.h +++ b/sys/compat/linuxkpi/common/src/linux_80211.h @@ -220,6 +220,7 @@ struct lkpi_vif { struct mtx mtx; struct wireless_dev wdev; + struct cfg80211_bitrate_mask br_mask; /* Other local stuff. */ int (*iv_newstate)(struct ieee80211vap *, From nobody Mon Jun 29 06:34:42 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2W0gDTz6k5CK for ; Mon, 29 Jun 2026 06:34:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2V2zvBz4HBF for ; Mon, 29 Jun 2026 06:34:42 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714882; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SvdI+vtSVduJXhccnn30RLmoKVpaJFMCPvM6oUC8EF8=; b=iAeyTsSzryZT61hpsB5vZRaPXX3cuxgGDjn2nhCCf2JIImrrHQMXITpRMoM1wlIzb0j7/O SAnqOh8TrGNIHkStoH2oL8Y1Oty5VtbeUnTuFshdgNRVogPoDYtyaN5bPNA2TED5Hu/aNN 6nQXslc8RSoxR26NHaESPtp6sOmAbvQd2vH0+R6CEHWC53oRkoC0LuqtHYU/BBlAzQHZeI 9Pev0mVyIKSngr9nKHcSP3s9PdiCmXTtDZOmzX0iBwTdiG3ZWNfQPTrA+lxqXo15RF+vue kwFNxbl6ZoZ9syN+LOJJ2bCsJn0KJMID/GhF7LAAJGntZO/F5cSqm6SURzHmkg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714882; a=rsa-sha256; cv=none; b=dTXi3XhzgN9aTsqzek6yMcZ+V8KeMEHepZUXWxynqjMzt5dXlT+OZjNIslz4pL5NEn+osK msX/gJUjYbB4i2mWqpfOYRqTW73G2cJpYNTtJg50f/TDNbzNWyI0f9sylrjIsE1m1M441o r2Bi745nd96fLTKgOUgIpTYxy6zLf/3ghPbd6EJdVosHdkCU2iI7bSEDb8/Kgoi38bw5/a KcxY2D5VxkT+vQwcDWEnjEUKg3IsLvInPH60ZUV7klMkNhCmkyOjT6hJRXUVhHkMw3ELdC Lw+NDWG1TKw+iK4eLmIcVmnUE8xoy0mc+j1xkIx3b6Rrxn6MBmkZkMOyjfk0dQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714882; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SvdI+vtSVduJXhccnn30RLmoKVpaJFMCPvM6oUC8EF8=; b=aTER8z8/veCyrzn991VlByvEGWh+tTnEanSGAW3t1n5BdDzL1/Hbd1IB3N0FkkgfvT96Lp nBXv49Do4RuaLr1/JScPYct+8TvUkTFTBltZvktyWAJ3Iw2dDZf/EW5aS39CFL6DMncpsg IuXug0FzRxgQcAZWP8An8UdCe6edwg4BgCYIv5gmWBVY09nli7qjeU/WyLdWRtvqhCGXjw ujK/jvqvm9jDBDbBuvIa3bGj4HNdocHZ86gYH4DZLQk/N8vj/kKmo5ySRNl4McOjVIZjQ+ Zg2a4M2Q0RbN61Nbgx27JKcFnLkCq1ALRN/MwScv/5FdRs9G5zSui8nZsALX5w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2V0TCQzmHC for ; Mon, 29 Jun 2026 06:34:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46da1 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:42 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: f5b0b80a3d0e - stable/15 - LinuxKPI: 802.11: add function to update some rate related fields List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: f5b0b80a3d0eb7bf8b8cfa4092124d5a0e695df5 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:42 +0000 Message-Id: <6a421202.46da1.6c564f26@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=f5b0b80a3d0eb7bf8b8cfa4092124d5a0e695df5 commit f5b0b80a3d0eb7bf8b8cfa4092124d5a0e695df5 Author: Bjoern A. Zeeb AuthorDate: 2026-06-22 00:41:38 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:54:51 +0000 LinuxKPI: 802.11: add function to update some rate related fields Add lkpi_sta_supp_rates() which serves multiple purposes: (a) build (and update) the supp_rates field on a sta link (deflink only in our case still), (b) build and update basic_rates on the vif->bss_conf and print a warning in case we end up without any basic rate (should not happen anymore, not even on initial startup sync), (c) if HT or VHT are supported, then update the relevant br_mask fields for the current band. Deal with the various flags which trigger different updates by returning them so the caller can act upon. Sponsored by: The FreeBSD Foundation (cherry picked from commit 0d3cd54642f6695f9f82b82402f27e10bbee7cfc) --- sys/compat/linuxkpi/common/src/linux_80211.c | 152 ++++++++++++++++++++++++++- 1 file changed, 150 insertions(+), 2 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 777caa6d14e4..33ce55814b44 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -503,6 +503,144 @@ lkpi_rx_bw_to_cw(enum ieee80211_sta_rx_bandwidth rx_bw) } } +static enum ieee80211_bss_changed +lkpi_sta_supp_rates(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + struct ieee80211_node *ni, + enum ieee80211_rate_control_changed_flags *rc_changed) +{ + struct lkpi_vif *lvif; + struct lkpi_sta *lsta; + struct ieee80211_sta *sta; + enum ieee80211_bss_changed bss_changed; + struct ieee80211_supported_band *supband; + uint32_t supp_rates, basic_rates; + int band, i, n; + + bss_changed = 0; + + band = vif->bss_conf.chanreq.oper.chan->band; + supband = hw->wiphy->bands[band]; + if (supband == NULL) + return (bss_changed); + + lvif = VIF_TO_LVIF(vif); + lsta = ni->ni_drv_data; + sta = LSTA_TO_STA(lsta); + + supp_rates = 0; + basic_rates = 0; + + for (n = 0; n < ni->ni_rates.rs_nrates; n++) { + uint8_t supp_rate; + uint16_t bitr; + bool basic; + + /* Note: net80211 rates are in 0.5Mbit/s, e.g., 108 is 54Mbit/s. */ + supp_rate = ni->ni_rates.rs_rates[n] & (~IEEE80211_RATE_BASIC); + basic = (ni->ni_rates.rs_rates[n] & IEEE80211_RATE_BASIC) != 0; + + for (i = 0; i < supband->n_bitrates; i++) { + /* Band bitrates are * 10 so, e.g., 55 is 5.5Mbit/s. */ + /* To match net80211 rates we need to do a DIV5. */ + bitr = howmany(supband->bitrates[i].bitrate, 5); + if (supp_rate == bitr) { + supp_rates |= BIT(i); + if (basic) + basic_rates |= BIT(i); + } + /* + * We are not checking if we are doing 11b or 11g and + * if the rate is fine for each. + */ + } + TRACE_RATES("supp_rate %u basic %d supp_rates %#010x basic_rates %#010x", + supp_rate, basic, supp_rates, basic_rates); + } + if (basic_rates != 0 && + vif->bss_conf.basic_rates != basic_rates) { + TRACE_RATES("vif bss_conf basic_rates %#010x update to %#010x", + vif->bss_conf.basic_rates, basic_rates); + vif->bss_conf.basic_rates = basic_rates; + bss_changed |= BSS_CHANGED_BASIC_RATES; + } + /* Guard against net80211 not having any rates set when we get here. */ + if (supp_rates == 0) + supp_rates = vif->bss_conf.basic_rates; + if (sta->deflink.supp_rates[band] != supp_rates) { + TRACE_RATES("band %d supp_rates %#010x update to %#010x", + band, sta->deflink.supp_rates[band], supp_rates); + sta->deflink.supp_rates[band] = supp_rates; + if (rc_changed != NULL) + *rc_changed |= IEEE80211_RC_SUPP_RATES_CHANGED; + } + + /* + * br_mask got initialized in lkpi_ic_vap_create(). + * Do a basic rates check against it for the current band if we are + * in a state to have all the above information. + */ + TRACE_RATES("band %d br_mask legacy %#010x & basic_rates %#010x != 0?", + band, lvif->br_mask.control[band].legacy, vif->bss_conf.basic_rates); + if (band == vif->bss_conf.chanreq.oper.chan->band && + (lvif->br_mask.control[band].legacy & vif->bss_conf.basic_rates) == 0) { + /* In our setup this should never happen. */ + printf("%s: WARNING: no acceptable basic rate %#010x & %#010x\n", + __func__, lvif->br_mask.control[band].legacy, vif->bss_conf.basic_rates); + } + + /* + * XXX-BZ we should track changes here as well and call or let the + * caller call lkpi_80211_mo_set_bitrate_mask() if needed. + * Note: the call in lkpi_sta_scan_to_auth() still have to + * happen unconditionally for the initial setting. + */ +#if defined(LKPI_80211_HT) + if (supband->ht_cap.ht_supported) { + memcpy(lvif->br_mask.control[band].ht_mcs, + supband->ht_cap.mcs.rx_mask, + sizeof(lvif->br_mask.control[band].ht_mcs)); +#if defined(LINUXKPI_DEBUG_80211) + for (int i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) { + TRACE_RATES("band %d ht_mcs[%d] %#010x", + band, i, lvif->br_mask.control[band].ht_mcs[i]); + } +#endif + } +#endif /* LKPI_80211_HT */ +#if defined(LKPI_80211_VHT) + if (supband->vht_cap.vht_supported) { + uint16_t mcs_map, val; + uint8_t nss; + + mcs_map = supband->vht_cap.vht_mcs.tx_mcs_map; + for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) { + TRACE_RATES("band %d nss %d vht_mcs.tx_mcs_map %#06x mcs_map %#06x & 0x3 = %#06x", + band, nss, supband->vht_cap.vht_mcs.tx_mcs_map, mcs_map, mcs_map & 0x3); + switch (mcs_map & 0x3) { + case IEEE80211_VHT_MCS_SUPPORT_0_7: + val = 0x00ff; + break; + case IEEE80211_VHT_MCS_SUPPORT_0_8: + val = 0x01ff; + break; + case IEEE80211_VHT_MCS_SUPPORT_0_9: + val = 0x03ff; + break; + case IEEE80211_VHT_MCS_NOT_SUPPORTED: + val = 0; + break; + } + lvif->br_mask.control[band].vht_mcs[nss] = val; + TRACE_RATES("band %d nss %d vht_mcs %#06x", + band, nss, lvif->br_mask.control[band].vht_mcs[nss]); + mcs_map >>= 2; + } + } +#endif /* LKPI_80211_VHT */ + + return (bss_changed); +} + static void lkpi_sync_chanctx_cw_from_rx_bw(struct ieee80211_hw *hw, struct ieee80211_vif *vif, struct ieee80211_sta *sta) @@ -751,11 +889,13 @@ lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, struct ieee80211_sta *sta, struct ieee80211_node *ni, bool updchnctx) { enum ieee80211_bss_changed bss_changed; + enum ieee80211_rate_control_changed_flags rc_changed; if (updchnctx) lockdep_assert_wiphy(hw->wiphy); bss_changed = 0; + rc_changed = 0; /* * Ensure rx_nss is at least 1 as otherwise drivers run into @@ -780,6 +920,11 @@ lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, if (updchnctx) lkpi_sync_chanctx_cw_from_rx_bw(hw, vif, sta); + bss_changed |= lkpi_sta_supp_rates(hw, vif, ni, &rc_changed); + + if (rc_changed != 0) + lkpi_80211_mo_link_sta_rc_update(hw, vif, &sta->deflink, rc_changed); + return (bss_changed); } @@ -2689,8 +2834,6 @@ lkpi_sta_scan_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int vif->cfg.idle = false; bss_changed |= BSS_CHANGED_IDLE; - /* vif->bss_conf.basic_rates ? Where exactly? */ - lvif->beacons = 0; /* Should almost assert it is this. */ vif->cfg.assoc = false; @@ -2706,6 +2849,11 @@ lkpi_sta_scan_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int /* RATES */ IMPROVE("bss info: not all needs to come now and rates are missing"); + bss_changed |= lkpi_sta_supp_rates(hw, vif, ni, NULL); + if (ieee80211_hw_check(hw, HAS_RATE_CONTROL)) + lkpi_80211_mo_set_bitrate_mask(hw, vif, &lvif->br_mask); + TODO("cfg80211_tid_config WHERE?"); + lkpi_bss_info_change(hw, vif, bss_changed); /* From nobody Mon Jun 29 06:34:43 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2W3b07z6k5Pq for ; Mon, 29 Jun 2026 06:34:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2W29spz4HBR for ; Mon, 29 Jun 2026 06:34:43 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714883; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=IGlikBuwGjYMnEB2poQF0clhPetzS18URGXWuRL1+AE=; b=wbDSqIiZvVUhu052RUGsK7zWlvKPQ2uLGZ1MIWgmcIPT+kWdBZRQChMjfai4ogVxvJi+gF JXD+2EQ71uYY4/py2T0jRt7/S4vYrxh6NqTXkFLPt7CBMDmZ0Kc4wlG1wEI4/Vm2B8o+uA 8KQVXBJLOLQTSNW+2TXJbziD6Pcb6JZXUbQ/M8WUSCypdZreMAZNpXjtMVzJ9BIwSU6Hne Z22rwkCyg9eMaBs9gv84NDcygRVAklPsoIMYfgW8Wu1gsfZMLbK3Zu+FMiq81EgoWDkrD2 gmoC7SgOYQjnuolDgO76/7AVkx4+mCQ0cUu6X1vQw1NWbKwTCZ+HJP/QrPi73Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714883; a=rsa-sha256; cv=none; b=TzaD2eCdx/9LjZjv7rdTYPdJLEB7aNxeL2+MMM+t6dGQoo1JvCmOwd4Y9P7c3AlZclbok3 4Z+v+gNQKMEfpApdwFMz4ItXHyGnVf1+IekKrQV3h6Hh325Mkbra7Udn9Wf/UlvQup2AiC e4lHOvDc2U9T3LZ4ewIdytJTakM8/IZrsawtMFxE8XMNsuUQ6KU267FbCadjQtCe+/VL3s hKqQkAF9Lekgq6h1H1d2P8YuBW0dIKD0/pyF/DaB/XbdjlL5VdUgVDpeZVbJpW2Lxp2Q+0 aSkgzyWj0fnMm8buLuyLBy5NSZiz2rjzFKHEtYlU7gvDgZ03Em9lSQfRPQD8ig== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714883; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=IGlikBuwGjYMnEB2poQF0clhPetzS18URGXWuRL1+AE=; b=hotVXmzu4vlfex/4EsciUsyxSWBJG8Hyvv7ASdePDen3sL94NqKZ628POb2cf4G2MiCMko Ue6V2b73XdgPp5qsHQA5/lpT9S4lbZjY0BUW8hzbxDXDmGtHk5YNGTXrPWVffXPnFDGY+3 rbymBrDh3uENoMKcyc+UH6qyR43B7m0fVucJ1+zNiCSiQaT1ArXwjZiYGHfbEQLEhgDyf/ Vxrojy2dW0SvD5eMaoMreKaQ1GSw83OPFMYoiN8itTwl+6lPlq/LYAVmipQ1DbH4E0ZypM DjL8VKdQCqDpxvWTLyRs8x6FYKee8Imw+8EnYk+ARxgYPJFjdeASqlTfyYMeqQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2W0vwTzmh4 for ; Mon, 29 Jun 2026 06:34:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 47880 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:43 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: f1f0aa38ec7a - stable/15 - LinuxKPI: 802.11: add/change rate related tracing List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: f1f0aa38ec7a65471bb065a26e3fa2eb96d19e29 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:43 +0000 Message-Id: <6a421203.47880.630bfff9@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=f1f0aa38ec7a65471bb065a26e3fa2eb96d19e29 commit f1f0aa38ec7a65471bb065a26e3fa2eb96d19e29 Author: Bjoern A. Zeeb AuthorDate: 2026-06-22 01:01:15 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:54:57 +0000 LinuxKPI: 802.11: add/change rate related tracing Make use of the TRACE_RATES() macro and add various tracing events. Also adjust some events formerly under TRACEOK to TRACE_RATES(). Ignoring the tracing, no other functional changes. Sponsored by: The FreeBSD Foundation (cherry picked from commit 42cf2798110e12df6ccc22a138ed89617ac7d407) --- sys/compat/linuxkpi/common/src/linux_80211.c | 33 ++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 33ce55814b44..d5f9ef7f15a9 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -657,6 +657,9 @@ lkpi_sync_chanctx_cw_from_rx_bw(struct ieee80211_hw *hw, return; old_bw = lkpi_cw_to_rx_bw(chanctx_conf->def.width); + TRACE_RATES("old_bw %d sta->deflink.bandwidth %d hw->conf.chandef.width %d", + old_bw, sta->deflink.bandwidth, lkpi_cw_to_rx_bw(hw->conf.chandef.width)); + if (old_bw == sta->deflink.bandwidth) return; @@ -669,6 +672,11 @@ lkpi_sync_chanctx_cw_from_rx_bw(struct ieee80211_hw *hw, vif->bss_conf.chanreq.oper.width = chanctx_conf->def.width; + TRACE_RATES("chanctx_conf %p def.width %d sta->deflink.bandwidth %d " + "ht_supported %d vht_supported %d", + chanctx_conf, chanctx_conf->def.width, sta->deflink.bandwidth, + sta->deflink.ht_cap.ht_supported, sta->deflink.vht_cap.vht_supported); + changed = IEEE80211_CHANCTX_CHANGE_MIN_WIDTH; changed |= IEEE80211_CHANCTX_CHANGE_WIDTH; lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed); @@ -688,6 +696,7 @@ lkpi_sta_sync_ht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, if ((ni->ni_flags & IEEE80211_NODE_HT) == 0) { sta->deflink.ht_cap.ht_supported = false; + TRACE_RATES("HT ht_supported %d", sta->deflink.ht_cap.ht_supported); return; } @@ -722,7 +731,7 @@ lkpi_sta_sync_ht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, sta_ht_cap = &sta->deflink.ht_cap; rx_nss = 0; for (i = 0; i < 4; i++) { - TRACEOK("HT rx_mask[%d] sta %#04x & hw %#04x", i, + TRACE_RATES("HT rx_mask[%d] sta %#04x & hw %#04x", i, sta_ht_cap->mcs.rx_mask[i], ht_cap->mcs.rx_mask[i]); sta_ht_cap->mcs.rx_mask[i] = sta_ht_cap->mcs.rx_mask[i] & ht_cap->mcs.rx_mask[i]; @@ -732,10 +741,11 @@ lkpi_sta_sync_ht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, rx_nss++; } if (rx_nss > 0) { - TRACEOK("HT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss); + TRACE_RATES("HT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss); sta->deflink.rx_nss = MAX(rx_nss, sta->deflink.rx_nss); } else { sta->deflink.ht_cap.ht_supported = false; + TRACE_RATES("HT ht_supported %d", sta->deflink.ht_cap.ht_supported); return; } @@ -757,6 +767,7 @@ lkpi_sta_sync_ht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, sta->deflink.agg.max_tid_amsdu_len[j] = ; } #endif + TRACE_RATES("HT ht_supported %d", sta->deflink.ht_cap.ht_supported); } #endif @@ -775,6 +786,7 @@ lkpi_sta_sync_vht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, if ((ni->ni_flags & IEEE80211_NODE_VHT) == 0 || !IEEE80211_IS_CHAN_VHT_5GHZ(ni->ni_chan)) { sta->deflink.vht_cap.vht_supported = false; + TRACE_RATES("VHT vht_supported %d", sta->deflink.vht_cap.vht_supported); return; } @@ -856,16 +868,17 @@ skip_bw: } tx_map |= (sta << (2 * i)); } - TRACEOK("VHT rx_mcs_map %#010x->%#010x, tx_mcs_map %#010x->%#010x, rx_nss = %d", + TRACE_RATES("VHT rx_mcs_map %#010x->%#010x, tx_mcs_map %#010x->%#010x, rx_nss = %d", sta_vht_cap->vht_mcs.rx_mcs_map, rx_map, sta_vht_cap->vht_mcs.tx_mcs_map, tx_map, rx_nss); sta_vht_cap->vht_mcs.rx_mcs_map = rx_map; sta_vht_cap->vht_mcs.tx_mcs_map = tx_map; if (rx_nss > 0) { - TRACEOK("VHT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss); + TRACE_RATES("VHT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss); sta->deflink.rx_nss = MAX(rx_nss, sta->deflink.rx_nss); } else { sta->deflink.vht_cap.vht_supported = false; + TRACE_RATES("VHT vht_supported %d", sta->deflink.vht_cap.vht_supported); return; } @@ -881,6 +894,8 @@ skip_bw: sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_3895; break; } + + TRACE_RATES("VHT vht_supported %d", sta->deflink.vht_cap.vht_supported); } #endif @@ -922,6 +937,11 @@ lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, bss_changed |= lkpi_sta_supp_rates(hw, vif, ni, &rc_changed); + TRACE_RATES("updchnctx %d rc_change %#010x bss_changed %#010jx " + "bandwidth %d rx_nss %u", + updchnctx, rc_changed, (uintmax_t)bss_changed, + sta->deflink.bandwidth, sta->deflink.rx_nss); + if (rc_changed != 0) lkpi_80211_mo_link_sta_rc_update(hw, vif, &sta->deflink, rc_changed); @@ -6086,6 +6106,7 @@ lkpi_80211_txq_tx_one(struct lkpi_sta *lsta, struct mbuf *m) if ((m->m_flags & M_EAPOL) != 0) { info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO; info->flags |= IEEE80211_TX_CTL_USE_MINRATE; /* mt76 */ + TRACE_RATES("M_EAPOL -> TX_CTL_USE_MINRATE"); } info->control.vif = vif; @@ -8746,6 +8767,10 @@ lkpi_wiphy_band_annotate(struct wiphy *wiphy) } break; } + TRACE_RATES("band %d bitrate[%d/%u] %u flags %#010x", + band, i, supband->n_bitrates, + supband->bitrates[i].bitrate, + supband->bitrates[i].flags); } } } From nobody Mon Jun 29 06:34:44 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2Y04knz6k5CS for ; Mon, 29 Jun 2026 06:34:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2X4G0cz4HH7 for ; Mon, 29 Jun 2026 06:34:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714884; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wCQ0YXcgw94VTkUyqP7cTKVIw+C9v5IRXP2E5HHGZ50=; b=YHPDfCz8oOgsEnv1XXpugcdn9KFWhu48vrmJ21C3k7KEu5rGmlZ33UHjwen7nFBRzx2GZM B1hkkRGEdQ7U30aV6E7eXVNkIvLN84/BCV3mj4ng7A5KuijOdftcZPAXQpZgE1BEfW96ai /1djc8+7/eNIDL2Br59AHMhthglJ/MjSNJ7wplj1NGT1iOwvoBhPcidF8w1qMK9w3bHu7s F+cdDNzg9intHYtQSUF4Av569fJ/s6Xf0lM8Rs8sv3jhuNJHBhBLlG1H8CeRKyjowQt+xM mTvPVmA0YWNcNWs+rpMDDLNnY/3ylc5SK/mpVlU0XvDu2F9+ZCzJJ4OZoLv3Cw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714884; a=rsa-sha256; cv=none; b=iDStKHSugiThdvkgs38GHJ3puT+HnY72QaxxvJB/lqcd7HOJbg87GoGVuYZ2VbBLX/02bv enQEW1wEsd7j8iDOw3SF/8xrGwHuc8FU4uyXwHWUoJieqrajCmAZUBgH0h3/+G5s9pXTSR 72GnCSsMQbx8IlmoT6R/fZfC5bPEWoE8Z/hgVnXxxmAmWvkBqWwx/cUC40B6Rvy2dmiQOF g/yBRNCyWxOzyMcbCsBiIJX1HZz0igGzpEAA8xRP703pT560ddxPQ3KBNpgGepUDqntVf+ fFae8x6zaKG8Ukx4hp0PnGb1gVKJeIsnJIrDeJl6Tk1NdC0OgyfRfUcAn7YDOA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714884; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wCQ0YXcgw94VTkUyqP7cTKVIw+C9v5IRXP2E5HHGZ50=; b=YTjmzN50duXXwdWDmsYHV/QhKcde7at1kdgy/OQOmI5nidODDH684Zf7A570tlLb2viMUA VSSxMSU6l2dmCBL6VpJHQVcrAQ8UR2JF+P/MSGDCi48NpL8O7ZC636Mg8b4hmd2FxUWx8P ICjcPC8aYlf1Ea4vzCj8G0SnRliljLcqc40rNrIuPNr9ffSEH0OMf7+cRvshYrk2+OLWlM OwPGmda4SPyZKbLN4ItBrHj8izwmh9wVED8H4RIrwYolXo3u0beZpqMyZINm6bpa4D8Ve2 HLh5eQVhiG3DHSWKlXET5MrDu6pi9IgxSYyKQkwxlOLvzGLA2H4KpmIgj/Tr3Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2X38PhzmVT for ; Mon, 29 Jun 2026 06:34:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45ab9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:44 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: f0eeea32cd12 - stable/15 - LinuxKPI: 802.11: consider emulate_chanctx in lkpi_sync_chanctx_cw_from_rx_bw() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: f0eeea32cd123c349ec2c18b383201656078def4 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:44 +0000 Message-Id: <6a421204.45ab9.7fd7f9d4@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=f0eeea32cd123c349ec2c18b383201656078def4 commit f0eeea32cd123c349ec2c18b383201656078def4 Author: Bjoern A. Zeeb AuthorDate: 2026-06-22 01:04:36 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:55:04 +0000 LinuxKPI: 802.11: consider emulate_chanctx in lkpi_sync_chanctx_cw_from_rx_bw() Only return early if the bandwidth has not changed and we are not using emulate_chanctx or the chandef.width already matches the new bandwidth. Otherwise we have to continue to get all the values updated. Sponsored by: The FreeBSD Foundation (cherry picked from commit cff565a4c0335e12376ea43f99ef5328c45ce933) --- sys/compat/linuxkpi/common/src/linux_80211.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index d5f9ef7f15a9..ed9b3878f1d9 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -645,6 +645,7 @@ static void lkpi_sync_chanctx_cw_from_rx_bw(struct ieee80211_hw *hw, struct ieee80211_vif *vif, struct ieee80211_sta *sta) { + struct lkpi_hw *lhw; struct ieee80211_chanctx_conf *chanctx_conf; enum ieee80211_sta_rx_bandwidth old_bw; uint32_t changed; @@ -660,7 +661,9 @@ lkpi_sync_chanctx_cw_from_rx_bw(struct ieee80211_hw *hw, TRACE_RATES("old_bw %d sta->deflink.bandwidth %d hw->conf.chandef.width %d", old_bw, sta->deflink.bandwidth, lkpi_cw_to_rx_bw(hw->conf.chandef.width)); - if (old_bw == sta->deflink.bandwidth) + lhw = HW_TO_LHW(hw); + if (old_bw == sta->deflink.bandwidth && + (!lhw->emulate_chanctx || old_bw == lkpi_cw_to_rx_bw(hw->conf.chandef.width))) return; chanctx_conf->def.width = lkpi_rx_bw_to_cw(sta->deflink.bandwidth); From nobody Mon Jun 29 06:34:45 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2Y6Ks7z6k5CW for ; Mon, 29 Jun 2026 06:34:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2Y42Sfz4GyZ for ; Mon, 29 Jun 2026 06:34:45 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714885; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WPL9Th074Z/bQ7riIoBvF2+hgGnfqPgVXZaRqV8xm1Q=; b=NlCn61rSNXIw7iU1MAcQ+uOry9kfBeyZGR4mYAhW+2WSTVZSe2gOWdc6L2HDLnOc9GROvJ zeqIZu3iLonnuL46zYAlz9Z2yK5SCPqOlc59VhcUYV5SHcMYK81W3wEzmQb/L5t6v45RK+ DkD9BuDLsCNwbm/a4ouGysQj42MFn6NzujwNqf917VcRDcXpNZsQuRawPfAKhnCDk68Q45 KMba1i4Vi4MrlvczqGYbvoGPtbwJg52q0JPoXArVIRPerekU7OXeq/LbVYlAURBSo+9Fl1 951hGrF3R8SIRECXZpCEPFYZsfxRWAArw7KWJNwHOyO7ZqE9XtjQiT3Olx8ZzQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714885; a=rsa-sha256; cv=none; b=KXLsg9LRLen62JtLgOVd0c10dzueyrxyC7Xpq09K3Dl38On+8VbyR5n/Efe+5zrwdqsNFH NeamMApW509r0Nm+QRkHN2KjgmxNICGQ66+yQHR63yp/ya62yAPupbgKlKAhNvvauT8dJf k3OPaXITfEQQiuej9zCS0saAl93ihYXxf2B7GWyxCYVYncYlaPvzijb8cCUaO1uUtQwbR4 MATQACjiBTx8OpkBOG9xpsNi9d+929CMOL610x/5U5gtL9oIL8Sq5ZsO91fVV+AoF5KAOi SxX0VcdOZE6fpCQGiGhkKJPqZvQIOPJj4LXkhP6eDFSLbk2LhCDwle0ducA8UQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714885; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WPL9Th074Z/bQ7riIoBvF2+hgGnfqPgVXZaRqV8xm1Q=; b=PCMhQtthOA8uHmq6QrXvX/NLMawd246dreHEhshUC4FOI/VgXELdrkLHN1XX/fmR6MU2NK tXEp5DF5A0U5Ckk1xD5bHWcAHXL/ADnTYYwWwTFBqtzbZvrBoQK1FqfEw76dYFSZqkLqh1 e8BmQDLYjtBeOqfedF3j1CLg4n49qe64Twr5DsUien7mehloNOn9xFLF+PfOISQzvJ040a WyYS7tOuA6jkm/M4jSL0cQhtAw1bf/u+OU/fwROAaM+KOJBtoy55E8X9PqZAtUcwGysxEY U0/pf0JaNsvH3asvUaACoqsuW+zZUwMMjhiDEqCU9qGzyIrrdL79iq/UY0U1Aw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2Y2f3hzmmj for ; Mon, 29 Jun 2026 06:34:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 47086 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:45 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: f28bc5e19477 - stable/15 - LinuxKPI: 802.11: track bandwidth/rx_nss change in lkpi_sta_sync_from_ni() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: f28bc5e194777be6381976bd43826376d948ef12 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:45 +0000 Message-Id: <6a421205.47086.5339cd3e@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=f28bc5e194777be6381976bd43826376d948ef12 commit f28bc5e194777be6381976bd43826376d948ef12 Author: Bjoern A. Zeeb AuthorDate: 2026-06-22 01:11:18 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:55:09 +0000 LinuxKPI: 802.11: track bandwidth/rx_nss change in lkpi_sta_sync_from_ni() In lkpi_sta_sync_from_ni() track the bandwidth and rx_nss at the beginning so at the end we can diff if they changed in order to generate the appropriate RC*CHNAGED flags for the (*link_sta_rc_update) downcall. Sponsored by: The FreeBSD Foundation (cherry picked from commit 53d9c14af6a65dcc037527c6ff5308c94806fafe) --- sys/compat/linuxkpi/common/src/linux_80211.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index ed9b3878f1d9..04874b0e340f 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -908,6 +908,8 @@ lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, { enum ieee80211_bss_changed bss_changed; enum ieee80211_rate_control_changed_flags rc_changed; + enum ieee80211_sta_rx_bandwidth bandwidth; + uint8_t rx_nss; if (updchnctx) lockdep_assert_wiphy(hw->wiphy); @@ -915,6 +917,12 @@ lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, bss_changed = 0; rc_changed = 0; + bandwidth = sta->deflink.bandwidth; + rx_nss = sta->deflink.rx_nss; + + TRACE_RATES("updchnctx %d bandwidth %d rx_nss %u", + updchnctx, bandwidth, rx_nss); + /* * Ensure rx_nss is at least 1 as otherwise drivers run into * unexpected problems. @@ -940,6 +948,11 @@ lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif, bss_changed |= lkpi_sta_supp_rates(hw, vif, ni, &rc_changed); + if (sta->deflink.bandwidth != bandwidth) + rc_changed |= IEEE80211_RC_BW_CHANGED; + if (sta->deflink.rx_nss != rx_nss) + rc_changed |= IEEE80211_RC_NSS_CHANGED; + TRACE_RATES("updchnctx %d rc_change %#010x bss_changed %#010jx " "bandwidth %d rx_nss %u", updchnctx, rc_changed, (uintmax_t)bss_changed, From nobody Mon Jun 29 06:34:46 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2b0fkZz6k5Q3 for ; Mon, 29 Jun 2026 06:34:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpc2Z4l0yz4HDr for ; Mon, 29 Jun 2026 06:34:46 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714886; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=EooUItdW6A4UCjzddUfcxKwqmaUpKqkxbWLJL/WEvG8=; b=ysyuz3HJHi8AybYDEMMMfSGSmLvVxtE4Vv/CfFCv9g89iN/1mtftCM9Q6nls29CV+2pdIT se2mwiuw+IXkuu80C4gdWm8AxGtdrJecjmIDM+EhQmgzh7pBSHvUv/ETwPiXNANwKanSss Rv19xpzodJI1YxAx6Balh3h/mwEwWd+8GDzsq7Jcnwi+eD26bzEcx27F4yuDdrj/OvgjTz GjNhm2TmPQxBCPFvKPzf/Ge7RC12nNOShhlb8olW2eMFMZx07etKl+WLchEpdND9pxpM/v 5QKBci82HiTDuN7oLoBMHUo/27aOfjivuXoRfj2k3HJLGEPTccn4HhnTeXI74A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782714886; a=rsa-sha256; cv=none; b=Zsutv/1qgPsY6y5Bu0J+gAIx3EKzqxw9PZvTTX1dvjQM4bArCpowDXfbLyEq/u/LIwE2S8 6urpw1uz9ZeRG6lpa2j9KFw5b6VIGj7KcLzXT9e36i5cNH5JApBD45Qg+eawfS44Ph9gxx pMEWsAR+dL1oDBa56j+kjjljdRxXBHkLNrb0bHDvWE0ZDSTkCCJ5GDBmWu9stC+B+Psbz8 re4gnxtp/mVRpJ7pzCehEFslbuCM+o1hWBLps3bjTAGUOPZKzjtjwSFZIC0CDAMsKXpX7Q ajdQ2tSoc2LaLVYl0Td33QFGHRcCsZfByAUjxT+1NtnU4adCFiTEqf/5nslWNA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782714886; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=EooUItdW6A4UCjzddUfcxKwqmaUpKqkxbWLJL/WEvG8=; b=lvctjt0Nyh88DEELTLn1cZNxAX3jN21he23jJTexI1MB3DDdcSSZybHdeE22tWrGvOpdQO kJZmec8hQFbxO9oh94gLWXdkxEfp+WPWXEXXzmT6WHMKZgXIgBWuf+iKF7OtokwjxxB96s Tpbyne9Bo3/UGwMZmE7fljITgoS/S9NiszUnexeAcN1Msdf5D82fen4QwX/hXDPy3TVyPZ KtGDcaAcTcvCtDnnn8YhKiPn/Y1W3e3OOBFAIxShXwGeoiAr+4khLtRSAK1mY2Sq6rJoMK 3G3i9wO6PWtvSCnlW9SEBf2k6EM7mr63iVmFKSD8M+FP5Zist/m5i07e0PQMkQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpc2Z3KP2zmMq for ; Mon, 29 Jun 2026 06:34:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46b16 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 06:34:46 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 8df9c187c742 - stable/15 - LinuxKPI: 802.11: adjust timing of sync_from_ni in lkpi_sta_assoc_to_run() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 8df9c187c7425fd1c14f707a608d1479c8b249c7 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 06:34:46 +0000 Message-Id: <6a421206.46b16.2f4305af@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=8df9c187c7425fd1c14f707a608d1479c8b249c7 commit 8df9c187c7425fd1c14f707a608d1479c8b249c7 Author: Bjoern A. Zeeb AuthorDate: 2026-06-22 01:16:45 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-06-29 03:55:13 +0000 LinuxKPI: 802.11: adjust timing of sync_from_ni in lkpi_sta_assoc_to_run() We used to call the (*sta_state) downcall into the driver to set the sta state to ASSOC. After that we did a lot of sync operations incl. the lkpi_sta_sync_from_ni() which does a lot of rate and bandwith adjustments. This sync call needs to happen before we set the sta to assoc as drivers rely on some of this information, e.g., ht_cap and vht_cap (and equivalents for later standards) at that point. Moving this will make, e.g., mt7921 transmit at higher rates than just basic_rates. Sponsored by: The FreeBSD Foundation (cherry picked from commit 75aadc902298005c47d2b931c483452027ceae69) --- sys/compat/linuxkpi/common/src/linux_80211.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 04874b0e340f..4ed05d32ceed 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -3184,6 +3184,16 @@ lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int if (vap->iv_flags & IEEE80211_F_WME) sta->wme = true; #endif + bss_changed = 0; + /* + * This sync needs to happen before the sta_state change to ASSOC. + * At least mt7921 (likely all drivers) rely on, e.g., ht_cap, vht_cap, + * .. to be set at the point we go to assoc. + */ + bss_changed |= lkpi_sta_sync_from_ni(hw, vif, sta, ni, true); + if (ieee80211_hw_check(hw, HAS_RATE_CONTROL)) + lkpi_80211_mo_set_bitrate_mask(hw, vif, &lvif->br_mask); + error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC); if (error != 0) { ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) " @@ -3194,7 +3204,6 @@ lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int IMPROVE("wme / conf_tx [all]"); /* Update bss info (bss_info_changed) (assoc, aid, ..). */ - bss_changed = 0; #ifdef LKPI_80211_WME bss_changed |= lkpi_wme_update(lhw, vap, true); #endif @@ -3255,7 +3264,6 @@ lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int bss_changed = 0; IMPROVE("Is this the right spot, has net80211 done all updates already?"); - bss_changed |= lkpi_sta_sync_from_ni(hw, vif, sta, ni, true); /* Update thresholds. */ hw->wiphy->frag_threshold = vap->iv_fragthreshold; From nobody Mon Jun 29 08:11:12 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpf9x3txvz6kD21 for ; Mon, 29 Jun 2026 08:11:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpf9x39cjz3M0K for ; Mon, 29 Jun 2026 08:11:17 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782720677; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Xc32XWDY/875r7c2vznEFf0I9GboLy3F3AgixzH8W7o=; b=xTuUem3vlTP/5pAgLjSjqwXhzanOE5K9aJDtLPmkpWEBIx7w6YS67wEsRmW2+yKfGRArcg 0PRXz7G0sDp13ni1iBYvOLXx9/FKyX8juO5m9KmOct7VEgM2Kg1fGx+wtCcrOpq4wsPltG oot3lYd5pnYn9hsBMw1KKR/bqpxhGahPO88xa0l1D7pRtYlykhTlFrbDQloKujSrQVODQT cIjJ8CUfBTe4jRyasNv/2jtdPCkXXF/sAmIvHQgnzUO2QT0m2kza12nSB5LckSvd0wopEg ei+VS00o5ATNezN95slFR0v31G3I1ijNPH1Vs2hu/N4I1QogvVeVnFCMDmMQKA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782720677; a=rsa-sha256; cv=none; b=TJ28eHGWjvakItzs1w2H8YvBfqIalkdr5SuRvH4CI1jl/hREoHCp4qq+REmg+NHzzfw2AE HEF0QF9ri7fE4vFswwsUMn6GC8zUEHUhUZJ2RDGLUSwXr3CL6pu0c1Tq2BQvVLfDR1MRK9 RRr3D6fXph5eUb94Gy8XxSs9UZtrQzFXeiDxdhcNEZO6YYrc2s+RcuRzHRMklUg+IcmulC 8WwLXzxOseadcjJwftJXfBK9adH+mwQdn/T1ti9wwTfZzxsiI9geFdqaEfJIy9PYP5tqqv LyX/BxXMBdHrNQFI5nOR3uwcFdVcsPcLCrie5y3KwLlX+bEG/B3jYP8I94d4qA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782720677; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Xc32XWDY/875r7c2vznEFf0I9GboLy3F3AgixzH8W7o=; b=RiX8K559UxM4EMWQulADP1wdTcO7Wrvg1d0lsmdJcK63nhG46B0VWD+t8lD/H4TV71WYBa fZ8rsjO3dIXOdi+XhfS8Z3Uwt6fw5SiKkpbY5M51TSRDqvVNJQuJbMGlas7zx2EyPe6I4c MJcZuGF51qx6vTFhpzwL6K/hBpqGpW5pODvGH5Lue+ZEPPSSQZPuVTSSrtpRwiAH7+usW6 blx4l58J6tfaYUQz3wMugdUcPTxP4lU17dhcT0EZYxLBX0+1JceflFfaKE3syH0vdHpXxI lwBgLmzAUsmE1q69b3IE1d8TIsgLSU1WkSE5DSsljO4Ta3cTwe8ZTlpdsoyZDQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpf9x211Bzq5k for ; Mon, 29 Jun 2026 08:11:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22a2c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 08:11:12 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Piotr Kubaj From: Robert Clausecker Subject: git: 964215aa1347 - stable/15 - sys/arm64: fix return values of freebsd32_{set,swap}context() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fuz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 964215aa1347c9da457ecaced0521c29eaaf7b21 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 08:11:12 +0000 Message-Id: <6a4228a0.22a2c.2ead25d6@gitrepo.freebsd.org> The branch stable/15 has been updated by fuz: URL: https://cgit.FreeBSD.org/src/commit/?id=964215aa1347c9da457ecaced0521c29eaaf7b21 commit 964215aa1347c9da457ecaced0521c29eaaf7b21 Author: Piotr Kubaj AuthorDate: 2026-06-11 11:41:29 +0000 Commit: Robert Clausecker CommitDate: 2026-06-29 08:10:09 +0000 sys/arm64: fix return values of freebsd32_{set,swap}context() This patch aligns the return values of freebsd32_{set,swap}context() with their counterparts on amd64 and powerpc64, fixing the setcontext() and swapcontext() calls in armv7 applications running on aarch64. In particular, this fixes random crashes in armv7 Ruby applications running on aarch64 hosts. Tested by: fuz MFC after: 1 week (cherry picked from commit 92ae21e8a155734f73589b7ef9fa19a6bb6d042f) --- sys/arm64/arm64/freebsd32_machdep.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/arm64/arm64/freebsd32_machdep.c b/sys/arm64/arm64/freebsd32_machdep.c index d0218dc1dc80..3c7040bf5bb4 100644 --- a/sys/arm64/arm64/freebsd32_machdep.c +++ b/sys/arm64/arm64/freebsd32_machdep.c @@ -293,7 +293,7 @@ freebsd32_setcontext(struct thread *td, struct freebsd32_setcontext_args *uap) NULL, 0); } } - return (ret); + return (ret == 0 ? EJUSTRETURN : ret); } int @@ -341,7 +341,7 @@ freebsd32_swapcontext(struct thread *td, struct freebsd32_swapcontext_args *uap) } } } - return (ret); + return (ret == 0 ? EJUSTRETURN : ret); } void From nobody Mon Jun 29 08:14:41 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpfFs5V6Xz6kDYC for ; Mon, 29 Jun 2026 08:14:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpfFs3v3mz3N7l for ; Mon, 29 Jun 2026 08:14:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782720881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OKZVy4HWESnZKbBCDI5HhKvyp7obq4KMTEXmN5lUOjY=; b=d6GGn60FfwJhPv1d1kNLFUpZ7aWJwxIQwwGQvk2tsqtxEa8iCKUp4GCZ5gSwq9g4/O5Gy+ ilAhBILJIInkX2RhjliV4UdcK/6EwU8X0SmSIWDS5O4Eg9WElxSLHEd3egZILIXytH9N5k lNTFSUwCbOeVul9JaRM3OoQPzqFFJBlh5PbrQGZ8VGHpKeET3SdAw1PpmeNHSp8srxbQQl lbnuq4JInGU1Rvc5jHXyt2okZB226ca5VaSUrmIIdmIxKv+bQcRDeaXZrcejORg9HATAXE h93GPTwfL471av6uhfAQOrJ+HbRNcz5fXhStBHnMwGcXQUc4WGzfXh68b/Y0TA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782720881; a=rsa-sha256; cv=none; b=Ei3EpuLtNmQhwM3f2YINLJum0Vrnd06SmSsgSbsJUnM+KQZgHLbVgQbJ3YlYIbXNVwbFQw nO3zR3fn3nzcm6o6lWZaWQe/Yf3xEqEniSunAsNTrCQmtS0bVXMmQAfGMgJjwOq1aDbhvf YIiF2dmyqw53S54e5s7085PPD9iyanPzPEXXrROoFU7V1I9GC0v0BVURGKAxhaRk7vpLv/ Qg128alot5q6gjM9KeajK9zXGHi2JWLxnsoXefMDvZnN1UzHMkycd2ihxcEwVQe1udYFH1 rf6msPE4TV8C/Zw2uE4fYm+SX32AIoKkQX5b55Yhaul/QzgPSDwUMMU7AQCW1Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782720881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OKZVy4HWESnZKbBCDI5HhKvyp7obq4KMTEXmN5lUOjY=; b=XNpvGSt/6WcQ7CTag2N3mAoakN5PnC7acPlQBzI1ASBvRLQj2Rs71Ic1vOtixzsvYXhQQc rDjAJJYnXIYMMS3egu8x1dIjR1uQH5wsnDfp2/5pnTX9Fj3GXpUWwHWD/I5WcV29kfOz6p ckyZYzxvA6nRXzrSa/ahatwLuwjFpGh/WqjZ07+X6QK3UAFxqZK91bIRZFeyTq5CUtGWEe wRGSoAk1WAI3dSbYBqzT3PP57yQv1wf/1WTf2WanG/XMSirlaSFHRhl2dqV6GM2ZPTAeMZ P4gI3IKpbYiNy2ILH7zlP6UGPo6SxK8RikLk1EIfyBa5adnygFJgAGvTd9lsbQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpfFs2xRJzq6H for ; Mon, 29 Jun 2026 08:14:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 2220e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 08:14:41 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Piotr Kubaj From: Robert Clausecker Subject: git: 58a15fe75cc5 - stable/14 - sys/arm64: fix return values of freebsd32_{set,swap}context() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fuz X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 58a15fe75cc59a73016f00069f2dad001d798edf Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 08:14:41 +0000 Message-Id: <6a422971.2220e.487c97bf@gitrepo.freebsd.org> The branch stable/14 has been updated by fuz: URL: https://cgit.FreeBSD.org/src/commit/?id=58a15fe75cc59a73016f00069f2dad001d798edf commit 58a15fe75cc59a73016f00069f2dad001d798edf Author: Piotr Kubaj AuthorDate: 2026-06-11 11:41:29 +0000 Commit: Robert Clausecker CommitDate: 2026-06-29 08:14:05 +0000 sys/arm64: fix return values of freebsd32_{set,swap}context() This patch aligns the return values of freebsd32_{set,swap}context() with their counterparts on amd64 and powerpc64, fixing the setcontext() and swapcontext() calls in armv7 applications running on aarch64. In particular, this fixes random crashes in armv7 Ruby applications running on aarch64 hosts. Tested by: fuz MFC after: 1 week (cherry picked from commit 92ae21e8a155734f73589b7ef9fa19a6bb6d042f) --- sys/arm64/arm64/freebsd32_machdep.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/arm64/arm64/freebsd32_machdep.c b/sys/arm64/arm64/freebsd32_machdep.c index 1cf8403e0a0e..dc0e536c2bbc 100644 --- a/sys/arm64/arm64/freebsd32_machdep.c +++ b/sys/arm64/arm64/freebsd32_machdep.c @@ -292,7 +292,7 @@ freebsd32_setcontext(struct thread *td, struct freebsd32_setcontext_args *uap) NULL, 0); } } - return (ret); + return (ret == 0 ? EJUSTRETURN : ret); } int @@ -340,7 +340,7 @@ freebsd32_swapcontext(struct thread *td, struct freebsd32_swapcontext_args *uap) } } } - return (ret); + return (ret == 0 ? EJUSTRETURN : ret); } void From nobody Mon Jun 29 10:11:15 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gphrM6xdrz6kMry for ; Mon, 29 Jun 2026 10:11:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gphrM1wmfz3cDJ for ; Mon, 29 Jun 2026 10:11:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727875; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Z2aczJXvf45uJMifreo3g3hsMKqfzDrAX5zkroNQZ3U=; b=NbqYfTEVu7yTiQalFBRUMuLYEQXj4Zy0HWSohBl5XmFDBzokoWnY8rRJjfVGHqElVZEOoM T5jm2izRgBAkHBVNKEehLmLaDxqNIZqU5tytUtN7QwPaOwpY1CnZ7WrGr3NdJyQ9PjzBkT LZhw3TFpopu/srtxS2iXVU08x+ijsANIt3topYKIubyU0W7yqQyYrB7NmIP7hW9YJ+ES8G /MFXTOw/9N0wQ0PKR/HH8D25x5Ghb3Ins7ihFCgJcnS8rzYBngUWJ/O6oTxiOEg01t0H7H mM//sOQ8ZHUlSb07rlcdykhwydh5+2hSVqTXim4F2o9p5MB82XUa5mIpKYmrAw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782727875; a=rsa-sha256; cv=none; b=EoIntRkp+6vy4yLFLwzKSrh9L8AqbRz1aPB8Dk24cYTp6mRG6oUP4tOwB59NpdI3deqwDR wiwAWQ9TQReGB1mMCfyTmdqpUm4T1wYAIZ+ZNF3ii5PK8jq4e1uf5Ows91O7HCAiKYvzse buRLiuNwA4hyAn2QPx513/KWck36Qqny80mXXfFwt2sjA44qBnPIfvNnGfGa/eQDFoYzpQ tgLdS+MQqyC8RKQsJEpSOm4I39Wmp+pyyfs7hmto7S262oEuKp3TTLI4dqE8HplWz+LwSV g8m90RBKanQr+ZXyCdnKBv34AjzO67T+UtIw1FrdsBN/n2BA7kMiXlMcJEBRdA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727875; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Z2aczJXvf45uJMifreo3g3hsMKqfzDrAX5zkroNQZ3U=; b=K8ZJQrGKoUGH39UN3nii365HIGDR5yY8i70gyn/t2b5JTCJXF5v0X7NxHxhcN4t0T58iCi AQuY86ZjNhu6weoLUTzpDjKQJXqVx5A3yVkPmEf4re4aRHUsVz1FY74z5YIbs1Szt9ZuAE 5m2q2eAU5vOIsLFOI6ErzF8dU6UikrJLJEjTEp30qoyQgziDqmrxslXnG38Gl3Wv0UV76o 87F4Vj5QWVtXu68/tbMIj7E4mDV3yL/csm2bTdlNvOjGUm4ZB3n/6IaNmexLtEWmuoHwe2 HvA15xSEaIQF6+AEXrSMI1dJKlO/hzVcPJ4DTjRevLpoNcapm2PIASqR3HfSxg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gphrM0vDhzsq9 for ; Mon, 29 Jun 2026 10:11:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 36864 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 10:11:15 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Faraz Vahedi From: Robert Clausecker Subject: git: 47068325900a - stable/15 - rpcsvc: Remove obsolete bool definition from yp_prot.h List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fuz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 47068325900acaa82bd0fd71f32a666ee84f3dab Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 10:11:15 +0000 Message-Id: <6a4244c3.36864.60dd6493@gitrepo.freebsd.org> The branch stable/15 has been updated by fuz: URL: https://cgit.FreeBSD.org/src/commit/?id=47068325900acaa82bd0fd71f32a666ee84f3dab commit 47068325900acaa82bd0fd71f32a666ee84f3dab Author: Faraz Vahedi AuthorDate: 2026-05-25 19:14:58 +0000 Commit: Robert Clausecker CommitDate: 2026-06-29 08:23:01 +0000 rpcsvc: Remove obsolete bool definition from yp_prot.h `yp_prot.h` has carried a SunRPC-era typedef of `bool` guarded by `BOOL_DEFINED`, but the header itself does not use it. The YP/RPC interfaces use `bool_t` for protocol booleans. Defining `bool` in a public header collides with modern C headers that provide `bool` as a macro or keyword, such as `` and C23-aware assert handling. Drop the compatibility typedef and leave `bool` definition to the consumer's language mode. Signed-off-by: Faraz Vahedi Reviewed by: fuz MFC after: 1 month Pull Request: https://github.com/freebsd/freebsd-src/pull/2203 (cherry picked from commit 60c11e7c54d0128fafcea9c804c7736e2fb53e37) --- include/rpcsvc/yp_prot.h | 5 ----- 1 file changed, 5 deletions(-) diff --git a/include/rpcsvc/yp_prot.h b/include/rpcsvc/yp_prot.h index 091347231c8b..d0ad15bd657c 100644 --- a/include/rpcsvc/yp_prot.h +++ b/include/rpcsvc/yp_prot.h @@ -67,11 +67,6 @@ * YPPROC_MAPLIST takes (char *), returns (struct ypmaplist *). */ -#ifndef BOOL_DEFINED -typedef u_int bool; -#define BOOL_DEFINED -#endif - /* Program and version symbols, magic numbers */ #define YPPROG ((u_long)100004) From nobody Mon Jun 29 10:11:16 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gphrP0mHxz6kN3B for ; Mon, 29 Jun 2026 10:11:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gphrN2ky0z3c15 for ; Mon, 29 Jun 2026 10:11:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727876; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=HXNX6yN/QolgqEte+WGJN76kvw5hHSMdDQlKOsbKeGw=; b=trWNH4YzjHgNDpSE9m6hBPqkAJyvrWSNI6ws5eEs0bNYHHjF72F6PRnn8smlYT2G6qRkG0 aoDHuJeAqQpPetNiBmGCrEWUWvYf1MkLMsTi/2zCYHpl4q+Xr/WK4Bf12BVTnEuEimuSio CvHwddNFyyJhiBK+ap4FMHcyCDt0lx356o75Wq+Me270bdnb3NUIteyPzAhIuYRI2THapR MDzFk4g73hjycM1CUTnc0N3hJ0z1kJJ+Cf1IBi6ISCpEgRdFddkY6o00AvuwFpW88MULEZ lCwVBKbAaHNW0cP2zSUV0yLjv2aQF7S/msFyEQngyuUVldGobrRTmuanNsCHmQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782727876; a=rsa-sha256; cv=none; b=OsQr2d17pzAMQeXAP10TLRlfl2ljTCAH1m9e+KhQD/A4+gLf4xYG4cZhHkKmf3BkbMhcIc OuS4WPWB2f6LLBu4kgo4ufN8v0ldn6QMgrk1m58iUOfMO+VJZgO5zYTNoSyaJrv9Q6nZrK uBwF/soAhiGHcXhNvZ5ULisAwugtl4e7sxlIFkcRlyOKZ5ONoOby5dWlh/kervPJNAvECU XzF0KOekWo5tfYETAXR3Cf8OO7rPOZtoK4zWDthXqxWshbGkW6wKeKp+8tZhk8WBPNTs1t Segcjot14fO/5+yRWPwoGr5E1xzNZLMQ8IjNXx7wLkWM1/m3SmwcHLBKG6PoJA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727876; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=HXNX6yN/QolgqEte+WGJN76kvw5hHSMdDQlKOsbKeGw=; b=J2uUQqrRUpMdW87/5fnMmRurZ3Gx4MUQD++EbKcZ1GRY84CqRZNfXdggzljTnNld+QdYua df8liY3xa0gxlbWUrDfRuc5G7b70PhBVSfRT55A51qCwXnD5W0FcxPrH807kXUc9FpRBUa p75vbRBrZ0CsLE/Zsc1FILDoYs2V61IOT9NDX8Vx+jeKEQ+3fRBbXgK23alk30ICp1tqzb a75mFC+ReqgsFejAK/P8hqgIUxE4nnyU7Xk1XxJmHQb7uKmL0EAMwbTczNqXa7GJlRBXL0 D1TQiJZoxQt/iM6V2XArir15kkHNcP6VCClzLnxhfb24S6F3Xz/8kkzOgz0IQA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gphrN1gv7zsxx for ; Mon, 29 Jun 2026 10:11:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 376a0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 10:11:16 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Faraz Vahedi From: Robert Clausecker Subject: git: d0777495d46a - stable/15 - mdmfs: Use standard bool definition List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fuz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: d0777495d46a6ed55bceaeec812ab7cc62f8520b Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 10:11:16 +0000 Message-Id: <6a4244c4.376a0.49534561@gitrepo.freebsd.org> The branch stable/15 has been updated by fuz: URL: https://cgit.FreeBSD.org/src/commit/?id=d0777495d46a6ed55bceaeec812ab7cc62f8520b commit d0777495d46a6ed55bceaeec812ab7cc62f8520b Author: Faraz Vahedi AuthorDate: 2026-05-26 06:06:52 +0000 Commit: Robert Clausecker CommitDate: 2026-06-29 08:23:01 +0000 mdmfs: Use standard bool definition Include `` instead of defining a local bool enum. This avoids duplicating a standard type name and keeps the source compatible with headers that provide bool as a macro, or in case of C23 that compilers provide it as keyword. Signed-off-by: Faraz Vahedi Reviewed by: fuz MFC after: 1 month Pull Request: https://github.com/freebsd/freebsd-src/pull/2203 (cherry picked from commit 64502126e126476456ca2aa60b4f798ed2d0b879) --- sbin/mdmfs/mdmfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sbin/mdmfs/mdmfs.c b/sbin/mdmfs/mdmfs.c index cd0bf7c96143..c86a098a892d 100644 --- a/sbin/mdmfs/mdmfs.c +++ b/sbin/mdmfs/mdmfs.c @@ -49,14 +49,13 @@ #include #include #include +#include #include #include #include #include #include -typedef enum { false, true } bool; - struct mtpt_info { uid_t mi_uid; bool mi_have_uid; From nobody Mon Jun 29 10:11:17 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gphrQ1Xn5z6kN0p for ; Mon, 29 Jun 2026 10:11:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gphrP40lWz3cSV for ; Mon, 29 Jun 2026 10:11:17 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727877; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rVo09qlm98kBaZxJD+dxHrgdeEBnY5ZBqPD1UhZqPm4=; b=c+R6w+c9TJMi0j7KVF6Iua1FtvOcq5N47xuqwojHUKAASIYygmLPLOYEuZh/vRL3tA7S5Q JENRideLfFxgM6QS0r5rhkDsBCIvgbRMAsWhFdlUYNJtOwfFWVli8D/K6IoxwKIKBW9LCs 2XBcPya7tbPsKV/q9KkawWfvbE03ytHGZY/GkT4la/j5UfXGU2vdjBq934mDy22NYGQhuU R93gm3maDlnGAPKC2mcTVBnV07pYtRmcI/Jzn19PnfzkzPV2HFTw6een5MrpnG6h4D+5Vx jkKqxztxvl3lxXOSA/XFKjKKTLVSkA8W+BwvrLQcWT87JunO0jHmkeL82Bt3Iw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782727877; a=rsa-sha256; cv=none; b=Ow6Ma59Gd9KGE90bKMVx4zfmKdcg5C253tmB0PPewOLfTXKRVg2N4dOYHSCDxAn5CVPCvt EKVcvWarRKbgJ6XrhAun+OrEP4I/NGC7PycMN9Th9ZVmaEr2opYwHzgHtwj58eKfLvwEr0 u2LJpLKouUClnLCAr2bfc36nIjMAdp1QaHu3FkNMKGICp3/Pje5ethPacdnaKjecRbpiEJ 4x5H8pmoGhT0VOeysVKA4d7bVrhjISLOmepRi8xHrdUjTjrVpTN9BWSepshuq06Nvf+1K1 iYpNx9D++uS1lPE7RfyUVeHYiS4EWHg4dBwDcDBotbDTKomym2fw7h466CPYeg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727877; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rVo09qlm98kBaZxJD+dxHrgdeEBnY5ZBqPD1UhZqPm4=; b=FjTftt+09xGtFV37U0xKFfd7BqYxOvNG8yRaAIiv2DWUnVZp9j8aRZy6HbVDksJyMfpl9w 76gI3H+3aanIMvRDA/6UFRO0CRfrysiuDnAqVkPuCnofaSFL9KJLthCTSAJ3FVGL08o8W7 yWzDPa0aL2Eg3HKZBMCADyqHdI/SxH4O9m6M5WqhnkIRSMpI+d+ovnMmMs+NN15Y6fGIBc /n9BfYyqPym3g+/GvhNUDgy10nScFGdmARBOn6DK5uASR8nEr2wp5jgeVmoYG8exUeSSn1 wGzDxtu6mbo8nd+JK7L0urRmzbocHjTUPdl5duT0YmsJUw5qkwQDLxmEwj6c5w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gphrP2pcYztL7 for ; Mon, 29 Jun 2026 10:11:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3764b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 10:11:17 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Faraz Vahedi From: Robert Clausecker Subject: git: 54dab51ee8fb - stable/15 - libc: Restrict the static_assert macro to pre-C23 modes List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fuz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 54dab51ee8fb8e3c6d36117272c5f7fc6c7f0874 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 10:11:17 +0000 Message-Id: <6a4244c5.3764b.286abb46@gitrepo.freebsd.org> The branch stable/15 has been updated by fuz: URL: https://cgit.FreeBSD.org/src/commit/?id=54dab51ee8fb8e3c6d36117272c5f7fc6c7f0874 commit 54dab51ee8fb8e3c6d36117272c5f7fc6c7f0874 Author: Faraz Vahedi AuthorDate: 2026-05-17 20:47:49 +0000 Commit: Robert Clausecker CommitDate: 2026-06-29 08:23:02 +0000 libc: Restrict the static_assert macro to pre-C23 modes Signed-off-by: Faraz Vahedi Reviewed by: fuz MFC after: 1 month Pull Request: https://github.com/freebsd/freebsd-src/pull/2203 (cherry picked from commit c5c7d18d011830088a2134e1be32f610f1f3e797) --- include/assert.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/include/assert.h b/include/assert.h index a3dbe933e18f..a089d7b79915 100644 --- a/include/assert.h +++ b/include/assert.h @@ -72,8 +72,11 @@ * C++ template parameters may contain commas, even if not enclosed in * parentheses, causing the _Static_assert macro to be invoked with more * than two parameters. + * + * C23 defines static_assert and its obsolescent alternative spelling, + * _Static_assert, as keywords. */ -#if __ISO_C_VISIBLE >= 2011 && !defined(__cplusplus) +#if __ISO_C_VISIBLE >= 2011 && __ISO_C_VISIBLE < 2023 && !defined(__cplusplus) #define static_assert _Static_assert #endif From nobody Mon Jun 29 10:11:18 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gphrR1FCwz6kN7s for ; Mon, 29 Jun 2026 10:11:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gphrQ4FCYz3cLT for ; Mon, 29 Jun 2026 10:11:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727878; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UsuR0ujNBVGTj0Vy7VAIMUDFps5wzWsZviCCcxgyi2o=; b=Z1+gd6v7QBM+CzAasjNqDLTsCNq2+5PygEp2eEnXb6mtS6C7FSAh0sNYWTTnz4fxuK2jPu vpwHBIiR8yk7fhfQToaFyDteAmPfMQE4dbSH5zxrrPuI+jcY8eaaUT4TFYV3Kul1iM3YJq m/0vKlIUUwyM746fUOhB7zKWKfZTPm0AL+GCdBrU0gnngOIdUjlVQ0xHkyXfW22H+XbdZv ePCUeLBXVWH+PEIAIuXzzFRiHf997sxq9RqVRLQ4IzWq1MQDbqaWSPrb2nUB/Rfdi4c/HU ZJZ/R+4INB1z4Qee33aeG6nc86DJSGF0fyN090TfRRsfVUTzNvhbrGa5BSzkdA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782727878; a=rsa-sha256; cv=none; b=uVdx+49Atuj0B2ckXaFTO84Ul6NhGmJDK8H9nLnv/9sOfpHmiiG6dMvZZJFQgORxF9jf1n f35RMGNYKwiRVQDh9SKbveSNnHdl6rW7mb9NzOk9iK3noD2/fZY2Hq951XldqoxbdrdM2l U/0OwJcA3YT5DTyUDabrZCIUb2Lxz6p2NEUhRQufFFT55dIqEzKrxQRiD6tq87yVfAreoL A0iYObnDjUh9BqIpHZDmcEbKW44S5wznA43GsBFBPT/a/k2RYvOl+iDSelteT4Q3D+uONV nldgv1imn5uFTTAnWhntfw444CbKTdLaq0vwkJkeciXILfeUtX2DPZIooYVXMg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727878; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UsuR0ujNBVGTj0Vy7VAIMUDFps5wzWsZviCCcxgyi2o=; b=AJmoJjU5dRp1dj9xQjcc/pS8C/6bF8kb6FihHIRQ9zd8xIgwGO0xvzYiZE3RfP4tkW06yo 0WNF2LgoAIB0mhH+eL3nbopBRSkvtLnOofmsFzdeAZobWy92u5DHk/oBjCCdtOgic6K7De 8W7hZpAbc5/2IL1durCAnazAvNYnEvL2oia3wg8XK3sFIMAlYUS4SHA0ijPNbMXG+9Nkv+ cEJUXAdEYAnIHtC0WPGIzLCw6Y5PaHeQg5OUWpp0z0tkb0QYHFD/KnEpDD4KlwxW5WIIv2 EsN9FEMjTf31cziI7SfyMLL0JChh9aNBdOkFfzZ+c4veLminfvRR1e9A2PO/pA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gphrQ3JjFzss1 for ; Mon, 29 Jun 2026 10:11:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 37288 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 10:11:18 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Faraz Vahedi From: Robert Clausecker Subject: git: a35335392755 - stable/15 - assert.h: Remove leading tabs for whitespace consistency List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fuz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a353353927555ed5d3781e07d5391f345acf5b96 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 10:11:18 +0000 Message-Id: <6a4244c6.37288.7d5b6b55@gitrepo.freebsd.org> The branch stable/15 has been updated by fuz: URL: https://cgit.FreeBSD.org/src/commit/?id=a353353927555ed5d3781e07d5391f345acf5b96 commit a353353927555ed5d3781e07d5391f345acf5b96 Author: Faraz Vahedi AuthorDate: 2026-05-28 07:17:28 +0000 Commit: Robert Clausecker CommitDate: 2026-06-29 08:23:02 +0000 assert.h: Remove leading tabs for whitespace consistency Signed-off-by: Faraz Vahedi Reviewed by: fuz MFC after: 1 month Pull Request: https://github.com/freebsd/freebsd-src/pull/2203 (cherry picked from commit 157c184689ea3d7b8b6bd89aff849e94f004aa0e) --- include/assert.h | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/include/assert.h b/include/assert.h index a089d7b79915..7dd48e61c082 100644 --- a/include/assert.h +++ b/include/assert.h @@ -46,19 +46,19 @@ #undef __assert_unreachable #ifdef NDEBUG -#define assert(e) ((void)0) -#define _assert(e) ((void)0) +#define assert(e) ((void)0) +#define _assert(e) ((void)0) #if __BSD_VISIBLE -#define __assert_unreachable() __unreachable() -#endif /* __BSD_VISIBLE */ +#define __assert_unreachable() __unreachable() +#endif /* __BSD_VISIBLE */ #else -#define _assert(e) assert(e) +#define _assert(e) assert(e) -#define assert(e) ((e) ? (void)0 : __assert(__func__, __FILE__, \ +#define assert(e) ((e) ? (void)0 : __assert(__func__, __FILE__, \ __LINE__, #e)) #if __BSD_VISIBLE -#define __assert_unreachable() assert(0 && "unreachable segment reached") -#endif /* __BSD_VISIBLE */ +#define __assert_unreachable() assert(0 && "unreachable segment reached") +#endif /* __BSD_VISIBLE */ #endif /* NDEBUG */ #ifndef _ASSERT_H_ @@ -77,7 +77,7 @@ * _Static_assert, as keywords. */ #if __ISO_C_VISIBLE >= 2011 && __ISO_C_VISIBLE < 2023 && !defined(__cplusplus) -#define static_assert _Static_assert +#define static_assert _Static_assert #endif __BEGIN_DECLS From nobody Mon Jun 29 10:11:19 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gphrS1D86z6kMs6 for ; Mon, 29 Jun 2026 10:11:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gphrR52Jqz3cDR for ; Mon, 29 Jun 2026 10:11:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727879; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+9k9gCanbpeWHasK9QKvS9hybZRs6rvSw+ftD1eVrRY=; b=pZ7DQGOtDdnycSsL0XpeSuQgBu2GEScPhj1TwYsZ1E1HkZV0uCxSP8dV7XPCJzISkUMptP txFLa+BmXK/dfyOt4l+pvuLIIPCRTQYDWeYZIs/v+LbM+5/ZUDrJpAVmI5mseij7dxOA0W Md5B+cPDwCGCVGjRWxwjuRGTTOWnv+PaFU5HAXSnlU3yf3K/zGoPmiZxJ/ICvcIN7OsO4w cIeX6c7prXFIMsiqn53x73xUR//Fa5LeIenuVWrBuzHH3MLg6b31C5yg8Qs3qDbzL5tt38 xVylprvYHVvAZakAxHQ4lEiI+NVUeLYfIvKE4d+vitwz5c4Cbl+KPEH/KQOh4w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782727879; a=rsa-sha256; cv=none; b=Aebr4WlWFnVn6xAtMA5QPC6OkX1ApC7LMk1//3jS7w+gKgOmv3BvshKm54kWaAebLAonAx mUxZuWfHI6Fi3GwDs1kyMthkHxXKhNJwVF/BzwlTO2kKiR/B9ssOK84X3gd5zZxaVBzD8F 6bJRTZXDe96eYhjcVAEfCkqbf2Y1WU9HuOD91O4eKpKUV5iBvmbwRWCK7cuvHK5aMCuoU+ nV8npU2bpmJJoiWWZdpuKddqOW6n+u4dip+1weFUN+gyI5x7HtDyCIlfGHGcDl/J4p5X2J sgE2IvkPmEuuJD2YSoQMYx+CBrM1M2O0EM+2VFsEFMp2FH8vJD52o5x+/bc2wg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727879; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+9k9gCanbpeWHasK9QKvS9hybZRs6rvSw+ftD1eVrRY=; b=VfP3eJ+iXMZK2IJEuWlos8sUJ7JRo46/iqYUGZjj87y8eM2elQ5TgkPox6DuHRbQ2aUFM/ WejsoIkH/ZTZW1jpZYtSMhErsVVc+8bfK+uTTRePTMt6rsDU8OizE64SzvYNHU8M7uq+9T 21Jjiua6lQsaoC41NApmHtRuVdxthOgNKLupTEGVZ0DT/Ub6/No6kn+hayOJUrWYbrv48i YTNJNSULQsKDSe3li/qTe67QylkvNRdngBmZH9C7bMsHa2GWT6XKefDhJuJBY16nFU5eVu c1uBkTAEIu14bGQRTL+A5kV/sGJ49q+5TWGfD7NJ/xOYW7Ak6jbh7vBGpcGvuw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gphrR4774zss2 for ; Mon, 29 Jun 2026 10:11:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 37650 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 10:11:19 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Faraz Vahedi From: Robert Clausecker Subject: git: 6d29a9354d28 - stable/15 - libc: Add variadic assert in accordance with C23 List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fuz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 6d29a9354d28119d01a512693ba74d742211996b Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 10:11:19 +0000 Message-Id: <6a4244c7.37650.3e2693b9@gitrepo.freebsd.org> The branch stable/15 has been updated by fuz: URL: https://cgit.FreeBSD.org/src/commit/?id=6d29a9354d28119d01a512693ba74d742211996b commit 6d29a9354d28119d01a512693ba74d742211996b Author: Faraz Vahedi AuthorDate: 2026-05-28 07:31:29 +0000 Commit: Robert Clausecker CommitDate: 2026-06-29 08:23:02 +0000 libc: Add variadic assert in accordance with C23 Signed-off-by: Faraz Vahedi Reviewed by: fuz MFC after: 1 month Pull Request: https://github.com/freebsd/freebsd-src/pull/2203 (cherry picked from commit 867b51452ea78ece0b312a387e63fdbc2a11056a) --- include/assert.h | 42 +++++++++++++++++++++++++++++++++++------- 1 file changed, 35 insertions(+), 7 deletions(-) diff --git a/include/assert.h b/include/assert.h index 7dd48e61c082..159efacfa45b 100644 --- a/include/assert.h +++ b/include/assert.h @@ -46,16 +46,43 @@ #undef __assert_unreachable #ifdef NDEBUG -#define assert(e) ((void)0) -#define _assert(e) ((void)0) +#define assert(...) ((void)0) +#define _assert(...) ((void)0) #if __BSD_VISIBLE #define __assert_unreachable() __unreachable() #endif /* __BSD_VISIBLE */ #else -#define _assert(e) assert(e) - -#define assert(e) ((e) ? (void)0 : __assert(__func__, __FILE__, \ - __LINE__, #e)) +#ifdef __cplusplus +#if __cplusplus < 202002L +/* + * C++ modes prior to C++20 cannot simultaneously satisfy all three + * desirable properties of the sanitiser: + * + * Approach No double-eval Lambda support Arity check + * ----------------------------- -------------- -------------- ----------- + * sizeof(cast(expression)) yes no yes + * static_cast(expression) no yes no + * (void)bool(expression) no yes no + * + * NOTE: C++20 introduced lambdas in unevaluated contexts; see P0315R4. + * + * Since no approach satisfies all three below C++20, the least harmful + * choice is to forgo the check entirely rather than silently break one + * of the remaining guarantees. + * + */ +#define __assert_sanitize(...) ((void)0) +#else +#define __assert_sanitize(...) (void)sizeof(((bool(*)(bool))0)(__VA_ARGS__)) +#endif /* __cplusplus < 202002L */ +#else +#define __assert_sanitize(...) (void)sizeof(((_Bool(*)(_Bool))0)(__VA_ARGS__)) +#endif /* __cplusplus */ +#define assert(...) (__assert_sanitize(__VA_ARGS__), \ + (__VA_ARGS__) ? (void)0 : \ + __assert(__func__, __FILE__, \ + __LINE__, #__VA_ARGS__)) +#define _assert(...) assert(__VA_ARGS__) #if __BSD_VISIBLE #define __assert_unreachable() assert(0 && "unreachable segment reached") #endif /* __BSD_VISIBLE */ @@ -76,7 +103,8 @@ * C23 defines static_assert and its obsolescent alternative spelling, * _Static_assert, as keywords. */ -#if __ISO_C_VISIBLE >= 2011 && __ISO_C_VISIBLE < 2023 && !defined(__cplusplus) +#if __ISO_C_VISIBLE >= 2011 && !defined(__cplusplus) && \ + __STDC_VERSION__ < 202311L #define static_assert _Static_assert #endif From nobody Mon Jun 29 10:11:20 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gphrT1frVz6kMxY for ; Mon, 29 Jun 2026 10:11:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gphrS5ywKz3cRD for ; Mon, 29 Jun 2026 10:11:20 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727880; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=NZFv8GHX/q2ffcopbXSJujD1Dchb8WfgyTeTT1QMHlk=; b=HQ45uMP1dCyduBqJSENzvwbyKpzf9lvk80YCE2IihTJpX8Es18KGUMMQraDqxKFYmLF2sb UYFOJbpwsYHNBJ/EVkh8k1CJxJ/bC5cFH494ugJ8UdEvANcGSQXWhPF1ojaHCTpjmSbH4z 1nzw43dz8sD6XMIZ9PXDLJARTucGvdb+lAd/1Cc3K4JlYeqyr5btXrx5qGMPy63A/82AGz rpfN9xXoiY8mzHO7czDtqjnAkEOl4yIgU+fqDvBJk08QJ3T6l3LgNwqAKjZUGs+gq0/5GP Sthyf95R1bKTvz5YVe6fIRi+udFwZhVSv2rR8i1wYyL4UIzYIL+x2hrVkDzgQQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782727880; a=rsa-sha256; cv=none; b=mRcx3Tf9Rrc81+Pw8dq/yjklHY4qjy5h4g3MwyKgh/RPYOdeGZPfFMa7ghvVy4iaWzBk2R XYtGbms5rIBn+MHyvLqbyhHIagy1zWA7YdJmZopODXyf9+A1nU2alDkxRMs4QwP3uX4xlh npef5gvwkwDSniPnFT7VQGIRhYz1yoJB05FpsMhYcgARA0WmYsgogR8yv+ZDX/C/zzzmoV H0X9+27VtbwHjjdYVqxxJurFvp5f/RNLV8OMphWgzpNXnYF8FRE31BqAqxFDB8p3NvRGcI wbuhGVm6r4GElXo+WsyJDLDf2NqpjkUnKhSAAS+LpJTMQl1ylgL+Nf1+2wha2A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727880; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=NZFv8GHX/q2ffcopbXSJujD1Dchb8WfgyTeTT1QMHlk=; b=lfYhcb6BKwkmak3uT1TOgkGLHvrT36adlvsaiV3imKeTO/wf0wMMj/2hyWs87iL0IUVPkC XBoREB0If4yQPIxF8z8RxqWbPV4r0osJ+l/nKu6s2As8JbTLAvnQfqfCPTlWiyMon6K4V6 AbxcJaiT2lT9swa4p8ZvnA487yjYRn+ofxeGiki8NR/aAnhcoNjc4OW0TiiEcGQv5v01lL R+sQZO87QxoIrfGVUnqkNA+ndCvQdFY/Z+gZzXUWcP3Y5OaEg//eMBHxYBaSHG1FzUvFXO AphqrycDwYTVuE7u9fOUvm4XGVOxy8yPtpWxh3k+bBVi1W+qKsxmsnPWmh66QA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gphrS4vrzzsdx for ; Mon, 29 Jun 2026 10:11:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 343dc by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 10:11:20 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Faraz Vahedi From: Robert Clausecker Subject: git: 2126cab4a454 - stable/15 - libc: Add C23 feature test macro List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fuz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 2126cab4a454655042858bf4b382e426e6dc5081 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 10:11:20 +0000 Message-Id: <6a4244c8.343dc.6e67465d@gitrepo.freebsd.org> The branch stable/15 has been updated by fuz: URL: https://cgit.FreeBSD.org/src/commit/?id=2126cab4a454655042858bf4b382e426e6dc5081 commit 2126cab4a454655042858bf4b382e426e6dc5081 Author: Faraz Vahedi AuthorDate: 2026-05-17 20:39:18 +0000 Commit: Robert Clausecker CommitDate: 2026-06-29 08:23:02 +0000 libc: Add C23 feature test macro Signed-off-by: Faraz Vahedi Reviewed by: fuz MFC after: 1 month Pull Request: https://github.com/freebsd/freebsd-src/pull/2203 (cherry picked from commit 0fe73dcf7c3260260afd95c3d1cfe846feb1df7c) --- include/assert.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/include/assert.h b/include/assert.h index 159efacfa45b..75d3e62e8932 100644 --- a/include/assert.h +++ b/include/assert.h @@ -88,8 +88,8 @@ #endif /* __BSD_VISIBLE */ #endif /* NDEBUG */ -#ifndef _ASSERT_H_ -#define _ASSERT_H_ +#ifndef __STDC_VERSION_ASSERT_H__ +#define __STDC_VERSION_ASSERT_H__ 202311L /* * Static assertions. In principle we could define static_assert for @@ -112,4 +112,4 @@ __BEGIN_DECLS void __assert(const char *, const char *, int, const char *) __dead2; __END_DECLS -#endif /* !_ASSERT_H_ */ +#endif /* !__STDC_VERSION_ASSERT_H__ */ From nobody Mon Jun 29 10:11:21 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gphrV6rThz6kN82 for ; Mon, 29 Jun 2026 10:11:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gphrV1WKnz3c2q for ; Mon, 29 Jun 2026 10:11:22 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727882; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=f3W0WINkxW5zfbEQYMbZHFH9w1Ky5RZWvrJ5+CmZHzA=; b=k285hXxFzc5BVask8Nb7z6ErBTg+A43ESL8rZ2wbgkyKFWyyduSOdZECFpKdAXZ7cMDdr6 Kj0ieigLcsrOvEQkD3YLUR+2GnkpTUsHMbEBUYOz3kgsD4eUo4b/ME7bs0FbwmR8lI3Neh q5j/k1PaayfAnzj43JbcoadibAs2bEMbaaqBPUTaA/7T8UBxZcFLg7ek8sxlOZqLXnbg47 ZTrwIK2vqavKOEBLjSc2W3gUHvuYurAPKNT7nQ/FBy2vn348vLGmSmtGKxEpA8QeNyfj7T SB+2mJjOhRogsGWcbbTBMww3mkIJH2fJAJCWqwBDKGpFa/MfUr5cuIX2QrGQqA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782727882; a=rsa-sha256; cv=none; b=yJhUGz3CkFjqk5fAWEMxnL+IIYDMs3jeCsmLVmoeLXCvmuQizb+06XzUkROGu6ZVoUtH/J c+EQbjYJdBjZzSZ3V1wBHr9sPSCdE6WS6HD8VTxkAzqx+TD3+qwIkHZgctp+A2QTr0/aS3 Z56+fPhcUEytn25uhYJF1Nnxd23NiRashpVWuCtwyxNpsOCYdsC5mN6gHmCisnpYuPL8tE 7Ln2Jl6hswPV1DLqdZr/0WgIu1ndXUaAu+adZJybweN3oLv0KvqF1pjlqouZPIlh6TpswF MKlbG21fi6u0BEQVsuIanIlhWuF66exFhWVUIesrlNgg31ZF/2gIwMZt97Xstw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782727882; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=f3W0WINkxW5zfbEQYMbZHFH9w1Ky5RZWvrJ5+CmZHzA=; b=utYxAjShqvF7Br1nHt9fhpXTPz1m4vunqDauMs3CH1peSOXRxur5PTBtb1jG1DbKWZVD5c CYskDUTOSbBhBhy+VYd2jxqIdC7LCNwJCIxKEPgyTeFjVDlgI0liNzIS6HnrQ/QyEsYRMG eCgbq4I15bVqIv7ttjVagkQnekRJqtD2Rs9AMWmgblyEPdhFg9PxwiVCNIjAShnQLBqIda pGq1NKwROSBmvruDlnbH3xQJleOwoSay+tvbaqMO/dk/Mlj4gmX/ikcEYFwnc08JQsE3cL AUDZ8gjug/phqOrfbQZr5tzfYSoAjp66Dsg1vvUPK92bZ79hHGfVzEtS1v05ng== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gphrT5j80zss4 for ; Mon, 29 Jun 2026 10:11:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3708f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 10:11:21 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Faraz Vahedi From: Robert Clausecker Subject: git: f57a6d5d888e - stable/15 - assert.3: Update as per C23 List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fuz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: f57a6d5d888e6f8ef1b38232a36bfa6b66470be4 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 10:11:21 +0000 Message-Id: <6a4244c9.3708f.2072f99d@gitrepo.freebsd.org> The branch stable/15 has been updated by fuz: URL: https://cgit.FreeBSD.org/src/commit/?id=f57a6d5d888e6f8ef1b38232a36bfa6b66470be4 commit f57a6d5d888e6f8ef1b38232a36bfa6b66470be4 Author: Faraz Vahedi AuthorDate: 2026-05-20 07:22:19 +0000 Commit: Robert Clausecker CommitDate: 2026-06-29 08:23:02 +0000 assert.3: Update as per C23 Signed-off-by: Faraz Vahedi Reviewed by: fuz MFC after: 1 month Pull Request: https://github.com/freebsd/freebsd-src/pull/2203 (cherry picked from commit c115aad996d52f5270ccd22b27d1f34b4f0f4160) --- share/man/man3/assert.3 | 76 +++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 61 insertions(+), 15 deletions(-) diff --git a/share/man/man3/assert.3 b/share/man/man3/assert.3 index f219aa1d6743..2782ffe7de18 100644 --- a/share/man/man3/assert.3 +++ b/share/man/man3/assert.3 @@ -25,7 +25,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd April 20, 2021 +.Dd May 17, 2026 .Dt ASSERT 3 .Os .Sh NAME @@ -40,15 +40,14 @@ .Sh DESCRIPTION The .Fn assert -macro tests the given -.Ar expression +macro tests the given scalar +.Ar expression , and if it is false, -the calling process is terminated. -A diagnostic message is written to +a diagnostic message is written to .Dv stderr and the function .Xr abort 3 -is called, effectively terminating the program. +is called, effectively terminating the calling process. .Pp If .Ar expression @@ -57,6 +56,22 @@ the .Fn assert macro does nothing. .Pp +In all compilation modes, +.Fn assert +is defined as a macro with an ellipsis parameter, consistent with the +C23 standard. +This allows expressions containing commas to be passed directly without +requiring an extra pair of enclosing parentheses. +Only a single scalar expression is evaluated. +Supplying multiple arguments is prohibited, and hence are top-level comma +operators. +In particular, this guards against accidentally writing +.Fn assert +in the style of +.Fn static_assert , +which would otherwise silently evaluate as always true via the comma +operator. +.Pp The .Fn assert macro @@ -73,7 +88,7 @@ may be included multiple times. Each time whether or not .Dv NDEBUG is defined determines the behavior of assert from that point forward -until the end of the unit or another include of +until the end of the unit or another inclusion of .In assert.h . .Pp The @@ -82,9 +97,9 @@ macro should only be used for ensuring the developer's expectations hold true. It is not appropriate for regular run-time error detection. .Pp -The +In pre-C23 compilation modes .Fn static_assert -macro expands to +is implemented as a macro and expands to .Fn _Static_assert , and, contrarily to .Fn assert , @@ -94,8 +109,14 @@ message including the string literal message, if provided. The initial form of the .Fn _Static_assert containing a string literal message was introduced in C11 standard, and -the other form with no string literal is to be implemented by C2x and -some compilers may lack its adoption at present. +the other form with no string literal conforms to C23 standard. +.Pp +In C23 and later, +.Fn static_assert +is a language keyword, and +.Fn _Static_assert +is provided as an obsolescent alternative spelling that should not be +used for new code and development. .Sh EXAMPLES The assertion: .Dl "assert(1 == 0);" @@ -111,7 +132,20 @@ Second, the code will disappear if .Dv NDEBUG is defined, changing the semantics of the program. .Pp -The following asserts that the size of the S structure is 16. +The following example asserts that the +.Va iov_len +member of the compound literal, reflecting the value of +.Va len , +is non-zero. +The compound literal contains a comma that is not protected by +parentheses, which the variadic +.Fn assert +macro handles transparently: +.Dl assert((struct iovec){ buf, len }.iov_len); +.Pp +The following asserts that the size of the +.Vt S +structure is 16. Otherwise, it produces a diagnostic message which points at the constraint and includes the provided string literal: .Dl "static_assert(sizeof(struct S) == 16, ""size mismatch"");" @@ -123,14 +157,26 @@ If none is provided, it only points at the constraint. The .Fn assert macro conforms to -.St -isoC-99 . +.St -isoC-2023 . .Pp The .Fn static_assert macro conforms to .St -isoC-2011 . +In +.St -isoC-2023 , +it is a language keyword; whether the macro is defined or not +depends on compilation mode. .Sh HISTORY -An +The .Nm -macro appeared in +macro first appeared in .At v7 . +Starting with +.Fx 15.2 , +it accepts a variadic argument list, allowing expressions +containing commas, such as compound literals, to be passed +without requiring extra enclosing parentheses. +This conforms to +.St -isoC-2023 , +but made available in all compilation modes. From nobody Mon Jun 29 19:25:34 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx7z3Fhpz6jjNK for ; Mon, 29 Jun 2026 19:25:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx7y6CRxz3ypS for ; Mon, 29 Jun 2026 19:25:34 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761134; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Zf3gwQqAsLCZlgonyy6rriuP+8hBpuCDK83vN8j11IQ=; b=pDw28E9sdM6NdvhE/P7a2Nu0IhDwr8w2VITYhCKWz6nLX1R3CsXlStZ0+lJ/8vpW4EP4I4 73I6EOAV3LWWQ6f5kwTTiCeoqaXZEYVaR+8Hv1NH1fJbUPecWrfCed8uD4qU21e9wk0LG0 jG177lDFzIJMZvjGHXnoi2P2YTxIgPH82+Rke/P605snQJ10NBbkp71Rhok3vPE99qSthw ZLz8MVHpHYSWQM2jeUn6m6CKOXj0H8B0LQD3CpcBcAKtFw8cWDxFd393ClN+c+so8Gbfoa IBUbzBHTpDAAMkdkVRlSg9fpiqcGOCDGZxTTqICvy6ItIlh2VZdh2wEdF7uHkQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761134; a=rsa-sha256; cv=none; b=okCD3xUCHSS0q1OWUGCz8J8+9Ym/UqPGhEgk0T5X2IFqAisD744DRahT6wB8tftpcBglaF LuMfuYFEJ1Wy40sdoR+D/X9vlsEovyOcSmcuIF1FYdtiVU9vogxq08LbGYSi7dQ5PVt2cz DuUONTGjDmeKBPLUaYdLIYox2WGk1cDUhgvW8nHgeYs166wVshla84jAK97TofeH70VbCu OLzonFQoXGaYjVB3w9jJLD2hhiyCSpajLBdM9r3ajXfYPYc5KGGoanflTO0XucheNbldv1 YSip6P337tMfBMZ/mc9RHKLKRl/hlVbV/gu2qAm6G5oUHrLHkGV29tOhvpMkNg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761134; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Zf3gwQqAsLCZlgonyy6rriuP+8hBpuCDK83vN8j11IQ=; b=JX5urZEnTX4JI7+klq7hP4dxcUOnGzc63vCTqNrCu17ehGf/Ub5tD1NRIUUwnJjz4m2z4z s6umdvfhPPXwLmBTRS2XHkp430/2YaHn1aKXCzWwBM1l1tIlGY//SwWqRI9KJ/zaeELZ1I frDuD4OguwvyRmxFY6EhkF9PgSqGpNi2kTjlXLP1lhksSVRDO7A4BwakM+jVdFX5XU5LIW ELEjAXq0EfYHkgiuVILAzlg+/ZwozykCsbuPVgvi17QZvM6cR861Z1Dt63Ek3/ZPeRVB2o C3GvVecZCfHDpbWAbuUe9AOoaqrXuOrFIJJjpsP2+MJJoT/HxnnzUOmPs+MOPg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx7y5B4Mz19Kw for ; Mon, 29 Jun 2026 19:25:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22a95 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 0ced25378ba9 - stable/15 - MAC/do: Make it style(9) compliant again List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 0ced25378ba98c597c5c7bf2f6411dbd3198351f Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:34 +0000 Message-Id: <6a42c6ae.22a95.669daea8@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=0ced25378ba98c597c5c7bf2f6411dbd3198351f commit 0ced25378ba98c597c5c7bf2f6411dbd3198351f Author: Olivier Certner AuthorDate: 2026-03-23 11:45:17 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:37 +0000 MAC/do: Make it style(9) compliant again Fix too long lines, declarations not at head of block, improper indentation and superfluous whitespace coming from the previous commit introducing the configurable executable paths feature. While here, fix some older improper comment formatting. Reviewed by: bapt Fixes: 6c3def74e2de ("MAC/do: Support multiple users and groups as single rule's targets") Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit f93cd891aefd839da869dcdb450d00050d5e701e) --- sys/security/mac_do/mac_do.c | 166 +++++++++++++++++++++++++------------------ 1 file changed, 96 insertions(+), 70 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index c24e14d7937b..c9fb7fc8774b 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -129,11 +129,15 @@ typedef uint16_t flags_t; #define MDF_MAY_REJ_SUPP (1u << 11) /* (t,gid) Some explicit ID (not MDF_CURRENT) has MDF_SUPP_MUST. */ #define MDF_EXPLICIT_SUPP_MUST (1u << 12) -/* (t,gid) Whether any target clause is about primary groups. Used during - * parsing only. */ +/* + * (t,gid) Whether any target clause is about primary groups. Used during + * parsing only. + */ #define MDF_HAS_PRIMARY_CLAUSE (1u << 13) -/* (t,gid) Whether any target clause is about supplementary groups. Used during - * parsing only. */ +/* + * (t,gid) Whether any target clause is about supplementary groups. Used during + * parsing only. + */ #define MDF_HAS_SUPP_CLAUSE (1u << 14) #define MDF_TYPE_GID_MASK (MDF_ANY_SUPP | MDF_MAY_REJ_SUPP | \ MDF_EXPLICIT_SUPP_MUST | MDF_HAS_PRIMARY_CLAUSE | MDF_HAS_SUPP_CLAUSE) @@ -238,7 +242,7 @@ check_type_and_id_flags(const id_type_t type, const flags_t flags) } break; default: - __assert_unreachable(); + __assert_unreachable(); } return; @@ -361,7 +365,8 @@ init_exec_paths(struct exec_paths *const exec_paths) static struct conf * alloc_conf(void) { - struct conf *const conf = malloc(sizeof(*conf), M_MAC_DO, M_WAITOK | M_ZERO); + struct conf *const conf = malloc(sizeof(*conf), M_MAC_DO, M_WAITOK | + M_ZERO); init_rules(&conf->rules); init_exec_paths(&conf->exec_paths); @@ -465,7 +470,8 @@ static void make_parse_error(struct parse_error **const parse_error, const size_t pos, const char *const fmt, ...) { - struct parse_error *const err = malloc(sizeof(*err), M_MAC_DO, M_WAITOK); + struct parse_error *const err = malloc(sizeof(*err), M_MAC_DO, + M_WAITOK); va_list ap; err->pos = pos; @@ -1081,7 +1087,7 @@ out: static int parse_exec_paths(const char *const string, struct exec_paths *const exec_paths, - struct parse_error **const parse_error) + struct parse_error **const parse_error) { const size_t len = strlen(string); char *copy, *p, *path; @@ -1091,8 +1097,8 @@ parse_exec_paths(const char *const string, struct exec_paths *const exec_paths, if (len >= EXEC_PATHS_MAXLEN) { make_parse_error(parse_error, 0, - "Exec path specification string is too long (%zu, max %u)", - len, EXEC_PATHS_MAXLEN - 1); + "Exec path specification string is too long (%zu, max %u)", + len, EXEC_PATHS_MAXLEN - 1); return (ENAMETOOLONG); } @@ -1105,26 +1111,30 @@ parse_exec_paths(const char *const string, struct exec_paths *const exec_paths, p = copy; while ((path = strsep_noblanks(&p, ":")) != NULL) { + size_t path_len; + if (*path == '\0') continue; if (exec_paths->exec_path_count >= MAX_EXEC_PATHS) { make_parse_error(parse_error, path - copy, - "Too many exec paths specified (max %d)", MAX_EXEC_PATHS); + "Too many exec paths specified (max %d)", + MAX_EXEC_PATHS); error = EINVAL; goto out; } - const size_t path_len = strlen(path); + path_len = strlen(path); if (path_len >= PATH_MAX) { make_parse_error(parse_error, path - copy, - "Exec paths too long (%zu, max %u)", - path_len, PATH_MAX - 1); + "Exec paths too long (%zu, max %u)", + path_len, PATH_MAX - 1); error = ENAMETOOLONG; goto out; } - strlcpy(exec_paths->exec_paths[exec_paths->exec_path_count], path, PATH_MAX); + strlcpy(exec_paths->exec_paths[exec_paths->exec_path_count], + path, PATH_MAX); exec_paths->exec_path_count++; } @@ -1289,7 +1299,8 @@ set_default_conf(struct prison *const pr) { struct conf *const conf = alloc_conf(); - strlcpy(conf->exec_paths.exec_paths_str, "/usr/bin/mdo", EXEC_PATHS_MAXLEN); + strlcpy(conf->exec_paths.exec_paths_str, "/usr/bin/mdo", + EXEC_PATHS_MAXLEN); strlcpy(conf->exec_paths.exec_paths[0], "/usr/bin/mdo", PATH_MAX); conf->exec_paths.exec_path_count = 1; @@ -1312,19 +1323,20 @@ clone_rules(struct rules *dst, struct rules *const src) STAILQ_INIT(&dst->head); STAILQ_FOREACH(src_rule, &src->head, r_entries) { - dst_rule = malloc(sizeof(*dst_rule), M_MAC_DO, M_WAITOK | M_ZERO); + dst_rule = malloc(sizeof(*dst_rule), M_MAC_DO, M_WAITOK | + M_ZERO); bcopy(src_rule, dst_rule, sizeof(*dst_rule)); if (src_rule->uids_nb > 0) { - dst_rule->uids = malloc(sizeof(*dst_rule->uids) * src_rule->uids_nb, - M_MAC_DO, M_WAITOK); + dst_rule->uids = malloc(sizeof(*dst_rule->uids) * + src_rule->uids_nb, M_MAC_DO, M_WAITOK); bcopy(src_rule->uids, dst_rule->uids, sizeof(*dst_rule->uids) * src_rule->uids_nb); } if (src_rule->gids_nb > 0) { - dst_rule->gids = malloc(sizeof(*dst_rule->gids) * src_rule->gids_nb, - M_MAC_DO, M_WAITOK); + dst_rule->gids = malloc(sizeof(*dst_rule->gids) * + src_rule->gids_nb, M_MAC_DO, M_WAITOK); bcopy(src_rule->gids, dst_rule->gids, sizeof(*dst_rule->gids) * src_rule->gids_nb); } @@ -1338,18 +1350,17 @@ clone_exec_paths(struct exec_paths *dst, struct exec_paths *const src) { bzero(dst, sizeof(*dst)); dst->exec_path_count = src->exec_path_count; - for (int i = 0; i < src->exec_path_count; i++) { + for (int i = 0; i < src->exec_path_count; i++) strlcpy(dst->exec_paths[i], src->exec_paths[i], - sizeof(dst->exec_paths[i])); - } + sizeof(dst->exec_paths[i])); strlcpy(dst->exec_paths_str, src->exec_paths_str, - sizeof(dst->exec_paths_str)); + sizeof(dst->exec_paths_str)); } -static int -parse_and_set_conf(struct prison *pr, const char *rules_string, - const char *exec_paths_string, struct parse_error **parse_error) +static int +parse_and_set_conf(struct prison *pr, const char *rules_string, + const char *exec_paths_string, struct parse_error **parse_error) { struct prison *ppr = NULL; struct conf *applicable_conf = NULL; @@ -1360,7 +1371,7 @@ parse_and_set_conf(struct prison *pr, const char *rules_string, *parse_error = NULL; need_applicable_conf = (rules_string == NULL || rules_string[0] == '\0' || - exec_paths_string == NULL || exec_paths_string[0] == '\0'); + exec_paths_string == NULL || exec_paths_string[0] == '\0'); if (need_applicable_conf) { applicable_conf = find_conf(pr, &ppr); @@ -1379,11 +1390,13 @@ parse_and_set_conf(struct prison *pr, const char *rules_string, clone_rules(&conf->rules, &applicable_conf->rules); if (exec_paths_string != NULL && exec_paths_string[0] != '\0') { - error = parse_exec_paths(exec_paths_string, &conf->exec_paths, parse_error); + error = parse_exec_paths(exec_paths_string, &conf->exec_paths, + parse_error); if (error != 0) goto out; } else if (applicable_conf != NULL) - clone_exec_paths(&conf->exec_paths, &applicable_conf->exec_paths); + clone_exec_paths(&conf->exec_paths, + &applicable_conf->exec_paths); set_conf(pr, conf); @@ -1470,12 +1483,12 @@ out: } SYSCTL_PROC(_security_mac_do, OID_AUTO, exec_paths, - CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_PRISON | CTLFLAG_MPSAFE, - 0, 0, mac_do_sysctl_exec_paths, "A", - "Colon-separated list of allowed executables"); + CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_PRISON | CTLFLAG_MPSAFE, + 0, 0, mac_do_sysctl_exec_paths, "A", + "Colon-separated list of allowed executables"); -SYSCTL_JAIL_PARAM_STRING(_mac_do, exec_paths, CTLFLAG_RW, EXEC_PATHS_MAXLEN, - "Jail MAC/do executable paths"); +SYSCTL_JAIL_PARAM_STRING(_mac_do, exec_paths, CTLFLAG_RW, EXEC_PATHS_MAXLEN, + "Jail MAC/do executable paths"); static int mac_do_jail_create(void *obj, void *data) @@ -1512,7 +1525,8 @@ mac_do_jail_get(void *obj, void *data) if (error != 0 && error != ENOENT) goto done; - error = vfs_setopts(opts, "mac.do.exec_paths", exec_paths->exec_paths_str); + error = vfs_setopts(opts, "mac.do.exec_paths", + exec_paths->exec_paths_str); if (error != 0 && error != ENOENT) goto done; @@ -1533,7 +1547,6 @@ _Static_assert(-1 != JAIL_SYS_DISABLE && -1 != JAIL_SYS_NEW && * We perform only cheap checks here, i.e., we do not really parse the rules * specification string, if any. */ - static int mac_do_jail_check(void *obj, void *data) { @@ -1560,14 +1573,17 @@ mac_do_jail_check(void *obj, void *data) * jail_set() calls vfs_getopts() itself later (they becoming * inconsistent wouldn't cause any security problem). */ - error = vfs_getopt(opts, "mac.do.rules", (void **)&rules_string, &rules_len); + + error = vfs_getopt(opts, "mac.do.rules", (void **)&rules_string, + &rules_len); if (error == ENOENT) rules_string = NULL; else { if (error != 0) return (error); if (rules_len == 0 || rules_string[rules_len - 1] != '\0') { - vfs_opterror(opts, "'mac.do.rules' not a proper string"); + vfs_opterror(opts, + "'mac.do.rules' not a proper string"); return (EINVAL); } if (rules_len > MAC_RULE_STRING_LEN) { @@ -1577,14 +1593,17 @@ mac_do_jail_check(void *obj, void *data) } /* Handle 'exec_paths' input */ - error = vfs_getopt(opts, "mac.do.exec_paths", (void **)&exec_paths_string, &exec_paths_len); + error = vfs_getopt(opts, "mac.do.exec_paths", + (void **)&exec_paths_string, &exec_paths_len); if (error == ENOENT) exec_paths_string = NULL; else { if (error != 0) return (error); - if (exec_paths_len == 0 || exec_paths_string[exec_paths_len - 1] != '\0') { - vfs_opterror(opts, "'mac.do.exec_paths' not a proper string"); + if (exec_paths_len == 0 || + exec_paths_string[exec_paths_len - 1] != '\0') { + vfs_opterror(opts, + "'mac.do.exec_paths' not a proper string"); return (EINVAL); } if (exec_paths_len > EXEC_PATHS_MAXLEN) { @@ -1594,12 +1613,13 @@ mac_do_jail_check(void *obj, void *data) } /* - * Be liberal, considering that an empty rule or exec paths specification - * is equivalent to no specification. - * This affects the JAIL_SYS_DISABLE and JAIL_SYS_INHERIT sanity checks below. + * Be liberal, considering that an empty rule or exec paths + * specification is equivalent to no specification. This affects the + * JAIL_SYS_DISABLE and JAIL_SYS_INHERIT sanity checks below. */ - has_rules = rules_string && rules_string[0] != '\0'; - has_exec_paths = exec_paths_string && exec_paths_string[0] != '\0'; + has_rules = rules_string != NULL && rules_string[0] != '\0'; + has_exec_paths = exec_paths_string != NULL && + exec_paths_string[0] != '\0'; /* Infer 'jsys' if needed */ if (jsys == -1) { @@ -1614,18 +1634,23 @@ mac_do_jail_check(void *obj, void *data) case JAIL_SYS_DISABLE: case JAIL_SYS_INHERIT: if (has_rules) { - vfs_opterror(opts, "'mac.do.rules' specified but should not be when mac.do is disabled or inherited"); + vfs_opterror(opts, + "'mac.do.rules' specified but should not be when " + "'mac.do' is 'disabled' or 'inherited'"); return (EINVAL); } if (has_exec_paths) { - vfs_opterror(opts, "'mac.do.exec_paths' specified but should not be when mac.do is disabled or inherited"); + vfs_opterror(opts, + "'mac.do.exec_paths' specified but should not be " + "when 'mac.do' is 'disabled' or 'inherited'"); return (EINVAL); } break; case JAIL_SYS_NEW: if (!has_rules && !has_exec_paths) { - vfs_opterror(opts, "mac.do set to 'new' but neither rules nor exec_paths specified"); + vfs_opterror(opts, "'mac.do' set to 'new' but neither " + "rules nor executable paths specified"); return (EINVAL); } /* Allow: rules only, exec_paths only (though exec_paths only is discouraged), or both */ @@ -1663,8 +1688,9 @@ mac_do_jail_set(void *obj, void *data) exec_paths_string = vfs_getopts(opts, "mac.do.exec_paths", &error); MPASS(error == 0 || error == ENOENT); - has_rules = (rules_string != NULL && rules_string[0] != '\0'); - has_exec_paths = (exec_paths_string != NULL && exec_paths_string[0] != '\0'); + has_rules = rules_string != NULL && rules_string[0] != '\0'; + has_exec_paths = exec_paths_string != NULL && + exec_paths_string[0] != '\0'; if (jsys == -1) { if (has_rules || has_exec_paths) @@ -1685,14 +1711,15 @@ mac_do_jail_set(void *obj, void *data) case JAIL_SYS_NEW: error = parse_and_set_conf(pr, - has_rules ? rules_string : NULL, - has_exec_paths ? exec_paths_string : NULL, - &parse_error); + has_rules ? rules_string : NULL, + has_exec_paths ? exec_paths_string : NULL, + &parse_error); if (error != 0) { if (parse_error != NULL) { - vfs_opterror(opts, "MAC/do: Parse error at index %zu: %s\n", - parse_error->pos, parse_error->msg); + vfs_opterror(opts, + "MAC/do: Parse error at index %zu: %s\n", + parse_error->pos, parse_error->msg); free_parse_error(parse_error); } @@ -1739,8 +1766,8 @@ struct mac_do_data_header { * indicates this header is uninitialized. */ int priv; - /* Rules to apply. */ - struct conf *conf; + /* The configuration that applies. */ + struct conf *conf; }; /* @@ -2235,7 +2262,11 @@ static int check_proc(void) { char *path, *to_free; - int error = EPERM; + struct conf *conf; + struct exec_paths *exec_paths; + struct prison *td_pr; + struct prison *pr; + int error; /* * Only grant privileges if requested by the right executable. @@ -2258,22 +2289,17 @@ check_proc(void) if (vn_fullpath_jail(curproc->p_textvp, &path, &to_free) != 0) return (EPERM); - struct conf *conf; - struct exec_paths *exec_paths; - struct prison *td_pr = curproc->p_ucred->cr_prison; - struct prison *pr; + error = EPERM; + td_pr = curproc->p_ucred->cr_prison; conf = find_conf(td_pr, &pr); exec_paths = &conf->exec_paths; - if (exec_paths->exec_path_count > 0) { - for (int i = 0; i < exec_paths->exec_path_count; i++) { + if (exec_paths->exec_path_count > 0) + for (int i = 0; i < exec_paths->exec_path_count; i++) if (strcmp(exec_paths->exec_paths[i], path) == 0) { error = 0; break; } - } - - } prison_unlock(pr); From nobody Mon Jun 29 19:25:35 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx801fzvz6jjQW for ; Mon, 29 Jun 2026 19:25:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx7z67WMz3ytd for ; Mon, 29 Jun 2026 19:25:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761135; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ErgxTerFa3JI08EvH93uTvtaA3javZSA4Lae1t3u/mw=; b=D27+sFO+7otXJknfIN4s2Q+W/O2Ql/SHCdiKUaHqpSGSPb5UTPhZRwagli6NL9kIv/qVqG xWbbWUuUdqhNIbNr6qaDWVTz8aetgwGiEuZ6nZlwBAfP7I1rRioMfdtMSSYgVlfGQQE81F iYohyt2zEUiduE3A+5PkPpLUhW0FmfhyUivIpJPpvygpaAn1MPh2qlTwPTBy/LT7dQxZbW wicS0BOjjnyj4RbLFCJ/3ETG8bZeqSTdc8BUrhyqrdgMhA/E/D2ddiN5zPR9IRD/M8n0jT 1XoxyuHIK9O+IO0hvDSfJifQFvmYw0Fc0QsyJ2etr5+S8sy8C1XQkc0EWyvXmg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761135; a=rsa-sha256; cv=none; b=lFhsM+cQr8q1DG0yG7nmVx9o478E9CwKM7twUqZ5DJTjJVNbUb4lZWuy0IsSHRB5rIai+t Ax/ZbtSsAuB2eEOAoxGrWwgbfsMXpmWuTeyUPEkllMDCdCWZmQOltoJ3Hf2LSNw33bpkqw kcPb6M11MoUBhkYmtHXXTmDpULOie+J7QP5vf2clB/VB45Z90YF7K+7c4reAJpJqn/h1gV VGy//buvXXaVM50ngdsHM2x3QxHC8/4tYCyu04F7FITHhTH+XAu49JTVZstEQBd+BdN8St Vi5jBe+LhJ69SGLMC/WlXYRCe5TRM7xkaUlHqapyoaATWhQ9idabTh5AOCUCBg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761135; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ErgxTerFa3JI08EvH93uTvtaA3javZSA4Lae1t3u/mw=; b=pGuElnlUDOCT9kOMbGEb5SSUw48QNNGxK+c/eePYSeuOxWLhco/2i/QMhSHkGscY13Ndu9 bSF4AZWrRrx/zYYMGixKdU7XgVLeaYOmiEyhNPR3WLKyXMOT364UkLnKzsdXKoc/raNl03 gZ3fMOk1mBOEK7pX9gcWLfl/nCuDU9Y2g1WXI0BPS3m/6BsPp/asWZKpRIHFdGiYB+0se+ WC6ZafJFF1rn2Y6+aIw5qXdlo8ebLezHHsvgrR3IYJGHrsweLG/Jn9jWTeMGcieU4rnjRs 6qOS2Wf8dZzAzr0ly80qVkzbE1P3ZCKXqZpEuxxtnn0aWB6LD4ArO3vv/rV7Rg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx7z5Bn3z19cW for ; Mon, 29 Jun 2026 19:25:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21a21 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:35 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: a946f6630b2c - stable/15 - MAC/do: Fix recently-introduced comments List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a946f6630b2cbf6844476257539ed66e2cb24012 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:35 +0000 Message-Id: <6a42c6af.21a21.2fb3a3ea@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=a946f6630b2cbf6844476257539ed66e2cb24012 commit a946f6630b2cbf6844476257539ed66e2cb24012 Author: Olivier Certner AuthorDate: 2026-03-23 13:13:22 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:38 +0000 MAC/do: Fix recently-introduced comments Reviewed by: bapt Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 7825338824415153fe29bec30c1d5c1e5fcb638b) --- sys/security/mac_do/mac_do.c | 39 +++++++++++++++++++++++++-------------- 1 file changed, 25 insertions(+), 14 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index c9fb7fc8774b..95c7007b6a8a 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -346,7 +346,7 @@ toast_rules(struct rules *const rules) } } -/* Assuming storage is zeroed already */ +/* Assumes storage has been zeroed. */ static void init_rules(struct rules *const rules) { @@ -1150,12 +1150,13 @@ out: } /* - * Find conf applicable to the passed prison. + * Find configuration applicable to the passed prison. * - * Returns the applicable conf (and never NULL). 'pr' must be unlocked. - * 'aprp' is set to the (ancestor) prison holding these, and it must be unlocked - * once the caller is done accessing the conf. '*aprp' is equal to 'pr' if and - * only if the current jail has its own set of conf. + * Returns the applicable configuration (and never NULL). 'pr' must be + * unlocked. 'aprp' is set to the (ancestor) prison holding these, and it must + * be unlocked once the caller is done accessing the configuration. '*aprp' is + * equal to 'pr' if and only if the current jail has its own specific + * configuration. */ static struct conf * find_conf(struct prison *const pr, struct prison **const aprp) @@ -1274,6 +1275,9 @@ remove_conf(struct prison *const pr) drop_conf(old_conf); } +/* + * Assign an already-built configuration to a jail. + */ static void set_conf(struct prison *const pr, struct conf *const conf) { @@ -1292,7 +1296,7 @@ set_conf(struct prison *const pr, struct conf *const conf) } /* - * Assigns default conf to a jail. + * Assigns the default configuration to a jail. */ static void set_default_conf(struct prison *const pr) @@ -1555,9 +1559,12 @@ mac_do_jail_check(void *obj, void *data) int error, jsys, rules_len = 0, exec_paths_len = 0; bool has_rules, has_exec_paths; - /* Mark unspecified */ error = vfs_copyopt(opts, "mac.do", &jsys, sizeof(jsys)); if (error == ENOENT) + /* + * Mark unspecified. Will fill it up below depending on the + * other options. + */ jsys = -1; else { if (error != 0) @@ -1568,12 +1575,13 @@ mac_do_jail_check(void *obj, void *data) } /* - * We use vfs_getopt() here instead of vfs_getopts() to get the length. + * We use vfs_getopt() below instead of vfs_getopts() to get the length. * We perform the additional checks done by the latter here, even if * jail_set() calls vfs_getopts() itself later (they becoming * inconsistent wouldn't cause any security problem). */ + /* Rules. */ error = vfs_getopt(opts, "mac.do.rules", (void **)&rules_string, &rules_len); if (error == ENOENT) @@ -1592,7 +1600,7 @@ mac_do_jail_check(void *obj, void *data) } } - /* Handle 'exec_paths' input */ + /* Executable paths. */ error = vfs_getopt(opts, "mac.do.exec_paths", (void **)&exec_paths_string, &exec_paths_len); if (error == ENOENT) @@ -1613,7 +1621,7 @@ mac_do_jail_check(void *obj, void *data) } /* - * Be liberal, considering that an empty rule or exec paths + * Be liberal, considering that an empty rule or execution paths * specification is equivalent to no specification. This affects the * JAIL_SYS_DISABLE and JAIL_SYS_INHERIT sanity checks below. */ @@ -1621,15 +1629,19 @@ mac_do_jail_check(void *obj, void *data) has_exec_paths = exec_paths_string != NULL && exec_paths_string[0] != '\0'; - /* Infer 'jsys' if needed */ + /* If not specified, infer 'jsys' from passed options. */ if (jsys == -1) { + /* + * Default in absence of "mac.do.rules" and "mac.do.exec_paths" + * is to disable (and, in particular, not inherit). + */ if (has_rules || has_exec_paths) jsys = JAIL_SYS_NEW; else jsys = JAIL_SYS_DISABLE; } - /* Final checks based on resolved 'jsys' */ + /* Final checks based on resolved 'jsys'. */ switch (jsys) { case JAIL_SYS_DISABLE: case JAIL_SYS_INHERIT: @@ -1653,7 +1665,6 @@ mac_do_jail_check(void *obj, void *data) "rules nor executable paths specified"); return (EINVAL); } - /* Allow: rules only, exec_paths only (though exec_paths only is discouraged), or both */ break; default: From nobody Mon Jun 29 19:25:36 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx811y5nz6jhsg for ; Mon, 29 Jun 2026 19:25:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8071dHz3yvH for ; Mon, 29 Jun 2026 19:25:36 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761137; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/NDx/c6qgSQmtCMPvUzxVvBTDY33XUnGoLPTC+lJs90=; b=xIzsrSx/nFwxK1KOX8fWhoyEcsGQ3o7uIIsHklFSv31oJQXX5cGrS0pZQKU5VLAmMnSWlX utRye7muD1DzGUozOxEYNu/KFGgJdmNWgZr4vfzm96i4CYvTZYErkumdAmku/Slb3r6HqI 49PoOGGOFAs5lNEuebHDTIaRAYqxlCikmXyyPdw1lM3hbgZ88vlcniDkgMbtNHfQb81GZ7 m4hFfxT3BNLl0SvCHWq1ZqRx2ELBBa8u0RGEn1RJePwJ9kEJm6KX6q68aUjRm8L7GBQbxH p8e5jIqIlldcbCwXd/+1qBKxoEsZPZruvjeDFnHIUw95oWyVb72nYJGuCWdINA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761137; a=rsa-sha256; cv=none; b=lXXCXh2Msbiqhzs1OpUIGxMH88r4sgTxVEtgS6nPzUuoEBoK3Fg8IomW4K3Xui9B5V2R6z WNTglQexLwq1xh0LOVUaAc8m2LiHiWgYn+iJJk+1FYjZRPnkQ03YSOocZ0BGCrbw+D9aB2 Z7BOcfMVoPOd0q+ZWr8gkk2it4vCd1a2S3hPY7Twj5hXArCCeaXuMhbItkwh+NS0M7y9tx epzhLqVIIX9JsSZpL5RliqexHfQoFi7b7dpyHIsJbrvBwHMq7hnLpd4PL2BfrTDEz0zmHi ZQERtHA1y/ElX4t8EeaanXhTa8v/cc5iOJV7rcxFXrLXwNlcbWi9WFtQlExEKw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761137; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/NDx/c6qgSQmtCMPvUzxVvBTDY33XUnGoLPTC+lJs90=; b=Sl5Mi+PAL672fnK0TgyWLkMHskkUzOqwg+5p5zFaWCsv67gt+v43CfEvbm/xq43OoPki/I NSDmKqLSRP39UwMeorNubK9K9dQuELFlrv3rBHD2VsJgxe0RMSl4S6NSDhqDehmQXISFY/ WZj4ykaTPxuW22Ud8/8RPxtIPjgk84lHXt6MVTBQ7t+DO4/6B//vo10rpCWFoXMmi76S7s rNDZhvPXt1bwBbSNVa2n2Bc/3WNShjNhnyMGBZzxvcvT2LmszkPIGdlnzrx/oPZdBHoVh/ hk15NLBu62ljjzK0HFJ6j6ERvmWYmNJuSgae+7KVx4dQQX+eaIPLuWQpOgnmmw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx806089z198C for ; Mon, 29 Jun 2026 19:25:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 218b2 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:36 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: f99c921251ae - stable/15 - MAC/do: Expand "conf" to "configuration" in a panic message on INVARIANTS List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: f99c921251aef519ed8926d3512f968006fcb84c Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:36 +0000 Message-Id: <6a42c6b0.218b2.44f5d0fa@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=f99c921251aef519ed8926d3512f968006fcb84c commit f99c921251aef519ed8926d3512f968006fcb84c Author: Olivier Certner AuthorDate: 2026-03-23 14:42:07 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:38 +0000 MAC/do: Expand "conf" to "configuration" in a panic message on INVARIANTS No functional change. Reviewed by: bapt Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 22a0912bb1dc71f18d2e33ec9915a54a8324a3ff) --- sys/security/mac_do/mac_do.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 95c7007b6a8a..16f7d90f031b 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1203,8 +1203,8 @@ check_conf_use_count(const struct conf *const conf, u_int expected) const u_int use_count = refcount_load(&conf->use_count); if (use_count != expected) - panic("MAC/do: Conf at %p: Use count is %u, expected %u", - conf, use_count, expected); + panic("MAC/do: Configuration at %p: Use count is %u, " + "expected %u", conf, use_count, expected); } #else #define check_conf_use_count(...) From nobody Mon Jun 29 19:25:37 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx82307Lz6jhsk for ; Mon, 29 Jun 2026 19:25:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx820Sk1z3yv7 for ; Mon, 29 Jun 2026 19:25:38 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761138; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ccolXm546xLqJdAasJYoHXoon7p7Qpf31cIxpogcV7s=; b=Mn1A0qcwyc4ixOG0YasnUPAQPn4yQuB+C7L+mbTPiMqXWIGvYMXQvylmHMdzNHW+8Md7v/ OqSqYAQW71FXdmX08X/NbQ3xUalozTq0BlVqOLbDQpXw1oEX3ZOzxT7JGZM1KcN8lKGtp4 8qkg9lRXy7r5y0dxqO5YF5bVmKIbqYpeKK1NfrF8AjN2+QmRHGy74uaI5wNOwBlirn9b6W s+Nrhr+sqE16EEB3NhQOCrbCrf6IxRAg7BTY4J7CFLNm8RIjh0Clv+GcslL/GDzO/qpUF8 krwWuT79I2xmpJr68WGFUkrga3icerypU6wCASqh1TufPqTQrkZljWzuY2+vow== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761138; a=rsa-sha256; cv=none; b=NTx0flwLKZSKcq27tA4Ty3E+O4km48k8V3rO8p/eN6JGMgYxf0kyzVP8Y/SKX52bfVnz/c hDp/VPSaCST/n/POW46uHsomELQuLDadRSMO+1fgSOeu4phFNxIalMHUnrGUGqdIcmyq9e cls+gx/nPRmntub2R4+uq1F0Jr/vrd9qBPL89p811GLXwFv3Er5rOFLiU2VMhlThjBS7bV Pga2CiXSUN2q17Q9jAEX5kigqqf77BeTsEXzrK3cd9PRbFTCy6YEjhYDfKnFreTVaYG68G vzmnPwzSLeSeyV6CKBVc6bQArqdfo5BLjyXqfqcAeI/0emX3j66Lk4U0FJAyXw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761138; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ccolXm546xLqJdAasJYoHXoon7p7Qpf31cIxpogcV7s=; b=Mv+G/eiOkLk9+wTl1HCrouMOSE6ZpcNEKp/4vCQa0tjsEpMne4hDYMpouDRULGaJ0zbS2D CePPSan4hOnG++BiKPDyL+DWPczGHRLR7HMHWG/k+yisbz7AOnwN55fXNFYiKMuVnqc4EG /gnvDhFcG39NbU5egrEFurLLNKjf5NHkg8yZP2zSei4ZOOkzs/BZH7Y6pOJISJ2gQ/3Wp8 q0jOmVhD37xg4EpdRIBefddPyDs9/sWrqMqRqFFbMB+psPO1QzK2fFFN24zSjXWRTw1JMR QEbjbLBLngHBBGgJK3e7ECy7iQOfCFN4S58nJkfXZv9GwSEAYR0+ZbBCDFdTJQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx816LTmz19XV for ; Mon, 29 Jun 2026 19:25:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 2251f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:37 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 34980adcb4db - stable/15 - MAC/do: check_proc(): Remove a superfluous 'if' List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 34980adcb4db4a75448d4f3026827d8b32904f2f Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:37 +0000 Message-Id: <6a42c6b1.2251f.1d3cf38e@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=34980adcb4db4a75448d4f3026827d8b32904f2f commit 34980adcb4db4a75448d4f3026827d8b32904f2f Author: Olivier Certner AuthorDate: 2026-04-28 13:44:53 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:39 +0000 MAC/do: check_proc(): Remove a superfluous 'if' No functional change (intended). Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit d554b89f4096589d00abef584552eff0481418db) --- sys/security/mac_do/mac_do.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 16f7d90f031b..0e715d576a16 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -2305,12 +2305,11 @@ check_proc(void) conf = find_conf(td_pr, &pr); exec_paths = &conf->exec_paths; - if (exec_paths->exec_path_count > 0) - for (int i = 0; i < exec_paths->exec_path_count; i++) - if (strcmp(exec_paths->exec_paths[i], path) == 0) { - error = 0; - break; - } + for (int i = 0; i < exec_paths->exec_path_count; i++) + if (strcmp(exec_paths->exec_paths[i], path) == 0) { + error = 0; + break; + } prison_unlock(pr); From nobody Mon Jun 29 19:25:33 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx832x1lz6jjL5 for ; Mon, 29 Jun 2026 19:25:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx825Htsz3ytt for ; Mon, 29 Jun 2026 19:25:38 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761138; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DD2X/VcLXY/jlNTFXRLKAWoq4BjpChSqz8q3RXqtgs0=; b=qrTmo2NlGB5Y2ABDl1HlYkOAWEntU3N+wsG6f9t43+JtPE6J3/0sSssCj8ojxAepO3mk94 bpXeommoe5fTQZt4/TXrnFXQTNhRpfGIvkHc/wvnRpH15jpBITGwIx1/UPUiwNSuZDPGxV f7v2ToeC/TSfCImKlEqqr6HRFkCy9HbPbFQaHJMyPbJhhNCOV1CgYA4fiyURyuQDPLIScq ccNqJiLuLaHrOk4k2CDHj4B1HX4e6G8p6zCFdgGaU7RbnXvJT2fAkjZaWIDKawmdDJQBra byEB4m8Pz2qhaLgnUX4nHj8Kjur0fjK+qj8pS6V/MxNdmPWjILj3neYjj7LHxw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761138; a=rsa-sha256; cv=none; b=dWOJw4MzPlZyoe5RxrF20TROtHTOWxXfI9QajPTvc9YNcIW2d8SzIuxpbcVmApUIh4AVxl ZxI3c+km3zEvfyVT//sgnutVaK0DbRPYngovNVSGoT6xGA9HVUATjdNMEGx7+mwN9nzoHn ssAjzDy5gvOYee90+Gc1F9lZD/p/f2IxP+/CufzrG63PFTubsNAWJls0Gq6WPB8LmJulrh 5BxgDF0ZtCxlpiscBsG5FTejP2PqTMEcWD9OSPrg/PLdPlXxU4Klqe/msHxsQO8JySntK7 XTxhwr50GrAQYHtKku9460aLxLRdsgVaU7MGGCy8Nr5x7uF42Ftv7UkDA9zDWg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761138; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DD2X/VcLXY/jlNTFXRLKAWoq4BjpChSqz8q3RXqtgs0=; b=fWdAwVzoPDI/GBcttrUk6SkuPUjLhJgapkZJbPFFsxfTaq7vAGQtsrrA7IZ1MbymPU8t4F 7MFE9+Tuw05/4To0mnGmlka79tcph+tegyBZm1+6X0YYvUoCMkv2/uOY2VcJAALpifv7sK mkg0nVjFuTw92mrvlXuTyCh2L269hQMXsarUVKlq9FM8zVNHCzmSEYNmeicLhoktBmqCH2 zLZ7tQEUYL/splbwXDjlqmqtqLYzu+z5gKf4FFhHgFo6WSpo/+W4NVb0rJeKuRDFzbapmh wqhg8RORyY7qU336kVGT6PAEJuKzrJD4fva0SMkWF3A2tcxeFFb1vruNwQZREQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx7x4CW0z19cV for ; Mon, 29 Jun 2026 19:25:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1f8e3 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:33 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: a558fd9e531c - stable/15 - MAC/do: Update copyright List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a558fd9e531c34b1b75b5f9a6710d3e6b970c30e Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:33 +0000 Message-Id: <6a42c6ad.1f8e3.245db6fc@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=a558fd9e531c34b1b75b5f9a6710d3e6b970c30e commit a558fd9e531c34b1b75b5f9a6710d3e6b970c30e Author: Olivier Certner AuthorDate: 2026-05-20 11:41:07 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:36 +0000 MAC/do: Update copyright Add Kushagra to account for the commit adding the "executable paths" feature. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 3e17f37c2cd2064c5db3fb63fad57f40e4e334fa) --- sys/security/mac_do/mac_do.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 33904f09a6f4..c24e14d7937b 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -3,6 +3,7 @@ * * Copyright(c) 2024 Baptiste Daroussin * Copyright (c) 2024 The FreeBSD Foundation + * Copyright (c) 2025 Kushagra Srivastava * * Portions of this software were developed by Olivier Certner * at Kumacom SARL under sponsorship from the FreeBSD From nobody Mon Jun 29 19:25:38 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx834pbNz6jjQh for ; Mon, 29 Jun 2026 19:25:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx832L2Tz3yvZ for ; Mon, 29 Jun 2026 19:25:39 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761139; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ju9boqBILTrqNYNbTWtLHfcx/kuUfFXFyjrCr7tyD0g=; b=P5OTZW7N6qFkdVuuoFZhMVb3a/Wy455fPKhlDzIpSSr09Dr/4f/gTFHuJhLQ88ZmeBeBwW HIQ1mEaol23dwff/BHWjIN6h14uy9RD/bTeLeQ9BvUpcD/ip3TJQOlPGGTEQmJjaP/SSe4 IcUPX+Tq7SDsO4uL/CzqyiEcYkptPh7nIxPKjoJpBlBqJbK/y5Prhe8h2+Varu+QqFRv2a tYLPeJP5Qb8dllnPlpB9BiNiQn1iFRn5zinZ+BvgJ654nhbB8QqD5LGfKLUob8D9C+zwhW AzXVMYRM2yEo3T0b7JuEDCZz6p/KR6NRAPKObEmgqMrLUodbgRm6mrg6mI9IDg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761139; a=rsa-sha256; cv=none; b=fYzsRapy09dUTuIydZMqjR2f5oK7G07FWjOYv52IQXakcJbTMWSe4jlnzaMusBCEOti0kC Q/YPm9fM6skPbHIv8Lh0uKKpa2iK9vIMaHbQvlpgT0YU51N+sZwdKVuZ+L0CWM3ovkPkRP MEe6iL3h2sg+eMsqB4jwiNa8+dHudt3yXhiFWdhyopHOjIExneMlRktRkUlsmU4Fzysssy uFoc2dhAxzQYK9mnPX4jCZFE/jUchkztorKxVLafHduI588S7DJQxN3gGkcUpB0RbhzZ9t 24MaNwV/nosaq+Fm43LMWLcNoKi90FP4PZ+3SM5NXD2Ru+JQFdjxv/Qu7F/kCw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761139; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ju9boqBILTrqNYNbTWtLHfcx/kuUfFXFyjrCr7tyD0g=; b=gDjE6BQ3FHo7gt841GegpHi5665wdVpvc1CAPFYVv4TZNq+ndTEZNV/vQThI/WNvaw/xdF 0cErak6PE/YSAUWCSqnjzrhARQ4jDABHFWK9ZnMOlUNmo0GvCVxR0w+rPtWiNa0qiVKtzi QoBA58if0AHa+8H+i/qhZVPYB3whYv4QmhY7BZpCaIivXnhut749vhFUVsDn3XDLdVnlKu KNG57xt59gvnfGPSE9WnfVkZpA0hvOF+M4Mb46vycJlGttH3Y5rZFV75kpdxy8wcORtYYg K2HjYYt3ktSsTEOCpIJhGXvfw8Y3JZ5kZusw06qOHyWPdVatPuKfFmTq9Bya6w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx826mjcz19Ky for ; Mon, 29 Jun 2026 19:25:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 206d5 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:38 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: be43248be7cd - stable/15 - MAC/do: Document and assert when parse error objects must be built List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: be43248be7cd133e729649a9912bb8f9aab397b8 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:38 +0000 Message-Id: <6a42c6b2.206d5.64643da8@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=be43248be7cd133e729649a9912bb8f9aab397b8 commit be43248be7cd133e729649a9912bb8f9aab397b8 Author: Olivier Certner AuthorDate: 2026-05-19 19:38:41 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:40 +0000 MAC/do: Document and assert when parse error objects must be built The invariant is that parse_*() functions must create a parse error object and return it through their 'parse_error' argument if and only if they return an error code (non-zero). Add assertions checking this invariant in various places, and in particular in the new parse_exec_paths(), to be future proof. Change the contract of parse_and_set_conf() so that the caller is required to pass a NULL '*parse_error'. Remove useless resetting of '*parse_error' to NULL. While here, remove a test that is always true thanks to this invariant and that was recently introduced with the "executable paths" feature. No functional change intended. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 0aef1c059fae86a7f62b444dc3352eb0d5bdaa31) --- sys/security/mac_do/mac_do.c | 82 +++++++++++++++++++++++++++----------------- 1 file changed, 50 insertions(+), 32 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 0e715d576a16..84c7e875af73 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -71,6 +71,11 @@ static const char *id_type_to_str[] = { #define PARSE_ERROR_SIZE 256 +/* + * All functions having a parse error parameter must return through it a parse + * error object if and only if they return an error value (non-zero); else, NULL + * must be returned through it. + */ struct parse_error { size_t pos; char msg[PARSE_ERROR_SIZE]; @@ -778,6 +783,7 @@ parse_target_clause(char *to, struct rule *const rule, check_type_and_finish: check_type_and_type_flags(type, *tflags); finish: + MPASS(error == 0 && *parse_error == NULL); return (0); einval: /* We must have built a parse error on error. */ @@ -855,7 +861,7 @@ pour_list_into_rule(const id_type_t type, struct id_list *const list, make_parse_error(parse_error, 0, "Incompatible flags or duplicate " "GID %u.", id); - return (EINVAL); + goto einval; } check_type_and_id_flags(type, array[ref_idx].flags); @@ -869,7 +875,7 @@ pour_list_into_rule(const id_type_t type, struct id_list *const list, */ make_parse_error(parse_error, 0, "Duplicate UID %u.", id); - return (EINVAL); + goto einval; default: __assert_unreachable(); @@ -878,7 +884,12 @@ pour_list_into_rule(const id_type_t type, struct id_list *const list, *nb = ref_idx + 1; } + MPASS(*parse_error == NULL); return (0); + +einval: + MPASS(*parse_error != NULL); + return (EINVAL); } /* @@ -1004,6 +1015,7 @@ parse_single_rule(char *rule, struct rules *const rules, } STAILQ_INSERT_TAIL(&rules->head, new, r_entries); + MPASS(error == 0 && *parse_error == NULL); return (0); einval: @@ -1021,13 +1033,13 @@ einval: /* * Parse rules specification and produce rule structures out of it. * - * Returns 0 on success, with '*rulesp' made to point to a 'struct rule' - * representing the rules. On error, the returned value is non-zero and - * '*rulesp' is unchanged. If 'string' has length greater or equal to - * MAC_RULE_STRING_LEN, ENAMETOOLONG is returned. If it is not in the expected - * format, EINVAL is returned. If an error is returned, '*parse_error' is set - * to point to a 'struct parse_error' giving an error message for the problem, - * else '*parse_error' is set to NULL. + * Must be called with '*parse_error' set to NULL. Returns 0 on success, with + * '*rulesp' made to point to a 'struct rule' representing the rules. On error, + * the returned value is non-zero and '*rulesp' is unchanged. If 'string' has + * length greater or equal to MAC_RULE_STRING_LEN, ENAMETOOLONG is returned. If + * it is not in the expected format, EINVAL is returned. If an error is + * returned, '*parse_error' is set to point to a 'struct parse_error' giving an + * error message for the problem. * * Expected format: A >-colon-separated list of rules of the form * ">" (for backwards compatibility, a semi-colon ":" is accepted @@ -1052,8 +1064,6 @@ parse_rules(const char *const string, struct rules *const rules, char *copy, *p, *rule; int error = 0; - *parse_error = NULL; - if (len >= MAC_RULE_STRING_LEN) { make_parse_error(parse_error, 0, "Rule specification string is too long (%zu, max %zu)", @@ -1076,15 +1086,22 @@ parse_rules(const char *const string, struct rules *const rules, if (error != 0) { (*parse_error)->pos += rule - copy; toast_rules(rules); - goto out; + goto error; } } + MPASS(error == 0 && *parse_error == NULL); out: free(copy, M_MAC_DO); return (error); +error: + MPASS(error != 0 && *parse_error != NULL); + goto out; } +/* + * Similar constraints as parse_rules() (which see). + */ static int parse_exec_paths(const char *const string, struct exec_paths *const exec_paths, struct parse_error **const parse_error) @@ -1093,8 +1110,6 @@ parse_exec_paths(const char *const string, struct exec_paths *const exec_paths, char *copy, *p, *path; int error = 0; - *parse_error = NULL; - if (len >= EXEC_PATHS_MAXLEN) { make_parse_error(parse_error, 0, "Exec path specification string is too long (%zu, max %u)", @@ -1121,7 +1136,7 @@ parse_exec_paths(const char *const string, struct exec_paths *const exec_paths, "Too many exec paths specified (max %d)", MAX_EXEC_PATHS); error = EINVAL; - goto out; + goto error; } path_len = strlen(path); @@ -1130,7 +1145,7 @@ parse_exec_paths(const char *const string, struct exec_paths *const exec_paths, "Exec paths too long (%zu, max %u)", path_len, PATH_MAX - 1); error = ENAMETOOLONG; - goto out; + goto error; } strlcpy(exec_paths->exec_paths[exec_paths->exec_path_count], @@ -1141,12 +1156,16 @@ parse_exec_paths(const char *const string, struct exec_paths *const exec_paths, if (exec_paths->exec_path_count == 0) { make_parse_error(parse_error, 0, "No valid exec paths found"); error = EINVAL; - goto out; + goto error; } + MPASS(error == 0 && *parse_error == NULL); out: free(copy, M_MAC_DO); return (error); +error: + MPASS(error != 0 && *parse_error != NULL); + goto out; } /* @@ -1362,6 +1381,7 @@ clone_exec_paths(struct exec_paths *dst, struct exec_paths *const src) sizeof(dst->exec_paths_str)); } +/* Must be called with '*parse_error' set to NULL. */ static int parse_and_set_conf(struct prison *pr, const char *rules_string, const char *exec_paths_string, struct parse_error **parse_error) @@ -1372,8 +1392,6 @@ parse_and_set_conf(struct prison *pr, const char *rules_string, int error = 0; bool need_applicable_conf; - *parse_error = NULL; - need_applicable_conf = (rules_string == NULL || rules_string[0] == '\0' || exec_paths_string == NULL || exec_paths_string[0] == '\0'); @@ -1388,7 +1406,7 @@ parse_and_set_conf(struct prison *pr, const char *rules_string, if (rules_string != NULL && rules_string[0] != '\0') { error = parse_rules(rules_string, &conf->rules, parse_error); if (error != 0) - goto out; + goto error; } else if (applicable_conf != NULL) clone_rules(&conf->rules, &applicable_conf->rules); @@ -1397,20 +1415,22 @@ parse_and_set_conf(struct prison *pr, const char *rules_string, error = parse_exec_paths(exec_paths_string, &conf->exec_paths, parse_error); if (error != 0) - goto out; + goto error; } else if (applicable_conf != NULL) clone_exec_paths(&conf->exec_paths, &applicable_conf->exec_paths); set_conf(pr, conf); + MPASS(error == 0 && *parse_error == NULL); out: if (applicable_conf != NULL) drop_conf(applicable_conf); - if (error != 0) - drop_conf(conf); - return (error); +error: + MPASS(error != 0 && *parse_error != NULL); + drop_conf(conf); + goto out; } static int @@ -1420,7 +1440,7 @@ mac_do_sysctl_rules(SYSCTL_HANDLER_ARGS) struct prison *const td_pr = req->td->td_ucred->cr_prison; struct prison *pr; struct conf *conf; - struct parse_error *parse_error; + struct parse_error *parse_error = NULL; int error; conf = find_conf(td_pr, &pr); @@ -1462,7 +1482,7 @@ mac_do_sysctl_exec_paths(SYSCTL_HANDLER_ARGS) struct prison *const td_pr = req->td->td_ucred->cr_prison; struct prison *pr; struct conf *conf; - struct parse_error *parse_error; + struct parse_error *parse_error = NULL; int error; conf = find_conf(td_pr, &pr); @@ -1727,12 +1747,10 @@ mac_do_jail_set(void *obj, void *data) &parse_error); if (error != 0) { - if (parse_error != NULL) { - vfs_opterror(opts, - "MAC/do: Parse error at index %zu: %s\n", - parse_error->pos, parse_error->msg); - free_parse_error(parse_error); - } + vfs_opterror(opts, + "MAC/do: Parse error at index %zu: %s\n", + parse_error->pos, parse_error->msg); + free_parse_error(parse_error); return (error); } From nobody Mon Jun 29 19:25:40 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx843zqWz6jj2D for ; Mon, 29 Jun 2026 19:25:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx841Yl2z4016 for ; Mon, 29 Jun 2026 19:25:40 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761140; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BIA0gHSEtUcCJD093kFGX8QosnChBlb0H6ggvgpKgz8=; b=f/kedjt9qJOzfYcFvgI180XAMR2HszH4WBwNyU6QnjEdQaHN/TTluZUnqMU+7xECyt1ZoW gzKaS9riOpvd/z6guwNKRFe7QuV+bRy5vAgvbNbo5eqdyq8TKsZnz5ztki0XtaWuZEBpJ4 zmDojFGfSZK7MPSKypGjNyBVQ3oMjn51DdiFm5QnoYO98DNfG+lTb3E5RZYpi1i4SxbEZj yZ5wxQrq+JALiUOtFvT4T9PhMKUkO8FKWUew88dlu1ga+a3Rz5H799vf4usHBoDc/f6k7U IJXqkAvRPahPlM5NOougKVzBGLzn10de5QBHo04PkPQ9uuPWQaZdbfq34X9ZZQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761140; a=rsa-sha256; cv=none; b=XbIzBDZCAT+NnVKCFwrzOFz2SXp2zaX0VdX8atz8PEEZCMgdv3JmUGYQzOahYS5DtfXCAA FR/d4LDRHnGRtrmja27SBSRIVAMzbklcrHAKcjPpZUycA1T4pgcnoduX9ENyQuvlx/2NUy km2OapnhZ9PjVirMexE/FJTPMqcpiuOcI7PCO8w7vQOHMRJVw8hNXqxWKGQdxExulAOVmi Lz4PdewpDJZyDCjv/n671lNEnitzv8oAoEt/91R7XZVbPDeL0350k7BbJaOuBDWIqkxTWB FdrFhBAhYLxLyzZhBcBa4YD3JyGfGr6l/iV+4lVTaIX5KvwwLhoY/C86bNZHTA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761140; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BIA0gHSEtUcCJD093kFGX8QosnChBlb0H6ggvgpKgz8=; b=PxnZelWhZ/QTkB0fR3kkxZhR2giHR/wu+I8Evgw9yWsKq2sVwMcqqY6csfe0p8RzgnyuTZ qREeoStJavfGztMuQM5+sp4VOokZUB0t4nygTM/KB/r/ZhKSFZK+CzJGd3VfNGupGAe1Jz 7ABoVYvOj05fKAGzZRHre+Ma+7kyyiiQM2u8Ceq9O88Ygy5CMlOb18MlPRSH9bbWZQ8YEn qJAP/Rq0QJg10uCZOaFVea7EuKO4svDPQjWZeWAvTHpMcPmwH9qXYy7l+/SX7mD24CFW2r bwZ9IAf0inda0EhxNiRIozTafKoEZSvrcIrXsyLQuB/gDEiPFp+u+X48MqgyqA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx840VhVz19Nf for ; Mon, 29 Jun 2026 19:25:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 2192f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:40 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 3a95d9255a65 - stable/15 - MAC/do: Executable paths: Accept an empty string List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 3a95d9255a654802937bacff7ba8db11de6cb99d Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:40 +0000 Message-Id: <6a42c6b4.2192f.282639dd@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=3a95d9255a654802937bacff7ba8db11de6cb99d commit 3a95d9255a654802937bacff7ba8db11de6cb99d Author: Olivier Certner AuthorDate: 2026-04-28 13:37:50 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:40 +0000 MAC/do: Executable paths: Accept an empty string This effectively allows to disable mac_do(4) by setting the executable paths to an empty string, realizing a symmetry with rules to be leveraged in subsequent commits. Reviewed by: bapt Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 3a4433425e63f88e70078a354bd404d7ea6ca3ce) --- sys/security/mac_do/mac_do.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 84c7e875af73..e31ba6904bde 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1153,12 +1153,6 @@ parse_exec_paths(const char *const string, struct exec_paths *const exec_paths, exec_paths->exec_path_count++; } - if (exec_paths->exec_path_count == 0) { - make_parse_error(parse_error, 0, "No valid exec paths found"); - error = EINVAL; - goto error; - } - MPASS(error == 0 && *parse_error == NULL); out: free(copy, M_MAC_DO); From nobody Mon Jun 29 19:25:41 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx866R9gz6jjL8 for ; Mon, 29 Jun 2026 19:25:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx853cvsz3yp1 for ; Mon, 29 Jun 2026 19:25:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761141; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Bl0Ntow9P/FS9wxyV+q9+XLwXvuwIWKFcXw4nDW5Ujc=; b=KRb3kdj7bhCC+qiSTt6WhXxBaXSOY0U9FYFuTsFakEZX4WMaQNe3uwIfwMjxcYOMU/l/Sc 8jx/kUKWJRNuy2jp5i8XZmy9li1YnO4ENLeouMz7Ug8wp/PLSYWSwf13rAV/Te9c8oKGU5 RKtzFd946ke9rVblnTWaHBccbgUH0wOsBUYAe4YsKDne9Xzo/YiWLCZ6SkyQ0yLF2xHeQc 85VvDa2wVoCLjPGHmin/jdOZxBDzW5+t6zimAIL8NHiTrzUSzCAgfOoe8enzvX1MDn20MH jmuFcWHCCcopWj+ENz2JDA85cWGoBVJ/OFoe0iRLmB/cAWlm3vOnuGMOL2a+DQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761141; a=rsa-sha256; cv=none; b=YxvKW6+TaPsRh2+OZTIxG6KSrKcL2OtSMSfUtK9ipkvpd+v6RoPoqR2sjhEWUSd2NvpvTw 20kUR11Ae1RlHaRypN3fF5kxTjIXbuX4S5QR1pkWwoPZQTCO8ENq/tsxuwF/QTZ7aRexBh WBesVA68jY2hPW6MXy7DqGYv7GO3MeFXTTK61fUftCpDjbvoEwTGUmMV+OH0Dt99+uxxKp /8jOgCa8qU3S1aFfeuMcVc9vrtrT5TKnw0vnzXeXK/NNhB3SzPmVd7C3YDFYSts860chgd Zsnb5ZdGGOrbm2BOKM8+StUb+tqkYgPKHUQ4oH4hT457bi7fZQnCzkIZFx/IsQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761141; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Bl0Ntow9P/FS9wxyV+q9+XLwXvuwIWKFcXw4nDW5Ujc=; b=BBGLMRaJcsP/K5+YmbKOOAu/mNoyVrPeAYj+/quDpL0jcC+taglbf3NqBIeWvvo1mdCXhU shiyAnrXmHAHemh4jLfr+9b6QfYGdkXFqoe1ux2mV02ybrQpWgzjZ1+tCouUKJW5abZGyq 5mboTugm/FnhrOsXzHJqPlRZbotxhomPXXtsS9nzPQo+5JyD6updCIZAQFSPNMmkt+7SHN MDMrIrkgPyQ1dpwZcqUzAVcXge8nVUffpXreD9KQCYKJWeC86C9sLzGa9r3I4JjmdMT0A1 5Xyg9mfZDYrr1/5rhNSfefjBTM749c69q1Osgbt4p3dQjHLhrAHaAZ96GfRfSQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx851Kxmz196d for ; Mon, 29 Jun 2026 19:25:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21d81 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:41 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 5398649fa0e3 - stable/15 - MAC/do: Rename size constants/variables to clear confusion with string lengths List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 5398649fa0e3d6d07403443671a8cea992b2c145 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:41 +0000 Message-Id: <6a42c6b5.21d81.39c965fa@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=5398649fa0e3d6d07403443671a8cea992b2c145 commit 5398649fa0e3d6d07403443671a8cea992b2c145 Author: Olivier Certner AuthorDate: 2026-03-23 16:13:37 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:41 +0000 MAC/do: Rename size constants/variables to clear confusion with string lengths These constants represent buffer sizes in bytes, not string lengths. While here, move MAX in EXEC_PATHS_MAXLEN at start, like the other constants. While here, fix the prefix of the old MAC_RULE_STRING_LEN accordingly. No functional change. Reviewed by: bapt Fixes: 8aac90f18aef ("mac_do: add a new MAC/do policy and mdo(1) utility") Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 28ebab7c3730105f06f982950e9aee4130469906) --- sys/security/mac_do/mac_do.c | 68 ++++++++++++++++++++++---------------------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index e31ba6904bde..bef29badc5ba 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -47,10 +47,10 @@ SYSCTL_INT(_security_mac_do, OID_AUTO, print_parse_error, CTLFLAG_RWTUN, static MALLOC_DEFINE(M_MAC_DO, "mac_do", "mac_do(4) security module"); -#define EXEC_PATHS_MAXLEN 2048 -#define MAX_EXEC_PATHS 8 +#define MAX_EXEC_PATHS_SIZE 2048 +#define MAX_EXEC_PATHS 8 -#define MAC_RULE_STRING_LEN 1024 +#define MAX_RULE_STRING_SIZE 1024 static unsigned osd_jail_slot; static unsigned osd_thread_slot; @@ -159,7 +159,7 @@ struct id_spec { /* * This limits the number of target clauses per type to 65535. With the current - * value of MAC_RULE_STRING_LEN (1024), this is way more than enough anyway. + * value of MAX_RULE_STRING_SIZE (1024), this is way more than enough anyway. */ typedef uint16_t id_nb_t; /* We only have a few IT_* types. */ @@ -180,12 +180,12 @@ struct rule { STAILQ_HEAD(rulehead, rule); struct rules { - char string[MAC_RULE_STRING_LEN]; + char string[MAX_RULE_STRING_SIZE]; struct rulehead head; }; struct exec_paths { - char exec_paths_str[EXEC_PATHS_MAXLEN]; + char exec_paths_str[MAX_EXEC_PATHS_SIZE]; char exec_paths[MAX_EXEC_PATHS][PATH_MAX]; int exec_path_count; }; @@ -355,14 +355,14 @@ toast_rules(struct rules *const rules) static void init_rules(struct rules *const rules) { - _Static_assert(MAC_RULE_STRING_LEN > 0, "MAC_RULE_STRING_LEN <= 0!"); + _Static_assert(MAX_RULE_STRING_SIZE > 0, "MAX_RULE_STRING_SIZE <= 0!"); STAILQ_INIT(&rules->head); } static void init_exec_paths(struct exec_paths *const exec_paths) { - _Static_assert(EXEC_PATHS_MAXLEN > 0, "EXEC_PATHS_MAXLEN <= 0!"); + _Static_assert(MAX_EXEC_PATHS_SIZE > 0, "MAX_EXEC_PATHS_SIZE <= 0!"); bzero(exec_paths, sizeof(*exec_paths)); exec_paths->exec_paths_str[0] = 0; } @@ -1036,7 +1036,7 @@ einval: * Must be called with '*parse_error' set to NULL. Returns 0 on success, with * '*rulesp' made to point to a 'struct rule' representing the rules. On error, * the returned value is non-zero and '*rulesp' is unchanged. If 'string' has - * length greater or equal to MAC_RULE_STRING_LEN, ENAMETOOLONG is returned. If + * length greater or equal to MAX_RULE_STRING_SIZE, ENAMETOOLONG is returned. If * it is not in the expected format, EINVAL is returned. If an error is * returned, '*parse_error' is set to point to a 'struct parse_error' giving an * error message for the problem. @@ -1064,10 +1064,10 @@ parse_rules(const char *const string, struct rules *const rules, char *copy, *p, *rule; int error = 0; - if (len >= MAC_RULE_STRING_LEN) { + if (len >= MAX_RULE_STRING_SIZE) { make_parse_error(parse_error, 0, "Rule specification string is too long (%zu, max %zu)", - len, MAC_RULE_STRING_LEN - 1); + len, MAX_RULE_STRING_SIZE - 1); return (ENAMETOOLONG); } @@ -1110,10 +1110,10 @@ parse_exec_paths(const char *const string, struct exec_paths *const exec_paths, char *copy, *p, *path; int error = 0; - if (len >= EXEC_PATHS_MAXLEN) { + if (len >= MAX_EXEC_PATHS_SIZE) { make_parse_error(parse_error, 0, "Exec path specification string is too long (%zu, max %u)", - len, EXEC_PATHS_MAXLEN - 1); + len, MAX_EXEC_PATHS_SIZE - 1); return (ENAMETOOLONG); } @@ -1317,7 +1317,7 @@ set_default_conf(struct prison *const pr) struct conf *const conf = alloc_conf(); strlcpy(conf->exec_paths.exec_paths_str, "/usr/bin/mdo", - EXEC_PATHS_MAXLEN); + MAX_EXEC_PATHS_SIZE); strlcpy(conf->exec_paths.exec_paths[0], "/usr/bin/mdo", PATH_MAX); conf->exec_paths.exec_path_count = 1; @@ -1430,7 +1430,7 @@ error: static int mac_do_sysctl_rules(SYSCTL_HANDLER_ARGS) { - char *const buf = malloc(MAC_RULE_STRING_LEN, M_MAC_DO, M_WAITOK); + char *const buf = malloc(MAX_RULE_STRING_SIZE, M_MAC_DO, M_WAITOK); struct prison *const td_pr = req->td->td_ucred->cr_prison; struct prison *pr; struct conf *conf; @@ -1438,10 +1438,10 @@ mac_do_sysctl_rules(SYSCTL_HANDLER_ARGS) int error; conf = find_conf(td_pr, &pr); - strlcpy(buf, conf->rules.string, MAC_RULE_STRING_LEN); + strlcpy(buf, conf->rules.string, MAX_RULE_STRING_SIZE); prison_unlock(pr); - error = sysctl_handle_string(oidp, buf, MAC_RULE_STRING_LEN, req); + error = sysctl_handle_string(oidp, buf, MAX_RULE_STRING_SIZE, req); if (error != 0 || req->newptr == NULL) goto out; @@ -1466,13 +1466,13 @@ SYSCTL_PROC(_security_mac_do, OID_AUTO, rules, SYSCTL_JAIL_PARAM_SYS_SUBNODE(mac, do, CTLFLAG_RW, "Jail MAC/do parameters"); -SYSCTL_JAIL_PARAM_STRING(_mac_do, rules, CTLFLAG_RW, MAC_RULE_STRING_LEN, +SYSCTL_JAIL_PARAM_STRING(_mac_do, rules, CTLFLAG_RW, MAX_RULE_STRING_SIZE, "Jail MAC/do rules"); static int mac_do_sysctl_exec_paths(SYSCTL_HANDLER_ARGS) { - char *const buf = malloc(EXEC_PATHS_MAXLEN, M_MAC_DO, M_WAITOK); + char *const buf = malloc(MAX_EXEC_PATHS_SIZE, M_MAC_DO, M_WAITOK); struct prison *const td_pr = req->td->td_ucred->cr_prison; struct prison *pr; struct conf *conf; @@ -1480,10 +1480,10 @@ mac_do_sysctl_exec_paths(SYSCTL_HANDLER_ARGS) int error; conf = find_conf(td_pr, &pr); - strlcpy(buf, conf->exec_paths.exec_paths_str, EXEC_PATHS_MAXLEN); + strlcpy(buf, conf->exec_paths.exec_paths_str, MAX_EXEC_PATHS_SIZE); prison_unlock(pr); - error = sysctl_handle_string(oidp, buf, EXEC_PATHS_MAXLEN, req); + error = sysctl_handle_string(oidp, buf, MAX_EXEC_PATHS_SIZE, req); if (error != 0 || req->newptr == NULL) goto out; @@ -1505,7 +1505,7 @@ SYSCTL_PROC(_security_mac_do, OID_AUTO, exec_paths, 0, 0, mac_do_sysctl_exec_paths, "A", "Colon-separated list of allowed executables"); -SYSCTL_JAIL_PARAM_STRING(_mac_do, exec_paths, CTLFLAG_RW, EXEC_PATHS_MAXLEN, +SYSCTL_JAIL_PARAM_STRING(_mac_do, exec_paths, CTLFLAG_RW, MAX_EXEC_PATHS_SIZE, "Jail MAC/do executable paths"); static int @@ -1570,7 +1570,7 @@ mac_do_jail_check(void *obj, void *data) { struct vfsoptlist *opts = data; char *rules_string, *exec_paths_string; - int error, jsys, rules_len = 0, exec_paths_len = 0; + int error, jsys, rules_size = 0, exec_paths_size = 0; bool has_rules, has_exec_paths; error = vfs_copyopt(opts, "mac.do", &jsys, sizeof(jsys)); @@ -1589,26 +1589,26 @@ mac_do_jail_check(void *obj, void *data) } /* - * We use vfs_getopt() below instead of vfs_getopts() to get the length. - * We perform the additional checks done by the latter here, even if - * jail_set() calls vfs_getopts() itself later (they becoming - * inconsistent wouldn't cause any security problem). + * We use vfs_getopt() below instead of vfs_getopts() to get the + * string's buffer size. We perform the additional checks done by the + * latter here, even if jail_set() calls vfs_getopts() itself later + * (they becoming inconsistent wouldn't cause any security problem). */ /* Rules. */ error = vfs_getopt(opts, "mac.do.rules", (void **)&rules_string, - &rules_len); + &rules_size); if (error == ENOENT) rules_string = NULL; else { if (error != 0) return (error); - if (rules_len == 0 || rules_string[rules_len - 1] != '\0') { + if (rules_size == 0 || rules_string[rules_size - 1] != '\0') { vfs_opterror(opts, "'mac.do.rules' not a proper string"); return (EINVAL); } - if (rules_len > MAC_RULE_STRING_LEN) { + if (rules_size > MAX_RULE_STRING_SIZE) { vfs_opterror(opts, "'mac.do.rules' too long"); return (ENAMETOOLONG); } @@ -1616,19 +1616,19 @@ mac_do_jail_check(void *obj, void *data) /* Executable paths. */ error = vfs_getopt(opts, "mac.do.exec_paths", - (void **)&exec_paths_string, &exec_paths_len); + (void **)&exec_paths_string, &exec_paths_size); if (error == ENOENT) exec_paths_string = NULL; else { if (error != 0) return (error); - if (exec_paths_len == 0 || - exec_paths_string[exec_paths_len - 1] != '\0') { + if (exec_paths_size == 0 || + exec_paths_string[exec_paths_size - 1] != '\0') { vfs_opterror(opts, "'mac.do.exec_paths' not a proper string"); return (EINVAL); } - if (exec_paths_len > EXEC_PATHS_MAXLEN) { + if (exec_paths_size > MAX_EXEC_PATHS_SIZE) { vfs_opterror(opts, "'mac.do.exec_paths' too long"); return (ENAMETOOLONG); } From nobody Mon Jun 29 19:25:42 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx870FGZz6jjTL for ; Mon, 29 Jun 2026 19:25:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx863BRxz40Cb for ; Mon, 29 Jun 2026 19:25:42 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761142; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zVjlm7od2Pz9dXU2sYklwQ7rPKLq/A8mjIhAU+sRDAc=; b=YibpKH6qs7SIM1BRuN/wG8boyqejMaRyBZ9ZoAvFodQnOzIHyM0UV7FHwYxWR6mZ2u8veR MjdgJOsVnE0E4mn0tpp68/C1h5runiy5fz9E3sgnVEN9CsJPcpW1N3v55s9HdzeN7Utnyb VfGI+CWOCHhUh6CbEtrquemK2pbF/9ZEwC50AFjXORzRBuPgCrRGA/tVu0zlP2+Fpriq/4 aq7g6ZdyIG54Sf1FW4xLEYdBwOuIT482b8Zel5Z2i8SH/UX9AGt9MIyLxHlPIJmZgylNN1 DY7jttKC7k4Y3E6w13vvIm27/sKbZPbz2b2uTu9j/EpV0CMflwKtVZKQ3w0hPQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761142; a=rsa-sha256; cv=none; b=uIK6dLWw/bEAJ0QtEmBnUNJhk7xa4oePYCxXFPBSGdQ7lFa0UKuDo7wsdmZFyMY8WZYiLc 2C4OGxofIJr2LYkTr91u75T1MS/H7zt8JK56dfDZrdTDeTswQPsfeI5XSUQGzvYY5rteM1 D490+WxF+H1Li7ZzNGoH0ujWIVyOoxpjmKGTZ1iN0rhXmHplC7Nb+B2S4wAYT2MLkyrZfN Jrrc1htxFBADLZwPE008dJvnDwL6jdU6sFYAGAi6U3opESM0KH+yctoO3mf5bx9jzWq1Tg 4rxQCt5lpeZbhZjO2arsl44jw2rxEt/doHF01YQ7ONS1Cw9xHfHmXukZDCRHfg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761142; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zVjlm7od2Pz9dXU2sYklwQ7rPKLq/A8mjIhAU+sRDAc=; b=Z5Zvl+kLib1iDZS3vVPFAgn6BsjMwL/V50791hE2YhqfF+m0IesoSNG1Y4bgRwE+OgKDJi kkZ6BfRaOePxMjo+0NaBI56Vo3PMH+tLS65pEluPl2PzxXu7H3iSJsV3dmUmpqHVnzrlI9 s3AgDylYjXIsqN1qQv4iiMGa5L6yf8NL1ZXGFrGtQ4PBZRQkupBjqrA14aHpsmIeJrtXJD J+TJqc6oxCHScNoTf2A5F7DRD2EP0qNvHVQ5OljZlUiSKmUgXHAOxoo4NPS5wJzMwozS2/ piDgCiezY5bN6fEcDk0wzTIZA+VhBqoxlo1uteBhGIscj9Q+TxRrZPmk/mWjCw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx861njsz19XX for ; Mon, 29 Jun 2026 19:25:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21d09 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:42 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: e3373e0a74f1 - stable/15 - MAC/do: find_conf(): Turn an MPASS() into a KASSERT() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: e3373e0a74f1537db947211ac5023f68d6a338ce Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:42 +0000 Message-Id: <6a42c6b6.21d09.f5cc4ff@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=e3373e0a74f1537db947211ac5023f68d6a338ce commit e3373e0a74f1537db947211ac5023f68d6a338ce Author: Olivier Certner AuthorDate: 2026-04-27 12:16:46 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:42 +0000 MAC/do: find_conf(): Turn an MPASS() into a KASSERT() Turn the pre-existing comment into an assertion message, with an update following the introduction of the "executable paths" feature. Explain in a comment why this situation cannot happen. Without INVARIANTS, such a situation would cause an immediate panic() (NULL is dereferenced in the next iteration of the loop), so leave the check under INVARIANTS only. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit cf942ac9e967055286a7076bf76e9a62e1d22d8f) --- sys/security/mac_do/mac_do.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index bef29badc5ba..0b224a24e0a7 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1186,7 +1186,15 @@ find_conf(struct prison *const pr, struct prison **const aprp) prison_unlock(cpr); ppr = cpr->pr_parent; - MPASS(ppr != NULL); /* prison0 always has rules. */ + /* + * 'prison0' normally always have a mac_do(4) configuration + * because we installed one on module load/activation and + * nothing can destroy it as 'prison0' is not a regular jail and + * the 'mac.do' parameter cannot be set to 'inherit' on it, + * which is the only way to clear an existing configuration. + */ + KASSERT(ppr != NULL, + ("MAC/do: 'prison0' must always have a configuration.")); cpr = ppr; } From nobody Mon Jun 29 19:25:43 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx876Rxlz6jjZ0 for ; Mon, 29 Jun 2026 19:25:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx873rjtz40MM for ; Mon, 29 Jun 2026 19:25:43 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761143; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=S16wQpEp0GvVOS5EQ4en8vqVVQUU5fWhhHgzdAXSFFk=; b=CZ01Z/NgR5r2fkquqqjLeMuHO0zwSeHtydIsT6IdwsdNJpcnEE8V+oRSkdwsrIopo2h5tQ BwL9pxXqre+m4GC6gBLj+9VVG5yPCNFZYTiEzAOmNso/r8H//k1sTGmlDJ0sazJMVFgSbM JUAs/iJQa1MiLKe8EupcxsAqX/YMfY9MMUXS3Rm1cxm/n1WObFHZoxT1QjatWM6rUoWLy/ rQtpA3NUYxOhU7FHe71Q7O5ui/xV9bS0dRn8twVrgzyMAdlu42yJfEcjNQogsjgpLuVFXW QXSzTJNoxFO6VigXIoW2WydhX6zDLpfOxhPKZDvUYZIv9m3v/I8HKDe4nqegOg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761143; a=rsa-sha256; cv=none; b=LW2hk3rPbibCNWYsRdGO9OJUAOqM9FMGxUJ7yE/gZBE5DEv/Y0LO4f6LOyAJxB0w2Eth9k L1pcdElCtlbj68sMqKnlt930CqxsNSXKxaL3evgpYkPvcHthSb5MSGdJ+L7TNqindZq6t2 msffiAZhkZcWirfCvXpVeDQspZkgBF2w+sG6d0CoIcxhMwrUzhbMLD/fQZVm/f6oUbdBoM +6q+mmnNOhlLxglwRKXWkJsoghu5EuNLNC6fwT1nxV0HDq3c2G2IE6fXsXI9ZjPgCXCO/S XDT7hTxuiLP9WiKhd+Dk0zrL26vQnnNRIQ0SfNT6ucStj23kgpKg37JAlx9Iqw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761143; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=S16wQpEp0GvVOS5EQ4en8vqVVQUU5fWhhHgzdAXSFFk=; b=xPl02vAmqItWfDsAHG/hr60CQhaKNlvPUTyY/nnc8yJ16nzJPOy2PArxqRheL/PdRmtNYu IsG45waXbt9xJD16LWBRLo2fHwVqk1vKh94vhhsZqq+RQj6vsQnNYmbtBcpgl7TtwxfJK6 hGfRq3cdLBvQAazEHnah1f291j/w/YNpLYK3NowHar4MSzdreSBYL5ncwnWEu+JPKCKjFL MTuor8kRit/zbn3DUrHK37QyOa2ewXIqDhNmT5Kb8kHMUNvcS3NZZJSTyoaMTCO9/i4kpL AloqvXAAEZhQ7SiPWtS6MAqSzHySIJgKZeRvESBx6lxYPZb7CXTwrO1GbYLQ1A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx872bcrz19bR for ; Mon, 29 Jun 2026 19:25:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21d85 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:43 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 9383427b2f90 - stable/15 - MAC/do: Move hold_conf() and drop_conf() earlier List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 9383427b2f906dc39ac61a466afa642f3707f2f8 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:43 +0000 Message-Id: <6a42c6b7.21d85.33e5883d@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=9383427b2f906dc39ac61a466afa642f3707f2f8 commit 9383427b2f906dc39ac61a466afa642f3707f2f8 Author: Olivier Certner AuthorDate: 2026-04-27 12:55:05 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:42 +0000 MAC/do: Move hold_conf() and drop_conf() earlier This is in preparation for using hold_conf() in find_conf(). Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit cd1ac04409359ec1357e23752f20b22f5055ddfa) --- sys/security/mac_do/mac_do.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 0b224a24e0a7..e844cda7e1c4 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1162,6 +1162,21 @@ error: goto out; } +static void +hold_conf(struct conf *const conf) +{ + refcount_acquire(&conf->use_count); +} + +static void +drop_conf(struct conf *const conf) +{ + if (refcount_release(&conf->use_count)) { + toast_rules(&conf->rules); + free(conf, M_MAC_DO); + } +} + /* * Find configuration applicable to the passed prison. * @@ -1202,21 +1217,6 @@ find_conf(struct prison *const pr, struct prison **const aprp) return (conf); } -static void -hold_conf(struct conf *const conf) -{ - refcount_acquire(&conf->use_count); -} - -static void -drop_conf(struct conf *const conf) -{ - if (refcount_release(&conf->use_count)) { - toast_rules(&conf->rules); - free(conf, M_MAC_DO); - } -} - #ifdef INVARIANTS static void check_conf_use_count(const struct conf *const conf, u_int expected) From nobody Mon Jun 29 19:25:44 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx89197Zz6jjZ4 for ; Mon, 29 Jun 2026 19:25:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx884LfJz3ytq for ; Mon, 29 Jun 2026 19:25:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761144; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eIoEKVF8gf7unTy7jXhDy+axGl8Kztk2lvPdAmeGRLU=; b=mz7rUUwuZyjltbOZhbY3+On9zGCgzpy1Mou6L1oIYBaKA6ZzXRB0iD4+0eMFmyGGB1EJT9 pw/aeVQraPkLBuOvaKECKRkhB5G4yYZmW5vvEKrqRj2ecolB4bu6KO0rLkoOb+aLSTKWE2 hg9SMpzOTnJVzQDyLZFLO2Aapcu2JJe8n/DBFABunfwusZjQ1HCkRToc0Ti4kV/uUCDkL4 Q9mPBiDszW99IMQkJ2vM2OOgrTBXkHC0l7s1X06zGgiXVntNa15wECeSUoGSGqFqzKaTgl Sx4+iQXORkWN2qOCRjZDF2CQxipBwMLvuMaAmDGbzT0xmfp9PaUZsNA63exqfw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761144; a=rsa-sha256; cv=none; b=J7ZSuem8U4Qs0LI+3zzj2l6L6lck6kGcD1VSL8MCwdPIIz2pfhWLJGrRbPANVyIOdoQOxI Mo4zxO6jXBVhSiZpIFnlpbUs/3OVA70gZIjk+r5e+UT+udwnRo31R/Kl6ZD1o8QvJPrONn LNaWArcMRkoUiv6AOBI+kbYZ7+4LMNU/qe7sSmjtYyie/kRZ/Vpx6QsGMksiqZTPQwUpue eFWoVSIR72JH8h4z5dgGImyZZdq6V7Jck0B/pmqtDbwaYRCX9K8//vkgIn9lK0r4jaxL/x YGGxf11NrQdr6SDmEv28IEIA4mNSC9I2g8Ae0hy3fqtj6FjeQzpsDLH0+8ZRcQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761144; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eIoEKVF8gf7unTy7jXhDy+axGl8Kztk2lvPdAmeGRLU=; b=IkbMwKLyOf1h+JN8mZB8IKqpB59qPtvwwapWbAka3Rsn+hwwPGLrd/GahpPdILDwgRNV0Z l6H/t06zy9MZhRReq6t1zWg/s+a3de0ALxgYGaJa2HSRwThWTkmQ9Pfk0qyL71q9pAf23R 09Aa1whk6m+G9IEGNtxzJAl1g3gia7/SwBuf4c9k0r/oVoitOHyYhyG0tJjtpoeIAXM8eY Md0T3v5Vk+i4NUOabF+pYAUexIrZgdiWjNIG9fGZVw/6DV54M0L95yV3ZK4rmKA/jyM9Rb KjmUqBAeqVOl83QSzb5Slr0U/p8lamBJzC+Kt666wo6nBedjDdOCtSrFMRmlWw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx883QLQz19bS for ; Mon, 29 Jun 2026 19:25:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1feee by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:44 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 56e1a621d0b4 - stable/15 - MAC/do: find_conf(): Return configuration with a true reference List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 56e1a621d0b4d0cbf054822fcfcafffd92c8d3a4 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:44 +0000 Message-Id: <6a42c6b8.1feee.47ba239f@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=56e1a621d0b4d0cbf054822fcfcafffd92c8d3a4 commit 56e1a621d0b4d0cbf054822fcfcafffd92c8d3a4 Author: Olivier Certner AuthorDate: 2026-04-27 14:39:15 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:43 +0000 MAC/do: find_conf(): Return configuration with a true reference In addition to the applicable configuration, find_conf() was returning a pointer to the actual jail holding the configuration object, with that jail's mutex locked in order to ensure liveness of the returned configuration (if we wouldn't, a concurrent thread modifying the jail's configuration could destroy this configuration object underneath us). But: 1. Ensuring configuration stability by owning the holding jail's mutex requires callers to either keep that mutex locked for a longer period of time than just accessing the corresponding 'struct prison' (in general, bad for concurrency with other operations involving jails) or to perform an additional dance to acquire a real reference in case the jail's mutex, for some reason (in general, LORs or acquiring a sleepable lock) must be dropped before use. 2. Most code does not actually need to know which jail holds the applicable configuration but for unlocking the jail's mutex. Having to deal with the jail holding the configuration can cause confusion about which jail (the current one, or the one holding the configuration) must be used (and actually did in the very initial version of MAC/do, which had a serious flaw as a consequence). So, do not keep a lock on the holding jail. Instead, ensure configuration stability by always acquiring a true reference from the start and passing it to the caller. Those callers not doing the dance mentioned above now need to free it when finished (but this need replaces the one to unlock the prison). Additionally, only return the holding jail if explicitly requested by the caller. mac_do_jail_get() is currently the only caller that needs it, in order to be able to reliably report if the configuration is inherited. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 4e4cf18b85cc51f41bcae20114f9c0e7b69f76e0) --- sys/security/mac_do/mac_do.c | 83 +++++++++++++++++++++----------------------- 1 file changed, 40 insertions(+), 43 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index e844cda7e1c4..19ea3768153d 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1180,14 +1180,19 @@ drop_conf(struct conf *const conf) /* * Find configuration applicable to the passed prison. * - * Returns the applicable configuration (and never NULL). 'pr' must be - * unlocked. 'aprp' is set to the (ancestor) prison holding these, and it must - * be unlocked once the caller is done accessing the configuration. '*aprp' is - * equal to 'pr' if and only if the current jail has its own specific - * configuration. + * Returns the applicable configuration (which always exists), with an + * additional reference that must be freed by the caller. 'pr' must not be + * locked. + * + * The applicable configuration is that of the closest ancestor prison + * (including itself) of the passed prison that actually has a 'struct conf' + * associated to it. + * + * If 'hpr' is not NULL, it is used to return a pointer to the (unlocked) prison + * holding the applicable configuration. */ static struct conf * -find_conf(struct prison *const pr, struct prison **const aprp) +find_conf(struct prison *const pr, struct prison **const hpr) { struct prison *cpr, *ppr; struct conf *conf; @@ -1213,7 +1218,11 @@ find_conf(struct prison *const pr, struct prison **const aprp) cpr = ppr; } - *aprp = cpr; + hold_conf(conf); + prison_unlock(cpr); + + if (hpr != NULL) + *hpr = cpr; return (conf); } @@ -1388,7 +1397,6 @@ static int parse_and_set_conf(struct prison *pr, const char *rules_string, const char *exec_paths_string, struct parse_error **parse_error) { - struct prison *ppr = NULL; struct conf *applicable_conf = NULL; struct conf *conf; int error = 0; @@ -1397,11 +1405,8 @@ parse_and_set_conf(struct prison *pr, const char *rules_string, need_applicable_conf = (rules_string == NULL || rules_string[0] == '\0' || exec_paths_string == NULL || exec_paths_string[0] == '\0'); - if (need_applicable_conf) { - applicable_conf = find_conf(pr, &ppr); - hold_conf(applicable_conf); - prison_unlock(ppr); - } + if (need_applicable_conf) + applicable_conf = find_conf(pr, NULL); conf = alloc_conf(); @@ -1439,22 +1444,20 @@ static int mac_do_sysctl_rules(SYSCTL_HANDLER_ARGS) { char *const buf = malloc(MAX_RULE_STRING_SIZE, M_MAC_DO, M_WAITOK); - struct prison *const td_pr = req->td->td_ucred->cr_prison; - struct prison *pr; + struct prison *const pr = req->td->td_ucred->cr_prison; struct conf *conf; struct parse_error *parse_error = NULL; int error; - conf = find_conf(td_pr, &pr); + conf = find_conf(pr, NULL); strlcpy(buf, conf->rules.string, MAX_RULE_STRING_SIZE); - prison_unlock(pr); error = sysctl_handle_string(oidp, buf, MAX_RULE_STRING_SIZE, req); if (error != 0 || req->newptr == NULL) goto out; /* Set our prison's rules, not that of the jail we inherited from. */ - error = parse_and_set_conf(td_pr, buf, NULL, &parse_error); + error = parse_and_set_conf(pr, buf, NULL, &parse_error); if (error != 0) { if (print_parse_error) printf("MAC/do: Parse error at index %zu: %s\n", @@ -1463,6 +1466,7 @@ mac_do_sysctl_rules(SYSCTL_HANDLER_ARGS) } out: + drop_conf(conf); free(buf, M_MAC_DO); return (error); } @@ -1481,21 +1485,19 @@ static int mac_do_sysctl_exec_paths(SYSCTL_HANDLER_ARGS) { char *const buf = malloc(MAX_EXEC_PATHS_SIZE, M_MAC_DO, M_WAITOK); - struct prison *const td_pr = req->td->td_ucred->cr_prison; - struct prison *pr; + struct prison *const pr = req->td->td_ucred->cr_prison; struct conf *conf; struct parse_error *parse_error = NULL; int error; - conf = find_conf(td_pr, &pr); + conf = find_conf(pr, NULL); strlcpy(buf, conf->exec_paths.exec_paths_str, MAX_EXEC_PATHS_SIZE); - prison_unlock(pr); error = sysctl_handle_string(oidp, buf, MAX_EXEC_PATHS_SIZE, req); if (error != 0 || req->newptr == NULL) goto out; - error = parse_and_set_conf(td_pr, NULL, buf, &parse_error); + error = parse_and_set_conf(pr, NULL, buf, &parse_error); if (error != 0) { if (print_parse_error) printf("MAC/do: Parse error at index %zu: %s\n", @@ -1504,6 +1506,7 @@ mac_do_sysctl_exec_paths(SYSCTL_HANDLER_ARGS) } out: + drop_conf(conf); free(buf, M_MAC_DO); return (error); } @@ -1529,20 +1532,19 @@ mac_do_jail_create(void *obj, void *data) static int mac_do_jail_get(void *obj, void *data) { - struct prison *ppr, *const pr = obj; + struct prison *const pr = obj; struct vfsoptlist *const opts = data; - struct conf *conf; - struct rules *rules; - struct exec_paths *exec_paths; + struct prison *hpr_out; + struct conf *const applicable_conf = find_conf(pr, &hpr_out); + const struct prison *const hpr = hpr_out; + const struct rules *const rules = &applicable_conf->rules; + const struct exec_paths *const exec_paths = &applicable_conf->exec_paths; int jsys, error; - conf = find_conf(pr, &ppr); - rules = &conf->rules; - exec_paths = &conf->exec_paths; - - jsys = pr == ppr ? + jsys = hpr == pr ? (STAILQ_EMPTY(&rules->head) ? JAIL_SYS_DISABLE : JAIL_SYS_NEW) : JAIL_SYS_INHERIT; + error = vfs_setopt(opts, "mac.do", &jsys, sizeof(jsys)); if (error != 0 && error != ENOENT) goto done; @@ -1558,7 +1560,7 @@ mac_do_jail_get(void *obj, void *data) error = 0; done: - prison_unlock(ppr); + drop_conf(applicable_conf); return (error); } @@ -2292,11 +2294,10 @@ mac_do_priv_grant(struct ucred *cred, int priv) static int check_proc(void) { + struct prison *const pr = curproc->p_ucred->cr_prison; char *path, *to_free; struct conf *conf; struct exec_paths *exec_paths; - struct prison *td_pr; - struct prison *pr; int error; /* @@ -2321,8 +2322,7 @@ check_proc(void) return (EPERM); error = EPERM; - td_pr = curproc->p_ucred->cr_prison; - conf = find_conf(td_pr, &pr); + conf = find_conf(pr, NULL); exec_paths = &conf->exec_paths; for (int i = 0; i < exec_paths->exec_path_count; i++) @@ -2331,8 +2331,7 @@ check_proc(void) break; } - prison_unlock(pr); - + drop_conf(conf); free(to_free, M_TEMP); return (error); } @@ -2340,7 +2339,7 @@ check_proc(void) static void mac_do_setcred_enter(void) { - struct prison *pr; + struct prison *const pr = curproc->p_ucred->cr_prison; struct mac_do_setcred_data * data; struct conf *conf; int error; @@ -2364,9 +2363,7 @@ mac_do_setcred_enter(void) /* * Find the currently applicable rules. */ - conf = find_conf(curproc->p_ucred->cr_prison, &pr); - hold_conf(conf); - prison_unlock(pr); + conf = find_conf(pr, NULL); /* * Setup thread data to be used by other hooks. From nobody Mon Jun 29 19:25:45 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8B0gZjz6jjQx for ; Mon, 29 Jun 2026 19:25:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx895f4Fz40Gw for ; Mon, 29 Jun 2026 19:25:45 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761145; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wWGoEJA9K1DgU7TbyLq4ho8xmLXZYMYHXi/RoKFCqX0=; b=sz6YA0IGke+zUpa6AGI72cmJM32Dde6+FyG9hXnUzhm017cO73PCfCICyvZ0548t4VXI8R VGQF/XF3Xou0lKa98TyNVO6ySp5r+B55yl7X3rLZaJtTxjUhsY5oZUk0N7ysDPgeaxfMd5 uatd8ClT0QEoEW9O4l7bakgKHPMczwaYDY3Fy6Oen4lYueZec2DOiABROs3q8EYliGjvUt nfRqOxKGmtAdyd2aasRcb/LrtOvKe5LurPPP9dHxDSw+LNHwcaZB8B+dB6sjDvDYAjHNL4 slG5qBhq2RYbsw9hk7rEoZednTIbQu1DloaeVKbbOKhWu5vvQo42cI12x7ClSQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761145; a=rsa-sha256; cv=none; b=mQkzs87MHXeiOzy1r41XVhMQOLlYbSfa92l5Wl9BfsLfqBk+sex1KT64s4dapxanQDfztJ jTBKW/ZeM2A96AwF/4CackZVpR1+ruZLiQyKVhLchwDCLH+bJI6sdaUGPOdctsKBC2hwHs Zh6Kt0uvHWiDVOWXEbaKXDqIAmg0K9u0cJIPtSOnQLqohiyKFkmr0ZjVQyXoaLUVOrjvzh 8wVBkGTTk134tUXxvcSdDnxJpYRs1qchSRrNVHForKqAFhjChc75GhmSU4x4B1RMbbtO5t vC0uxn86e3OgjzhRrBm+HSlyXTnvdE5ntiyui0WEa0PjTcEkxCB37FV2FdYuFA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761145; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wWGoEJA9K1DgU7TbyLq4ho8xmLXZYMYHXi/RoKFCqX0=; b=f3j4Ul7QHqccT/uVTw9wzPas9W/al9WOg8C37N+B85gKo+KiLvAOb1tYLTBq7GIWocOCpb FNmk91sXldh0KZnHmUeGJXIikBWCPZ32M20LrrYci6YeZFSAp2vYN+dVPss/EM4WalJ9y2 fr3zDDImRebkg+7FSLf8gw0tYSiyscTEbZbQihzA/Rdq+5MJ/kCCK95ckf7yK3yuYDh+0d 36filbI1k7KTZvRgY9aDib+HPVBVZUtLPHbssNb1snn5yrnPXnRpvHa7hhtMwq7ia1zd8y jI+Kktwu5p0QfQqmBMcf11d1XwrQsqcYG4/czuzLONbtT+bZRG9VJ8UTLjroQg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx894J2Jz196f for ; Mon, 29 Jun 2026 19:25:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21d0d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:45 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: e4ab9584a765 - stable/15 - MAC/do: Fix releasing a nonexistent reference on configuration parsing error List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: e4ab9584a765bb022f898cd703497b74f5e69ab0 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:45 +0000 Message-Id: <6a42c6b9.21d0d.2447768c@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=e4ab9584a765bb022f898cd703497b74f5e69ab0 commit e4ab9584a765bb022f898cd703497b74f5e69ab0 Author: Olivier Certner AuthorDate: 2026-04-28 08:42:01 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:44 +0000 MAC/do: Fix releasing a nonexistent reference on configuration parsing error On parsing error, parse_and_set_conf(), introduced with the recent "executable paths" feature, has been calling drop_conf() on the being-built configuration. However, that configuration structure is allocated through alloc_conf(), which does not grab a reference. Calling drop_conf() on it, which releases a reference, is thus erroneous, and causes the underlying counter to saturate, translating into a memory leak. To fix this bug, make alloc_conf() grab a reference on the newly-created 'struct conf', and rename it to new_conf() to be more in line with what it does. Keep set_conf() as is, i.e., grabbing an additional reference on behalf of the jail that is going to hold the configuration. Consequently, make sure that callers of alloc_conf() unconditionally drop the reference acquired by the latter before returning (i.e., even if set_conf() has been called). While here, since hold_conf() is always used to obtain additional references on a configuration (new_conf() does not use it, instead directly setting the use count), add an assertion that it is never used on a configuration that has no references at all (which indicates that the configuration has been destroyed). These changes generally simplify the lifecycle of configurations, reducing the probability of re-introducing reference mismatches (at the expense of slightly more reference counting operations, but performance does not matter here). Reviewed by: bapt Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit a7a9e6cc64aa90a899aad9ea1395bfc77bb26f48) --- sys/security/mac_do/mac_do.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 19ea3768153d..8276ac3f9bc5 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -368,14 +368,14 @@ init_exec_paths(struct exec_paths *const exec_paths) } static struct conf * -alloc_conf(void) +new_conf(void) { struct conf *const conf = malloc(sizeof(*conf), M_MAC_DO, M_WAITOK | M_ZERO); init_rules(&conf->rules); init_exec_paths(&conf->exec_paths); - conf->use_count = 0; + refcount_init(&conf->use_count, 1); return (conf); } @@ -1165,7 +1165,10 @@ error: static void hold_conf(struct conf *const conf) { - refcount_acquire(&conf->use_count); + int old_count __diagused = refcount_acquire(&conf->use_count); + + KASSERT(old_count != 0, + ("MAC/do: Trying to resurrect a destroyed configuration.")); } static void @@ -1331,7 +1334,7 @@ set_conf(struct prison *const pr, struct conf *const conf) static void set_default_conf(struct prison *const pr) { - struct conf *const conf = alloc_conf(); + struct conf *const conf = new_conf(); strlcpy(conf->exec_paths.exec_paths_str, "/usr/bin/mdo", MAX_EXEC_PATHS_SIZE); @@ -1339,6 +1342,7 @@ set_default_conf(struct prison *const pr) conf->exec_paths.exec_path_count = 1; set_conf(pr, conf); + drop_conf(conf); } /* @@ -1408,7 +1412,7 @@ parse_and_set_conf(struct prison *pr, const char *rules_string, if (need_applicable_conf) applicable_conf = find_conf(pr, NULL); - conf = alloc_conf(); + conf = new_conf(); if (rules_string != NULL && rules_string[0] != '\0') { error = parse_rules(rules_string, &conf->rules, parse_error); @@ -1431,12 +1435,12 @@ parse_and_set_conf(struct prison *pr, const char *rules_string, MPASS(error == 0 && *parse_error == NULL); out: + drop_conf(conf); if (applicable_conf != NULL) drop_conf(applicable_conf); return (error); error: MPASS(error != 0 && *parse_error != NULL); - drop_conf(conf); goto out; } From nobody Mon Jun 29 19:25:47 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8D4Lbjz6jjTY for ; Mon, 29 Jun 2026 19:25:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8D08TQz40WB for ; Mon, 29 Jun 2026 19:25:48 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761148; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hwyySOeKRcUdP46hT9OIdsW2czOPUbHvP3yLFIZZHvk=; b=Q11EJH3V2Usrm1/k8oyubfKDArM4DEHfvZf2axoUV0O9UFpSu9Vv15ShK9CxnzchwlaHpY 6IfEcGIzKwsZG1y4YbnDyw/eIU1STy8bmBRUKu0d/YyBv9wEJI03FThZjFLhmryeTOBjFs XZCse4sPRJHhUrh9KAfbPRLVHxMyYQOryLPd7SygIDKsmaGBSdNYUWGrdYAYqINr4hPICi E5APOOw+qRvHFlVW7wUJdUzj4hC1CTwbS/BE/qCXmfCETk2gNQGVM+ZJpaWGY0lYLWjmkU 4jk2u8f26ZBWfdKxusSS/mMh23E5Xw9xHQTfdeVeY6wvK6h+fPV2ZTNNUmeYVg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761148; a=rsa-sha256; cv=none; b=lWzo6rzMmJwIiS4KUjv6QHwYaT3R1wFzijaRk9y4Eym51LArAnkX+sRjR+HGi2s3m9C0Ja O63dqW9H01w5N0wP69Y/of0ReP6ClK1Cu49OLVrVyUjVy7QumxewYAzKeUyWvdRlKDLh7I TJXfc06TwFFfPFZVOJKgKMuXxWgfH+w9HyGLNd65i84PENIZK+eztxFPKPzuM8LV2GeJKx gCsZabeM8bJNbaUQnvVvfmnNtbVmeUdYbkYtR8MneiTCx0P2PM5TFvY2PAh+sWHgOSsNtM kXfrDnfwv56j6vB+6BV9ctgYIheM3wI20WzGIfrzpbhYOWOUMj/VYpT/10qCDw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761148; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hwyySOeKRcUdP46hT9OIdsW2czOPUbHvP3yLFIZZHvk=; b=neD5cwAtT90P2Z1vq7xRovnStmXmEOf/NEqeJGTL1rNhnwntV/M4vuPL22ASF5wEe2wN0f 0OLA0f/PBxFkaKFgKn3XXoeSFP4b6yckthhgRMLWtzIWZ7lbkCo+j6z9J4cVri3nREeZJQ WSeBUmm3QxTASODjAuwuBHFCjKLNBrX0bBW9GOmUIdBKu1cZHulKSdGCq7nXl4YW1xgpdA RyNexeL7+axqCndpYuNjDFZ3RVpnkgQa/NF9N/Ik+9ZqjvR0ziUkGGQWQnDdCQD4ah5hMk LIzQ8oi8zEm1rmk9xChh5jJN33jszVyH6wti5mYyoHKdzylqVSBRlD9oH7K4iw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8C5y7Mz19bW for ; Mon, 29 Jun 2026 19:25:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21b72 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:47 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: c8394ff0c615 - stable/15 - MAC/do: Move static assertions on constants close to their definitions List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: c8394ff0c61514f3fc73f705450061883874e337 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:47 +0000 Message-Id: <6a42c6bb.21b72.3cc74e42@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=c8394ff0c61514f3fc73f705450061883874e337 commit c8394ff0c61514f3fc73f705450061883874e337 Author: Olivier Certner AuthorDate: 2026-05-20 09:38:37 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:45 +0000 MAC/do: Move static assertions on constants close to their definitions And document more clearly their purpose. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 4e27cc086b3f9e029160da8830abacb06a2f9e39) --- sys/security/mac_do/mac_do.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index f2206c85c489..8868a6eb432f 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -47,10 +47,14 @@ SYSCTL_INT(_security_mac_do, OID_AUTO, print_parse_error, CTLFLAG_RWTUN, static MALLOC_DEFINE(M_MAC_DO, "mac_do", "mac_do(4) security module"); +#define MAX_RULE_STRING_SIZE 1024 +_Static_assert(MAX_RULE_STRING_SIZE > 0, + "MAX_RULE_STRING_SIZE: No space for the NUL terminator!"); + #define MAX_EXEC_PATHS_SIZE 2048 #define MAX_EXEC_PATHS 8 - -#define MAX_RULE_STRING_SIZE 1024 +_Static_assert(MAX_EXEC_PATHS_SIZE > 0, + "MAX_EXEC_PATHS_SIZE: No space for the NUL terminator!"); static unsigned osd_jail_slot; static unsigned osd_thread_slot; @@ -355,14 +359,12 @@ toast_rules(struct rules *const rules) static void init_rules(struct rules *const rules) { - _Static_assert(MAX_RULE_STRING_SIZE > 0, "MAX_RULE_STRING_SIZE <= 0!"); STAILQ_INIT(&rules->head); } static void init_exec_paths(struct exec_paths *const exec_paths) { - _Static_assert(MAX_EXEC_PATHS_SIZE > 0, "MAX_EXEC_PATHS_SIZE <= 0!"); bzero(exec_paths, sizeof(*exec_paths)); exec_paths->exec_paths_str[0] = 0; } From nobody Mon Jun 29 19:25:32 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8D3QWmz6jjTW for ; Mon, 29 Jun 2026 19:25:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8C6y1tz40Qb for ; Mon, 29 Jun 2026 19:25:47 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761148; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BR0yLkqiS3Oq/Si7+GvuHMo506CJpQ2p8Uyns2OTYzo=; b=uGS0Sv1HBIsfbXXezZToyn2WLLSNYzNzTMylUTbwEjGChiy9ssvxrpTwmZOIlrguA0UHHP 6ojdZZN/rQF8HYKmTPx2FPB/cKG9nu3qwQR/oWvTQ3d3+W5VHN7aercBsWmdbDZPYGqvxe iBSd1+grXynoYYTM/poxFBnciZeJIxkz3C7yjbtHWpzwvfJZlTGou8IMIccJwHcPLU1JWf 69rcxe6r7rBarcRjhtaGNr/0qPfqMqYaNWQCLVlsB+6Wd2GdgclGx16xbPDy65GRoiTiQL eM9aj5ttiXdJRrotXQXwrdDh4UOWC8yaHFdbs62ls6cM5rHTQ6l0J3qHe+dLpw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761148; a=rsa-sha256; cv=none; b=EPDZVRTxlXDTCl2qo4sVTGbfBwwILDQ9O+YDAICEMwux9rjMgM2yNuXYdpXR8TgHSjSD1H 8t1s8GB6x9el93mT7sEECp/ZfSQEKFvF79OCmdAMVOrMgSJWc84xSsnhjXXiWb+Ezsg40m xK5gl7WoCVUYOF8Ha9ZJMNmNVz0M1b/ZuOEq9+AURKtYXKStpteMrmwK12dS1oidxSwEtZ Vvjsie0FDCperNef9DKVWRQUdYfoqntwS+DaFq0gUn32EQdy5Ig9/gly16XxZZdKkN0DcW 78kAdj+wQ7oIdGAG6ROy3YHcpnhExavi6zGnUHw3NWateZQPAJI7VFpviEcXGA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761148; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BR0yLkqiS3Oq/Si7+GvuHMo506CJpQ2p8Uyns2OTYzo=; b=vbz61uPrN5zDp2YNWVjDEXHZVLnPX/bpMWJxhmN1KruGanZ7iK6eKBhtKeQQp6yaRz85G0 gP+dU93WUAgObuV7o5NKI3+pk0+z3DrMpqv/yBmwGGwBsEAc78ziqiz4Kk2vMNntsdQ9Dx s9loFKHOZp8bGn4RkmZU1ajbHfBjCuOEu8OKvpn65J78ly6KBbQDUsvR8wtCohPo1lEz6T bYaLvwaUC+lWnrUYBYcrjvI08L/GNeHBUCTvkSduCWAhm1qBseSIsoEBg6RRW+pF1D2tk6 PnFLMQ2Pak8SbXHfa2Zh0bGrDchODiQ0aJXsp9iDi9UPOK86IapkilN0A35ePQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8C5rNbz19Xb for ; Mon, 29 Jun 2026 19:25:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21fba by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:32 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Kushagra Srivastava From: Olivier Certner Subject: git: 8cbd56ec1c54 - stable/15 - MAC/do: Executable paths feature (GSoC 2025's final state) List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 8cbd56ec1c543dfe41680bc9fd5f3c4d6183e3f1 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:32 +0000 Message-Id: <6a42c6ac.21fba.12ab3105@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=8cbd56ec1c543dfe41680bc9fd5f3c4d6183e3f1 commit 8cbd56ec1c543dfe41680bc9fd5f3c4d6183e3f1 Author: Kushagra Srivastava AuthorDate: 2025-08-14 14:41:57 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:29 +0000 MAC/do: Executable paths feature (GSoC 2025's final state) By design, mac_do(4) only authorizes credentials change requests if they are issued by a process spawned from '/usr/bin/mdo'. The executable paths feature introduces some flexibility by allowing to change that path, thus allowing another executable to make requests, and to use multiple such paths (up to 8 in the current implementation). Its purpose is to enable thin jails scenarios where mdo(1) may not be at its canonical path ('/usr/bin/mdo') and to allow experimenting with other userland programs leveraging setcred(2). Configuration of executable paths is per-jail and intentionally works completely similarly with rules. It is accessible from within a jail through the 'security.mac.do.exec_paths' sysctl knob and from outside a jail through the 'mac.do.exec_paths' jail parameter. This commit groups the verbatim changes of the following commits that Kushagra Srivastava, our GSoC 2025 student, created in his GitHub repository (https://github.com/thesynthax/freebsd-src), branch 'task/exec-paths-refactor': mac_do(4): Complete refactor of allowed executable paths feature mac_do(4): Fixed changing security.mac.do.* knobs in inheritance mode mac_do(4): Debugging rules and exec_paths leak on destroy mac_do(4): Deep copy rules mac_do(4): Fixed leak mac_do(4): fixed various bugs, structs inlined, leaks remain mac_do(4): MAC/do working in jail, leaks decreased mac_do(4): MAC/do fixed, works in host and jails, leaks removed mac_do(4): style Frozen log for these commits: https://github.com/OlCe2/freebsd-src/compare/main...14fdc49fb29265fac5d0daf95a13d0dce325c951. The corresponding pull request is at: https://github.com/OlCe2/freebsd-src/pull/2. The GSoC's final state of this code still has a number of problems that are fixed in subsequent commits. It is however committed separately to clearly delineate Kushagra's work. Reviewed by: olce (amendments to come, see above) MFC after: 1 month Relnotes: yes Sponsored by: Google LLC (GSoC 2025) Sponsored by: The FreeBSD Foundation (review, commit) Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 9818224174c41a434028446fb6fa5516a6291755) --- sys/security/mac_do/mac_do.c | 581 +++++++++++++++++++++++++++++++------------ 1 file changed, 422 insertions(+), 159 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 790701e57e56..33904f09a6f4 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -46,6 +46,9 @@ SYSCTL_INT(_security_mac_do, OID_AUTO, print_parse_error, CTLFLAG_RWTUN, static MALLOC_DEFINE(M_MAC_DO, "mac_do", "mac_do(4) security module"); +#define EXEC_PATHS_MAXLEN 2048 +#define MAX_EXEC_PATHS 8 + #define MAC_RULE_STRING_LEN 1024 static unsigned osd_jail_slot; @@ -169,6 +172,17 @@ STAILQ_HEAD(rulehead, rule); struct rules { char string[MAC_RULE_STRING_LEN]; struct rulehead head; +}; + +struct exec_paths { + char exec_paths_str[EXEC_PATHS_MAXLEN]; + char exec_paths[MAX_EXEC_PATHS][PATH_MAX]; + int exec_path_count; +}; + +struct conf { + struct rules rules; + struct exec_paths exec_paths; volatile u_int use_count __aligned(CACHE_LINE_SIZE); }; @@ -325,19 +339,34 @@ toast_rules(struct rules *const rules) free(rule->gids, M_MAC_DO); free(rule, M_MAC_DO); } - free(rules, M_MAC_DO); } -static struct rules * -alloc_rules(void) +/* Assuming storage is zeroed already */ +static void +init_rules(struct rules *const rules) { - struct rules *const rules = malloc(sizeof(*rules), M_MAC_DO, M_WAITOK); - _Static_assert(MAC_RULE_STRING_LEN > 0, "MAC_RULE_STRING_LEN <= 0!"); - rules->string[0] = 0; STAILQ_INIT(&rules->head); - rules->use_count = 0; - return (rules); +} + +static void +init_exec_paths(struct exec_paths *const exec_paths) +{ + _Static_assert(EXEC_PATHS_MAXLEN > 0, "EXEC_PATHS_MAXLEN <= 0!"); + bzero(exec_paths, sizeof(*exec_paths)); + exec_paths->exec_paths_str[0] = 0; +} + +static struct conf * +alloc_conf(void) +{ + struct conf *const conf = malloc(sizeof(*conf), M_MAC_DO, M_WAITOK | M_ZERO); + + init_rules(&conf->rules); + init_exec_paths(&conf->exec_paths); + conf->use_count = 0; + + return (conf); } static bool @@ -1009,12 +1038,11 @@ einval: * - "gid=1010>gid=1011,gid=1012,gid=1013" */ static int -parse_rules(const char *const string, struct rules **const rulesp, +parse_rules(const char *const string, struct rules *const rules, struct parse_error **const parse_error) { const size_t len = strlen(string); char *copy, *p, *rule; - struct rules *rules; int error = 0; *parse_error = NULL; @@ -1026,7 +1054,6 @@ parse_rules(const char *const string, struct rules **const rulesp, return (ENAMETOOLONG); } - rules = alloc_rules(); bcopy(string, rules->string, len + 1); MPASS(rules->string[len] == '\0'); /* Catch some races. */ @@ -1046,31 +1073,90 @@ parse_rules(const char *const string, struct rules **const rulesp, } } - *rulesp = rules; +out: + free(copy, M_MAC_DO); + return (error); +} + +static int +parse_exec_paths(const char *const string, struct exec_paths *const exec_paths, + struct parse_error **const parse_error) +{ + const size_t len = strlen(string); + char *copy, *p, *path; + int error = 0; + + *parse_error = NULL; + + if (len >= EXEC_PATHS_MAXLEN) { + make_parse_error(parse_error, 0, + "Exec path specification string is too long (%zu, max %u)", + len, EXEC_PATHS_MAXLEN - 1); + return (ENAMETOOLONG); + } + + bcopy(string, exec_paths->exec_paths_str, len + 1); + MPASS(exec_paths->exec_paths_str[len] == '\0'); + + copy = malloc(len + 1, M_MAC_DO, M_WAITOK); + bcopy(string, copy, len + 1); + MPASS(copy[len] == '\0'); + + p = copy; + while ((path = strsep_noblanks(&p, ":")) != NULL) { + if (*path == '\0') + continue; + + if (exec_paths->exec_path_count >= MAX_EXEC_PATHS) { + make_parse_error(parse_error, path - copy, + "Too many exec paths specified (max %d)", MAX_EXEC_PATHS); + error = EINVAL; + goto out; + } + + const size_t path_len = strlen(path); + if (path_len >= PATH_MAX) { + make_parse_error(parse_error, path - copy, + "Exec paths too long (%zu, max %u)", + path_len, PATH_MAX - 1); + error = ENAMETOOLONG; + goto out; + } + + strlcpy(exec_paths->exec_paths[exec_paths->exec_path_count], path, PATH_MAX); + exec_paths->exec_path_count++; + } + + if (exec_paths->exec_path_count == 0) { + make_parse_error(parse_error, 0, "No valid exec paths found"); + error = EINVAL; + goto out; + } + out: free(copy, M_MAC_DO); return (error); } /* - * Find rules applicable to the passed prison. + * Find conf applicable to the passed prison. * - * Returns the applicable rules (and never NULL). 'pr' must be unlocked. + * Returns the applicable conf (and never NULL). 'pr' must be unlocked. * 'aprp' is set to the (ancestor) prison holding these, and it must be unlocked - * once the caller is done accessing the rules. '*aprp' is equal to 'pr' if and - * only if the current jail has its own set of rules. + * once the caller is done accessing the conf. '*aprp' is equal to 'pr' if and + * only if the current jail has its own set of conf. */ -static struct rules * -find_rules(struct prison *const pr, struct prison **const aprp) +static struct conf * +find_conf(struct prison *const pr, struct prison **const aprp) { struct prison *cpr, *ppr; - struct rules *rules; + struct conf *conf; cpr = pr; for (;;) { prison_lock(cpr); - rules = osd_jail_get(cpr, osd_jail_slot); - if (rules != NULL) + conf = osd_jail_get(cpr, osd_jail_slot); + if (conf != NULL) break; prison_unlock(cpr); @@ -1080,34 +1166,36 @@ find_rules(struct prison *const pr, struct prison **const aprp) } *aprp = cpr; - return (rules); + return (conf); } static void -hold_rules(struct rules *const rules) +hold_conf(struct conf *const conf) { - refcount_acquire(&rules->use_count); + refcount_acquire(&conf->use_count); } static void -drop_rules(struct rules *const rules) +drop_conf(struct conf *const conf) { - if (refcount_release(&rules->use_count)) - toast_rules(rules); + if (refcount_release(&conf->use_count)) { + toast_rules(&conf->rules); + free(conf, M_MAC_DO); + } } #ifdef INVARIANTS static void -check_rules_use_count(const struct rules *const rules, u_int expected) +check_conf_use_count(const struct conf *const conf, u_int expected) { - const u_int use_count = refcount_load(&rules->use_count); + const u_int use_count = refcount_load(&conf->use_count); if (use_count != expected) - panic("MAC/do: Rules at %p: Use count is %u, expected %u", - rules, use_count, expected); + panic("MAC/do: Conf at %p: Use count is %u, expected %u", + conf, use_count, expected); } #else -#define check_rules_use_count(...) +#define check_conf_use_count(...) #endif /* INVARIANTS */ /* @@ -1119,7 +1207,7 @@ check_rules_use_count(const struct rules *const rules, u_int expected) static void dealloc_jail_osd(void *const value) { - struct rules *const rules = value; + struct conf *const conf = value; /* * If called because the "holding" jail goes down, no one should be @@ -1135,8 +1223,8 @@ dealloc_jail_osd(void *const value) * we ensure that all thread's slots are freed first in mac_do_destroy() * to be able to check that only one reference remains. */ - check_rules_use_count(rules, 1); - toast_rules(rules); + check_conf_use_count(conf, 1); + drop_conf(conf); } /* @@ -1148,9 +1236,9 @@ dealloc_jail_osd(void *const value) * Destroys the 'osd_jail_slot' slot of the passed jail. */ static void -remove_rules(struct prison *const pr) +remove_conf(struct prison *const pr) { - struct rules *old_rules; + struct conf *old_conf; int error __unused; prison_lock(pr); @@ -1160,7 +1248,7 @@ remove_rules(struct prison *const pr) * decrement their use count, and possibly free them, outside of the * prison lock. */ - old_rules = osd_jail_get(pr, osd_jail_slot); + old_conf = osd_jail_get(pr, osd_jail_slot); error = osd_jail_set(pr, osd_jail_slot, NULL); /* osd_set() never allocates memory when 'value' is NULL, nor fails. */ MPASS(error == 0); @@ -1171,40 +1259,40 @@ remove_rules(struct prison *const pr) osd_jail_del(pr, osd_jail_slot); prison_unlock(pr); - if (old_rules != NULL) - drop_rules(old_rules); + if (old_conf != NULL) + drop_conf(old_conf); } -/* - * Assign already built rules to a jail. - */ static void -set_rules(struct prison *const pr, struct rules *const rules) +set_conf(struct prison *const pr, struct conf *const conf) { - struct rules *old_rules; + struct conf *old_conf; void **rsv; - check_rules_use_count(rules, 0); - hold_rules(rules); + hold_conf(conf); rsv = osd_reserve(osd_jail_slot); prison_lock(pr); - old_rules = osd_jail_get(pr, osd_jail_slot); - osd_jail_set_reserved(pr, osd_jail_slot, rsv, rules); + old_conf = osd_jail_get(pr, osd_jail_slot); + osd_jail_set_reserved(pr, osd_jail_slot, rsv, conf); prison_unlock(pr); - if (old_rules != NULL) - drop_rules(old_rules); + if (old_conf != NULL) + drop_conf(old_conf); } /* - * Assigns empty rules to a jail. + * Assigns default conf to a jail. */ static void -set_empty_rules(struct prison *const pr) +set_default_conf(struct prison *const pr) { - struct rules *const rules = alloc_rules(); + struct conf *const conf = alloc_conf(); + + strlcpy(conf->exec_paths.exec_paths_str, "/usr/bin/mdo", EXEC_PATHS_MAXLEN); + strlcpy(conf->exec_paths.exec_paths[0], "/usr/bin/mdo", PATH_MAX); + conf->exec_paths.exec_path_count = 1; - set_rules(pr, rules); + set_conf(pr, conf); } /* @@ -1212,18 +1300,99 @@ set_empty_rules(struct prison *const pr) * * Returns the same error code as parse_rules() (which see). */ -static int -parse_and_set_rules(struct prison *const pr, const char *rules_string, - struct parse_error **const parse_error) + +static void +clone_rules(struct rules *dst, struct rules *const src) { - struct rules *rules; - int error; + struct rule *src_rule, *dst_rule; + + bzero(dst, sizeof(*dst)); + strlcpy(dst->string, src->string, sizeof(dst->string)); + STAILQ_INIT(&dst->head); + + STAILQ_FOREACH(src_rule, &src->head, r_entries) { + dst_rule = malloc(sizeof(*dst_rule), M_MAC_DO, M_WAITOK | M_ZERO); + bcopy(src_rule, dst_rule, sizeof(*dst_rule)); + + if (src_rule->uids_nb > 0) { + dst_rule->uids = malloc(sizeof(*dst_rule->uids) * src_rule->uids_nb, + M_MAC_DO, M_WAITOK); + bcopy(src_rule->uids, dst_rule->uids, + sizeof(*dst_rule->uids) * src_rule->uids_nb); + } + + if (src_rule->gids_nb > 0) { + dst_rule->gids = malloc(sizeof(*dst_rule->gids) * src_rule->gids_nb, + M_MAC_DO, M_WAITOK); + bcopy(src_rule->gids, dst_rule->gids, + sizeof(*dst_rule->gids) * src_rule->gids_nb); + } - error = parse_rules(rules_string, &rules, parse_error); + STAILQ_INSERT_TAIL(&dst->head, dst_rule, r_entries); + } +} + +static void +clone_exec_paths(struct exec_paths *dst, struct exec_paths *const src) +{ + bzero(dst, sizeof(*dst)); + dst->exec_path_count = src->exec_path_count; + for (int i = 0; i < src->exec_path_count; i++) { + strlcpy(dst->exec_paths[i], src->exec_paths[i], + sizeof(dst->exec_paths[i])); + } + + strlcpy(dst->exec_paths_str, src->exec_paths_str, + sizeof(dst->exec_paths_str)); +} + +static int +parse_and_set_conf(struct prison *pr, const char *rules_string, + const char *exec_paths_string, struct parse_error **parse_error) +{ + struct prison *ppr = NULL; + struct conf *applicable_conf = NULL; + struct conf *conf; + int error = 0; + bool need_applicable_conf; + + *parse_error = NULL; + + need_applicable_conf = (rules_string == NULL || rules_string[0] == '\0' || + exec_paths_string == NULL || exec_paths_string[0] == '\0'); + + if (need_applicable_conf) { + applicable_conf = find_conf(pr, &ppr); + hold_conf(applicable_conf); + prison_unlock(ppr); + } + + conf = alloc_conf(); + + if (rules_string != NULL && rules_string[0] != '\0') { + error = parse_rules(rules_string, &conf->rules, parse_error); + if (error != 0) + goto out; + } + else if (applicable_conf != NULL) + clone_rules(&conf->rules, &applicable_conf->rules); + + if (exec_paths_string != NULL && exec_paths_string[0] != '\0') { + error = parse_exec_paths(exec_paths_string, &conf->exec_paths, parse_error); + if (error != 0) + goto out; + } else if (applicable_conf != NULL) + clone_exec_paths(&conf->exec_paths, &applicable_conf->exec_paths); + + set_conf(pr, conf); + +out: + if (applicable_conf != NULL) + drop_conf(applicable_conf); if (error != 0) - return (error); - set_rules(pr, rules); - return (0); + drop_conf(conf); + + return (error); } static int @@ -1232,12 +1401,12 @@ mac_do_sysctl_rules(SYSCTL_HANDLER_ARGS) char *const buf = malloc(MAC_RULE_STRING_LEN, M_MAC_DO, M_WAITOK); struct prison *const td_pr = req->td->td_ucred->cr_prison; struct prison *pr; - struct rules *rules; + struct conf *conf; struct parse_error *parse_error; int error; - rules = find_rules(td_pr, &pr); - strlcpy(buf, rules->string, MAC_RULE_STRING_LEN); + conf = find_conf(td_pr, &pr); + strlcpy(buf, conf->rules.string, MAC_RULE_STRING_LEN); prison_unlock(pr); error = sysctl_handle_string(oidp, buf, MAC_RULE_STRING_LEN, req); @@ -1245,13 +1414,14 @@ mac_do_sysctl_rules(SYSCTL_HANDLER_ARGS) goto out; /* Set our prison's rules, not that of the jail we inherited from. */ - error = parse_and_set_rules(td_pr, buf, &parse_error); + error = parse_and_set_conf(td_pr, buf, NULL, &parse_error); if (error != 0) { if (print_parse_error) printf("MAC/do: Parse error at index %zu: %s\n", parse_error->pos, parse_error->msg); free_parse_error(parse_error); } + out: free(buf, M_MAC_DO); return (error); @@ -1267,13 +1437,52 @@ SYSCTL_JAIL_PARAM_SYS_SUBNODE(mac, do, CTLFLAG_RW, "Jail MAC/do parameters"); SYSCTL_JAIL_PARAM_STRING(_mac_do, rules, CTLFLAG_RW, MAC_RULE_STRING_LEN, "Jail MAC/do rules"); +static int +mac_do_sysctl_exec_paths(SYSCTL_HANDLER_ARGS) +{ + char *const buf = malloc(EXEC_PATHS_MAXLEN, M_MAC_DO, M_WAITOK); + struct prison *const td_pr = req->td->td_ucred->cr_prison; + struct prison *pr; + struct conf *conf; + struct parse_error *parse_error; + int error; + + conf = find_conf(td_pr, &pr); + strlcpy(buf, conf->exec_paths.exec_paths_str, EXEC_PATHS_MAXLEN); + prison_unlock(pr); + + error = sysctl_handle_string(oidp, buf, EXEC_PATHS_MAXLEN, req); + if (error != 0 || req->newptr == NULL) + goto out; + + error = parse_and_set_conf(td_pr, NULL, buf, &parse_error); + if (error != 0) { + if (print_parse_error) + printf("MAC/do: Parse error at index %zu: %s\n", + parse_error->pos, parse_error->msg); + free_parse_error(parse_error); + } + +out: + free(buf, M_MAC_DO); + return (error); +} + +SYSCTL_PROC(_security_mac_do, OID_AUTO, exec_paths, + CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_PRISON | CTLFLAG_MPSAFE, + 0, 0, mac_do_sysctl_exec_paths, "A", + "Colon-separated list of allowed executables"); + +SYSCTL_JAIL_PARAM_STRING(_mac_do, exec_paths, CTLFLAG_RW, EXEC_PATHS_MAXLEN, + "Jail MAC/do executable paths"); static int -mac_do_jail_create(void *obj, void *data __unused) +mac_do_jail_create(void *obj, void *data) { struct prison *const pr = obj; - set_empty_rules(pr); + set_default_conf(pr); + return (0); } @@ -1282,10 +1491,14 @@ mac_do_jail_get(void *obj, void *data) { struct prison *ppr, *const pr = obj; struct vfsoptlist *const opts = data; + struct conf *conf; struct rules *rules; + struct exec_paths *exec_paths; int jsys, error; - rules = find_rules(pr, &ppr); + conf = find_conf(pr, &ppr); + rules = &conf->rules; + exec_paths = &conf->exec_paths; jsys = pr == ppr ? (STAILQ_EMPTY(&rules->head) ? JAIL_SYS_DISABLE : JAIL_SYS_NEW) : @@ -1298,6 +1511,10 @@ mac_do_jail_get(void *obj, void *data) if (error != 0 && error != ENOENT) goto done; + error = vfs_setopts(opts, "mac.do.exec_paths", exec_paths->exec_paths_str); + if (error != 0 && error != ENOENT) + goto done; + error = 0; done: prison_unlock(ppr); @@ -1315,13 +1532,16 @@ _Static_assert(-1 != JAIL_SYS_DISABLE && -1 != JAIL_SYS_NEW && * We perform only cheap checks here, i.e., we do not really parse the rules * specification string, if any. */ + static int mac_do_jail_check(void *obj, void *data) { struct vfsoptlist *opts = data; - char *rules_string; - int error, jsys, size; + char *rules_string, *exec_paths_string; + int error, jsys, rules_len = 0, exec_paths_len = 0; + bool has_rules, has_exec_paths; + /* Mark unspecified */ error = vfs_copyopt(opts, "mac.do", &jsys, sizeof(jsys)); if (error == ENOENT) jsys = -1; @@ -1339,60 +1559,82 @@ mac_do_jail_check(void *obj, void *data) * jail_set() calls vfs_getopts() itself later (they becoming * inconsistent wouldn't cause any security problem). */ - error = vfs_getopt(opts, "mac.do.rules", (void**)&rules_string, &size); - if (error == ENOENT) { - /* - * Default (in absence of "mac.do.rules") is to disable (and, in - * particular, not inherit). - */ - if (jsys == -1) - jsys = JAIL_SYS_DISABLE; - - if (jsys == JAIL_SYS_NEW) { - vfs_opterror(opts, "'mac.do.rules' must be specified " - "given 'mac.do''s value"); + error = vfs_getopt(opts, "mac.do.rules", (void **)&rules_string, &rules_len); + if (error == ENOENT) + rules_string = NULL; + else { + if (error != 0) + return (error); + if (rules_len == 0 || rules_string[rules_len - 1] != '\0') { + vfs_opterror(opts, "'mac.do.rules' not a proper string"); return (EINVAL); } + if (rules_len > MAC_RULE_STRING_LEN) { + vfs_opterror(opts, "'mac.do.rules' too long"); + return (ENAMETOOLONG); + } + } - /* Absence of "mac.do.rules" at this point is OK. */ - error = 0; - } else { + /* Handle 'exec_paths' input */ + error = vfs_getopt(opts, "mac.do.exec_paths", (void **)&exec_paths_string, &exec_paths_len); + if (error == ENOENT) + exec_paths_string = NULL; + else { if (error != 0) return (error); - - /* Not a proper string. */ - if (size == 0 || rules_string[size - 1] != '\0') { - vfs_opterror(opts, "'mac.do.rules' not a proper string"); + if (exec_paths_len == 0 || exec_paths_string[exec_paths_len - 1] != '\0') { + vfs_opterror(opts, "'mac.do.exec_paths' not a proper string"); return (EINVAL); } - - if (size > MAC_RULE_STRING_LEN) { - vfs_opterror(opts, "'mdo.rules' too long"); + if (exec_paths_len > EXEC_PATHS_MAXLEN) { + vfs_opterror(opts, "'mac.do.exec_paths' too long"); return (ENAMETOOLONG); } + } - if (jsys == -1) - /* Default (if "mac.do.rules" is present). */ - jsys = rules_string[0] == '\0' ? JAIL_SYS_DISABLE : - JAIL_SYS_NEW; + /* + * Be liberal, considering that an empty rule or exec paths specification + * is equivalent to no specification. + * This affects the JAIL_SYS_DISABLE and JAIL_SYS_INHERIT sanity checks below. + */ + has_rules = rules_string && rules_string[0] != '\0'; + has_exec_paths = exec_paths_string && exec_paths_string[0] != '\0'; - /* - * Be liberal and accept JAIL_SYS_DISABLE and JAIL_SYS_INHERIT - * with an explicit empty rules specification. - */ - switch (jsys) { - case JAIL_SYS_DISABLE: - case JAIL_SYS_INHERIT: - if (rules_string[0] != '\0') { - vfs_opterror(opts, "'mac.do.rules' specified " - "but should not given 'mac.do''s value"); - return (EINVAL); - } - break; + /* Infer 'jsys' if needed */ + if (jsys == -1) { + if (has_rules || has_exec_paths) + jsys = JAIL_SYS_NEW; + else + jsys = JAIL_SYS_DISABLE; + } + + /* Final checks based on resolved 'jsys' */ + switch (jsys) { + case JAIL_SYS_DISABLE: + case JAIL_SYS_INHERIT: + if (has_rules) { + vfs_opterror(opts, "'mac.do.rules' specified but should not be when mac.do is disabled or inherited"); + return (EINVAL); + } + if (has_exec_paths) { + vfs_opterror(opts, "'mac.do.exec_paths' specified but should not be when mac.do is disabled or inherited"); + return (EINVAL); } + break; + + case JAIL_SYS_NEW: + if (!has_rules && !has_exec_paths) { + vfs_opterror(opts, "mac.do set to 'new' but neither rules nor exec_paths specified"); + return (EINVAL); + } + /* Allow: rules only, exec_paths only (though exec_paths only is discouraged), or both */ + break; + + default: + __assert_unreachable(); } - return (error); + return (0); } static int @@ -1400,9 +1642,10 @@ mac_do_jail_set(void *obj, void *data) { struct prison *pr = obj; struct vfsoptlist *opts = data; - char *rules_string; - struct parse_error *parse_error; + char *rules_string, *exec_paths_string; + struct parse_error *parse_error = NULL; int error, jsys; + bool has_rules, has_exec_paths; /* * The invariants checks used below correspond to what has already been @@ -1416,49 +1659,50 @@ mac_do_jail_set(void *obj, void *data) rules_string = vfs_getopts(opts, "mac.do.rules", &error); MPASS(error == 0 || error == ENOENT); - if (error == 0) { - MPASS(strlen(rules_string) < MAC_RULE_STRING_LEN); - if (jsys == -1) - /* Default (if "mac.do.rules" is present). */ - jsys = rules_string[0] == '\0' ? JAIL_SYS_DISABLE : - JAIL_SYS_NEW; + exec_paths_string = vfs_getopts(opts, "mac.do.exec_paths", &error); + MPASS(error == 0 || error == ENOENT); + + has_rules = (rules_string != NULL && rules_string[0] != '\0'); + has_exec_paths = (exec_paths_string != NULL && exec_paths_string[0] != '\0'); + + if (jsys == -1) { + if (has_rules || has_exec_paths) + jsys = JAIL_SYS_NEW; else - MPASS(jsys == JAIL_SYS_NEW || - ((jsys == JAIL_SYS_DISABLE || - jsys == JAIL_SYS_INHERIT) && - rules_string[0] == '\0')); - } else { - MPASS(jsys != JAIL_SYS_NEW); - if (jsys == -1) - /* - * Default (in absence of "mac.do.rules") is to disable - * (and, in particular, not inherit). - */ jsys = JAIL_SYS_DISABLE; - /* If disabled, we'll store an empty rule specification. */ - if (jsys == JAIL_SYS_DISABLE) - rules_string = ""; } switch (jsys) { case JAIL_SYS_INHERIT: - remove_rules(pr); - error = 0; - break; + remove_conf(pr); + return (0); + case JAIL_SYS_DISABLE: + rules_string = ""; + has_rules = true; + /* FALLTHROUGH */ + case JAIL_SYS_NEW: - error = parse_and_set_rules(pr, rules_string, &parse_error); + error = parse_and_set_conf(pr, + has_rules ? rules_string : NULL, + has_exec_paths ? exec_paths_string : NULL, + &parse_error); + if (error != 0) { - vfs_opterror(opts, - "MAC/do: Parse error at index %zu: %s\n", - parse_error->pos, parse_error->msg); - free_parse_error(parse_error); + if (parse_error != NULL) { + vfs_opterror(opts, "MAC/do: Parse error at index %zu: %s\n", + parse_error->pos, parse_error->msg); + free_parse_error(parse_error); + } + + return (error); } - break; + + return (0); + default: __assert_unreachable(); } - return (error); } /* @@ -1495,7 +1739,7 @@ struct mac_do_data_header { */ int priv; /* Rules to apply. */ - struct rules *rules; + struct conf *conf; }; /* @@ -1538,7 +1782,7 @@ clear_data(void *const data) struct mac_do_data_header *const hdr = data; if (hdr != NULL) { - drop_rules(hdr->rules); + drop_conf(hdr->conf); /* We don't deallocate so as to save time on next access. */ hdr->priv = 0; } @@ -1560,7 +1804,7 @@ is_data_reusable(const void *const data, const size_t size) static void set_data_header(void *const data, const size_t size, const int priv, - struct rules *const rules) + struct conf *const conf) { struct mac_do_data_header *const hdr = data; @@ -1569,7 +1813,7 @@ set_data_header(void *const data, const size_t size, const int priv, MPASS(size <= hdr->allocated_size); hdr->size = size; hdr->priv = priv; - hdr->rules = rules; + hdr->conf = conf; } /* The proc lock (and any other non-sleepable lock) must not be held. */ @@ -1935,7 +2179,7 @@ static int mac_do_priv_grant(struct ucred *cred, int priv) { struct mac_do_setcred_data *const data = fetch_data(); - const struct rules *rules; + struct rules *rules; const struct ucred *new_cred; const struct rule *rule; u_int setcred_flags; @@ -1952,7 +2196,7 @@ mac_do_priv_grant(struct ucred *cred, int priv) /* No. */ return (EPERM); - rules = data->hdr.rules; + rules = &data->hdr.conf->rules; new_cred = data->new_cred; KASSERT(new_cred != NULL, ("priv_check*() called before mac_cred_check_setcred()")); @@ -1990,7 +2234,7 @@ static int check_proc(void) { char *path, *to_free; - int error; + int error = EPERM; /* * Only grant privileges if requested by the right executable. @@ -2012,7 +2256,26 @@ check_proc(void) */ if (vn_fullpath_jail(curproc->p_textvp, &path, &to_free) != 0) return (EPERM); - error = strcmp(path, "/usr/bin/mdo") == 0 ? 0 : EPERM; + + struct conf *conf; + struct exec_paths *exec_paths; + struct prison *td_pr = curproc->p_ucred->cr_prison; + struct prison *pr; + conf = find_conf(td_pr, &pr); + exec_paths = &conf->exec_paths; + + if (exec_paths->exec_path_count > 0) { + for (int i = 0; i < exec_paths->exec_path_count; i++) { + if (strcmp(exec_paths->exec_paths[i], path) == 0) { + error = 0; + break; + } + } + + } + + prison_unlock(pr); + free(to_free, M_TEMP); return (error); } @@ -2020,9 +2283,9 @@ check_proc(void) static void mac_do_setcred_enter(void) { - struct rules *rules; struct prison *pr; struct mac_do_setcred_data * data; + struct conf *conf; int error; /* @@ -2044,8 +2307,8 @@ mac_do_setcred_enter(void) /* * Find the currently applicable rules. */ - rules = find_rules(curproc->p_ucred->cr_prison, &pr); - hold_rules(rules); + conf = find_conf(curproc->p_ucred->cr_prison, &pr); + hold_conf(conf); prison_unlock(pr); /* @@ -2054,7 +2317,7 @@ mac_do_setcred_enter(void) data = fetch_data(); if (!is_data_reusable(data, sizeof(*data))) data = alloc_data(data, sizeof(*data)); - set_data_header(data, sizeof(*data), PRIV_CRED_SETCRED, rules); + set_data_header(data, sizeof(*data), PRIV_CRED_SETCRED, conf); /* Not really necessary, but helps to catch programming errors. */ *** 15 LINES SKIPPED *** From nobody Mon Jun 29 19:25:46 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8C0VzMz6jjLK for ; Mon, 29 Jun 2026 19:25:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8B6742z40DP for ; Mon, 29 Jun 2026 19:25:46 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761146; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZMOntIe36F1EiE0AtOsswq75l5bGkU722R+BESU8NTQ=; b=dAZC5ewNL54Gm7YpRjAJKCtlhbAXk1ELT4+gIJ4q8LVwUVnaiquVzcLZsqZ2Lyzj4CuZKH 0m/KDU+PkBVoEpV8V4JC4hFtJFuHUeVvuEK+aixXc6Cmlf5Cz2DX94+S7+Z75Wi8lx6ilZ SM+Uf0LYX82JzJ4o3hYzsKHcf6Srkhye0QG2a0Up/tm9BTPKJFMs+KPIXm4ZmjW3aXwhte HG2XmbCK1jmoz4dnI7BI7p3KH3ht/DVvgIF18TzygIqIVkWTYDFxXQcihLfTzT4lxcXOY5 X6tDHR3uscSrIOVGYXvH720clnkzVhsTbanVvphJLNIlcDcIJ3bnS6EqBkcXxA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761146; a=rsa-sha256; cv=none; b=POsHl6xEcOTS0xmzFpgmmDBnbTPquJaQwkhBqgTpyy1s/q4lYy2Nj17T8itCDFh/Y7lGzU l11578ZjoY8eOohiucfZ7bpv/bV2YClyNkWyWWyx3sFhVtsiJsGjqmCXygj5nF9poKvanz titkvLWKqbPdDyotiQ35jaid1u7CO27023QPrckFc4SHnQpMG6t+4rcAwDFs4y4a1TZIQZ RbzN4keOVBTC3dMGzWCn9fyT3cfc5t/+N3kd05pp3bcFenD1+cukuvBRJ/bWprtqxUYFCP llCk8Ar7iVBW0bxKBJIhweu9bR0vtio3zDp14s9Fbv+ZWOPAoQv0WDU5ZtZXiw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761146; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZMOntIe36F1EiE0AtOsswq75l5bGkU722R+BESU8NTQ=; b=rUmuWYLkuLYrdtcPI2DZ78C1+jbzpY2YH0cEQekj+oxZ+ZikMAYcgneOpvXwQhLTyTAIz7 iPgsc1tqVZEO+1LlNVXGnYHwsDA+SxbTgKH13tAyCbaQjw/qnLB8xAgB29KXZdM3jXz3qH cFk/8xRbY3MP5cTHGAhLWrjgslXy56HLX1cx4I0Gw3/yDbdHZWTxr8Vg+3lmdhvFk0ywQp syl4YwhXbb3kgy8ofocBENpkbR7vZzlpbeocZFrVlCjOzpvTlJN4t2oyUapO2dEKvd/GuS ed5GLbRVrXKWnH0PgkmEhclCwaJ6SlwIrR0wlfT67BudJtsE1WL6Df9QVGf9qg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8B57kTz19fj for ; Mon, 29 Jun 2026 19:25:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22a99 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:46 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: c0f6eaf5a8ff - stable/15 - MAC/do: Constify clone_rules() and clone_exec_paths()'s source argument List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: c0f6eaf5a8ff6a74b84dc8a090a9db527f518a0a Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:46 +0000 Message-Id: <6a42c6ba.22a99.2acd9cde@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=c0f6eaf5a8ff6a74b84dc8a090a9db527f518a0a commit c0f6eaf5a8ff6a74b84dc8a090a9db527f518a0a Author: Olivier Certner AuthorDate: 2026-04-27 16:24:01 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:44 +0000 MAC/do: Constify clone_rules() and clone_exec_paths()'s source argument Defensive programming. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 68cc6aa2e93a2a2969eb40b5588452eeb1805fa6) --- sys/security/mac_do/mac_do.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 8276ac3f9bc5..f2206c85c489 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1352,7 +1352,7 @@ set_default_conf(struct prison *const pr) */ static void -clone_rules(struct rules *dst, struct rules *const src) +clone_rules(struct rules *const dst, const struct rules *const src) { struct rule *src_rule, *dst_rule; @@ -1384,7 +1384,8 @@ clone_rules(struct rules *dst, struct rules *const src) } static void -clone_exec_paths(struct exec_paths *dst, struct exec_paths *const src) +clone_exec_paths(struct exec_paths *const dst, + const struct exec_paths *const src) { bzero(dst, sizeof(*dst)); dst->exec_path_count = src->exec_path_count; From nobody Mon Jun 29 19:25:48 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8F5T9sz6jjWm for ; Mon, 29 Jun 2026 19:25:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8F0QYVz40HZ for ; Mon, 29 Jun 2026 19:25:49 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761149; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=llbDXDS5VMUkfVCeH9FT/iFnRVcH2IHfcmlfAir+/Mk=; b=db9WGqzuINJn929cDKkoTD/SmHbA4MZKP2q6RcrzeVov+SdLqkHN3DDgDR33TwBC7GhgGi VYTAqzloSztN5qIqJEUOE9GED4SkKem3/Qsr+Np+aof01gHmwoACl6dojAz1wereT/h9AS cp9m6QRJ+2j/9DzElhzUOzY2hjnUiFfYUkC4xifZf8+KZb4v7vtndDsf4Jp/eAH3SAuvhO WguOvhxL/GBsQkbDv6S2EjffKhpokGCdxsHQt6+/TWx9ZqFgIy07AM/bNG0niibgwTyaRy f3ITMfgqe8Ij0hL08UZwuWGszgmz1KFO2w84mHX+qZnM3L7+W3dug10qJpzYmA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761149; a=rsa-sha256; cv=none; b=jOEkj2x98eYhRjdXv6BnTMCPolhG1CDaiGR+WxtlJP/B1TNpFExaxttElUIygmM/y36Qdd Zhc7DHfDm51xpa092jRrpyJW3V3etNw2BaknR7JBGVlTtsPZLoECfXgsZTgmRR4WyIr1eA zsO1Kl/DSgAoQblkHLBI368nEuV41gdg9yEU5+ehEIWOZA2rUp9KNg+S3nsur86VH/Aeld XSuhwKe6c38dL+hWAozjI3N3YAqpFkxWr9U+zvfe9/V3rHIbDmJ8pBPoGnpM1/0ssHHCyO 8FzC9LgdaZ2mRbjNAlxfiXrZIpb1KySthusSAzC6wNLr5cF3BLUqluPLZ+V5zA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761149; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=llbDXDS5VMUkfVCeH9FT/iFnRVcH2IHfcmlfAir+/Mk=; b=X8Bkxo8mqEKjYer9ufroG/dhDMzVZ5nE5cfcNC5TpKNApTqjI33nyJ16JT+R1xj3UOSx0j +58G9aGGgi8/e9TBlou4kS6MYCnVFMfZJ/JBgWHHR02twfRSECybBBSL5q2rOchkIH2NUG C/YORVthZxAGMBZE4xbObuQW+Y2n+oszX+ZhsWosxclTgPuJCg/cdaEwLMeMcTpAB+JqN9 KRvrBi2i1704lRutv6POTaYkx6p9e/Hv3h8cgttfb18zS7RtsknUDoAvmIkb0PjIRjOQGn RV8Gho1WZCxLA1xAuNKipfCErOCIAQV5sR+1iGSOUyNti9J6254660ih+z0msg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8D6Lgzz19bX for ; Mon, 29 Jun 2026 19:25:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21864 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:48 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: ce8846deb881 - stable/15 - MAC/do: Remove superfluous configuration initialization List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: ce8846deb88137f785ce1d84572384bd0a5b5130 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:48 +0000 Message-Id: <6a42c6bc.21864.4366d1df@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=ce8846deb88137f785ce1d84572384bd0a5b5130 commit ce8846deb88137f785ce1d84572384bd0a5b5130 Author: Olivier Certner AuthorDate: 2026-05-20 09:29:51 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:46 +0000 MAC/do: Remove superfluous configuration initialization Configuration objects would be initialized (zeroed, and some STAILQ_INIT() called) multiple times. Make sure they are so only once, and add assertions to check that this is actually the case for functions that expect it. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 11b567e94ad2a1b4baf768d77c6f1fb2018cfe83) --- sys/security/mac_do/mac_do.c | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 8868a6eb432f..f23509f6bebe 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -33,6 +33,23 @@ #include +#ifdef INVARIANTS +/* + * Should typically be moved to libkern (and perhaps libc) at some point, and be + * optimized if to be used outside of INVARIANTS. + */ +static bool +is_zeroed(const void *const buf, const size_t size) +{ + const char *const p = buf; + + for (size_t i = 0; i < size; ++i) + if (p[i] != 0) + return (false); + return (true); +} +#endif + static SYSCTL_NODE(_security_mac, OID_AUTO, do, CTLFLAG_RW|CTLFLAG_MPSAFE, 0, "mac_do policy controls"); @@ -355,25 +372,24 @@ toast_rules(struct rules *const rules) } } -/* Assumes storage has been zeroed. */ -static void +static inline void init_rules(struct rules *const rules) { + MPASS(is_zeroed(rules, sizeof(*rules))); STAILQ_INIT(&rules->head); } -static void +static inline void init_exec_paths(struct exec_paths *const exec_paths) { - bzero(exec_paths, sizeof(*exec_paths)); - exec_paths->exec_paths_str[0] = 0; + MPASS(is_zeroed(exec_paths, sizeof(*exec_paths))); } static struct conf * new_conf(void) { - struct conf *const conf = malloc(sizeof(*conf), M_MAC_DO, M_WAITOK | - M_ZERO); + struct conf *const conf = malloc(sizeof(*conf), M_MAC_DO, + M_WAITOK | M_ZERO); init_rules(&conf->rules); init_exec_paths(&conf->exec_paths); @@ -1358,9 +1374,7 @@ clone_rules(struct rules *const dst, const struct rules *const src) { struct rule *src_rule, *dst_rule; - bzero(dst, sizeof(*dst)); strlcpy(dst->string, src->string, sizeof(dst->string)); - STAILQ_INIT(&dst->head); STAILQ_FOREACH(src_rule, &src->head, r_entries) { dst_rule = malloc(sizeof(*dst_rule), M_MAC_DO, M_WAITOK | @@ -1389,7 +1403,7 @@ static void clone_exec_paths(struct exec_paths *const dst, const struct exec_paths *const src) { - bzero(dst, sizeof(*dst)); + MPASS(is_zeroed(dst, sizeof(*dst))); dst->exec_path_count = src->exec_path_count; for (int i = 0; i < src->exec_path_count; i++) strlcpy(dst->exec_paths[i], src->exec_paths[i], From nobody Mon Jun 29 19:25:49 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8G2f6pz6jj4l for ; Mon, 29 Jun 2026 19:25:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8G0ZB0z40Ky for ; Mon, 29 Jun 2026 19:25:50 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761150; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=n6EPE4e7WpwBot8yb6ahguVSp/m01i+4nyVSIOPyA4c=; b=UI/VhH931sGTMHKhQ3m4AQ3Mr0hUqJyIXSPMtU4FvinPFuaIafCDAzh/E11OL72ADbrt4B 0J/bcbpVTI6ysBciqxV+nzlWq80QICIqhYK/l/KjpjrmJMFfF8lrAcoIxyJY/b4lhSiqG9 WyJIh+dJfLHzGf1AwH5OrK9n22xVy1gXHKq/7I4Ywvr+rJFzAqKnhpPjqWOO20jOTPedMF WGeGJr0TUjbno74NwonnGxKTHgbCzZdxpz/5X40vMhLlDBi0RzRxxeBfqWK/qyPVpaaJtc ixTXR/U9tz+s109pykd03hEdnfUa+v+R1ZigyXTD5cAvTdVf3y/F6T4vxofZsQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761150; a=rsa-sha256; cv=none; b=BInkPfs1RLbC3eZTnCo3a/QXuhKvag1+imgJ3fa7H3NFmZ/9/eAXA7t1D3svlRKRKrfcfI fion9Jr5RyW2J9VApR1Fg1iPBY7mOkJdbr+NmbSGhNGJfO7kA3nKkiR9QGF7LNyfVrmuWd AcpXoqx+v6iz5dOenEKwaaK5GTqeRM3slVExFqAZr4eadX62fwwGOVvH9iG9gFv5wStAfZ jWaz9Sg3bQj2hF9NkEiPQyWZfFP5yWpwSamo8JqIXhIKvmiDfRB/A6bu9nFUMnij4bDZQm Fg9fduugAK8E5ScJw4fxIsvsKjhqEEgzP22tLBFAIu6FRqadi3FdZEdgtrfaGw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761150; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=n6EPE4e7WpwBot8yb6ahguVSp/m01i+4nyVSIOPyA4c=; b=IXgfLbM/VTQOIoVHSNUsphM/ekloD/mxOSWIfASGfwu8XaN6F0eKgzHJxvkx0r5j1AWyuy bCAaIZWPVyU/saxPtP6aRhQU1M/9nmdgN3VmK0FErgdK6oGD1HwTwvuGldKG3qVFrlkSPf sM1awXXlE+O2Qs7CyCQdZJZ+npGEHHZQA4lyNnl7OcOiYTzOgLwQm5ld18YCXL6fgEYD2u ue3rxZzIe0xsQY3vatIO24n2X5VvAYvnXGobykjoKmXOwmqIg02jSCEgFCe1TEUEbB+RSW KX7Il/zXcYngoGhZVSD8SuzN+SdXOuxbwOsd82BFlwDuJXVJZwXQ9DED4TsSxQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8F6mQpz196h for ; Mon, 29 Jun 2026 19:25:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21e84 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:49 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: bef2b6e3bf4a - stable/15 - MAC/do: clone_rules(): Readability improvements, constification List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: bef2b6e3bf4a8e615438c4f90472fd70309a407c Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:49 +0000 Message-Id: <6a42c6bd.21e84.3e7edf98@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=bef2b6e3bf4a8e615438c4f90472fd70309a407c commit bef2b6e3bf4a8e615438c4f90472fd70309a407c Author: Olivier Certner AuthorDate: 2026-05-20 10:33:41 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:46 +0000 MAC/do: clone_rules(): Readability improvements, constification Constify in order to let the compiler check that source and destination arguments are passed in the proper order in the different calls. No functional change (intended). Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit ce59a4181593f59028d3a26f2b63dcf2c8041d79) --- sys/security/mac_do/mac_do.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index f23509f6bebe..7b9c45eb265b 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1372,27 +1372,29 @@ set_default_conf(struct prison *const pr) static void clone_rules(struct rules *const dst, const struct rules *const src) { - struct rule *src_rule, *dst_rule; + const struct rule *src_rule; strlcpy(dst->string, src->string, sizeof(dst->string)); STAILQ_FOREACH(src_rule, &src->head, r_entries) { - dst_rule = malloc(sizeof(*dst_rule), M_MAC_DO, M_WAITOK | - M_ZERO); + struct rule *const dst_rule = malloc(sizeof(*dst_rule), + M_MAC_DO, M_WAITOK); bcopy(src_rule, dst_rule, sizeof(*dst_rule)); if (src_rule->uids_nb > 0) { - dst_rule->uids = malloc(sizeof(*dst_rule->uids) * - src_rule->uids_nb, M_MAC_DO, M_WAITOK); - bcopy(src_rule->uids, dst_rule->uids, - sizeof(*dst_rule->uids) * src_rule->uids_nb); + const size_t uids_size = sizeof(*dst_rule->uids) * + src_rule->uids_nb; + + dst_rule->uids = malloc(uids_size, M_MAC_DO, M_WAITOK); + bcopy(src_rule->uids, dst_rule->uids, uids_size); } if (src_rule->gids_nb > 0) { - dst_rule->gids = malloc(sizeof(*dst_rule->gids) * - src_rule->gids_nb, M_MAC_DO, M_WAITOK); - bcopy(src_rule->gids, dst_rule->gids, - sizeof(*dst_rule->gids) * src_rule->gids_nb); + const size_t gids_size = sizeof(*dst_rule->gids) * + src_rule->gids_nb; + + dst_rule->gids = malloc(gids_size, M_MAC_DO, M_WAITOK); + bcopy(src_rule->gids, dst_rule->gids, gids_size); } STAILQ_INSERT_TAIL(&dst->head, dst_rule, r_entries); From nobody Mon Jun 29 19:25:51 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8H4fmvz6jjZK for ; Mon, 29 Jun 2026 19:25:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8H1WDHz40Ng for ; Mon, 29 Jun 2026 19:25:51 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761151; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WXkcFh6WMeWUBQbcr1ZaAQKH4RgoZ14NFSEtuzgCM9I=; b=TkEVJeuyJcwOV84duDM8ZR2xqAmIj/frgqBSQPoS/cE48W5M4c18oyc5i95QOB7lojr3cv NpPr4TvTf2tZ/3Er17EZso+8xggZW2tfR+k1zbitWOCym7VgNlCpv3mOQaGgdmMTAsjDKM feejVra9DBG09crrHel2OGLl0HzYJsJ018vBvNwe3tv8IxRcrl3/9HG3kaAzp3koaG0HAB 77hqB/SeMhvjpIA8Qp6qIqWVACTNvCbWmxWuXUJTDDK9VbW9CXB4Y2vGXapBzT2FO4koNJ vo0fsdyzSCAh/LcYuHD/Vgk7NxwgTGVOWzsli9eCskvs3WyJ+Ctm1Fjcb+gAlg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761151; a=rsa-sha256; cv=none; b=TOZ6Sfj63UtqTSUhjGWOBY5PFM5KNvaHFhdDr2WomIa6EY4B1gMtgoED7AV+KvIXF+MS/6 Uq/o5xKqkT0++vNvRQr5rrS4bTuyXhZI5ONWnkiC75w2+vK4di0xh7MHBxgtWeqjokpcgv Hdy1KY0xCbCGwh/fksuC6RqfJVSa3tR7xw74GRGKh+pU2uHetX+JgKRW1cXue6OJzHVgT/ dtk4KOQJzzycbcNMx3hkhuhxidI7Dkt/2Exn87m3zUabX67WbHaTmj7eMdkfyjea563W9B YAvqmSNyKuZJRj0pooSn8sgZl96TsR4FBJQ0itUSWkInNK6b1n3QHqPQC1l3Dg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761151; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WXkcFh6WMeWUBQbcr1ZaAQKH4RgoZ14NFSEtuzgCM9I=; b=fR2LUmXUu5+v0pt5E9lwb3nqFEe6GoPYhdT8W3dvvQi8eOVV/uoB3YVV6jXdGFEOxeNgxg LXLFdZ0N2GcABFqS3axap+ESe0RL20LA4djMWLQNqaxPtb9k+trJWco/5GUH5sCNTU2QNv tt4BhGdLUZakwfeob15cf1UxhqjQrr9CsSqdM0l+A/N4EPKU+KdWBqkSTla6LyxI7M0i4y dUM2VFzcOqCUoDdNFnLrus4laYK7RlszPXVUJd8ZEwVV//OofBfYNJXbSgUGMVjlDsOjxX gF5ep8GtGTGMPJinc64UW9ttY+gxcvnO6nw9zlEBZGNX43tZRa6QVvNRQ8yMNw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8H0YP4z19bZ for ; Mon, 29 Jun 2026 19:25:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21fbf by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:51 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 0466e9319858 - stable/15 - MAC/do: parse_and_set_conf(): Obey empty parameters; Add doc List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 0466e931985816eca3f01ad34b7359c3634aadb0 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:51 +0000 Message-Id: <6a42c6bf.21fbf.8e1cdb4@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=0466e931985816eca3f01ad34b7359c3634aadb0 commit 0466e931985816eca3f01ad34b7359c3634aadb0 Author: Olivier Certner AuthorDate: 2026-04-27 16:12:08 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:47 +0000 MAC/do: parse_and_set_conf(): Obey empty parameters; Add doc parse_and_set_conf() is meant to be used in all situations when there is a need to set or modify some jail's MAC/do configuration. This entails passing the information of whether some parameter was explicitly specified. For example, an administrator setting/modifying jail parameters may not specify executable paths but only rules, in which case the executable paths value is copied from the currently-applicable configuration. The sysctl(8) knobs case always leverages this feature, since setting a knob changes one parameter at a time. Currently, a NULL or empty string argument is treated as a non-specified parameter. This causes a bug where disabling MAC/do in a jail does not actually work because, to this end, parse_and_set_conf() is passed an empty string which it then interprets as a request to copy the currently applicable configuration's value, which may well not be empty. Fix this problem by only treating NULL as a marker for a non-specified parameter, in accordance with the original design for this function. While here, write some documentation to explain the interface. While here, remove the original herald comment for parse_and_set_rules(), which was inadvertently pushed apart from the replacing parse_and_set_conf(). Reviewed by: bapt Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit d254322f6fa46010bb94d658ff13c06ad438ee77) --- sys/security/mac_do/mac_do.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 7b9c45eb265b..cd34d8711487 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1363,12 +1363,6 @@ set_default_conf(struct prison *const pr) drop_conf(conf); } -/* - * Parse a rules specification and assign them to a jail. - * - * Returns the same error code as parse_rules() (which see). - */ - static void clone_rules(struct rules *const dst, const struct rules *const src) { @@ -1415,7 +1409,17 @@ clone_exec_paths(struct exec_paths *const dst, sizeof(dst->exec_paths_str)); } -/* Must be called with '*parse_error' set to NULL. */ +/* + * Sets/modifies the MAC/do configuration for a jail. + * + * Must be called with '*parse_error' set to NULL. + * + * Supports explicitly setting all parameters or only some of them, in which + * case the implicit ones are copied from the currently applicable configuration + * (that of the closest ancestor jail that has one). + * + * An unspecified parameter must be passed as NULL. + */ static int parse_and_set_conf(struct prison *pr, const char *rules_string, const char *exec_paths_string, struct parse_error **parse_error) @@ -1423,17 +1427,13 @@ parse_and_set_conf(struct prison *pr, const char *rules_string, struct conf *applicable_conf = NULL; struct conf *conf; int error = 0; - bool need_applicable_conf; - - need_applicable_conf = (rules_string == NULL || rules_string[0] == '\0' || - exec_paths_string == NULL || exec_paths_string[0] == '\0'); - if (need_applicable_conf) + if (rules_string == NULL || exec_paths_string == NULL) applicable_conf = find_conf(pr, NULL); conf = new_conf(); - if (rules_string != NULL && rules_string[0] != '\0') { + if (rules_string != NULL) { error = parse_rules(rules_string, &conf->rules, parse_error); if (error != 0) goto error; @@ -1441,7 +1441,7 @@ parse_and_set_conf(struct prison *pr, const char *rules_string, else if (applicable_conf != NULL) clone_rules(&conf->rules, &applicable_conf->rules); - if (exec_paths_string != NULL && exec_paths_string[0] != '\0') { + if (exec_paths_string != NULL) { error = parse_exec_paths(exec_paths_string, &conf->exec_paths, parse_error); if (error != 0) From nobody Mon Jun 29 19:25:52 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8J5Qvqz6jjNy for ; Mon, 29 Jun 2026 19:25:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8J2WgTz40YY for ; Mon, 29 Jun 2026 19:25:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761152; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Lpm8Hsbzkm0mBn4dhVjKIpxDQnajxzqtionko1UQvxI=; b=bLIe4bLdCwlTQTt1m0fDvlEaFLofXjJakO7b1sGrPsgPawye0qC1Lpb+Hpzrq4WqcHOhHI 4omXwMF7MIme7zujniyZw5xq2a9oRX+b6K2Q9uC/aXR2x1RYPmAp9iS0308XInC71m0YVh Oy7NRxai4NEOIeV23VOIfwIYCQ0FRJUX3q4YW4X7i2JytWmmuVGQE/eEe7kryN7w/jMnmV ORUEazEzKjrYwYv2nPzPUa60tWk0U/Sl+B3BvjgH6gslS9XpV1VIPs3Z2aV+XbOlQmUflx Go5Htu/flSWRYqYNe4ON0SPJunLOoI6QGaRw9CZYWubTvO3blZN5aqRcPYV8Ng== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761152; a=rsa-sha256; cv=none; b=HQxdORgghsmMLABYn1LCQlr8Dtwl6noXC3y9p03mx/eR725X5KM6YlMTW0hBYquK+eXiq4 u/wqLNnZAxAOiqPfoTrj7xIIC4tfRXyBFuK3TCg6iK3+w6NB/NQqPRIyqOHvq5TegDl0ob 2zE9fsZZVsP3LavozXz/thl4J4fpbWSPkPJgSpGVOR0kyIhdg3uEqkPQ3hlsbc7zrP/8E+ JBj5OkZtI54tZNQuNg2RdsrhjQpdf4aMUs3Zn8batB+BuQBbFi/FGjux/s75b65b5/6K4i 0vhXB4TbN8SYfmUYUqHmaPuUsVge3o1hjaYmIvxAiOGCT0hIOEqIXX8Zuiu+nQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761152; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Lpm8Hsbzkm0mBn4dhVjKIpxDQnajxzqtionko1UQvxI=; b=RNA2ybwdHpQL9w5Kikf3W0Nwj/ETfyNlUXhsH1knPseay71R4VuvWSom29W6pMwILhN3/5 giZnZfbFpYGcZt9lz97Dio237Xh+WGXGX6aGdSwm95IKWTMlKsNlWsuw+uUzZeeM3q9YQ7 XVCgwq6NoLK7qGEAQf5/k7vOl6GVIN9U5teW7tEUr9xbl0i/WU2BSfW2myuBI72vi5eopA wUEeDuhMeJmtW2ZcEWLOThkUakiEt145RGucbfeS1vlsyrDx/jjOE2+gOAbV8h+Bk3Zle/ aJvbDBMuB8Ot1rq5NDl+YtNWMsX/7Rm5ggM+SjgHv2j0Gg6sjop4uMOJY50G5A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8J1PmTz19bb for ; Mon, 29 Jun 2026 19:25:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1ffbc by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:52 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 619213c00886 - stable/15 - MAC/do: parse_and_set_conf(): Require the model configuration List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 619213c0088650ba6eb07e3e317c72ab19e8dd2e Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:52 +0000 Message-Id: <6a42c6c0.1ffbc.1e1f99b6@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=619213c0088650ba6eb07e3e317c72ab19e8dd2e commit 619213c0088650ba6eb07e3e317c72ab19e8dd2e Author: Olivier Certner AuthorDate: 2026-04-28 09:55:29 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:48 +0000 MAC/do: parse_and_set_conf(): Require the model configuration This change is a prerequisite for the next change in caller mac_do_jail_set(), which for semantic correctness needs to rely on a stable model configuration. The two other callers already call find_conf() to retrieve the applicable configuration, so for these a second call to find_conf() can be saved. However, this does not fix (actually, makes slightly worse) an atomicity problem when multiple threads concurrently change some jail's configuration (or the configuration inherited by a jail), which has existed since the introduction of executable paths due to being able to change only rules or executable paths independently (and the possibility of not specifying them and having them copied from the currently applicable configuration). Before tackling it in later commits, we first focus on fixing the semantics of configuration changes in the very next patches. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 73215eba8b91fab37c1ad380fca04f082f3f92fd) --- sys/security/mac_do/mac_do.c | 66 +++++++++++++++++++++++++------------------- 1 file changed, 38 insertions(+), 28 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index cd34d8711487..31b83a4b9214 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1414,49 +1414,46 @@ clone_exec_paths(struct exec_paths *const dst, * * Must be called with '*parse_error' set to NULL. * - * Supports explicitly setting all parameters or only some of them, in which - * case the implicit ones are copied from the currently applicable configuration - * (that of the closest ancestor jail that has one). - * - * An unspecified parameter must be passed as NULL. + * Supports explicitly setting all parameters or only some of them. An + * unspecified parameter must be passed as NULL. The values of unspecified + * parameters are copied from those of the passed model configuration (which is + * expected to be the currently applicable configuration, i.e., that of the + * closest ancestor jail that has one). */ static int -parse_and_set_conf(struct prison *pr, const char *rules_string, - const char *exec_paths_string, struct parse_error **parse_error) +parse_and_set_conf(struct prison *const pr, const char *const rules_string, + const char *const exec_paths_string, const struct conf *const model_conf, + struct parse_error **const parse_error) { - struct conf *applicable_conf = NULL; - struct conf *conf; + struct conf *const conf = new_conf(); int error = 0; - if (rules_string == NULL || exec_paths_string == NULL) - applicable_conf = find_conf(pr, NULL); - - conf = new_conf(); + KASSERT(model_conf != NULL || + (rules_string != NULL && exec_paths_string != NULL), + ("MAC/do: %s: Model configuration needed!", __func__)); if (rules_string != NULL) { error = parse_rules(rules_string, &conf->rules, parse_error); if (error != 0) goto error; } - else if (applicable_conf != NULL) - clone_rules(&conf->rules, &applicable_conf->rules); + else + clone_rules(&conf->rules, &model_conf->rules); if (exec_paths_string != NULL) { error = parse_exec_paths(exec_paths_string, &conf->exec_paths, parse_error); if (error != 0) goto error; - } else if (applicable_conf != NULL) + } else clone_exec_paths(&conf->exec_paths, - &applicable_conf->exec_paths); + &model_conf->exec_paths); set_conf(pr, conf); MPASS(error == 0 && *parse_error == NULL); out: drop_conf(conf); - if (applicable_conf != NULL) - drop_conf(applicable_conf); return (error); error: MPASS(error != 0 && *parse_error != NULL); @@ -1479,8 +1476,7 @@ mac_do_sysctl_rules(SYSCTL_HANDLER_ARGS) if (error != 0 || req->newptr == NULL) goto out; - /* Set our prison's rules, not that of the jail we inherited from. */ - error = parse_and_set_conf(pr, buf, NULL, &parse_error); + error = parse_and_set_conf(pr, buf, NULL, conf, &parse_error); if (error != 0) { if (print_parse_error) printf("MAC/do: Parse error at index %zu: %s\n", @@ -1520,7 +1516,7 @@ mac_do_sysctl_exec_paths(SYSCTL_HANDLER_ARGS) if (error != 0 || req->newptr == NULL) goto out; - error = parse_and_set_conf(pr, NULL, buf, &parse_error); + error = parse_and_set_conf(pr, NULL, buf, conf, &parse_error); if (error != 0) { if (print_parse_error) printf("MAC/do: Parse error at index %zu: %s\n", @@ -1728,6 +1724,7 @@ mac_do_jail_set(void *obj, void *data) struct vfsoptlist *opts = data; char *rules_string, *exec_paths_string; struct parse_error *parse_error = NULL; + struct conf *model_conf; int error, jsys; bool has_rules, has_exec_paths; @@ -1757,20 +1754,32 @@ mac_do_jail_set(void *obj, void *data) jsys = JAIL_SYS_DISABLE; } - switch (jsys) { - case JAIL_SYS_INHERIT: + if (jsys == JAIL_SYS_INHERIT) { + MPASS(!has_rules && !has_exec_paths); remove_conf(pr); return (0); + } + + model_conf = NULL; + switch (jsys) { case JAIL_SYS_DISABLE: rules_string = ""; has_rules = true; /* FALLTHROUGH */ case JAIL_SYS_NEW: + /* + * If 'pr' has a configuration, we want to use it as the model + * (i.e., only change what has been explicitly specified). + * Else, we want as default values those that are inherited. + */ + model_conf = !has_rules || !has_exec_paths ? + find_conf(pr, NULL) : NULL; error = parse_and_set_conf(pr, has_rules ? rules_string : NULL, has_exec_paths ? exec_paths_string : NULL, + model_conf, &parse_error); if (error != 0) { @@ -1778,15 +1787,16 @@ mac_do_jail_set(void *obj, void *data) "MAC/do: Parse error at index %zu: %s\n", parse_error->pos, parse_error->msg); free_parse_error(parse_error); - - return (error); } - - return (0); + break; default: __assert_unreachable(); } + + if (model_conf != NULL) + drop_conf(model_conf); + return (error); } /* From nobody Mon Jun 29 19:25:53 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8K6dfYz6jjX1 for ; Mon, 29 Jun 2026 19:25:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8K3B5Qz40J3 for ; Mon, 29 Jun 2026 19:25:53 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761153; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tMqaAeg+PmcEr/n4YekG6nk0sdNafGD86Us84Lp5YrE=; b=fHmAdBHjZuhD3KUgZww7a5JYPw9Tw5M6BldgzhwBRqI3Tx9IgNlQH91eLqJ0icVou37hgw BV7VtZoiMEV9VmHYr+wEmZIhC4DyxKNkrZxBsw4X90OH1zRLoc1HLS9Z651NOEQScZS+W7 WqngLU378KTZkdpTMMKna0AfL7Mc61e2kZAS1TUNdP/L/Kl+mpb4DiEMoqFNtGZW+6TGL1 fh8QI5sW+37/QzFjd2FbAn98c3I1ljm5gHgDTgWqejtz56FxpJrhnmG0d9LBzQ0UY8tbj6 BgvFk4WHAVuzlR/JRgzit2kvkp9fgvwmfAzX6E16ZLJLhws0Yav8Dq8QEJZFfA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761153; a=rsa-sha256; cv=none; b=t+1NmBwVpoZ7F8zvk40Swi+QtQbqE9ItjcXEQo40F9zgWWtg6ekrmNBsKkCQ2q2WDrln92 IhXBXPHAjnwFOVNZa/TmzdquDsH30MuwX5E0UnKI0G/4uexwjdugHwd1gG9UJoDEVhNnXe 3mB/lVzD3/BdvNpmqTAOmLglwtQZgOnLdY2Zczalu5xLgGNVloZqqDwROJCkiZAdnhFRUs uG+xXxxtSLl0LlgKQHghPGh9DEPScJdLw3R1jHQ2aZFP9vEYFpfWdrnjBdF+9cTgaBnoVu IevZORbeWn8BRqEWMTgJtC2WlbDOQ0LQ2Hg3AYBHYDDxUOKptszgi6sUgw6b7w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761153; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tMqaAeg+PmcEr/n4YekG6nk0sdNafGD86Us84Lp5YrE=; b=wdymafuVN4EkhAsb0aVtrwPblCxrnOaEmxAYCcl1V2/RzrCqDTJHoQ7Egf8W7sV43hpnn1 Hsqwh07W28p50WS+iCpSAJhdaJ8jsWL42H6A6ONPr7nEA6cs5scIpubNqtC5JMzueI9gNN yUZMggzP2q1Ou+ftpvlLD08MMb0suAA5lGyoXCl872yKaFFa8q5I6YP150nJ1H1UZNU0GC zEYd3wI9+NNI+co6CL0RwVJKFx9qYfWYnrLeahon2fIirKkDDtSMY83zNiwacUgdxcGgW9 TEgjFdGQG/hZyps2lOkktP3ftPCqJVsLD0/2gFg47VS1C9tE9iFhSkZSJKSuRw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8K2GDvz198D for ; Mon, 29 Jun 2026 19:25:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 218b6 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:53 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 67ec8dba2dce - stable/15 - MAC/do: Fix obsolete wording in a comment ("ascendant" => "ancestor") List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 67ec8dba2dce8bd3d9c93ad2e489221d45d50a64 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:53 +0000 Message-Id: <6a42c6c1.218b6.6c80e943@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=67ec8dba2dce8bd3d9c93ad2e489221d45d50a64 commit 67ec8dba2dce8bd3d9c93ad2e489221d45d50a64 Author: Olivier Certner AuthorDate: 2026-04-28 09:58:31 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:48 +0000 MAC/do: Fix obsolete wording in a comment ("ascendant" => "ancestor") Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit dbf8f0895ad86fea10adbd678873f8af0bd7558c) --- sys/security/mac_do/mac_do.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 31b83a4b9214..32950237d33c 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1294,7 +1294,7 @@ dealloc_jail_osd(void *const value) * Remove the rules specifically associated to a prison. * * In practice, this means that the rules become inherited (from the closest - * ascendant that has some). + * ancestor that has some). * * Destroys the 'osd_jail_slot' slot of the passed jail. */ From nobody Mon Jun 29 19:25:54 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8L6gtFz6jjZR for ; Mon, 29 Jun 2026 19:25:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8L41b6z40Yv for ; Mon, 29 Jun 2026 19:25:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761154; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=kXDRBfYv7q8u+WdIohBKEqUL5M3zyaWa0377kNPYXko=; b=aExanr27BhkncwAVdlkGIWGTqakFC4pxgQqAZCu3Zn36qzUEeID2YGYygvJ8yvzKkH6jSQ HW5rRXuwZb4OyD+HS11sTTOaWy3BSGN/OQD5qreJEwmZza8SHwa44G+geTRJsD8Z6vmuuQ R9d7n/o56fCyqTkMBML8iqcc28Wyrwo1HJuUhZHZ0T9Ib5g6wp7ONG2MEqZrmSbbrvVde8 w5IO25PmtvLi9C4yJ0b6FlWV/xIuvyKGoWkHMoZOUmhqB/dhy5zgRU6ygaBQV3dKOGDNxn BPRvnEA4BAbsV8YUAUodN4NNT3tW0mYEC8kslVZZGxaobyoUhvi2YefKNDjwnQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761154; a=rsa-sha256; cv=none; b=ysfZhSNDli8P9NOpr5ROh5Godmaz20db8p/kwtdH3i6e7lISk22mwGiZ0fkxKY/K6oWN3S vAfYkEN6j7ePD/2U3wCEgi+0VmHyGSv2tYMsWW/CkkdgA5xZ5U843lgA7mlowDM7f6nt8b AFPCaB/93YFYpXkU3JAy2EyhyaQUIlLB6MYHRtTNQ03+03WIrMgXtFVeqCM92jOx8j8VHT RuFsZ4SwbrihWGGjnsuLgtrbxvxgfi2LTPbudgGuUFD8tbCME8jMMZqM9QMtdpzFtEVd81 zzVBNgCak6N1XvP9qMHY+J5s9fg1o0NlYdS2Y0fDUkx3Sx3F61YciGZgl/W3Jw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761154; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=kXDRBfYv7q8u+WdIohBKEqUL5M3zyaWa0377kNPYXko=; b=T1RpW08VSIc5Pcy8Ixn2Zflw35fMWpgNn6yJsucZVuTPHPJIHTA+9ZoyqgwCR0KeNShfv3 Qa4nNly6/z2cnzXBO87Dr0wCaCJToxF+YrfBoaTKuTkgftV+SLIlJfzfSfxPb1gVQbm0KG JE/uwFvi/8UuqNDBqNVLPuOQ7Ewwwh0FkVheEVysx9b2HdcHc6D/h9E2UUT7cxeAXM8D4b 0FboTclzpwixfZw8/tnU77+LF5nN93iapRr3A6/MttvbWzz97IJACbB/w1+ddFAOpJ4YIQ gOtrWlGeigYO1RC/U9NZqIxSbBaPk8BF1ZMi1oJlYCisFyZ9U18ne2W2JvW3kw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8L32Dgz19bc for ; Mon, 29 Jun 2026 19:25:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1e8e4 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:54 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: b338e0909672 - stable/15 - MAC/do: Constify is_null_or_empty() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: b338e0909672ea6155ce4f4deeeeaa91a5eec157 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:54 +0000 Message-Id: <6a42c6c2.1e8e4.8fdcea6@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=b338e0909672ea6155ce4f4deeeeaa91a5eec157 commit b338e0909672ea6155ce4f4deeeeaa91a5eec157 Author: Olivier Certner AuthorDate: 2026-05-20 11:12:38 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:49 +0000 MAC/do: Constify is_null_or_empty() Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 37bc08d5fe9933f41574bf477080d729daf19928) --- sys/security/mac_do/mac_do.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 32950237d33c..9a316e4cd6e7 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -399,7 +399,7 @@ new_conf(void) } static bool -is_null_or_empty(const char *s) +is_null_or_empty(const char *const s) { return (s == NULL || s[0] == '\0'); } From nobody Mon Jun 29 19:25:55 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8N0tyRz6jjTt for ; Mon, 29 Jun 2026 19:25:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8M4lL2z40JX for ; Mon, 29 Jun 2026 19:25:55 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761155; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KNUHE6lgjEE8JlAlhAlKXgEzsDF3PJr1gCT5kQD93fs=; b=ofkR6TtoOk77MmqD3IZ8fOeqGEZFNNwBHCKiUbenscsFk133RV4MPMhgy9sGX/8b5df4qa JGUcm6oj1IuizNVUNzn/yo6eiw3Ea0RKZ2SUhAqpoi9IVtvyeueC7Ebe/cDKlXJsHzAHWM 1YYEus2tzUDrRx6to6tRadLchcsKZUBV+Pttw/gYeiGpPv75hb51jwWdFuqyjXjCOR35WX ZxqJKo7Bfen3SRVPlzKVQ4AEqTIJOBZyWv4qLwkl+wehDKYE9DWxHzq0NH6cBCfoBc0vva 3x7TCq06NIq6kZEx/VKIMWIh2992h4mpuz2vTwBhotWmDx6kIbFu9alrt81S9Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761155; a=rsa-sha256; cv=none; b=gYhsjOhhBys0ZSPXWxXfXGRxAzPr2MlR+Y4sjuTtMBKeGeaaIMZt0uQZKb+S+LLrD3OXVl YHXzdUOTOc1VRy4Di7MoBaAfKhlCMSckjwPgRRhLH4FlsSzKEzulpYdUz2v3T8IG15kKCe v9bAl+N1z3Wo3b7UlAXUDosf4BM1+4kGYpoeICeYJSPN7zSqf6oH8uIn3M+XjVq7kZrThn /e0jbXhnuyB7m7HhMMM5qLgyFAzpNMs7oX49JGUn7sghyqEfB5MhD/mE5VHTxrsyr9BYMW s7BbQjnh+NAFGkz8M72BEomF5BALcZRv8pTfFdV4lM12U/yH30rBMqhY/0HEbg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761155; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KNUHE6lgjEE8JlAlhAlKXgEzsDF3PJr1gCT5kQD93fs=; b=PE+w0SJKnW5NDQVmqlcT8SDx98sxeLHlyEPh28b1iA+sCM8YXKx+/BifPAK7LZjrprrTjx GO2vBWBUUXuJGB6gz4MYKg6FrkmYoDjuRAPJd+TV4GXnoucDNp4lt59/Gk1hSpbz7M73ZN tE5pFXceQUdg4WzFXpwLENHLMDPsEX5XodXq3nwvALCDhytIVXzlKjt+OkBWsDunBe4P1t fCCZ2P/WHQD4a1jPi4HTcl8P9enPyxvz2KDKd/WYHGmfLLwWUtsb+nm2XCIuKYGoX03PZD QlLSTr18i2+7KekTdOkiRrpmL80YnVSLGpoEN91EAt8XJJuQ+R+hRgRRCQtWwg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8M3mpCz198G for ; Mon, 29 Jun 2026 19:25:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 206d9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:55 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: e76403859f53 - stable/15 - MAC/do: Fix the recent logic to set jail parameters, make it more tolerant List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: e76403859f53f522ebcca7a32094a158ed5ebe74 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:55 +0000 Message-Id: <6a42c6c3.206d9.67b29918@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=e76403859f53f522ebcca7a32094a158ed5ebe74 commit e76403859f53f522ebcca7a32094a158ed5ebe74 Author: Olivier Certner AuthorDate: 2026-04-28 12:40:19 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:50 +0000 MAC/do: Fix the recent logic to set jail parameters, make it more tolerant The logic introduced in the initial commit for the "executable paths" feature did not match the specification we discussed in that specifying an empty value (for rules or executable paths) on "mac.do" being "new" would be treated as an absence of value and trigger a copy from the currently applicable configuration, instead of being an override that deactivates mac_do(4) in the jail. Fix that by distinguishing both cases. More generally, a non-explicitly specified parameter is set to the same value it has in the currently applicable configuration (that of the closest ancestor jail that has one; 'prison0' (the host) always has one), with an exception in the disable case. On disable (explicit: "mac.do" to "disable", implicit: no parameters passed, or at least one is empty), now accept parameters with a non-empty value as long as at least one of them is empty (which alone is enough to disable mac_do(4)). If no parameters are passed, both are copied from the currently applicable configuration; if none of them is empty, then the rules are emptied to effectively disable mac_do(4) (see the inline comment as to why this was chosen). On explicit enable ("mac.do" to "enable"), allow not specifying any of the rules and executable paths, in which case both are copied from the currently applicable configuration (consistently with what is done when only one is missing). Note that, as mentioned above, not specifying any of them by default still resolves to disabling mac_do(4) (i.e., on no explicit "mac.do" parameter). On (explicit) inheritance, allow specifying non-empty parameters, provided they match the values we are going to inherit. This enables re-applying jail parameters' reported values verbatim to the current jail (idempotence) or, e.g., to some sibling jail. (While here, make some existing code easier to read by leveraging is_null_or_empty().) Reviewed by: bapt Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 7929f364ef5135f712e061d291d1c2c0fb48abde) --- sys/security/mac_do/mac_do.c | 201 ++++++++++++++++++++++++++++++------------- 1 file changed, 140 insertions(+), 61 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 9a316e4cd6e7..126feba135c2 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -328,6 +328,18 @@ unexpected_flags: #define check_type_and_type_flags(...) #endif /* INVARIANTS */ +static bool +has_rules(const struct rules *const rules) +{ + return (rules->string[0] != '\0'); +} + +static bool +has_exec_paths(const struct exec_paths *const exec_paths) +{ + return (exec_paths->exec_paths_str[0] != '\0'); +} + /* * Returns EALREADY if both flags have some overlap, or EINVAL if flags are * incompatible, else 0 with flags successfully merged into 'dest'. @@ -1600,7 +1612,7 @@ mac_do_jail_check(void *obj, void *data) struct vfsoptlist *opts = data; char *rules_string, *exec_paths_string; int error, jsys, rules_size = 0, exec_paths_size = 0; - bool has_rules, has_exec_paths; + bool absent_or_empty_rules, absent_or_empty_exec_paths; error = vfs_copyopt(opts, "mac.do", &jsys, sizeof(jsys)); if (error == ENOENT) @@ -1663,22 +1675,17 @@ mac_do_jail_check(void *obj, void *data) } } - /* - * Be liberal, considering that an empty rule or execution paths - * specification is equivalent to no specification. This affects the - * JAIL_SYS_DISABLE and JAIL_SYS_INHERIT sanity checks below. - */ - has_rules = rules_string != NULL && rules_string[0] != '\0'; - has_exec_paths = exec_paths_string != NULL && - exec_paths_string[0] != '\0'; + absent_or_empty_rules = is_null_or_empty(rules_string); + absent_or_empty_exec_paths = is_null_or_empty(exec_paths_string); /* If not specified, infer 'jsys' from passed options. */ if (jsys == -1) { /* * Default in absence of "mac.do.rules" and "mac.do.exec_paths" - * is to disable (and, in particular, not inherit). + * is to disable. We never implicitly inherit, as that changes + * reasoning about configurations. */ - if (has_rules || has_exec_paths) + if (!absent_or_empty_rules || !absent_or_empty_exec_paths) jsys = JAIL_SYS_NEW; else jsys = JAIL_SYS_DISABLE; @@ -1687,31 +1694,38 @@ mac_do_jail_check(void *obj, void *data) /* Final checks based on resolved 'jsys'. */ switch (jsys) { case JAIL_SYS_DISABLE: - case JAIL_SYS_INHERIT: - if (has_rules) { - vfs_opterror(opts, - "'mac.do.rules' specified but should not be when " - "'mac.do' is 'disabled' or 'inherited'"); - return (EINVAL); - } - if (has_exec_paths) { + /* + * Tolerate specified but empty rules or execution paths + * (instead of not being specified). Also, tolerate that one of + * them is not empty (but not both). Indeed, as soon as one is + * empty, mac_do(4) is effectively disabled. This allows the + * administrator to still specify a value for one of them, which + * is then used for new sub-jails that do not inherit and for + * which no value for the parameter is explicitly specified + * (because then the value passed here is copied). + */ + if (!absent_or_empty_rules && !absent_or_empty_exec_paths) { vfs_opterror(opts, - "'mac.do.exec_paths' specified but should not be " - "when 'mac.do' is 'disabled' or 'inherited'"); + "One of 'mac.do.rules' and 'mac_do.exec_paths' " + "should not be specified or should be empty when " + "'mac.do' is 'disabled'"); return (EINVAL); } break; - case JAIL_SYS_NEW: - if (!has_rules && !has_exec_paths) { - vfs_opterror(opts, "'mac.do' set to 'new' but neither " - "rules nor executable paths specified"); - return (EINVAL); - } + case JAIL_SYS_INHERIT: + /* + * Canonically, no parameters should be specified in this case. + * However, we tolerate empty ones, and also non-empty ones + * provided they match the inherited values, so that we can + * report the *resolved* value of current parameters via + * mac_do_jail_get() and have them re-applicable to this jail in + * a similar situation. Testing that inherited values are the + * same as passed ones is more expensive than a single test and + * requires some atomicity, which is why we do not perform that + * here but only in mac_do_jail_set(). + */ break; - - default: - __assert_unreachable(); } return (0); @@ -1720,13 +1734,13 @@ mac_do_jail_check(void *obj, void *data) static int mac_do_jail_set(void *obj, void *data) { - struct prison *pr = obj; - struct vfsoptlist *opts = data; + struct prison *const pr = obj; + struct vfsoptlist *const opts = data; char *rules_string, *exec_paths_string; struct parse_error *parse_error = NULL; struct conf *model_conf; int error, jsys; - bool has_rules, has_exec_paths; + bool absent_or_empty_rules, absent_or_empty_exec_paths; /* * The invariants checks used below correspond to what has already been @@ -1743,59 +1757,124 @@ mac_do_jail_set(void *obj, void *data) exec_paths_string = vfs_getopts(opts, "mac.do.exec_paths", &error); MPASS(error == 0 || error == ENOENT); - has_rules = rules_string != NULL && rules_string[0] != '\0'; - has_exec_paths = exec_paths_string != NULL && - exec_paths_string[0] != '\0'; + absent_or_empty_rules = is_null_or_empty(rules_string); + absent_or_empty_exec_paths = is_null_or_empty(exec_paths_string); if (jsys == -1) { - if (has_rules || has_exec_paths) + if (!absent_or_empty_rules || !absent_or_empty_exec_paths) jsys = JAIL_SYS_NEW; else jsys = JAIL_SYS_DISABLE; } if (jsys == JAIL_SYS_INHERIT) { - MPASS(!has_rules && !has_exec_paths); - remove_conf(pr); - return (0); + error = 0; + + if (!absent_or_empty_rules || !absent_or_empty_exec_paths) { + /* + * Some values specified. Check that they match the + * ones we are going to inherit. + */ + model_conf = find_conf(pr->pr_parent, NULL); + if (strcmp(model_conf->rules.string, rules_string) + != 0) { + error = EINVAL; + vfs_opterror(opts, + "'mac.do' is 'inherited' but 'mac.do.rules'" + " was specified with a different value " + "than the one to be inherited (\"%s\")", + model_conf->rules.string); + } + if (strcmp(model_conf->exec_paths.exec_paths_str, + exec_paths_string) != 0) { + error = EINVAL; + vfs_opterror(opts, + "'mac.do' is 'inherited' but " + "'mac.do.exec_paths' was specified with a " + "different value than the one to be " + "inherited (\"%s\")", + model_conf->exec_paths.exec_paths_str); + } + drop_conf(model_conf); + } + + if (error == 0) + /* + * There's no TOCTOU problem here as the removal of the + * current jail's configuration commutes with changing + * the inherited configuration we checked against. + */ + remove_conf(pr); + + return (error); } model_conf = NULL; switch (jsys) { case JAIL_SYS_DISABLE: - rules_string = ""; - has_rules = true; - /* FALLTHROUGH */ - - case JAIL_SYS_NEW: /* - * If 'pr' has a configuration, we want to use it as the model - * (i.e., only change what has been explicitly specified). - * Else, we want as default values those that are inherited. + * mac_do(4) is disabled iff one of the parameter's string is + * empty. The parse_and_set_conf() call below treats passing + * NULL for a parameter as a flag to copy its value from the + * relevant ancestor jail's configuration, so we have to watch + * for the final result having an empty parameter if no + * parameter has been explicitly passed as empty. Thanks to + * mac_do_jail_check(), we know that at least one parameter is + * absent or empty (see the comment for the corresponding case + * there). */ - model_conf = !has_rules || !has_exec_paths ? - find_conf(pr, NULL) : NULL; - error = parse_and_set_conf(pr, - has_rules ? rules_string : NULL, - has_exec_paths ? exec_paths_string : NULL, - model_conf, - &parse_error); - - if (error != 0) { - vfs_opterror(opts, - "MAC/do: Parse error at index %zu: %s\n", - parse_error->pos, parse_error->msg); - free_parse_error(parse_error); + MPASS(absent_or_empty_rules || absent_or_empty_exec_paths); + if (!absent_or_empty_rules) + exec_paths_string = ""; + else if (!absent_or_empty_exec_paths) + rules_string = ""; + else { + /* + * Both are either empty or absent. If at least one is + * absent, we retrieve the applicable configuration as + * it will serve as a template (provides default + * values). + */ + if (rules_string == NULL || exec_paths_string == NULL) + model_conf = find_conf(pr, NULL); + /* If both are absent, we have to examine if, in the + * currently applicable configuration, one of the + * parameters, which we are going to copy, is + * effectively empty. If both of those are non-empty, + * we keep the executable paths and empty the rules, + * since we expect that this is more convenient to + * administrators that may want to enable mac_do(4) + * later by just setting new rules. + */ + if (rules_string == NULL && exec_paths_string == NULL && + has_rules(&model_conf->rules) && + has_exec_paths(&model_conf->exec_paths)) + rules_string = ""; } break; + case JAIL_SYS_NEW: + /* See the comment before the call to find_conf() above. */ + if (rules_string == NULL || exec_paths_string == NULL) + model_conf = find_conf(pr, NULL); + break; + default: __assert_unreachable(); } + error = parse_and_set_conf(pr, rules_string, exec_paths_string, + model_conf, &parse_error); if (model_conf != NULL) drop_conf(model_conf); + if (error != 0) { + vfs_opterror(opts, + "MAC/do: Parse error at index %zu: %s\n", + parse_error->pos, parse_error->msg); + free_parse_error(parse_error); + } + return (error); } From nobody Mon Jun 29 19:25:57 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8Q5xWNz6jjXG for ; Mon, 29 Jun 2026 19:25:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8Q12yJz40c0 for ; Mon, 29 Jun 2026 19:25:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761158; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TaruqlurgJgn2AciRInmjalToMyTw8I9a3lMK/+F6EM=; b=ug8sOhn7ZRd9cNx+bexdAvnwlZBA7C03UDijyE5PO5kxlLBpXH30q1z/6A/qT+02Lzu+qH dIVJAKyPq9TTtnUsPliKyMdi1zDHFNXpV3+DeIcwyuat6zdpcQUWNac6mZul70DP4bO5z2 MTFBXTDkoJpRS3mUnZW+6+FP5F0sZ3hZV8TKGfg9WrDKT2IaZczhoQLsbTiCXviLhrfCdW ILiifQAdYpIW9l7ZqbjZAKwOf2N+5tR2168x4PJi2mOQ+NX5fe9BneMlQEyCLjbeWm03cq 6mGI1juUQNbUqg4ksND/+vr7g/64c1xQSPp78x4DK110nklw8Jh0F2hf76QipQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761158; a=rsa-sha256; cv=none; b=xShXLg3Y7zwvJ/9YbfBgLyVtpCCcD8gGLxvpi6FsM/v4QD4bG8obkM1aPJHUBDSp9kirpP 0YAyl5lU2MI+Frs98agXGPCg8QTW7uJMfGNRqAE/NzaHsbuFo7QeHY4DiHxoTsBi6PNlpT j1AXYw4lcIGWBeSQ/CF6N4+fZe/+gMt+iKXPspE9JY1XQW5hAwWndff502dOTIhPsq38vH olhYUaCX1V5GoHM04jmmIMTkP0aXD7W/MiX7R7bsJswAnqBkpX5ATVRMQMVQVMCL8EN6Rf p3C7f6ky+GP1dDUmnRBRtCCEEQ8VRxCSUt0vRT/mFgmRCGwt1x6fWtZTWde1pg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761158; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TaruqlurgJgn2AciRInmjalToMyTw8I9a3lMK/+F6EM=; b=UNCEcUXQEpoKd7KjSecyM2GQ/DySL5UNMIln9/xlXU/dom8HGdTIhUSJiwGCGXl5RCbGOB SNdhWFZz4usyyghRav4TPTgtc6D6yGUmulxN/ILzBZPnvAEVCbe5VJ2b4gXuvsR2fmgRD7 642kVWZyLgFZr/FOeAXUE9u7ntXgBeBRdhlEGpqQ8CfK+g/1H+sM5TXhVd/HDfgU1dPAYc +SRvppVadio9ft+99svz7g9NvrA/7U/sQSwlhzWDsPgFJr5JQ5owOaFR/YRrzpQFS2T7En aSdcW0TqgPHCOIWWNCMbWv9KS/0A1HB6nMPItMArVaMoYzVkcr6PdvtR980iTw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8P5GXNz19Nq for ; Mon, 29 Jun 2026 19:25:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 208c5 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:57 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: ab2f2f1f75c0 - stable/15 - MAC/do: Fix reporting of "mac.do" post-"executable paths" List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: ab2f2f1f75c0617963fdc745ecffbcfa4f2854ec Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:57 +0000 Message-Id: <6a42c6c5.208c5.7af935da@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=ab2f2f1f75c0617963fdc745ecffbcfa4f2854ec commit ab2f2f1f75c0617963fdc745ecffbcfa4f2854ec Author: Olivier Certner AuthorDate: 2026-04-28 13:17:18 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:51 +0000 MAC/do: Fix reporting of "mac.do" post-"executable paths" In mac_do_jail_get(), computation of 'jsys' had not been updated to take into account executable paths. Reviewed by: bapt Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 888a84ceeded9ef69903e352827cdef58163027e) --- sys/security/mac_do/mac_do.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 33e655a854a4..f298ad2d4f59 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1562,9 +1562,8 @@ mac_do_jail_get(void *obj, void *data) const struct exec_paths *const exec_paths = &applicable_conf->exec_paths; int jsys, error; - jsys = hpr == pr ? - (STAILQ_EMPTY(&rules->head) ? JAIL_SYS_DISABLE : JAIL_SYS_NEW) : - JAIL_SYS_INHERIT; + jsys = hpr == pr ? (has_rules(rules) && has_exec_paths(exec_paths) ? + JAIL_SYS_NEW : JAIL_SYS_DISABLE) : JAIL_SYS_INHERIT; error = vfs_setopt(opts, "mac.do", &jsys, sizeof(jsys)); if (error != 0 && error != ENOENT) From nobody Mon Jun 29 19:25:56 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8P3NkDz6jjTx for ; Mon, 29 Jun 2026 19:25:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8N5g21z40fK for ; Mon, 29 Jun 2026 19:25:56 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761156; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cp9QO4815E4Ekn2dxNaB65xCjDebw7VODAmw+PkSESs=; b=PlpxpMooRq4I9Qg6NJtpdMqpJUx0VJQMrTQlitCO5LcrZ8NDs07QB0EJkqqID4PbpTM28J mlCx5r0zQXRKBvqFv4LVTH3iHVcr8f6EDI+QeneTfUfnmf9MD+hzQKwtnUeToqzGQbIUjJ o98nKmywf11lh5bWQ71ZwDvrVQR8yhbqo54c70Ex0lvINF8s86Y3ScZPfiHqAY3uyfiD+f GQlQl013MBkiQNu3gSOzGCN7Ma2FZiROGdrFxQ/KxsYrrwFn1DJRFs+Hs6DlEzvQaiiGL1 TqK94OxkzPU9oi1iIU3EQ/+oxoaFBrCe8ivMVpWCtBYJ7X4RqWX04aWM2PUYeg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761156; a=rsa-sha256; cv=none; b=ph7Na+M0+afJ/WpLc3QTI3amHa3XzGpHVhGKaAie3BW7qDO4pU3ShFUYOFXU7K6L1Ei25p Jo+3ICrn18Di9D8PsOYGfd3DL5LYi7epkQ4SRpB+pa6uqt82RyFcKTXBpMfLAexKnPBCug onTjkyH2XAcStlSyBJNUGkUJJiI7nNtZ3y3x4ZFY8ZBFXpVN2WcBp3QvJJgf39MB5FmTJA +wz2Uu9c9+doj4oIBm8y3sQLBFKoSri9IEfmpy6zzmTkGOkMDLWxglzz+W9WmhqVJ3xXQU 2+cjIqa5b/3xt32XEepgt7fY4bzX+TKfiriAg98l5VAPewn1qBqkoqj2iNdgug== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761156; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cp9QO4815E4Ekn2dxNaB65xCjDebw7VODAmw+PkSESs=; b=eugEQvwRnJmgGkZEz+W7U5V81pE5XcHhL99M1/GQCd1ErGhqpCLeNQUyBSjR97SwtEEWrM LcBHKdq4HgdHtwTe2n80ytjtpEN30pELxdUtyLRruDrFjUkVAPW10i5ZNxO4KWVcgn6j8+ S4o2FN6ZtgDwg04JqaCOj0N06t7e48sdIeNOQ9+pEr2TnJII06S5RoNYQ1wvbwRxKIAFyb bcTuVcepni9rWc6D7ukU3B7wlee/lF5kUDef4CT3+Rg3NQN7J7mUKNWTG820uNRcIWyJQO sJ4YLeMj2VIac8TK+CMjjXMwI0SSGlJlRYFpCsLi1N4qcRngUOBTwSdRB9QFZw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8N4Qynz198H for ; Mon, 29 Jun 2026 19:25:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21d89 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:56 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 31d9802ec2b7 - stable/15 - MAC/do: Configuration: Fix default values: Remove jail creation method List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 31d9802ec2b7f12cc187209fd4fbe6ffc3ccae16 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:56 +0000 Message-Id: <6a42c6c4.21d89.6288bc41@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=31d9802ec2b7f12cc187209fd4fbe6ffc3ccae16 commit 31d9802ec2b7f12cc187209fd4fbe6ffc3ccae16 Author: Olivier Certner AuthorDate: 2026-04-28 13:10:14 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:50 +0000 MAC/do: Configuration: Fix default values: Remove jail creation method mac_do_jail_create() would create a default configuration on the just-created jail, erroneously causing mac_do_jail_set() to then retrieve it and use it as a model when determining the default values for not-specified parameters, instead of using the configuration applicable to the parent jail. Setting a default configuration in mac_do_jail_create() had been done as a kind of defensive measure to prevent a created jail not to have a configuration (effectively making it inherit from an ancestor jail, which is a security hazard except if explicitly requested). However, this measure was never really effective (osd_jail_call(PR_METHOD_CREATE) in kern_jail_set() calls the PR_PETHOD_CREATE methods in an unspecified order, and stops at the first error), so we are forced to rely in any case on the fact that an error in a PR_METHOD_CREATE or PR_METHOD_SET method leads to stopping the jail creation process (which is the case today; see kern_jail_set()). Reviewed by: bapt Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 51cc5840b66c9565e1740c1198a0e684d81e3734) --- sys/security/mac_do/mac_do.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 126feba135c2..33e655a854a4 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1550,16 +1550,6 @@ SYSCTL_PROC(_security_mac_do, OID_AUTO, exec_paths, SYSCTL_JAIL_PARAM_STRING(_mac_do, exec_paths, CTLFLAG_RW, MAX_EXEC_PATHS_SIZE, "Jail MAC/do executable paths"); -static int -mac_do_jail_create(void *obj, void *data) -{ - struct prison *const pr = obj; - - set_default_conf(pr); - - return (0); -} - static int mac_do_jail_get(void *obj, void *data) { @@ -1881,12 +1871,14 @@ mac_do_jail_set(void *obj, void *data) /* * OSD jail methods. * - * There is no PR_METHOD_REMOVE, as OSD storage is destroyed by the common jail - * code (see prison_cleanup()), which triggers a run of our dealloc_jail_osd() - * destructor. + * There is no PR_METHOD_REMOVE method, as OSD storage is destroyed by the + * common jail code (see prison_cleanup()), which triggers a run of our + * dealloc_jail_osd() destructor. There is neither a PR_METHOD_CREATE as + * PR_METHOD_SET is called just after (or the created jail destroyed if some + * PR_METHOD_CREATE fails), and our mac_do_jail_set() will ensure a jail is + * properly configured. */ static const osd_method_t osd_methods[PR_MAXMETHOD] = { - [PR_METHOD_CREATE] = mac_do_jail_create, [PR_METHOD_GET] = mac_do_jail_get, [PR_METHOD_CHECK] = mac_do_jail_check, [PR_METHOD_SET] = mac_do_jail_set, From nobody Mon Jun 29 19:25:58 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8R3Qz0z6jjg8 for ; Mon, 29 Jun 2026 19:25:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8Q74rWz40j6 for ; Mon, 29 Jun 2026 19:25:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761159; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=s2IS3OFEkbo6JfU7hWzH8N/ztUlQpJHLsbV28v3pp1w=; b=Ze4iH3MTNMw4gg8NKapAmhcnn5TIowa6fyVQzjICUZUjmP6tu4I57950rrsPYL5TUmtFT8 9sujW3Qjit958K7MtWJrKEZfgNEX2xM1Bk2c+YM3Mt/TRvps7yb58zCebm/9+LclQ32X9O aRHqM8pehI5Ya9c+s9rJxCbPycP/M/X/yQ5YFcwMxJIKXef01Ta+XqPfQqasx1cX51h5ci xVaa/BaTTPptpG5DSHooEMwAwcSCU3K7o1JlX+Iy3TKZspGAYzK0CvLC//TQoBIour2FXt rQlWuF58Hexv9A8RGdVPCzey+45JPPJ2SwUJJa3dVg3a33otlpzRJkBDFQD/Zw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761159; a=rsa-sha256; cv=none; b=x7m6YSJHVgVJM/lq6slbEG5E+eTnkVzSx3RKJiYws5Pok9WyoPfnajv33ai5lO49X3V8me SiTdJRmS9M7x5a7aVBI1nEjCHGSD+J0/RkAxInsW3RgoyPhmQ7sdlsqvb/Eb8P3voXsJPQ +5cHFXRiYg//53cjMWIJUl2DjstPdKZ/h0Sb6nOGVj6lK+bdQcWGW9WsU9FxRhMAEVJIP6 OpGnEVTOvu7V6BR1duk3NZHaeGTShy8voZhf7roW20xoixgpUjibsRWeyGhUAVWitB7uv9 pXFgLItYlK5Xw5yIi7hAgLnEPT5aWs4vixHuKgKQ0pNJuwBUwpwKe3kDRt0evg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761159; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=s2IS3OFEkbo6JfU7hWzH8N/ztUlQpJHLsbV28v3pp1w=; b=PWS1v22VwKOW7866ftSJhT2ZADa3R+qpm3bAh0l0PPPSTSSn2M1FsPsp1UzAeOlouNmeZk 9HMN6bTrFiXvQd3m4OXm3lLM1NYGhV8TM74PWR/sEYIanuSexQmPc8XJ3ptggOq5NBJrPm +zxg/TWc6yC7puJCQb9AducLt0c8D1+SyAxmO7ZjySiobkM3iV8h51V2eX2XAPfw4sMIYm +7vjiuIFQFVshRAI43LMZXzu5sI+ghM8bXdV7j9ihtZigmV0+jOGo7jsFAum9IvwCYsIM+ eP7ByaC7pJQ8o6KzIYfH4XPMYV5pprLH54eCZQ8HHgyjd8Y/bUaICWVx6msqgw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8Q5tCSz19bd for ; Mon, 29 Jun 2026 19:25:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1e8e8 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:58 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: d0ff8724a4f4 - stable/15 - MAC/do: Visually separate some file sections List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: d0ff8724a4f4cfa75870b72ddc465c5894aee41f Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:58 +0000 Message-Id: <6a42c6c6.1e8e8.263b932e@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=d0ff8724a4f4cfa75870b72ddc465c5894aee41f commit d0ff8724a4f4cfa75870b72ddc465c5894aee41f Author: Olivier Certner AuthorDate: 2026-04-28 13:39:09 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:52 +0000 MAC/do: Visually separate some file sections With additional empty lines. No functional change (intended). Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 01e2b0ce1820adf475e372ec72371dffca17a7af) --- sys/security/mac_do/mac_do.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index f298ad2d4f59..f796e1b5cf76 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -33,6 +33,7 @@ #include + #ifdef INVARIANTS /* * Should typically be moved to libkern (and perhaps libc) at some point, and be @@ -228,6 +229,7 @@ struct id_elem { STAILQ_HEAD(id_list, id_elem); + #ifdef INVARIANTS static void check_type(const id_type_t type) From nobody Mon Jun 29 19:25:59 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8S5pPTz6jjXJ for ; Mon, 29 Jun 2026 19:26:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8S0m4Dz40cR for ; Mon, 29 Jun 2026 19:26:00 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761160; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rZLG+yYaE8N8+SKvJteTtH7qdPCZRgg0HJL9RAM6MOU=; b=ddueXVnZIuBWnks8wYT/hAFPVLRcwV4QW3qglRJhonsFWoye4VxW+SLVEKrpm52bvuqjms vjePp1RALDocF4aYcw5YsFSbYSqIcyPMLpKkHAwY21lM661Q5591lOB6vIyolzTp3DOqkP zZLNqP/j3pAhOqOak28wtBKdEbwN+HyUNLdyTb/DKddQCro2uQzahYXEm6cd6kUn9lWGXK OglxollJPhVxEfaR6x15nAZHhIqFtPNSmzKDgzZ9QnvFv8XarB1YAvwXNimMWs/et49bzv KpC7HP5a5Qp3vKyq8daeRyOsGBaO71NDzrYi4KgbzFdsQOMUVgT7PHOa3fV4zQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761160; a=rsa-sha256; cv=none; b=pylh8Rt+knzt0J5vyufS20bZc9vN8Uosf+kQMTawz0kZs1sUl/L7i+yrLDlo6fPNncNlfZ /RfjHtUs07Pw1PcmfeJh4E1oeA6fEiGjX+N7KHgtz5NfpSeezaQXMiD7VT8qpMLf/wNA3I uXNnCjWMoMJyEA1bulAt4Z1zPlzeU2TK7mkb7KoRsrIfUzGkn4hBbjBjn2jmror24FPLp3 5SFAS6oD4cAcMwUZem00y+aR5V4In0hGhSPe/0y9IPOapQoUuKMt1gmioiBB2skEGtj+nH EpJp8rjwPDhq0PEoPHDIdaC7uRyBu+1k7+IkSPtUjwu2PhAUm/Sry/6RzrtLwA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761160; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rZLG+yYaE8N8+SKvJteTtH7qdPCZRgg0HJL9RAM6MOU=; b=R5G0UTdf6yvl5aMOU57WR2dY8U3jonAqmoRHtco4kqXyOTTOd1PlzH75JWdGnJ8hn5p28T PnzK83salSA/RqgrqyrcGz0M5+sytxaQ3eio2inh0/fhAFzbmt5x1wvgWVkq1pKUvzv687 W+M+ZqPGjnbNs9fbVeZlpOelv98DrwqbKjW+UNIINBytmqsSxpOsbC4prPfGUIhQc/dgQn vY2wcq33jdC4nCtnR54smQQ9cBvfTpovbC49H2JGYozkBKJLHzyjwDv7/l4IfTEuF4/JbD VLGcRjnkRaJjZ9NOAcwbL3m3g+wDVh/bx3RsmIjswztaeHJbJMkUnovDCjGhbA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8R6lxpz19cg for ; Mon, 29 Jun 2026 19:25:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21868 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:25:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: ddad09993fdd - stable/15 - MAC/do: Allocate only one default configuration List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: ddad09993fdd606d65611afac7fc987339401e80 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:25:59 +0000 Message-Id: <6a42c6c7.21868.176717fb@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=ddad09993fdd606d65611afac7fc987339401e80 commit ddad09993fdd606d65611afac7fc987339401e80 Author: Olivier Certner AuthorDate: 2026-04-29 13:12:10 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:52 +0000 MAC/do: Allocate only one default configuration When mac_do(4) is loaded, all jails get the same default configuration (disabled, with only one allowed executable path: '/usr/bin/mdo'). Share it between all jails instead of creating a separate copy for each. Reviewed by: bapt Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 31ef4ee2e3570b8f438b9b3fb09b3d87c87419ff) --- sys/security/mac_do/mac_do.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index f796e1b5cf76..4ba545ec5a19 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1360,21 +1360,19 @@ set_conf(struct prison *const pr, struct conf *const conf) drop_conf(old_conf); } -/* - * Assigns the default configuration to a jail. - */ -static void -set_default_conf(struct prison *const pr) +static struct conf * +new_default_conf(void) { - struct conf *const conf = new_conf(); + const char *const mdo_path = "/usr/bin/mdo"; + struct conf *conf = new_conf(); - strlcpy(conf->exec_paths.exec_paths_str, "/usr/bin/mdo", + strlcpy(conf->exec_paths.exec_paths_str, mdo_path, MAX_EXEC_PATHS_SIZE); - strlcpy(conf->exec_paths.exec_paths[0], "/usr/bin/mdo", PATH_MAX); + strlcpy(conf->exec_paths.exec_paths[0], mdo_path, + PATH_MAX); conf->exec_paths.exec_path_count = 1; - set_conf(pr, conf); - drop_conf(conf); + return (conf); } static void @@ -2523,14 +2521,16 @@ mac_do_setcred_exit(void) static void mac_do_init(struct mac_policy_conf *mpc) { + struct conf *const default_conf = new_default_conf(); struct prison *pr; osd_jail_slot = osd_jail_register(dealloc_jail_osd, osd_methods); - set_default_conf(&prison0); + set_conf(&prison0, default_conf); sx_slock(&allprison_lock); TAILQ_FOREACH(pr, &allprison, pr_list) - set_default_conf(pr); + set_conf(pr, default_conf); sx_sunlock(&allprison_lock); + drop_conf(default_conf); osd_thread_slot = osd_thread_register(dealloc_thread_osd); } From nobody Mon Jun 29 19:26:01 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8T5WjRz6jjLj for ; Mon, 29 Jun 2026 19:26:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8T1cb8z40jQ for ; Mon, 29 Jun 2026 19:26:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761161; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5Z6CmqvdSHgk1sShyC7GVQMcDsZ3fSX/JLoQOu2dBUY=; b=akm+gHPvcSrjs4MdZIsWk3BbOXfu3ZtZiYWtivRw/64UbWo/53vDwhirjVUGQlsUdbpoFD apDvd7Wnydtq6Xj6sYteAc5OBSq/NrYE4RRNUmjnMEeV6+4jfjO7eNjdJRnpIkua9hYdPf se/NEtW4xc0sRjYVaJbLR96keNX+Qpl5Z5iDFhjab2U6fHgYIPLQzLnnTDVAqKJr5UyqY2 Yvnb0ZivGbZKV9PN9AQGg+s6wtc5ntLdN76TVg/0ilplA0+IqMAVXuXtkrm4VyA/kZ1DSL S96h3JpKWLvNd9B0FW5ZCnAaS2OPE7br6FuZOkEO5nC+pOrsALMNvpbYDgewbQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761161; a=rsa-sha256; cv=none; b=txTcbu9KzOjdGUObqdl246dBFuEZfiYW2cDMiC2vcRUDrDRZaTs2ohMUtAMlzJ9rHtCNCr LwZe5YO7a6UNGRZ09JLK9bU3HctAlvdlnJReRrNv9lVP5D2TuOsaLOqS3j1O/SnWB6Bjp9 0AG3qR7eJxIqUTaOg+gtaRAH3GKfQNTDTTmiyL3ECr4WKzfEo8xd40LNXiRZvq7tDXjyg2 JJtW+crNcjncaqUVWV9105dXrqrJdKAU5a0rPH9yaBPKhdrl2P9kAdQLQ5ZGsDAySgh8aV ptE11Hn0nRx28Wk7WvcoLXJAjEWoEC6nEQ5UWeQLYpG+oa7v0O0T0pKtH2JWDQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761161; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5Z6CmqvdSHgk1sShyC7GVQMcDsZ3fSX/JLoQOu2dBUY=; b=d+4d68Ad2x44/bcPTWwlClz/zTForEIDkrF9XJfvWLqYO582QY/FjWMfeABuSsUfCKdUz+ VlovoJrCa4XXLftaU0myx9IYg9f+tlmKRH28iqcCVAKU5xbT7kW15N7AK9A0WxrB/SqSTS e0wdo5UNKI7KPEwtcn+QbzLhU0QLKgvflOy8AgUNIc010EUorKV9RyVmk3MkPCoZI7/X2N ow705eNVSrKrY66oDCGdpfDltqfsZ3AV8Zx48IEaurKNzM/UHO2YewNi1pclcqtshJWQPk M8eifnxWmlKdWy/G99SdBK5iCRZw61oqnaxnxwJwU+Lujiyvx9y4txGf0rkmrw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8T0c3Cz19fp for ; Mon, 29 Jun 2026 19:26:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21e88 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:26:01 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: a6398c245128 - stable/15 - MAC/do: Comment to explain the main invariant for configurations List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a6398c245128cbc5a2b9a98971ea09ef03bb6234 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:26:01 +0000 Message-Id: <6a42c6c9.21e88.10e774c6@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=a6398c245128cbc5a2b9a98971ea09ef03bb6234 commit a6398c245128cbc5a2b9a98971ea09ef03bb6234 Author: Olivier Certner AuthorDate: 2026-04-29 17:11:34 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:53 +0000 MAC/do: Comment to explain the main invariant for configurations Once visible, configuration structures must *never* change. Spell that out in a comment to help future readers/contributors understand the design. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 5bedb5e44757ba83dba9d618f5b951416cf44345) --- sys/security/mac_do/mac_do.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 4ba545ec5a19..a175b92c764d 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -212,6 +212,11 @@ struct exec_paths { int exec_path_count; }; +/* + * Once in use, i.e., being pointed to by a jail, a configuration structure MUST + * NEVER CHANGE (except for the 'use_count' field). This invariant is + * fundamental to correctness! + */ struct conf { struct rules rules; struct exec_paths exec_paths; From nobody Mon Jun 29 19:26:02 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8V5Jy6z6jjRd for ; Mon, 29 Jun 2026 19:26:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8V2pl2z40pT for ; Mon, 29 Jun 2026 19:26:02 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761162; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XmNuQTeTJc8JuPrnZJZjFWb98BwXVGAYr/i0ROkr1oA=; b=RYDqaANRrdm4w9RRGtHPnk1mv2PZbNotDi/xFoeTZcoaSYXmab69xDL49LBsTKCqaP7PuQ MLDMMNO6wsO4fazIYTa62j+80cMxZa+SB6IY8Y+ibkyqygvVziiNFrHzxJBc1yUxVR6bl/ Dvo4furZfMZUdDGQP1nYaZeWTb99eXEGSButVIo4NQWEKd3DnGlEkhC5JZzLE1Zr+u5GdL GxClQND5C8wZclRndgLM4G7iBcXWlRrCzxS4xvC7gSrs0GPhQvNfpnusj0v5ksRCPrXhuR KVFo9j6XlnQqoPhZmzYyYzw3gjHtHQ3pkQWkOrsfq0WaWqBgWTMVe30tMkF+hA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761162; a=rsa-sha256; cv=none; b=sS9Cwqg2SyZHo6Zkg98QnbgYN6omO2wnkqBdMZCQ/QcwTXLl6CoRyzFdtRJwTOjg31P1he A2j6G6Kp2k8tw8OCRZMqlcxGAWK6kPAIr1JO+hHZ+O9JMfjitwk4S0UK0mcggdv1LAVSQv mp9NXR/soiL+ahG3w3Alaoc6vNl2n6YtKDX/edLJr0EK7xmKEuqR2/54rEzddde4qQu5Y0 amqOSucm1o05l/G4PPQlOEczwPGwIr3atRJFY4UV9+3hafl9KnAo76gWDJELnjBt/JILap TIN7iBZ6SF6ZyZfD2pCZ4him5YEO8TRbKCm7rJpmIyZOA0Z+Tq+e+0eN9CwUrQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761162; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XmNuQTeTJc8JuPrnZJZjFWb98BwXVGAYr/i0ROkr1oA=; b=TQPRRBxahqiAHvoj9eYKmJ76R0Ha3hgFJU1XPCxY69K5tPsmZ7oK9zKO4zVbKGcGhXj/kU xVZAIPBfC/boD55pWbOlwEVeyquWHjQ2NQ5fsQ61uCnwkFL0nAUWU/q2WTxMizBDbR0ECJ SWaCFZ21FabnMK779cvIppFbmEPLqL3O+05ZiiMLaS9HXrVK1JNBjNiYFX3j/Yfs3F09Yf JgOYzmiW/gxME53q97Y6NYkWY79WKq2Rj4+4Tpl0G1UyRIno60zFhsUGLiza45XCH/vHxw c283BTZdd8ulmTgg1yMFLwfmy30ElXA+uukaC9I3f34tzTe6nzWlOv0Ec0HNyA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8V1TBwz198J for ; Mon, 29 Jun 2026 19:26:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21b76 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:26:02 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 84af2a5ba34b - stable/15 - MAC/do: Sequential consistency for configuration retrieval List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 84af2a5ba34b6bdcaa73bd2b9d5e38f82ecf6afd Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:26:02 +0000 Message-Id: <6a42c6ca.21b76.6ca34e87@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=84af2a5ba34b6bdcaa73bd2b9d5e38f82ecf6afd commit 84af2a5ba34b6bdcaa73bd2b9d5e38f82ecf6afd Author: Olivier Certner AuthorDate: 2026-04-29 17:14:13 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:54 +0000 MAC/do: Sequential consistency for configuration retrieval Since the inception of mac_do(4), find_conf(), used to retrieve the applicable configuration, has been weakly consistent with respect to concurrent modifications to configuration inheritance that influence its result (and it has been sequentially consistent with respect to other configuration modifications, which the initial executable paths feature and introduction of implicit parameters broke and which will be fixed in a subsequent commit). Indeed, find_conf() climbs the jail tree to find an applicable configuration, which is not an atomic operation. It examines the current jail's configuration pointer for each browsed jail, which does not prevent concurrent modifications of the configuration pointer for jails below or above it. Modifications above the current jail are not a problem, since if climbing needs to continue (i.e., the current jail inherits), these modifications will be seen if performed before that check (and may or may not be seen if performed after that check). However, modifications below the current jail impair sequential consistency, because they could be done before other modifications at the current jail or higher up, and the latter could still be picked up by the rest of the climb, effectively ignoring that the former should have blocked the climb earlier, making them look as if they had happened after for the climbing thread. As a concrete example of this situation, let's examine a scenario where some jail A is the parent of some jail B, and B inherits its configuration from A. An administrator may want to relax the rules only for jail A but not B. To this end, he first copies the current rules on B over to A and then relaxes the rules on A. He can intuitively and reasonably expect that changing B's rules first will prevent A's relaxed rules to leak to threads in B. Unfortunately, that is not the case: As explained in the previous paragraph, there can be a time window where threads from B can still pick up A's new configuration just after it has been installed. This arguably makes changing inheritance in mac_do(4) in a fully secure fashion almost impossible. If preserving fine-grained locking of prisons, we could prevent this problem by having find_conf(), once it has climbed to a non-NULL pointer (actual, non-inherited configuration), do another climb to check that it can reach the same configuration on the same jail again. If the new climb gives another pointer or jail, it could make it the new candidate and do a climb check again until the situation stabilizes. A climb check detects whether changes in jails below that of the candidate configuration object happened, catching in particular such changes that happened before changes to the candidate object. However, that process alone would still be subject to ABA problems, and we would additionally need to tag each prison with some modification timestamp (global, or local but necessitating allocating memory during the check) to fix them. In the end, we considered this direction to be unnecessarily complex, given that configuration changes are to be rare events and most uses will just be configuration determination. Consequently, switch protecting jail configurations with a single read-mostly lock. While here, adapt set_conf() to accept NULL as the new configuration object, and have remove_conf() call it, which removes duplicated code. While here, add a comment explaining why we do not need to take any more locks when climbing the jail tree. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 5b194a4ae3190a9954544058dfc0790fd9a16172) --- sys/security/mac_do/mac_do.c | 112 ++++++++++++++++++++++++------------------- 1 file changed, 64 insertions(+), 48 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index a175b92c764d..0c1bf101d3ee 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -24,6 +24,7 @@ #include #include #include +#include #include #include #include @@ -74,6 +75,8 @@ _Static_assert(MAX_RULE_STRING_SIZE > 0, _Static_assert(MAX_EXEC_PATHS_SIZE > 0, "MAX_EXEC_PATHS_SIZE: No space for the NUL terminator!"); +struct rmlock mac_do_rml; + static unsigned osd_jail_slot; static unsigned osd_thread_slot; @@ -1230,28 +1233,46 @@ drop_conf(struct conf *const conf) * * If 'hpr' is not NULL, it is used to return a pointer to the (unlocked) prison * holding the applicable configuration. + * + * The find_conf_unlocked() variant needs 'mac_do_rml' to be (read- or write-) + * locked. The find_conf() variant will take a read lock for the duration of + * the search. + * + * The configuration returned by this function is sequentially consistent with + * other concurrent reads and configuration modifications, even in the presence + * of concurrent changes of configurations higher up in the jail tree (whether + * they "change" the value of some parameters, install a new configuration where + * there wasn't any, breaking inheritance from higher up, or remove an existing + * one, establishing inheritance from higher up). */ static struct conf * find_conf(struct prison *const pr, struct prison **const hpr) { - struct prison *cpr, *ppr; + struct prison *cpr, *ppr; /* Current and parent. */ struct conf *conf; + struct rm_priotracker rmpt; + rm_rlock(&mac_do_rml, &rmpt); + /* + * We do not need to take any locks here to climb the prison tree as + * either the start prison ('pr') is that of the current thread (and our + * ancestors are necessarily stable), or it is a prison passed by the jail + * machinery to an OSD method, in which case the prison tree lock is + * already being held. + */ cpr = pr; for (;;) { - prison_lock(cpr); - conf = osd_jail_get(cpr, osd_jail_slot); + conf = osd_jail_get_unlocked(cpr, osd_jail_slot); if (conf != NULL) break; - prison_unlock(cpr); ppr = cpr->pr_parent; /* - * 'prison0' normally always have a mac_do(4) configuration - * because we installed one on module load/activation and - * nothing can destroy it as 'prison0' is not a regular jail and - * the 'mac.do' parameter cannot be set to 'inherit' on it, - * which is the only way to clear an existing configuration. + * 'prison0' always has a mac_do(4) configuration because we + * installed one on module load/activation and nothing can + * destroy it as 'prison0' is not a regular jail and the + * 'mac.do' parameter cannot be set to 'inherit' on it, which is + * the only way to clear an existing configuration. */ KASSERT(ppr != NULL, ("MAC/do: 'prison0' must always have a configuration.")); @@ -1259,10 +1280,11 @@ find_conf(struct prison *const pr, struct prison **const hpr) } hold_conf(conf); - prison_unlock(cpr); + rm_runlock(&mac_do_rml, &rmpt); if (hpr != NULL) *hpr = cpr; + return (conf); } @@ -1310,59 +1332,50 @@ dealloc_jail_osd(void *const value) } /* - * Remove the rules specifically associated to a prison. - * - * In practice, this means that the rules become inherited (from the closest - * ancestor that has some). + * Assign an already-built configuration to a jail. * - * Destroys the 'osd_jail_slot' slot of the passed jail. + * Takes care of write-locking 'mac_do_rm', which should be unlocked on entry + * and will be unlocked on exit. */ static void -remove_conf(struct prison *const pr) +set_conf(struct prison *const pr, struct conf *const conf) { + void **const rsv = conf != NULL ? osd_reserve(osd_jail_slot) : NULL; struct conf *old_conf; - int error __unused; + int error __diagused; - prison_lock(pr); - /* - * We burden ourselves with extracting rules first instead of just - * letting osd_jail_del() call dealloc_jail_osd() as we want to - * decrement their use count, and possibly free them, outside of the - * prison lock. - */ - old_conf = osd_jail_get(pr, osd_jail_slot); - error = osd_jail_set(pr, osd_jail_slot, NULL); - /* osd_set() never allocates memory when 'value' is NULL, nor fails. */ - MPASS(error == 0); - /* - * This completely frees the OSD slot, but doesn't call the destructor - * since we've just put NULL in the slot. - */ - osd_jail_del(pr, osd_jail_slot); - prison_unlock(pr); + if (conf != NULL) + hold_conf(conf); + + rm_wlock(&mac_do_rml); + old_conf = osd_jail_get_unlocked(pr, osd_jail_slot); + error = osd_jail_set_reserved(pr, osd_jail_slot, rsv, conf); + KASSERT(error == 0, ("MAC/do: osd_jail_set_reserved() failed " + "with 'conf' = %p and 'rsv' = %p", conf, rsv)); + if (conf == NULL) + /* + * This completely frees the OSD slot, but doesn't call the + * destructor since we've just put NULL into the slot. + */ + osd_jail_del(pr, osd_jail_slot); + rm_wunlock(&mac_do_rml); if (old_conf != NULL) drop_conf(old_conf); } /* - * Assign an already-built configuration to a jail. + * Remove the rules specifically associated to a prison. + * + * In practice, this means that the rules become inherited (from the closest + * ancestor that has some). + * + * Destroys the 'osd_jail_slot' slot of the passed jail. */ static void -set_conf(struct prison *const pr, struct conf *const conf) +remove_conf(struct prison *const pr) { - struct conf *old_conf; - void **rsv; - - hold_conf(conf); - rsv = osd_reserve(osd_jail_slot); - - prison_lock(pr); - old_conf = osd_jail_get(pr, osd_jail_slot); - osd_jail_set_reserved(pr, osd_jail_slot, rsv, conf); - prison_unlock(pr); - if (old_conf != NULL) - drop_conf(old_conf); + set_conf(pr, NULL); } static struct conf * @@ -2529,6 +2542,8 @@ mac_do_init(struct mac_policy_conf *mpc) struct conf *const default_conf = new_default_conf(); struct prison *pr; + rm_init(&mac_do_rml, "mac_do(4)"); + osd_jail_slot = osd_jail_register(dealloc_jail_osd, osd_methods); set_conf(&prison0, default_conf); sx_slock(&allprison_lock); @@ -2549,6 +2564,7 @@ mac_do_destroy(struct mac_policy_conf *mpc) */ osd_thread_deregister(osd_thread_slot); osd_jail_deregister(osd_jail_slot); + rm_destroy(&mac_do_rml); } static struct mac_policy_ops do_ops = { From nobody Mon Jun 29 19:26:03 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8W5gVHz6jjPS for ; Mon, 29 Jun 2026 19:26:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8W2sKvz40jf for ; Mon, 29 Jun 2026 19:26:03 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761163; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4Trtu/2/7HGuDOk3YuMjInne6m9UaGqPOde34IN8qmM=; b=V7H06ZrgA/EihgOM1qpHFfv6i8jvUtb132eVvxPKkM+Jngf90A7SqrdcRPcGQEqzsciZKD fjyc7bEf7X6UJpbiFBbEY4GbN8l8Ve7StmJYJ9weOPJmD89X0iJkwDToPwPFLAThE5THbY yICAJi1TTt4p/TlFx3LStkATWRQmJvNS55qsIWoEJSN43RJpa2VBBKb6pJyyhh7ldsobs0 zQWgY6i1eehV327FOB+n42F1JbIrSdL7kRXFZA1yXSrzDlrBBJ5F3Dn0A855YkdCD5kJvJ 7RjlfQVXR8V1R8VkbZn+bSXJQhTEZ2lZOkaj/TLADur6jRU7j1Q4lnnkq+Hl0A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761163; a=rsa-sha256; cv=none; b=cuIMcMLtadn/c8hQHQJCV8Ox17qpUnRotvV5a4rsnt1Wg+p+NX+zk+jHSi9LAS3huLwvWP fXcbmHyWjGp8pnggsTlyvF0+5lBuVq9nRgfIIseTVQeo3Cd3RCDvnwV91YkZ9djKqHHOpp /f0XJepctbnkLPsDg+Mbestl4ZoG+uIbxHEwCPvdbb29Q7RGD6neaUtXp9At+AUgkLHygy /s7a49HzyP1nyHL8nKXHe+9MT/YqWaZONfyIAE6NERodEtGzh4HJPJzJ7P6/RMXN4+mhr5 +uNWZ0Y3KYB1OosM7kC9o5//6SSsurt+zQ2ysDA6dotp/g1aL7HgHzuLTX1NnA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761163; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4Trtu/2/7HGuDOk3YuMjInne6m9UaGqPOde34IN8qmM=; b=vtVd41+nMZYwnUop7unHSKa95jn3o1ivqIk0Ig1qfvhxKI+JCjpYLggBoP7S9swiMX6NCu tGfgv9S5dFDRsp4E8b4WL3GbHu00TYjblQfhtqIHuw35MWnhFiMfhdZLkS0U2Qu0VLyjAZ wBS2n0TmjpjpS+X6qzttJQDQuEg9EEblnBHP3hojH1R3I4ZAF2Nb08JIkAgoWzfkCy/94S NLTsiN1WzAr+lM8B2SCJWthG8SLN0n9hAqDF70nhWAYJ6lD7EHiqEOtEv/CQQ6u3tIGPo/ pGoSdOLM9lWxYDyK7jeF7vA/Hk14jn/2uEf5j2qVRepZQQcZCRVVlDnIUJR33Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8W1srVz19fq for ; Mon, 29 Jun 2026 19:26:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21b7a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:26:03 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: d344d17c24dd - stable/15 - MAC/do: Support for atomically modifying configurations List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: d344d17c24dd4dfa876706032799a2d2853ce74a Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:26:03 +0000 Message-Id: <6a42c6cb.21b7a.2adb93e@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=d344d17c24dd4dfa876706032799a2d2853ce74a commit d344d17c24dd4dfa876706032799a2d2853ce74a Author: Olivier Certner AuthorDate: 2026-04-29 16:28:44 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:54 +0000 MAC/do: Support for atomically modifying configurations As mentioned in previous commits "MAC/do: parse_and_set_conf(): Require the model configuration" and "MAC/do: Sequential consistency for configuration retrieval", the introduction of the "executable path" feature, more fundamentally, the fact that there is now more than one per-jail parameter and that parameters can be independently modified or copied, causes an atomicity problem in case of concurrent accesses to of a jail's applicable configuration. Partially modifying a configuration is indeed akin to a read-modify-write operation, where the read is either to the current or an inherited configuration. More precisely, once pointed to by a jail, a configuration object is immutable, and changing the jail's configuration means making the jail point to another configuration object. To change a jail's configuration, a new configuration object is thus built, and if only some parameters have been explicitly specified, those that have not been are set by copying the corresponding values from an existing configuration object (in case of partial modification of the existing configuration, from the original configuration object that is going to be replaced; in case of breakage of inheritance or at jail creation, from the applicable configuration object, which is on an ancestor jail). This process is not immune to concurrent modifications because nothing prevents changes of configurations between reading existing values and setting the new configuration. Thus, some other thread could change the value of a parameter after a copy of it has been made into the new object but before that copy is actually installed, which effectively will erase the other thread's modification. To avoid this, we introduce support for serializing configuration changes on a given jail. To this end, we move the jail climbing process from find_conf() into find_conf_locked(), and make the former call the latter in a read-locked section. Similarly, we isolate setting a configuration in the new set_conf_locked() function, and make set_conf() call it inside a write-locked section. The new *_unlocked() variants make it possible to prevent any configuration access between determining and reading an applicable configuration, computing from it a new configuration object and finally setting it, by holding a write lock over the whole process (there is a trade-off here, as read-mostly locks cannot be upgraded), effectively making it atomic and realizing full sequential consistency of configuration changes. Also, the 'mac_do_rm' global read-mostly lock is made sleepable so that it can be write-locked over sysctl_handle*() functions or memory allocations (eases implementation, at the expense of a potential loss of concurrency which is most probably irrelevant). No functional change (intended) at this point. Reviewed by: bapt Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 0db7f110cb810b7aa6d29df221edf9091d66b58a) --- sys/security/mac_do/mac_do.c | 64 +++++++++++++++++++++++++++++++++----------- 1 file changed, 49 insertions(+), 15 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 0c1bf101d3ee..c493c47a84df 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1246,13 +1246,12 @@ drop_conf(struct conf *const conf) * one, establishing inheritance from higher up). */ static struct conf * -find_conf(struct prison *const pr, struct prison **const hpr) +find_conf_locked(struct prison *const pr, struct prison **const hpr) { struct prison *cpr, *ppr; /* Current and parent. */ struct conf *conf; - struct rm_priotracker rmpt; - rm_rlock(&mac_do_rml, &rmpt); + rm_assert(&mac_do_rml, RA_LOCKED); /* * We do not need to take any locks here to climb the prison tree as * either the start prison ('pr') is that of the current thread (and our @@ -1280,11 +1279,20 @@ find_conf(struct prison *const pr, struct prison **const hpr) } hold_conf(conf); - rm_runlock(&mac_do_rml, &rmpt); - if (hpr != NULL) *hpr = cpr; + return (conf); +} + +static struct conf * +find_conf(struct prison *const pr, struct prison **const hpr) +{ + struct conf *conf; + struct rm_priotracker rmpt; + rm_rlock(&mac_do_rml, &rmpt); + conf = find_conf_locked(pr, hpr); + rm_runlock(&mac_do_rml, &rmpt); return (conf); } @@ -1332,22 +1340,29 @@ dealloc_jail_osd(void *const value) } /* - * Assign an already-built configuration to a jail. + * Sets a mac_do(4) configuration on a jail. * - * Takes care of write-locking 'mac_do_rm', which should be unlocked on entry - * and will be unlocked on exit. + * 'conf' is the new conf to set (can be NULL), and an additional reference will + * be taken on it to represent the jail holding it (if not NULL). 'rsv' must + * have been allocated through osd_reserve() (if 'conf' is not NULL; else can + * be NULL). + * + * The previous configuration on the jail (or NULL) is returned (with an + * associated reference if not NULL). */ -static void -set_conf(struct prison *const pr, struct conf *const conf) +static struct conf * +set_conf_locked(struct prison *const pr, struct conf *const conf, + void **const rsv) { - void **const rsv = conf != NULL ? osd_reserve(osd_jail_slot) : NULL; struct conf *old_conf; int error __diagused; + KASSERT(conf == NULL || rsv != NULL, + ("MAC/do: OSD reserve needed to avoid allocating memory")); + rm_assert(&mac_do_rml, RA_WLOCKED); + if (conf != NULL) hold_conf(conf); - - rm_wlock(&mac_do_rml); old_conf = osd_jail_get_unlocked(pr, osd_jail_slot); error = osd_jail_set_reserved(pr, osd_jail_slot, rsv, conf); KASSERT(error == 0, ("MAC/do: osd_jail_set_reserved() failed " @@ -1358,8 +1373,27 @@ set_conf(struct prison *const pr, struct conf *const conf) * destructor since we've just put NULL into the slot. */ osd_jail_del(pr, osd_jail_slot); - rm_wunlock(&mac_do_rml); + return (old_conf); +} +/* + * Immediately replace the jail's configuration. + * + * To be used only if the configuration to set does not depend in any way on the + * currently applicable configuration. + * + * Takes care of write-locking 'mac_do_rml', which should be unlocked on entry + * and will be unlocked on exit. + */ +static void +set_conf(struct prison *const pr, struct conf *const conf) +{ + void **const rsv = conf != NULL ? osd_reserve(osd_jail_slot) : NULL; + struct conf *old_conf; + + rm_wlock(&mac_do_rml); + old_conf = set_conf_locked(pr, conf, rsv); + rm_wunlock(&mac_do_rml); if (old_conf != NULL) drop_conf(old_conf); } @@ -2542,7 +2576,7 @@ mac_do_init(struct mac_policy_conf *mpc) struct conf *const default_conf = new_default_conf(); struct prison *pr; - rm_init(&mac_do_rml, "mac_do(4)"); + rm_init_flags(&mac_do_rml, "mac_do(4)", RM_SLEEPABLE); osd_jail_slot = osd_jail_register(dealloc_jail_osd, osd_methods); set_conf(&prison0, default_conf); From nobody Mon Jun 29 19:26:04 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8Y0W3xz6jjcs for ; Mon, 29 Jun 2026 19:26:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8X4Q2Pz40dD for ; Mon, 29 Jun 2026 19:26:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761164; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MD6au5c9B9xnimmvuFc+YlU9eiAYVbkXqOe/ov932YA=; b=u75yZRQaXfSir+s0OMibABIP9w98fCEEpr8BVp7soUNd4QxAF9Ei/CRRlQyKHtt3APUIi7 dG/oqTMVuG1n5YyWs6WnIWT0DKTwL36GzP0MKgjXcYruwF8ThEXqVaosChLPLgsIbLSdJS WWs+pggifCCCTudNv3zvRFEWxaxMdQpiOtTUO5hNAYUYGGGRC7PrU3eRc2yHISEx5WZJtF 5Am5j1s62KEf4jiMKV3GDu8iQifvhjbvO8rM+GbuPnxteZUSSAV2bpJSNtVOJOEayEqQKz lLKvpKLpiK1vGVXfQTf8A6aDGUoRDgxfjDHrcgQi3606unNZmR/yXN/AHACqsQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761164; a=rsa-sha256; cv=none; b=t1VSWLg3BpyPIbRvBmWmIbMYkxH6yVX7VF5aQbHUf6x2sPL/lA/yEx56Yrd9ra7lOzG8IL qmDihA92qZdePdJ9PTBPNVnixTBrJZO8niDCMpEfyjQUlxKKJqa4AFfsoHeZoJQxMEOQfw 42gqNBNRX4Z1r4HXgn+6c1Nwm6aMhl5wu8LYffcUTdkF1LH4h3UPV8fGOMgkh2r+gGKsBI 3frECVQM2/NJwxs2Mf8mnw3QXFycBhV01x0htUMA7JJy211gR74iLG+BH2ZdFal62REeg9 Hx6/Gwjgfd9HCiWsJjc2hPwyflDM/qM9FBHsug7kpfoyXlFJdRCXODwN3uZngw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761164; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MD6au5c9B9xnimmvuFc+YlU9eiAYVbkXqOe/ov932YA=; b=bdLSRRsTd/CrpZp3cx9quzmLOtOIOln5GWznLZ1/fOIkJcaM6b/OdYZ458znR8WMwSLXeZ x95h1THkzVPR4rPUbk0oGNNX0Ie7Egwa0bVcqWE59EZZqZr9HSkvQxgo1H/RocAIzdBU59 CSKr3T8eoymvutVbmfdwINZUVXnEbcHhoYGtFJZS9ZsLNi/Xk0cdAVrJl+OFoiutrDZB1x lzMItNNxObAlcbqS9YIK7Zht+xOJbM/sn1cULMeR07qAfrPz5zseR9AHsoHF8xdpg6SYI/ JCyBNNMVgiUfCtjL2605AorM2/hk/bf596WsLOP+Pd4F52r3+6J6/YuK5vzvnA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8X2jRcz19fr for ; Mon, 29 Jun 2026 19:26:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 208c9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:26:04 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: ac9d12f27abf - stable/15 - MAC/do: Serialize installing/modifying some jail's configuration List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: ac9d12f27abf57bc27212f3215445b1b6d8cc67f Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:26:04 +0000 Message-Id: <6a42c6cc.208c9.23b48a2f@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=ac9d12f27abf57bc27212f3215445b1b6d8cc67f commit ac9d12f27abf57bc27212f3215445b1b6d8cc67f Author: Olivier Certner AuthorDate: 2026-04-29 18:32:56 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:55 +0000 MAC/do: Serialize installing/modifying some jail's configuration See the immediately preceding commit for explanations on what this is fixing. When setting 'mac.do' to 'inherit' on a jail with 'mac.do.rules' and 'mac.do.exec_paths' also specified in the same call, ensure that the check that these passed parameters are the same as those to be inherited is atomic with respect to enabling the inheritance (i.e., removing the jail's 'struct conf' object). (See previous commit "MAC/do: Fix the recent logic to set jail parameters, make it more tolerant" as for why this check exists.) Because we currently only modify a single configuration object per transaction, we introduce the parse_and_commit_conf() wrapper around parse_and_set_conf() to remove duplicated code that would ensue from calling the latter directly, namely, releasing the 'mac_do_rwl' lock and freeing the old configuration object (if any). Taking the 'mac_do_rwl' lock for writing as a way to freeze all accesses to mac_do(4) configurations was deemed too thin an operation to be worth wrapping. Reviewed by: bapt (older version) Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 4c98f7a0025eea550ecf6f93f818cd03c6ac0fd5) --- sys/security/mac_do/mac_do.c | 99 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 76 insertions(+), 23 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index c493c47a84df..9ca6874ce145 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1406,10 +1406,10 @@ set_conf(struct prison *const pr, struct conf *const conf) * * Destroys the 'osd_jail_slot' slot of the passed jail. */ -static void -remove_conf(struct prison *const pr) +static struct conf * +remove_conf_locked(struct prison *const pr) { - set_conf(pr, NULL); + return (set_conf_locked(pr, NULL, NULL)); } static struct conf * @@ -1483,11 +1483,15 @@ clone_exec_paths(struct exec_paths *const dst, * parameters are copied from those of the passed model configuration (which is * expected to be the currently applicable configuration, i.e., that of the * closest ancestor jail that has one). + * + * 'mac_do_rml' needs to be write-locked (and stays so). 'old_conf' serves to + * return, on no error, the old configuration with a reference (which must be + * eventually freed). */ static int parse_and_set_conf(struct prison *const pr, const char *const rules_string, const char *const exec_paths_string, const struct conf *const model_conf, - struct parse_error **const parse_error) + struct conf **const old_conf, struct parse_error **const parse_error) { struct conf *const conf = new_conf(); int error = 0; @@ -1513,7 +1517,8 @@ parse_and_set_conf(struct prison *const pr, const char *const rules_string, clone_exec_paths(&conf->exec_paths, &model_conf->exec_paths); - set_conf(pr, conf); + MPASS(error == 0); + *old_conf = set_conf_locked(pr, conf, osd_reserve(osd_jail_slot)); MPASS(error == 0 && *parse_error == NULL); out: @@ -1524,6 +1529,30 @@ error: goto out; } +/* + * Calls parse_and_set_conf() and closes the current configuration transaction. + * + * Closes the transaction by unlocking 'mac_do_rml' and releasing the old + * configuration returned by parse_and_set_conf(). + */ +static int +parse_and_commit_conf(struct prison *const pr, const char *const rules_string, + const char *const exec_paths_string, const struct conf *const model_conf, + struct parse_error **const parse_error) +{ + struct conf *old_conf; + int error; + + error = parse_and_set_conf(pr, rules_string, exec_paths_string, + model_conf, &old_conf, parse_error); + rm_wunlock(&mac_do_rml); + + if (error == 0 && old_conf != NULL) + drop_conf(old_conf); + return (error); +} + + static int mac_do_sysctl_rules(SYSCTL_HANDLER_ARGS) { @@ -1533,14 +1562,23 @@ mac_do_sysctl_rules(SYSCTL_HANDLER_ARGS) struct parse_error *parse_error = NULL; int error; - conf = find_conf(pr, NULL); + if (req->newptr != NULL) { + rm_wlock(&mac_do_rml); + conf = find_conf_locked(pr, NULL); + } else + conf = find_conf(pr, NULL); strlcpy(buf, conf->rules.string, MAX_RULE_STRING_SIZE); error = sysctl_handle_string(oidp, buf, MAX_RULE_STRING_SIZE, req); - if (error != 0 || req->newptr == NULL) + if (req->newptr == NULL) + goto out; + if (error != 0) { + rm_wunlock(&mac_do_rml); goto out; + } - error = parse_and_set_conf(pr, buf, NULL, conf, &parse_error); + /* Unlocks 'mac_do_rml'. */ + error = parse_and_commit_conf(pr, buf, NULL, conf, &parse_error); if (error != 0) { if (print_parse_error) printf("MAC/do: Parse error at index %zu: %s\n", @@ -1573,14 +1611,23 @@ mac_do_sysctl_exec_paths(SYSCTL_HANDLER_ARGS) struct parse_error *parse_error = NULL; int error; - conf = find_conf(pr, NULL); + if (req->newptr != NULL) { + rm_wlock(&mac_do_rml); + conf = find_conf_locked(pr, NULL); + } else + conf = find_conf(pr, NULL); strlcpy(buf, conf->exec_paths.exec_paths_str, MAX_EXEC_PATHS_SIZE); error = sysctl_handle_string(oidp, buf, MAX_EXEC_PATHS_SIZE, req); - if (error != 0 || req->newptr == NULL) + if (req->newptr == NULL) goto out; + if (error != 0) { + rm_wunlock(&mac_do_rml); + goto out; + } - error = parse_and_set_conf(pr, NULL, buf, conf, &parse_error); + /* Unlocks 'mac_do_rml'. */ + error = parse_and_commit_conf(pr, NULL, buf, conf, &parse_error); if (error != 0) { if (print_parse_error) printf("MAC/do: Parse error at index %zu: %s\n", @@ -1809,14 +1856,17 @@ mac_do_jail_set(void *obj, void *data) } if (jsys == JAIL_SYS_INHERIT) { + struct conf *old_conf = NULL; + error = 0; + rm_wlock(&mac_do_rml); if (!absent_or_empty_rules || !absent_or_empty_exec_paths) { /* * Some values specified. Check that they match the * ones we are going to inherit. */ - model_conf = find_conf(pr->pr_parent, NULL); + model_conf = find_conf_locked(pr->pr_parent, NULL); if (strcmp(model_conf->rules.string, rules_string) != 0) { error = EINVAL; @@ -1840,23 +1890,25 @@ mac_do_jail_set(void *obj, void *data) } if (error == 0) - /* - * There's no TOCTOU problem here as the removal of the - * current jail's configuration commutes with changing - * the inherited configuration we checked against. - */ - remove_conf(pr); + old_conf = remove_conf_locked(pr); + + rm_wunlock(&mac_do_rml); + + if (old_conf != NULL) + drop_conf(old_conf); return (error); } model_conf = NULL; + /* Freeze configuration accesses. */ + rm_wlock(&mac_do_rml); switch (jsys) { case JAIL_SYS_DISABLE: /* * mac_do(4) is disabled iff one of the parameter's string is - * empty. The parse_and_set_conf() call below treats passing + * empty. The parse_and_commit_conf() call below treats passing * NULL for a parameter as a flag to copy its value from the * relevant ancestor jail's configuration, so we have to watch * for the final result having an empty parameter if no @@ -1878,7 +1930,7 @@ mac_do_jail_set(void *obj, void *data) * values). */ if (rules_string == NULL || exec_paths_string == NULL) - model_conf = find_conf(pr, NULL); + model_conf = find_conf_locked(pr, NULL); /* If both are absent, we have to examine if, in the * currently applicable configuration, one of the * parameters, which we are going to copy, is @@ -1896,16 +1948,17 @@ mac_do_jail_set(void *obj, void *data) break; case JAIL_SYS_NEW: - /* See the comment before the call to find_conf() above. */ + /* See the comment before the same test above. */ if (rules_string == NULL || exec_paths_string == NULL) - model_conf = find_conf(pr, NULL); + model_conf = find_conf_locked(pr, NULL); break; default: __assert_unreachable(); } - error = parse_and_set_conf(pr, rules_string, exec_paths_string, + /* Unlocks 'mac_do_rml'. */ + error = parse_and_commit_conf(pr, rules_string, exec_paths_string, model_conf, &parse_error); if (model_conf != NULL) drop_conf(model_conf); From nobody Mon Jun 29 19:26:05 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8Z0VGmz6jjRl for ; Mon, 29 Jun 2026 19:26:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8Y4XPNz40dQ for ; Mon, 29 Jun 2026 19:26:05 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761165; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=d47LOIH1cGirhHi6fFen8aO1PrGeDMW61jtLiuMY4UA=; b=HJj/EMusVSMqqFV3svoKyZZF+oeSu4q06Bgy6Ca9YYfrswl3FvJ0eC9XN6zDhPV9BRr7FF GnI3mSWKiOThhtZRrJSYJ+vLg3aFPTT0YotjUL7ATvAEU2uEmydRmi/kjBRphxcBSyS54Z 5ly81KIzrqPPwuyKqaz46UdA4tKeaicPI9xItXPhTsMyDRF88UPFwIzLkHfGRyP2xptfE2 JhtOWeBdkle0QoTiPFbC9p15LbppN6bmuahG5tRcuo5edGPP4rxU1xosT05eT5UiCpEt1T HROuGVlVRJxVPkndcWu2deJkNvUsx/PqVTaeoYXVO6jcTSmykvXB2xsZZIC4sg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761165; a=rsa-sha256; cv=none; b=A+JmRqMVLaflH1aj3Fsv4rXeS8/Y5W+neyWfogsEdsTABPy2uEgCY1ss1krT2UujyKY2+/ GObR9nOmquCUFpnyHfacCsaEwX1fBrhc90BinOUf0zkCToJXB/g9Q8SfLfCzTxKl3ZhAg0 rghPiQYTgYT24ukVe3OeqRD6VDXZFxh5OWm7Se7GlWFtCPv4Ds/+g2UkTu8N8kfzmIUUus VB5ZRWnxajooiqwfK0N6FWE41z3GH2e1KgJK604gOTYfpclmVYlHPs8LU74XRspLYJECkc RPm2Na5GpG2wDSPaVcjVL7JbleKBDxZOC16Ox9bnUdawdotW2YmFToYj0mVp2w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761165; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=d47LOIH1cGirhHi6fFen8aO1PrGeDMW61jtLiuMY4UA=; b=C0gzmxd19jrg9fodxj7iUPjqQZp7gdVMJlVeKl9rtOFajjfgiIVvjnJDBgclGPfocph0LZ dsF9Xj1p9X6NIMN8wbhlM/IW0kb4N/6QHuhrX05vnGAIEuaM4PU71C0sEvm1AUqb2IozTL 9C/eKjQdLNQF21rpKi3g05804VvWHTUpMxlDKFNtnNMWvaenNkRjj84crUuU3wdnSgQ1FU P9+m77w0EyNDwdOUnAE1HfYt7+b2Wy7ao33qKBMpx9R+w0m9aH7ru9oNzr0deWDGHmQwxM olfXzgGsoEeVGtiywMObMJR7ta8JNSe9c4EhzxwtCgcQfFnVXnAFsLUAvjLuCA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8Y3Jh3z19bg for ; Mon, 29 Jun 2026 19:26:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21fc3 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:26:05 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 29c55812380d - stable/15 - MAC/do: Do not skip blanks when parsing executable paths List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 29c55812380daa6acd4b9483ef96b8a17f6fba3e Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:26:05 +0000 Message-Id: <6a42c6cd.21fc3.20919c88@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=29c55812380daa6acd4b9483ef96b8a17f6fba3e commit 29c55812380daa6acd4b9483ef96b8a17f6fba3e Author: Olivier Certner AuthorDate: 2026-05-07 15:32:28 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:56 +0000 MAC/do: Do not skip blanks when parsing executable paths The kind of tolerance we apply to parsing rules, whose format we have defined, cannot be applied to paths since blank characters are allowed there. There is still the limitation that no escape character is currently supported, and so it is not possible to configure a path having a ':' character. Reviewed by: bapt Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 1fa1e3f3950fc0593ab73ea075c24c9bfbe8afd6) --- sys/security/mac_do/mac_do.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 9ca6874ce145..8ef2a21396b1 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1165,7 +1165,7 @@ parse_exec_paths(const char *const string, struct exec_paths *const exec_paths, MPASS(copy[len] == '\0'); p = copy; - while ((path = strsep_noblanks(&p, ":")) != NULL) { + while ((path = strsep(&p, ":")) != NULL) { size_t path_len; if (*path == '\0') From nobody Mon Jun 29 19:26:06 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8Z6gPVz6jjb6 for ; Mon, 29 Jun 2026 19:26:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8Z50Kvz40qB for ; Mon, 29 Jun 2026 19:26:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761166; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4n+rEg6AAvvVI0HCI4YfbrZTjMABnBl7T6h9AcY0oSo=; b=Ky6KehvNEFj/Cg/NZQWtb3biiwRQeJ+GtHsPie8zJ9nCp5cGn8kvBvFfbkHeMLO8IK3T0b uLkjAJxKwTASeeuap/5xgrwrnrAo4spzLdlL1TAPiiaKdb6m298sf6WgytNrVZUcUk/qRj EQbo5WxPQRJRfQIaDCOskNtasgLZu7ZqLLRQ5/FC7L4rm/8thxrRb3WQcLbwmEvMudMClV s+p6tF7HRfYV+M5E8EPNvUYaQnUWgz/6PpKEteDusnH65L+F8fhlFAdGFXcEuzC7/fCWa9 xyBG3+WJxbiwVlg5eHe9c8/kH38E/zrGKiTyDz37GmR50tOiuO0CEx1Pk0VAhQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761166; a=rsa-sha256; cv=none; b=Sf4EAchINB5Soyl5d5h3W5A3gNJQ/DhxETsm9XLmVj0v4PAGPUXZquXHMMjzoFzMZgIme5 40jPt+g+hTQ7WEQ4c7m6jkhFSOT5RzzAn5sen9W5GsGMBelz7EK5adm37VDHftTdYjp+NS r+tkWz1xGhej/m//ET3KPz7DiFVR+YqWlb36dbesQOFcMOEQuupGNDfDS1vWWmxpaobc7m sBpJT/nG3GzmJbel9mwROg2syHjvCcVJHce+zizRy2inQPisYPGpo32H/LO809r6XpVs65 aNUxGNzhAZO5kRN6B9ZLuOPDgF5hpIYIM9XBhxPYvepzmmrxcFwuj2u1BAyNUQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761166; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4n+rEg6AAvvVI0HCI4YfbrZTjMABnBl7T6h9AcY0oSo=; b=rIE+lmabqHwFyWf20pQt4YfXUtCakBn7MuRMX6DWh0qERdcYuVBAVZEPJnI0Mp06cIz6TM 3tHY5ZMnjw3l4DX7prxK4+VwJK/i8/rXd9qCHrgHnHh5VWW0M9SuN4V87KA3w3kiEdskLo pqg0Dl8MZl2KelN6wQLsCLTSu84hUVJC//LeMnEpPtOmtrvmpkf9Pe33YTeqU+Bu7bb7CN yvDc4KpajxeDViIYT4owJHztzBf3T+OrIu3WH/QfODIzkgAVuwKpCcs6nfYFF7P0oUQ+PE xVeIYTrgMDODRIxtjJZmeM/0i6LJrt6J+pfkTyycwl4v0O4wrHDqNhDov6BbQQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8Z43bhz19cj for ; Mon, 29 Jun 2026 19:26:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21933 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:26:06 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 531c3eaa013a - stable/15 - MAC/do: Update copyright List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 531c3eaa013a456d951b119f33f00f3e72ff80dd Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:26:06 +0000 Message-Id: <6a42c6ce.21933.1176ed90@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=531c3eaa013a456d951b119f33f00f3e72ff80dd commit 531c3eaa013a456d951b119f33f00f3e72ff80dd Author: Olivier Certner AuthorDate: 2026-05-20 11:46:45 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:56 +0000 MAC/do: Update copyright Update years for the Foundation. While here, remove the initial '/*-' which has been useless for a long time. While here, add a missing space on bapt@'s copyright line (approved by him). Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit fcb0018634c77fe32ed99bca00f856af18ed240b) --- sys/security/mac_do/mac_do.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 8ef2a21396b1..d807ea7ddd7d 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1,8 +1,8 @@ -/*- +/* * SPDX-License-Identifier: BSD-2-Clause * - * Copyright(c) 2024 Baptiste Daroussin - * Copyright (c) 2024 The FreeBSD Foundation + * Copyright (c) 2024 Baptiste Daroussin + * Copyright (c) 2024, 2026, The FreeBSD Foundation * Copyright (c) 2025 Kushagra Srivastava * * Portions of this software were developed by Olivier Certner From nobody Mon Jun 29 19:26:07 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8c342yz6jjd2 for ; Mon, 29 Jun 2026 19:26:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpx8b617Yz40kP for ; Mon, 29 Jun 2026 19:26:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761167; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ynU2r0utBiL8AR89b5mUEl++SDYI+VtFZ2C6ZBrlE9I=; b=P8lajltGiLTOf1dwmD57HNr8sBIE5lxT7/FduIF+zToRc/jRWr584qTCnSUBcgdl5fPf0o 19LVB0bHnb9ebhkLvLmNGQFlM9gqSWgY9JEImbKcVwkSK4qqox9dSdfidGX7D92VIH1qbo ztUnauHKhB/N3Bz1lnMey3RUkXrBEyvhGlAsmdOlgT7aZuu/Z98pnjPXAW1/gciHUxJ4m7 9RD3kLilWPW5jDQ2PH8S6DiMubPLkosVOrT3tq+hWcFYAZ4OTgnbcdLMpHYvZOsOG5f5fQ ZeCHttm5kiTQiC0O2O6JFrYn9zYyLGLZgfsdGuxJLSiDMiv4V0/H7ldUqMR7sA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782761167; a=rsa-sha256; cv=none; b=FOjhL4ReGfKQrEDur6EvVZbM3xQlhrzLSnQt97+SADh28Xee2/PLyTE7/pOk71cD0Wc8xq pxJCJvZ1pFwy5hXFujwaqx3xtlhPNQYz9KGjI5Eqy8YmXnJIzf8GxJ7ZgY7Oj6jllI6fxX 8XmJDiAqV2PuFTv6JPonjPe+9lrw5f99pGxK5iU2ZxC6J8qmnoej8po2ruswTtMIO/0QQK qKO9PGAsP94N6Y69TFS6wHJ7AbQQUI9J0Wmk39Bf8mcc3VMSDrjniFcAK1Ly7bSbOzdEQV j530HVsEgS+iYXCslzj33UL/J/COFXaRrbFcmG8gxlU/7N+LWr/mpmyU3yppYA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782761167; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ynU2r0utBiL8AR89b5mUEl++SDYI+VtFZ2C6ZBrlE9I=; b=xASISQtU6hu1vGV2/GKKIt5HGjUO75Bg1jcUQwrZpUqpw3jJd/t9ZFGNTF3QJNf8MkLqvD WznPVUtzr9YAIJxYdncj2wiTBnDnIQiYbUB0CMA+9Ik4hktXkCFoKaXfbT60gZAlg2Ji3A KO2kjK7vrefgPtsdA5Hy9xo6ekIkwooFJu96EzOW5g8yDWgwsEgFe5YifvxfYKp8912X9v lXC8EqGt8gQSOggGRsS876sqHyojag0KXxBQsaStQaMMTxQeSuWBEh6gV5HRWBfS+kV1aU IN37NBu0TsWw9aMtK7zq5D5fdFBru9/C8TbuNJAoiB1dQmc7ty5Re2qMX394Yw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpx8b4w8Qz196q for ; Mon, 29 Jun 2026 19:26:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1fe68 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 19:26:07 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 9dea58fb0fc0 - stable/15 - MAC/do: Fix double-free on parse error after "executable paths" feature List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 9dea58fb0fc016644c72c4787cbf7fadbcaa1ba3 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 19:26:07 +0000 Message-Id: <6a42c6cf.1fe68.11cb437f@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=9dea58fb0fc016644c72c4787cbf7fadbcaa1ba3 commit 9dea58fb0fc016644c72c4787cbf7fadbcaa1ba3 Author: Olivier Certner AuthorDate: 2026-06-01 08:52:16 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:23:57 +0000 MAC/do: Fix double-free on parse error after "executable paths" feature parse_rules() has been calling toast_rules() in case of a parse error in order to deallocate the 'struct rule' objects it has constructed up to that point. toast_rules() would take a pointer to a full 'struct rules' object, and besides freeing all 'struct rule' referenced by it, would also free the holding 'struct rules' itself. With the introduction of the "executable paths" feature, and the embedding of 'struct rules' into 'struct conf', meaning that the lifecycle for 'struct rules' was no longer independent, toast_rules() was changed not to free the passed 'struct rules' (as it was a field of a 'struct conf' object). Unfortunately, this change was not completed with a reinitialization of the rules list head, so the 'struct conf' object would continue to reference just-freed rules, which then would be freed a second time on destruction of that container. So, make toast_rules() re-initialize the rules list in 'struct rules', which it logically has been having to do since not freeing the enclosing 'struct rules'. This alone is enough to fix the bug, but let's use the occasion to change the contract of parse_rules() and bring its herald comment up-to-date: On error, parse_rules() now simply leaves already constructed 'struct rule' objects in 'conf'. The latter is eventually destroyed and the rule objects reclaimed at that point. Add a test trying to set an invalid rules configuration with the first rule being valid and the second being invalid, which triggers the bug (and an immediate panic() on an INVARIANTS kernel). Reported by: impost0r(ret2plt) Reviewed by: markj Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") Sponsored by: The FreeBSD Foundation (cherry picked from commit 79d0dbc9c6d6a1627c9f3eeab0633c232a6a0a34) --- sys/security/mac_do/mac_do.c | 16 ++++++++-------- tests/sys/mac/do/invalid_configs.sh | 14 ++++++++++++++ 2 files changed, 22 insertions(+), 8 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index d807ea7ddd7d..d150c8bcb228 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -392,6 +392,7 @@ toast_rules(struct rules *const rules) free(rule->gids, M_MAC_DO); free(rule, M_MAC_DO); } + STAILQ_INIT(head); } static inline void @@ -1073,13 +1074,13 @@ einval: /* * Parse rules specification and produce rule structures out of it. * - * Must be called with '*parse_error' set to NULL. Returns 0 on success, with - * '*rulesp' made to point to a 'struct rule' representing the rules. On error, - * the returned value is non-zero and '*rulesp' is unchanged. If 'string' has - * length greater or equal to MAX_RULE_STRING_SIZE, ENAMETOOLONG is returned. If - * it is not in the expected format, EINVAL is returned. If an error is - * returned, '*parse_error' is set to point to a 'struct parse_error' giving an - * error message for the problem. + * Must be called with '*parse_error' set to NULL. Returns 0 on success, + * filling the passed '*rules' with 'struct rule' objects. On error, the + * returned value is non-zero, and '*rules' may have been changed. If 'string' + * has length greater or equal to MAX_RULE_STRING_SIZE, ENAMETOOLONG is + * returned. If it is not in the expected format, EINVAL is returned. If an + * error is returned, '*parse_error' is set to point to a 'struct parse_error' + * giving an error message for the problem. * * Expected format: A >-colon-separated list of rules of the form * ">" (for backwards compatibility, a semi-colon ":" is accepted @@ -1125,7 +1126,6 @@ parse_rules(const char *const string, struct rules *const rules, error = parse_single_rule(rule, rules, parse_error); if (error != 0) { (*parse_error)->pos += rule - copy; - toast_rules(rules); goto error; } } diff --git a/tests/sys/mac/do/invalid_configs.sh b/tests/sys/mac/do/invalid_configs.sh index d1a9eb8c1e96..91e38a0055c0 100644 --- a/tests/sys/mac/do/invalid_configs.sh +++ b/tests/sys/mac/do/invalid_configs.sh @@ -72,6 +72,19 @@ rules_wrong_separator_body() sysctl_set_and_check_fails_rules "uid=1001>gid=0:gid=1001>gid=5" } +# Added after observing a panic() in this situation because of a double-free +# after introduction of "exec_paths". +atf_test_case non_first_rule_unparseable +non_first_rule_unparseable_head() +{ + atf_set descr "Non-first rule wrong" +} + +non_first_rule_unparseable_body() +{ + sysctl_set_and_check_fails_rules "gid=1001>uid=0;hello" +} + atf_init_test_cases() { @@ -83,4 +96,5 @@ atf_init_test_cases() atf_add_test_case rule_user_names_fail atf_add_test_case rule_group_names_fail atf_add_test_case rules_wrong_separator + atf_add_test_case non_first_rule_unparseable } From nobody Mon Jun 29 20:35:54 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpyj66CDTz6jq0T for ; Mon, 29 Jun 2026 20:35:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpyj63lwtz3Pmf for ; Mon, 29 Jun 2026 20:35:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782765354; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hXYx61l6Zd6XX9xj75WmFWAAtPfLN8KD3clbmJnYmFU=; b=RhiuC2QOblmaZqQxCrmLLS5cF6ZEM20v8nwW/gOmrr3GmhQXLMBULd5TIIrVVP+zkgtzJG Fa7kLRQ/r3fsH2cC4e5pDbc2e4DnkKKm5WpqXyHTIYdVndTGgC2MLaWWwrVJC+akhTqxIl Q00s/5LgB00GG+xKwblNn9QWiBjcfjoKq3bw3FdfArxrPHU1ujnoaXLWxpZN188qMi9kZy kbAqmnQ5j9qUpcr3qnoaVxzTx3SA1ttySqnjpAMPZ+IvqEkn7k80SCYgVq7688nRGTZpnW Wr1hdJobHSMCWT1UPoHmCdGJXs6+qKVf9YugSmapgQ6KfF00uNQQ+62UGbGYpA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782765354; a=rsa-sha256; cv=none; b=Yu+SHgejTDuxsQyWxcrzFFelHrr3l7IKtN64UXbCcxqDuAp/18wHvQWPf59na8OBJz2ntI FWMsMCRTW6whe3aLPBSirhHUN3Kp+q3yKBv+oVqPB04pfD0NIK6cRKCaO07cM0KHHQprU9 tvnmSWL+H3YDcwfzOv5exBN+YfdKN6E4E5mrmEZNg6dTe7gbPdToYacXLI/x9X+Tp+X0c2 JXNMvL+fjVhlkPx4AkOgVEHu7lA98EWP18S0kWLDvZVhPfUEVnbzzBNZX+hmHDbgSRASX0 Jc2zfX1ed5bXenJ1FOs8lWhTV7ZiRoq4K/1/prEpcNzsLnBdAxjjTBSXUKWFRg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782765354; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hXYx61l6Zd6XX9xj75WmFWAAtPfLN8KD3clbmJnYmFU=; b=ugF4IzJtZxEJt6EzPzVpnlham06uSRP+zJL/I43Yg1HinAKQF62IM3UyGio6kxeMKdpH9h UvL9Gho1PtccPaetCRymVZb4jOBrpemQq0ylYbshYLvy3p+Kr2V/7uIIWEbCT8MC4exObf Cjjz/TDKSAQSjVWKGsRfjFTfxhUHfGfh7w39TZelgdzdPPkA+dDRHg/DRnogJHux15W/WE r38TY0X3RYzI/TdfqCZxAruvcXaDeXMW3bBBxiXfmDiLYpDJXcQYlGeRf3nGl/wlXPJSnT pi5vREyMUqwrEWSvR3eJUuQWenqf/wuoXyCMFTkHy3ykuNSS9ntwErj20dMDLg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpyj62kbWz1CR5 for ; Mon, 29 Jun 2026 20:35:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 26178 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 20:35:54 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 0ab20f73ca31 - stable/15 - MAC/do: Tests: Add support for exec paths, jail parameters, subjails List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 0ab20f73ca31c559881bfbc415b222ab48836eb9 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 20:35:54 +0000 Message-Id: <6a42d72a.26178.7daa4f7f@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=0ab20f73ca31c559881bfbc415b222ab48836eb9 commit 0ab20f73ca31c559881bfbc415b222ab48836eb9 Author: Olivier Certner AuthorDate: 2026-05-22 14:23:31 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:37:10 +0000 MAC/do: Tests: Add support for exec paths, jail parameters, subjails And also allow configuration of the mdo(1) executable path. This commit only contains new or modified infrastructure. No functional change intended at this point. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit a95ff5ef7d1ffcb701913028253a4700cd9a1459) --- tests/sys/mac/do/common.sh | 119 +++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 110 insertions(+), 9 deletions(-) diff --git a/tests/sys/mac/do/common.sh b/tests/sys/mac/do/common.sh index 6c4b138bdac0..4f0e838bbf5f 100644 --- a/tests/sys/mac/do/common.sh +++ b/tests/sys/mac/do/common.sh @@ -10,11 +10,79 @@ rules_parameter() echo "$1".rules } +exec_paths_parameter() +{ + echo "$1".exec_paths +} + +: ${MDO:=/usr/bin/mdo} + +ROOT_KNOB=security.mac.do +RULES_KNOB=$(rules_parameter ${ROOT_KNOB}) +EXEC_PATHS_KNOB=$(exec_paths_parameter ${ROOT_KNOB}) +PPE_KNOB=${ROOT_KNOB}.print_parse_error + +ROOT_JAIL_PARAM=mac.do +RULES_JAIL_PARAM=$(rules_parameter ${ROOT_JAIL_PARAM}) +EXEC_PATHS_JAIL_PARAM=$(exec_paths_parameter ${ROOT_JAIL_PARAM}) + +# To be overridden to execute commands in a sub-jail +JEXEC= + +# Exit status: 0 iff disabled +mac_do_disabled() +{ + [ -z "$($JEXEC sysctl -n ${RULES_KNOB})" ] || + [ -z "$($JEXEC sysctl -n ${EXEC_PATHS_KNOB})" ] +} + +mac_do_check_disabled() +{ + mac_do_disabled || atf_fail "mac_do(4) expected disabled but is not." +} + +mac_do_ensure_disabled() +{ + mac_do_disabled || $JEXEC sysctl ${RULES_KNOB}="" +} + +sysctl_rules() +{ + $JEXEC sysctl -n ${RULES_KNOB} +} + +sysctl_exec_paths() +{ + $JEXEC sysctl -n ${EXEC_PATHS_KNOB} +} + +# $1 = sysctl func, $2 = expected value +sysctl_check() +{ + local func value + + func=$1 + value=$2 + atf_check [ "$($func)" = "$value" ] +} + +# $1 = value +sysctl_check_rules() +{ + local value -CONF_ROOT_KNOB=security.mac.do -RULES_KNOB=$(rules_parameter ${CONF_ROOT_KNOB}) -PPE_KNOB=${CONF_ROOT_KNOB}.print_parse_error + value=$1 + sysctl_check sysctl_rules $value +} +# $1 = value +sysctl_check_exec_paths() +{ + local value + + value=$1 + sysctl_check sysctl_exec_paths $value +} # $1 = knob name, $2 = value sysctl_set_and_check() @@ -23,8 +91,8 @@ sysctl_set_and_check() knob=$1 value=$2 - atf_check -o ignore sysctl "$knob"="$value" - atf_check -o inline:"$value\n" sysctl -n "$knob" + atf_check -o ignore $JEXEC sysctl "$knob"="$value" + atf_check -o inline:"$value\n" $JEXEC sysctl -n "$knob" } # $1 = knob name, $2 = value @@ -35,8 +103,8 @@ sysctl_set_and_check_fails() knob=$1 value=$2 orig_value=$(sysctl -n "$knob") - atf_check -s not-exit:0 -o ignore -e ignore sysctl "$knob"="$value" - atf_check -o inline:"${orig_value}\n" sysctl -n "$knob" + atf_check -s not-exit:0 -o ignore -e ignore $JEXEC sysctl "$knob"="$value" + atf_check -o inline:"${orig_value}\n" $JEXEC sysctl -n "$knob" } # $1 = sysctl function, $2 = value @@ -46,9 +114,9 @@ sysctl_set_and_check_rules_common() func=$1 value=$2 - "$func" ${RULES_KNOB} "$value" - # Same spec but using the older in-rule separator (':') + # Use older in-rule separator (':') first to have final value as specified "$func" ${RULES_KNOB} "$(echo "$value" | sed 's%>%:%')" + "$func" ${RULES_KNOB} "$value" } # $1 = value @@ -69,7 +137,40 @@ sysctl_set_and_check_fails_rules() sysctl_set_and_check_rules_common sysctl_set_and_check_fails "$value" } +# $1 = sysctl function, $2 = value +sysctl_set_and_check_exec_paths_common() +{ + local func value + + func=$1 + value=$2 + # Use older in-rule separator (':') first to have final value as specified + "$func" ${EXEC_PATHS_KNOB} "$(echo "$value" | sed 's%>%:%')" + "$func" ${EXEC_PATHS_KNOB} "$value" +} + +# $1 = value +sysctl_set_and_check_exec_paths() +{ + local value + + value=$1 + sysctl_set_and_check_exec_paths_common sysctl_set_and_check "$value" +} + +# Create a persistent subjail. Echoes its JID. +launch_subjail() +{ + ( + set -o pipefail + $JEXEC jail -c -J /dev/stdout persist=true | + sed -nE 's%^.*jid=([0-9]+).*$%\1%p' + ) || atf_fail "Cannot create a subjail (check children limits?)" +} + atf_require_prog sysctl +atf_require_prog jail +atf_require_prog sed # Do not pollute kernel logs with parse errors sysctl $PPE_KNOB=0 >/dev/null 2>&1 From nobody Mon Jun 29 20:35:55 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpyj80ZSNz6jq5Q for ; Mon, 29 Jun 2026 20:35:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpyj73q9qz3PpB for ; Mon, 29 Jun 2026 20:35:55 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782765355; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wH/rY/6BZ4Qt0PN/M10hcARGXoz5+8CENpSmoKYCC5k=; b=yck2Uu1uJlOe8vJww1+Z5NyYiiLZu2Zd1gTkFPOfj59UFjWEUmCkTAkEowPpT7WYungE2V gNxWvOgRgCRqHnyhpa7WbJpRFNbpSW1SpPAXfi+zpz1xR2qrswtEUaS09beDjpfxJ29Q82 UJEasQn+szDb70HjSaGmw15urw5dLBj3WTUOLq1baW0ql/tz8mU44RmPcMagzxhTt85nLg gniC+/yp/UgWrI8VYq2wNmYWalUVp0Izo9ByzD+iumAH9xDD1Ol9y4KbHgvBIaD+ATfHI9 Pcs9r/i8QftthDWTBWyf1mG83rki36mc+H3YcIrIiVUdlvMMNZnV4ayYW0Psvw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782765355; a=rsa-sha256; cv=none; b=qtCPAwC2PwgfHygryp03Mhk99VVxyK49JniTrYw7AHgAPYBqFhS3tjYGhZhXcmcogz64yW Umr+CwgdnVPxandE7+6/SLJB6A/0RgnYGI4TMBEJACo5nMrf0g3uK1XjGqstbmFHhNTVhw e/OCI1lBim7uNJTfQksXO0hZQZRV82eUToj6adA04Wi5NonmYUayr+xY2exZI/VlXH6RV7 GdKUt4XwQPcz4J+AIBWg0viRJVWPIvq6P5eNMBWzccUkN5UMB/Kcq6taPm0tVmNKYaDoUC hZhigQCO3AdEmIo2V1xRxPa+jQe6bMr8gtJsskvH+F3W4QMKi+nW4k7NNxjU6A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782765355; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wH/rY/6BZ4Qt0PN/M10hcARGXoz5+8CENpSmoKYCC5k=; b=n7WJ78AqXlt+gv8TQCvOQpDOlVZ7a0d5N9s+KJWVgQoMJhVFZJnxh3+/3m/aCR5Uv/tgll WW25+yw2LWhw9+0o0eMB111qWc1+Ab4wMccHcfnq6BuZszfbuVqlmljesIdadYzvZHvlJa 1kWpT4xXkuZZ83mEb4zvh8hYSyqh5Jtn6c/mXHNMu6EG5H4wGZ4IjRsW5sW4bj7Ilm87HD 81kBqS+Yp3Z7NvWHOQjBUqw+fVllVe6GkF/AyiV0Rrzag7vf4Ig3Uzmkyj7vBmEQP2iqzN /d0VfZ/aYkBtI3JAFT0+i1/AdeqLnRxtVdastu5wEkykNSsab7bMJQaU9PMhOw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpyj72fG8z1CDK for ; Mon, 29 Jun 2026 20:35:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3004c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 20:35:55 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 309e4f0bd473 - stable/15 - MAC/do: Add consistency tests List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 309e4f0bd473891aa4276c43f19420d09eac4a48 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 20:35:55 +0000 Message-Id: <6a42d72b.3004c.d192fea@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=309e4f0bd473891aa4276c43f19420d09eac4a48 commit 309e4f0bd473891aa4276c43f19420d09eac4a48 Author: Olivier Certner AuthorDate: 2026-05-22 14:33:18 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:37:11 +0000 MAC/do: Add consistency tests Test that: 1. Concurrent changes to different parameters on the same jail are independent/atomic. 2. Inheritance works. 3. Relaxing only parent jail rules does not leak to a subjail thanks to sequential consistency. 4. Sysctl knobs and jail parameters stay consistent. Some of these tests may be extended in the future with several layers of jails (there is only a single subjail currently). Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 851499046d25fbe5841a55fb7bfcc879522f59a8) --- tests/sys/mac/do/Makefile | 2 +- tests/sys/mac/do/consistency.sh | 211 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 212 insertions(+), 1 deletion(-) diff --git a/tests/sys/mac/do/Makefile b/tests/sys/mac/do/Makefile index bfca40efdc8d..0c40f65b65f6 100644 --- a/tests/sys/mac/do/Makefile +++ b/tests/sys/mac/do/Makefile @@ -2,7 +2,7 @@ PACKAGE= tests TESTSDIR= ${TESTSBASE}/sys/mac/do -ATF_TESTS_SH+= valid_configs invalid_configs +ATF_TESTS_SH+= valid_configs invalid_configs consistency ${PACKAGE}FILES+= common.sh diff --git a/tests/sys/mac/do/consistency.sh b/tests/sys/mac/do/consistency.sh new file mode 100644 index 000000000000..6a64917edb6d --- /dev/null +++ b/tests/sys/mac/do/consistency.sh @@ -0,0 +1,211 @@ +# Copyright (c) 2026 The FreeBSD Foundation +# +# SPDX-License-Identifier: BSD-2-Clause +# +# This software was developed by Olivier Certner at +# Kumacom SARL under sponsorship from the FreeBSD Foundation. + +SJ_JID_FILE=sj.jid + +atf_test_case concurrent_rules_exec_paths_changes +concurrent_rules_exec_paths_changes_head() +{ + atf_set descr "Consistency of rules and exec paths changes on same jail" +} +concurrent_rules_exec_paths_changes_body() +{ + local rules exec_paths rules_es exec_paths_es + + for I in $(jot - 1 1000); do + sysctl_set_and_check_rules "uid=$I>uid=1001" + done & + rules=$! + + for I in $(jot - 1 1000); do + sysctl_set_and_check_exec_paths /nowhere/nonexistent$I + done & + exec_paths=$! + + wait $rules + rules_es=$? + + wait $exec_paths + exec_paths_es=$? + + # atf_check called in the asynchronous AND-OR lists above causes exit of the + # subshells and also a write to the ATF result file. These writes are + # concurrent and may cause the result file to be malformed. Consequently, + # it is important that, once execution becomes sequential again, atf_fail() is + # called again (and not just exit()). + if [ $rules_es -ne 0 ] || [ $exec_paths_es -ne 0 ]; then + atf_fail "Rules exit status: $rules_es, \ +exec paths exit status: $exec_paths_es" + fi +} + +atf_test_case inheritance cleanup +inheritance_head() +{ + atf_set descr "Simple inheritance test (values propagated to child jail)" +} +inheritance_body() +{ + local sj rules exec_paths + + # For the sake of not running the test under Kyua + mac_do_ensure_disabled + + sj=$(launch_subjail) + echo $sj > "${SJ_JID_FILE}" + + jail -m jid=$sj ${ROOT_JAIL_PARAM}=inherit + JEXEC="jexec $sj" + mac_do_check_disabled + JEXEC= + + rules="uid=1001>uid=0" + sysctl_set_and_check_rules $rules + JEXEC="jexec $sj" + sysctl_check_rules $rules + JEXEC= + + rules="gid=1001>uid=0" + sysctl_set_and_check_rules $rules + JEXEC="jexec $sj" + sysctl_check_rules $rules + JEXEC= + + # Not really necessary, just to keep mac_do(4) disabled + sysctl_set_and_check_rules "" + + exec_paths="/nowhere/nonexistent" + sysctl_set_and_check_exec_paths $exec_paths + JEXEC="jexec $sj" + sysctl_check_exec_paths $exec_paths + JEXEC= + + exec_paths="$MDO" + sysctl_set_and_check_exec_paths $exec_paths + JEXEC="jexec $sj" + sysctl_check_exec_paths $exec_paths + JEXEC= +} +inheritance_cleanup() +{ + # We clean up our subjail manually just for the sake of launching this test + # with atf-sh. Kyua is informed that these tests should run in a jail, and + # kills it automatically after the test, which kills all subjails. It is + # annoying that atf-sh does not offer a more practical way to pass + # information from the body to the cleanup part than a file. + jail -r $(cat "${SJ_JID_FILE}") + rm -f "${SJ_JID_FILE}" +} + +atf_test_case inheritance_relax_parent_jail cleanup +inheritance_relax_parent_jail_head() +{ + atf_set descr \ + "Test sequential consistency in a \"relax parent rules\" scenario" +} +inheritance_relax_parent_jail_body() +{ + local sj rules exec_paths subproc + + sj=$(launch_subjail) + echo $sj > "${SJ_JID_FILE}" + + jail -m jid=$sj ${ROOT_JAIL_PARAM}=inherit + rules="uid=1001>uid=0" + sysctl_set_and_check_rules $rules + # Additional inheritance sanity check + JEXEC="jexec $sj" + sysctl_check_rules $rules + JEXEC= + exec_paths="$MDO" + sysctl_set_and_check_exec_paths $exec_paths + # Additional inheritance sanity check + JEXEC="jexec $sj" + sysctl_check_exec_paths $exec_paths + JEXEC= + + # Launch a process that tries to become 'root' from user 1002, and verify + # that this always fails. + { for I in $(jot - 1 1000); do + jexec $sj "$MDO" -u 1002 -g 1002 -G 1002 "$MDO" -i true 2>/dev/null && + exit 1 + done; true; } & + subproc=$! + + # Decouple the subjail from the parent jail, copying its parameters + jail -m jid=$sj ${ROOT_JAIL_PARAM}=new + # Allow user 1002 to become 'root' on the parent jail + sysctl_set_and_check_rules "$rules;uid=1002>uid=0" + JEXEC="jexec $sj" + # Additional sanity check (that rules of the subjail are now independent) + [ "$(sysctl_rules)" == $rules ] || atf_fail "Rules not copied" + [ "$(sysctl_exec_paths)" == $exec_paths ] || + atf_fail "Exec paths not copied" + JEXEC= + + wait $subproc || atf_fail "A transition wrongly succeeded in the subjail!" +} +inheritance_relax_parent_jail_cleanup() +{ + # See inheritance_cleanup() for explanations + jail -r $(cat "${SJ_JID_FILE}") + rm -f "${SJ_JID_FILE}" +} + +atf_test_case same_knob_and_jail_parameter cleanup +same_knob_and_jail_parameter_head() +{ + atf_set descr \ + "Corresponding sysctl knobs and jail parameters have same value" +} +same_knob_and_jail_parameter_body() +{ + local sj rules exec_paths subproc + + sj=$(launch_subjail) + echo $sj > "${SJ_JID_FILE}" + + # Set sysctl knobs, observe parameters + rules="uid=19999>uid=21700" + exec_paths="/improbable/path/he" + JEXEC="jexec $sj" + sysctl_set_and_check_rules $rules + sysctl_set_and_check_exec_paths $exec_paths + JEXEC= + atf_check -o inline:"$rules\n" jls -j $sj ${RULES_JAIL_PARAM} + atf_check -o inline:"${exec_paths}\n" jls -j $sj ${EXEC_PATHS_JAIL_PARAM} + + # Set parameters, observe knobs + rules="uid=128000>uid=-1" + exec_paths="/hello/i_ve/changed" + jail -m jid=$sj ${RULES_JAIL_PARAM}=$rules \ + ${EXEC_PATHS_JAIL_PARAM}=${exec_paths} + JEXEC="jexec $sj" + sysctl_check_rules $rules + sysctl_check_exec_paths $exec_paths + JEXEC= +} +same_knob_and_jail_parameter_cleanup() +{ + # See inheritance_cleanup() for explanations + jail -r $(cat "${SJ_JID_FILE}") + rm -f "${SJ_JID_FILE}" +} + + +atf_init_test_cases() +{ + . $(atf_get_srcdir)/common.sh + atf_require_prog jot + # Needs an absolute path for mdo(1), to set it in exec_paths + atf_require_prog "$MDO" + + atf_add_test_case concurrent_rules_exec_paths_changes + atf_add_test_case inheritance + atf_add_test_case inheritance_relax_parent_jail + atf_add_test_case same_knob_and_jail_parameter +} From nobody Mon Jun 29 20:35:53 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpyjC0gxjz6jpVH for ; Mon, 29 Jun 2026 20:35:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpyjB2v3Dz3PyD for ; Mon, 29 Jun 2026 20:35:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782765358; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=3Ik69lj6/wEWbs9CoRkGbsQSNv0KeRyuxLuRKfdalXU=; b=Gf8OThLyXkwqA8uZSunh33jRhVL4+BI2mhBDrvgQMG9uiuUXFRiAVBQikxF1Wy5HKkFzoc UENki4u2bgWZQ0Ng1LjqGV8EZoJ7OVcqwKYR/6HPpjORJfE+0bbk9eYNZ4QO9VP+H7ngCn rlQmvBxMAsKdZ4Ux6JeHdN5jJTl761L2NBPNMGouvMplfB8Fd37lw/XBf1sQgGpGWBgtuI YD7ISKOQznhMTPTCr5zrdrFiSgvA1dnSQ1CswU8YZHvDaQ8R5bvAadVuh1a4g02PwMsvpv YWPfVsB2oQG6B90g7u9QbIT49jOY6/PXYGDr5fETW+fiQsBaLaNLR2gk4KmaAg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782765358; a=rsa-sha256; cv=none; b=tUgHf3ho9GaQkoV2ZCzBVUtIUDI9t5Ou8yJX/Rd6It0/otqKnhSruBwLO5nI8DtWvB9Ncg uenNYi0WZ5o/bfJiiOnUeqAubVpiKg5uN6F/7RujvniLM3fuTSURLpleFMfdk/RH+kPDgo Z0qC3IJL73wehN3raXBkHe39TfV7+bRGgtH9V9pAXZXY/UPxjbdwHTyLtJ1ZKD4K7x2Ula Wz2XEfcFP1YpnqvuebwK7w3V3ky27JzywPZLwBZe1dzN+lYJrjT5iIrWH+ZGF2cCLPfqX3 rYJqm4vfak+3QjdcsfupMuPIYxIRJOF8jtRhNiDFLcdVi86PfScqErytL5bw+g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782765358; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=3Ik69lj6/wEWbs9CoRkGbsQSNv0KeRyuxLuRKfdalXU=; b=PmNtGanCp1GS6L1goW5/p19mS4fnh+lUx0WwiBOWzZ/JO+PQ4PfjbO9p61zBtWfUI4kurx Mqkbm4feHJRJG5F0fwekQRKGw8HVonXnAgMb9ST4yhaWIKBXRiZh/r3L7cvsN0WQbgVv2t Xnl3ZetDrf5Wo1JUnO7F+hXZkk6+6SAj8hxAdxSgy3/+JY92jqJOGi2ESVrS0jyAUpDB5R vhI1ZWuYUeklDM4jbI2Nszv8FUCLT5Wh5I2t5kYeDkg3Z1Yx3sTgcWau6Y6Qo4xEINb1+x O6ukai2tO5C2SYVJZOlE1cMqltbVM1BMSwvMUxFk1VoGVZsq1EG1gsRB9Sl6nQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpyjB1bBxz1CR7 for ; Mon, 29 Jun 2026 20:35:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3111d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 20:35:53 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Olivier Certner Subject: git: 406c84a22876 - stable/15 - mac_do.4: Document executable paths, default jail values and consistency List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olce X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 406c84a22876b0f4d2311705fce431873fb05767 Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 20:35:53 +0000 Message-Id: <6a42d729.3111d.6705a465@gitrepo.freebsd.org> The branch stable/15 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=406c84a22876b0f4d2311705fce431873fb05767 commit 406c84a22876b0f4d2311705fce431873fb05767 Author: Olivier Certner AuthorDate: 2026-05-20 16:23:33 +0000 Commit: Olivier Certner CommitDate: 2026-06-29 19:37:04 +0000 mac_do.4: Document executable paths, default jail values and consistency While here, fix the bug of mentioning 'enable' as a possible value for the 'mac.do' jail parameter whereas it is 'new' instead. Reviewed by: bapt MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 (cherry picked from commit 39818654ae879788807d3a87c2d75cc700cc7113) --- share/man/man4/mac_do.4 | 189 ++++++++++++++++++++++++++++++++++++------------ 1 file changed, 143 insertions(+), 46 deletions(-) diff --git a/share/man/man4/mac_do.4 b/share/man/man4/mac_do.4 index 8c08e072be88..7f05d5f88bf8 100644 --- a/share/man/man4/mac_do.4 +++ b/share/man/man4/mac_do.4 @@ -1,8 +1,8 @@ .\"- .\" SPDX-License-Identifier: BSD-2-Clause .\" -.\" Copyright (c) 2024 Baptiste Daroussin -.\" Copyright (c) 2024 The FreeBSD Foundation +.\" Copyright (c) 2024, Baptiste Daroussin +.\" Copyright (c) 2024, 2026, The FreeBSD Foundation .\" .\" Portions of this documentation were written by Olivier Certner .\" at Kumacom SARL under sponsorship from the FreeBSD @@ -42,13 +42,23 @@ policy module allows unprivileged users to change process credentials according to rules configured by the administrator. It supports per-jail configuration. .Pp -Currently, the +The .Nm -policy module only produces effects to processes spawned from the +policy module only produces effects on processes spawned from specific +executables from a configurable whitelist. +By default, this whitelist only contains the .Pa /usr/bin/mdo executable, please see .Xr mdo 1 for more details on this program. +.Pp +Section +.Sx CREDENTIALS RULES +specifies the format of credentials transition rules, and section +.Sx CONFIGURATION +explains how to configure +.Nm , +including rules and authorized executables. .Sh CREDENTIALS RULES Rules specify which transitions of process credentials .Nm @@ -267,84 +277,170 @@ then converted to unsigned ones as specified in the C standard for the and .Vt gid_t types, which are both 32-bit unsigned integers. -.Sh RUNTIME CONFIGURATION -The following +.Sh CONFIGURATION +Each parameter of +.Nm +has a corresponding +.Xr sysctl 8 +knob. +.Nm +supports per-jail values for most parameters. +.Ss Sysctl Knobs +The .Xr sysctl 8 -knobs are available: +knobs presented by +.Nm +are of two types: Global ones, which influence all uses of the module, and +per-jail ones, which allow to retrieve or change the setting applicable to +a jail +.Pq or the host +from within. +They are tagged accordingly in the list below. +.Pp +The indicated default values for per-jail parameters applies to the host. +Those applying to jails are described in the +.Sx Jail Parameters +subsection below. +.Pp +The following knobs are available: .Bl -tag -width indent .It Va security.mac.do.enabled Enable the .Nm policy. -(Default: 1). -.It Va security.mac.do.rules -The list of credential rules, whose syntax is described in the -.Sx CREDENTIALS RULES -section above. -This list is specific to each jail. -Please see the -.Sx JAIL SUPPORT -section below for more details on the interaction of -.Nm -with jails. +.Pq Global. Default: 1. .It Va security.mac.do.print_parse_error Logs a message on trying to set incorrect rules via the .Va security.mac.do.rules .Xr sysctl 8 knob. +.Pq Global. Default: 1. +.It Va security.mac.do.rules +The list of credentials transition rules, whose syntax is described in the +.Sx CREDENTIALS RULES +section above. +An empty string effectively disables the policy. +.Pq Per-jail. Default: Empty. +.It Va security.mac.do.exec_paths +The list of absolute paths +.Pq relative to the current jail's root +to authorized executables, separated by colons +.Pq Ql ":" . +Only processes launched from these executables are considered by the +.Nm +policy. +An empty string effectively disables the policy. +.Po +Per-jail. Default: +.Ql "/usr/bin/mdo" . +.Pc .El -.Sh JAIL SUPPORT +.Ss Jail Parameters +Most parameters of .Nm -supports per-jail configuration of rules. +are per-jail +.Po +see the +.Sx "Sysctl Knobs" +subsection above +.Pc . +Those that are per-jail have corresponding jail parameters that can be used to +set their initial values on jail creation or modify their values in a running +jail from outside the jail. .Pp -By default, at creation, a new jail has no credentials rules, effectively -disabling +By default, as it is for the host, a new jail has .Nm -for its processes. +disabled for its processes, as if the +.Va mac.do +parameter below was explicitly set to +.Ql disable . .Pp -The following jail parameters are defined: +Each unspecified parameter other than +.Va mac.do +defaults to a copy of its value in the currently applicable configuration for +a running jail, or from the parent jail on jail creation. +.Pp +The following jail parameters are available: .Bl -tag -width indent .It Va mac.do Possible values are: +.Pp .Bl -tag -width "'disable'" -compact .It Ql new .Nm -will enforce specific credential rules in the jail. -The -.Va mac.do.rules -jail parameter must also be set in this case. +will use a specific configuration for the jail. +This case degrades to +.Ql disable +if one of the other jail parameters end up empty after applying the default +values rule +.Pq see the preamble . .It Ql disable Disables .Nm in the jail. -Strictly equivalent to jail creation's default behavior and to setting the rules -to an empty string. +This is achieved by ensuring that at least one of the +.Va mac.do.rules +and +.Va mac.do.exec_paths +jail parameters are empty. +If none of them ends up empty after applying the default values rule +.Pq see the preamble , +.Va mac.do.rules +is forced to an empty value. +An explicit +.Ql disable +is incompatible with explicit non-empty values for all other jail parameters and +will trigger an error. .It Ql inherit -The jail's credentials rules are inherited from the jail's parent +The other per-jail parameters are inherited from those applicable to the jail's +parent .Pq which may themselves have been inherited . -Modified rules propagate to all children jails configured for inheritance. +Configuration modifications immediately propagate to all descendant jails +configured for inheritance +.Po +as long as there is no intervening jail having its own specific configuration +.Pc . .El +.Pp +The default value depends on the absence or presence and value of the other jail +parameters. +As soon as one of the latter is present and not empty, the default value is +.Ql new , +else it is +.Ql disable . +Inheritance is never established implicitly, it must be explicitly requested. .It Va mac.do.rules The credentials rules for the jail. -It is always equal to the value that can be retrieved by the +See the description of the corresponding .Xr sysctl 8 knob .Va security.mac.do.rules -described in section -.Sx RUNTIME CONFIGURATION . -If set, and the jail parameter -.Va mac.do -is not so explicitly, the value of the latter will default to -.Ql disable -if empty, else to -.Ql new . +in subsection +.Sx "Sysctl Knobs" +above. +See also the preamble for the default values rule. +.It Va mac.do.exec_paths +The authorized executables. +See the description of the corresponding +.Xr sysctl 8 +knob +.Va security.mac.do.exec_paths +in subsection +.Sx "Sysctl Knobs" +above. +See also the preamble for the default values rule. .El +.Ss Consistency +Values read or set from jail parameters are always consistent with their +corresponding +.Xr sysctl 8 +knobs, effectively operating on the same internal +.Dq variable . .Pp -Each jail must have -.Xr mdo 1 -installed at path -.Pa /usr/bin/mdo , -as this path is currently not configurable. +All accesses to some parameter or some jail configuration as a whole, whether +a read or a modification, are sequentially consistent. +In other words, they appear to be atomic, and all threads see them happening in +the same order. .Sh EXAMPLES Here are several examples of single rules matching processes having a real user ID of 10001: @@ -405,6 +501,7 @@ current supplementary groups must be kept. .Sh AUTHORS .An Olivier Certner Aq Mt olce@FreeBSD.org .An Baptiste Daroussin Aq Mt bapt@FreeBSD.org +.An Kushagra Srivastava Aq Mt kushagra1403@gmail.com .Sh BUGS Currently, .Nm From nobody Tue Jun 30 04:51:41 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gq9j95hJKz6jTZ5 for ; Tue, 30 Jun 2026 04:51:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gq9j954LVz4JtD for ; Tue, 30 Jun 2026 04:51:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795101; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZsHCgbTRM1U3PsXN8GHdSUqDuA/krCT2olUoSZgbywE=; b=GGTjR5DpXOeHc7ZFa2a08fxNM5c1CRnhi2oC5H/k3dH9QcA5m+fa3vJTFBQMddzr/rIGIK aU0fQdDiCqTAS1tiT4wbZqOpRwecU3Q0HocBBndj3q8Hjw+XCBSgEIMO3ENCCgnj2E+6Ec FMHPwvz+sotX2ERsrQj/DbF6/iXXDE4BJVK6AOUv4ogZoHK4KOZ118R4zJWW6gKx5a+RSe KF6T1SWVSY6rOS3rfNDJiNHn9lCh8iQIPR02YRRdQPfsfLThgdd7dLmlCGMlx4kTpMTMGM 2uiNRzG7rQEBKuXaWbvjA01nXK43K+wVjve0douVsL8gBWQN40J/lw4GsT/Bgw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782795101; a=rsa-sha256; cv=none; b=QdJFQuaaExVkNjfUc5sl+ROXopFTze4waptIBqCJnhGBJ6QCkH5oobGsI2szO4qiJkSUyx eqmx90xnrKr0abWqIa2MJnTZIGUJa5XL+c27Wyfayt7UB7kVWUTrjNqR/vdQSCoZx5m+s0 s5/Pqa4ei6I4vkgHbUEOXWh45UZ8lDvotbgcQdd29y/lqUMkqICcX0EjKjFpLRqyZ0Dka7 mCbIIGypLxrN1oP0zXSV82fCYK1Qicj8ZaEWAScj9Kc28ZKP47Fnq04a6G/ncRhCiODIoU dqrPl/LUbrZxr+EQoBzkprTK7KLnFopej/CwT3nlWOB9PqB4nt19NkwiK8819w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795101; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZsHCgbTRM1U3PsXN8GHdSUqDuA/krCT2olUoSZgbywE=; b=RhZA54nCYZUu3rk7bvUUFQ96+SpOtPx/3am2YE62+zOgBpalVyb1lBcIXXTATkK2DxYtTb xZKW5Ebe3Hx7ouUds9mkazT8H3GZir6ACXDuDeJCPa3MmOdBhmadMmlZ1CMrgiN4PtAYtO piYe1urX2xE0AbBFzJsjMgaHLoVezn6YKKGsllLsPZ/LwMvOFMT09HEu+oPKNNc7w+hVXt PG8ImTI3BDMYTtuYOkjzbiREN9Eis07sR8EtlG/2pBSykDCKzC3+DAZf1sIebBb7IVMndx x+WyfGwIFWBL9At2FLAAphH8kqG8YKDRxGgmRoWGgu6Kkn9TqV0usxkr5p58Rg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gq9j946sKzDRj for ; Tue, 30 Jun 2026 04:51:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3de96 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 04:51:41 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Bergling Subject: git: 270bfa34cd42 - stable/15 - devd.conf(5): Fix a typo in the manual page List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gbe X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 270bfa34cd421039532e079e2549c02e4a7f88ea Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 04:51:41 +0000 Message-Id: <6a434b5d.3de96.55aca391@gitrepo.freebsd.org> The branch stable/15 has been updated by gbe: URL: https://cgit.FreeBSD.org/src/commit/?id=270bfa34cd421039532e079e2549c02e4a7f88ea commit 270bfa34cd421039532e079e2549c02e4a7f88ea Author: Gordon Bergling AuthorDate: 2026-06-27 10:54:18 +0000 Commit: Gordon Bergling CommitDate: 2026-06-30 04:47:29 +0000 devd.conf(5): Fix a typo in the manual page - s/betwen/between/ (cherry picked from commit 050962ab04a68756b45ff967af42eb2541b0ff5f) --- sbin/devd/devd.conf.5 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sbin/devd/devd.conf.5 b/sbin/devd/devd.conf.5 index a1d6a9051389..7fa0ecd92b72 100644 --- a/sbin/devd/devd.conf.5 +++ b/sbin/devd/devd.conf.5 @@ -878,7 +878,7 @@ detach 0 { }; .Ed .Pp -The following example illustrates the difference betwen internal and shell variables: +The following example illustrates the difference between internal and shell variables: .Bd -literal attach 20 { device-name "umodem[0-9]+"; From nobody Tue Jun 30 04:51:42 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gq9jC0prTz6jTNJ for ; Tue, 30 Jun 2026 04:51:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gq9jB6R0Vz4K15 for ; Tue, 30 Jun 2026 04:51:42 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795102; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WBUOAH94arPaEfCxIMyq/xOI7cpwl3PZjPUQKK5tZAc=; b=PURRQVAYXj026aW99aS1yXvmnCCoWS9c/Kvlb1N1HpNLtIYpj6ydMe8prmlUSuk90NdZom ZUb/fi74D+m8l8bIuo0isAWUdPUqS5HowuUAcrgTO5yWRQOZIlcDB1HcdLCvXDMq75tb9G PtXKTytr+1dilPkYHIF7G+WiGzIh67cF1RnjDeuHTseC1QxyGelt+LC6gIMfZwMTw7hRyq ygW3nm0Ltr8mDHgAJ1QlbbFnxBWyRKkah2c1VYGeRt/B8Q030V+6epm7XNmYrdyF9NqcoU LVX0GLsMlIzRNEpobUq1nxYE4ukVLSAOwSn7FtjVS0wIWpoZ4uhcCF8hSK5mjw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782795102; a=rsa-sha256; cv=none; b=f9zI1oq5CNvQlXEmB1/x2hs2S1ZSrvXQO/0+/jWXA1R6d07XKNh4V9EKGlDwL7zgPnQBm7 ScSHZZRCjc8R1R6xES/h4KD++VKNN8CXa2Btt9daQilMDiB3WiOXOqkgHrRcq4Hhej6Yxf gBrDRKVOMLz44UU6okmScE8I7LGvcSLOGuYa+XYZGI0pDLKYmDZH1CGdrlFSoZiJfWBg6v a1qUqjNLVSdsi4QeoZ/dHWJduazgP57NwM7BodJ5w8zFE4hSQCun0AMROHsG6+UDqN1b2Y Lp/93ayIZHgfWKpFJsQv/E+5mgqBsUUfDSj4yuJ33CDXPxoM4tCVNQtrCJu9Xw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795102; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WBUOAH94arPaEfCxIMyq/xOI7cpwl3PZjPUQKK5tZAc=; b=GPPD5Zb/0Zu+sNJxsyaRIH2diA/O7w7CchaXaHJV5Q5ojbqoxIqN3FmlNBvHMS4eWnUBDd Q/87F7Y5V/To1GNqMqFnLM65Dd6nDHtyAPsjSvPNF4tL0tPJZI+dlxiys/dD1QvuxVi+9H Mff/lLxuUWZgQZHZapNBmvDQga49N2TzRShqbzVZog2irfJ617qc67N9bZcOvdrINfNki7 35N3NK5Gq+MGMRsqMrf9oJVf/cUgh94GsB30dlNre3pgF26YLO77bsuKCdmxXoe5OU8ZJV OnNTczAnYf84i2XXT6PB1qp+H9CU+XGbL8rvfZTmjb7zjPsYWj9wxhhUpY4VDQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gq9jB4vcszCgT for ; Tue, 30 Jun 2026 04:51:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3d15e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 04:51:42 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Bergling Subject: git: a8bbce08731b - stable/15 - ipfw(8): Fix a typo in the manual page List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gbe X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a8bbce08731b2b5a730a4a8689e9e9ea831e6334 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 04:51:42 +0000 Message-Id: <6a434b5e.3d15e.52667233@gitrepo.freebsd.org> The branch stable/15 has been updated by gbe: URL: https://cgit.FreeBSD.org/src/commit/?id=a8bbce08731b2b5a730a4a8689e9e9ea831e6334 commit a8bbce08731b2b5a730a4a8689e9e9ea831e6334 Author: Gordon Bergling AuthorDate: 2026-06-27 10:53:14 +0000 Commit: Gordon Bergling CommitDate: 2026-06-30 04:47:49 +0000 ipfw(8): Fix a typo in the manual page - s/exept/except/ (cherry picked from commit 1e36ffffe21042983304290a5742ad7e0e0ffe05) --- sbin/ipfw/ipfw.8 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8 index 2d683286ed4e..05b88a5ad990 100644 --- a/sbin/ipfw/ipfw.8 +++ b/sbin/ipfw/ipfw.8 @@ -1991,7 +1991,7 @@ certain packet fields. The .Ar bitmask allows to implement wildcard lookups by inserting into table masked prefix and -appying +applying .Ar bitmask upon each lookup. .Pp @@ -3541,7 +3541,7 @@ NAT). Each connection from a particular internal address:port to different external addresses:ports is mapped to a random and unpredictable NAT address:port. -Two appplications behind EDM NATs can only connect to each other +Two applications behind EDM NATs can only connect to each other by port forwarding on the NAT, or tunnelling through an in-between server. .El .Pp @@ -4796,7 +4796,7 @@ ipfw table mynats add 0.0.0.1 11 ipfw table mynats add 0.0.0.2 12 ipfw table mynats add 0.0.0.3 13 -# In -> Out NAT, zero out all bits in a client's IP exept +# In -> Out NAT, zero out all bits in a client's IP except # 2 least significant prior to table lookup ipfw add nat tablearg ip from 10.0.0.0/24 to any lookup src-ip4:0.0.0.3 mynats From nobody Tue Jun 30 04:51:43 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gq9jD4cfFz6jTrg for ; Tue, 30 Jun 2026 04:51:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gq9jD0Gypz4Jxg for ; Tue, 30 Jun 2026 04:51:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795104; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=N+NFstg4DxITmnh3cAxmkajQfmoG+5nN5cF5p6pl7Dk=; b=kVlbQvqJDJ8eNxqmasvTmZXZGNZSY4EbYSU5mV8SYIU6n0VzkaHksgXpSwCWXZvXQKzXen xjagpd2Jhb/PswH20Q2Ae2gtKfgE2nwLT2z/BZdLaR3qKGozNYXlzVU3x7DcxevgqSH2M0 C++yDt71Z5OFAdiLhJcKhg79u9IotZpBEBoIfraggMYju9Oqv1QcbI3fUsvMoUv0zMZAAS CEDGlCuXOeIkz/wBABezzx9fmv1PCQkupNcEj8ymIpO9d5SJ06ygqtvKzeSshCXyhLfGjX nM0RnPcxUJR7TPF/XjsXFmjV/TAlcjS4Wnnl2HohWTNkUavuHIECjHeNZxZWfw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782795104; a=rsa-sha256; cv=none; b=JmlOux2uRBaYBwg/Gz8zl4SbtZU5i+ed5blARyQinpOEzFXLOJslYdfGjAFtsOcLSM9HmS xWCWBhzBYtCo+UD/BEtmkFsRqMd4N7Vinu5lYdUzoA+BQJLBqLqrtmLi28HDQg0j6vdaA0 W6m4m2KfROOdespvkUJe0FnlDXfTS9epivjYW8H4ubd5ZyEEewKm9ZqwAj9DWKzrVCx2i3 PWjCOodzXiGrYP0xMYUXlsdBZSHyHWeRdrIeLOf+xD8wdqy9OjfKWQcCO3xFPVACNzppqF 0sAsVlq3EUXIaxZZFpoKkZaqofy0konCeGseViLexe4yqi2DiWHFIiLfv8lrtw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795104; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=N+NFstg4DxITmnh3cAxmkajQfmoG+5nN5cF5p6pl7Dk=; b=rtJFqXlej6RDfJj/rLQuPz7Qux9hp9mROc6V6z+cGL18IINvip1q3EgDYp//9RArjfHT7e gGTHd6t/X2hpuv0oL8D0B8giBM6GlQM8crAmHYhaeUMU3CW2Mpy03TdAR5ArA8hrZMb8UH OVH+x/QkMBjGox/UIdAIitHKRao+ccafBf5r8CUo4SQQ2av3m76878w2sUMpxWuC/tCmcj rJaCLDafsvnhkMQZ0bfMGqL1Amfdpgs6TRFtKXYGPOx7hBaY9WCMgFC9a9J02pd1jbo4mj Fp9nOVEAjssqtushtqnpm21UJ6X2VFc4TQaPXRSobjb0gaBm2uILwMXfAqYKTg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gq9jC5gdWzCgX for ; Tue, 30 Jun 2026 04:51:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3de22 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 04:51:43 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Bergling Subject: git: 716ba5f31865 - stable/15 - bectl(8): Fix a typo in the manual page List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gbe X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 716ba5f31865a12926ed963ecbdb71186956634b Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 04:51:43 +0000 Message-Id: <6a434b5f.3de22.41779e73@gitrepo.freebsd.org> The branch stable/15 has been updated by gbe: URL: https://cgit.FreeBSD.org/src/commit/?id=716ba5f31865a12926ed963ecbdb71186956634b commit 716ba5f31865a12926ed963ecbdb71186956634b Author: Gordon Bergling AuthorDate: 2026-06-27 10:49:15 +0000 Commit: Gordon Bergling CommitDate: 2026-06-30 04:48:07 +0000 bectl(8): Fix a typo in the manual page - s/envionments/environments/ (cherry picked from commit c94302609a5999786f0be77d1bd0b016153b6b11) --- sbin/bectl/bectl.8 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sbin/bectl/bectl.8 b/sbin/bectl/bectl.8 index 7614bea2ddad..a28ab544d362 100644 --- a/sbin/bectl/bectl.8 +++ b/sbin/bectl/bectl.8 @@ -86,7 +86,7 @@ The .Nm utility manages bootable ZFS clones called boot environments. -Boot envionments allow system changes to be tested safely, +Boot environments allow system changes to be tested safely, as they are selectable directly from the boot .Xr loader 8 . This utility can From nobody Tue Jun 30 04:51:44 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gq9jF551Rz6jTn0 for ; Tue, 30 Jun 2026 04:51:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gq9jF3Dxnz4K4G for ; Tue, 30 Jun 2026 04:51:45 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795105; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vxKdcPMYnvXSyW3QxEKziXcVnSZPjeGt+3UQ0wzCq5E=; b=lAF5kP0syFzXPaP8Ki2Fg3nnBqjlsBZQEQxxaqBMd2c1+URfo0xWN0MUO9fv07afVrG5GK lwQf3R2bYZdM7EC7ajsLyp2uqqJx7hNrVjd7lvXQkeayKVrvcG5k7hl4wLGwecz2ABhdAs wxHYsBNL76MXr+5fVu3KiB6uDvTLBYOfoiJ7w3flu1blWdNfJBv4yPB7H1I8O4cCj7gdV0 xBSywBBmVc/UbwgyRVRBn0SaK2ngGYL7QLUkYh1jApNoZARPgxyrtbdY5RsrS96a58HkCE MiDRRrw5SISHvzuo9yZLKDQLClkJuIjQ4/1LHVxaQCq2DQv82nw+vCVCT8XZRw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782795105; a=rsa-sha256; cv=none; b=r8XkVrH/my3AYs1Uj/zUHoN6IErYblHOzhkTQzSoDHKHxnmOadfYF/fjjbI44JpuaxPmjP OTDXcL6hDRpH1ojsnD5VVQfWDPUGpexH1ZakpGgh15n1xk4sJOYW8j9lsKbvCOU5oLM7Yx i8+UvOOuPxRm/BXDSQ5XcBxw8x7hcTETwP1ceMtyIrHQFeZf4zShhxtWLhLW/Lsc2N6tJx MPXjGThbwDCwhWK2ZCc66DYiLKiHF7ik7+qlxZY0FKZg9HH/DHPq+QxGSufPQHBdLYZN8u JVryG4VWpqRQAUtZ1KuNNBIxQTFEk7sr0L61e4FQU+0eLN4F8K3BDXUjF+SduQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795105; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vxKdcPMYnvXSyW3QxEKziXcVnSZPjeGt+3UQ0wzCq5E=; b=CRK3TwuJenyZwfsM9Sq+aWJKufEMkXpCSdcMzeC4u+iaLfKe4y3vfuZH/HE+f9Wf7b2Ifg ve6rk0i2BXCYYq8cDyiVeY4Hfb8hY59b9oEQlUUHch99koQo7yfqDzQ9o8KIQv+MYhBE0u ayDxqxRS8BhP8PnFx75gKeyk9McUtq6G3Zn54h5BEXPtbUrhVYj8MK3QZWQ8f+ia1VMg5e OP+mo0FfJHlfdtMPYgWR5+CQIorLSGUQNU+ULY+FOg4LBuLLz+YS959dQeGclU/VcV+vo2 Q+a9rHxvdNd6rP5mabRGmn7GX7WZnxFfcZN2SP1OQEEhUsX8QpOsknvVHJ4Xyg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gq9jD6NNDzDP8 for ; Tue, 30 Jun 2026 04:51:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3e6c9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 04:51:44 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Bergling Subject: git: 54ab35a81e43 - stable/15 - ps(1): Fix a few typos in the manual page List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gbe X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 54ab35a81e4334f4fb669cd3e50f6a286689aeb3 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 04:51:44 +0000 Message-Id: <6a434b60.3e6c9.5008338b@gitrepo.freebsd.org> The branch stable/15 has been updated by gbe: URL: https://cgit.FreeBSD.org/src/commit/?id=54ab35a81e4334f4fb669cd3e50f6a286689aeb3 commit 54ab35a81e4334f4fb669cd3e50f6a286689aeb3 Author: Gordon Bergling AuthorDate: 2026-06-27 10:48:11 +0000 Commit: Gordon Bergling CommitDate: 2026-06-30 04:48:26 +0000 ps(1): Fix a few typos in the manual page - s/occurence/occurrence/ - s/occurences/occurrences/ - s/ouput/output/ (cherry picked from commit dd2127b54f97fd7445bb4f4187a148e979c9c944) --- bin/ps/ps.1 | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/bin/ps/ps.1 b/bin/ps/ps.1 index 542004453658..81e059646fd7 100644 --- a/bin/ps/ps.1 +++ b/bin/ps/ps.1 @@ -321,11 +321,11 @@ Extract the name list from the specified system instead of the default, which is the kernel image the system has booted from. .It Fl O Save passed columns in a separate list that in the end is grafted just after the -display's first occurence of the process ID column as specified by other +display's first occurrence of the process ID column as specified by other options, or the default display if there is none. If the display prepared by other options does not include a process ID column, the list is inserted at start of the display. -Further occurences of +Further occurrences of .Fl O append to the to-be-grafted list of columns. This option takes a space- or comma-separated list of keywords. @@ -431,7 +431,7 @@ and .Fl x are specified, .Nm -will obey the last occurence. +will obey the last occurrence. .It Fl Z Add .Xr mac 4 @@ -989,7 +989,7 @@ cannot run faster than the system and is run as any other scheduled process, the information it displays can never be exact. .Pp .Nm ps -currently does not correctly limit the ouput width, and in most cases does not +currently does not correctly limit the output width, and in most cases does not limit it at all when it should. Regardless of the target width, requested columns are always all printed and with widths allowing to entirely print their longest values, except for columns From nobody Tue Jun 30 04:51:46 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gq9jG5T6qz6jTZB for ; Tue, 30 Jun 2026 04:51:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gq9jG1vpgz4KF5 for ; Tue, 30 Jun 2026 04:51:46 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795106; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gqYJ79W0UO1juv1f6DYfg87dVXub5a7igCCSZGVe0Ik=; b=I+P5hcLh36tDIuFulIlehJu/k6DlSdcOrXQbR+VHfDxiVXmtabx+OnTitbIc4TUjTgMGON LCeLQmFYPEsWGu8yWxtXhZDyLjrVVCF1CbQt7s/43xvWq1fkvTAu2q0bXAdjoMsWqpNWXU MGHEKGeQgavtyllAZVV/8C8AufTM/MLLe/TIK+UKklgEtk9p2Ni5exyvBXimRJLIaUD1ww Z5/aufC00KVfcCU2CrwFx7U5RgDNhYbxkPjhyivMFIxfXqgQjUYiM+ykCw8c7Xia0yn9oL MAJR5qRt8mVRkv9Ajnoi8Rv5+KdHPZmDCGGJrEarx02ep+q3LXmrdp12AlKLlw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782795106; a=rsa-sha256; cv=none; b=AenLRPCGOV+3rkQHceLR6ZguX7fK+dECGoF4k9kgfQb/euvkjssdLpSFq0sob9CZQKITvT u7UA+Rb5NfY8VA/EFWcn/WVBhfiTU7EXkUuQf5FHAUL+F71/pURHCUDXryGwPKNQSAd6NX MevENnlz/BtECVtifLHWuUhAEHy9Vxh8+TlowQ4NXAWqCfh2vLGaYvCyBrVqwPMhsdEqxE 5k/JiqUSmXdN/g+aJlSM2VVFM0YJjANS3oDFCEVtr6vPq9NTJgkpfrcAu6xO24NY7Ydu3V gInfOcqgK1qnYTYtTvIIVZDPAWm6s88tzNCGFRdByR3SHQRjrj2pmu1W9xF1eA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795106; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gqYJ79W0UO1juv1f6DYfg87dVXub5a7igCCSZGVe0Ik=; b=fTnHhjRnGXl3ZXyxfEt4D0nARhJZflVHGnEpSc5LIakNyYTtYTVpmYJrAAx4I5uGSOLg78 jLIpbGrQVHWfou8rd/bAHPi8Ior2CXTa4Kn+FEnyRE85rNW1TqwFrF7HHPTx/byk3/GxQA lMHT1o+sbHKtHJAiy5F0XoyvipV+iJz4ECQdNoN1vWddEAQke4tyv+trk+fzKdrQpThLJJ M6VvjLn6syNO91uFCBdbIqN4yP5YrDvgyJcWrGqsGKWDorKrzBcl3aW8Uf9FRzkpjByxfu lctUZG+RoaInq38vqw5/0RgR4iVAUBwmCgTVpWHjdTCw++CufapGSDDzA4vhRQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gq9jG03slzDPB for ; Tue, 30 Jun 2026 04:51:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3ccd7 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 04:51:46 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Bergling Subject: git: f51949d1ac66 - stable/15 - natd(8): Fix a typo in the manual page List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gbe X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: f51949d1ac664c9e49f798caedac14278627694f Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 04:51:46 +0000 Message-Id: <6a434b62.3ccd7.106505d@gitrepo.freebsd.org> The branch stable/15 has been updated by gbe: URL: https://cgit.FreeBSD.org/src/commit/?id=f51949d1ac664c9e49f798caedac14278627694f commit f51949d1ac664c9e49f798caedac14278627694f Author: Gordon Bergling AuthorDate: 2026-06-27 10:56:02 +0000 Commit: Gordon Bergling CommitDate: 2026-06-30 04:48:42 +0000 natd(8): Fix a typo in the manual page - s/appplications/applications/ (cherry picked from commit be8c82bc8e83570474afa78c07f7583bb6813046) --- sbin/natd/natd.8 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sbin/natd/natd.8 b/sbin/natd/natd.8 index 8beff2e66b6a..835c8d9bc724 100644 --- a/sbin/natd/natd.8 +++ b/sbin/natd/natd.8 @@ -133,7 +133,7 @@ NAT). Each connection from a particular internal address:port to different external addresses:ports is mapped to a random and unpredictable NAT address:port. -Two appplications behind EDM NATs can only connect to each other +Two applications behind EDM NATs can only connect to each other by port forwarding on the NAT, or tunnelling through an in-between server. .It Fl verbose | v Do not call From nobody Tue Jun 30 04:51:47 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gq9jH65PHz6jTNS for ; Tue, 30 Jun 2026 04:51:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gq9jH2Gdcz4K94 for ; Tue, 30 Jun 2026 04:51:47 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795107; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cpCfo8IZUzI/66AMdUpV5eUSEVBHjrTtCW9Ipvphs2M=; b=gdJGDJ3Zx5mmT0uDAlwCAhezFwKZ6lhsqUGBHhkyDIYOfKD1PhZf6f2DqmhEJHMg7ejUJX S4/1d6ksYYRfy3BRBDU63iZMQvrHmegedn+kesjDcK7/FGK5O1f9YEIerfP/6Wm52YHYp0 N4NFHd2O8kj/3nP7ZLlHeUsyX2vNAyjI0+MUfTKF8AXL4Jq9AjfwPsO8JJ9V7NZDBHBiAC lc1x3H8MCIhVCbMcWWmE8nMes408qGaronmy8iu9dzHyVk6ILHAvk4oyAlALU8MYy6CelL Mq1EJv0xnT+ik27DFShvN4eNzmoswQlpF0nPSbK+9nbzP8ivE9h19vnJtzTKdA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782795107; a=rsa-sha256; cv=none; b=vwBgh7CFZsr9a+Tr+vdME5+28/k1uYkcX49PFZmnBykPb8ZnHHgEEuM3PNawJJ3v1fZJct xxD6Tw/VjFHWtm3hDu8zyLb0hZeAt4YIjh7vIFel3ZcJYz4MKhrHs5zGqCtRlJUMILu56p u/VTSFim09J4YZ+H+xWYr9pn9N5GGB1mid+niqROHKAqIbWacMwYVDuogQpMRReVPjymLd O4B8Z6h1fd0EIzH/udbfGiwklsjQ37UHLxoRLw5KVQ88vLGC7BCjx0TgWTUmAG7G1ytR6f Q+EAhR88mJ18macgXIjuFLjA3TiYGA1n2t7Txsjutfeks21csQ1lXIXLoEkqqQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795107; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cpCfo8IZUzI/66AMdUpV5eUSEVBHjrTtCW9Ipvphs2M=; b=lsuDCDJzBywH0D/abENnZshwG1KBApvSxP3cklb5qF/SIhu+YSX5OhVO3XF9B5z1pfSEA0 VaNEOOWikOB/Hx7+jK77QdiQUJ88FPd+5gSIdWz2WXb1+zyI8t1vecwOLMaG5e8sGEBp8J H9W5GGMfNwexkP/05T1uFkYbW2wFPikgqKLL2WMGICSJ+wFC2INmMs5I9+2HKeKslztQmC rgnyRNUCAjYIe+vtvqEzP26ZhGuiR3gaBqO1eo4wqa0sb5rJqYtYfP3QkvwNMWSuMzIejD yM4cGI3oNqSAQIRD744YjAhweQUoEnnfjR4IpjvKpkpb2KgpP5tzOGsePRRhYA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gq9jH0xDdzCgc for ; Tue, 30 Jun 2026 04:51:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3e0a8 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 04:51:47 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Bergling Subject: git: 3a27e586a109 - stable/15 - ggated(8): Fix two typos in the manual page List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gbe X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 3a27e586a109466ed29d2d4b57379f54f4c39f62 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 04:51:47 +0000 Message-Id: <6a434b63.3e0a8.74a4a537@gitrepo.freebsd.org> The branch stable/15 has been updated by gbe: URL: https://cgit.FreeBSD.org/src/commit/?id=3a27e586a109466ed29d2d4b57379f54f4c39f62 commit 3a27e586a109466ed29d2d4b57379f54f4c39f62 Author: Gordon Bergling AuthorDate: 2026-06-27 10:58:09 +0000 Commit: Gordon Bergling CommitDate: 2026-06-30 04:48:58 +0000 ggated(8): Fix two typos in the manual page - s/colunm/column/ - s/operaions/operations/ (cherry picked from commit e2339370737bdbebc8bd34a84f5b869da3a9ed43) --- sbin/ggate/ggated/ggated.8 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sbin/ggate/ggated/ggated.8 b/sbin/ggate/ggated/ggated.8 index c48967268df8..e1dbdcda487e 100644 --- a/sbin/ggate/ggated/ggated.8 +++ b/sbin/ggate/ggated/ggated.8 @@ -92,7 +92,7 @@ hostname RW,DIRECT /tmp/direct-image hostname RW,NODIRECT /tmp/nodirect-image .Ed .Pp -The first colunm specifies the ip, network with netmask, or the hostname +The first column specifies the ip, network with netmask, or the hostname that the export applies to. .Pp The next column is the access flags that apply to the export @@ -121,7 +121,7 @@ DIRECT and NODIRECT are used to coerce the use of the O_DIRECT flag to .Xr open 2 when the specified path is opened. If DIRECT is specified the path is always opened with O_DIRECT. If NODIRECT is specified the path is never opened with O_DIRECT. DIRECT access limits the cache effects of -IO operaions on the file. This has the effect of having clients accessing +IO operations on the file. This has the effect of having clients accessing exports to not impact the cache of the local machine, however it will cause greater IO utilization to the devices on which the files reside. .Pp From nobody Tue Jun 30 04:51:48 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gq9jJ4Z6Mz6jTpK for ; Tue, 30 Jun 2026 04:51:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gq9jJ2kbSz4K4k for ; Tue, 30 Jun 2026 04:51:48 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795108; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rO1QVCBKgedntzfkdNUUYispMNmJ94YMX61DPsHQhnw=; b=XEdfHc3kS8y7BOZGz0XP1jlzHm9gNgQc8/ccmGsCV+0vQFWU5m7BDe+YtnvkPh1O6Xy65n wQMZZ60H2fG0EWMUPR71+PN96mTunKviIBSWOqXayfXWqoXjzty2KocJur0dovxP75v5RS ExmTVANQ4H7m4FM7GQnJlYPMS3jViDrtt75P4A30CA+HJ8DTLPFT0mD/h1MfQzQsfyKIn1 n07l6lmAhNPC5Xvv+8yeotOP5Y2KbbZ2vcZTrJHMVkdqJRWao4Hhnfm4TyiFJTB3Ogotwj b1mkznj6FqbkBzGj+c+fk1PekVVGPqEjPjjosOrxLbW2Gks4lIqSbBeG9dukGw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782795108; a=rsa-sha256; cv=none; b=lVlHljS4CWO0GTBW+TFxXE3ytDtLXZHh9yeifSiYQ42jkxJ3tTRYMxidmdMgIVZSCved7d 5QuYFkM2S2roO10J8TOTlld7HVVpjuS7oa758Duydl7jWYqOWt0Fbev5JwIf2Y2W35CbZ0 ageY1BEv7BWX2CHBEkMC4Se90IYk30ZXp7Wj6YoPxcSNOdOLR/BsuwxlGygTFZk01jR5U0 uXVcV0else4Sa4gk4gFEnIcVGySFBmXVyz5Ks66vlYDPTnkFL++9IXtfUPD70iJZd0MVOt W0NKgldcemHLLRmTa9hgsT/sd1DIMDBNiqA9iq/0RnWWZAFgxBpyaQjbBSvXuQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795108; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rO1QVCBKgedntzfkdNUUYispMNmJ94YMX61DPsHQhnw=; b=L+ylNq16BUg4wTdVdm0mcHIY02dhiPL8zVyvZlro3qoajp4KwEoasKB1KFYPl7+CaAzfod MD3oguI9yMnM7uGurvBMgEeDiPYeXkHhb5t0MCdXpxxEk6c3r/b9JmjJroJdEQxzCxwYk8 pJeRstaEoc4pERynXN/ggyHT+eIZZRndfU9TPfiSlEflM1XnA9vQHKSlP00tMWWC2PSmYY iOaKr7aAjWbpPZsIJoTJUzgwKCZsx+juHljqbibTvVHWnC7g8Bk99obqUNdGzGUogDkV84 GNsBmqvaJQFIfF3gfV6Mp7lmtV0WipbTmfcakaSa67hsnDshO+1/0RqwSCfCTw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gq9jJ1YWVzCgd for ; Tue, 30 Jun 2026 04:51:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3e516 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 04:51:48 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Bergling Subject: git: de70e79d0767 - stable/15 - ipfilter(4): Fix a couple of typos in the manual pages List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gbe X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: de70e79d076715b6ff4c03c732809f9847d436b4 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 04:51:48 +0000 Message-Id: <6a434b64.3e516.512f6167@gitrepo.freebsd.org> The branch stable/15 has been updated by gbe: URL: https://cgit.FreeBSD.org/src/commit/?id=de70e79d076715b6ff4c03c732809f9847d436b4 commit de70e79d076715b6ff4c03c732809f9847d436b4 Author: Gordon Bergling AuthorDate: 2026-06-27 10:51:19 +0000 Commit: Gordon Bergling CommitDate: 2026-06-30 04:51:29 +0000 ipfilter(4): Fix a couple of typos in the manual pages - s/heirarchical/hierarchical/ - s/itnerface/interface/ - s/conjuction/conjunction/ (cherry picked from commit 0223ae33ad6dd29215bbb6efd041aa5b6c67dc1f) --- sbin/ipf/ippool/ippool.5 | 4 ++-- sbin/ipf/ippool/ippool.8 | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/sbin/ipf/ippool/ippool.5 b/sbin/ipf/ippool/ippool.5 index 1ab8681bef8b..ae6c4b919940 100644 --- a/sbin/ipf/ippool/ippool.5 +++ b/sbin/ipf/ippool/ippool.5 @@ -34,7 +34,7 @@ pool .IP address pools - are an alternative to hash tables that can perform just as well in most circumstances. In addition, the address pools allow for -heirarchical matching, so it is possible to define a subnet as matching +hierarchical matching, so it is possible to define a subnet as matching but then exclude specific addresses from it. .SS Evolving Configuration @@ -170,7 +170,7 @@ necessary to list each host to be used explicitly. Expressing a collection of hosts as a range or a subnet is not supported. With each address it is also possible to specify a network interface name. The network interface name is ignored by NAT when using destination lists. -The network itnerface name is currently only used with policy based +The network interface name is currently only used with policy based routing (use of "to"/"dup-to" in ipf.conf(5)). .PP Unlike the other directives that can be expressed in this file, destination diff --git a/sbin/ipf/ippool/ippool.8 b/sbin/ipf/ippool/ippool.8 index c879c97b01dd..f1d0aed09d9d 100644 --- a/sbin/ipf/ippool/ippool.8 +++ b/sbin/ipf/ippool/ippool.8 @@ -120,7 +120,7 @@ When parsing a configuration file, rather than load new pool data into the kernel, unload it. .TP .B -D -When used in conjuction with -l, dump the ippool configuration to stdout in +When used in conjunction with -l, dump the ippool configuration to stdout in a format that can be subsequently used as input into ippool -f. .TP .SH FILES From nobody Tue Jun 30 04:53:34 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gq9lM00R8z6jTyK for ; Tue, 30 Jun 2026 04:53:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gq9lL4lFsz4MM0 for ; Tue, 30 Jun 2026 04:53:34 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795214; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LrxjvBCHwMZoK45URTQiDugPHxfvhOvyfxn5igszU0E=; b=mQQRaCjtalI6hWsS8CakDJzlIJIGXCPGzl8zT5AexXRaWKGIFhKxTk7s5EdJY1T3P6Csr9 PiKMPgcV7wRvAmthBbJEd5itMh6x0KwVd/0rhaiZYMdtxWAxFc3NNRpFchHVSTkBPe+iqv 9VZzHlcRNEny8e4BQVuf+qJ/YV2G13zhpTwGTKXHGSwoIoE6aMOFX62MJkWbvFPjagNkQs K++g3nz6a/XziAtex4oMSjMxOdSYlGZifBtR3I5APh92GkjVKZbXPzen/FR/o2gIvp+A1w 7HQuxc+AvNrkCf7DGnD/LbMtS0kaEdaNwg8pobFEPd6NTynspaH/NS2NcP0FHQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782795214; a=rsa-sha256; cv=none; b=L/HMneiKpU7e5EprEt/XQxxeB5mH53jJyg8UwL7cPrDhucT3+09HYBZoA6hhwZCk0BtTdt 8DV6NFVmq/zH0SA6zctoxBxIlP3g1MqQUxnFkdi4gxX0qeb3mVlXIy57vegZ+sYPWH149m RoVarXOzBL5lrasOCtltX5Vj4xz1J2I5OKdHUbChiKW9D0OG7HtrZe/SD/FVmRLyXE5C9E uY3AfYfouuAiSo+qi/NIt/Cm7nzhF3wDAOfzyR9RK1ImqtacO7TVYM8yJWK5Z4w7fD2T7B 0UOAgSrX2OUroADP9HBb2fQbBYnQ4M7U/FR9Jj3Z0vhrzpqH6RzIz4iA5EKwfA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795214; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LrxjvBCHwMZoK45URTQiDugPHxfvhOvyfxn5igszU0E=; b=cn5df7BHViac2KMM4NzgBAONtFvqh2NMC2SpONFeG/fliTYwaUwnY8yWQTQ2P+U2w7YH3X R+j8Ji2Ce3nV/w0lzqKOlhKV4qOCj6QmQHE/7fSdQ/bk8GbdKQ8090V+RHvCy8YQ9ZfgXO bgzTMAu1bRXTLHQzMDzeJAaoGFYhMNIIZJ4BchaeuG6w6Coz19O4nAzw2aGPyNDFv+B2H0 NWdGhVl4AR3n0UnqJfQNs5oUZL3ehbNR/8KgOVj0Lnb8aS8mkPbNE3BV9yNKPNqJlwwtUj IP3YqiyRkdIGSsDxh/hlL02f3xPUuYmTMXxEH4LCr0YexikjVHoCOooHXGguzg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gq9lL3nk4zTHx for ; Tue, 30 Jun 2026 04:53:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3dd9b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 04:53:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Bergling Subject: git: f24211ef601a - stable/14 - bectl(8): Fix a typo in the manual page List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gbe X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: f24211ef601aa2fd8fe43b09cdc663cf181e7ff1 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 04:53:34 +0000 Message-Id: <6a434bce.3dd9b.312d9599@gitrepo.freebsd.org> The branch stable/14 has been updated by gbe: URL: https://cgit.FreeBSD.org/src/commit/?id=f24211ef601aa2fd8fe43b09cdc663cf181e7ff1 commit f24211ef601aa2fd8fe43b09cdc663cf181e7ff1 Author: Gordon Bergling AuthorDate: 2026-06-27 10:49:15 +0000 Commit: Gordon Bergling CommitDate: 2026-06-30 04:52:32 +0000 bectl(8): Fix a typo in the manual page - s/envionments/environments/ (cherry picked from commit c94302609a5999786f0be77d1bd0b016153b6b11) --- sbin/bectl/bectl.8 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sbin/bectl/bectl.8 b/sbin/bectl/bectl.8 index fd939f20e694..2713f7ddc4ea 100644 --- a/sbin/bectl/bectl.8 +++ b/sbin/bectl/bectl.8 @@ -83,7 +83,7 @@ The .Nm utility manages bootable ZFS clones called boot environments. -Boot envionments allow system changes to be tested safely, +Boot environments allow system changes to be tested safely, as they are selectable directly from the boot .Xr loader 8 . This utility can From nobody Tue Jun 30 04:53:35 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gq9lN2Sh8z6jV68 for ; Tue, 30 Jun 2026 04:53:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gq9lM5dl0z4MBW for ; Tue, 30 Jun 2026 04:53:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795215; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lcv5XK6xOmA4cZRzyiMljnIgUzOnwEb+48DsZMmkFfE=; b=QdBhYisEtj3HD/h6XCwNpxTtmuHQdNprHsdmWCccQDZYVigki7MJvqW4b5AA4RdLaAFHI0 9lZkyyC2mz2yKkDxOQXqx7AKgaII+Zo+PRjIQPWl9gvQJ5MUFQbzgYQzW4Gkt2kyK0FrkM dmVlWhuFN6Eeot0iNNArr6rRt6+K2WyptYbaMEJJjkcf5xiYk4hVJP9QzRSGdTgpdh38Wr sRu0ym3eRXzRCpR1GSKGO8RKP/eAYTxZWNK15wQxHZQkh7fepEFz6sMmSa01+Fs1jTm3Cw QI8SQDlAnFwH24ELJgPBZVnk4ECiANasXbzwL/sy1hlCnooUVBJfVfo8l2Pctg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782795215; a=rsa-sha256; cv=none; b=KRRzGMxlYnEqKG/qhxtMpDUlp64Hm76zWyuNd9Oz5t81Otqc24ig6A+8Q6LAhWI2zffD5X pU7jmhz5Z8sZrpllhqsnA36BU+BwtT/83KPM0m0IOYadRTdOqe0ti0OLwBNkzBmqQ7qdBt Mix1vW1thzWjKixhJWfnpFtGCZPHlpv1ElncOhRHH7ODIRctX0xV/30U5YkixictNGobnZ KoFtncSBXb8nwR67R0CpQjeCZWHManjW2568e34fSxrZgYiZN/6+RHlgH5C9K5BeTKzj++ QCdAxI3UsLyn55XUkmYunhOmaT6G6HOo/F8Q+HmQh96FcA2UBDBtcy41d3sVbw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795215; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lcv5XK6xOmA4cZRzyiMljnIgUzOnwEb+48DsZMmkFfE=; b=c4sdNfbLzAAFQlii044RufhBRJ5mkJZ+wDsVm4j1ejW38RZSEX/4/mU2w3307CLEmt5lBZ nBcyec3nfvv5jxtt2gD3rIttkWMcppYyPguorbjFWQmAl+Szwqh7QSl7VDzCJXbN3bzrHT bEi2e1GEJyS/QnEgCR+Qw8CcPrJJHdENx/If7rsWrJyD9LWIan94rDhikyyUxkRDZlphF3 0zleSzzM34KbpiC1v5QXs/7rBc30gJqunhzrTLdb9LZc2RgGsCaD5jJ5fMvLI//scWQ+9K xfqKPwNRl3zF5GUqr3ZeIAFwkEcgvcaq+dd00Z78Pwk844TM0E8FLDItP7wDiw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gq9lM4cNWzTMy for ; Tue, 30 Jun 2026 04:53:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3e4a8 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 04:53:35 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Bergling Subject: git: 4a70a74168fb - stable/14 - ps(1): Fix a few typos in the manual page List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gbe X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 4a70a74168fb6a4af4a4d2fc3231bb20ac10d78a Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 04:53:35 +0000 Message-Id: <6a434bcf.3e4a8.bec1720@gitrepo.freebsd.org> The branch stable/14 has been updated by gbe: URL: https://cgit.FreeBSD.org/src/commit/?id=4a70a74168fb6a4af4a4d2fc3231bb20ac10d78a commit 4a70a74168fb6a4af4a4d2fc3231bb20ac10d78a Author: Gordon Bergling AuthorDate: 2026-06-27 10:48:11 +0000 Commit: Gordon Bergling CommitDate: 2026-06-30 04:52:45 +0000 ps(1): Fix a few typos in the manual page - s/occurence/occurrence/ - s/occurences/occurrences/ - s/ouput/output/ (cherry picked from commit dd2127b54f97fd7445bb4f4187a148e979c9c944) --- bin/ps/ps.1 | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/bin/ps/ps.1 b/bin/ps/ps.1 index 1267b1013f69..13923e18973d 100644 --- a/bin/ps/ps.1 +++ b/bin/ps/ps.1 @@ -317,11 +317,11 @@ Extract the name list from the specified system instead of the default, which is the kernel image the system has booted from. .It Fl O Save passed columns in a separate list that in the end is grafted just after the -display's first occurence of the process ID column as specified by other +display's first occurrence of the process ID column as specified by other options, or the default display if there is none. If the display prepared by other options does not include a process ID column, the list is inserted at start of the display. -Further occurences of +Further occurrences of .Fl O append to the to-be-grafted list of columns. This option takes a space- or comma-separated list of keywords. @@ -427,7 +427,7 @@ and .Fl x are specified, .Nm -will obey the last occurence. +will obey the last occurrence. .It Fl Z Add .Xr mac 4 @@ -989,7 +989,7 @@ cannot run faster than the system and is run as any other scheduled process, the information it displays can never be exact. .Pp .Nm ps -currently does not correctly limit the ouput width, and in most cases does not +currently does not correctly limit the output width, and in most cases does not limit it at all when it should. Regardless of the target width, requested columns are always all printed and with widths allowing to entirely print their longest values, except for columns From nobody Tue Jun 30 04:53:36 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gq9lP1CWfz6jV41 for ; Tue, 30 Jun 2026 04:53:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gq9lN6RqNz4MHF for ; Tue, 30 Jun 2026 04:53:36 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795216; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=C1rqXErZ5Fgk1SdwhahDJFrtw+9Uqf04sRZz8ceT6ug=; b=ZJw6acUxoS+Dw+NKuMSQUjHkutkyeBPcXZI3Pdt+vpLzN64fyS9Ux6pirt/PaDpclpedQh KB2xUwrzqI9DJmt+qDlLnXIF/rALcUdRqI4PAZzzigcLkwdTOintpZxeCxKH2SKtx4Ae+v OJX3LLZs2OJyFSNopUkPM4tB4uVAZTgR3omO0mzVnLoFuvHIIHxfZLXg563BgwHyQX8rXw T9TV/PT4VlG5DvsoZjdn5847ghAO4CabalQRajVljPQ6Ow47HYerk945GTsg46qIa5hWaA LGCN9Ax4A0teSn4mJwlapxXUoRBGxQb5zgwE6I5q6Z7XKFk0ukjmYuyOLfxANQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782795216; a=rsa-sha256; cv=none; b=rddpAVEhHky/gMVUA37E4K4XMGIlCIXKF4OMWzWNrrBnjTMuS92IqJIiZuJiDMQ4UkP7uA CPNYGUmacr8AHchqjqJIMnPYaAFFEpTQdjUxK7XX4hTigfsKYBsZCCC4AHZHBuaNBfVE6R 6yU4KFRTlkEnLMsQkR9wUNqzBfuRXoehID0IQcfHmIbKcXsDBtXsR5x631W6K1JGPrfqck Ml910iMz13SD9R4foquwcTLTIUmIzUP2ZFH1mmg5ozWpRosrR5ENe789rU66kGEcxBRRMX tDY35qdEvRt8PtzTtWeCthfxCY27dJO+7UIeKv1vt6sgFCsqMR7QEoVLJkSo2A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782795216; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=C1rqXErZ5Fgk1SdwhahDJFrtw+9Uqf04sRZz8ceT6ug=; b=AYvfAs6evH8+pK0st7prioLt5qdEJXi0LOM5gpciNnCp631+fYIfQUI00JT8n2hP7MGFbV onNzzxKmvqDKgXIT+lInVdsPhflw9bfpuIymnfRyXdIt3Frj/aFntbgpNp7ZvsJco0F1ue Yy5ip/Ti++UpoHdv0l/tJlHboVmUYqZ0NZRz+JnjcS0PelDIyTD2S8LpdyEiLD4OK7UA8M t3aYMx2HIkNcEMgTQqieoUxEc8khj+dLsYP1r3YffWQoJj88NdoseXaQAw8eRF57dmBGgm 8NrV2TlHraXRnZvkc4ufmyRE0NebMufw4UVWgcXKyNgFmenVCO0VhajjBgCRWQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gq9lN5GRszTN0 for ; Tue, 30 Jun 2026 04:53:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3df15 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 04:53:36 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Bergling Subject: git: a2e72a2f471f - stable/14 - ipfilter(4): Fix a couple of typos in the manual pages List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gbe X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: a2e72a2f471fb4f36b95ce032ab35451322f8f5b Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 04:53:36 +0000 Message-Id: <6a434bd0.3df15.34862248@gitrepo.freebsd.org> The branch stable/14 has been updated by gbe: URL: https://cgit.FreeBSD.org/src/commit/?id=a2e72a2f471fb4f36b95ce032ab35451322f8f5b commit a2e72a2f471fb4f36b95ce032ab35451322f8f5b Author: Gordon Bergling AuthorDate: 2026-06-27 10:51:19 +0000 Commit: Gordon Bergling CommitDate: 2026-06-30 04:53:24 +0000 ipfilter(4): Fix a couple of typos in the manual pages - s/heirarchical/hierarchical/ - s/itnerface/interface/ - s/conjuction/conjunction/ (cherry picked from commit 0223ae33ad6dd29215bbb6efd041aa5b6c67dc1f) --- sbin/ipf/ippool/ippool.5 | 4 ++-- sbin/ipf/ippool/ippool.8 | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/sbin/ipf/ippool/ippool.5 b/sbin/ipf/ippool/ippool.5 index 97e831cfc8cc..87ec5ed6fa85 100644 --- a/sbin/ipf/ippool/ippool.5 +++ b/sbin/ipf/ippool/ippool.5 @@ -34,7 +34,7 @@ pool .IP address pools - are an alternative to hash tables that can perform just as well in most circumstances. In addition, the address pools allow for -heirarchical matching, so it is possible to define a subnet as matching +hierarchical matching, so it is possible to define a subnet as matching but then exclude specific addresses from it. .SS Evolving Configuration @@ -174,7 +174,7 @@ necessary to list each host to be used explicitly. Expressing a collection of hosts as a range or a subnet is not supported. With each address it is also possible to specify a network interface name. The network interface name is ignored by NAT when using destination lists. -The network itnerface name is currently only used with policy based +The network interface name is currently only used with policy based routing (use of "to"/"dup-to" in ipf.conf(5)). .PP Unlike the other directives that can be expressed in this file, destination diff --git a/sbin/ipf/ippool/ippool.8 b/sbin/ipf/ippool/ippool.8 index 1ff9911a87d8..35fe257c8b00 100644 --- a/sbin/ipf/ippool/ippool.8 +++ b/sbin/ipf/ippool/ippool.8 @@ -121,7 +121,7 @@ When parsing a configuration file, rather than load new pool data into the kernel, unload it. .TP .B -D -When used in conjuction with -l, dump the ippool configuration to stdout in +When used in conjunction with -l, dump the ippool configuration to stdout in a format that can be subsequently used as input into ippool -f. .TP .SH FILES From nobody Tue Jun 30 06:24:33 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqCmK4KXvz6jcW8 for ; Tue, 30 Jun 2026 06:24:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqCmK1Vf7z3Fpw for ; Tue, 30 Jun 2026 06:24:33 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782800673; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qVr6CPXos1pgEjzkaig/FDiuSOSm0UUnnHzDCk5bNhw=; b=LcW/2bdYSig2U2Vn3Ilbw+tF2NNWw38STPrj8sodag+w3MHMwisHXOrbJCBG0fps4npUeO EdKy1thiP7+lR1Ly/7ON0pWA7kh3uyAR4RnHTVqkmUSHSKuulfArIt72IV6rkA4dbKYyY0 K45IykVLb8jJCMY1pUbhZinnRUVZ7Wip4ldaxi4QmtxM6t9hS/zUe8Zj+pWWd/tyJ8J2Vh fC4ROdNcWhkS6G8jB8z+ksPIhuPZeL7PtQoB8DKqiual5BvlsxoWp0nmhFTmz0+u7F7t4B fc/L2Wbsm7TeAiPjksq997jtF4Y3mZp/weMvPByhOQKlEOPGsmfyj9IjsEl9eg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782800673; a=rsa-sha256; cv=none; b=In+1s1tcx55aUBHdyrhhGJlxV0mCOfKC+Kwp5wzRbzfQiGTPKp6unrRsQZDLUwuAyabs4S ZNf7bC4M2p0S1SRDfAWn/DFMKAFM90YkUZfjWhrkLwkM9JxQAC/nP4alusYNTYT5EzBYIC QbysIyoHTeda0FcFuxwrcg1EaCjQ7sIGbre3JY0tVTAT2xEagE53nx2MNSc+1uN598Cnen MzwOihkxljPB9Exvv+aOf8EwuNKAaugvUtomJJfRzFKWwIFRsuudYfehukFLgz4dQn9ya8 ofJbhyeaR+0E30OkDYDcu26WxXBfb+EsuFgXMa+amKo1RcxdOy1uu2ozJig1tw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782800673; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qVr6CPXos1pgEjzkaig/FDiuSOSm0UUnnHzDCk5bNhw=; b=fOiWejIO2lAkdfoQQ62G6EqQWUF24PC4bwQClt+CCkMdW4D3W/wuvxNQ5bY1o9akvBidcZ Cq4PddLaOKkDcN1OG5p1215YRDx1K2jdYYIADTUcorbHw6GoJdMnHHfuDuZoC7kPi2qvFD UH+zFybY/GZRLL0hKMlBR6KnZgH1gbq7f12Z6dEHCF4sy0203HRalLxcSVIYzLg4SOqY1p aIyfUC13AfSjo54wc5GXK3zFVhZE0JI3eOnNp+jtET/xXcUP+3UB8676Xo5YHki/OBkP7J C1cCEmzlbDFgadGeAKjsMoohaPH8iEs8SqHXLUDMa6zlN68wh3Thf7nbNYk0HQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqCmK08jSzYNW for ; Tue, 30 Jun 2026 06:24:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 20d1f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 06:24:33 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Goran=?utf-8?Q? Meki=C4=87?= From: Christos Margiolis Subject: git: 5347284ba90f - stable/15 - sound: Include more information in kevent returned from the kernel List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: christos X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 5347284ba90fd52eeb5d23e50673f23a3b77c8ad Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 06:24:33 +0000 Message-Id: <6a436121.20d1f.50ec7296@gitrepo.freebsd.org> The branch stable/15 has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=5347284ba90fd52eeb5d23e50673f23a3b77c8ad commit 5347284ba90fd52eeb5d23e50673f23a3b77c8ad Author: Goran Mekić AuthorDate: 2026-06-17 10:35:07 +0000 Commit: Christos Margiolis CommitDate: 2026-06-30 06:23:56 +0000 sound: Include more information in kevent returned from the kernel Reviewed by: christos Differential Revision: https://reviews.freebsd.org/D57362 (cherry picked from commit fe13f70b95a762e19c38d1152eac6312d8578f84) --- share/man/man4/pcm.4 | 76 +++++++++++++++++++++++++++++++++++++++++++++++++ sys/dev/sound/pcm/dsp.c | 14 +++++++-- 2 files changed, 88 insertions(+), 2 deletions(-) diff --git a/share/man/man4/pcm.4 b/share/man/man4/pcm.4 index 7a0059f43f73..1aebff562d8f 100644 --- a/share/man/man4/pcm.4 +++ b/share/man/man4/pcm.4 @@ -509,6 +509,82 @@ See for a complete list of the supported .Fn ioctl functions. +.Ss kqueue Support +The +.Va kevent +structure's fields are defined as follows: +.Bl -tag -width "Fa filter" +.It Fa ident +The file descriptor for the device. +.It Fa filter +The kernel filter used to process the event. +This is either +.Dv EVFILT_READ +for recording or +.Dv EVFILT_WRITE +for playback. +.It Fa data +The number of bytes available to be read or written. +.It Fa ext +.Bl -bullet -compact +.It +.Va ext[0] +For devices that use +.Xr mmap 2 , +it contains the +.Va count_info.ptr +field reported by +.Va SNDCTL_DSP_GETIPTR +for recording or +.Va SNDCTL_DSP_GETOPTR +for playback, whereas for devices that do not use +.Xr mmap 2 , +it contains the +.Va oss_count_t.fifo_samples +field reported by +.Va SNDCTL_DSP_CURRENT_IPTR +for recording or +.Va SNDCTL_DSP_CURRENT_OPTR +for playback. +.It +.Va ext[1] +contains the +.Va audio_errinfo.rec_overruns +field for recording events, or the +.Va audio_errinfo.play_underruns +field for playback events, as reported by +.Va SNDCTL_DSP_GETERROR . +.Pp +This allows a single +.Va kevent +to report that data is ready, how many bytes can be read or written, the +current buffer position, and the current error count. +This is especially useful for scenarios that use +.Xr mmap 2 , +because without +.Xr kqueue 2 +the typical processing loop consists of: +.Bl -bullet -compact +.It +Calculating the wait time and calling +.Xr clock_nanosleep 2 . +.It +Calling +.Xr ioctl 2 +for +.Va SNDCTL_DSP_GETIPTR +or +.Va SNDCTL_DSP_GETOPTR +to get the pointer into the memory-mapped buffer where new data starts. +.It +Calling +.Xr ioctl 2 +for +.Va SNDCTL_DSP_GETERROR +to get over/underruns and handle them. +.El +.El +.El .Sh FILES The .Nm diff --git a/sys/dev/sound/pcm/dsp.c b/sys/dev/sound/pcm/dsp.c index f32446570374..fbe9f8a04325 100644 --- a/sys/dev/sound/pcm/dsp.c +++ b/sys/dev/sound/pcm/dsp.c @@ -3011,10 +3011,20 @@ dsp_kqevent(struct knote *kn, long hint) } kn->kn_data = 0; if (chn_polltrigger(ch)) { - if (kn->kn_filter == EVFILT_READ) + if (kn->kn_filter == EVFILT_READ) { kn->kn_data = sndbuf_getready(ch->bufsoft); - else + if (ch->flags & CHN_F_MMAP) + kn->kn_kevent.ext[0] = sndbuf_getfreeptr(ch->bufsoft); + else + kn->kn_kevent.ext[0] = sndbuf_getready(ch->bufsoft) / ch->bufsoft->align; + } else { kn->kn_data = sndbuf_getfree(ch->bufsoft); + if (ch->flags & CHN_F_MMAP) + kn->kn_kevent.ext[0] = sndbuf_getreadyptr(ch->bufsoft); + else + kn->kn_kevent.ext[0] = sndbuf_getready(ch->bufsoft) / ch->bufsoft->align; + } + kn->kn_kevent.ext[1] = ch->xruns; } return (kn->kn_data > 0); From nobody Tue Jun 30 06:24:34 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqCmL4pDRz6jcWC for ; Tue, 30 Jun 2026 06:24:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqCmL2CR7z3FYL for ; Tue, 30 Jun 2026 06:24:34 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782800674; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MCsnQfvwfZbUWQWKXRWJqlxsnvJwRvuxBkOGIfRp/mI=; b=kZjGp0rBQxacTq+Qim7sVUjtqUQ+QvkaMJ9P41Uy75I/7ekX8AOpVvfDqc7AZalyP//UFZ j+o9ApZE0YGtzdeIgErTlyanoixWvOHXmxfUtIA6A6XA/q0Ou7s82Omd0GXVm2O5DcwEKA arTazNGafKvk81k2+TUKZYbWbTPzO7dsHfDUE/Avbd+Rm6QSEhQxYw/9xSsqqX2j19V0hN PnHdgMKNHvcAuw5zdkpT+Oz8DezbzfrWDq0ZW/XknHNV/95i2i+h8lA7Pvpd5GNoAXyAQt vhNNSkXAdAiGvu8JMNYLi9uPumzotPFTuwyPl/71Yb4mZMFNuxMhrSK/EtiijQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782800674; a=rsa-sha256; cv=none; b=Z1sp98f1fPEj+ohuY/hgtdK/hFTj9TvtRHjihsOdhlBI/BpV2Ye6U/dyX2/NrM7iuuYlz8 iY5tLpw2fxw0DIhcOw+g4X4QBHo1JcvmfPQCe0WTtHdkjaQxjiHL7Ui7wN9/0mHuAkE4/t 5D7Sam/XLSkpa/ZH1Gy/xSD+juGVA3hmNEL/0guIOZ2XhvJNXv3J3S7tGe/wMMpmX5Q8JI L7mhWUVeFpvTM02dDx/S0780pjTrPCL0t6EMdenYdjuBwrRNugrZ5un2hoJ4P7vhoQruco r36UbVXvqXPPgMUlyjB43S0MGhHBDCjBHyrr3sDil1mR5eF9Hh5+PeXLqcpsMw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782800674; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MCsnQfvwfZbUWQWKXRWJqlxsnvJwRvuxBkOGIfRp/mI=; b=U+a7J6F3WkoFQf61in7BeBDvjiKQnhvA1I5O34Ejj1cPl886juAD429wwzOkPC/fejNGwi 802KP6ARzDKTGWJh6+yoputJjkOWEpkV8PJiuREbFTN0NTm4verIEvZeNLvLK55xC1oX+v G3t65aAgmXNtCTGGiS4DQwG5ON0izyalXG5wSGflN1Wco5+gEndeOT+memk286SEFWHo3d m7yoyujSBr6L/lnjXHRC03Sk1MPQGIVBWgRBD4ep6JxqHYx8OzS80Fcof6TaoY9wti4OEE LrN0eoc63RJMThesoKTIz/2OKd7uH/QMoqPs8R5VShBGFV1RI/ACszdgwCaoEw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqCmL121CzXp0 for ; Tue, 30 Jun 2026 06:24:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1e362 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 06:24:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Goran=?utf-8?Q? Meki=C4=87?= From: Christos Margiolis Subject: git: a751490f5bf7 - stable/15 - sound: Adjust mmap example to use kqueue List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: christos X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a751490f5bf7186e4dc7092c3ffb9483ae853e43 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 06:24:34 +0000 Message-Id: <6a436122.1e362.3315b82@gitrepo.freebsd.org> The branch stable/15 has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=a751490f5bf7186e4dc7092c3ffb9483ae853e43 commit a751490f5bf7186e4dc7092c3ffb9483ae853e43 Author: Goran Mekić AuthorDate: 2026-06-17 10:36:12 +0000 Commit: Christos Margiolis CommitDate: 2026-06-30 06:23:57 +0000 sound: Adjust mmap example to use kqueue Reviewed by: christos Differential Revision: https://reviews.freebsd.org/D57410 (cherry picked from commit a48bbef5eb32508a8d7b3b986c9b1d28176d1694) --- share/examples/sound/mmap.c | 178 +++++++++++++------------------------------- 1 file changed, 50 insertions(+), 128 deletions(-) diff --git a/share/examples/sound/mmap.c b/share/examples/sound/mmap.c index 7f165d417020..3710483361ac 100644 --- a/share/examples/sound/mmap.c +++ b/share/examples/sound/mmap.c @@ -26,114 +26,18 @@ */ /* - * This program demonstrates low-latency audio pass-through using mmap. - * Opens input and output audio devices using memory-mapped I/O, - * synchronizes them in a sync group for simultaneous start, - * then continuously copies audio data from input to output. + * This program demonstrates low-latency audio pass-through using mmap + * and kqueue. It opens input and output audio devices using memory- + * mapped I/O, synchronizes them in a sync group for simultaneous start, + * then continuously copies audio data from input to output. Buffer + * positions are obtained from kqueue's ext[0] (replacing GETIPTR/ + * GETOPTR ioctls) and error counters from ext[1] (replacing GETERROR). */ -#include +#include #include "oss.h" -/* - * Get current time in nanoseconds using monotonic clock. - * Monotonic clock is not affected by system time changes. - */ -static int64_t -gettime_ns(void) -{ - struct timespec ts; - - if (clock_gettime(CLOCK_MONOTONIC, &ts) != 0) - err(1, "clock_gettime failed"); - return ((int64_t)ts.tv_sec * 1000000000LL + ts.tv_nsec); -} - -/* - * Sleep until the specified absolute time (in nanoseconds). - * Uses TIMER_ABSTIME for precise timing synchronization. - */ -static void -sleep_until_ns(int64_t target_ns) -{ - struct timespec ts; - - ts.tv_sec = target_ns / 1000000000LL; - ts.tv_nsec = target_ns % 1000000000LL; - if (clock_nanosleep(CLOCK_MONOTONIC, TIMER_ABSTIME, &ts, NULL) != 0) - err(1, "clock_nanosleep failed"); -} - -/* - * Calculate the number of frames to process per iteration. - * Higher sample rates require larger steps to maintain efficiency. - */ -static unsigned -frame_stepping(unsigned sample_rate) -{ - return (16U * (1U + (sample_rate / 50000U))); -} - -/* - * Update the mmap pointer and calculate progress. - * Returns the absolute progress in bytes. - * - * fd: file descriptor for the audio device - * request: ioctl request (SNDCTL_DSP_GETIPTR or SNDCTL_DSP_GETOPTR) - * map_pointer: current pointer position in the ring buffer - * map_progress: absolute progress in bytes - * buffer_bytes: total size of the ring buffer - * frag_size: size of each fragment - * frame_size: size of one audio frame in bytes - */ -static int64_t -update_map_progress(int fd, unsigned long request, int *map_pointer, - int64_t *map_progress, int buffer_bytes, int frag_size, int frame_size) -{ - count_info info = {}; - unsigned delta, max_bytes, cycles; - int fragments; - - if (ioctl(fd, request, &info) < 0) - err(1, "Failed to get mmap pointer"); - if (info.ptr < 0 || info.ptr >= buffer_bytes) - errx(1, "Pointer out of bounds: %d", info.ptr); - if ((info.ptr % frame_size) != 0) - errx(1, "Pointer %d not aligned to frame size %d", info.ptr, - frame_size); - if (info.blocks < 0) - errx(1, "Invalid block count %d", info.blocks); - - /* - * Calculate delta: how many bytes have been processed since last check. - * Handle ring buffer wraparound using modulo arithmetic. - */ - delta = (info.ptr + buffer_bytes - *map_pointer) % buffer_bytes; - - /* - * Adjust delta based on reported blocks available. - * This accounts for cases where the pointer has wrapped multiple times. - */ - max_bytes = (info.blocks + 1) * frag_size - 1; - if (max_bytes >= delta) { - cycles = max_bytes - delta; - cycles -= cycles % buffer_bytes; - delta += cycles; - } - - /* Verify fragment count matches expected value */ - fragments = delta / frag_size; - if (info.blocks < fragments || info.blocks > fragments + 1) - warnx("Pointer block mismatch: ptr=%d blocks=%d delta=%u", - info.ptr, info.blocks, delta); - - /* Update pointer and progress tracking */ - *map_pointer = info.ptr; - *map_progress += delta; - return (*map_progress); -} - /* * Copy data between ring buffers, handling wraparound. * The copy starts at 'offset' and copies 'length' bytes. @@ -169,8 +73,6 @@ main(int argc, char *argv[]) int ch, bytes; int frag_size, frame_size, verbose = 0; int map_pointer = 0; - unsigned step_frames; - int64_t frame_ns, start_ns, next_wakeup_ns; int64_t read_progress = 0, write_progress = 0; oss_syncgroup sync_group = { 0, 0, { 0 } }; struct config config_in = { @@ -187,6 +89,8 @@ main(int argc, char *argv[]) .sample_rate = 48000, .mmap = 1, }; + struct kevent ev; + int kq; while ((ch = getopt(argc, argv, "v")) != -1) { switch (ch) { @@ -228,10 +132,6 @@ main(int argc, char *argv[]) errx(1, "Input and output configurations have different fragment sizes"); - /* Calculate timing parameters */ - step_frames = frame_stepping(config_in.sample_rate); - frame_ns = 1000000000LL / config_in.sample_rate; - /* Clear output buffer to prevent noise on startup */ memset(config_out.buf, 0, bytes); @@ -245,25 +145,51 @@ main(int argc, char *argv[]) if (ioctl(config_in.fd, SNDCTL_DSP_SYNCSTART, &sync_group.id) < 0) err(1, "Starting sync group failed"); - /* Initialize timing and progress tracking */ - start_ns = gettime_ns(); - read_progress = update_map_progress(config_in.fd, SNDCTL_DSP_GETIPTR, - &map_pointer, &read_progress, bytes, frag_size, frame_size); - write_progress = read_progress; - next_wakeup_ns = start_ns; + /* Create kqueue and register input device for read events */ + kq = kqueue(); + if (kq < 0) + err(1, "kqueue failed"); + EV_SET(&ev, config_in.fd, EVFILT_READ, EV_ADD, 0, 0, NULL); + if (kevent(kq, &ev, 1, NULL, 0, NULL) < 0) + err(1, "kevent register failed"); /* * Main processing loop: - * 1. Sleep until next scheduled wakeup - * 2. Check how much new audio data is available - * 3. Copy available data from input to output buffer - * 4. Schedule next wakeup + * Block on kevent() until input data is available. + * ext[0] holds the current DMA pointer (GETIPTR/GETOPTR equivalent). + * ext[1] holds the xrun count for the channel (GETERROR equivalent). */ for (;;) { - sleep_until_ns(next_wakeup_ns); - read_progress = update_map_progress(config_in.fd, - SNDCTL_DSP_GETIPTR, &map_pointer, &read_progress, bytes, - frag_size, frame_size); + int n; + int ptr; + unsigned delta; + + n = kevent(kq, NULL, 0, &ev, 1, NULL); + if (n < 0) + err(1, "kevent failed"); + if (n == 0) + continue; + + ptr = (int)ev.ext[0]; + if (ptr < 0 || ptr >= bytes) + errx(1, "Pointer out of bounds: %d", ptr); + if ((ptr % frame_size) != 0) + errx(1, "Pointer %d not aligned to frame size %d", ptr, + frame_size); + + /* + * Calculate delta: how many bytes have been processed since + * last check. Handle ring buffer wraparound. + */ + delta = (ptr + bytes - map_pointer) % bytes; + + /* Update pointer and progress tracking */ + map_pointer = ptr; + read_progress += delta; + + /* Report xruns if any */ + if (ev.ext[1] != 0 && verbose) + warnx("xruns: %llu", (unsigned long long)ev.ext[1]); /* Copy new audio data if available */ if (read_progress > write_progress) { @@ -277,13 +203,9 @@ main(int argc, char *argv[]) printf("copied %d bytes at %d (abs %lld)\n", length, offset, (long long)write_progress); } - - /* Schedule next wakeup based on frame timing */ - next_wakeup_ns += (int64_t)step_frames * frame_ns; - if (next_wakeup_ns < gettime_ns()) - next_wakeup_ns = gettime_ns(); } + close(kq); if (munmap(config_in.buf, bytes) != 0) err(1, "Memory unmap failed"); config_in.buf = NULL; From nobody Tue Jun 30 06:24:31 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqCmQ0RZlz6jcQl for ; Tue, 30 Jun 2026 06:24:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqCmP14MPz3Fmc for ; Tue, 30 Jun 2026 06:24:37 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782800677; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=az18BZ39u59Nh+LhQPl9QXf1GHU7bebdS6b/cK5Kklk=; b=keYUryJWMBI5h6KZMXG10L4DSSLocBFKg6m7DmaFiSsSmhDC1aPq13J2O8Mwwqh2MPSvOh udLqBB5Invpfg4iOtNmCc3E8Gaub49M6iPt0euhQiqrz3uQEtSJIaZMplqAuGcSigTE/aJ WoBp3ANJXS0Lf4hSMXrZCTtFDRADf1Rfeo0OBmm3BEedE8QpC/v5uv/a0gZk9qnhKtKymf GyoNlQU6SdOCcS3qyHhKGZ6neSqAa5TmpO3H7NNjd3fNFzcORHhpqkpNGuWmzu3pAfgDH1 bD52J6UDkPRId+NgX272CYYorNevDhYDG1sa4JQU1mBRostSpg7q9wHzi91xfw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782800677; a=rsa-sha256; cv=none; b=IuoCsQM//MMuaRWJc9wc2b1MPMNM0wwjXJTotcEs+gwk8UzFdG/CPqgG/0eeoZAZ2PqxPq zZ0yRa3SCQsTRdsZrkqb704GZA6fEoq+bCTz1NFKMfNQk7I32mqAfknxJLwI+ueRBw8ZWD 8/IXYDMGNk/D/rysJV32UZnG+YAXH4HuHOkAbxj7behF3SknxmIWEjFyuQrW0MNCg24Cvz m5RoAyBu65OdMZS4vzg6xAciJvNbnKUQS0Jc4+4Np8hhAmtrnLQ+alQhpVjFWah3Auja1+ iR4Z8MsaLDrnZgIuZev/5Vs6Svi6MYSJnK4ojAcbYIRXWlPXAkOAfW99jCcQXA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782800677; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=az18BZ39u59Nh+LhQPl9QXf1GHU7bebdS6b/cK5Kklk=; b=Z1hoFHckiAEeWNKdqAQpiMCJ2yg50+T7FksMHLoN2HlpmU7Ml4n3Yup2IaRZFOzo5w4qPX sgqq5LxjVzJNl+Jbt76Ik31KG66/Icj3LDA+iZ90fs1yMoHa0jweFTxPjSpT/YtTzy2w6c w2pMSvjs9o5saPK1U043elWsqXvBTnuW8j6PAlKEbMtrPG8MtkiHTWI0sfY7QGKkpuzJep c4bvKjxJLyuyDJC8CDt/dK7neWMUuT39IY3/pceXtC2M4uJQCrPEDaGoZktvpYupW2Be8K 6JNWDUuJkzlra7uFSc0axAzYCgFdqms5tiikWwjbY6e+FI/TgDl8zyp8n7qwfA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqCmP07LVzYNb for ; Tue, 30 Jun 2026 06:24:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 204fb by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 06:24:31 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Goran=?utf-8?Q? Meki=C4=87?= From: Christos Margiolis Subject: git: 0665d5b9d38a - stable/15 - sound: Start each channel individually List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: christos X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 0665d5b9d38a0b45db50a38244dfe17b8fefebee Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 06:24:31 +0000 Message-Id: <6a43611f.204fb.dc9b002@gitrepo.freebsd.org> The branch stable/15 has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=0665d5b9d38a0b45db50a38244dfe17b8fefebee commit 0665d5b9d38a0b45db50a38244dfe17b8fefebee Author: Goran Mekić AuthorDate: 2026-06-17 10:34:05 +0000 Commit: Christos Margiolis CommitDate: 2026-06-30 06:23:40 +0000 sound: Start each channel individually Unlock all members before starting any of them. Holding multiple channel locks while calling chn_start() on a virtual channel can trigger the parent, which acquires PCM_LOCK() while other virtual channels are still locked -- a lock order reversal. Reviewed by: christos Differential Revision: https://reviews.freebsd.org/D57399 (cherry picked from commit 47ae0a869c7db693ffb1ac058d63dcb79c4e68a8) --- sys/dev/sound/pcm/dsp.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/sys/dev/sound/pcm/dsp.c b/sys/dev/sound/pcm/dsp.c index 471db6524aa2..f32446570374 100644 --- a/sys/dev/sound/pcm/dsp.c +++ b/sys/dev/sound/pcm/dsp.c @@ -2733,16 +2733,29 @@ dsp_oss_syncstart(int sg_id) /* Proceed only if no errors encountered. */ if (ret == 0) { - /* Launch channels */ - while ((sm = SLIST_FIRST(&sg->members)) != NULL) { - SLIST_REMOVE_HEAD(&sg->members, link); + /* + * Unlock all members before starting any of them. + * Holding multiple channel locks while calling chn_start() + * on a virtual channel can trigger the parent, which + * acquires PCM_LOCK() while other virtual channels are + * still locked -- a lock order reversal. + */ + SLIST_FOREACH(sm, &sg->members, link) { + sm->ch->sm = NULL; + sm->ch->flags &= ~CHN_F_NOTRIGGER; + CHN_UNLOCK(sm->ch); + } + /* + * Start each channel individually, then remove it from + * the sync group and free its member structure. + */ + while ((sm = SLIST_FIRST(&sg->members)) != NULL) { c = sm->ch; - c->sm = NULL; + CHN_LOCK(c); chn_start(c, 1); - c->flags &= ~CHN_F_NOTRIGGER; CHN_UNLOCK(c); - + SLIST_REMOVE_HEAD(&sg->members, link); free(sm, M_DEVBUF); } From nobody Tue Jun 30 13:35:47 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqPKw2YXzz6kChH for ; Tue, 30 Jun 2026 13:35:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqPKw05r0z3K8V for ; Tue, 30 Jun 2026 13:35:48 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782826548; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=HeIjYyyRk61vobydd1gcSiZFeDNM/XHXtux6CYtC8oY=; b=Cc9JLiRRBM8skfkIk7mGaVAQ8v/0sgLxYbzKkJ8CeaKvxM/ueyM7bm6bdKHbPqFgLTRO47 2aVmoLA2cxSTivBhfGFUYJSHNA/ssLiD50prNPNVYnCUsvULtZMi1IVRy/dEQlQPcu0rUC /j/hwDGr4nbzvkjiPwTZF1Kycg8iB8lZkHIPJuwYl7hI7h74El7Jt3Ge4XLEVbfms3xY8H bbRBcvLQxlNB8y2biX2CC4T48nQrSOZuDepgs2ovJQkbhr6/rxZ8gYs6lQcZquFC5dFQjJ 9D+QXrLk7JRuadiXwF8Cl2ZuWBoGjcAEdegN36rpHR2DjX7kKeBzF8/iVnDcIQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782826548; a=rsa-sha256; cv=none; b=X29WhJgH/DyAxOQBbGTZCyh9v5285m7nV7tAYOc+4p17e0Op2EPgoW76vvzuA32o3QhZvU wRZgSnrrBmF10wyNmrF0Tl6LaYMV2GynVzOQqiEwRWluT+mX0BTktch58ghI1B62LXjsks 63X04Mqr6BUdIhd42W1aVk/0/MEqtIfKGnQNl/2icyivyObAHF4Q89AHm2ghxdxrMjU89i lWlDzL5jAFGA+KN8GEX149G9TS+Z2dWgjFgtiPO9FcuhLJfG+SEk8SZ+aVGvJc+5v0oDE4 BtBUWGiZOPxggSS9Vy5APTD/CDmTc/0L+SJnWPx2W730tyy6AHuF2Vo1oDe6dw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782826548; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=HeIjYyyRk61vobydd1gcSiZFeDNM/XHXtux6CYtC8oY=; b=nfKXxVCCffsAcxX5Jev9sLONjLf0DaN0DdjtSBFk5H8GXrcYL9YPPpVsZGSbg2cU+cfPFN T1x4SPKaB3nFx5htHO8Kjg8hMaWaelni2u8VyTyIq8B4Sm6auXewpXVbEqeAbJaJAKkHeL 9gOtxHm4FoJK1BlSrk7kGl8asdet5jZUIXZtw+Y6/a6wJ4wnXIIIm5AneqMTOIAQ/w6Zea Sv+9Wo6IKE1WJwTiDaO4nhnFa8G2uqg0Dp/h4MgDi10+gCdDejBrOcKwbH4VW1z7kqKfkY 4LIDsxlYgS8P7Z2o2QDYgpt1LRQfzC3WK2CmMTTiiMHUK3GQWQJjY1I1t3R4UA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqPKv646zzmVH for ; Tue, 30 Jun 2026 13:35:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 262b4 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 13:35:47 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Siva Mahadevan Subject: git: 6aac5dd48dc6 - stable/15 - tests/test_rtsock_l3: fix flaky temporal route addition tests List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: siva X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 6aac5dd48dc6e085765fe297d907a5cfb072c574 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 13:35:47 +0000 Message-Id: <6a43c633.262b4.581d13ca@gitrepo.freebsd.org> The branch stable/15 has been updated by siva: URL: https://cgit.FreeBSD.org/src/commit/?id=6aac5dd48dc6e085765fe297d907a5cfb072c574 commit 6aac5dd48dc6e085765fe297d907a5cfb072c574 Author: Siva Mahadevan AuthorDate: 2026-06-18 15:33:00 +0000 Commit: Siva Mahadevan CommitDate: 2026-06-30 13:14:12 +0000 tests/test_rtsock_l3: fix flaky temporal route addition tests If RTM_DELETE arrives before RTM_ADD, the test will skip the first reply and then timeout after attempting to read another message from the rtsock_fd. See the CI test failure[0] for more details. [0] https://ci.freebsd.org/job/FreeBSD-main-riscv64-test/16628/testReport/sys.net.routing/test_rtsock_l3/rtm_add_v6_temporal1_success/ Reviewed by: pouria Fixes: e02d3fe70c7247027c85d60179c331618554ba34 MFC after: 3 days Sponsored by: The FreeBSD Foundation (cherry picked from commit 9e2d8ec2df414a8019d9c31a9a09a5cc728b4c19) --- tests/sys/net/routing/test_rtsock_l3.c | 46 +++++++++++++++++++++++++--------- 1 file changed, 34 insertions(+), 12 deletions(-) diff --git a/tests/sys/net/routing/test_rtsock_l3.c b/tests/sys/net/routing/test_rtsock_l3.c index cdfc63d604bf..acd0828c4f38 100644 --- a/tests/sys/net/routing/test_rtsock_l3.c +++ b/tests/sys/net/routing/test_rtsock_l3.c @@ -973,6 +973,9 @@ ATF_TC_HEAD(rtm_add_v4_temporal1_success, tc) ATF_TC_BODY(rtm_add_v4_temporal1_success, tc) { DECLARE_TEST_VARS; + char buffer2[2048]; + struct rt_msghdr *rtm2 = (struct rt_msghdr *)buffer2; + int seq; c = presetup_ipv4(tc); @@ -984,6 +987,7 @@ ATF_TC_BODY(rtm_add_v4_temporal1_success, tc) prepare_route_message(rtm, RTM_ADD, (struct sockaddr *)&net4, (struct sockaddr *)&mask4, (struct sockaddr *)&gw4); + seq = rtm->rtm_seq; /* Set expire time to now */ struct timeval tv; @@ -992,17 +996,24 @@ ATF_TC_BODY(rtm_add_v4_temporal1_success, tc) rtm->rtm_inits |= RTV_EXPIRE; rtsock_send_rtm(c->rtsock_fd, rtm); - rtm = rtsock_read_rtm_reply(c->rtsock_fd, buffer, sizeof(buffer), rtm->rtm_seq); + + rtsock_read_rtm(c->rtsock_fd, buffer, sizeof(buffer)); ATF_REQUIRE_MSG(rtm != NULL, "unable to get rtsock reply for RTM_ADD"); - RTSOCK_ATF_REQUIRE_MSG(rtm, rtm->rtm_inits & RTV_EXPIRE, "RTV_EXPIRE not set"); + if (rtm->rtm_type == RTM_DELETE) { + /* The messages arrived swapped, so swap them back when verifying. */ + rtm = (struct rt_msghdr *)buffer2; + rtm2 = (struct rt_msghdr *)buffer; + } + rtsock_read_rtm(c->rtsock_fd, buffer2, sizeof(buffer2)); - /* The next should be route deletion */ - rtm = rtsock_read_rtm(c->rtsock_fd, buffer, sizeof(buffer)); + RTSOCK_ATF_REQUIRE_MSG(rtm, rtm->rtm_pid == getpid() && rtm->rtm_seq == seq, + "Unmatched rtsock reply for RTM_ADD"); + RTSOCK_ATF_REQUIRE_MSG(rtm, rtm->rtm_inits & RTV_EXPIRE, "RTV_EXPIRE not set"); - verify_route_message(rtm, RTM_DELETE, (struct sockaddr *)&net4, + verify_route_message(rtm2, RTM_DELETE, (struct sockaddr *)&net4, (struct sockaddr *)&mask4, (struct sockaddr *)&gw4); - verify_route_message_extra(rtm, c->ifindex, + verify_route_message_extra(rtm2, c->ifindex, RTF_DONE | RTF_GATEWAY | RTF_STATIC); } @@ -1020,6 +1031,9 @@ ATF_TC_HEAD(rtm_add_v6_temporal1_success, tc) ATF_TC_BODY(rtm_add_v6_temporal1_success, tc) { DECLARE_TEST_VARS; + char buffer2[2048]; + struct rt_msghdr *rtm2 = (struct rt_msghdr *)buffer2; + int seq; c = presetup_ipv6(tc); @@ -1031,6 +1045,7 @@ ATF_TC_BODY(rtm_add_v6_temporal1_success, tc) prepare_route_message(rtm, RTM_ADD, (struct sockaddr *)&net6, (struct sockaddr *)&mask6, (struct sockaddr *)&gw6); + seq = rtm->rtm_seq; /* Set expire time to now */ struct timeval tv; @@ -1039,17 +1054,24 @@ ATF_TC_BODY(rtm_add_v6_temporal1_success, tc) rtm->rtm_inits |= RTV_EXPIRE; rtsock_send_rtm(c->rtsock_fd, rtm); - rtm = rtsock_read_rtm_reply(c->rtsock_fd, buffer, sizeof(buffer), rtm->rtm_seq); + + rtsock_read_rtm(c->rtsock_fd, buffer, sizeof(buffer)); ATF_REQUIRE_MSG(rtm != NULL, "unable to get rtsock reply for RTM_ADD"); - RTSOCK_ATF_REQUIRE_MSG(rtm, rtm->rtm_inits & RTV_EXPIRE, "RTV_EXPIRE not set"); + if (rtm->rtm_type == RTM_DELETE) { + /* The messages arrived swapped, so swap them back when verifying. */ + rtm = (struct rt_msghdr *)buffer2; + rtm2 = (struct rt_msghdr *)buffer; + } + rtsock_read_rtm(c->rtsock_fd, buffer2, sizeof(buffer2)); - /* The next should be route deletion */ - rtm = rtsock_read_rtm(c->rtsock_fd, buffer, sizeof(buffer)); + RTSOCK_ATF_REQUIRE_MSG(rtm, rtm->rtm_pid == getpid() && rtm->rtm_seq == seq, + "Unmatched rtsock reply for RTM_ADD"); + RTSOCK_ATF_REQUIRE_MSG(rtm, rtm->rtm_inits & RTV_EXPIRE, "RTV_EXPIRE not set"); - verify_route_message(rtm, RTM_DELETE, (struct sockaddr *)&net6, + verify_route_message(rtm2, RTM_DELETE, (struct sockaddr *)&net6, (struct sockaddr *)&mask6, (struct sockaddr *)&gw6); - verify_route_message_extra(rtm, c->ifindex, + verify_route_message_extra(rtm2, c->ifindex, RTF_DONE | RTF_GATEWAY | RTF_STATIC); } From nobody Tue Jun 30 13:52:23 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqPj55X96z6kDdq for ; Tue, 30 Jun 2026 13:52:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqPj36LCbz3MTv for ; Tue, 30 Jun 2026 13:52:23 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782827543; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XoHRQsunp+yq1XrUIu0X0LGe5MaZhRpnNOVQFAUyqns=; b=FCWHIrvDZKzUwO0KY7Ygs2QWYB3ejbhDHMAvgxcham7CR5fJtjjydvcLnx13Hv8Vuthq9h BY0acuKP9EmX90Mug38JWdID/ulo8z52OGiLfh4lSgtH+J9wbKRDTbN9W9TD/QF/8mu5CP b7jO4MevnXXzWKXg+odCtcU4td+eB0vU/YfL0lKsvwBmYHuGNQth8Yk8rifuTLK65Po6o7 /NbJV6E25hBJYRiesqcX7a3ACVsS31yhe00WmOlv/zmpqsP+EJjr4vpM3SGUVhhOb6b4Je hvTksDVwZVD62la0eRV41LkkNzgONb7lSb9xmvnala7lYw0SjA0umjwXN/Q+fg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782827543; a=rsa-sha256; cv=none; b=UioYTxjQ1trG490unywFw4mopvpxNLyabTBPaIbTqvJTNnMdo9rIv0sYh7WP3kx6RiPUkr Dcubjfk4PNucWKPbctOItWeBsDp1hO1pwKJOq1YRITMoxfT138nOvmD3f+ua9dLReQ1j0A BtnZqpEY+xkT2gPXsjRMSyYTJrlt7UNuLVwPJG2tVid6NGnYljOBUrI+UdhUty4uMpSRS/ viKJvR8Qzyh5T3RYf/aioVHGvrxrlDQKqjoj3qaK8VdWn4RzRyEejoWJTlrw8LKts7o2BL OrFauS2U5CWwYR6MzC7o7k6RmzJ549Tyi7SjsgJaF+I/7Yj4p3hEEyRdSpQiXw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782827543; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XoHRQsunp+yq1XrUIu0X0LGe5MaZhRpnNOVQFAUyqns=; b=rX/TyayI8cgUhPLxj7pl4SYR79pMMs4oMr853DI0DuOj8G0skqTFcdKv1jxSNpw524pjlu NnmBwe4xAUQQdCq5gAipZvCW+7xt38LKi0LH+H23kgjkbSplEc0/vNIYTpt99fHhJeVHg9 jhpNmAZ6JOQaj+a2KFbTldSXMo3CuWTNKrdMoFSvS7KFPBfwoFeTjPFWmyJpuYx0PalO6t 4brztFDf7f5ZY+GRT2jELw4GEC3Fli7VBvT+GjMkeku7TZQX1EPcaos6veFp8k3r49kiE2 q4CKRB5jXcCFAi3Ik770pLFEJ+3JaatD8L34gEL6KHtOuWU9FyTodJslgWnd/Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqPj35PR8zmpP for ; Tue, 30 Jun 2026 13:52:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 26e54 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 13:52:23 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Siva Mahadevan Subject: git: e37b51957a16 - stable/14 - tests/test_rtsock_l3: fix flaky temporal route addition tests List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: siva X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: e37b51957a169fbe600badd42a6e7a08e6e62d61 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 13:52:23 +0000 Message-Id: <6a43ca17.26e54.5f9c1237@gitrepo.freebsd.org> The branch stable/14 has been updated by siva: URL: https://cgit.FreeBSD.org/src/commit/?id=e37b51957a169fbe600badd42a6e7a08e6e62d61 commit e37b51957a169fbe600badd42a6e7a08e6e62d61 Author: Siva Mahadevan AuthorDate: 2026-06-18 15:33:00 +0000 Commit: Siva Mahadevan CommitDate: 2026-06-30 13:20:33 +0000 tests/test_rtsock_l3: fix flaky temporal route addition tests If RTM_DELETE arrives before RTM_ADD, the test will skip the first reply and then timeout after attempting to read another message from the rtsock_fd. See the CI test failure[0] for more details. [0] https://ci.freebsd.org/job/FreeBSD-main-riscv64-test/16628/testReport/sys.net.routing/test_rtsock_l3/rtm_add_v6_temporal1_success/ Reviewed by: pouria Fixes: e02d3fe70c7247027c85d60179c331618554ba34 MFC after: 3 days Sponsored by: The FreeBSD Foundation (cherry picked from commit 9e2d8ec2df414a8019d9c31a9a09a5cc728b4c19) --- tests/sys/net/routing/test_rtsock_l3.c | 46 +++++++++++++++++++++++++--------- 1 file changed, 34 insertions(+), 12 deletions(-) diff --git a/tests/sys/net/routing/test_rtsock_l3.c b/tests/sys/net/routing/test_rtsock_l3.c index cdfc63d604bf..acd0828c4f38 100644 --- a/tests/sys/net/routing/test_rtsock_l3.c +++ b/tests/sys/net/routing/test_rtsock_l3.c @@ -973,6 +973,9 @@ ATF_TC_HEAD(rtm_add_v4_temporal1_success, tc) ATF_TC_BODY(rtm_add_v4_temporal1_success, tc) { DECLARE_TEST_VARS; + char buffer2[2048]; + struct rt_msghdr *rtm2 = (struct rt_msghdr *)buffer2; + int seq; c = presetup_ipv4(tc); @@ -984,6 +987,7 @@ ATF_TC_BODY(rtm_add_v4_temporal1_success, tc) prepare_route_message(rtm, RTM_ADD, (struct sockaddr *)&net4, (struct sockaddr *)&mask4, (struct sockaddr *)&gw4); + seq = rtm->rtm_seq; /* Set expire time to now */ struct timeval tv; @@ -992,17 +996,24 @@ ATF_TC_BODY(rtm_add_v4_temporal1_success, tc) rtm->rtm_inits |= RTV_EXPIRE; rtsock_send_rtm(c->rtsock_fd, rtm); - rtm = rtsock_read_rtm_reply(c->rtsock_fd, buffer, sizeof(buffer), rtm->rtm_seq); + + rtsock_read_rtm(c->rtsock_fd, buffer, sizeof(buffer)); ATF_REQUIRE_MSG(rtm != NULL, "unable to get rtsock reply for RTM_ADD"); - RTSOCK_ATF_REQUIRE_MSG(rtm, rtm->rtm_inits & RTV_EXPIRE, "RTV_EXPIRE not set"); + if (rtm->rtm_type == RTM_DELETE) { + /* The messages arrived swapped, so swap them back when verifying. */ + rtm = (struct rt_msghdr *)buffer2; + rtm2 = (struct rt_msghdr *)buffer; + } + rtsock_read_rtm(c->rtsock_fd, buffer2, sizeof(buffer2)); - /* The next should be route deletion */ - rtm = rtsock_read_rtm(c->rtsock_fd, buffer, sizeof(buffer)); + RTSOCK_ATF_REQUIRE_MSG(rtm, rtm->rtm_pid == getpid() && rtm->rtm_seq == seq, + "Unmatched rtsock reply for RTM_ADD"); + RTSOCK_ATF_REQUIRE_MSG(rtm, rtm->rtm_inits & RTV_EXPIRE, "RTV_EXPIRE not set"); - verify_route_message(rtm, RTM_DELETE, (struct sockaddr *)&net4, + verify_route_message(rtm2, RTM_DELETE, (struct sockaddr *)&net4, (struct sockaddr *)&mask4, (struct sockaddr *)&gw4); - verify_route_message_extra(rtm, c->ifindex, + verify_route_message_extra(rtm2, c->ifindex, RTF_DONE | RTF_GATEWAY | RTF_STATIC); } @@ -1020,6 +1031,9 @@ ATF_TC_HEAD(rtm_add_v6_temporal1_success, tc) ATF_TC_BODY(rtm_add_v6_temporal1_success, tc) { DECLARE_TEST_VARS; + char buffer2[2048]; + struct rt_msghdr *rtm2 = (struct rt_msghdr *)buffer2; + int seq; c = presetup_ipv6(tc); @@ -1031,6 +1045,7 @@ ATF_TC_BODY(rtm_add_v6_temporal1_success, tc) prepare_route_message(rtm, RTM_ADD, (struct sockaddr *)&net6, (struct sockaddr *)&mask6, (struct sockaddr *)&gw6); + seq = rtm->rtm_seq; /* Set expire time to now */ struct timeval tv; @@ -1039,17 +1054,24 @@ ATF_TC_BODY(rtm_add_v6_temporal1_success, tc) rtm->rtm_inits |= RTV_EXPIRE; rtsock_send_rtm(c->rtsock_fd, rtm); - rtm = rtsock_read_rtm_reply(c->rtsock_fd, buffer, sizeof(buffer), rtm->rtm_seq); + + rtsock_read_rtm(c->rtsock_fd, buffer, sizeof(buffer)); ATF_REQUIRE_MSG(rtm != NULL, "unable to get rtsock reply for RTM_ADD"); - RTSOCK_ATF_REQUIRE_MSG(rtm, rtm->rtm_inits & RTV_EXPIRE, "RTV_EXPIRE not set"); + if (rtm->rtm_type == RTM_DELETE) { + /* The messages arrived swapped, so swap them back when verifying. */ + rtm = (struct rt_msghdr *)buffer2; + rtm2 = (struct rt_msghdr *)buffer; + } + rtsock_read_rtm(c->rtsock_fd, buffer2, sizeof(buffer2)); - /* The next should be route deletion */ - rtm = rtsock_read_rtm(c->rtsock_fd, buffer, sizeof(buffer)); + RTSOCK_ATF_REQUIRE_MSG(rtm, rtm->rtm_pid == getpid() && rtm->rtm_seq == seq, + "Unmatched rtsock reply for RTM_ADD"); + RTSOCK_ATF_REQUIRE_MSG(rtm, rtm->rtm_inits & RTV_EXPIRE, "RTV_EXPIRE not set"); - verify_route_message(rtm, RTM_DELETE, (struct sockaddr *)&net6, + verify_route_message(rtm2, RTM_DELETE, (struct sockaddr *)&net6, (struct sockaddr *)&mask6, (struct sockaddr *)&gw6); - verify_route_message_extra(rtm, c->ifindex, + verify_route_message_extra(rtm2, c->ifindex, RTF_DONE | RTF_GATEWAY | RTF_STATIC); } From nobody Tue Jun 30 15:35:44 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqS0Q1mB1z6jNJv for ; Tue, 30 Jun 2026 15:35:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqS0Q0zTmz3ZRN for ; Tue, 30 Jun 2026 15:35:50 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782833750; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9Ko9pZmU4Omm4hLbIoWMEL69BxbArGSgTM6duus7jVw=; b=UOnvQ+0MCXKEXasw9ctiADjWLLcjn27ej/5u1wpFBlC7AvMbIgKyj3iSGxQZ+noO9enHc4 EtXL/cEnyvBEEiU0FGYwnIOUraokfA6lbtGUzH/kjw4yf/woxeyhKg7nqqe/EPI36RhZXz sFV2ZqzncIS1Av6IU9Gd9U3yxvXUIGLZbQtSG8550pXjQuO2/2urdwGxOSSldXz7cX8+Jl nIUlXivdsXGIYrZy3MENFcb9X9vLv7YdZBDUfsZDO6hkrGpuD+fochynroVtT3wUSc80g9 QbpFFt7USnjYg7iDGB2lJdzXLirQzK5n8XN9HPaO/WI8qiICE2LSuG5jta9Mvg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782833750; a=rsa-sha256; cv=none; b=xj4ajGxoeXCxO0B2aRKRjHmEJDAX4OAlZ+miXcnT6BGM8ZRiWW4w3+gNEDcImc0c49DPaU FhQrk5NbIsHbm+kHQNbAIOJ99xkUK9TkQP0TznnqqNSdf8wrL/zYClobcvfaawMYAIIAVL vOInxnpcjhbSSDmR0tBoYJaThkcq0cJMY7KYveqEHt/4RfHD9lSg3Gdpkc6UqunxjGQOnD qAw9nGQ3lvtaXiJUW/IeWJXrDSKuF1/E7ofIY+ltNOMBGRKa4NpjZ9/DP3c6E0tWNu1DHT DJ94PX3q0pZJPNH5CiSCULtWRxjBKkTE5GucM4EyjlxckXIHEYPPTqt4Nb30ig== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782833750; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9Ko9pZmU4Omm4hLbIoWMEL69BxbArGSgTM6duus7jVw=; b=r6lYJ+CmFLrhgQjYQL0emqsJRqnAdYnPMFKbRFzNXkOlg8ie7lY8BJwySmiPpL+oDJoqjg oznZ2WbrojmjKD7QsmBCYbqbWxxLlZoWpzj5WwrJVLvAAkJtvj0Lpu8TpikkarfgzGfMY9 BriiW7rFqHUYmfm2eFu08PKXEX/MR+riCHxYb5xIbGWREIHx66wAIt3lJR3IbLJGgM6XaK iEygirxZTujVGLIGMuQBS6dvPEkKS0J4KziRiYDxzPWQfHz16dI+sNEmkTkBX+4VddfDzR cnNTJx82O/dkyQAK6V28rtr9HpBB2PxTA7SJRJCwTqnWXhyqVTIoX3Pc4Siryg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqS0P6gR8zqDk for ; Tue, 30 Jun 2026 15:35:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3af9e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 15:35:44 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Kit Dallege From: Warner Losh Subject: git: 6ed2f5184251 - stable/15 - diskless(8): remove references to deleted clone_root script List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: imp X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 6ed2f5184251bc021976cf5b25696716cf09cf5c Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 15:35:44 +0000 Message-Id: <6a43e250.3af9e.3589b106@gitrepo.freebsd.org> The branch stable/15 has been updated by imp: URL: https://cgit.FreeBSD.org/src/commit/?id=6ed2f5184251bc021976cf5b25696716cf09cf5c commit 6ed2f5184251bc021976cf5b25696716cf09cf5c Author: Kit Dallege AuthorDate: 2026-03-27 04:25:41 +0000 Commit: Warner Losh CommitDate: 2026-06-30 15:35:04 +0000 diskless(8): remove references to deleted clone_root script The clone_root script was removed from the tree in commit 7736786b08e8 but the diskless(8) man page still referenced it in two places. Remove both references. PR: 292231 Signed-off-by: Kit Dallege Reviewed by: imp Pull Request: https://github.com/freebsd/freebsd-src/pull/2101 (cherry picked from commit f8c8875add6946b09ea8cf1f7bbdbd90fe5b1f17) --- share/man/man8/diskless.8 | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/share/man/man8/diskless.8 b/share/man/man8/diskless.8 index cc49854ae850..603209dec7dc 100644 --- a/share/man/man8/diskless.8 +++ b/share/man/man8/diskless.8 @@ -27,7 +27,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd August 11, 2024 +.Dd June 9, 2026 .Dt DISKLESS 8 .Os .Sh NAME @@ -179,10 +179,7 @@ can contain the following lines: where .Aq ROOT is the mount point on the server of the root partition. -The script -.Pa /usr/share/examples/diskless/clone_root -can be used to create a shared read-only root partition, -but in many cases you may decide to export +In many cases you may decide to export (again as read-only) the root directory used by the server itself. .It @@ -219,10 +216,6 @@ and have the obvious meanings. .It A properly initialized root partition. -The script -.Pa /usr/share/examples/diskless/clone_root -can help in creating it, using the server's root partition -as a reference. If you are just starting out, you should simply use the server's own root directory, .Pa / , From nobody Tue Jun 30 17:19:47 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJM5V9Dz6jXZn for ; Tue, 30 Jun 2026 17:19:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJM2h0Fz3pYs for ; Tue, 30 Jun 2026 17:19:47 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839987; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wEyXTmIZp3k7sbv7usdbp1ZV/S4Ql0DJvqFV23i7FEY=; b=tZFHT/zMvvJqT+nRR9B0HuGbmctujfJ+gInU/iaPgbwnZeU4bfMTIhOwX304AnfKMw9Hy1 ncB97AOUH++85oazu2n2A4I2qXjKZlbJf0cdBEBtgQtcfsmVSLIYu76lCXDYroun71TV3Y Rnd3CjQS+F3FA/bD8EymAZoDWeiXBFJQDP7rNRn5E2H1joXV4ZkHzZBysgThZ+/+0G/DeI FuAXR2CgHEhjBPHMZxj5+b2L4rx+CJjC9ze+YpAWxyOoHPWLLl0KsFIp1Qd69bkPFG9c2e 9TINRDXBHTGG6t4+yXoxuAiJC3eeMcChkeZ0yg65CKFEMhKxOYbq7vfTn78v0Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839987; a=rsa-sha256; cv=none; b=s2XSgA676g9K2ULBkzGyk+UleoFZ890n0H2qtfML+Limb0d3H9QfdbJIv9o8BnLHT+Ga15 n4/XqREowmURULVG/+W4PzVDPmNpr4synyg36xLwv9/20BZyymGGXFT2Z+hlDle6SqBgwS LRfOeVsQiLqRXzvTp2h10fN026GrYzOj55c/7sVCfYPzl91C3RFKkwXRPwaeeUe6zknCjB 3jnPPR78B7fwll8AN/an0HQS+dBDu0eE3EzieK6NF5DNiv7sv90SKHD4jdVovSS8HsM1IB zuxFw3uAekNBD4ebtYWsvhjtw7KxGHtXFK5NEa8kBVHi1zzHdjasG3Z31GYSxg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839987; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wEyXTmIZp3k7sbv7usdbp1ZV/S4Ql0DJvqFV23i7FEY=; b=gUmIz9FcbZK8OhWsAJtBri8u46gFeJVF1VgRIfMP08fkuOQlJUr/IFDxNICinLqyM7oQFo xWFz4V5EHCHh97i1hiCSW9MTtV6n8TJnnk0RDjcq/kEGksupifieenKtIKY2S97mvodHzf bDHDHJn7/gMSpSjHNUgnTLT1R7we4r6mOxbBejaSO2eXF/nGWf8UCLNqAJbAJd5kBVXWee Nt+vFQIez+o37A6+mjcbWYSxSNoKpWF2aIEFCAH9RVQ/ae6EGDoFOCV6CUIOrQelYvHwUF 8G73BPEe+RzOa2hYqdYHw7Shk7yWDCRELTnpmPzvOr3QB7HHzofA1imuIocLuA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJM0yL2ztV0 for ; Tue, 30 Jun 2026 17:19:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45580 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:47 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 715831359fa7 - stable/14 - device_pager: Avoid double-insertion of pages into the pager list List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 715831359fa7ac19df7b0e6445a648f8860e084e Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:47 +0000 Message-Id: <6a43fab3.45580.7fe0937c@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=715831359fa7ac19df7b0e6445a648f8860e084e commit 715831359fa7ac19df7b0e6445a648f8860e084e Author: Mark Johnston AuthorDate: 2026-06-22 14:40:22 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:21 +0000 device_pager: Avoid double-insertion of pages into the pager list Unmanaged device pager objects maintain a linked list of pages that were returned from the fault handler. Initially, such pages are valid, but msync(MS_INVALIDATE) can mark them invalid (and clean). They are not removed from page tables (since they are unmanaged), but a subsequent mlock() call can trigger a page fault that is handled by the pager. dev_pager_getpages() then re-inserts the page into the linked list even though it's already present there. This patch fixes the problem by removing the linked list. OBJ_PG_DTOR is set, so vm_object_terminate_pages() does nothing, and dev_pager_dealloc() instead handles cleanup of the object. Add a regression test case which triggers a queue.h assertion failure in unpatched kernels. Note, in stable branches we should avoid changing the layout of struct vm_object. Approved by: so Security: FreeBSD-SA-26:37.vm Security: CVE-2026-49418 Reported by: slidybat Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57743 --- sys/vm/device_pager.c | 34 +++++++++++++++++----------------- sys/vm/vm_object.h | 2 +- sys/vm/vm_page.c | 6 ++++-- tests/sys/vm/mmap_test.c | 30 ++++++++++++++++++++++++++++++ 4 files changed, 52 insertions(+), 20 deletions(-) diff --git a/sys/vm/device_pager.c b/sys/vm/device_pager.c index bceff38a41c3..b32d18fc3354 100644 --- a/sys/vm/device_pager.c +++ b/sys/vm/device_pager.c @@ -210,7 +210,8 @@ again: object1 = NULL; object->handle = handle; object->un_pager.devp.ops = ops; - TAILQ_INIT(&object->un_pager.devp.devp_pglist); + if (object->type == OBJT_DEVICE) + vm_object_set_flag(object, OBJ_PG_DTOR); TAILQ_INSERT_TAIL(&dev_pager_object_list, object, pager_object_list); mtx_unlock(&dev_pager_mtx); @@ -282,15 +283,12 @@ dev_pager_free_page(vm_object_t object, vm_page_t m) KASSERT((object->type == OBJT_DEVICE && (m->oflags & VPO_UNMANAGED) != 0), ("Managed device or page obj %p m %p", object, m)); - TAILQ_REMOVE(&object->un_pager.devp.devp_pglist, m, plinks.q); vm_page_putfake(m); } static void dev_pager_dealloc(vm_object_t object) { - vm_page_t m; - VM_OBJECT_WUNLOCK(object); object->un_pager.devp.ops->cdev_pg_dtor(object->un_pager.devp.handle); @@ -300,15 +298,21 @@ dev_pager_dealloc(vm_object_t object) VM_OBJECT_WLOCK(object); if (object->type == OBJT_DEVICE) { - /* - * Free up our fake pages. - */ - while ((m = TAILQ_FIRST(&object->un_pager.devp.devp_pglist)) - != NULL) { - if (vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL) == 0) - continue; - - dev_pager_free_page(object, m); + vm_page_t m, mtmp; + +restart: + TAILQ_FOREACH_SAFE(m, &object->memq, listq, mtmp) { + if (!vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL)) + goto restart; + if (vm_page_remove(m)) { + /* + * We could end up with invalid pages installed + * by the generic page fault handler. Typically + * these are replaced by the device pager. + */ + vm_page_free(m); + } else if ((m->flags & PG_FICTITIOUS) != 0) + dev_pager_free_page(object, m); } } object->handle = NULL; @@ -337,10 +341,6 @@ dev_pager_getpages(vm_object_t object, vm_page_t *ma, int count, int *rbehind, (object->type == OBJT_MGTDEVICE && (ma[0]->oflags & VPO_UNMANAGED) == 0), ("Wrong page type %p %p", ma[0], object)); - if (object->type == OBJT_DEVICE) { - TAILQ_INSERT_TAIL(&object->un_pager.devp.devp_pglist, - ma[0], plinks.q); - } if (rbehind) *rbehind = 0; if (rahead) diff --git a/sys/vm/vm_object.h b/sys/vm/vm_object.h index 9a3bba4ef396..75a44fb66be4 100644 --- a/sys/vm/vm_object.h +++ b/sys/vm/vm_object.h @@ -137,7 +137,7 @@ struct vm_object { * devp_pglist - list of allocated pages */ struct { - TAILQ_HEAD(, vm_page) devp_pglist; + void *spare[2]; const struct cdev_pager_ops *ops; void *handle; } devp; diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c index b23c44ae083d..178b104ab95f 100644 --- a/sys/vm/vm_page.c +++ b/sys/vm/vm_page.c @@ -1301,8 +1301,10 @@ vm_page_putfake(vm_page_t m) KASSERT((m->oflags & VPO_UNMANAGED) != 0, ("managed %p", m)); KASSERT((m->flags & PG_FICTITIOUS) != 0, ("vm_page_putfake: bad page %p", m)); - vm_page_assert_xbusied(m); - vm_page_busy_free(m); + if (m->object != NULL) { + vm_page_assert_xbusied(m); + vm_page_busy_free(m); + } uma_zfree(fakepg_zone, m); } diff --git a/tests/sys/vm/mmap_test.c b/tests/sys/vm/mmap_test.c index 6bc30f73ca95..a94fb56c46cf 100644 --- a/tests/sys/vm/mmap_test.c +++ b/tests/sys/vm/mmap_test.c @@ -362,6 +362,35 @@ ATF_TC_BODY(mmap__maxprot_shm, tc) ATF_REQUIRE(close(fd) == 0); } +/* A regression test for a bug in the device pager. */ +ATF_TC_WITHOUT_HEAD(mmap__device_reinsert); +ATF_TC_BODY(mmap__device_reinsert, tc) +{ + void *p; + int fd; + + fd = open("/dev/devstat", O_RDONLY); + ATF_REQUIRE(fd >= 0); + + p = mmap(NULL, getpagesize(), PROT_READ, MAP_SHARED, fd, 0); + ATF_REQUIRE(p != MAP_FAILED); + + /* + * Use mlock() to trigger a fault, since msync() will not actually + * remove the page from the process page tables. + */ + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + ATF_REQUIRE(msync(p, getpagesize(), MS_INVALIDATE) == 0); + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + ATF_REQUIRE(msync(p, getpagesize(), MS_INVALIDATE) == 0); + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + + ATF_REQUIRE(munmap(p, getpagesize()) == 0); +} + ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TC(tp, mmap__map_at_zero); @@ -371,6 +400,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, mmap__write_only); ATF_TP_ADD_TC(tp, mmap__maxprot_basic); ATF_TP_ADD_TC(tp, mmap__maxprot_shm); + ATF_TP_ADD_TC(tp, mmap__device_reinsert); return (atf_no_error()); } From nobody Tue Jun 30 17:19:48 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJN5nh7z6jXdZ for ; Tue, 30 Jun 2026 17:19:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJN37qYz3pWc for ; Tue, 30 Jun 2026 17:19:48 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839988; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XdarcVz2dHMXBIUmd5L5vZvzEXnxBG+ICrYmgAYSGBQ=; b=r1Mh8L9x7x2fWIFfJmPwMNet2XUyT16eETnZBf/u9OUGY7g8RuiYoDNEv1KD53Kn0MxyK2 Kg9AKuPvPx0V692xQWXDKVSRhb9qo6DzlpOOi5PjKVbpLw9B/5sV/FiGWN0Z8+lT7bRnpv XMSWIqASWPSxCWIPCBwDNus6CBG4siz6BU5BstY7kp6117Z1X8JJBOVb5QCXNkYRxkF85g xTKhL2Frz4oBmbRNYwsJFN554us7aBdl7TBcubgPNCvzZCVx2OA9GrrMTqhmK3w5B5gszK bOMCeDYuL2yseTl7cHjMoYbDpEtZH/FuMx+TW+T0bsB3Ot03vHh/59Y4lOPYzQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839988; a=rsa-sha256; cv=none; b=X90NTjy6rnwxiTcaMbIWhfcs1PHQ4+jRmozEjd4MYw8nJwx8RE2o8W+/aFuoFGTwYWzJzf TRZKjncnvRK65+C6CGlYS1CwEQqG1GpdKx+woUelDpkIDBVtf9dlv5n3geariokN7rQ4S+ r06SviuMlz4CyLhlBC/lCeoCVJ8x+tdR2AM2VAWkV4BkgV6rmqeLI0jYlghCAgv1joUTy4 TnAaCOOc/n1rvVOa0gT0QyHxKiGQvCE9euPllO4nkhO8Qmu9QOLaBZCudy+ir+4haUuTlO 4NpjOCYPgjBPmRxJCNSX2vL0xwxGbRX6hL3gmlMFOzphqJVLCgyDWzihTuP9UQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839988; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XdarcVz2dHMXBIUmd5L5vZvzEXnxBG+ICrYmgAYSGBQ=; b=GzjQuBGc9cNRCDRixbEdEBOTgTwS2kuxcHpjSQ3RslS+KweXZdiWkd0pInY1uFNir0t0JF r/3BLaSNcLP7unIQkD1eXSJn7CKedeOc9YijRcmWCINOPk7/3OkfTem3n618akAccboRCd 6Mv2JPFNSzgL0vRRaXeNaTnHXDysNfqPFLr/DCjHIKxg4PpFjoBQEjkrcAz87fjGHuCaZy g9ZLKM3g68fURrKcgvoZvZf/EuA3KzQbdpIEyWkGPfEMT/hHm91Nqbv5OkgCOET2LZ0AuJ 20IVhdfdVIfBTZ+9KCkIfa/mNHRTzqE7CCO1eo6elc6lXXO7Wg8caKxpCCyCXA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJN1qLjztRS for ; Tue, 30 Jun 2026 17:19:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44692 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:48 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 6419ed0df139 - stable/14 - zfs: Roll up several upstream commits List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 6419ed0df1393433c201d1bc946ee90f46f74e84 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:48 +0000 Message-Id: <6a43fab4.44692.5a778594@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=6419ed0df1393433c201d1bc946ee90f46f74e84 commit 6419ed0df1393433c201d1bc946ee90f46f74e84 Author: Mark Johnston AuthorDate: 2026-06-28 22:00:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:21 +0000 zfs: Roll up several upstream commits This commit squashes the following upstream commits: #18604 63a0ff6cd nvpair: Check for un-terminated strings in packed nvlist #18617 38cd6adcb Extend dataset zfs_ioc_set_prop() secpolicy #18615 738791027 Fix the integer type in zfs_ioc_userspace_many() #18623 06d8cfedb Add additional verification of size fields and strings Approved by: so Security: FreeBSD-SA-26:40.zfs Security: CVE-2026-49429 Security: CVE-2026-49430 Security: CVE-2026-49431 --- sys/contrib/openzfs/module/nvpair/nvpair.c | 49 ++++-- sys/contrib/openzfs/module/zfs/dmu_recv.c | 44 ++++-- sys/contrib/openzfs/module/zfs/vdev_label.c | 1 + sys/contrib/openzfs/module/zfs/zfs_ioctl.c | 34 +++- sys/contrib/openzfs/module/zfs/zfs_quota.c | 8 +- .../tests/zfs-tests/cmd/libzfs_input_check.c | 172 ++++++++++++++++++++- 6 files changed, 272 insertions(+), 36 deletions(-) diff --git a/sys/contrib/openzfs/module/nvpair/nvpair.c b/sys/contrib/openzfs/module/nvpair/nvpair.c index 887f7d32df4a..04141bb58111 100644 --- a/sys/contrib/openzfs/module/nvpair/nvpair.c +++ b/sys/contrib/openzfs/module/nvpair/nvpair.c @@ -134,7 +134,8 @@ #define NVP_SIZE_CALC(name_len, data_len) \ (NV_ALIGN((sizeof (nvpair_t)) + name_len) + NV_ALIGN(data_len)) -static int i_get_value_size(data_type_t type, const void *data, uint_t nelem); +static int i_get_value_size(data_type_t type, const void *data, uint_t nelem, + size_t max_size); static int nvlist_add_common(nvlist_t *nvl, const char *name, data_type_t type, uint_t nelem, const void *data); @@ -809,8 +810,10 @@ i_validate_nvpair(nvpair_t *nvp) * verify nvp_type, nvp_value_elem, and also possibly * verify string values and get the value size. */ - size2 = i_get_value_size(type, NVP_VALUE(nvp), NVP_NELEM(nvp)); size1 = nvp->nvp_size - NVP_VALOFF(nvp); + size2 = i_get_value_size(type, NVP_VALUE(nvp), NVP_NELEM(nvp), + size1); + if (size2 < 0 || size1 != NV_ALIGN(size2)) return (EFAULT); @@ -1001,12 +1004,21 @@ nvlist_remove_nvpair(nvlist_t *nvl, nvpair_t *nvp) * DATA_TYPE_STRING and * DATA_TYPE_STRING_ARRAY * Is data == NULL then the size of the string(s) is excluded. + * + * If 'max_size' is non-zero, then don't look beyond 'max_size' number of + * bytes when calculating a value size. Note that 'max_size' should include + * the NULL terminator byte when calculating string size. If 'max_size' is 0, + * it is ignored. */ static int -i_get_value_size(data_type_t type, const void *data, uint_t nelem) +i_get_value_size(data_type_t type, const void *data, uint_t nelem, + size_t max_size) { uint64_t value_sz; + if (max_size == 0) + max_size = INT32_MAX; + if (i_validate_type_nelem(type, nelem) != 0) return (-1); @@ -1051,10 +1063,15 @@ i_get_value_size(data_type_t type, const void *data, uint_t nelem) break; #endif case DATA_TYPE_STRING: - if (data == NULL) + if (data == NULL) { value_sz = 0; - else - value_sz = strlen(data) + 1; + } else { + value_sz = strnlen(data, max_size); + if (value_sz >= max_size) { + return (-1); /* string not terminated */ + } + value_sz += 1; + } break; case DATA_TYPE_BOOLEAN_ARRAY: value_sz = (uint64_t)nelem * sizeof (boolean_t); @@ -1088,16 +1105,23 @@ i_get_value_size(data_type_t type, const void *data, uint_t nelem) break; case DATA_TYPE_STRING_ARRAY: value_sz = (uint64_t)nelem * sizeof (uint64_t); - if (data != NULL) { char *const *strs = data; uint_t i; + size_t newsize; /* no alignment requirement for strings */ for (i = 0; i < nelem; i++) { if (strs[i] == NULL) return (-1); - value_sz += strlen(strs[i]) + 1; + + newsize = strnlen(strs[i], max_size); + + if (newsize == max_size) + return (-1); /* not terminated */ + + value_sz += newsize + 1; /* +1 for NULL */ + max_size -= newsize + 1; } } break; @@ -1162,7 +1186,7 @@ nvlist_add_common(nvlist_t *nvl, const char *name, * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) included. */ - if ((value_sz = i_get_value_size(type, data, nelem)) < 0) + if ((value_sz = i_get_value_size(type, data, nelem, 0)) < 0) return (EINVAL); if (i_validate_nvpair_value(type, nelem, data) != 0) @@ -1587,7 +1611,7 @@ nvpair_value_common(const nvpair_t *nvp, data_type_t type, uint_t *nelem, #endif if (data == NULL) return (EINVAL); - if ((value_sz = i_get_value_size(type, NULL, 1)) < 0) + if ((value_sz = i_get_value_size(type, NULL, 1, 0)) < 0) return (EINVAL); memcpy(data, NVP_VALUE(nvp), (size_t)value_sz); if (nelem != NULL) @@ -3017,7 +3041,8 @@ nvs_native_nvp_op(nvstream_t *nvs, nvpair_t *nvp) * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) excluded. */ - if ((value_sz = i_get_value_size(type, NULL, NVP_NELEM(nvp))) < 0) + if ((value_sz = i_get_value_size(type, NULL, NVP_NELEM(nvp), + NVP_SIZE(nvp))) < 0) return (EFAULT); if (NVP_SIZE_CALC(nvp->nvp_name_sz, value_sz) > nvp->nvp_size) @@ -3332,7 +3357,7 @@ nvs_xdr_nvp_op(nvstream_t *nvs, nvpair_t *nvp) * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) excluded. */ - if ((value_sz = i_get_value_size(type, NULL, nelem)) < 0) + if ((value_sz = i_get_value_size(type, NULL, nelem, NVP_SIZE(nvp)) < 0)) return (EFAULT); /* if there is no data to extract then return */ diff --git a/sys/contrib/openzfs/module/zfs/dmu_recv.c b/sys/contrib/openzfs/module/zfs/dmu_recv.c index 41b279d48464..cd8a491e81c8 100644 --- a/sys/contrib/openzfs/module/zfs/dmu_recv.c +++ b/sys/contrib/openzfs/module/zfs/dmu_recv.c @@ -2834,16 +2834,20 @@ receive_read_record(dmu_recv_cookie_t *drc) { struct drr_object *drro = &drc->drc_rrd->header.drr_u.drr_object; - uint32_t size = DRR_OBJECT_PAYLOAD_SIZE(drro); + uint32_t size; void *buf = NULL; dmu_object_info_t doi; + size = DRR_OBJECT_PAYLOAD_SIZE(drro); + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + if (size != 0) - buf = kmem_zalloc(size, KM_SLEEP); + buf = vmem_zalloc(size, KM_SLEEP); err = receive_read_payload_and_next_header(drc, size, buf); if (err != 0) { - kmem_free(buf, size); + vmem_free(buf, size); return (err); } err = dmu_object_info(drc->drc_os, drro->drr_object, &doi); @@ -2867,7 +2871,11 @@ receive_read_record(dmu_recv_cookie_t *drc) case DRR_WRITE: { struct drr_write *drrw = &drc->drc_rrd->header.drr_u.drr_write; - int size = DRR_WRITE_PAYLOAD_SIZE(drrw); + uint64_t size = DRR_WRITE_PAYLOAD_SIZE(drrw); + + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + abd_t *abd = abd_alloc_linear(size, B_FALSE); err = receive_read_payload_and_next_header(drc, size, abd_to_buf(abd)); @@ -2884,12 +2892,18 @@ receive_read_record(dmu_recv_cookie_t *drc) { struct drr_write_embedded *drrwe = &drc->drc_rrd->header.drr_u.drr_write_embedded; - uint32_t size = P2ROUNDUP(drrwe->drr_psize, 8); - void *buf = kmem_zalloc(size, KM_SLEEP); + uint32_t size; + void *buf; + + size = P2ROUNDUP(drrwe->drr_psize, 8); + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + + buf = vmem_zalloc(size, KM_SLEEP); err = receive_read_payload_and_next_header(drc, size, buf); if (err != 0) { - kmem_free(buf, size); + vmem_free(buf, size); return (err); } @@ -2918,7 +2932,11 @@ receive_read_record(dmu_recv_cookie_t *drc) case DRR_SPILL: { struct drr_spill *drrs = &drc->drc_rrd->header.drr_u.drr_spill; - int size = DRR_SPILL_PAYLOAD_SIZE(drrs); + uint64_t size = DRR_SPILL_PAYLOAD_SIZE(drrs); + + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + abd_t *abd = abd_alloc_linear(size, B_FALSE); err = receive_read_payload_and_next_header(drc, size, abd_to_buf(abd)); @@ -3069,7 +3087,7 @@ receive_process_record(struct receive_writer_arg *rwa, abd_free(rrd->abd); rrd->abd = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } return (0); @@ -3083,7 +3101,7 @@ receive_process_record(struct receive_writer_arg *rwa, rrd->abd = NULL; rrd->payload = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } @@ -3096,7 +3114,7 @@ receive_process_record(struct receive_writer_arg *rwa, { struct drr_object *drro = &rrd->header.drr_u.drr_object; err = receive_object(rwa, drro, rrd->payload); - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; break; } @@ -3134,7 +3152,7 @@ receive_process_record(struct receive_writer_arg *rwa, struct drr_write_embedded *drrwe = &rrd->header.drr_u.drr_write_embedded; err = receive_write_embedded(rwa, drrwe, rrd->payload); - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; break; } @@ -3203,7 +3221,7 @@ receive_writer_thread(void *arg) rrd->abd = NULL; rrd->payload = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } /* diff --git a/sys/contrib/openzfs/module/zfs/vdev_label.c b/sys/contrib/openzfs/module/zfs/vdev_label.c index a64cd1690684..ee10cc845ce5 100644 --- a/sys/contrib/openzfs/module/zfs/vdev_label.c +++ b/sys/contrib/openzfs/module/zfs/vdev_label.c @@ -1362,6 +1362,7 @@ vdev_label_read_bootenv(vdev_t *rvd, nvlist_t *bootenv) VB_NVLIST); break; } + vbe->vbe_bootenv[sizeof (vbe->vbe_bootenv) - 1] = '\0'; fnvlist_add_string(bootenv, FREEBSD_BOOTONCE, buf); } diff --git a/sys/contrib/openzfs/module/zfs/zfs_ioctl.c b/sys/contrib/openzfs/module/zfs/zfs_ioctl.c index 8f28687bb36b..121968bcdbb4 100644 --- a/sys/contrib/openzfs/module/zfs/zfs_ioctl.c +++ b/sys/contrib/openzfs/module/zfs/zfs_ioctl.c @@ -913,6 +913,23 @@ zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr) ZFS_DELEG_PERM_CREATE, cr)); } +/* + * Policy for dataset set property operations. Individual properties checked by + * zfs_check_settable(), additionally require zfs_secpolicy_recv() when setting + * properties as part of a receive. + */ +static int +zfs_secpolicy_setprops(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr) +{ + boolean_t received = zc->zc_cookie; + int error; + + if (received && (error = zfs_secpolicy_recv(zc, innvl, cr))) + return (error); + + return (zfs_secpolicy_read(zc, innvl, cr)); +} + int zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr) { @@ -3642,7 +3659,6 @@ static int zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl) { (void) unused, (void) outnvl; - const char *message; char *poolname; spa_t *spa; int error; @@ -3663,7 +3679,7 @@ zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl) if (error != 0) return (error); - message = fnvlist_lookup_string(innvl, "message"); + const char *message = fnvlist_lookup_string(innvl, "message"); if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) { spa_close(spa, FTAG); @@ -5994,21 +6010,27 @@ zfs_ioc_userspace_one(zfs_cmd_t *zc) * outputs: * zc_nvlist_dst[_size] data buffer (array of zfs_useracct_t) * zc_cookie zap cursor + * + * The zc_nvlist_dst output array is limited to 1000 entries. */ static int zfs_ioc_userspace_many(zfs_cmd_t *zc) { + const size_t batch_limit = 1000 * sizeof (zfs_useracct_t); + uint64_t bufsize = MIN(zc->zc_nvlist_dst_size, batch_limit); zfsvfs_t *zfsvfs; - int bufsize = zc->zc_nvlist_dst_size; - if (bufsize <= 0) + if (bufsize < sizeof (zfs_useracct_t)) { + zc->zc_nvlist_dst_size = sizeof (zfs_useracct_t); return (SET_ERROR(ENOMEM)); + } int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE); if (error != 0) return (error); void *buf = vmem_alloc(bufsize, KM_SLEEP); + zc->zc_nvlist_dst_size = bufsize; error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie, buf, &zc->zc_nvlist_dst_size); @@ -6499,7 +6521,7 @@ zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl) dsl_pool_t *dp; dsl_dataset_t *new, *old; const char *firstsnap; - uint64_t used, comp, uncomp; + uint64_t used = 0, comp = 0, uncomp = 0; firstsnap = fnvlist_lookup_string(innvl, "firstsnap"); @@ -7374,7 +7396,7 @@ zfs_ioctl_init(void) zfs_ioc_send, zfs_secpolicy_send); zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop, - zfs_secpolicy_none); + zfs_secpolicy_setprops); zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy, zfs_secpolicy_destroy); zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename, diff --git a/sys/contrib/openzfs/module/zfs/zfs_quota.c b/sys/contrib/openzfs/module/zfs/zfs_quota.c index 9b351eefc04e..c5ffd60609b2 100644 --- a/sys/contrib/openzfs/module/zfs/zfs_quota.c +++ b/sys/contrib/openzfs/module/zfs/zfs_quota.c @@ -85,10 +85,14 @@ zpl_get_file_info(dmu_object_type_t bonustype, const void *data, sa.sa_layout_info = BSWAP_16(sa.sa_layout_info); swap = B_TRUE; } - VERIFY3U(sa.sa_magic, ==, SA_MAGIC); + + if (unlikely(sa.sa_magic != SA_MAGIC)) + return (SET_ERROR(EINVAL)); int hdrsize = sa_hdrsize(&sa); - VERIFY3U(hdrsize, >=, sizeof (sa_hdr_phys_t)); + + if (unlikely(hdrsize < sizeof (sa_hdr_phys_t))) + return (SET_ERROR(EINVAL)); uintptr_t data_after_hdr = (uintptr_t)data + hdrsize; zoi->zfi_user = *((uint64_t *)(data_after_hdr + SA_UID_OFFSET)); diff --git a/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c b/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c index 7d9ce4fada1b..4f8977ffa47a 100644 --- a/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c +++ b/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c @@ -84,7 +84,6 @@ static const zfs_ioc_t ioc_skip[] = { ZFS_IOC_DSOBJ_TO_DSNAME, ZFS_IOC_OBJ_TO_PATH, ZFS_IOC_POOL_SET_PROPS, - ZFS_IOC_POOL_GET_PROPS, ZFS_IOC_SET_FSACL, ZFS_IOC_GET_FSACL, ZFS_IOC_SHARE, @@ -124,11 +123,136 @@ static const zfs_ioc_t ioc_skip[] = { lzc_ioctl_test(ioc, name, req, opt, err, wild); \ } while (0) +#define IOC_INPUT_TEST_INJECT(ioc, name, innvl) \ + do { \ + active_test = __func__ + 5; \ + lzc_ioctl_run_impl(ioc, name, innvl, 0, B_TRUE); \ + } while (0) + +/* + * Given a zfs_cmd_t containing an already packed nvlist in zc->zc_nvlist_src, + * and its original innvl, look in innvl for the last string nvpair, or last + * string array nvpair, and remove the string terminator. The idea is to + * corrupt the nvlist string value so that anyone doing a strlen() on it will + * read past the end of the packed nvlist buffer and trigger a crash. + */ +static void +do_bad_string(zfs_cmd_t *zc, nvlist_t *innvl) +{ + nvpair_t *elem = NULL; + nvpair_t *lastseen = NULL; + const char *str = NULL; + const char **arr; + uint_t n; + char *off; + char *packed; + uint64_t size, off_size; + + while ((elem = nvlist_next_nvpair(innvl, elem)) != NULL) { + if ((nvpair_type(elem) == DATA_TYPE_STRING) || + (nvpair_type(elem) == DATA_TYPE_STRING_ARRAY)) + lastseen = elem; + } + + if (lastseen == NULL) + return; /* No strings */ + + /* + * Lookup either the last string, or the last string in the last + * string array in the nvlist. We will use this to corrupt from the + * string to the end of the nvlist buffer. Any attempts to strlen this + * string should run pass the end of the packed buffer. + */ + if (nvpair_value_string(lastseen, &str) != 0) { + if (nvpair_value_string_array(lastseen, &arr, &n) == 0) + str = arr[n-1]; + } + + /* + * We now have the last string. Corrupt everything from the NULL + * terminator byte for the last string to the end of the packed nvlist + * buffer. + */ + packed = (char *)zc->zc_nvlist_src; + size = zc->zc_nvlist_src_size; + + off = memmem(packed, size, str, strlen(str)); + off_size = strlen(str); + + memset(&off[off_size - 1], '!', (packed + size) - + (&off[off_size - 1])); + +} + +/* + * For each byte in the packed nvlist list in zc, corrupt a single byte, then + * try doing the ioctl. This tests how well the kernel handles fuzzed nvlists. + * + * NOTE - make sure you are doing this with a "safe" ioctl! You don't want to + * run this on an ioctl that can potentially corrupt data (like a zpool create). + */ +static void +do_fuzz(int zfs_fd, zfs_ioc_t ioc, zfs_cmd_t *zc) +{ + uint64_t size; + uint64_t i; + unsigned char old = 0; + unsigned char *pos; + zfs_cmd_t orig_zc = *zc; + + pos = (unsigned char *) zc->zc_nvlist_src; + size = zc->zc_nvlist_src_size; + + /* + * Fuzz each byte in the packed nvlist, one byte at a time, and do the + * ioctl. If the kernel doesn't crash, then the test passed. + */ + for (i = 0; i < size; i++) { + /* Restore the previously corrupted byte */ + if (i > 0) + pos[i-1] = old; + + old = pos[i]; + + /* Corrupt the new byte */ + pos[i]++; + + /* + * Do the ioctl and ignore the return code. We just want to + * see if the kernel panics. + */ + lzc_ioctl_fd(zfs_fd, ioc, zc); + + /* + * Restore 'zc' with original fields since the ioctl may + * have modified them. + */ + *zc = orig_zc; + } + /* Restore last byte */ + if (i > 0) + pos[i - 1] = old; + + /* + * Try fuzzing the packed nvlist size field. Test it with one byte + * bigger and one byte smaller than the current value. + */ + zc->zc_nvlist_src_size--; + lzc_ioctl_fd(zfs_fd, ioc, zc); + + zc->zc_nvlist_src_size += 2; + lzc_ioctl_fd(zfs_fd, ioc, zc); + + /* Restore to normal */ + zc->zc_nvlist_src_size -= 1; +} + /* * run a zfs ioctl command, verify expected results and log failures */ static void -lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) +lzc_ioctl_run_impl(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, + int expected, boolean_t do_corrupt) { zfs_cmd_t zc = {"\0"}; char *packed = NULL; @@ -159,10 +283,30 @@ lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) zc.zc_nvlist_dst_size = MAX(size * 2, 128 * 1024); zc.zc_nvlist_dst = (uint64_t)(uintptr_t)malloc(zc.zc_nvlist_dst_size); + if (do_corrupt) { + /* + * Try changing bytes in the packed nvlist to see if it will + * panic the kernel when you do the ioctl. + */ + do_fuzz(zfs_fd, ioc, &zc); + + /* + * Corrupt the last string in the packed nvlist so it has no + * NULL terminator. + */ + do_bad_string(&zc, innvl); + + } + if (lzc_ioctl_fd(zfs_fd, ioc, &zc) != 0) error = errno; - if (error != expected) { + /* + * If we're corrupting the nvlist we don't care about the specific + * error code that gets returned, as it could be one of many. We only + * care if it panics the kernel. + */ + if (!do_corrupt && error != expected) { unexpected_failures = B_TRUE; (void) fprintf(stderr, "%s: Unexpected result with %s, " "error %d (expecting %d)\n", @@ -173,6 +317,12 @@ lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) free((void *)(uintptr_t)zc.zc_nvlist_dst); } +static void +lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) +{ + return (lzc_ioctl_run_impl(ioc, name, innvl, expected, B_FALSE)); +} + /* * Test each ioc for the following ioctl input errors: * ZFS_ERR_IOC_ARG_UNAVAIL an input argument is not supported by kernel @@ -309,6 +459,7 @@ test_log_history(const char *pool) fnvlist_add_string(required, "message", "input check"); IOC_INPUT_TEST(ZFS_IOC_LOG_HISTORY, pool, required, NULL, 0); + IOC_INPUT_TEST_INJECT(ZFS_IOC_LOG_HISTORY, pool, required); nvlist_free(required); } @@ -790,6 +941,20 @@ test_set_bootenv(const char *pool) nvlist_free(required); } +static void +test_zpool_get(const char *pool) +{ + const char *strs[] = {ZPOOL_DEDUPCACHED_PROP_NAME}; + nvlist_t *optional = fnvlist_alloc(); + + fnvlist_add_string_array(optional, ZPOOL_GET_PROPS_NAMES, strs, 1); + + IOC_INPUT_TEST(ZFS_IOC_POOL_GET_PROPS, pool, NULL, optional, 0); + IOC_INPUT_TEST_INJECT(ZFS_IOC_POOL_GET_PROPS, pool, optional); + + nvlist_free(optional); +} + static void zfs_ioc_input_tests(const char *pool) { @@ -884,6 +1049,7 @@ zfs_ioc_input_tests(const char *pool) test_scrub(pool); + test_zpool_get(pool); /* * cleanup */ From nobody Tue Jun 30 17:19:49 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJP688Zz6jXXx for ; Tue, 30 Jun 2026 17:19:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJP3c4rz3pR4 for ; Tue, 30 Jun 2026 17:19:49 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839989; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cv/1p3jMMsw0iFtCZ8oputwGhyrCcwNlY2+wQaOg/VY=; b=iBIDJCoapohKwStTyYhdXWQm9v4xFN+eI3KhiTtgdYF1Xfd6VyDhIUBAXyYmkdKO20Jcd+ Y2pYF4LSTS51D3qLKvwOWV8lrnrydgt0KLZCn3XCmJkaPMxDzkrU2Od0QeczwuVot0W+cE APu+3tQhrwWE4RAfTtAJnei9jKjcka7QvB1q7lQlWtJ/CWO5YEmmbIrdkoXAN2g6+5Urwt fLxa326GuZH6mn3XgC3ezwghhsTqQWbdDCa+bH+ZXJ9E+Iea3Y5I5EUDU8hbxhWw8mQYm0 47ktVH2TLcNtrULq4RjXSTzhZViTqv1ps1TQAE4WW/9ngA176VlppjQXJbC0VQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839989; a=rsa-sha256; cv=none; b=UZWzPUWzOP/UlDBP3VvRW1i4EKAD2m+ke2GPuJNKR+6np92F9I7LoFiBXjoQqVxIkfsm8R MD12OOftAEbn0t7RxammOt8V1hTmsYR7CO8fWMMRQ0/5YLNcPyEeEQzJdwkDTL230vrHi8 +a6af43CPrIzDuCw/VPll78lh6S6UidAd/0rpNPLsAZi3gfi01Xa7flmRjSSq9JLQTCEMd WR081s1rKyD2SC/z+D07l0OWV48k5xTJLoBOHN4meAyzKDKBneo39n9+9DSZRUNaKZhEpp sSGVCYF1hgweOL4qazWO633dMvV9Rd2FrTqs13B+mLy8fKUFGxbEaLXXZwARjw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839989; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cv/1p3jMMsw0iFtCZ8oputwGhyrCcwNlY2+wQaOg/VY=; b=sx7TZKGBbww40P5b2N3rLdH+jdPx1jAdwzWRjWFBLZdKg5D4M60EG7xK9gd0ADA9Fo/ft0 OOVR5nkelUrMeTHHLzN/mZE18+DR3Qbc8iPbNqKo8RaWQ34c5HinpEZObYarmfbbn5pJgZ 1SenmhsAyLoV23H3CEvPih/W6VLYIt9i4SprJCENCP+nLs2UddnukWGmvD++MjzyHN8HgX RLTdclmxxMZ7RZ1YdcDKl0chBcxWMmXHobYEoxRRkYTW+RQtF6eMmoc6/US1NnscBFtg3N LRxwiFLM/aGSbbnJhdEB2tJRpo4EVrffGBK1Qi2fYxZLEYl4dY0pPycCieZQQQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJP2L9KztV2 for ; Tue, 30 Jun 2026 17:19:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44f84 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:49 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav From: Mark Johnston Subject: git: 2f84081641aa - stable/14 - libalias: Fix buffer overflow in RTSP aliasing List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 2f84081641aac179be145a7deafec492cada4742 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:49 +0000 Message-Id: <6a43fab5.44f84.48bb1cf9@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=2f84081641aac179be145a7deafec492cada4742 commit 2f84081641aac179be145a7deafec492cada4742 Author: Dag-Erling Smørgrav AuthorDate: 2026-06-28 22:10:40 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:21 +0000 libalias: Fix buffer overflow in RTSP aliasing In alias_rtsp_out(), we construct a new packet in a fixed-length buffer before copying it back into the original buffer. We never checked if the data we were writing to this temporary buffer fit in it, nor if the result fit in the original buffer. * Use a dynamically sized allocated buffer instead of a fixed-length stack buffer. * Check for overflow before appending to our temporary buffer. * Check for overflow before copying the data back to the packet buffer. * While here, use size_t for sizes and bool for booleans. Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 MFC after: 1 week Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D57753 --- sys/netinet/libalias/alias_smedia.c | 156 ++++++++++++++++++++---------------- 1 file changed, 89 insertions(+), 67 deletions(-) diff --git a/sys/netinet/libalias/alias_smedia.c b/sys/netinet/libalias/alias_smedia.c index 6c67e0d8f006..af1f6ed4aca8 100644 --- a/sys/netinet/libalias/alias_smedia.c +++ b/sys/netinet/libalias/alias_smedia.c @@ -104,8 +104,9 @@ #include #include #else -#include #include +#include +#include #include #include #endif @@ -128,9 +129,9 @@ #define RTSP_CONTROL_PORT_NUMBER_2 7070 #define TFTP_PORT_NUMBER 69 -static void -AliasHandleRtspOut(struct libalias *, struct ip *, struct alias_link *, - int maxpacketsize); +static void AliasHandleRtspOut(struct libalias *, struct ip *, + struct alias_link *, size_t); + static int fingerprint(struct libalias *la, struct alias_data *ah) { @@ -154,7 +155,8 @@ protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah) if (ntohs(*ah->dport) == TFTP_PORT_NUMBER) FindRtspOut(la, pip->ip_src, pip->ip_dst, *ah->sport, *ah->aport, IPPROTO_UDP); - else AliasHandleRtspOut(la, pip, ah->lnk, ah->maxpktsize); + else + AliasHandleRtspOut(la, pip, ah->lnk, ah->maxpktsize); return (0); } @@ -208,13 +210,15 @@ MODULE_DEPEND(alias_smedia, libalias, 1, 1, 1); #define ISDIGIT(a) (((a) >= '0') && ((a) <= '9')) -static int -search_string(char *data, int dlen, const char *search_str) +static ssize_t +search_string(char *data, size_t dlen, const char *search_str) { - int i, j, k; - int search_str_len; + size_t i, j, k; + size_t search_str_len; search_str_len = strlen(search_str); + if (search_str_len > dlen) + return (-1); for (i = 0; i < dlen - search_str_len; i++) { for (j = i, k = 0; j < dlen - search_str_len; j++, k++) { if (data[j] != search_str[k] && @@ -230,18 +234,21 @@ search_string(char *data, int dlen, const char *search_str) static int alias_rtsp_out(struct libalias *la, struct ip *pip, struct alias_link *lnk, - char *data, + char *data, size_t maxlen, const char *port_str) { - int hlen, tlen, dlen; + size_t hlen, tlen, dlen; + size_t i, j; struct tcphdr *tc; - int i, j, pos, state, port_dlen, new_dlen, delta; + int delta, state; + ssize_t pos, slen; + size_t new_dlen, port_dlen, port_slen; u_short p[2], new_len; u_short sport, eport, base_port; u_short salias = 0, ealias = 0, base_alias = 0; const char *transport_str = "transport:"; - char newdata[2048], *port_data, *port_newdata, stemp[80]; - int links_created = 0, pkt_updated = 0; + char *newdata, *port_data; + bool links_created = false, pkt_updated = false; struct alias_link *rtsp_lnk = NULL; struct in_addr null_addr; @@ -250,6 +257,9 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, hlen = (pip->ip_hl + tc->th_off) << 2; tlen = ntohs(pip->ip_len); dlen = tlen - hlen; + if (hlen > tlen || tlen > maxlen) + return (-1); + port_slen = strlen(port_str); /* Find keyword, "Transport: " */ pos = search_string(data, dlen, transport_str); @@ -259,17 +269,21 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, port_data = data + pos; port_dlen = dlen - pos; + /* Allocate temporary buffer */ + maxlen -= hlen; + if ((newdata = malloc(maxlen)) == NULL) + return (-1); memcpy(newdata, data, pos); - port_newdata = newdata + pos; + new_dlen = pos; - while (port_dlen > (int)strlen(port_str)) { + while (port_dlen > port_slen) { /* Find keyword, appropriate port string */ pos = search_string(port_data, port_dlen, port_str); - if (pos < 0) + if (pos < 0 || (size_t)pos + 1 > maxlen - new_dlen) break; - memcpy(port_newdata, port_data, pos + 1); - port_newdata += (pos + 1); + memcpy(newdata + new_dlen, port_data, pos + 1); + new_dlen += pos + 1; p[0] = p[1] = 0; sport = eport = 0; @@ -300,7 +314,7 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, eport = htons(p[1]); if (!links_created) { - links_created = 1; + links_created = true; /* * Find an even numbered port * number base that satisfies the @@ -349,24 +363,30 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, ealias = htons(base_alias + (RTSP_PORT_GROUP - 1)); } if (salias && rtsp_lnk) { - pkt_updated = 1; + pkt_updated = true; /* Copy into IP packet */ - sprintf(stemp, "%d", ntohs(salias)); - memcpy(port_newdata, stemp, strlen(stemp)); - port_newdata += strlen(stemp); + slen = snprintf(newdata + new_dlen, + maxlen - new_dlen, "%d", ntohs(salias)); + if (slen < 0 || slen >= maxlen - new_dlen) + goto fail; + new_dlen += slen; if (eport != 0) { - *port_newdata = '-'; - port_newdata++; + if (new_dlen == maxlen) + goto fail; + newdata[new_dlen++] = '-'; /* Copy into IP packet */ - sprintf(stemp, "%d", ntohs(ealias)); - memcpy(port_newdata, stemp, strlen(stemp)); - port_newdata += strlen(stemp); + slen = snprintf(newdata + new_dlen, + maxlen - new_dlen, "%d", ntohs(ealias)); + if (slen < 0 || slen >= maxlen - new_dlen) + goto fail; + new_dlen += slen; } - *port_newdata = ';'; - port_newdata++; + if (new_dlen == maxlen) + goto fail; + newdata[new_dlen++] = ';'; } state++; break; @@ -380,20 +400,20 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, } if (!pkt_updated) - return (-1); - - memcpy(port_newdata, port_data, port_dlen); - port_newdata += port_dlen; - *port_newdata = '\0'; + goto fail; /* Create new packet */ - new_dlen = port_newdata - newdata; + if (new_dlen + port_dlen > maxlen) + goto fail; + memmove(data + new_dlen, port_data, port_dlen); memcpy(data, newdata, new_dlen); + new_dlen += port_dlen; + free(newdata); SetAckModified(lnk); tc = (struct tcphdr *)ip_next(pip); delta = GetDeltaSeqOut(tc->th_seq, lnk); - AddSeq(lnk, delta + new_dlen - dlen, pip->ip_hl, pip->ip_len, + AddSeq(lnk, delta + (int)(new_dlen - dlen), pip->ip_hl, pip->ip_len, tc->th_seq, tc->th_off); new_len = htons(hlen + new_dlen); @@ -407,6 +427,9 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, tc->th_sum = TcpChecksum(pip); #endif return (0); +fail: + free(newdata); + return (-1); } /* Support the protocol used by early versions of RealPlayer */ @@ -415,13 +438,13 @@ static int alias_pna_out(struct libalias *la, struct ip *pip, struct alias_link *lnk, char *data, - int dlen) + size_t dlen) { struct alias_link *pna_links; - u_short msg_id, msg_len; char *work; - u_short alias_port, port; struct tcphdr *tc; + u_short msg_id, msg_len; + u_short alias_port, port; work = data; work += 5; @@ -433,7 +456,7 @@ alias_pna_out(struct libalias *la, struct ip *pip, if (ntohs(msg_id) == 0) /* end of options */ return (0); - if ((ntohs(msg_id) == 1) || (ntohs(msg_id) == 7)) { + if (ntohs(msg_id) == 1 || ntohs(msg_id) == 7) { memcpy(&port, work, 2); pna_links = FindUdpTcpOut(la, pip->ip_src, GetDestAddress(lnk), port, 0, IPPROTO_UDP, 1); @@ -462,22 +485,23 @@ alias_pna_out(struct libalias *la, struct ip *pip, } static void -AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, int maxpacketsize) +AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, + size_t maxlen) { - int hlen, tlen, dlen; struct tcphdr *tc; char *data; const char *setup = "SETUP", *pna = "PNA", *str200 = "200"; const char *okstr = "OK", *client_port_str = "client_port"; const char *server_port_str = "server_port"; - int i, parseOk; - - (void)maxpacketsize; + size_t hlen, tlen, dlen; + size_t i; tc = (struct tcphdr *)ip_next(pip); hlen = (pip->ip_hl + tc->th_off) << 2; tlen = ntohs(pip->ip_len); dlen = tlen - hlen; + if (hlen > tlen || tlen > maxlen) + return; data = (char *)pip; data += hlen; @@ -485,13 +509,14 @@ AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, /* When aliasing a client, check for the SETUP request */ if ((ntohs(tc->th_dport) == RTSP_CONTROL_PORT_NUMBER_1) || (ntohs(tc->th_dport) == RTSP_CONTROL_PORT_NUMBER_2)) { - if (dlen >= (int)strlen(setup) && + if (dlen >= strlen(setup) && memcmp(data, setup, strlen(setup)) == 0) { - alias_rtsp_out(la, pip, lnk, data, client_port_str); + alias_rtsp_out(la, pip, lnk, data, maxlen, + client_port_str); return; } - if (dlen >= (int)strlen(pna) && + if (dlen >= strlen(pna) && memcmp(data, pna, strlen(pna)) == 0) alias_pna_out(la, pip, lnk, data, dlen); } else { @@ -499,24 +524,21 @@ AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, * When aliasing a server, check for the 200 reply * Accommodate varying number of blanks between 200 & OK */ - - if (dlen >= (int)strlen(str200)) { - for (parseOk = 0, i = 0; - i <= dlen - (int)strlen(str200); - i++) - if (memcmp(&data[i], str200, strlen(str200)) == 0) { - parseOk = 1; - break; - } - - if (parseOk) { - i += strlen(str200); /* skip string found */ - while (data[i] == ' ') /* skip blank(s) */ + if (dlen < strlen(str200) + 1 + strlen(okstr)) + return; + for (i = 0; i <= dlen - strlen(str200) - 1; i++) { + if (memcmp(&data[i], str200, strlen(str200)) == 0 && + data[i + strlen(str200)] == ' ') { + i += strlen(str200); /* skip 200 */ + while (i < dlen && data[i] == ' ') /* skip blank(s) */ i++; - - if ((dlen - i) >= (int)strlen(okstr)) - if (memcmp(&data[i], okstr, strlen(okstr)) == 0) - alias_rtsp_out(la, pip, lnk, data, server_port_str); + if (dlen - i >= strlen(okstr)) { + if (memcmp(&data[i], okstr, strlen(okstr)) == 0) { + alias_rtsp_out(la, pip, lnk, data, + maxlen, server_port_str); + break; + } + } } } } From nobody Tue Jun 30 17:19:51 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJS09jtz6jXqC for ; Tue, 30 Jun 2026 17:19:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJR535kz3pNs for ; Tue, 30 Jun 2026 17:19:51 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839991; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DIvuGWpX4SEsUqaSRz6OPDfJHUx6G8VZcXQco7M3W1Q=; b=mDxsk0JxusDKZkLx3g4ZQIBN7d0PkYjrlWFd0eGMq4TS9ZiyrZU0vmgNSGH3VCwJL8dH3K nuLwgkbFU9N+nC8us+Qx8CH9u7kVyP9z0pJIq1kCtyQkaoCoxbdPfsQQo1HnbNTyIr02yu v2Y2tX2ZVIIcjJZQRb1xn0KQkyLcJgUkPle8V5GSfi+ML1z1YzCqIEFpLV5XxPeYvJSjn2 /EjCv1PlRbdbRpzJfjxnxnfP17jbZ7kXA8SPQcziDKIaL76s9NWf01FAPJM3Ks8IOTbWpq pm9ASof7OLMiNSPXAaQVRIb6z2BKrdS4OaAazP38WdyN/rK04mqhjgYzH8lgcw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839991; a=rsa-sha256; cv=none; b=HAXe3O6zGAV5MZyPmni3VhL5pE6eInqcgbQlcquzhsT4elVP+iP0V8/Jb24oqPfQ7NBcVK 8IZhJFqydqYJvKWG+3Z2CITJSHmgAve+u/So19erU27MwQXNhgHKpiTlhhD0R3FjWU26IJ UaL6g65brldPjyV06i7KEO/4XJu//+cHGXvv4kCwZpohYSf1bY16IDnnQPqxyarH1+cbT7 u6BuJLe2r7C7HZi0uwQE/xA78tD1if3GymBFsqHrJCwJZ/HXalI/Llp5OXoJbazD49v2Kl gBU96s++NeGj1zjuPk7RfIG3/RHE0fZ5ecFMyxx+U03je9rKbY2Xw/VTYFaJZA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839991; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DIvuGWpX4SEsUqaSRz6OPDfJHUx6G8VZcXQco7M3W1Q=; b=dkpaBx8DdwgLwKz7Z3m75KgT1JybRGW4tE3Uam6K3klW8ek16baQIdIBdyAmU6hno2usCC jJjNg4l3eV2t5QMJVvS4XcUVimH4jtOAPYzG2G3Pe3xR3ArAgpcZolObDYCS13GeBQ7tXO XAAr3QvkHSuLbcKT8EfMgKXIGU7Ex0xZKBWMtzZcfW6LMAz45pQgeYsHG45yzw/qcDgn/L C6pXWRN9kkjFhrbcYsVyZGQ2ydnyi+Uq4sA5MBIgZWLrMNlYCanEhcOSzp1XReBSYH/TnP xkSsTmXInrn0X/J3Kfz4FtO6MREvZxvWre+MzGWP5/XuIejUMFmwKsIUGaVSTA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJR40L7ztPH for ; Tue, 30 Jun 2026 17:19:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44eb0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:51 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 7982ae91a51a - stable/14 - unlinkat: Pass flags down to the work functions List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 7982ae91a51a1f30b6ad7d12c5eedc4b46a37992 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:51 +0000 Message-Id: <6a43fab7.44eb0.45b7e10d@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=7982ae91a51a1f30b6ad7d12c5eedc4b46a37992 commit 7982ae91a51a1f30b6ad7d12c5eedc4b46a37992 Author: Mark Johnston AuthorDate: 2026-06-23 20:43:53 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:21 +0000 unlinkat: Pass flags down to the work functions The unlinkat(2) and funlinkat(2) system calls were ignoring AT_RESOLVE_BENEATH. Also pass pathseg through instead of assuming it's UIO_USERSPACE. Add some tests which make sure that AT_RESOLVE_BENEATH is handled properly by various system calls. Approved by: so Security: FreeBSD-SA-26:42.unlinkat Security: CVE-2026-49421 Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57790 --- sys/kern/vfs_syscalls.c | 11 +- tests/sys/kern/Makefile | 1 + tests/sys/kern/resolve_beneath_test.c | 220 ++++++++++++++++++++++++++++++++++ 3 files changed, 227 insertions(+), 5 deletions(-) diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index 5c59d4dda2fd..de2261256875 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -1889,16 +1889,17 @@ sys_unlink(struct thread *td, struct unlink_args *uap) static int kern_funlinkat_ex(struct thread *td, int dfd, const char *path, int fd, - int flag, enum uio_seg pathseg, ino_t oldinum) + int flags, enum uio_seg pathseg, ino_t oldinum) { - if ((flag & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) + if ((flags & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) return (EINVAL); - if ((flag & AT_REMOVEDIR) != 0) - return (kern_frmdirat(td, dfd, path, fd, UIO_USERSPACE, 0)); + if ((flags & AT_REMOVEDIR) != 0) + return (kern_frmdirat(td, dfd, path, fd, pathseg, + flags & ~AT_REMOVEDIR)); - return (kern_funlinkat(td, dfd, path, fd, UIO_USERSPACE, 0, 0)); + return (kern_funlinkat(td, dfd, path, fd, pathseg, flags, 0)); } #ifndef _SYS_SYSPROTO_H_ diff --git a/tests/sys/kern/Makefile b/tests/sys/kern/Makefile index 9f0c29736257..d28b6e850636 100644 --- a/tests/sys/kern/Makefile +++ b/tests/sys/kern/Makefile @@ -32,6 +32,7 @@ ATF_TESTS_C+= procdesc ATF_TESTS_C+= ptrace_test TEST_METADATA.ptrace_test+= timeout="15" ATF_TESTS_C+= reaper +ATF_TESTS_C+= resolve_beneath_test ATF_TESTS_C+= sched_affinity ATF_TESTS_C+= sigaltstack ATF_TESTS_C+= sigwait diff --git a/tests/sys/kern/resolve_beneath_test.c b/tests/sys/kern/resolve_beneath_test.c new file mode 100644 index 000000000000..b83926038ded --- /dev/null +++ b/tests/sys/kern/resolve_beneath_test.c @@ -0,0 +1,220 @@ +/* + * Copyright (c) 2026 The FreeBSD Foundation + * + * This software was written by Mark Johnston under sponsorship from + * the FreeBSD Foundation. + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +#include +#include + +#include +#include +#include + +#include + +/* + * Verify that AT_RESOLVE_BENEATH is respected by various system calls. + */ + +static int +setup(void) +{ + int fd, tfd; + + ATF_REQUIRE_EQ(0, mkdir("base", 0755)); + ATF_REQUIRE_EQ(0, mkdir("outside", 0755)); + ATF_REQUIRE((tfd = open("outside/target", O_CREAT | O_WRONLY, 0644)) >= + 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("outside/dir", 0755)); + ATF_REQUIRE((tfd = open("base/file", O_CREAT | O_WRONLY, 0644)) >= 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("base/subdir", 0755)); + ATF_REQUIRE((fd = open("base", O_DIRECTORY | O_RDONLY)) >= 0); + return (fd); +} + +ATF_TC_WITHOUT_HEAD(faccessat_beneath); +ATF_TC_BODY(faccessat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + faccessat(fd, "file", F_OK, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + faccessat(fd, "../outside/target", F_OK, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(chflagsat_beneath); +ATF_TC_BODY(chflagsat_beneath, tc) +{ + int fd, ret; + + fd = setup(); + ret = chflagsat(fd, "file", UF_NODUMP, AT_RESOLVE_BENEATH); + if (ret != 0) + ATF_REQUIRE_EQ(EOPNOTSUPP, errno); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + chflagsat(fd, "../outside/target", UF_NODUMP, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchmodat_beneath); +ATF_TC_BODY(fchmodat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchmodat(fd, "file", 0644, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchmodat(fd, "../outside/target", 0644, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchownat_beneath); +ATF_TC_BODY(fchownat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchownat(fd, "file", -1, -1, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchownat(fd, "../outside/target", 0, 0, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(utimensat_beneath); +ATF_TC_BODY(utimensat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + utimensat(fd, "file", NULL, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + utimensat(fd, "../outside/target", NULL, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(linkat_beneath); +ATF_TC_BODY(linkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + linkat(fd, "file", fd, "hardlink", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + linkat(fd, "../outside/target", fd, "hardlink2", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_beneath); +ATF_TC_BODY(unlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "file", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/target", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_rmdir_beneath); +ATF_TC_BODY(unlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "subdir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/dir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_beneath); +ATF_TC_BODY(funlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "file", FD_NONE, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/target", FD_NONE, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_rmdir_beneath); +ATF_TC_BODY(funlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, mkdir("base/subdir2", 0755)); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "subdir2", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/dir", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC(getfhat_beneath); +ATF_TC_HEAD(getfhat_beneath, tc) +{ + atf_tc_set_md_var(tc, "require.user", "root"); +} +ATF_TC_BODY(getfhat_beneath, tc) +{ + fhandle_t fh; + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + getfhat(fd, "file", &fh, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + getfhat(fd, "../outside/target", &fh, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TP_ADD_TCS(tp) +{ + ATF_TP_ADD_TC(tp, faccessat_beneath); + ATF_TP_ADD_TC(tp, chflagsat_beneath); + ATF_TP_ADD_TC(tp, fchmodat_beneath); + ATF_TP_ADD_TC(tp, fchownat_beneath); + ATF_TP_ADD_TC(tp, utimensat_beneath); + ATF_TP_ADD_TC(tp, linkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, funlinkat_beneath); + ATF_TP_ADD_TC(tp, funlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, getfhat_beneath); + return (atf_no_error()); +} From nobody Tue Jun 30 17:19:50 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJR0ByCz6jXYL for ; Tue, 30 Jun 2026 17:19:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJQ4PFdz3pcg for ; Tue, 30 Jun 2026 17:19:50 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839990; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bE9ZJVOk37VRQib2kQg+TLX3lNbk0tzQj5Y4xBCUDFY=; b=qiyvJ6ynkFvFaOoh+w0Wuahdce/IkPjUrqu03da3/popnSyQbHEB2NND/JnE8mnahpWa4g xLgnYY97SHTRg23g2eCb8hcYYW1cId84HqQW+2lM+DAnr9BruNjdqKl6pJgbkKraAl4F4A +5zbFYPqRHDj0zZ9KcodFJEn0z+AsK+MzxVkoj194l65sGRZYgVbrgpnbiqAz6l2SWDFmF 8EdO5KM+Jk9HwLtj3c9JygUvUed7aN99PBaVvQ0vMgvBWJp5q8DvUcUwzb8wN9hvaRq+CB jUzcZ9BV6gHpkwFt/dTZDHexzrOXc+bJC6fNvDerPRRKqVL7mZSjZJIvTMaXog== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839990; a=rsa-sha256; cv=none; b=pf0lk5cqr3L7pvlFSZPzKFs4W1G1tf09CjALY5nZzyLGtGIhf57F2lOpwWGncy0dOtvD9f rBI8ZBgtkq4iKEjVlkyF8Oyslw9BOdlGl56ZdQ+HAh2bNcrwNUbH0aGl2sclUs3OZTrULo LKmkBk5yuCUzI5iTKwvSLbTotW9TD1oquULLSidE25kWUdSlVcdelNKAEsbGtGX6VzXiVs NyTFNmYJYU2KxDbXcdBwqYP8T7ts7mG0bs1VB61j+r7KvM0aHmUNfdlb9RF8sV38KveH6F jycU829kVdbjLR7LyekKXZhyhAh5xR5N3Ehr5IRhGa9TOiMdGdrvubtPgqfaCA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839990; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bE9ZJVOk37VRQib2kQg+TLX3lNbk0tzQj5Y4xBCUDFY=; b=s23bFg0LGl9MHmqNxLHX7vnE/uHPL6iGIB3//NLxFLW3bz5rxx/bMBBy9nffertnpQtF8k oiDea0Pk4mGxt06mtFTv9qXMxNZMENMgDitgimZeWN37eNXcMuQJosPvZ1QMfPE3WXkdEJ eS/8KPrRZSfsEkI4x4Nh7qWj+2EmF7NjcW4WYiOomv/tLUCViTsinfNdqDRLlN8FVOfa/y iO2YtMqbWaF8zoXYpVhsh470Zs9YX5y3fq4fGsQtdLNmqBE08K1+RnR74hrW7dOMoO5Ow7 7I549+g7hHIbLUTdO6wryX5/ot+xj05RhcLeXM6fHYXwxjntQFgG3Lie67qDPw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJQ38Q0zsXX for ; Tue, 30 Jun 2026 17:19:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 454f8 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:50 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 4c0f47666666 - stable/14 - tests/libalias: Add a regression test for an alias_smedia bug List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 4c0f47666666be701bbd6b68b21462e5e71b6d28 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:50 +0000 Message-Id: <6a43fab6.454f8.2e391c6a@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=4c0f47666666be701bbd6b68b21462e5e71b6d28 commit 4c0f47666666be701bbd6b68b21462e5e71b6d28 Author: Mark Johnston AuthorDate: 2026-06-22 17:25:56 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:21 +0000 tests/libalias: Add a regression test for an alias_smedia bug Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57747 --- tests/sys/netinet/libalias/Makefile | 4 ++ tests/sys/netinet/libalias/smedia.c | 74 +++++++++++++++++++++++++++++++++++++ 2 files changed, 78 insertions(+) diff --git a/tests/sys/netinet/libalias/Makefile b/tests/sys/netinet/libalias/Makefile index 20d904511538..5f83eaee9900 100644 --- a/tests/sys/netinet/libalias/Makefile +++ b/tests/sys/netinet/libalias/Makefile @@ -4,6 +4,10 @@ PACKAGE= tests TESTSDIR= ${TESTSBASE}/sys/netinet/libalias BINDIR= ${TESTSDIR} +PLAIN_TESTS_C+= smedia + +LIBADD.smedia+= sbuf + ATF_TESTS_C+= 1_instance \ 2_natout \ 3_natin \ diff --git a/tests/sys/netinet/libalias/smedia.c b/tests/sys/netinet/libalias/smedia.c new file mode 100644 index 000000000000..e181a7a538af --- /dev/null +++ b/tests/sys/netinet/libalias/smedia.c @@ -0,0 +1,74 @@ +/* + * Copyright (c) 2026 The FreeBSD Foundation + * + * This software was developed by Mark Johnston under sponsorship from + * the FreeBSD Foundation. + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +/* + * A minimal regression test for a buffer overflow in alias_rtsp_out(). + */ + +#include +#include + +#include +#include +#include +#include + +#include +#include + +#include + +int +main(void) +{ + uint8_t *packet; + struct ip ip; + struct tcphdr tcp; + struct sbuf sb; + struct libalias *la; + + sbuf_new(&sb, NULL, 0, SBUF_AUTOEXTEND); + sbuf_printf(&sb, "SETUP rtsp://example.com/media.mp4 RTSP/1.0\r\n"); + sbuf_printf(&sb, "CSeq: 1\r\n"); + sbuf_printf(&sb, "Transport: RTP/AVP;unicast;"); + for (int i = 0; i < 200; i++) + sbuf_printf(&sb, "client_port=%d-%d;", 2 * i, 2 * i + 1); + sbuf_printf(&sb, "\r\n\r\n"); + sbuf_finish(&sb); + + memset(&tcp, 0, sizeof(tcp)); + tcp.th_sport = htons(1234); + tcp.th_dport = htons(554); + tcp.th_off = 5; + + memset(&ip, 0, sizeof(ip)); + ip.ip_v = IPVERSION; + ip.ip_hl = sizeof(ip) / 4; + ip.ip_len = htons(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)); + ip.ip_id = htons(1); + ip.ip_ttl = 64; + ip.ip_p = IPPROTO_TCP; + ip.ip_src.s_addr = inet_addr("127.0.0.1"); + ip.ip_dst.s_addr = inet_addr("127.0.0.2"); + + packet = malloc(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)); + memcpy(packet, &ip, sizeof(ip)); + memcpy(packet + sizeof(ip), &tcp, sizeof(tcp)); + memcpy(packet + sizeof(ip) + sizeof(tcp), sbuf_data(&sb), + sbuf_len(&sb)); + + la = LibAliasInit(NULL); + LibAliasSetAddress(la, + (struct in_addr){.s_addr = inet_addr("127.0.0.1")}); + if (LibAliasOut(la, packet, sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)) != + PKT_ALIAS_OK) + return (1); + LibAliasUninit(la); + return (0); +} From nobody Tue Jun 30 17:19:52 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJT3KdQz6jXrk for ; Tue, 30 Jun 2026 17:19:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJS5qSfz3pP3 for ; Tue, 30 Jun 2026 17:19:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839992; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LxWdgaQnAwmsf90XT7AMyD+23m4ev850nTeW/u+i+t0=; b=LMdcvKO7noC6hRvuq6UoZE3uPxSIiKCHkAVA0O8kWPRNvgQCZ9dQhNcbaJxsAmfPOn2XAR byv7MUsVEUkzUIegDaKJaOUvoeNJ1EnIslOEoChiY/H90YLILf3GSJlcMuacArlr3jVWIF QBtx8KN9A+zQ/Z+ek9DDIPydeKFWQUkdRoopWBryVnhyexZtca4pF7abyA4PL3UShJNcMU inRiabUfkpxvBzdeIi6E/BxUhwaHGDhb3ooNhj/3JpL1wSqk+TcmqV3XMPIajXG+Sp+Hza PaPC8W1NSeBEM0x8ECwPGKZNa6TeYvAunsqaugG0to2Ox85Iw2E3VKj7w0zTUg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839992; a=rsa-sha256; cv=none; b=e3fudeLWVPcPzxi9tCumcAr4EiWX71qqmA28i9eU/GtOwXcQ7ivCAl//QshBfdhAas9xL9 0iha4yhRUdyxXfth9+VUn6BmzG9lOYl+gugGiAXLIfGaEp8LwDQMs0y59KGJN+Mv+RG7lB c3UoPSDRKMLim3wSzWrsHLgZLGQM76PIAbPk04U91m98JJfC5bNoNShKFqR9IPYu1NIVYW eXbquLbpMJtXjng0CSlrIt7/OnJI7+vSQy5JJpwgrT3jNe5n718/69AxD19LwJcZ+WhftR C0ZF8n/FaEDNIrN6WJliD3Npe/e4gsXNKRMD/98Bd8GStS74gfsckZL13jt9MA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839992; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LxWdgaQnAwmsf90XT7AMyD+23m4ev850nTeW/u+i+t0=; b=vBaTFGXcdsGSTuuadHk8Xr0D4VkDxbME442NdnBW1Fl3XWi0lOyVlryWpTVkIxV3BZblUe uuSbWLd4i0Sa/krf4+zLbh4pymL/ldGFEFnZ556OpgO1z1TAqQhu1ZG4LGkSoK4QWgrE3g PWh4hDjUuGXCSYb+XpVbcXme/BySpwZbfLHycgkrpoIhYEhY1dwYB+BnYD4dCizqckwsx1 5RgCorTztmm6f7hlh/nhhOCthuXneH3fwwiS6h4MJtavRge3AjWBDptZxia25wqovvv7kf Rpk25cL2dmeLRuxdALRc+VxS11MOW17jpvhsatPGUVPZq6cOxFxC/Om9b9W8KQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJS4w1RzsyY for ; Tue, 30 Jun 2026 17:19:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 43af4 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:52 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: df8885512da5 - stable/14 - rack: Reload the TCP stack PCB after reacquiring the inpcb lock List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: df8885512da546e6ba619039625ec43a945b9889 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:52 +0000 Message-Id: <6a43fab8.43af4.6d1e5385@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=df8885512da546e6ba619039625ec43a945b9889 commit df8885512da546e6ba619039625ec43a945b9889 Author: Mark Johnston AuthorDate: 2026-06-23 21:46:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:21 +0000 rack: Reload the TCP stack PCB after reacquiring the inpcb lock Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791 --- sys/netinet/tcp_stacks/rack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index 9b35fbb7797b..41a57eeedfde 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -23936,6 +23936,7 @@ process_opt: INP_WUNLOCK(inp); return (ENOPROTOOPT); } + rack = (struct tcp_rack *)tp->t_fb_ptr; if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_HYBRID_PACING) && From nobody Tue Jun 30 17:19:53 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJV331vz6jXb7 for ; Tue, 30 Jun 2026 17:19:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJT6yFyz3pjv for ; Tue, 30 Jun 2026 17:19:53 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839994; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lWRuNPnsBiH0bdyt2Op7UZQwmTet/TcvLMZTK6u/N1M=; b=SKk2/ZtQZnYALN4mi7BKQnODNV67V2wKdEXiOp3WrOu561udJboKn7i6GLAKKEJ5dcusky Gkd2E84soRLwCUxi3Fav/K+vbBjAv0sG3RrVP/JpBWN1Uz+d101nOnOWnIBoqg3DNUOEYq QsHwCilycwhwoMH9H/bJ74ZceqOPG8wXq3dc8acwyvwqQHD3NVeJzpBwW+P1dP5QHHfNN2 qQ98XY3n3wI5ZmsDRFYDJww1j7ifZAt9mEqEt5oqNrHYp8MGE/KyHqGLt0lOR/nxP4y9B5 jyKm58jhol+EJk0G8+DHyKOebMYDNOSNM3HG1Kiae7hXgmYsbj/dKDzbtPnt5Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839994; a=rsa-sha256; cv=none; b=k3ekSwATPLAzYaG6p2Nqlmb+5zCGbvIdb0EC2mBJTWbRx+LXGCR2B7Ih3lwXaHCOG4odEt MzjOyB+oi9VarT86hnttMaDA+VP2tzPwT5em4bybgSHyMJsmIrUCnuQeGXJ3WDTc2Hqxkk o0UkSpLCu5KD4xo77GBaU7nSmkB2yIm5hSLhaBapQ1FrElI/MTaRNeKdGDqKnUdx13mSA1 5RKCLZQqfBo8h/y3ZWrQDa9NA0kp///4FvvsqkG/EOdHqDNbv2TNI4gYiMqSlwKvTSv9CT QmG0jRnPF7BUNIXfxQEi+krml0UFKgCWsI1CIJCvnTgbBVeaXd709ptZf6IvSA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839994; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lWRuNPnsBiH0bdyt2Op7UZQwmTet/TcvLMZTK6u/N1M=; b=t06jLMrejESMYvdP3gU5Qdra1c8fl728sV44u9VoMBnRL9CyeApma21yajJDISC0euHisf QTXWwtmLHWgIDXZPCNEmfjFKenoeimUgsw8WvbCOGwYqhAiL/EjlboiR6IwxDIWKzEJe+8 ogc5uH03qTvpiYtWWrpuRRbF9BcJUi0rJ57XKjn5dMgMTGaG+Q4KT9qyuOCkWxiac1E3nH ipfsfdE56YOn2AVI6T4kDhd9jQPLcT6GZyrizjWvfBr2JoGGZe9TiNQSab74y2sHeCS51b i726mJBMuJPP8e74ggcdqzWapu2o9UKlF1nXXIBaPLN+vUqghV44iXpnY48d8A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJT5cz5zsXZ for ; Tue, 30 Jun 2026 17:19:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 41dff by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:53 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: c379639aa4c1 - stable/14 - posixshm: Disallow fspacectl() on largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: c379639aa4c1612c83c518d173a507618b9bcf17 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:53 +0000 Message-Id: <6a43fab9.41dff.257f63f4@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c379639aa4c1612c83c518d173a507618b9bcf17 commit c379639aa4c1612c83c518d173a507618b9bcf17 Author: Mark Johnston AuthorDate: 2026-06-24 19:56:07 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:22 +0000 posixshm: Disallow fspacectl() on largepage objects As with truncation, the operation isn't supported, but nothing prevented it. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57830 --- sys/kern/uipc_shm.c | 5 ++++- tests/sys/posixshm/posixshm_test.c | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index cd79d2039ebf..5c6a8d6e25ec 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -2104,11 +2104,14 @@ shm_fspacectl(struct file *fp, int cmd, off_t *offset, off_t *length, int flags, ("shm_fspacectl: non-zero flags")); KASSERT(*offset >= 0 && *length > 0 && *length <= OFF_MAX - *offset, ("shm_fspacectl: offset/length overflow or underflow")); - error = EINVAL; + shmfd = fp->f_data; off = *offset; len = *length; + if (shm_largepage(shmfd)) + return (ENOTSUP); + rl_cookie = shm_rangelock_wlock(shmfd, off, off + len); switch (cmd) { case SPACECTL_DEALLOC: diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index 85cb8af54039..d10d304ea5b6 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -1370,6 +1370,27 @@ ATF_TC_BODY(largepage_config, tc) ATF_REQUIRE(close(fd) == 0); } +ATF_TC_WITHOUT_HEAD(largepage_fspacectl); +ATF_TC_BODY(largepage_fspacectl, tc) +{ + struct spacectl_range range; + size_t ps[MAXPAGESIZES]; + int fd, pscnt; + + pscnt = pagesizes(ps, true); + + for (int i = 1; i < pscnt; i++) { + fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, ps[i]); + + range.r_offset = 0; + range.r_len = ps[i]; + ATF_REQUIRE_ERRNO(ENOTSUP, + fspacectl(fd, SPACECTL_DEALLOC, &range, 0, &range) == -1); + + ATF_REQUIRE(close(fd) == 0); + } +} + ATF_TC_WITHOUT_HEAD(largepage_mmap); ATF_TC_BODY(largepage_mmap, tc) { @@ -2166,6 +2187,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, mmap_prot); ATF_TP_ADD_TC(tp, largepage_basic); ATF_TP_ADD_TC(tp, largepage_config); + ATF_TP_ADD_TC(tp, largepage_fspacectl); ATF_TP_ADD_TC(tp, largepage_mmap); ATF_TP_ADD_TC(tp, largepage_munmap); ATF_TP_ADD_TC(tp, largepage_madvise); From nobody Tue Jun 30 17:19:56 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJY2rkGz6jXqS for ; Tue, 30 Jun 2026 17:19:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJY151qz3pVJ for ; Tue, 30 Jun 2026 17:19:57 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839997; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6ZfWWUl8SLelh2ZMsGFy3xQCeKFKtofJDHYWpxgnHNM=; b=s8ghtvEXvQ8IVm9yuWWhxsArbg6QtQNA0e2R5POZ3Z0dwSswX1ToUAQfTLUwsgWlCpb2Gs IU7xZKqPPX18G/RLDwV3Srd/WouvR+fW0O4uzuU7n1J5Sz5ceRM7qGOiUU+CnOomZDr70B M3Ox9I1WD4toRALk/Px6AHGi0oqM6V+1ShMBnUzAObstDyTlMqPCpcVpmYVccnnd1R/0zE hWArPH/YqiBbyP2a82REV8OszfKhTNRRsk5XGsZ7krxQxVMesHkUYpg2UGAc6OJ/UMFJCI km+VebEa7aWsijEYEif3LABmGkAzzxvmQKXty6y2u+8lL2g1UVyeF1puBfyGaw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839997; a=rsa-sha256; cv=none; b=LIoTABcrtGYwofdGDc5eJcHdfXg+Mv4SB3NGWje0qjoQUvsBz69zutbq2LmowJMcAhgiP6 1u72w3ioC4YVQzhf7NdDc7AwHl7Q2NvJKVnIH4vk6HUODT9QaDa+93uJS/XQxYUFmPmHhO CuX8RfZjnOXMPTdZivy7tXLtFFCDxbA0o6XEhpF91RdBDrtN29gws31wxauiTJjvaKY++b JCqLYtVRLZh8krXTfiQ9jUtoW3tITw612efWkkaR5qNDy2moiUfTm3p1YoxGOz1begCqlG j9hFKgVEpHS6Q6p3xiVnCRMe7r+JAAMaI8Lir3adnUlBHlKNEbrq6Fi7E+OSkw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839997; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6ZfWWUl8SLelh2ZMsGFy3xQCeKFKtofJDHYWpxgnHNM=; b=BLfjBArJ+3gwZ1Jj4s59qaTVla9txt8S2VwQHcKwoM9/erulL9zvRIGoAxDx5HfDQca+n+ SsmcMFbDPYKQ+9Z9CfI7jZJTxLYI575iabRgCcdxjkqQMilPnyFhyptKIhw2g1+owV+exG /C0l4qyo4HLGGM0piZ2N4YRaQhXiZgY1LiBqElzhAkig95pGkF8k+dbqzGBvnZv+qLcmPI wOWsz/VpPINtRBf1+CM3liFlPEIdPOl+l0FJ8q8T1ocEkKu7LeCkt7Ji9ZLPSqneFQJlJ1 KgNFv2/x4Dmgwf+lTUVPw/RyeJNddPnuxA0WGLXPgnZGwi8qwA3ZPPRsINFxTw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJX75ndztD9 for ; Tue, 30 Jun 2026 17:19:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45603 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:56 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Kyle Evans From: Mark Johnston Subject: git: 1763deb84ba9 - stable/14 - kern: fix auditing of ptrace(2) syscall requests List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 1763deb84ba988d36546cbb6222f08a71d1a1bb0 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:56 +0000 Message-Id: <6a43fabc.45603.3190e8f5@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=1763deb84ba988d36546cbb6222f08a71d1a1bb0 commit 1763deb84ba988d36546cbb6222f08a71d1a1bb0 Author: Kyle Evans AuthorDate: 2026-06-25 17:02:47 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:22 +0000 kern: fix auditing of ptrace(2) syscall requests `error` here is the return value of syscall_thread_enter() rather than the syscall itself, so the committed audit records do not reflect reality. This is less harmful than them recording an error when the operation actually succeeded, but it could still possibly be used to throw off IDS techniques with things like bsmtrace. Approved by: so Security: FreeBSD-SA-26:45.audit Security: CVE-2026-49426 Reviewed by: des, kib, markj, csjp Differential Revision: https://reviews.freebsd.org/D57847 --- sys/kern/kern_sig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c index 7f399586f639..88c93b98b646 100644 --- a/sys/kern/kern_sig.c +++ b/sys/kern/kern_sig.c @@ -2779,7 +2779,7 @@ ptrace_syscallreq(struct thread *td, struct proc *p, td->td_errno = nerror; if (audited) - AUDIT_SYSCALL_EXIT(error, td); + AUDIT_SYSCALL_EXIT(tsr->ts_ret.sr_error, td); if (!sy_thr_static) syscall_thread_exit(td, se); } From nobody Tue Jun 30 17:19:54 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJW4Dsdz6jXbG for ; Tue, 30 Jun 2026 17:19:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJV6wKKz3pV4 for ; Tue, 30 Jun 2026 17:19:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839995; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FzMO7qetH/ofAqBbwWdF65c3f5sqs80jJ9KDxxlDo/4=; b=Uyr7Cs0F6LGt7OkAWpEmOVV2HzixfZZwbTbi/zI07VaQVEfHPEdN1DhYeP01J8ZSgxqOLF c9jlkcsC14a7xO077J6CKMLtV2YUnvtVwZOllldPLnlqY33NI38JgPyF+WLIoeV5HTmZoE 6a+AsHhRFKvmzyM/Hxgo4SwCjxqKkaHMccYSFJejYGYfu0I9rF4dfsT5a8Q/Qv/LA6SuJY xwqz5SJj7HwXPr0v6ul2jUaXrLorddKqA/gddAsPvRMHJl9q9tHL5pt3J3eSqO0JbaLKjl rjYq+9hgRXVvsTEvQ2hJXyjMPrYa+iYuw1P5f8KkIXnYroAjzuKsvHWE4WJORg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839995; a=rsa-sha256; cv=none; b=Wd13WB3ILNim2LOTM+kBO2TeydgXweYuP2lbSuGz6P4paCSulbtBBi8XgHm7tV6bd14AyH TNhf/OVhIcssPJZfD/kXLIYKB7+l4Bp5ZEOlvOR2f3yQxFuGY4NxYRB6zv466cT9YfZhyK nu5MZt4UHV211dKh8kozygottgNM8OnHeBptesRoXkqLyDbbOWY5Ur5yTFB4FibvZIWS3e bfzzNdj5OicLGSuN+c6s86Q+gIDYmLLwMNpOiXyK75rIdICAm8ulunDshn45vodzVXlNxH f6TMo3YIQHCwKmN8/SDEMnaQa6sPeSGcilJYoOwrhP+0Jzsq9QJD2VDLzbaJYw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839995; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FzMO7qetH/ofAqBbwWdF65c3f5sqs80jJ9KDxxlDo/4=; b=TYETLmywOJksG+n34W9OR83OeGdWoj8NzCweQvKPjkrOrjJBTtna3VsGbuVjhGwlNrYsEa H4ag4cBqGKFsjo9H4U7ZT3IBnO322tXXhLKUXl8Q7b5CHsFv1rNd80QMrl8EwX7bEn1jYO 2QIvYxhhryaYZVZmcjW7RMEWeOtiIDIRn3uJvK6roW30GQt9n4MB0FoMoK6NpNRBFdrB8Q 3kc2x+NlTKsTni5d0kDWQ2v7L8pkCV6bhJu5imp1U++temWfwl6j+3/NqiCkXitKUo65Gq /3pqkNYbdW5RydnKBFEY9JRr8HcAFJWsVZfYt/KFJwgZg4xibXavz+l3Upy6rg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJV60xkztPJ for ; Tue, 30 Jun 2026 17:19:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45501 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:54 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 65883818cea0 - stable/14 - posixshm: Disallow truncation of largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 65883818cea03738c1a2b7ffc56ab2fe8041e9c1 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:54 +0000 Message-Id: <6a43faba.45501.d64e87e@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=65883818cea03738c1a2b7ffc56ab2fe8041e9c1 commit 65883818cea03738c1a2b7ffc56ab2fe8041e9c1 Author: Mark Johnston AuthorDate: 2026-06-23 22:47:02 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:22 +0000 posixshm: Disallow truncation of largepage objects We correctly handled ftruncate(), but not open(O_TRUNC). Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57831 --- sys/kern/uipc_shm.c | 8 +++----- tests/sys/posixshm/posixshm_test.c | 38 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 5 deletions(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index 5c6a8d6e25ec..f302bc305f86 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -824,7 +824,7 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) vm_pindex_t oldobjsz __unused; int aflags, error, i, psind, try; - KASSERT(length >= 0, ("shm_dotruncate: length < 0")); + KASSERT(length >= 0, ("shm_dotruncate_largepage: length < 0")); object = shmfd->shm_object; VM_OBJECT_ASSERT_WLOCKED(object); rangelock_cookie_assert(rl_cookie, RA_WLOCKED); @@ -1353,15 +1353,13 @@ kern_shm_open2(struct thread *td, const char *userpath, int flags, mode_t mode, if (error == 0 && (flags & (O_ACCMODE | O_TRUNC)) == (O_RDWR | O_TRUNC)) { - VM_OBJECT_WLOCK(shmfd->shm_object); #ifdef MAC error = mac_posixshm_check_truncate( - td->td_ucred, fp->f_cred, shmfd); + td->td_ucred, fp->f_cred, shmfd); if (error == 0) #endif - error = shm_dotruncate_locked(shmfd, 0, + error = shm_dotruncate_cookie(shmfd, 0, rl_cookie); - VM_OBJECT_WUNLOCK(shmfd->shm_object); } if (error == 0) { /* diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index d10d304ea5b6..20f44693b45d 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -2149,6 +2149,43 @@ ATF_TC_BODY(largepage_reopen, tc) "close failed; errno=%d", errno); } +ATF_TC_WITHOUT_HEAD(largepage_truncate); +ATF_TC_BODY(largepage_truncate, tc) +{ + size_t ps[MAXPAGESIZES]; + int fd, psind; + + (void)pagesizes(ps, true); + psind = 1; + + gen_test_path(); + fd = shm_create_largepage(test_path, O_CREAT | O_RDWR, psind, + SHM_LARGEPAGE_ALLOC_DEFAULT, 0600); + if (fd < 0 && errno == ENOTTY) + atf_tc_skip("no large page support"); + ATF_REQUIRE_MSG(fd >= 0, "shm_create_largepage failed; error=%d", errno); + + ATF_REQUIRE_MSG(ftruncate(fd, ps[psind]) == 0, + "ftruncate failed; error=%d", errno); + + ATF_REQUIRE_MSG(close(fd) == 0, "close failed; error=%d", errno); + + fd = shm_open(test_path, O_RDWR | O_TRUNC, 0); + ATF_REQUIRE_MSG(fd == -1, "shm_open(O_TRUNC) should have failed"); + ATF_REQUIRE_ERRNO(ENOTSUP, fd == -1); + + fd = shm_open(test_path, O_RDWR, 0); + ATF_REQUIRE_MSG(fd >= 0, "shm_open failed; error=%d", errno); + + ATF_REQUIRE_MSG(ftruncate(fd, ps[psind]) == 0, + "ftruncate to same size failed; error=%d", errno); + + ATF_REQUIRE_MSG(shm_unlink(test_path) == 0, + "shm_unlink failed; errno=%d", errno); + ATF_REQUIRE_MSG(close(fd) == 0, + "close failed; errno=%d", errno); +} + ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TC(tp, remap_object); @@ -2200,6 +2237,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, largepage_pkru); #endif ATF_TP_ADD_TC(tp, largepage_reopen); + ATF_TP_ADD_TC(tp, largepage_truncate); return (atf_no_error()); } From nobody Tue Jun 30 17:19:58 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJZ67QQz6jXhL for ; Tue, 30 Jun 2026 17:19:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJZ1QZxz3ptf for ; Tue, 30 Jun 2026 17:19:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839998; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8Jrp7EbZzKi4r35rR9fRpk9E32w9NtyVGZGxjLH/62A=; b=f8AzZHeFc82+u54asTvuHvJc8S/E29nY1wbMmsBQCo2aH8rf5ed6JkyH9EIBuM4He9OabS miIcA7yeqfsCYqpG799aHd8WkdSzyS1ZNQb+WDvMNdfagaZOussEaMMS21hC5EoAjXN4lH ZW38dQzKtku3HercCpO+L9oqdK7MtqJtW8tRrEVN1aeiD4Zx1xqXuFmOsOblOVg6dlJ44u G4IcchOQBIlzaijqHl5CixFVz/DN7SHEIy6SZAgAHXQ7a3jqnaZkXxCRbnx0/bMmZNkLaA U1sD5t5yvYBs9XkqoGhBDyRCtCOJ91LVqP2SK2pM0cnPfkZKyH6P1fpuKmT3IA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839998; a=rsa-sha256; cv=none; b=OgDulurWRWJttiiSIxNUjHPGUdfnc4YvwieTpvdV8eh3dHcmYVE4NOzOpbdEoOAhoo6rc7 9NDS9iHEdt9U1vGWwgTd7AdECUiqotcQJeoAp5xkZWv7chZR7cP8aGYvqfMleAzoQev20S DRjFhkD2KnOpFqDH/O1BRB0VITCq84roS4T2y6oorUx4bq83dV3qgA5xQKXNEeb67pfqoF 5p66YvfWyDFVet0v1fwrfyBpbQbDIPwtwA3OAAg1zRTa/pelopigXupf6V+hMtv1q6NW/t WiJqj4DoxDqbdMEbEOC7uvDssqt9gm6C7FEId7VIOzveVT5jtDWRBnJkEuGMCw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839998; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8Jrp7EbZzKi4r35rR9fRpk9E32w9NtyVGZGxjLH/62A=; b=FjmqfqCsZEJx076ZWuM9mRGwnczJAD5nLCKJOktREBjOhMGjWWgM4VLLEaMgqjeXb0WnQz KJc8e6LQ3aVcIAXheuADxBcX7ACuzVk8ovapiYflyyr4Y2xXvbyYa7ksHzlmuSTzaFlNqd /Y2ujB6Ytr2TPKAkq7GOb4+yLQAf3YP0Ms6Vy+2MK99zOAiUatCSuL76eWkK7sXkJqNgFL zr5Ofz3aQTeAtcli2Se1oB8t+8/U8W10AidMxnBFzLa83rz1zcAbpyBhhdc1EfYPJr7r3d UE2zbrAPlf5r2u3lPK9ngxkRVIzyQXNLNq4xTd7wBoCIio5Dye3swwps8i/yqg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJZ0NyWztV6 for ; Tue, 30 Jun 2026 17:19:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 435e1 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:58 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: John Baldwin From: Mark Johnston Subject: git: a7787f9f8b8e - stable/14 - ktls CBC decrypt: Only increment iovec index when an entry is used List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: a7787f9f8b8efcb1873ebaf9830de90ab0eb283b Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:58 +0000 Message-Id: <6a43fabe.435e1.514a726f@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=a7787f9f8b8efcb1873ebaf9830de90ab0eb283b commit a7787f9f8b8efcb1873ebaf9830de90ab0eb283b Author: John Baldwin AuthorDate: 2026-06-24 01:14:11 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:22 +0000 ktls CBC decrypt: Only increment iovec index when an entry is used If an mbuf in the chain was skipped because it only contained bytes from the header, the iovec index ('i') was incremented even though the entry was not populated. Only increment 'i' when an iovec entry is consumed. Add a new type of KTLS receive test which writes a single TLS record via two separate write(2) calls over a TCP_NODELAY socket to trigger a split in the mbuf chain in the kernel. Test various split locations including after the "plain" TLS header (5 bytes), after the full TLS header, in the middle of the data payload, just before the start of the trailer, and in the middle of the trailer. These tests are also run against all supported ciphers, not just CBC. The 'header' test for CBC ciphersuites was able to trigger the bug. Approved by: so Security: FreeBSD-SA-26:46.ktls Security: CVE-2026-49423 Sponsored by: Chelsio Communications --- sys/opencrypto/ktls_ocf.c | 3 +- tests/sys/kern/ktls_test.c | 110 ++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 110 insertions(+), 3 deletions(-) diff --git a/sys/opencrypto/ktls_ocf.c b/sys/opencrypto/ktls_ocf.c index f61fb7f73b5d..3c8b2e4f4589 100644 --- a/sys/opencrypto/ktls_ocf.c +++ b/sys/opencrypto/ktls_ocf.c @@ -503,13 +503,14 @@ ktls_ocf_tls_cbc_decrypt(struct ktls_session *tls, iov[0].iov_base = &ad; iov[0].iov_len = sizeof(ad); skip = sizeof(*hdr) + AES_BLOCK_LEN; - for (i = 1, n = m; n != NULL; i++, n = n->m_next) { + for (i = 1, n = m; n != NULL; n = n->m_next) { if (n->m_len < skip) { skip -= n->m_len; continue; } iov[i].iov_base = mtod(n, char *) + skip; iov[i].iov_len = n->m_len - skip; + i++; skip = 0; } uio.uio_iov = iov; diff --git a/tests/sys/kern/ktls_test.c b/tests/sys/kern/ktls_test.c index 3970083e7f72..7003b86fb4e2 100644 --- a/tests/sys/kern/ktls_test.c +++ b/tests/sys/kern/ktls_test.c @@ -303,6 +303,15 @@ fd_set_blocking(int fd) ATF_REQUIRE(fcntl(fd, F_SETFL, flags) != -1); } +static void +tcp_nodelay(int fd) +{ + int nodelay = 1; + + ATF_REQUIRE(setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &nodelay, + sizeof(nodelay)) == 0); +} + static bool cbc_crypt(const EVP_CIPHER *cipher, const char *key, const char *iv, const char *input, char *output, size_t size, int enc) @@ -1920,6 +1929,55 @@ test_ktls_receive_bad_size(const atf_tc_t *tc, struct tls_enable *en, close_sockets_ignore_errors(sockets); } +static void +test_ktls_receive_split_record(const atf_tc_t *tc, struct tls_enable *en, + uint64_t seqno, size_t len, size_t first_len) +{ + char *plaintext, *received, *outbuf; + size_t outbuf_cap, outbuf_len; + ssize_t rv; + int sockets[2]; + + ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); + + plaintext = alloc_buffer(len); + received = malloc(len); + outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); + outbuf = malloc(outbuf_cap); + + ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); + + ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, + sizeof(*en)) == 0); + check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); + + fd_set_blocking(sockets[0]); + fd_set_blocking(sockets[1]); + + outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, + plaintext, len, outbuf, outbuf_cap, 0); + ATF_REQUIRE(first_len < outbuf_len); + + tcp_nodelay(sockets[1]); + rv = write(sockets[1], outbuf, first_len); + ATF_REQUIRE_INTEQ((ssize_t)(first_len), rv); + + rv = write(sockets[1], outbuf + first_len, outbuf_len - first_len); + ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len - first_len), rv); + + rv = ktls_receive_tls_record(en, sockets[0], TLS_RLTYPE_APP, received, + len); + ATF_REQUIRE_INTEQ((ssize_t)len, rv); + + ATF_REQUIRE(memcmp(plaintext, received, len) == 0); + + free(outbuf); + free(received); + free(plaintext); + + close_sockets(sockets); +} + #define TLS_10_TESTS(M) \ M(aes128_cbc_1_0_sha1, CRYPTO_AES_CBC, 128 / 8, \ CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO) \ @@ -2360,6 +2418,26 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ auth_alg, minor, name) \ ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name); +#define GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, name, len, first_len) \ +ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_split_##name); \ +ATF_TC_BODY(ktls_receive_##cipher_name##_split_##name, tc) \ +{ \ + struct tls_enable en; \ + uint64_t seqno; \ + \ + ATF_REQUIRE_KTLS(); \ + seqno = random(); \ + build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ + seqno, &en); \ + test_ktls_receive_split_record(tc, &en, seqno, len, first_len); \ + free_tls_enable(&en); \ +} + +#define ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, name) \ + ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_split_##name); + #define GEN_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ minor) \ GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ @@ -2381,7 +2459,22 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ tls_minimum_record_payload(&en) - 1) \ GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ auth_alg, minor, oversized_record, \ - TLS_MAX_MSG_SIZE_V10_2 * 2) + TLS_MAX_MSG_SIZE_V10_2 * 2) \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, header, 64, \ + sizeof(struct tls_record_layer)); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, full_header, 64, \ + tls_header_len(&en)); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, half, 64, \ + tls_header_len(&en) + 32); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_start, 64, \ + tls_header_len(&en) + 64); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_middle, 64, \ + tls_header_len(&en) + 64 + tls_trailer_len(&en) / 2); #define ADD_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ minor) \ @@ -2402,7 +2495,17 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ auth_alg, minor, small_record) \ ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ - auth_alg, minor, oversized_record) + auth_alg, minor, oversized_record) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, header) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, full_header) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, half) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_start) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_middle) \ /* * For each supported cipher suite, run several receive tests: @@ -2425,6 +2528,9 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ * size * * - a test with an oversized TLS record + * + * - tests of a single record whose data is split across two writes, + * with each test using a different split point */ AES_CBC_NONZERO_TESTS(GEN_RECEIVE_TESTS); AES_GCM_TESTS(GEN_RECEIVE_TESTS); From nobody Tue Jun 30 17:19:55 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJX5v3cz6jXYY for ; Tue, 30 Jun 2026 17:19:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJX21dRz3plN for ; Tue, 30 Jun 2026 17:19:56 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839996; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=kuibJMS4ZVOo7l46hMOeQv13uqYqIS7kk15cLAW4pMQ=; b=SFuBCRD3dxNbVTUs8aw0Nhrcczdke8b6r35B3jafLZ02tTWHn5h3nb08N0zJ+6OiSktpPl QGqnanpw13gBDxrWmj1i5Khp+GtbYCi/0w4gzXbSXqLKHy7Cphzvw1bQE70TvKRrtFGXCx A9nuLzmeBdigC3jRaLovyJD7eI1mE4d8Aw0T/0hkKxuQOz0R1G3KSoc7nppROHIZOCOoaI TS97p7+9SMicdMmHBE1/19YhTeAz0MuFldhPNdFzc/2x4vmv4wmE0LDJ5M7JU2K7WbSqsD ywBw/Lo6bY6wm59JLlw2Ogg5vJrnMHb/F2ksKJBAxQXcNhmHprTjggFpbmMf3w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839996; a=rsa-sha256; cv=none; b=pM+XdUzzhzZPWegBgOGG9q5F1OQ2hDGeoqVBK8vet/ZrUC10dBTHiTYckwqZMNyOqyhkuM Makk36RTbyI/idTWvJMI0xd/R7vGE/8ykdOnE6/iIyxhBnsaAsrGB4tCLY8LG4tn9Ba/xj yvLDFo6j1kSzMW2/ciG130RWqLRckRcDurjeOCbIFf5yeDrVe1nZROzWa8p6tYbQT0QFeq W6+RV1EOLKIPujrrqOoPErc7LEouxSuOPfN1dnv23VPZzRnq6kh7rpEGjvLD12Tz9adxyC 33O/FGSo8KBNbDrOzoywgaOSyYf6Fx9Ce843aqaR3O1CD486G/s/nLD+GljO5g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839996; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=kuibJMS4ZVOo7l46hMOeQv13uqYqIS7kk15cLAW4pMQ=; b=taWxJT2EcaDJz4UzMdnDgjqaQBIvF3NAAvFUk30gvapoWk3MdgqHJd48Eo0DUqQchPvSEI lcQTP54Viw/IOKcAJ7YJgfawCQyDU6sKSV04Mg1aLaTGiC8apzQKFoqW7LKS4IgMMTKyYM gBbaQXwbs7bbxrUxJFWwEVHI7T8HdruDsid+GopIiM/8PNfNSYrhLoTxwP8dOGSrKCpcsu ZRQe4RRrKQwiFD7IQl7p0ozsZYdqeaQmqUoteU7cjCtEKFFpGadwX2XCw6/Dvngk6bu5xn KhAVOjEMoTPi2jWKv9s+UrEQpI0gTGDdAuopyElKMXBO/Qv2hU78fWrZhzy+tQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJW6YgBzsyZ for ; Tue, 30 Jun 2026 17:19:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 444a7 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:55 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: f30052c16dba - stable/14 - posixshm: Fix handling of sendfile() with largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: f30052c16dba54e63a5e9dcd81f5a58a4eee4684 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:55 +0000 Message-Id: <6a43fabb.444a7.6bdd809e@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=f30052c16dba54e63a5e9dcd81f5a58a4eee4684 commit f30052c16dba54e63a5e9dcd81f5a58a4eee4684 Author: Mark Johnston AuthorDate: 2026-06-24 19:57:00 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:22 +0000 posixshm: Fix handling of sendfile() with largepage objects sendfile(2) can transmit POSIX shared memory objects. Typically it will look up and wire each page before sending it to a socket; once transmission is complete, the page is unwired and typically released back into the page queues. sendfile() has an advisory flag, SF_NOCACHE, which means, "try to free the page once transmission is complete." This is implemented in vm_page_release(), which expects to operate on managed pages. Pages belonging a largepage object are de-facto wired not explicitly so. Thus, vm_page_release() will unwire and, having found no additional references, free the page. Because mappings of largepage objects are unmanaged, userspace can still access the now freed page. Fix the problem by explicitly wiring largepage pages. Make the VM object destructor responsible for unwiring and freeing them. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49427 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57832 --- sys/kern/uipc_shm.c | 19 ++++++-- sys/vm/vm_page.c | 23 +++++----- tests/sys/posixshm/posixshm_test.c | 89 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 118 insertions(+), 13 deletions(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index f302bc305f86..9c2f91ffe347 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -323,6 +323,7 @@ static void shm_largepage_phys_ctor(vm_object_t object, vm_prot_t prot, vm_ooffset_t foff, struct ucred *cred) { + object->flags |= OBJ_PG_DTOR; } static void @@ -330,11 +331,24 @@ shm_largepage_phys_dtor(vm_object_t object) { int psind; + VM_OBJECT_ASSERT_WLOCKED(object); + psind = object->un_pager.phys.data_val; if (psind != 0) { + vm_page_t m, mtmp; + bool removed __diagused; + +restart: + TAILQ_FOREACH_SAFE(m, &object->memq, listq, mtmp) { + if (!vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL)) { + goto restart; + } + removed = vm_page_remove(m); + KASSERT(!removed, ("%s: page %p not wired", __func__, m)); + vm_page_unwire(m, PQ_NONE); + } atomic_subtract_long(&count_largepages[psind], object->size / (pagesizes[psind] / PAGE_SIZE)); - vm_wire_sub(object->size); } else { KASSERT(object->size == 0, ("largepage phys obj %p not initialized bit size %#jx > 0", @@ -856,7 +870,7 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) if ((shmfd->shm_seals & F_SEAL_GROW) != 0) return (EPERM); - aflags = VM_ALLOC_NORMAL | VM_ALLOC_ZERO; + aflags = VM_ALLOC_NORMAL | VM_ALLOC_ZERO | VM_ALLOC_WIRED; if (shmfd->shm_lp_alloc_policy == SHM_LARGEPAGE_ALLOC_NOWAIT) aflags |= VM_ALLOC_WAITFAIL; try = 0; @@ -912,7 +926,6 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) object->size += OFF_TO_IDX(pagesizes[psind]); shmfd->shm_size += pagesizes[psind]; atomic_add_long(&count_largepages[psind], 1); - vm_wire_add(atop(pagesizes[psind])); } return (0); } diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c index 178b104ab95f..284895658651 100644 --- a/sys/vm/vm_page.c +++ b/sys/vm/vm_page.c @@ -4121,6 +4121,9 @@ vm_page_unwire_managed(vm_page_t m, uint8_t nqueue, bool noreuse) { u_int old; + KASSERT(nqueue < PQ_COUNT, + ("vm_page_unwire: invalid queue %u request for page %p", + nqueue, m)); KASSERT((m->oflags & VPO_UNMANAGED) == 0, ("%s: page %p is unmanaged", __func__, m)); @@ -4179,17 +4182,15 @@ vm_page_unwire_managed(vm_page_t m, uint8_t nqueue, bool noreuse) void vm_page_unwire(vm_page_t m, uint8_t nqueue) { - - KASSERT(nqueue < PQ_COUNT, - ("vm_page_unwire: invalid queue %u request for page %p", - nqueue, m)); + KASSERT(nqueue < PQ_COUNT || nqueue == PQ_NONE, + ("%s: invalid queue %u request for page %p", __func__, nqueue, m)); if ((m->oflags & VPO_UNMANAGED) != 0) { if (vm_page_unwire_noq(m) && m->ref_count == 0) vm_page_free(m); - return; + } else { + vm_page_unwire_managed(m, nqueue, false); } - vm_page_unwire_managed(m, nqueue, false); } /* @@ -4363,13 +4364,15 @@ vm_page_release_toq(vm_page_t m, uint8_t nqueue, const bool noreuse) void vm_page_release(vm_page_t m, int flags) { - vm_object_t object; - - KASSERT((m->oflags & VPO_UNMANAGED) == 0, - ("vm_page_release: page %p is unmanaged", m)); + if ((m->oflags & VPO_UNMANAGED) != 0) { + vm_page_unwire(m, PQ_NONE); + return; + } if ((flags & VPR_TRYFREE) != 0) { for (;;) { + vm_object_t object; + object = atomic_load_ptr(&m->object); if (object == NULL) break; diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index 20f44693b45d..24a90133f4d9 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -34,6 +34,7 @@ #include #include #include +#include #include #include #include @@ -2149,6 +2150,93 @@ ATF_TC_BODY(largepage_reopen, tc) "close failed; errno=%d", errno); } +static unsigned char +largepage_sendfile_expected(size_t off) +{ + + return ((unsigned char)(off * 131 + (off >> 8))); +} + +ATF_TC_WITHOUT_HEAD(largepage_sendfile); +ATF_TC_BODY(largepage_sendfile, tc) +{ + static const int flags[] = { 0, SF_NOCACHE }; + char *addr; + off_t sbytes; + size_t ps[MAXPAGESIZES]; + int error, fd, pscnt, sd[2], status; + pid_t child; + + pscnt = pagesizes(ps, true); + + for (int i = 1; i < pscnt; i++) { + for (int fi = 0; fi < (int)nitems(flags); fi++) { + fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, + ps[i]); + addr = mmap(NULL, ps[i], PROT_READ | PROT_WRITE, + MAP_SHARED, fd, 0); + ATF_REQUIRE_MSG(addr != MAP_FAILED, + "mmap(%zu bytes) failed; error=%d", ps[i], errno); + + /* Fill with a verifiable pattern. */ + for (size_t j = 0; j < ps[i]; j++) + addr[j] = largepage_sendfile_expected(j); + + ATF_REQUIRE(socketpair(PF_LOCAL, SOCK_STREAM, 0, + sd) == 0); + + child = fork(); + ATF_REQUIRE_MSG(child != -1, + "fork() failed; error=%d", errno); + if (child == 0) { + char buf[BUFSIZ]; + ssize_t len; + size_t off, resid; + + (void)close(sd[0]); + off = 0; + for (resid = ps[i]; resid > 0; resid -= len) { + len = read(sd[1], buf, sizeof(buf)); + if (len <= 0) + _exit(1); + for (ssize_t k = 0; k < len; k++) { + if ((unsigned char)buf[k] != + largepage_sendfile_expected( + off + k)) + _exit(2); + } + off += len; + } + _exit(0); + } + ATF_REQUIRE(close(sd[1]) == 0); + + sbytes = 0; + error = sendfile(fd, sd[0], 0, ps[i], NULL, &sbytes, + flags[fi]); + ATF_REQUIRE_MSG(error == 0, + "sendfile() failed; error=%d flags=%#x", + errno, flags[fi]); + ATF_REQUIRE_MSG(sbytes == (off_t)ps[i], + "sendfile() short; sbytes=%jd expected=%zu flags=%#x", + (intmax_t)sbytes, ps[i], flags[fi]); + + ATF_REQUIRE(close(sd[0]) == 0); + + ATF_REQUIRE_MSG(waitpid(child, &status, 0) == child, + "waitpid() failed; error=%d", errno); + ATF_REQUIRE_MSG(WIFEXITED(status), + "child killed by signal %d", WTERMSIG(status)); + ATF_REQUIRE_MSG(WEXITSTATUS(status) == 0, + "child exited with status %d (flags=%#x)", + WEXITSTATUS(status), flags[fi]); + + ATF_REQUIRE(munmap(addr, ps[i]) == 0); + ATF_REQUIRE(close(fd) == 0); + } + } +} + ATF_TC_WITHOUT_HEAD(largepage_truncate); ATF_TC_BODY(largepage_truncate, tc) { @@ -2237,6 +2325,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, largepage_pkru); #endif ATF_TP_ADD_TC(tp, largepage_reopen); + ATF_TP_ADD_TC(tp, largepage_sendfile); ATF_TP_ADD_TC(tp, largepage_truncate); return (atf_no_error()); From nobody Tue Jun 30 17:20:02 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJg1D9nz6jXsQ for ; Tue, 30 Jun 2026 17:20:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJf3Vdgz3pvL for ; Tue, 30 Jun 2026 17:20:02 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840002; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/U+D8D9EqlPF1URHrdzzvA58LLf5b4jQdpSRFiGz62A=; b=UuGZWYsuRlSYY7oseEH500rGkX+oHGtMvgBFwwlPL69sEZs0G4Se8KjfBuRnPqMDlilQM3 xBv/QgJcwEEnJEqL3fV0ZS95LA74JWccFNN7yoQch+mhuTP0yInBFkmKKh9VNAqjrivSRB pm6ikdg/jw/o5IZvatTyVTeUS1sKdPJZ2V4uh3rrWlMO+DkJ87BnALSics+6b2s0oRWojZ Rh8bXqOD5mO+vagUfX6kFxS2NUDINa6QGGziNtJAdMXMbhwtwAn40eMH20lGxE9mNZmgIR N0DJM4hGFtYZtakXKcy3d3AOvKnkBPbq5dCeOWlzGOoRkIwvGYoZNasZgrJlUQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840002; a=rsa-sha256; cv=none; b=HY40kyHeI+wA4dE6MbXS1bJMt59MMixWHQy4WlboZjRHygFH+U9iJquXC1Sm6SsqYWz5hl OGIHL/ll3Gjc/BvZtAvNO/Giz2dvIhS6nb6AqM7MzUX/jN+k7nzrd0rhXHGaanlYdsLKQV wJ5QWsd1zP0Krmw0czKvDvg8r8Vyl/XPCbfGssy0t/orgrMIyH9oaXzXa8J3RlWHxzVNac TI4hzgAag+FrJmvaLWfv/ZOVpQRZgajU0wL84GUkAx/hEKsyqV282zjEyU3cNcPEk5JKmD wA7sg2JQ4+NXMR3ifgsB7QbzcMa4GmdNNsVXlCI4RX38kBV30EUs+10JBNoYpw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840002; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/U+D8D9EqlPF1URHrdzzvA58LLf5b4jQdpSRFiGz62A=; b=IMv406JIBoxg5grTkoMNboyZXww5YKV3Rv4t2+jl+jKPUBgAH4yMYYIUYiK2wosxB/ArER gInWPJddfIEKXE3//5Kp5hfc2J2AQfHsQNuzgsuKr1o/nMoimVKrguD3FasYM+WQPuwhBj f3vX5QUPS6P5ZQfEFk1IGJuLL/55/nFC+u52vPx6uFp9bcTZoFmxYy/X5wq8rEOZBfFBjm n7vzYZqHOSw41o0ZfxHFNr/zWvUYB6DaNlojxwKRrlbJymv2gholoIuJ7OBWXvRU6w4kbH UM5wctN+aOvbcl+vGoYxSEWvTHAbU6+xu1p3LSZre/MTtgkMhxOlfej68mDdew== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJf2LWbzsXg for ; Tue, 30 Jun 2026 17:20:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44834 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:02 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: d62d0b6586a8 - stable/14 - iconv: Fix a stack buffer overflow in _ISO2022_sputwchar() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: d62d0b6586a88f64edb706295a4d568f2bde2808 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:02 +0000 Message-Id: <6a43fac2.44834.1abd3ddf@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=d62d0b6586a88f64edb706295a4d568f2bde2808 commit d62d0b6586a88f64edb706295a4d568f2bde2808 Author: Mark Johnston AuthorDate: 2026-06-23 17:45:28 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:22 +0000 iconv: Fix a stack buffer overflow in _ISO2022_sputwchar() In the ISO2022-CN encoding, characters may require at least seven bytes, and MB_LEN_MAX==6 is insufficient. From code inspection, _ISO2022_sputwchar() can emit 10 bytes in the worst case, so use that to size buffers. Add a regression test. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58082 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57950 --- contrib/netbsd-tests/lib/libc/locale/t_iconv.c | 20 ++++++++++++++++++++ lib/libiconv_modules/ISO2022/citrus_iso2022.c | 8 ++++---- 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c index f25c061bb170..199774769827 100644 --- a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c +++ b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c @@ -117,6 +117,26 @@ static const struct sample { 0x82,0x42,0x79,0x65, 0x2e }, 0, 0, NULL }, + /* 馬 from CNS 11643-1 */ + [9] = { "UTF-8", 3, (const char[3]){0xe9,0xa6,0xac}, + "ISO-2022-CN", 8, + (const char[8]){0x1b,0x24,0x29,0x47,0x0e,0x58,0x6b,0x0f}, + 0, 0, NULL }, + /* 馬毦 shifting from CNS 11643-1 to CNS 11643-2 */ + [10] = { "UTF-8", 6, (const char[6]){0xe9,0xa6,0xac,0xe6,0xaf,0xa6}, + "ISO-2022-CN", 16, + (const char[16]){ + /* ESC $ ) G (shift G1 to CNS 11643 plane 1) */ + 0x1b,0x24,0x29,0x47, + 0x0e, /* GL is G1 from now on */ + 0x58,0x6b, /* 馬 */ + /* ESC $ * H (shift G2 to CNS 11643 plane 2) */ + 0x1b,0x24,0x2a,0x48, + 0x1b,0x4e, /* GL is G2 for next char */ + 0x30,0x21, /* 毦 */ + 0x0f, /* GL is G0 from now on */ + }, + 0, 0, "PR lib/59019: various iconv issues ([case 10: ISO-2022-CN to UTF-8 14/6] iconv: Illegal byte sequence (85))" }, }; #ifdef MIN diff --git a/lib/libiconv_modules/ISO2022/citrus_iso2022.c b/lib/libiconv_modules/ISO2022/citrus_iso2022.c index a311dbc26e59..b2de13d9d13a 100644 --- a/lib/libiconv_modules/ISO2022/citrus_iso2022.c +++ b/lib/libiconv_modules/ISO2022/citrus_iso2022.c @@ -130,7 +130,7 @@ typedef struct { #define _FUNCNAME(m) _citrus_ISO2022_##m #define _ENCODING_INFO _ISO2022EncodingInfo #define _ENCODING_STATE _ISO2022State -#define _ENCODING_MB_CUR_MAX(_ei_) MB_LEN_MAX +#define _ENCODING_MB_CUR_MAX(_ei_) 10 #define _ENCODING_IS_STATE_DEPENDENT 1 #define _STATE_NEEDS_EXPLICIT_INIT(_ps_) \ (!((_ps_)->flags & _ISO2022STATE_FLAG_INITIALIZED)) @@ -1013,7 +1013,7 @@ _ISO2022_sputwchar(_ISO2022EncodingInfo * __restrict ei, wchar_t wc, { _ISO2022Charset cs; char *p; - char tmp[MB_LEN_MAX]; + char tmp[10]; size_t len; int bit8, i = 0, target; unsigned char mask; @@ -1178,7 +1178,7 @@ _citrus_ISO2022_put_state_reset(_ISO2022EncodingInfo * __restrict ei, size_t * __restrict nresult) { char *result; - char buf[MB_LEN_MAX]; + char buf[10]; size_t len; int ret; @@ -1207,7 +1207,7 @@ _citrus_ISO2022_wcrtomb_priv(_ISO2022EncodingInfo * __restrict ei, _ISO2022State * __restrict psenc, size_t * __restrict nresult) { char *result; - char buf[MB_LEN_MAX]; + char buf[10]; size_t len; int ret; From nobody Tue Jun 30 17:19:59 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJb4Xyzz6jXxk for ; Tue, 30 Jun 2026 17:19:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJb2PvBz3prP for ; Tue, 30 Jun 2026 17:19:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839999; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=P2aknvjgyNkGeQhMI4m3BZFl+TK651QV5YVsYWZCBOU=; b=itzFarZEmU7gO1z+yWa1yW+0QyhCOTWqW1aMVyW2pOCuTMQTSHeHn22kp2/fHeEmOcoxO8 j5/tiyB0fvNjpLqN84elNX5rabunVCqCM3oQ91LrpmM7cq5xlQfXwD4w13ia1BECvTqkPw PcYIgv2v57JbmaCy0nmn4y52SjeAFOlkRIpFIXggOi6eVRUxxWO4JHM7LbukG5YC0OycWY tpJN+UIiQXMT+x+qgLgcls4wkYMqJW19J3M9qQYZ5MkgVsgjYMsjiVBvPjM0o2nqkr2RBX hd78z30TiGpBmb0OoFVPD6us+uYF7+SFZ8JZBEMKdFotLa2pnmR7Z6sPnmmVgQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839999; a=rsa-sha256; cv=none; b=KrjY1hJWlJnul+Lm/Q58zu4NsWBbA0WSh6OO4pqSbjNMDEkXtFHLFUj+dluJ6NOQJ0RBE8 RJ5WGRU+BWtYIOnspLqyRiJj5QsdpuZ5z3Qo2w6CRwmmWaLmdb2vU9VrfutQaqMOmK09ge Z6gvlcj7Ke1fQXr3AgVFQGRzwlol9ScFYah4Lrr2iTpQi8nUvNalqlSCzQqo7U2yOVlYiS bixKIR0bD2vrV7nR8zZ3Bt0dBik+8v0jzqj8sY+jZ8OBwSV/E1Iseh/0j/gW3pnYkB/9Cd F3me0XJeKLy/bgxFDsuD2NS06YXuWGWD2jlXlHfNr7yS6wOEW9XzlfQnPp+tzQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839999; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=P2aknvjgyNkGeQhMI4m3BZFl+TK651QV5YVsYWZCBOU=; b=eFqoN2MjGNGKK9CpXmKnRRn5oqiBsfSevp89qgqag973m6zhNJ6WXmPOq5RIUih/nzfdf1 eA3LZfTuMSR4ikyP2geWpNos64pxLG3CLr4udGqb9xlSRhbgX300FPu76dfC2B9t73Wc6q 6lIPxzAwfUeD3+S2zD5z+a5ZxIxRbMQJcsWEPrlAAsuNrp0gOSIcX1LALfh8RE19+XWj+0 QXk08sUVrmoSCXjvmvEf/U4k9fj1mFNwPRrCi8PAreJq59Fte4lPaC4JCg8kLN4n+KbiEG RIfKkktqKMVD73Ew2aqua1aOeBkm9j9BeSoEnGUF2EPX91wg8QiW/lKBDtpafw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJb1BzfztXM for ; Tue, 30 Jun 2026 17:19:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44d1f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Taylor R Campbell From: Mark Johnston Subject: git: 799132497f04 - stable/14 - iconv(3): Fix problems in various encodings List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 799132497f046c0d449cced38b1c3095e4d89abd Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:59 +0000 Message-Id: <6a43fabf.44d1f.634714e6@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=799132497f046c0d449cced38b1c3095e4d89abd commit 799132497f046c0d449cced38b1c3095e4d89abd Author: Taylor R Campbell AuthorDate: 2026-06-22 21:15:25 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:22 +0000 iconv(3): Fix problems in various encodings Fix null pointer dereference with HZ8 encoding. Fix output buffer overrun in UTF-7, VIQR, ZW encodings. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57947 --- lib/libiconv_modules/HZ/citrus_hz.c | 2 ++ lib/libiconv_modules/UTF7/citrus_utf7.c | 20 +++++++++++++++----- lib/libiconv_modules/VIQR/citrus_viqr.c | 6 +++++- lib/libiconv_modules/ZW/citrus_zw.c | 7 +++++-- 4 files changed, 27 insertions(+), 8 deletions(-) diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index f12938a7dab8..db738b8f812e 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -262,6 +262,8 @@ _citrus_HZ_mbrtowc_priv(_HZEncodingInfo * __restrict ei, tail = psenc->chlen = 0; continue; } + if (graphic == NULL) + break; } else if (ch & 0x80) { if (graphic != GR(psenc->inuse)) break; diff --git a/lib/libiconv_modules/UTF7/citrus_utf7.c b/lib/libiconv_modules/UTF7/citrus_utf7.c index f924366551f1..e7c6a0862c54 100644 --- a/lib/libiconv_modules/UTF7/citrus_utf7.c +++ b/lib/libiconv_modules/UTF7/citrus_utf7.c @@ -296,7 +296,7 @@ done: static int _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei, - char * __restrict s, size_t n __unused, uint16_t u16, + char * __restrict s, size_t n, uint16_t u16, _UTF7State * __restrict psenc, size_t * __restrict nresult) { int bits, i; @@ -336,6 +336,8 @@ _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei, psenc->ch[psenc->chlen++] = base64[i]; } } + if (n < (size_t)psenc->chlen) + return (E2BIG); memcpy(s, psenc->ch, psenc->chlen); *nresult = psenc->chlen; psenc->chlen = 0; @@ -352,6 +354,8 @@ _citrus_UTF7_wcrtomb_priv(_UTF7EncodingInfo * __restrict ei, uint16_t u16[2]; int err, i, len; size_t nr, siz; + char buf[8], *bufp = buf; + _UTF7State psenc_save = *psenc; u32 = (uint32_t)wchar; if (u32 <= UTF16_MAX) { @@ -367,14 +371,20 @@ _citrus_UTF7_wcrtomb_priv(_UTF7EncodingInfo * __restrict ei, return (EILSEQ); } siz = 0; + if (n > sizeof(buf)) + n = sizeof(buf); for (i = 0; i < len; ++i) { - err = _citrus_UTF7_utf16tomb(ei, s, n, u16[i], psenc, &nr); - if (err != 0) - return (err); /* XXX: state has been modified */ - s += nr; + err = _citrus_UTF7_utf16tomb(ei, bufp, n, u16[i], psenc, &nr); + if (err != 0) { + *nresult = (size_t)-1; + *psenc = psenc_save; /* restore state */ + return (err); + } + bufp += nr; n -= nr; siz += nr; } + memcpy(s, buf, siz); *nresult = siz; return (0); diff --git a/lib/libiconv_modules/VIQR/citrus_viqr.c b/lib/libiconv_modules/VIQR/citrus_viqr.c index 1747c0a1705e..c1e88f188aab 100644 --- a/lib/libiconv_modules/VIQR/citrus_viqr.c +++ b/lib/libiconv_modules/VIQR/citrus_viqr.c @@ -323,7 +323,11 @@ _citrus_VIQR_wcrtomb_priv(_VIQREncodingInfo * __restrict ei, int ch = 0; switch (psenc->chlen) { - case 0: case 1: + case 0: + break; + case 1: + if (n-- < 1) + goto e2big; break; default: return (EINVAL); diff --git a/lib/libiconv_modules/ZW/citrus_zw.c b/lib/libiconv_modules/ZW/citrus_zw.c index 93590e550952..c59064e65465 100644 --- a/lib/libiconv_modules/ZW/citrus_zw.c +++ b/lib/libiconv_modules/ZW/citrus_zw.c @@ -264,9 +264,12 @@ _citrus_ZW_wcrtomb_priv(_ZWEncodingInfo * __restrict ei __unused, ch = (unsigned char)wc; switch (psenc->charset) { case NONE: - if (ch == '\0' || ch == '\n') + if (ch == '\0' || ch == '\n') { + if (n < 1) + return (E2BIG); + n -= 1; psenc->ch[psenc->chlen++] = ch; - else { + } else { if (n < 4) return (E2BIG); n -= 4; From nobody Tue Jun 30 17:20:01 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJf1xcBz6jXqs for ; Tue, 30 Jun 2026 17:20:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJd2zJLz3prg for ; Tue, 30 Jun 2026 17:20:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840001; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=VsOpS51jnJMZNMzF1Z5+CLrZ74iyRaSKIuze6OC2G2M=; b=sPVpJ0NrLpzDi4N9asseJWY8+IHuNsS+0mrDxBmA5Yq7TvpmlJmaNKrlSF0uqR7tx2zOrc T2FVWNv9zHqbeTJBrWbiaXJ8AjRv5hXfqI+KMgD74vQMQpCnOSO5Cs5DnbEcHko0qZM9g+ /gWtwwrDmiLdPQUI0n//0/h9twdsQ/HNfR94degSChRMctD4il7YvCsXYXUzNfQRnzv+Vp pVUIlg8RJCjB7sS2cK3wxslfRUNQtaeHa+3u6ZL6OzUMNEvOGRC/JjLGmgXOdc0GH294hV aIeCgtQsorS4rAW3/T4xjNjHszg87P/xNg4p4alZ/uBJfapzbrSOYaDx9GEAnw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840001; a=rsa-sha256; cv=none; b=U4p07ahuvoqquUbmN1uvpuCBZO4iCmh+nXXXoLiDPg1uo8DNonDTBBe3pzceMwgozYONFw tz8ho4a0nEl6wjuNoPfre7H4UvVPOBZuOkU9gicAwD5xyGgfiR7XqQ1vfsGnUR+v++okSx UCcyFeHEov9bYR+/AaQsnO6JwNP7QoW3vlVynHTXV7TLhMHBvv7uSVQ7zYW8tarPQxe7t/ MYASYV4QLdVSnopbkOLGOI49Npbssfs5oUC43zrGAU8h1imWZvzIcangr5Aji3+sm1OnsQ vwyJhWUVIMMMmQEl+3/56O8freRu6tfTbuQzUyIgCXEMXA7cHX//bTl9qUed1Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840001; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=VsOpS51jnJMZNMzF1Z5+CLrZ74iyRaSKIuze6OC2G2M=; b=qQax18s3lxGD+o9Lpf8kIghdtnpMGBUswrKBArCy5CSFrYH2LBcHtsybjFtWnagjb+fa3v x48TQvPHnPL4KDYPOyBs4eXL/Mk87Vlyron8dv0gegF/GYnaV6CMpVG+Qizl9LMaeAVEdp RlvXoDcbBvV2Mu3ZvHm8JnvJyCePvaBD1WW0mPY9/rCkJRvKXyGRI0kChK3NJvbtvzwgeG Pbs0JMkgp408zLDCwGvEmaDjTW0B+g6MkFFTxdNJY/pcO0r4N+az3/P7yCrLT7er2b5AGJ FEG4nUHASTGb6IMwcNZwy1BczstvvmwbgiIVwqcWiJ2zpG3aNVbbZ4vl4hvKFw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJd1xnlzt9h for ; Tue, 30 Jun 2026 17:20:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 455ad by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:01 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 298e912b0d8d - stable/14 - iconv: Fix a buffer overflow in the HZ encoding List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 298e912b0d8deab54dbd77cea08615e4b146cc03 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:01 +0000 Message-Id: <6a43fac1.455ad.8a07054@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=298e912b0d8deab54dbd77cea08615e4b146cc03 commit 298e912b0d8deab54dbd77cea08615e4b146cc03 Author: Mark Johnston AuthorDate: 2026-06-23 16:05:31 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:22 +0000 iconv: Fix a buffer overflow in the HZ encoding wcrtomb may store up to 2 2-byte escape sequences to the state buffer in addition to the character itself. In the worst case, a 3-byte heap overflow is possible. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57949 --- lib/libiconv_modules/HZ/citrus_hz.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index db738b8f812e..e16ab3a8e34c 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -132,7 +132,7 @@ typedef struct { typedef struct { escape_t *inuse; int chlen; - char ch[ROWCOL_MAX]; + char ch[4 + ROWCOL_MAX]; } _HZState; #define _CEI_TO_EI(_cei_) (&(_cei_)->ei) From nobody Tue Jun 30 17:20:00 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJd0VK6z6jXxw for ; Tue, 30 Jun 2026 17:20:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJc2Y8Fz3pxQ for ; Tue, 30 Jun 2026 17:20:00 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840000; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=p6mWw8TvsMiE5aSgckwBtE1MGsLbyGKTO6xdT8M5od0=; b=FHl/3itm2cUFe366pXK0eHQcZKbXV7X3l3L3zazxrkHAth9KCZor6keD+qYRtHUQj4Qc79 mavNZB4zvupBzpfyCHrjVydJPK+5ynqmk7g3InVmQsfUu9fgGTfNozx4BCieAmPbRvM5mH BaQtA/h7etSiudjzLyNi0VAuyRXh/1XSJ3qoH/gHohP7jxGPNjVEnfMpRuW4BIz6G2qdHu hQozYgQkuMkKDMS+O7g4tWF2aqPLGPnWPzXegFPnQs7HZC7u1qwn5B0pAx3EdB5fybyy8X oxXvB6rOAk0OyVqJUn9w1ao9NBBePJpiHW1zTKeclapLHaAWoqaUTMLsCcUvqw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840000; a=rsa-sha256; cv=none; b=UnxZGhBZ1/1Rqr57rbCi9HYqpzBAjhN1miPvWNUehFaKs+6a2IebOf8PXsCxjWfiZeB5al G7p4mh0LHYHSQn0dO9rYRusN8+hyLvBiJOVhN/Ur/F8kkB6EUIXhTMP9Kuh+yTo4GfJJhf Y7H0yzxkppKjf78xhZdA3ynUpH/u76QQpuu7ob0sJK0S8C/Ryt3V867Ff94gp7/Hfpy/kF hB8A/i9iwMGTcG8S8TF6G+OH7TnBB5+MkuUYYGrgLOUda75JTXK9n/+gUoals4a1v44nPe l6JB1NE1JcPXYH2J6yeC2fRf4xULmIDjGYyYYjzqBqyVZHJCJ58fILjnKr7i0g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840000; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=p6mWw8TvsMiE5aSgckwBtE1MGsLbyGKTO6xdT8M5od0=; b=l6EyOs9zs+3j+cy2aFOXXuN3fiH3WOs9/BOdIJNQZiiSj86XcNQYSNuHNfi8B4xdV+oGEA XsuNMShvT0Ep021JohivwP7W3uuf9dR4bMqWVOilxCrPc5cF6w77eSMEgCjdRz/jg6MlW1 zAjnGYKgWxd6l+ZBNQKN4Ujewjbc/ODrT5Sbn7Lgp7+KZjdE/3aVG4AExG76wa74YzA3A5 FpoCPcSF5NZqdfpl3Rmg6cvb+ZkuHOKXIHZB2UL9sxC4kfSejJt8zeI8kB/1BFzcX5lM0M jN0fc2mIqP10SgSyPginLZ6cXuCrv2Cis7dUID1BrpKvllrq1IjWQRWr3//xLw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJc1YtTzsXf for ; Tue, 30 Jun 2026 17:20:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44b69 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:00 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Taylor R Campbell From: Mark Johnston Subject: git: 399151130357 - stable/14 - iconv(3): Draft some automatic tests. List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 399151130357641c6f66f4d05f66aeed42515afc Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:00 +0000 Message-Id: <6a43fac0.44b69.438f8580@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=399151130357641c6f66f4d05f66aeed42515afc commit 399151130357641c6f66f4d05f66aeed42515afc Author: Taylor R Campbell AuthorDate: 2026-06-22 19:44:55 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:22 +0000 iconv(3): Draft some automatic tests. Based on a report by Nick Wellnhofer. Approved by: so Security: FreeBSD-SA-26:49.iconv Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57948 --- contrib/netbsd-tests/lib/libc/locale/t_iconv.c | 355 +++++++++++++++++++++++++ lib/libc/tests/locale/Makefile | 1 + 2 files changed, 356 insertions(+) diff --git a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c new file mode 100644 index 000000000000..f25c061bb170 --- /dev/null +++ b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c @@ -0,0 +1,355 @@ +/* $NetBSD$ */ + +/*- + * Copyright (c) 2025 The NetBSD Foundation, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS + * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +/* + * iconv(3) + */ + +#include +__RCSID("$NetBSD: t_mbrtoc8.c,v 1.3 2024/08/20 17:43:09 riastradh Exp $"); + +#include +#include +#include +#include +#include +#include +#include + +#include "h_macros.h" + +static const struct sample { + const char *src_codeset; + size_t nsrc; + const char *src; + const char *dst_codeset; + size_t ndst; + const char *dst; + size_t ninval; + size_t ninval_rev; + const char *xfail; +#define IRREVERSIBLE ((size_t)-1) +} samples[] = { + [0] = { "us-ascii", 6, "hello", + "us-ascii", 6, "hello", + 0, 0, NULL }, + /* LATIN SMALL LETTER E WITH ACUTE ACCENT */ + [1] = { "iso-8859-1", 1, (const char[1]){0xe9}, + "UTF-8", 2, (const char[2]){0xc3,0xa9}, + 0, 0, NULL }, + /* LEFT CURLY BRACKET */ + [2] = { "UTF-8", 2, (const char[2]){0x00,0x7b}, + "ZW", 6, (const char[6]){0x00,0x7a,0x57,0x20,0x7b,0x0a}, + 0, 0, NULL }, + /* LATIN SMALL LETTER O, TILDE */ + [3] = { "UTF-8", 2, (const char[2]){0x4f,0x7e}, + "VIQR", 3, (const char[3]){0x4f,0x5c,0x7e}, + 0, 0, NULL }, + /* LEFT CURLY BRACKET (optionally encoded in UTF-7) */ + [4] = { "UTF-7", 1, (const char[1]){0x7b}, + "UTF-8", 1, (const char[1]){0x7b}, + 0, IRREVERSIBLE, NULL }, + [5] = { "UTF-7", 4, "+AHs-", + "UTF-8", 1, (const char[1]){0x7b}, + 0, 0, NULL }, + /* éclair */ + [6] = { "UTF-7", 10, "+AOk-clair", + "UTF-8", 7, (const char[7]){ + 0xc3,0xa9,0x63,0x6c,0x61,0x69,0x72, + }, + 0, 0, NULL }, + [7] = { "HZ", 55, /* RFC 1843, Sec. 4, Example 1 */ + "The next sentence is in GB.~{<:Ky2;S{#,NpJ)l6HK!#~}Bye.", + "UTF-8", 61, (const char[61]) { + 0x54,0x68,0x65,0x20, 0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e, 0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73, 0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0xe5, 0xb7,0xb1,0xe6,0x89, + 0x80,0xe4,0xb8,0x8d, 0xe6,0xac,0xb2,0xef, + 0xbc,0x8c,0xe5,0x8b, 0xbf,0xe6,0x96,0xbd, + 0xe6,0x96,0xbc,0xe4, 0xba,0xba,0xe3,0x80, + 0x82,0x42,0x79,0x65, 0x2e + }, + 0, 0, NULL }, + /* Same as above but with HZ8 instead of HZ. */ + [8] = { "HZ8", 55, (const char[55]) { + 0x54,0x68,0x65,0x20,0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e,0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73,0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0x7e,0x7b,0xbc,0xba,0xcb, + 0xf9,0xb2,0xbb,0xd3,0xfb,0xa3,0xac,0xce, + 0xf0,0xca,0xa9,0xec,0xb6,0xc8,0xcb,0xa1, + 0xa3,0x7e,0x7d,0x42,0x79,0x65,0x2e + }, + "UTF-8", 61, (const char[61]) { + 0x54,0x68,0x65,0x20, 0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e, 0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73, 0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0xe5, 0xb7,0xb1,0xe6,0x89, + 0x80,0xe4,0xb8,0x8d, 0xe6,0xac,0xb2,0xef, + 0xbc,0x8c,0xe5,0x8b, 0xbf,0xe6,0x96,0xbd, + 0xe6,0x96,0xbc,0xe4, 0xba,0xba,0xe3,0x80, + 0x82,0x42,0x79,0x65, 0x2e + }, + 0, 0, NULL }, +}; + +#ifdef MIN +#undef MIN +#endif +#define MIN(x, y) ((x) < (y) ? (x) : (y)) + +static void +test_sample_bounded(const char *title, const struct sample *S, + size_t nsrc, size_t ndst) +{ + char inbuf[4096], inguard = arc4random(); + char outbuf[4096], outguard = arc4random(); + iconv_t C; + char *src0, *src, *dst0, *dst; + size_t srcleft0, srcleft, dstleft0, dstleft; + size_t ninval; + int error; + + ATF_REQUIRE_MSG(S->nsrc < sizeof(inbuf) - 2, "[%s]", title); + ATF_REQUIRE_MSG(S->ndst < sizeof(outbuf) - 2, "[%s]", title); + + memset(inbuf, inguard, sizeof(inbuf)); + memset(outbuf, outguard, sizeof(outbuf)); + src = src0 = inbuf + 1; + memcpy(src, S->src, nsrc); + dst = dst0 = outbuf + 1; + srcleft = srcleft0 = nsrc; + dstleft = dstleft0 = ndst; + + C = iconv_open(S->dst_codeset, S->src_codeset); + if (C == (iconv_t)-1) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv_open: %s (%d)", title, + strerror(error), error); + return; + } + + ninval = iconv(C, &src, &srcleft, &dst, &dstleft); + if (ninval == (size_t)-1) { + error = errno; + /* + * Incomplete input manifests as EINVAL -- ignore that, + * unless we're trying the full-size input. + * + * Truncated output manifests as E2BIG -- ignore that, + * unless we're trying the full-size output. + */ + if ((error != EINVAL || nsrc == S->nsrc) && + (error != E2BIG || ndst == S->ndst)) { + atf_tc_fail_nonfatal("[%s] iconv: %s (%d)", + title, strerror(error), error); + goto next; + } + } else if (ninval != S->ninval) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv:" + " %zu invalid, expected %zu", + title, ninval, S->ninval); + } + + ATF_CHECK_MSG(src0 <= src && src <= src0 + srcleft0, "[%s] iconv:" + " src went from %p to %p, expected [%p,%p]", + title, src0, src, src0, src0 + srcleft0); + ATF_CHECK_MSG(srcleft <= srcleft0, "[%s] iconv:" + " srcleft went from %zu to %zu", + title, srcleft0, srcleft); + ATF_CHECK_MSG(dst0 <= dst && dst <= dst0 + dstleft0, "[%s] iconv:" + " dst went from %p to %p, expected [%p,%p]", + title, dst0, dst, dst0, dst0 + dstleft0); + ATF_CHECK_MSG(dstleft <= dstleft0, "[%s] iconv:" + " dstleft went from %zu to %zu", + title, dstleft0, dstleft); + if (memcmp(dst0, S->dst, MIN(ndst, dstleft0 - dstleft)) != 0) { + size_t k; + + atf_tc_fail_nonfatal("[%s] iconv: bad conv", title); + fprintf(stderr, "[%s] input: ", title); + for (k = 0; k < nsrc; k++) + fprintf(stderr, " %02x", (unsigned char)S->src[k]); + fprintf(stderr, "\n"); + fprintf(stderr, "[%s] expected: ", title); + for (k = 0; k < ndst; k++) + fprintf(stderr, " %02x", (unsigned char)S->dst[k]); + fprintf(stderr, "\n"); + fprintf(stderr, "[%s] got: ", title); + for (k = 0; k < ndst; k++) + fprintf(stderr, " %02x", (unsigned char)dst0[k]); + fprintf(stderr, "\n"); + } + +next: if (dst0[-1] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran before buffer:" + " dst0[-1] = 0x%02x, expected 0x%02x", + title, dst0[-1], outguard); + } + if (dst0[ndst] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran after buffer:" + " dst0[ndst=%zu] = 0x%02x, expected 0x%02x", + title, ndst, dst0[ndst], outguard); + } + if (dst[0] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran past updated dst:" + " dst[0] = 0x%02x, expected 0x%02x", + title, dst[0], outguard); + } + + if (iconv_close(C) == -1) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv_close: %s (%d)", + title, strerror(error), error); + } +} + +static void +test_sample(const char *title, const struct sample *S) +{ + char buf[128]; + size_t nsrc, ndst; + + fprintf(stderr, "test %s from %s to %s\n", + title, S->src_codeset, S->dst_codeset); + + for (nsrc = 0; nsrc <= S->nsrc; nsrc++) { + snprintf(buf, sizeof(buf), "%s %zu/%zu", title, nsrc, S->ndst); + test_sample_bounded(buf, S, nsrc, S->ndst); + } + + for (ndst = 0; ndst <= S->ndst; ndst++) { + snprintf(buf, sizeof(buf), "%s %zu/%zu", title, S->nsrc, ndst); + test_sample_bounded(buf, S, S->nsrc, ndst); + } +} + +ATF_TC(iconv_samples); +ATF_TC_HEAD(iconv_samples, tc) +{ + + atf_tc_set_md_var(tc, "descr", "Test iconv on various fixed samples"); +} +ATF_TC_BODY(iconv_samples, tc) +{ + unsigned i; + + for (i = 0; i < __arraycount(samples); i++) { + const struct sample *S = &samples[i]; + struct sample reverse = { + .src_codeset = S->dst_codeset, + .dst_codeset = S->src_codeset, + .nsrc = S->ndst, + .src = S->dst, + .ndst = S->nsrc, + .dst = S->src, + .ninval = S->ninval_rev, + }; + char buf[128]; + + if (S->xfail) + atf_tc_expect_fail("%s", S->xfail); + + snprintf(buf, sizeof(buf), "case %u: %s to %s", i, + S->src_codeset, S->dst_codeset); + test_sample(buf, S); + if (S->ninval_rev != IRREVERSIBLE) { + snprintf(buf, sizeof(buf), "case %u: %s to %s", i, + S->dst_codeset, S->src_codeset); + test_sample(buf, &reverse); + } + + if (S->xfail) + atf_tc_expect_pass(); + } +} + +ATF_TC(iconv_pr59019_hz8); +ATF_TC_HEAD(iconv_pr59019_hz8, tc) +{ + + atf_tc_set_md_var(tc, "descr", "Truncated HZ8 input from PR 59019"); +} +ATF_TC_BODY(iconv_pr59019_hz8, tc) +{ + const char title[] = "iconv_pr59019_hz8"; + char in[4] = "\x7e\x7b\x7e\x7e"; /* ~{~~ */ + char out[4096], guard = arc4random(); + char *src0, *src, *dst0, *dst; + size_t srcleft0, srcleft, dstleft0, dstleft; + iconv_t C; + size_t ninval; + + memset(out, guard, sizeof(out)); + + REQUIRE_LIBC((C = iconv_open(/*to*/"UTF-8", /*from*/"HZ8")), + (iconv_t)-1); + + src = src0 = in; + srcleft = srcleft0 = sizeof(in); + dst = dst0 = out + 1; + dstleft = dstleft0 = sizeof(out) - 2; + + ninval = iconv(C, &src, &srcleft, &dst, &dstleft); + + /* + * XXX Not actually 100% sure this is the correct result -- I + * can't find a reference for the HZ8 encoding. + */ + ATF_CHECK_EQ_MSG(ninval, (size_t)-1, "[%s] iconv: ninval=%zu", title, + ninval); + + ATF_CHECK_MSG(src0 <= src && src <= src0 + srcleft0, "[%s] iconv:" + " src went from %p to %p, expected [%p,%p)", + title, src0, src, src0, src0 + srcleft0); + ATF_CHECK_MSG(srcleft <= srcleft0, "[%s] iconv:" + " srcleft went from %zu to %zu", + title, srcleft0, srcleft); + ATF_CHECK_MSG(dst0 <= dst && dst <= dst0 + dstleft0, "[%s] iconv:" + " dst went from %p to %p, expected [%p,%p)", + title, dst0, dst, dst0, dst0 + dstleft0); + ATF_CHECK_MSG(dstleft <= dstleft0, "[%s] iconv:" + " dstleft went from %zu to %zu", + title, dstleft0, dstleft); + + ATF_CHECK_EQ(dst0[-1], guard); + ATF_CHECK_EQ(dst0[dstleft0], guard); + + RL(iconv_close(C)); +} + +ATF_TP_ADD_TCS(tp) +{ + + ATF_TP_ADD_TC(tp, iconv_pr59019_hz8); + ATF_TP_ADD_TC(tp, iconv_samples); + + return atf_no_error(); +} diff --git a/lib/libc/tests/locale/Makefile b/lib/libc/tests/locale/Makefile index 03e89571aacd..62af569a1100 100644 --- a/lib/libc/tests/locale/Makefile +++ b/lib/libc/tests/locale/Makefile @@ -22,6 +22,7 @@ ATF_TESTS_C+= wctomb_2_test # Note: io_test requires zh_TW.Big5 locale (see ^/head@r315568) #NETBSD_ATF_TESTS_C= io_test +NETBSD_ATF_TESTS_C+= iconv_test NETBSD_ATF_TESTS_C+= mbrtowc_test NETBSD_ATF_TESTS_C+= mbstowcs_test NETBSD_ATF_TESTS_C+= mbsnrtowcs_test From nobody Tue Jun 30 17:20:07 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJm5ZCmz6jXsX for ; Tue, 30 Jun 2026 17:20:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJl4vnzz3q4S for ; Tue, 30 Jun 2026 17:20:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840007; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TzivY8bUygJf2EFsSt1I4kedo7Em7vkJKvWJWLpqccM=; b=RnhQUTtjnYIfvGIaiEpz+f/BGU08fKpen0UdVJe5F4XJSXSD8FWfrWSnDhe+nvNwXpJugN y5tMTPCzui95wTgMeM5sd9INyF0t5yQHJiIaQ8NooeveUoxj96ddBdT1P3yKe2+gU1fRlq TWzOcg+ydHVOUpaf3hztjtUxkeG0G3Mwf4pPHvps36JqO5KBYaFI8GUhMo9vsyXEbymOSu zWQRadb+U49YYtxpZtBEuQ+qbyHKtQntLGpwoEeugg5TZYQah7AdCNYFTXB4zLQ87vGeEG ou/HH8Wr+o5JrHxQz95jA7k9AZMHFI67ToctODVF0ji5Pyr2Fw16IjH2m/NdaQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840007; a=rsa-sha256; cv=none; b=gVolLlPPMAU9qCxlGqWSaJpn3BeB1H0TSDiIIuPOzw0OKmpwyFX9oEd5PFpwJjAEu6ay6l ham3aIWnYaNeUFOadeFWc0TXzbkLCOV4SxWSj49/0VZc/IWj+0EYOcfabGhHW+04zkTJpj HIIpaWODgZujT8XN5Ly2IhM39yqT2SF1Lt/49FNj8kuAnVll8HY9B6tHs5FoIlsowbPNQ9 I9TEkdH1T/1Sjx4/GsdmaOExbabbeLq2Ipdx8Gx99TYY/yikBzST7bSAzhSNp1IvCw0RAO ZkbAgG7oZGVnCvMNXDXUBZdVJiAejHOIKPIhtKp0SfRcXdgyqtbFe9LaEJQOWA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840007; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TzivY8bUygJf2EFsSt1I4kedo7Em7vkJKvWJWLpqccM=; b=xyVQSALEfgOVtZepu3okRKooqeZSRP6mKUR13kGP2hVIhzoUrWDI0/AvyVwNcEiR8keyrC T748fegCLSoC41CvQ1hA2b1SF6ZD3Nj713I9GEszphEkkWlfp17ch9g2DgtFBycy+5HFsG 0g94WaYsbdK8+qDjmHx9MbkO2ZyFBPnYUzBp4AXgJwparCtf+puwGCSsJSwdDQw5PMfDup Mo14LulsUZ34GDhpPy45H3JNU5xXdb2xR/eJv+mfvVNUYdk4RNQ7ft0qDSDksonYfYLXMR 0A7ctiOJ4yRxPL746/23FGGf/DcRjYfyozBF+MGrg8Y8A6jXIQd9foyh84MRXw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJl3tY8zsXh for ; Tue, 30 Jun 2026 17:20:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 455b1 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:07 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 21929fbe1ced - stable/15 - device_pager: Avoid double-insertion of pages into the pager list List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 21929fbe1ced1a57d4b9ff794bedb161a9b8237e Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:07 +0000 Message-Id: <6a43fac7.455b1.e0621b1@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=21929fbe1ced1a57d4b9ff794bedb161a9b8237e commit 21929fbe1ced1a57d4b9ff794bedb161a9b8237e Author: Mark Johnston AuthorDate: 2026-06-22 14:40:22 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 device_pager: Avoid double-insertion of pages into the pager list Unmanaged device pager objects maintain a linked list of pages that were returned from the fault handler. Initially, such pages are valid, but msync(MS_INVALIDATE) can mark them invalid (and clean). They are not removed from page tables (since they are unmanaged), but a subsequent mlock() call can trigger a page fault that is handled by the pager. dev_pager_getpages() then re-inserts the page into the linked list even though it's already present there. This patch fixes the problem by removing the linked list. OBJ_PG_DTOR is set, so vm_object_terminate_pages() does nothing, and dev_pager_dealloc() instead handles cleanup of the object. Add a regression test case which triggers a queue.h assertion failure in unpatched kernels. Note, in stable branches we should avoid changing the layout of struct vm_object. Approved by: so Security: FreeBSD-SA-26:37.vm Security: CVE-2026-49418 Reported by: slidybat Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57743 --- sys/vm/device_pager.c | 36 ++++++++++++++++++++---------------- sys/vm/vm_object.h | 2 +- sys/vm/vm_page.c | 6 ++++-- tests/sys/vm/mmap_test.c | 30 ++++++++++++++++++++++++++++++ 4 files changed, 55 insertions(+), 19 deletions(-) diff --git a/sys/vm/device_pager.c b/sys/vm/device_pager.c index 221969307ba4..9277d6255418 100644 --- a/sys/vm/device_pager.c +++ b/sys/vm/device_pager.c @@ -213,7 +213,8 @@ again: object1 = NULL; object->handle = handle; object->un_pager.devp.ops = ops; - TAILQ_INIT(&object->un_pager.devp.devp_pglist); + if (object->type == OBJT_DEVICE) + vm_object_set_flag(object, OBJ_PG_DTOR); TAILQ_INSERT_TAIL(&dev_pager_object_list, object, pager_object_list); mtx_unlock(&dev_pager_mtx); @@ -325,15 +326,12 @@ dev_pager_free_page(vm_object_t object, vm_page_t m) KASSERT((object->type == OBJT_DEVICE && (m->oflags & VPO_UNMANAGED) != 0), ("Managed device or page obj %p m %p", object, m)); - TAILQ_REMOVE(&object->un_pager.devp.devp_pglist, m, plinks.q); vm_page_putfake(m); } static void dev_pager_dealloc(vm_object_t object) { - vm_page_t m; - VM_OBJECT_WUNLOCK(object); object->un_pager.devp.ops->cdev_pg_dtor(object->un_pager.devp.handle); @@ -343,15 +341,25 @@ dev_pager_dealloc(vm_object_t object) VM_OBJECT_WLOCK(object); if (object->type == OBJT_DEVICE) { - /* - * Free up our fake pages. - */ - while ((m = TAILQ_FIRST(&object->un_pager.devp.devp_pglist)) - != NULL) { - if (vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL) == 0) - continue; + struct pctrie_iter pages; + vm_page_t m; - dev_pager_free_page(object, m); + vm_page_iter_init(&pages, object); +restart: + VM_RADIX_FOREACH(m, &pages) { + if (!vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL)) { + pctrie_iter_reset(&pages); + goto restart; + } + if (vm_page_iter_remove(&pages, m)) { + /* + * We could end up with invalid pages installed + * by the generic page fault handler. Typically + * these are replaced by the device pager. + */ + vm_page_free(m); + } else if ((m->flags & PG_FICTITIOUS) != 0) + dev_pager_free_page(object, m); } } object->handle = NULL; @@ -380,10 +388,6 @@ dev_pager_getpages(vm_object_t object, vm_page_t *ma, int count, int *rbehind, (object->type == OBJT_MGTDEVICE && (ma[0]->oflags & VPO_UNMANAGED) == 0), ("Wrong page type %p %p", ma[0], object)); - if (object->type == OBJT_DEVICE) { - TAILQ_INSERT_TAIL(&object->un_pager.devp.devp_pglist, - ma[0], plinks.q); - } if (rbehind) *rbehind = 0; if (rahead) diff --git a/sys/vm/vm_object.h b/sys/vm/vm_object.h index b056ebe9a4b7..694b9d77a12d 100644 --- a/sys/vm/vm_object.h +++ b/sys/vm/vm_object.h @@ -134,7 +134,7 @@ struct vm_object { * devp_pglist - list of allocated pages */ struct { - TAILQ_HEAD(, vm_page) devp_pglist; + void *spare[2]; const struct cdev_pager_ops *ops; void *handle; } devp; diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c index b39d665f9e0f..3753079f2fde 100644 --- a/sys/vm/vm_page.c +++ b/sys/vm/vm_page.c @@ -1363,8 +1363,10 @@ vm_page_putfake(vm_page_t m) KASSERT((m->oflags & VPO_UNMANAGED) != 0, ("managed %p", m)); KASSERT((m->flags & PG_FICTITIOUS) != 0, ("vm_page_putfake: bad page %p", m)); - vm_page_assert_xbusied(m); - vm_page_busy_free(m); + if (m->object != NULL) { + vm_page_assert_xbusied(m); + vm_page_busy_free(m); + } uma_zfree(fakepg_zone, m); } diff --git a/tests/sys/vm/mmap_test.c b/tests/sys/vm/mmap_test.c index 6bc30f73ca95..a94fb56c46cf 100644 --- a/tests/sys/vm/mmap_test.c +++ b/tests/sys/vm/mmap_test.c @@ -362,6 +362,35 @@ ATF_TC_BODY(mmap__maxprot_shm, tc) ATF_REQUIRE(close(fd) == 0); } +/* A regression test for a bug in the device pager. */ +ATF_TC_WITHOUT_HEAD(mmap__device_reinsert); +ATF_TC_BODY(mmap__device_reinsert, tc) +{ + void *p; + int fd; + + fd = open("/dev/devstat", O_RDONLY); + ATF_REQUIRE(fd >= 0); + + p = mmap(NULL, getpagesize(), PROT_READ, MAP_SHARED, fd, 0); + ATF_REQUIRE(p != MAP_FAILED); + + /* + * Use mlock() to trigger a fault, since msync() will not actually + * remove the page from the process page tables. + */ + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + ATF_REQUIRE(msync(p, getpagesize(), MS_INVALIDATE) == 0); + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + ATF_REQUIRE(msync(p, getpagesize(), MS_INVALIDATE) == 0); + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + + ATF_REQUIRE(munmap(p, getpagesize()) == 0); +} + ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TC(tp, mmap__map_at_zero); @@ -371,6 +400,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, mmap__write_only); ATF_TP_ADD_TC(tp, mmap__maxprot_basic); ATF_TP_ADD_TC(tp, mmap__maxprot_shm); + ATF_TP_ADD_TC(tp, mmap__device_reinsert); return (atf_no_error()); } From nobody Tue Jun 30 17:20:09 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJp1NpRz6jXbn for ; Tue, 30 Jun 2026 17:20:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJn5sKzz3pqF for ; Tue, 30 Jun 2026 17:20:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840009; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Z6y7EWylAXnqUV8ZC+eORVninlb9Cfd0cOmnrvj2Npc=; b=Sqq0EQKYeQZoZ1Mm6VA/xwC+mfdv7sWSI/mFEEtCpBQHHAjh5SnTIo8ddId+SRt0MU4MXE AC7hOaNTzkWRioQZXzyiNgZdPl9hnmeXeD7O5Bjen4YI0fgNH5c+VdLNtJN2KI50vR3KdK YB8XLpbLzOATsnnbcOfN9urURWJT/gnHeCT03PC0qnpvp2qVQWuLH9D7xFQFJICFQfGwpS 5EFRf/MSeaEpTtSe3oRu5LjfB1A8Z3mzzHSrijeHbHVNJ0+OYgK5fntlZeRfOMX4bRVHKQ +yY+1pSjQvktAeZnDpfKoR6bMGhXegwdS+g+vka2fqZxIysuHhUUhFDyymiWUg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840009; a=rsa-sha256; cv=none; b=cEIr/GjoD4w4PqAHD59Lsa3QSBEmD9ZCTWTjgN+U4dmZ8shK3z1B8RR54eCvALtPFqQS/5 L11sQoXIw4fBsN+paLxScEjchiAInSrf+2XeuptxLNoG+ienVwvmvJd7GZvacHtChrOo/a oVkkqBboOyc33vTcBo1D8286tgFCb6iEPD5rGbTn5ODu34CQ/j7EMd3hObAlHQV4EiX3BB k73Gt97iT4QQwws2U3LGwp6eXOTkyyBhD5+TBQK6vn1GIlmX+M5Ix9uHBTq4N2TNBsa+nl TzBQeVrXMa+3lI5CFYUYduxBuiJ2xMOqfSbX+as4WMZwIvwDFT+cflp/reWiHQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840009; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Z6y7EWylAXnqUV8ZC+eORVninlb9Cfd0cOmnrvj2Npc=; b=B4sRrYhszbmL5ol35XUippwIRg2ga1jJbiI/PuMQekyE2aBvxCNjV4Fr0GHMe23EPrV/B1 AGp4fXgIbBJF2g8osQHCpKUse4qypdsD8uitQEsMV/zSdHUS6CrTA1WVMHGGHYd6GClG1p AgXffOm8b5a2toLHAVZeLPgH87fDWzpnY2ZUSIHH5ztbkTu1YOJCMsqyzV39o5X6dbpOz5 0yc2p2wNO9HJo81DfrIjF8voiyn8Rk/xChm9kOYP/O3J+XIghxkuPnZWTJtTzAl1hHqsym 0QVJ7dqqoEd3sEB1SYOA6OLmUkuO5EzTsTTouSo7QYCkppi7iyBujDfOAF2ceA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJn4j55ztXQ for ; Tue, 30 Jun 2026 17:20:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44f4b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 1546794142f9 - stable/15 - tests/libalias: Add a regression test for an alias_smedia bug List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 1546794142f9eb2bd7cf149f2fc58943181ceb73 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:09 +0000 Message-Id: <6a43fac9.44f4b.4fff1c23@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=1546794142f9eb2bd7cf149f2fc58943181ceb73 commit 1546794142f9eb2bd7cf149f2fc58943181ceb73 Author: Mark Johnston AuthorDate: 2026-06-22 17:25:56 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 tests/libalias: Add a regression test for an alias_smedia bug Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57747 --- tests/sys/netinet/libalias/Makefile | 4 ++ tests/sys/netinet/libalias/smedia.c | 74 +++++++++++++++++++++++++++++++++++++ 2 files changed, 78 insertions(+) diff --git a/tests/sys/netinet/libalias/Makefile b/tests/sys/netinet/libalias/Makefile index 43bef996fae7..95816444a6d2 100644 --- a/tests/sys/netinet/libalias/Makefile +++ b/tests/sys/netinet/libalias/Makefile @@ -3,6 +3,10 @@ PACKAGE= tests TESTSDIR= ${TESTSBASE}/sys/netinet/libalias BINDIR= ${TESTSDIR} +PLAIN_TESTS_C+= smedia + +LIBADD.smedia+= sbuf + ATF_TESTS_C+= 1_instance \ 2_natout \ 3_natin \ diff --git a/tests/sys/netinet/libalias/smedia.c b/tests/sys/netinet/libalias/smedia.c new file mode 100644 index 000000000000..e181a7a538af --- /dev/null +++ b/tests/sys/netinet/libalias/smedia.c @@ -0,0 +1,74 @@ +/* + * Copyright (c) 2026 The FreeBSD Foundation + * + * This software was developed by Mark Johnston under sponsorship from + * the FreeBSD Foundation. + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +/* + * A minimal regression test for a buffer overflow in alias_rtsp_out(). + */ + +#include +#include + +#include +#include +#include +#include + +#include +#include + +#include + +int +main(void) +{ + uint8_t *packet; + struct ip ip; + struct tcphdr tcp; + struct sbuf sb; + struct libalias *la; + + sbuf_new(&sb, NULL, 0, SBUF_AUTOEXTEND); + sbuf_printf(&sb, "SETUP rtsp://example.com/media.mp4 RTSP/1.0\r\n"); + sbuf_printf(&sb, "CSeq: 1\r\n"); + sbuf_printf(&sb, "Transport: RTP/AVP;unicast;"); + for (int i = 0; i < 200; i++) + sbuf_printf(&sb, "client_port=%d-%d;", 2 * i, 2 * i + 1); + sbuf_printf(&sb, "\r\n\r\n"); + sbuf_finish(&sb); + + memset(&tcp, 0, sizeof(tcp)); + tcp.th_sport = htons(1234); + tcp.th_dport = htons(554); + tcp.th_off = 5; + + memset(&ip, 0, sizeof(ip)); + ip.ip_v = IPVERSION; + ip.ip_hl = sizeof(ip) / 4; + ip.ip_len = htons(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)); + ip.ip_id = htons(1); + ip.ip_ttl = 64; + ip.ip_p = IPPROTO_TCP; + ip.ip_src.s_addr = inet_addr("127.0.0.1"); + ip.ip_dst.s_addr = inet_addr("127.0.0.2"); + + packet = malloc(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)); + memcpy(packet, &ip, sizeof(ip)); + memcpy(packet + sizeof(ip), &tcp, sizeof(tcp)); + memcpy(packet + sizeof(ip) + sizeof(tcp), sbuf_data(&sb), + sbuf_len(&sb)); + + la = LibAliasInit(NULL); + LibAliasSetAddress(la, + (struct in_addr){.s_addr = inet_addr("127.0.0.1")}); + if (LibAliasOut(la, packet, sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)) != + PKT_ALIAS_OK) + return (1); + LibAliasUninit(la); + return (0); +} From nobody Tue Jun 30 17:20:08 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJn398Qz6jXhm for ; Tue, 30 Jun 2026 17:20:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJm5Q3Xz3psj for ; Tue, 30 Jun 2026 17:20:08 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840008; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WDZDuL9iae35XeFgaXA3qhCDIkhTZGlHZlL3SlFBrFg=; b=JxpEJGJ+VIpuC/4WrJC7GYpvV2bTGVhOqEp8gFSoW7P9K6hBlwzLUTX7UCSm7pQ9a28a/0 bw5u9ldQfFzvleVHHSSmzg82AM9IphL5zHeJTY+gOkfdxzx5o8cICF0/yYnnoIx+HFn/gp SUyATxK5KkJ0Jv5WtpmDXQOVwG/aE9N2Z8NgtnJ+oX3KqbvqdmV2YyFywPiYovfUKnfi3F NWAWgPLLwvAD87SmvWKYKASelPuQVaUw33TWmsKYsUFVkWb3XfFSJHc6qnb0uRcr67VfPm aPhIFmlPU7BWYsnmmgsMCG8xyGFpDz4sIjSTW15RTBXxTXniCIB5B2t3wW3Fqg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840008; a=rsa-sha256; cv=none; b=JpId2VY/a0fEc7JjdCqmqTtMGePAyP0EyVAiSmNhl5tW7iObfOk6HHVQrHleQBNOBbIXg7 WqO5WJZbUdXMtZHOGZ1bGo+Kl1cZOJGA+dmfMri8uyklEzXD/HxXIxS5u6Ah1pvJ9fc2lM nM0wkHuJjFbi5caQ50ixC7I0uB/izDccI4NKFWaSgj5CJmzlfRKiJnx7SJJz3baccK+9nt HqBF0JTRyHeqOi7TmWPNizOf+nCpmbA6j44lAmhA1tcZAb73EmdMCVop3xTe7M17iE8xnH 5dZlOsDHemYXmXcdL+HqskPuxjpGs8Owmlk7DhjmpR21zTF2p248CcC/4gy5tw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840008; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WDZDuL9iae35XeFgaXA3qhCDIkhTZGlHZlL3SlFBrFg=; b=vM0/1OY4hto4voZwWqNc/pUCTmoc5A6yl6jBsro9gUi9MC0NI9soh+RERXaFSRTkPxS8ON TvH0sznCqMGxkv0mlmEisz+iYua18EpovTjZYKWomk8Y+RGtNa1W7B0CIZYnetyq9HaGh0 vi7n/WGOdXRqHkhzNnXwWXWBwYObZLLHjVlJxiletmBXAdn44K+a+GAIFmcbOstovw5rhL 57Gs6HEv3ekqv56Q+IkN7lfH0XL76DbGMgfiHUI6UgXJeaHgK/vjGEkkFf5d0JITwgNBHQ YmmJnRfB149RR1mh0JxYCqjr3cJgBBBdxh7rnPkTWhLNGBwJzumfsbYa/uI5Og== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJm4KLbztDD for ; Tue, 30 Jun 2026 17:20:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4588c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:08 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav From: Mark Johnston Subject: git: cb5f47a761fe - stable/15 - libalias: Fix buffer overflow in RTSP aliasing List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: cb5f47a761fefaf9b86ed500e5563d872f23f2cd Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:08 +0000 Message-Id: <6a43fac8.4588c.4253db3b@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=cb5f47a761fefaf9b86ed500e5563d872f23f2cd commit cb5f47a761fefaf9b86ed500e5563d872f23f2cd Author: Dag-Erling Smørgrav AuthorDate: 2026-06-28 22:10:40 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 libalias: Fix buffer overflow in RTSP aliasing In alias_rtsp_out(), we construct a new packet in a fixed-length buffer before copying it back into the original buffer. We never checked if the data we were writing to this temporary buffer fit in it, nor if the result fit in the original buffer. * Use a dynamically sized allocated buffer instead of a fixed-length stack buffer. * Check for overflow before appending to our temporary buffer. * Check for overflow before copying the data back to the packet buffer. * While here, use size_t for sizes and bool for booleans. Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 MFC after: 1 week Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D57753 --- sys/netinet/libalias/alias_smedia.c | 156 ++++++++++++++++++++---------------- 1 file changed, 89 insertions(+), 67 deletions(-) diff --git a/sys/netinet/libalias/alias_smedia.c b/sys/netinet/libalias/alias_smedia.c index badd75a45c61..cbfe30940596 100644 --- a/sys/netinet/libalias/alias_smedia.c +++ b/sys/netinet/libalias/alias_smedia.c @@ -104,8 +104,9 @@ #include #include #else -#include #include +#include +#include #include #include #endif @@ -128,9 +129,9 @@ #define RTSP_CONTROL_PORT_NUMBER_2 7070 #define TFTP_PORT_NUMBER 69 -static void -AliasHandleRtspOut(struct libalias *, struct ip *, struct alias_link *, - int maxpacketsize); +static void AliasHandleRtspOut(struct libalias *, struct ip *, + struct alias_link *, size_t); + static int fingerprint(struct libalias *la, struct alias_data *ah) { @@ -154,7 +155,8 @@ protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah) if (ntohs(*ah->dport) == TFTP_PORT_NUMBER) FindRtspOut(la, pip->ip_src, pip->ip_dst, *ah->sport, *ah->aport, IPPROTO_UDP); - else AliasHandleRtspOut(la, pip, ah->lnk, ah->maxpktsize); + else + AliasHandleRtspOut(la, pip, ah->lnk, ah->maxpktsize); return (0); } @@ -208,13 +210,15 @@ MODULE_DEPEND(alias_smedia, libalias, 1, 1, 1); #define ISDIGIT(a) (((a) >= '0') && ((a) <= '9')) -static int -search_string(char *data, int dlen, const char *search_str) +static ssize_t +search_string(char *data, size_t dlen, const char *search_str) { - int i, j, k; - int search_str_len; + size_t i, j, k; + size_t search_str_len; search_str_len = strlen(search_str); + if (search_str_len > dlen) + return (-1); for (i = 0; i < dlen - search_str_len; i++) { for (j = i, k = 0; j < dlen - search_str_len; j++, k++) { if (data[j] != search_str[k] && @@ -230,18 +234,21 @@ search_string(char *data, int dlen, const char *search_str) static int alias_rtsp_out(struct libalias *la, struct ip *pip, struct alias_link *lnk, - char *data, + char *data, size_t maxlen, const char *port_str) { - int hlen, tlen, dlen; + size_t hlen, tlen, dlen; + size_t i, j; struct tcphdr *tc; - int i, j, pos, state, port_dlen, new_dlen, delta; + int delta, state; + ssize_t pos, slen; + size_t new_dlen, port_dlen, port_slen; u_short p[2], new_len; u_short sport, eport, base_port; u_short salias = 0, ealias = 0, base_alias = 0; const char *transport_str = "transport:"; - char newdata[2048], *port_data, *port_newdata, stemp[80]; - int links_created = 0, pkt_updated = 0; + char *newdata, *port_data; + bool links_created = false, pkt_updated = false; struct alias_link *rtsp_lnk = NULL; struct in_addr null_addr; @@ -250,6 +257,9 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, hlen = (pip->ip_hl + tc->th_off) << 2; tlen = ntohs(pip->ip_len); dlen = tlen - hlen; + if (hlen > tlen || tlen > maxlen) + return (-1); + port_slen = strlen(port_str); /* Find keyword, "Transport: " */ pos = search_string(data, dlen, transport_str); @@ -259,17 +269,21 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, port_data = data + pos; port_dlen = dlen - pos; + /* Allocate temporary buffer */ + maxlen -= hlen; + if ((newdata = malloc(maxlen)) == NULL) + return (-1); memcpy(newdata, data, pos); - port_newdata = newdata + pos; + new_dlen = pos; - while (port_dlen > (int)strlen(port_str)) { + while (port_dlen > port_slen) { /* Find keyword, appropriate port string */ pos = search_string(port_data, port_dlen, port_str); - if (pos < 0) + if (pos < 0 || (size_t)pos + 1 > maxlen - new_dlen) break; - memcpy(port_newdata, port_data, pos + 1); - port_newdata += (pos + 1); + memcpy(newdata + new_dlen, port_data, pos + 1); + new_dlen += pos + 1; p[0] = p[1] = 0; sport = eport = 0; @@ -300,7 +314,7 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, eport = htons(p[1]); if (!links_created) { - links_created = 1; + links_created = true; /* * Find an even numbered port * number base that satisfies the @@ -349,24 +363,30 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, ealias = htons(base_alias + (RTSP_PORT_GROUP - 1)); } if (salias && rtsp_lnk) { - pkt_updated = 1; + pkt_updated = true; /* Copy into IP packet */ - sprintf(stemp, "%d", ntohs(salias)); - memcpy(port_newdata, stemp, strlen(stemp)); - port_newdata += strlen(stemp); + slen = snprintf(newdata + new_dlen, + maxlen - new_dlen, "%d", ntohs(salias)); + if (slen < 0 || slen >= maxlen - new_dlen) + goto fail; + new_dlen += slen; if (eport != 0) { - *port_newdata = '-'; - port_newdata++; + if (new_dlen == maxlen) + goto fail; + newdata[new_dlen++] = '-'; /* Copy into IP packet */ - sprintf(stemp, "%d", ntohs(ealias)); - memcpy(port_newdata, stemp, strlen(stemp)); - port_newdata += strlen(stemp); + slen = snprintf(newdata + new_dlen, + maxlen - new_dlen, "%d", ntohs(ealias)); + if (slen < 0 || slen >= maxlen - new_dlen) + goto fail; + new_dlen += slen; } - *port_newdata = ';'; - port_newdata++; + if (new_dlen == maxlen) + goto fail; + newdata[new_dlen++] = ';'; } state++; break; @@ -380,20 +400,20 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, } if (!pkt_updated) - return (-1); - - memcpy(port_newdata, port_data, port_dlen); - port_newdata += port_dlen; - *port_newdata = '\0'; + goto fail; /* Create new packet */ - new_dlen = port_newdata - newdata; + if (new_dlen + port_dlen > maxlen) + goto fail; + memmove(data + new_dlen, port_data, port_dlen); memcpy(data, newdata, new_dlen); + new_dlen += port_dlen; + free(newdata); SetAckModified(lnk); tc = (struct tcphdr *)ip_next(pip); delta = GetDeltaSeqOut(tc->th_seq, lnk); - AddSeq(lnk, delta + new_dlen - dlen, pip->ip_hl, pip->ip_len, + AddSeq(lnk, delta + (int)(new_dlen - dlen), pip->ip_hl, pip->ip_len, tc->th_seq, tc->th_off); new_len = htons(hlen + new_dlen); @@ -407,6 +427,9 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, tc->th_sum = TcpChecksum(pip); #endif return (0); +fail: + free(newdata); + return (-1); } /* Support the protocol used by early versions of RealPlayer */ @@ -415,13 +438,13 @@ static int alias_pna_out(struct libalias *la, struct ip *pip, struct alias_link *lnk, char *data, - int dlen) + size_t dlen) { struct alias_link *pna_links; - u_short msg_id, msg_len; char *work; - u_short alias_port, port; struct tcphdr *tc; + u_short msg_id, msg_len; + u_short alias_port, port; work = data; work += 5; @@ -433,7 +456,7 @@ alias_pna_out(struct libalias *la, struct ip *pip, if (ntohs(msg_id) == 0) /* end of options */ return (0); - if ((ntohs(msg_id) == 1) || (ntohs(msg_id) == 7)) { + if (ntohs(msg_id) == 1 || ntohs(msg_id) == 7) { memcpy(&port, work, 2); (void)FindUdpTcpOut(la, pip->ip_src, GetDestAddress(lnk), port, 0, IPPROTO_UDP, 1, &pna_links); @@ -462,22 +485,23 @@ alias_pna_out(struct libalias *la, struct ip *pip, } static void -AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, int maxpacketsize) +AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, + size_t maxlen) { - int hlen, tlen, dlen; struct tcphdr *tc; char *data; const char *setup = "SETUP", *pna = "PNA", *str200 = "200"; const char *okstr = "OK", *client_port_str = "client_port"; const char *server_port_str = "server_port"; - int i, parseOk; - - (void)maxpacketsize; + size_t hlen, tlen, dlen; + size_t i; tc = (struct tcphdr *)ip_next(pip); hlen = (pip->ip_hl + tc->th_off) << 2; tlen = ntohs(pip->ip_len); dlen = tlen - hlen; + if (hlen > tlen || tlen > maxlen) + return; data = (char *)pip; data += hlen; @@ -485,13 +509,14 @@ AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, /* When aliasing a client, check for the SETUP request */ if ((ntohs(tc->th_dport) == RTSP_CONTROL_PORT_NUMBER_1) || (ntohs(tc->th_dport) == RTSP_CONTROL_PORT_NUMBER_2)) { - if (dlen >= (int)strlen(setup) && + if (dlen >= strlen(setup) && memcmp(data, setup, strlen(setup)) == 0) { - alias_rtsp_out(la, pip, lnk, data, client_port_str); + alias_rtsp_out(la, pip, lnk, data, maxlen, + client_port_str); return; } - if (dlen >= (int)strlen(pna) && + if (dlen >= strlen(pna) && memcmp(data, pna, strlen(pna)) == 0) alias_pna_out(la, pip, lnk, data, dlen); } else { @@ -499,24 +524,21 @@ AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, * When aliasing a server, check for the 200 reply * Accommodate varying number of blanks between 200 & OK */ - - if (dlen >= (int)strlen(str200)) { - for (parseOk = 0, i = 0; - i <= dlen - (int)strlen(str200); - i++) - if (memcmp(&data[i], str200, strlen(str200)) == 0) { - parseOk = 1; - break; - } - - if (parseOk) { - i += strlen(str200); /* skip string found */ - while (data[i] == ' ') /* skip blank(s) */ + if (dlen < strlen(str200) + 1 + strlen(okstr)) + return; + for (i = 0; i <= dlen - strlen(str200) - 1; i++) { + if (memcmp(&data[i], str200, strlen(str200)) == 0 && + data[i + strlen(str200)] == ' ') { + i += strlen(str200); /* skip 200 */ + while (i < dlen && data[i] == ' ') /* skip blank(s) */ i++; - - if ((dlen - i) >= (int)strlen(okstr)) - if (memcmp(&data[i], okstr, strlen(okstr)) == 0) - alias_rtsp_out(la, pip, lnk, data, server_port_str); + if (dlen - i >= strlen(okstr)) { + if (memcmp(&data[i], okstr, strlen(okstr)) == 0) { + alias_rtsp_out(la, pip, lnk, data, + maxlen, server_port_str); + break; + } + } } } } From nobody Tue Jun 30 17:20:11 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJr1fdbz6jXhx for ; Tue, 30 Jun 2026 17:20:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJq6dGcz3q77 for ; Tue, 30 Jun 2026 17:20:11 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840012; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mxRoR1AzkCv9+3T2TQ1uIsQDQUg+Ji0PHlqBZtWOrIg=; b=LYPlUdswOUp5aTKdTjfh09At3wGZHe7zkiRP9grtxc5axINdD2pjyqtGNpT4bfOsUF9yti qV0JrYulgjsuP5H9EfQi5WFycoKqlP2BfHLwcOi6REOvMCID/h/U+5ER4EM3y8PCQ6XcPe E0IX2WVNNp6QkQqAVQ3rWEyVL7tH8P9VGDqUKSmTmNypzitRjIaaRl3yC0azpxAtPPd9Yu 0z1BG6X7/95Y90IijIdBUp8wlt53qXQEP8v7usxCsixJc7nujuzx69STT1IvQsNoa3QkEP c3n5Hslb018JTuOEwGeeqt53RLWQRf7ihgbz8v1Ul+9sadmTkCipJ9p//TosSQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840012; a=rsa-sha256; cv=none; b=mccIMHvVTtK11vxTyVL7fyLzNf2FBYQFWXnrrSvsnaCzBCpBmcN+F1ekntKOZlGOdiKQ08 AKkrpfWTkqlSGukf4tPMuxWl+9TtgIQqAvvb6594tfJSBIAJiXcQN1rrchdvc2x/7y54sC hT76qbNvwHWLhJy99bE4k3dDWAQI7t87pGGAJI3laC/E2jQsQCjew/qoueVwE94uITnc8p /MKF6G2Y9uOtLYbEg6Qj5lAgEsM1cH0PowifVQLE0YV0Qz6qltzgv6POt9Osg86fleKWOr MqlsUoaDkU62Y+M67v7cW9Izh0U+kksWk6Y5MYtXj6vJhxxoIDOEbFsDtldY+w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840012; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mxRoR1AzkCv9+3T2TQ1uIsQDQUg+Ji0PHlqBZtWOrIg=; b=TsLPgmroiTqinpM0SbKsfXO7uycpLDiAyRR7RZOZNWpc7Yp4va6nhbPJs5fKdCXMFdNQd+ WDxGBo6RSiZG7AMhmnd6MEpbwqgHsEYpBctrmbzefVuCfRrkqVBUyUkEqqbGkgggS/KlRW ggRkBbqBV5sIeVwVJVtt2GTFNJtOb6Z30A1X5wjQBlNWBGR+2chZqbqDJuletl5hEhkBZc sUojirOJoe8ZbZdBrHFAerHSkNDEalOT2c+1dvyGRJg0rmIw1Iy55Z59dTT9f9tD6yVksH g1Rg0Hqn6d0BJb/s7Vxzggm+vvNQyNdh7jULOBV1bOsxdnGgl5x7+XZSUsRt3w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJq5cbCzt9q for ; Tue, 30 Jun 2026 17:20:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4452c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:11 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: aed4c4dd9afc - stable/15 - rack: Reload the TCP stack PCB after reacquiring the inpcb lock List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: aed4c4dd9afce3059ab582315d9049544e447a93 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:11 +0000 Message-Id: <6a43facb.4452c.6a88177f@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=aed4c4dd9afce3059ab582315d9049544e447a93 commit aed4c4dd9afce3059ab582315d9049544e447a93 Author: Mark Johnston AuthorDate: 2026-06-23 21:46:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 rack: Reload the TCP stack PCB after reacquiring the inpcb lock Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791 --- sys/netinet/tcp_stacks/rack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index 219cf2758ff2..86ea34f46a05 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -24136,6 +24136,7 @@ process_opt: INP_WUNLOCK(inp); return (ENOPROTOOPT); } + rack = (struct tcp_rack *)tp->t_fb_ptr; if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_HYBRID_PACING) && From nobody Tue Jun 30 17:20:10 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJq1PBtz6jXfX for ; Tue, 30 Jun 2026 17:20:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJp6WfYz3qBq for ; Tue, 30 Jun 2026 17:20:10 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840010; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Rd7qt06Q2oV8ZZA62S1E4K9YR78/qotA5WlpktruMuU=; b=yBwgcP55+2G9I2QvA+6K8o24AR1jwtyXbBdkSEspHaDn7Y0wgUOEgvbJ9kaKSdyKgF08Tm 6ixEfHC3jdoMYE9/pccxdg5fja5Z2S2bXuZOHdOijX4y/aj/zE1bFxDj/tFDJlugMHL+jY uU3aGJc3cuxFhfp4q9PWy5cA9qqrAMU6ny8Ts0u8ytByOmYSHakgFUKHHdsJmy/fX9qPnx vmabJCR0DMC0bbepzYU26ECHKQL0qEXveAyrpG9SoGbNUUyTkY1gRjQbAjsTWSJitXjNDf 7MUEuzEp7K93OTrk89IaS0s1Eqh9WosWhSQbtDKem2KGgxvQ132HFHSmnii5dg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840010; a=rsa-sha256; cv=none; b=e70MKsdqgVSiFsm/IEqSBBh/F4iQMrilUlcY9k1xlbBfcvBcQoW+oYVJidhdDffxFFLU92 Yg9L2AgZENGSSviInNv89TTcO1J7TnZBTzG06Rz8a9nfdSDJMvZJxT/kdgum4dmvgjNkRC QDV4wPID2x2ezyamFOhz3hf3EFSG5IG0QWs9NQlTPW1zRCUysP5oAIW4rD+p1Puyb+kaB+ 2ROz1gNurPF3BAKQAbKGVO+880tOfe0f3mY0fAveU1BcLe+Y/wCw1ZZQrXGqQwmzmEYBZ7 02rzlkhNZwln7lFHxS0brw2+dymeSBjCfDcwYsvPxtc93aY8HZ6Wvc/BGYJvOg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840010; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Rd7qt06Q2oV8ZZA62S1E4K9YR78/qotA5WlpktruMuU=; b=Y0cbenmHhYDDrmHjoayriqFRgT3vWWps2ow9PTbqOVKAoJnZT/08xlnZsqd2guszcDz13+ mMZ1uPgBPZ9PfNWGadPSYnaBknop0wMAZanzeyIyvGcEj8p2yRojmBs4koy86PDHCeB66d 1yKw321Ep12c+YBw8Km8uB6CdVXxGmRXQ8/xfADz/ciVBrejDgvsEyuTyebCYZ+NqAfJBV 6vRrpWmn2391rx0qBz7Y+pBVay4/wltu21gFcAxWE8qHtWiwu884bmIghvafIdoHR88oJV cCELjQAuyKEK3JCvkaE3fRnEtKmC6iDOmJxucRuBX6vtnZrPFPknDXKS29kBDA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJp5MKqztRb for ; Tue, 30 Jun 2026 17:20:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44344 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:10 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 45f1fcb9d2f7 - stable/15 - unlinkat: Pass flags down to the work functions List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 45f1fcb9d2f79b9aef532f32a4ed8180d5b59b11 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:10 +0000 Message-Id: <6a43faca.44344.75ef360f@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=45f1fcb9d2f79b9aef532f32a4ed8180d5b59b11 commit 45f1fcb9d2f79b9aef532f32a4ed8180d5b59b11 Author: Mark Johnston AuthorDate: 2026-06-23 20:43:53 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 unlinkat: Pass flags down to the work functions The unlinkat(2) and funlinkat(2) system calls were ignoring AT_RESOLVE_BENEATH. Also pass pathseg through instead of assuming it's UIO_USERSPACE. Add some tests which make sure that AT_RESOLVE_BENEATH is handled properly by various system calls. Approved by: so Security: FreeBSD-SA-26:42.unlinkat Security: CVE-2026-49421 Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57790 --- sys/kern/vfs_syscalls.c | 11 +- tests/sys/kern/Makefile | 1 + tests/sys/kern/resolve_beneath_test.c | 220 ++++++++++++++++++++++++++++++++++ 3 files changed, 227 insertions(+), 5 deletions(-) diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index ef3f7b3e8184..2e6b4e9a3cad 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -1976,16 +1976,17 @@ sys_unlink(struct thread *td, struct unlink_args *uap) static int kern_funlinkat_ex(struct thread *td, int dfd, const char *path, int fd, - int flag, enum uio_seg pathseg, ino_t oldinum) + int flags, enum uio_seg pathseg, ino_t oldinum) { - if ((flag & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) + if ((flags & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) return (EINVAL); - if ((flag & AT_REMOVEDIR) != 0) - return (kern_frmdirat(td, dfd, path, fd, UIO_USERSPACE, 0)); + if ((flags & AT_REMOVEDIR) != 0) + return (kern_frmdirat(td, dfd, path, fd, pathseg, + flags & ~AT_REMOVEDIR)); - return (kern_funlinkat(td, dfd, path, fd, UIO_USERSPACE, 0, 0)); + return (kern_funlinkat(td, dfd, path, fd, pathseg, flags, 0)); } #ifndef _SYS_SYSPROTO_H_ diff --git a/tests/sys/kern/Makefile b/tests/sys/kern/Makefile index b581d1e6ca30..4fe194771f56 100644 --- a/tests/sys/kern/Makefile +++ b/tests/sys/kern/Makefile @@ -40,6 +40,7 @@ ATF_TESTS_C+= procdesc ATF_TESTS_C+= ptrace_test TEST_METADATA.ptrace_test+= timeout="15" ATF_TESTS_C+= reaper +ATF_TESTS_C+= resolve_beneath_test ATF_TESTS_C+= sched_affinity ATF_TESTS_C+= shutdown_dgram ATF_TESTS_C+= sigaltstack diff --git a/tests/sys/kern/resolve_beneath_test.c b/tests/sys/kern/resolve_beneath_test.c new file mode 100644 index 000000000000..b83926038ded --- /dev/null +++ b/tests/sys/kern/resolve_beneath_test.c @@ -0,0 +1,220 @@ +/* + * Copyright (c) 2026 The FreeBSD Foundation + * + * This software was written by Mark Johnston under sponsorship from + * the FreeBSD Foundation. + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +#include +#include + +#include +#include +#include + +#include + +/* + * Verify that AT_RESOLVE_BENEATH is respected by various system calls. + */ + +static int +setup(void) +{ + int fd, tfd; + + ATF_REQUIRE_EQ(0, mkdir("base", 0755)); + ATF_REQUIRE_EQ(0, mkdir("outside", 0755)); + ATF_REQUIRE((tfd = open("outside/target", O_CREAT | O_WRONLY, 0644)) >= + 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("outside/dir", 0755)); + ATF_REQUIRE((tfd = open("base/file", O_CREAT | O_WRONLY, 0644)) >= 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("base/subdir", 0755)); + ATF_REQUIRE((fd = open("base", O_DIRECTORY | O_RDONLY)) >= 0); + return (fd); +} + +ATF_TC_WITHOUT_HEAD(faccessat_beneath); +ATF_TC_BODY(faccessat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + faccessat(fd, "file", F_OK, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + faccessat(fd, "../outside/target", F_OK, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(chflagsat_beneath); +ATF_TC_BODY(chflagsat_beneath, tc) +{ + int fd, ret; + + fd = setup(); + ret = chflagsat(fd, "file", UF_NODUMP, AT_RESOLVE_BENEATH); + if (ret != 0) + ATF_REQUIRE_EQ(EOPNOTSUPP, errno); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + chflagsat(fd, "../outside/target", UF_NODUMP, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchmodat_beneath); +ATF_TC_BODY(fchmodat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchmodat(fd, "file", 0644, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchmodat(fd, "../outside/target", 0644, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchownat_beneath); +ATF_TC_BODY(fchownat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchownat(fd, "file", -1, -1, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchownat(fd, "../outside/target", 0, 0, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(utimensat_beneath); +ATF_TC_BODY(utimensat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + utimensat(fd, "file", NULL, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + utimensat(fd, "../outside/target", NULL, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(linkat_beneath); +ATF_TC_BODY(linkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + linkat(fd, "file", fd, "hardlink", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + linkat(fd, "../outside/target", fd, "hardlink2", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_beneath); +ATF_TC_BODY(unlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "file", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/target", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_rmdir_beneath); +ATF_TC_BODY(unlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "subdir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/dir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_beneath); +ATF_TC_BODY(funlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "file", FD_NONE, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/target", FD_NONE, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_rmdir_beneath); +ATF_TC_BODY(funlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, mkdir("base/subdir2", 0755)); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "subdir2", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/dir", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC(getfhat_beneath); +ATF_TC_HEAD(getfhat_beneath, tc) +{ + atf_tc_set_md_var(tc, "require.user", "root"); +} +ATF_TC_BODY(getfhat_beneath, tc) +{ + fhandle_t fh; + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + getfhat(fd, "file", &fh, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + getfhat(fd, "../outside/target", &fh, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TP_ADD_TCS(tp) +{ + ATF_TP_ADD_TC(tp, faccessat_beneath); + ATF_TP_ADD_TC(tp, chflagsat_beneath); + ATF_TP_ADD_TC(tp, fchmodat_beneath); + ATF_TP_ADD_TC(tp, fchownat_beneath); + ATF_TP_ADD_TC(tp, utimensat_beneath); + ATF_TP_ADD_TC(tp, linkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, funlinkat_beneath); + ATF_TP_ADD_TC(tp, funlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, getfhat_beneath); + return (atf_no_error()); +} From nobody Tue Jun 30 17:20:12 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJs5Gjlz6jY1J for ; Tue, 30 Jun 2026 17:20:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJs0Df6z3q2j for ; Tue, 30 Jun 2026 17:20:13 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840013; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zaKUqlECE+EEcQ6A75NnNeS0OV/M7Qk6EreQcknwr5c=; b=o9d4BcCLNgqKVjzzX1OmcbuomXqfRsmaVlRGHhuXlISw1kmnFWNMmUA6E4E31Prc06g/N+ +8rdvQPts8HHzgAMB+TzP1woO8LkFtFVb2HxOPFawzQXKFh2m5pNCh5EGk7APnMWKTDaMs 7+O+jm3EWHvDuAhc2u6KG3ouYJI5Q6IRjbijE2dT1k4NKQQfNoV5XDrSzaFwiH5DgzsIp7 i0uCg/i8dxcYTtVmO/IfLaVA5z/7ORuIg7pQZZlh/nDelbKPDk6puP+T130nTGDLv5g9zu 3J6AWqM1oLgecPBf5x7SMhzLkSrxYSCvDLEbf/nkWx5Dn6wJU8dcyOvDpyAfdQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840013; a=rsa-sha256; cv=none; b=cepEAl3JdxmWk9GH7W2CR4S/QPBkeyGdnE6O5qJDQwBNbbdo6UP0z8YNiJUuGplPMCoidP EEJyqfgQYkifQg/P1r24oSFnFYtDH6f+jlbHOAa/HUpYt/1s1GZMiDILXZ/WAdjr34m8Nd 1qLBucoox1I7dF31Dw6em7Nhr6fVrxcjY1Of+RZ7upra2srcZBzC56D8zO1C95YdSfFF6J QarMj14Yzv0tmUNKDDpAH1ri1AQqHWHYeb2/t7/BqSFfYx9k50GNvWnTjwGBxLRLUvZRnC AkWD2s3HBtrqB3AOU9zsVii4I59ZkpH6l8dhw8E1O+mYR5lW1AtWhpR3LfX9OQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840013; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zaKUqlECE+EEcQ6A75NnNeS0OV/M7Qk6EreQcknwr5c=; b=NizCTiPlacJMkRK4jQ99abnfUKV2FsBYeEjLMIosoZ6z3GUBUfpFhtV7ySyrZoCIKvYXJu 3P5ECcej1EEhYTrq9lIXVR61eaB0suSknobMGwc2moZ7YnqYg9brE0jLuI0TQqZveJH3zf fkS2jWjmCBNoDNc3huYvzuBHXfVPpgEAXyn7n3micaTB01fg9uxRO2kCL4sTFikAAiui3v JZgd3Ry0wd17L8BBVFZmQ1Dv6qjW5nOzab97udJytARQbZ3poCYx+cmqo+75AjNu2VBPqN ajpW5jCZuq/n1TfsZqusJe3xNLVnArlp0nFjOfDo8ApkaocTus5l+OZJAuUNQA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJr5ywgztXS for ; Tue, 30 Jun 2026 17:20:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 444e0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:12 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 57e705434b34 - stable/15 - posixshm: Disallow fspacectl() on largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 57e705434b346d91e845ef5e2e35a2502624cbba Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:12 +0000 Message-Id: <6a43facc.444e0.d5ce505@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=57e705434b346d91e845ef5e2e35a2502624cbba commit 57e705434b346d91e845ef5e2e35a2502624cbba Author: Mark Johnston AuthorDate: 2026-06-24 19:56:07 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 posixshm: Disallow fspacectl() on largepage objects As with truncation, the operation isn't supported, but nothing prevented it. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57830 --- sys/kern/uipc_shm.c | 5 ++++- tests/sys/posixshm/posixshm_test.c | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index 197409d97f0c..d965576ecd9c 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -2096,11 +2096,14 @@ shm_fspacectl(struct file *fp, int cmd, off_t *offset, off_t *length, int flags, ("shm_fspacectl: non-zero flags")); KASSERT(*offset >= 0 && *length > 0 && *length <= OFF_MAX - *offset, ("shm_fspacectl: offset/length overflow or underflow")); - error = EINVAL; + shmfd = fp->f_data; off = *offset; len = *length; + if (shm_largepage(shmfd)) + return (ENOTSUP); + rl_cookie = shm_rangelock_wlock(shmfd, off, off + len); switch (cmd) { case SPACECTL_DEALLOC: diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index fe6386c6aa4b..6729c33a789d 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -1369,6 +1369,27 @@ ATF_TC_BODY(largepage_config, tc) ATF_REQUIRE(close(fd) == 0); } +ATF_TC_WITHOUT_HEAD(largepage_fspacectl); +ATF_TC_BODY(largepage_fspacectl, tc) +{ + struct spacectl_range range; + size_t ps[MAXPAGESIZES]; + int fd, pscnt; + + pscnt = pagesizes(ps, true); + + for (int i = 1; i < pscnt; i++) { + fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, ps[i]); + + range.r_offset = 0; + range.r_len = ps[i]; + ATF_REQUIRE_ERRNO(ENOTSUP, + fspacectl(fd, SPACECTL_DEALLOC, &range, 0, &range) == -1); + + ATF_REQUIRE(close(fd) == 0); + } +} + ATF_TC_WITHOUT_HEAD(largepage_mmap); ATF_TC_BODY(largepage_mmap, tc) { @@ -2165,6 +2186,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, mmap_prot); ATF_TP_ADD_TC(tp, largepage_basic); ATF_TP_ADD_TC(tp, largepage_config); + ATF_TP_ADD_TC(tp, largepage_fspacectl); ATF_TP_ADD_TC(tp, largepage_mmap); ATF_TP_ADD_TC(tp, largepage_munmap); ATF_TP_ADD_TC(tp, largepage_madvise); From nobody Tue Jun 30 17:20:13 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJt4qY5z6jY3l for ; Tue, 30 Jun 2026 17:20:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJt0kXdz3qCF for ; Tue, 30 Jun 2026 17:20:14 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840014; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=T6GGNxNKfrCVdZiU8moR07up1PveIugLvwoILK+F1s4=; b=i/QFWynLrBYQlSw6DdpHYgkpsD7GUQ+wUO/sMH6qnV14bhPMAWg+pxBgn0rUvNFCxK6pcO jmNc0YyyHAZKAC5YYbKXxcI+nTnBMRCYzeza4LnEVolpqPKJqKC+nP2+IgATAwfGFT2HHi alDNkrLTy+OIyTfQA7geaL4o7aX8r56frgnYzOCTsNOIfMQcVsa4An4V2Lse7pH3TLvjx+ QAYsKQXtKNbD0V7FufycrVQP4sZr6bfPHFMDL3rZaWzIa99w6lzLWz1v8tu3+q7r2P/1tQ v5dhZmWB7a4yjRVeNvpVk7l8GWEB7QGQdMq2sZ6YScZIUlKOyxUSuP44ZTIxrg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840014; a=rsa-sha256; cv=none; b=jlK+GrpoZNIKRvmvV6vZb0vBTu0SUyuOh9Wn/oS8nPwzwmtQpwIc8JzriE0a7O1XKZp5Lp DPDQWdgBAhAaKrIGbdaA5yVePxjJ0l6XBOXYu0fvfdmRqWbmV8W7qttExfAQtPf0fY0v2j 6rG9T2DI2taHEowxiEOOFP0umXvS/W2hL5uH2rubcH1utP3A8lqOJ14D1EkCuPL+2rg+zR mzBlhvNHo/BXxGgkoTPGBfB3zDeR3VSRTha45qqJT4y8/CKaHW2v7cAJnCocbDdFJVNWa/ 0NcetMtwguAFjOkYL7jaY8uN2hqsIQwyilD1zIyVoW6wDAIdSB9GkZSTMAD2nw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840014; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=T6GGNxNKfrCVdZiU8moR07up1PveIugLvwoILK+F1s4=; b=gEs2U+wPSdzCYnI9r/JVqfbgdYrKMUTQ6b+ZH7HiWw4JSASD7pXgbKbbjOqi7gtFSoDSbr /hd87EL6zumUpjpNU7i7u91fSKAnLkSzS+CVAL4ueXK6SHuSG04rEbojRRw+pX1LSODcDO tiYxSD7860D2jGIiOqHSrIBJapGhrZYKlcwZDJLL1nUwo0Kk9J5MT3vMgDBz0twXFh2Zp4 WWrQfyRLV4FVFbYwfxQ7p+mjci1lAQZtdg/U+eoMwdngS+XmmCowaZIMzaMzNtnkKr/bfT ql6au2OYh5vKN4nyVNyVvF7nZl8KRL5whwGrz8z5jpETBIHWgZw1P5MRn6guYA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJs6LB6zsyc for ; Tue, 30 Jun 2026 17:20:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44fad by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:13 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 5499a343f381 - stable/15 - posixshm: Disallow truncation of largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 5499a343f38199c096098866a100768666f18821 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:13 +0000 Message-Id: <6a43facd.44fad.7ec6ab7a@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=5499a343f38199c096098866a100768666f18821 commit 5499a343f38199c096098866a100768666f18821 Author: Mark Johnston AuthorDate: 2026-06-23 22:47:02 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 posixshm: Disallow truncation of largepage objects We correctly handled ftruncate(), but not open(O_TRUNC). Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57831 --- sys/kern/uipc_shm.c | 8 +++----- tests/sys/posixshm/posixshm_test.c | 38 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 5 deletions(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index d965576ecd9c..b1b6a8657d69 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -786,7 +786,7 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) vm_pindex_t oldobjsz __unused; int aflags, error, i, psind, try; - KASSERT(length >= 0, ("shm_dotruncate: length < 0")); + KASSERT(length >= 0, ("shm_dotruncate_largepage: length < 0")); object = shmfd->shm_object; VM_OBJECT_ASSERT_WLOCKED(object); rangelock_cookie_assert(rl_cookie, RA_WLOCKED); @@ -1334,15 +1334,13 @@ kern_shm_open2(struct thread *td, const char *userpath, int flags, mode_t mode, if (error == 0 && (flags & (O_ACCMODE | O_TRUNC)) == (O_RDWR | O_TRUNC)) { - VM_OBJECT_WLOCK(shmfd->shm_object); #ifdef MAC error = mac_posixshm_check_truncate( - td->td_ucred, fp->f_cred, shmfd); + td->td_ucred, fp->f_cred, shmfd); if (error == 0) #endif - error = shm_dotruncate_locked(shmfd, 0, + error = shm_dotruncate_cookie(shmfd, 0, rl_cookie); - VM_OBJECT_WUNLOCK(shmfd->shm_object); } if (error == 0) { /* diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index 6729c33a789d..e816e2d1efa7 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -2148,6 +2148,43 @@ ATF_TC_BODY(largepage_reopen, tc) "close failed; errno=%d", errno); } +ATF_TC_WITHOUT_HEAD(largepage_truncate); +ATF_TC_BODY(largepage_truncate, tc) +{ + size_t ps[MAXPAGESIZES]; + int fd, psind; + + (void)pagesizes(ps, true); + psind = 1; + + gen_test_path(); + fd = shm_create_largepage(test_path, O_CREAT | O_RDWR, psind, + SHM_LARGEPAGE_ALLOC_DEFAULT, 0600); + if (fd < 0 && errno == ENOTTY) + atf_tc_skip("no large page support"); + ATF_REQUIRE_MSG(fd >= 0, "shm_create_largepage failed; error=%d", errno); + + ATF_REQUIRE_MSG(ftruncate(fd, ps[psind]) == 0, + "ftruncate failed; error=%d", errno); + + ATF_REQUIRE_MSG(close(fd) == 0, "close failed; error=%d", errno); + + fd = shm_open(test_path, O_RDWR | O_TRUNC, 0); + ATF_REQUIRE_MSG(fd == -1, "shm_open(O_TRUNC) should have failed"); + ATF_REQUIRE_ERRNO(ENOTSUP, fd == -1); + + fd = shm_open(test_path, O_RDWR, 0); + ATF_REQUIRE_MSG(fd >= 0, "shm_open failed; error=%d", errno); + + ATF_REQUIRE_MSG(ftruncate(fd, ps[psind]) == 0, + "ftruncate to same size failed; error=%d", errno); + + ATF_REQUIRE_MSG(shm_unlink(test_path) == 0, + "shm_unlink failed; errno=%d", errno); + ATF_REQUIRE_MSG(close(fd) == 0, + "close failed; errno=%d", errno); +} + ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TC(tp, remap_object); @@ -2199,6 +2236,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, largepage_pkru); #endif ATF_TP_ADD_TC(tp, largepage_reopen); + ATF_TP_ADD_TC(tp, largepage_truncate); return (atf_no_error()); } From nobody Tue Jun 30 17:20:16 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJw6Wgbz6jXnp for ; Tue, 30 Jun 2026 17:20:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJw18VMz3q0R for ; Tue, 30 Jun 2026 17:20:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840016; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=nRscvlWqLXMpAuf+I3lwHfWQiWu+yR1yzWgc8VpUyjQ=; b=tNMU/9X1yhoW8dQ9K8K2XoLP8Xc2uwDFMUccsJ4RlRC3x/z6vz1Bzb/EKP/toQtMf9KfRI T6I37nI0VeLonE10F8rduP4mxWISTniJAr7u8EAEnPeQ/uSCKyQcu8JtvZV6zWux4voVJL eWjj6lizHQtT5aB+MdN4l1CXi9IXtcCNY9PHLeO5jtECALJv8j1hrW8Ywmq6TvzTtZOLzw aIBpMRAWg52y39sJCvl8R4urLWsfc34OzpmlxZ0aG0byeX4VJV2NKJXiW1Dm5ZreEm3ElS I+ZTg/qV5le0auAOHxNW4Y6CVRt8YeATKbo+SNNtS67hGCsQMu1y9ZzPACmYSg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840016; a=rsa-sha256; cv=none; b=Hoc9nL3ayHb5pj9YjngzJVoPy7BLz5gTfZMOXAh9Q1uaVe3C3HPIQ9bWWFdmt8f63/gMAE fSM5MJ1y+6cVSZ3W8JO5ys9HLPBOlCs3WeMo2LDueeO2BXqD21lY4fac+5+WTerAZ62MUu GbiPWZq5QpG7+pKaEfguk/kvRI/DBjZLzwYg2nwSBqEYPgCTI8XFpQhSrFQor9RGrKbeIh WuVF2S6dCM0fM9QNB/7v+vJn7GjgZrlfv3Gi+PMS9YTBFa96dXW5JlfPUHPHIG1W31yGg4 z8sMu2hsfKsuHEChQi+goP6gGyPbrfWY+DW42tODJaWkOYW+cm8B1G0saIe/aw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840016; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=nRscvlWqLXMpAuf+I3lwHfWQiWu+yR1yzWgc8VpUyjQ=; b=gY9Uj6HAmlh5Utvfapp+2cGyTZXUOwt7nm9NFkRYg5jdk7BNH2XYl3BJukvIknFX7XkRUW EaeFpDo3WG8Aro0wqrwYhWrcvzbXVz4F4nmgEsyscpmyIgK99mop6O51rz8qTZztD3CMQ3 dqXM8IFcUppuCKN+2RkXwbVJojJuPmAo9Bj0izB2vFHo2R0hkdCRx8GwsFSt5d7G+2FatF +lcSXOncGgHHbnZIhmYS8mnfRn6FZKPJXutZZAu74q8CGBtJRXJ7CJ9BK95nR07D+XTb1z Sq5xV5xkdPUWt4y9EmgdyprHWVTWNZW2Z27Nrd8qQtCIOSLg63QrfUj5LCEEew== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJw0D53ztV9 for ; Tue, 30 Jun 2026 17:20:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44f4f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:16 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Kyle Evans From: Mark Johnston Subject: git: ec1989960781 - stable/15 - kern: fix auditing of ptrace(2) syscall requests List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: ec19899607813702d94b13798a9ed78dffdce719 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:16 +0000 Message-Id: <6a43fad0.44f4f.6304858d@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=ec19899607813702d94b13798a9ed78dffdce719 commit ec19899607813702d94b13798a9ed78dffdce719 Author: Kyle Evans AuthorDate: 2026-06-25 17:02:47 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 kern: fix auditing of ptrace(2) syscall requests `error` here is the return value of syscall_thread_enter() rather than the syscall itself, so the committed audit records do not reflect reality. This is less harmful than them recording an error when the operation actually succeeded, but it could still possibly be used to throw off IDS techniques with things like bsmtrace. Approved by: so Security: FreeBSD-SA-26:45.audit Security: CVE-2026-49426 Reviewed by: des, kib, markj, csjp Differential Revision: https://reviews.freebsd.org/D57847 --- sys/kern/kern_sig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c index e48997ed966a..fed5b62ee1c7 100644 --- a/sys/kern/kern_sig.c +++ b/sys/kern/kern_sig.c @@ -2766,7 +2766,7 @@ ptrace_syscallreq(struct thread *td, struct proc *p, td->td_errno = nerror; if (audited) - AUDIT_SYSCALL_EXIT(error, td); + AUDIT_SYSCALL_EXIT(tsr->ts_ret.sr_error, td); if (!sy_thr_static) syscall_thread_exit(td, se); } From nobody Tue Jun 30 17:20:17 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJx4Yp0z6jY6D for ; Tue, 30 Jun 2026 17:20:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJx1f1sz3q9Z for ; Tue, 30 Jun 2026 17:20:17 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840017; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KUoxZrHgCdku2vYsid73nlPtZH6iLBSP2KWgSFUVjhU=; b=xJuhtDvhAMIIsFGBBzcaOmhKzjasc1GO6VMRlxFF69TEVBtKk0ii7HY2r283yy3s7uDzNW N7f/EJl747PpcUOYdvYzX7uM/qjRM8uIBxbxRp1AU2q9hDcvx/qPZTLzClnPvi0ccs5lFj YDRelymcAhCSMzXMXe951JBb+AYUcNLY0Es/RGUaoU7FO2T72mCPUDHwRRoZrMRsyehnHX nADu8qE2aSM6QtG5PFFOghiTSYrLuI/e1ePg0xeGW5zcO4fmAmDzGyaqj2MzWcTmuwt/rc mj8y8DFVCvf84xsyB2DpUPUdQkbmaKnqgbbUkGKfheGh1GGx2AaLhFK+0AP7fA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840017; a=rsa-sha256; cv=none; b=qO4onSBZGg3IbmN78SCs3Na2oleAFHxxnVbTIHvxEvHEyZIyH19vFpbpyKOkOPywf3nh1R VLMsPg/muU3KYbKWgRzDfEAStueGrKwYT1uGMIzoP/t7nDnDUyRCZGkxElinTzaNA9R6yP 3jwUsrtWHn/xe2Q4VBh2hlovJ6jDIdeJFded5dhxcweWIvTBH9dUnRb5yTjoHxDS4v8wY9 4SZZwFNycJJf71nBDgVaXnq/PoSG9vHTjedyeI3YmAxXG89EMDLL/HwFtDEKi7I5iWmpUY UvMjAUshYVVoXxIzK8bCq/us+5Vh4ldAV5tl807XbaG9rEmymGIsKPsdYUwJ3A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840017; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KUoxZrHgCdku2vYsid73nlPtZH6iLBSP2KWgSFUVjhU=; b=aVZRj+xRlhrJmbKtbvYdSbpQ8LUowGc2ksZswav7FBzaD6dqbfL3ZONjNGL7SpVPBAU6Gj +CiVk3TnL7hamibzNIa0yX6ICCioJ55uIDOTI6Xhu4uZ6CWHYp4gM5TW7rXxFHAXxwf+ZJ cpnS0640CsPQoLL94KZR1+WGgRjllSk4/i5Dfc2r7wAXKSenNwd2LGk931fUCNe+/E+qdn VILMbh2VQf6My6YCMwVAAGeE85Iaah54P+eBY2mp+PCM2mKbPOSOuPfCiSwv7iI8JMNYLE d+HPuNESjVQZUC5FuN2tuYrPQV+7YDSBubgdZj96hbrHw1IDZf75rFgHaasBuA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJx0g3QztRc for ; Tue, 30 Jun 2026 17:20:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45b70 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:17 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: John Baldwin From: Mark Johnston Subject: git: e4e6250999aa - stable/15 - ktls CBC decrypt: Only increment iovec index when an entry is used List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: e4e6250999aa982602b498d0a7ec74d888f9552a Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:17 +0000 Message-Id: <6a43fad1.45b70.23d901b6@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=e4e6250999aa982602b498d0a7ec74d888f9552a commit e4e6250999aa982602b498d0a7ec74d888f9552a Author: John Baldwin AuthorDate: 2026-06-24 01:14:11 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 ktls CBC decrypt: Only increment iovec index when an entry is used If an mbuf in the chain was skipped because it only contained bytes from the header, the iovec index ('i') was incremented even though the entry was not populated. Only increment 'i' when an iovec entry is consumed. Add a new type of KTLS receive test which writes a single TLS record via two separate write(2) calls over a TCP_NODELAY socket to trigger a split in the mbuf chain in the kernel. Test various split locations including after the "plain" TLS header (5 bytes), after the full TLS header, in the middle of the data payload, just before the start of the trailer, and in the middle of the trailer. These tests are also run against all supported ciphers, not just CBC. The 'header' test for CBC ciphersuites was able to trigger the bug. Approved by: so Security: FreeBSD-SA-26:46.ktls Security: CVE-2026-49423 Sponsored by: Chelsio Communications --- sys/opencrypto/ktls_ocf.c | 3 +- tests/sys/kern/ktls_test.c | 110 ++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 110 insertions(+), 3 deletions(-) diff --git a/sys/opencrypto/ktls_ocf.c b/sys/opencrypto/ktls_ocf.c index ece509f5f969..e61f607622b0 100644 --- a/sys/opencrypto/ktls_ocf.c +++ b/sys/opencrypto/ktls_ocf.c @@ -500,13 +500,14 @@ ktls_ocf_tls_cbc_decrypt(struct ktls_session *tls, iov[0].iov_base = &ad; iov[0].iov_len = sizeof(ad); skip = sizeof(*hdr) + AES_BLOCK_LEN; - for (i = 1, n = m; n != NULL; i++, n = n->m_next) { + for (i = 1, n = m; n != NULL; n = n->m_next) { if (n->m_len < skip) { skip -= n->m_len; continue; } iov[i].iov_base = mtod(n, char *) + skip; iov[i].iov_len = n->m_len - skip; + i++; skip = 0; } uio.uio_iov = iov; diff --git a/tests/sys/kern/ktls_test.c b/tests/sys/kern/ktls_test.c index 3970083e7f72..7003b86fb4e2 100644 --- a/tests/sys/kern/ktls_test.c +++ b/tests/sys/kern/ktls_test.c @@ -303,6 +303,15 @@ fd_set_blocking(int fd) ATF_REQUIRE(fcntl(fd, F_SETFL, flags) != -1); } +static void +tcp_nodelay(int fd) +{ + int nodelay = 1; + + ATF_REQUIRE(setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &nodelay, + sizeof(nodelay)) == 0); +} + static bool cbc_crypt(const EVP_CIPHER *cipher, const char *key, const char *iv, const char *input, char *output, size_t size, int enc) @@ -1920,6 +1929,55 @@ test_ktls_receive_bad_size(const atf_tc_t *tc, struct tls_enable *en, close_sockets_ignore_errors(sockets); } +static void +test_ktls_receive_split_record(const atf_tc_t *tc, struct tls_enable *en, + uint64_t seqno, size_t len, size_t first_len) +{ + char *plaintext, *received, *outbuf; + size_t outbuf_cap, outbuf_len; + ssize_t rv; + int sockets[2]; + + ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); + + plaintext = alloc_buffer(len); + received = malloc(len); + outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); + outbuf = malloc(outbuf_cap); + + ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); + + ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, + sizeof(*en)) == 0); + check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); + + fd_set_blocking(sockets[0]); + fd_set_blocking(sockets[1]); + + outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, + plaintext, len, outbuf, outbuf_cap, 0); + ATF_REQUIRE(first_len < outbuf_len); + + tcp_nodelay(sockets[1]); + rv = write(sockets[1], outbuf, first_len); + ATF_REQUIRE_INTEQ((ssize_t)(first_len), rv); + + rv = write(sockets[1], outbuf + first_len, outbuf_len - first_len); + ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len - first_len), rv); + + rv = ktls_receive_tls_record(en, sockets[0], TLS_RLTYPE_APP, received, + len); + ATF_REQUIRE_INTEQ((ssize_t)len, rv); + + ATF_REQUIRE(memcmp(plaintext, received, len) == 0); + + free(outbuf); + free(received); + free(plaintext); + + close_sockets(sockets); +} + #define TLS_10_TESTS(M) \ M(aes128_cbc_1_0_sha1, CRYPTO_AES_CBC, 128 / 8, \ CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO) \ @@ -2360,6 +2418,26 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ auth_alg, minor, name) \ ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name); +#define GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, name, len, first_len) \ +ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_split_##name); \ +ATF_TC_BODY(ktls_receive_##cipher_name##_split_##name, tc) \ +{ \ + struct tls_enable en; \ + uint64_t seqno; \ + \ + ATF_REQUIRE_KTLS(); \ + seqno = random(); \ + build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ + seqno, &en); \ + test_ktls_receive_split_record(tc, &en, seqno, len, first_len); \ + free_tls_enable(&en); \ +} + +#define ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, name) \ + ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_split_##name); + #define GEN_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ minor) \ GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ @@ -2381,7 +2459,22 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ tls_minimum_record_payload(&en) - 1) \ GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ auth_alg, minor, oversized_record, \ - TLS_MAX_MSG_SIZE_V10_2 * 2) + TLS_MAX_MSG_SIZE_V10_2 * 2) \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, header, 64, \ + sizeof(struct tls_record_layer)); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, full_header, 64, \ + tls_header_len(&en)); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, half, 64, \ + tls_header_len(&en) + 32); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_start, 64, \ + tls_header_len(&en) + 64); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_middle, 64, \ + tls_header_len(&en) + 64 + tls_trailer_len(&en) / 2); #define ADD_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ minor) \ @@ -2402,7 +2495,17 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ auth_alg, minor, small_record) \ ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ - auth_alg, minor, oversized_record) + auth_alg, minor, oversized_record) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, header) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, full_header) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, half) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_start) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_middle) \ /* * For each supported cipher suite, run several receive tests: @@ -2425,6 +2528,9 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ * size * * - a test with an oversized TLS record + * + * - tests of a single record whose data is split across two writes, + * with each test using a different split point */ AES_CBC_NONZERO_TESTS(GEN_RECEIVE_TESTS); AES_GCM_TESTS(GEN_RECEIVE_TESTS); From nobody Tue Jun 30 17:20:14 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJv1z5Yz6jXnn for ; Tue, 30 Jun 2026 17:20:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJv0sbCz3q7L for ; Tue, 30 Jun 2026 17:20:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840015; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rlpyocW0gHdxlbKsnhrc3TVXQBiUjZOM+rR8QFZi0Fs=; b=rumn78FDQH56AItLfyxw0+AgM6J/do7utfkZaPzrYB05GcYCps9WBQcPtJv3c8nmwKTeon k7K80RXGJg6436u+7fG0/7G/7GY/ymRcKvGu7zPzlPixkhnov5jyHxNE9DMyggf9caBrHI TNp1eOYhUl6nZj0Z28ESp1Tpk5USI11E7RJ+uGkUD65oA5x5kGzxeCDuAyGQ2kqynK6oF4 5YecBjKfYveYV6X+sgUEFvuKGHOgJzJ8ep7qojkhuvabfufd5qv/qtmXw87M0tbjIRkvrM Zb60F0v/X1nSUe83nzs2N5rsx2l8VeJgSvhNeK/dCZZt3Nu0U2Fd8BwcxdB1dA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840015; a=rsa-sha256; cv=none; b=o7te8Ro/vojD+wpxEugBXwP54zgHGgNL1f5R28sJyqt96IzNbZ9YL3JZbVEjOUYAtjBO1u 6ghpAvtF9wIopbksvagLQi9Bj5yJx1DVIe+gdEtcmfs6W2pzFYe/9yQ1quIGYTBqjVretM NyeI2LaYkJZg45fID6ORitN2jUGscZKWSvDdqiFtZusgGvURZ7e1XngKhaZSnDAORiOy85 Px9y9v8wplo0XOvnjmtQLwi0jweT7w1lB4J1WakD9mfIUZ8e9TTexxADZzhGPzkZI5d9pa G7JcWL9JB5ZSgjybgmMr/wiPQzueWVVCs9PdLcxlA0a9o8Zn4x6dIu/XN7zMOA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840015; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rlpyocW0gHdxlbKsnhrc3TVXQBiUjZOM+rR8QFZi0Fs=; b=Tn7UiZR7CvLivsD9aaz/OlQ4Kr+b0yO+4Mu8z5bAG2/oASOmD+fETO7oHQnvNe1ctYRub1 o2XHSgnKEQHC1TR9gTEXp4eQCoMzeDZC0XzhyepwLO0PzRZ3eFT79DLtfU2KDCjXkFtmDe xnU45s/FzDBgH68WFtx2izS/8KjFCy6e8V/3ItO8Tw3pXKNovAtSMtq2NkrGVksyWX6zFx KiQpOt8r7yOSXqo6CeQc7Lg7DHzohAlx1lAAizAoxrmEy6WN/6jOFwwzlFBgSQW+nXXejm 8JXGHkyfCOKMfgHXt6Yt8kOSi/aZV+J/KJvU8ICRGHa2tYMgJHvRRPXBT7WOLA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJt6xpvzsyd for ; Tue, 30 Jun 2026 17:20:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45a17 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:14 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 702f4c829c17 - stable/15 - posixshm: Fix handling of sendfile() with largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 702f4c829c171b9d63f23e0d6753c80572315bc3 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:14 +0000 Message-Id: <6a43face.45a17.1033b74@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=702f4c829c171b9d63f23e0d6753c80572315bc3 commit 702f4c829c171b9d63f23e0d6753c80572315bc3 Author: Mark Johnston AuthorDate: 2026-06-24 19:57:00 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 posixshm: Fix handling of sendfile() with largepage objects sendfile(2) can transmit POSIX shared memory objects. Typically it will look up and wire each page before sending it to a socket; once transmission is complete, the page is unwired and typically released back into the page queues. sendfile() has an advisory flag, SF_NOCACHE, which means, "try to free the page once transmission is complete." This is implemented in vm_page_release(), which expects to operate on managed pages. Pages belonging a largepage object are de-facto wired not explicitly so. Thus, vm_page_release() will unwire and, having found no additional references, free the page. Because mappings of largepage objects are unmanaged, userspace can still access the now freed page. Fix the problem by explicitly wiring largepage pages. Make the VM object destructor responsible for unwiring and freeing them. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49427 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57832 --- sys/kern/uipc_shm.c | 22 ++++++++-- sys/vm/vm_page.c | 23 +++++----- tests/sys/posixshm/posixshm_test.c | 89 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 121 insertions(+), 13 deletions(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index b1b6a8657d69..8341364f4d16 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -326,6 +326,7 @@ static void shm_largepage_phys_ctor(vm_object_t object, vm_prot_t prot, vm_ooffset_t foff, struct ucred *cred) { + object->flags |= OBJ_PG_DTOR; } static void @@ -333,11 +334,27 @@ shm_largepage_phys_dtor(vm_object_t object) { int psind; + VM_OBJECT_ASSERT_WLOCKED(object); + psind = object->un_pager.phys.data_val; if (psind != 0) { + struct pctrie_iter pages; + vm_page_t m; + bool removed __diagused; + + vm_page_iter_init(&pages, object); +restart: + VM_RADIX_FOREACH(m, &pages) { + if (!vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL)) { + pctrie_iter_reset(&pages); + goto restart; + } + removed = vm_page_iter_remove(&pages, m); + KASSERT(!removed, ("%s: page %p not wired", __func__, m)); + vm_page_unwire(m, PQ_NONE); + } atomic_subtract_long(&count_largepages[psind], object->size / (pagesizes[psind] / PAGE_SIZE)); - vm_wire_sub(object->size); } else { KASSERT(object->size == 0, ("largepage phys obj %p not initialized bit size %#jx > 0", @@ -818,7 +835,7 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) if ((shmfd->shm_seals & F_SEAL_GROW) != 0) return (EPERM); - aflags = VM_ALLOC_NORMAL | VM_ALLOC_ZERO; + aflags = VM_ALLOC_NORMAL | VM_ALLOC_ZERO | VM_ALLOC_WIRED; if (shmfd->shm_lp_alloc_policy == SHM_LARGEPAGE_ALLOC_NOWAIT) aflags |= VM_ALLOC_WAITFAIL; try = 0; @@ -874,7 +891,6 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) object->size += OFF_TO_IDX(pagesizes[psind]); shmfd->shm_size += pagesizes[psind]; atomic_add_long(&count_largepages[psind], 1); - vm_wire_add(atop(pagesizes[psind])); } return (0); } diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c index 3753079f2fde..cd95cc620ad4 100644 --- a/sys/vm/vm_page.c +++ b/sys/vm/vm_page.c @@ -4272,6 +4272,9 @@ vm_page_unwire_managed(vm_page_t m, uint8_t nqueue, bool noreuse) { u_int old; + KASSERT(nqueue < PQ_COUNT, + ("vm_page_unwire: invalid queue %u request for page %p", + nqueue, m)); KASSERT((m->oflags & VPO_UNMANAGED) == 0, ("%s: page %p is unmanaged", __func__, m)); @@ -4330,17 +4333,15 @@ vm_page_unwire_managed(vm_page_t m, uint8_t nqueue, bool noreuse) void vm_page_unwire(vm_page_t m, uint8_t nqueue) { - - KASSERT(nqueue < PQ_COUNT, - ("vm_page_unwire: invalid queue %u request for page %p", - nqueue, m)); + KASSERT(nqueue < PQ_COUNT || nqueue == PQ_NONE, + ("%s: invalid queue %u request for page %p", __func__, nqueue, m)); if ((m->oflags & VPO_UNMANAGED) != 0) { if (vm_page_unwire_noq(m) && m->ref_count == 0) vm_page_free(m); - return; + } else { + vm_page_unwire_managed(m, nqueue, false); } - vm_page_unwire_managed(m, nqueue, false); } /* @@ -4514,13 +4515,15 @@ vm_page_release_toq(vm_page_t m, uint8_t nqueue, const bool noreuse) void vm_page_release(vm_page_t m, int flags) { - vm_object_t object; - - KASSERT((m->oflags & VPO_UNMANAGED) == 0, - ("vm_page_release: page %p is unmanaged", m)); + if ((m->oflags & VPO_UNMANAGED) != 0) { + vm_page_unwire(m, PQ_NONE); + return; + } if ((flags & VPR_TRYFREE) != 0) { for (;;) { + vm_object_t object; + object = atomic_load_ptr(&m->object); if (object == NULL) break; diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index e816e2d1efa7..e4b57dec6311 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -33,6 +33,7 @@ #include #include #include +#include #include #include #include @@ -2148,6 +2149,93 @@ ATF_TC_BODY(largepage_reopen, tc) "close failed; errno=%d", errno); } +static unsigned char +largepage_sendfile_expected(size_t off) +{ + + return ((unsigned char)(off * 131 + (off >> 8))); +} + +ATF_TC_WITHOUT_HEAD(largepage_sendfile); +ATF_TC_BODY(largepage_sendfile, tc) +{ + static const int flags[] = { 0, SF_NOCACHE }; + char *addr; + off_t sbytes; + size_t ps[MAXPAGESIZES]; + int error, fd, pscnt, sd[2], status; + pid_t child; + + pscnt = pagesizes(ps, true); + + for (int i = 1; i < pscnt; i++) { + for (int fi = 0; fi < (int)nitems(flags); fi++) { + fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, + ps[i]); + addr = mmap(NULL, ps[i], PROT_READ | PROT_WRITE, + MAP_SHARED, fd, 0); + ATF_REQUIRE_MSG(addr != MAP_FAILED, + "mmap(%zu bytes) failed; error=%d", ps[i], errno); + + /* Fill with a verifiable pattern. */ + for (size_t j = 0; j < ps[i]; j++) + addr[j] = largepage_sendfile_expected(j); + + ATF_REQUIRE(socketpair(PF_LOCAL, SOCK_STREAM, 0, + sd) == 0); + + child = fork(); + ATF_REQUIRE_MSG(child != -1, + "fork() failed; error=%d", errno); + if (child == 0) { + char buf[BUFSIZ]; + ssize_t len; + size_t off, resid; + + (void)close(sd[0]); + off = 0; + for (resid = ps[i]; resid > 0; resid -= len) { + len = read(sd[1], buf, sizeof(buf)); + if (len <= 0) + _exit(1); + for (ssize_t k = 0; k < len; k++) { + if ((unsigned char)buf[k] != + largepage_sendfile_expected( + off + k)) + _exit(2); + } + off += len; + } + _exit(0); + } + ATF_REQUIRE(close(sd[1]) == 0); + + sbytes = 0; + error = sendfile(fd, sd[0], 0, ps[i], NULL, &sbytes, + flags[fi]); + ATF_REQUIRE_MSG(error == 0, + "sendfile() failed; error=%d flags=%#x", + errno, flags[fi]); + ATF_REQUIRE_MSG(sbytes == (off_t)ps[i], + "sendfile() short; sbytes=%jd expected=%zu flags=%#x", + (intmax_t)sbytes, ps[i], flags[fi]); + + ATF_REQUIRE(close(sd[0]) == 0); + + ATF_REQUIRE_MSG(waitpid(child, &status, 0) == child, + "waitpid() failed; error=%d", errno); + ATF_REQUIRE_MSG(WIFEXITED(status), + "child killed by signal %d", WTERMSIG(status)); + ATF_REQUIRE_MSG(WEXITSTATUS(status) == 0, + "child exited with status %d (flags=%#x)", + WEXITSTATUS(status), flags[fi]); + + ATF_REQUIRE(munmap(addr, ps[i]) == 0); + ATF_REQUIRE(close(fd) == 0); + } + } +} + ATF_TC_WITHOUT_HEAD(largepage_truncate); ATF_TC_BODY(largepage_truncate, tc) { @@ -2236,6 +2324,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, largepage_pkru); #endif ATF_TP_ADD_TC(tp, largepage_reopen); + ATF_TP_ADD_TC(tp, largepage_sendfile); ATF_TP_ADD_TC(tp, largepage_truncate); return (atf_no_error()); From nobody Tue Jun 30 17:20:20 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVK10M8Sz6jY1S for ; Tue, 30 Jun 2026 17:20:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVK02zY5z3qFw for ; Tue, 30 Jun 2026 17:20:20 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840020; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gFYPY2BENkWRARx+Ir00lQ0OM6cYrzaqC8bzCi/TYrk=; b=fr+QwzF6LSTPgg83V9b8DNBjGEx0SZVwlqGshpQ4K2PfW5RnxtGNjx0OeIyTr6v4hkksLq wVgk0+RkffHDuhvutwjxvhX1qk1483RPbQrVrr/abTRFnqDmLedIe6ohxV4O9MeZfIbLAy qxQRrjxtcGle/5xA4ZaCJCXcQZVjGPwPWzuKPIc6K4j6ZmAUxiQkNiiZblV8qpwzM/Yq8A T2/aexNUa1nGBz1q4hKFLfacghazw7X2V8DxugZCD9q7zLGJAKXKxoO+P/qXqPowJBdbJz 39LKrkNDPR63m2YOUXb3H7e8VUYlNcUd4VigG7GyUTTzzMJmy8a0taFEN/V11w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840020; a=rsa-sha256; cv=none; b=e/UM/qrKrgJ2vyqnXP0txgDQfQ7DrDYlHgFKK565xXo9iAfU0Yd7sHr1E8X+AfEc6hX6Yv 96X0OOvAi3QxSMyGKsnd3ajYQ3pODzR62OxMMg4pnXFwfj3z41T1mW+FCNBCYGphLuHwRj AYbmdkzoQsPt+TYvyDXhBYE6uC4w6sI8H8lDxvZ9Q8BeNCIazetOnxaOf/hYVjNa/oeSsg ueJByLqeFbmSJznN9kSba/vKLHBZKKYHgxpTlsPaHC+P4Kbh1bV6b73nakYpGWhgsS0Shc yLD6V6M3OAjNXTr/YWV+2jQDsHZ27fWVbs3ZxYTjibd9EIIsiurs7wNZKRnoZQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840020; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gFYPY2BENkWRARx+Ir00lQ0OM6cYrzaqC8bzCi/TYrk=; b=V+rgzs+5oZCOcagx6g0+f1dWOg1EJVKJS1FGa8By3woToF1popQ0Rd6FtOfg0Eb3Dy8U3i +qH042lme2D3vPuXNRX8twn6mlogY6LcDbwSKjnpjFCXRJ+x4emGQ8yl6AIMi3EOjTKRG8 uVpHEGM+NWdPC5q7Y0rr76NYSdcpew9hjowU33jzaClJLNR+Yz3H/BbqkQNPI4opWgLNDF +3nx3t68YXpZdcyFD2zuYKbE+90OH2gB9I5moQUQkUUs0LBI6c6amncnxRTHhq3e+1aPq5 Be4OlpFDjSPmbNhOFOq+TXRG2PlBfoco1YF/zJVkcCQ/0NG7o6vHMFiNYjNz1w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVK01jf1zsyf for ; Tue, 30 Jun 2026 17:20:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45b76 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:20 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: abcc988af19e - stable/15 - iconv: Fix a buffer overflow in the HZ encoding List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: abcc988af19ef53884b202916f97856680849a8c Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:20 +0000 Message-Id: <6a43fad4.45b76.19a9694a@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=abcc988af19ef53884b202916f97856680849a8c commit abcc988af19ef53884b202916f97856680849a8c Author: Mark Johnston AuthorDate: 2026-06-23 16:05:31 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 iconv: Fix a buffer overflow in the HZ encoding wcrtomb may store up to 2 2-byte escape sequences to the state buffer in addition to the character itself. In the worst case, a 3-byte heap overflow is possible. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57949 --- lib/libiconv_modules/HZ/citrus_hz.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index db738b8f812e..e16ab3a8e34c 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -132,7 +132,7 @@ typedef struct { typedef struct { escape_t *inuse; int chlen; - char ch[ROWCOL_MAX]; + char ch[4 + ROWCOL_MAX]; } _HZState; #define _CEI_TO_EI(_cei_) (&(_cei_)->ei) From nobody Tue Jun 30 17:20:19 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJz6BTRz6jXt3 for ; Tue, 30 Jun 2026 17:20:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJz2sVLz3qB1 for ; Tue, 30 Jun 2026 17:20:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840019; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZVfOOgP8OVED9rEg6ER4KKA3Wt8AbSnl2d6zWG64MtE=; b=o1jmOG2eMCFVXuT1sWXel2A9Dgb6ZPop3UCCjCbm0hPdmu14xMz83+2KhkCs3BDR4L/Nwl nt/1W++LiMo46smre4lFP1c2NzOAElbyqHRz6TtCRUztabtjVxhjMQl+VIhcFoZZORkBc4 C3QZnawiVbatLMGWY7FeFnqaKkjFQ7TD5FzEFdcff4S93KCYFXuqZPNPFOEaBv89UTkpgD 4qldikH2BaaiVATB4qaFBsidZpjPXRJaXUfyln7VA74PJtmk1dCSJDdTPSydfB+X3vJvdV cq/c3iqXR+/MGULnjLCrbo4iHwxKiIFY7iveLheKqzHXnJklSHZmso+VSBxkXw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840019; a=rsa-sha256; cv=none; b=i14U8ISjWGJex5negIekXGQwVA1FwBig3lEW/ZZ1OagWWEyWBzEB3VPFwuUC/X24bcZ4jM RvMetVKTqUsP8CuuKCnYYwe/aqQyO28BZigOa3NbJDXk5cmk+9yGNvsxUGl5/GbVg7rrMt ZIYbZBLqzQUH7Ai9b7XzncODebk/orf2z3aWEMnfBDl2/cMN3q+dwpYZWRezBcAO3lZgLs alEHBtNDOlBrDhNC01MWrw2g4/oSBBFVnNZwBrgk8iF7dnGRczp/6Hy1EDw640NCQe1oAE pIeqvc6UpbRR8D73klJK9gwkAiN1b3qRZjs77Pt/7n8XJvOdO0MJqr8/JxVDRg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840019; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZVfOOgP8OVED9rEg6ER4KKA3Wt8AbSnl2d6zWG64MtE=; b=mBG51cn1czd4boPktjAhZtSFHr1RZzVXhx9ARpwDdQz/n40mos2xxUuRC+n4m9ixbF3ech vs9jOWfQoDXvZBs2OKXQJrUoblYvKfLnBZKTiwi+4aAsuhn2lR7M6NNVme+8TK8kc4gKH4 3ddGOqpWkxyGV7EgPD3KVmRbWiLUjjD9M+Ok0Rh+fprsfoYr6rQh+PSAzBQls5ZA1x3azP xWgZP9fKyivxn2kVYYkvwkd7WgjPoPN3yFzfWQdjaPkJTrn6P8xH9yi/o6xRXwQNk4FKb4 QHQ7mgrGz0Rg3bvWpRsfMcqzxfhwrJHhufn1dtl+lBMM3xXeFnAyipX8u5gsPw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJz1Mklzt9y for ; Tue, 30 Jun 2026 17:20:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 445cb by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:19 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Taylor R Campbell From: Mark Johnston Subject: git: 10a768349a10 - stable/15 - iconv(3): Draft some automatic tests. List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 10a768349a10f1c2045e43aeacc358bcc0153494 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:19 +0000 Message-Id: <6a43fad3.445cb.4ecb8f8@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=10a768349a10f1c2045e43aeacc358bcc0153494 commit 10a768349a10f1c2045e43aeacc358bcc0153494 Author: Taylor R Campbell AuthorDate: 2026-06-22 19:44:55 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 iconv(3): Draft some automatic tests. Based on a report by Nick Wellnhofer. Approved by: so Security: FreeBSD-SA-26:49.iconv Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57948 --- contrib/netbsd-tests/lib/libc/locale/t_iconv.c | 355 +++++++++++++++++++++++++ lib/libc/tests/locale/Makefile | 1 + 2 files changed, 356 insertions(+) diff --git a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c new file mode 100644 index 000000000000..f25c061bb170 --- /dev/null +++ b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c @@ -0,0 +1,355 @@ +/* $NetBSD$ */ + +/*- + * Copyright (c) 2025 The NetBSD Foundation, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS + * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +/* + * iconv(3) + */ + +#include +__RCSID("$NetBSD: t_mbrtoc8.c,v 1.3 2024/08/20 17:43:09 riastradh Exp $"); + +#include +#include +#include +#include +#include +#include +#include + +#include "h_macros.h" + +static const struct sample { + const char *src_codeset; + size_t nsrc; + const char *src; + const char *dst_codeset; + size_t ndst; + const char *dst; + size_t ninval; + size_t ninval_rev; + const char *xfail; +#define IRREVERSIBLE ((size_t)-1) +} samples[] = { + [0] = { "us-ascii", 6, "hello", + "us-ascii", 6, "hello", + 0, 0, NULL }, + /* LATIN SMALL LETTER E WITH ACUTE ACCENT */ + [1] = { "iso-8859-1", 1, (const char[1]){0xe9}, + "UTF-8", 2, (const char[2]){0xc3,0xa9}, + 0, 0, NULL }, + /* LEFT CURLY BRACKET */ + [2] = { "UTF-8", 2, (const char[2]){0x00,0x7b}, + "ZW", 6, (const char[6]){0x00,0x7a,0x57,0x20,0x7b,0x0a}, + 0, 0, NULL }, + /* LATIN SMALL LETTER O, TILDE */ + [3] = { "UTF-8", 2, (const char[2]){0x4f,0x7e}, + "VIQR", 3, (const char[3]){0x4f,0x5c,0x7e}, + 0, 0, NULL }, + /* LEFT CURLY BRACKET (optionally encoded in UTF-7) */ + [4] = { "UTF-7", 1, (const char[1]){0x7b}, + "UTF-8", 1, (const char[1]){0x7b}, + 0, IRREVERSIBLE, NULL }, + [5] = { "UTF-7", 4, "+AHs-", + "UTF-8", 1, (const char[1]){0x7b}, + 0, 0, NULL }, + /* éclair */ + [6] = { "UTF-7", 10, "+AOk-clair", + "UTF-8", 7, (const char[7]){ + 0xc3,0xa9,0x63,0x6c,0x61,0x69,0x72, + }, + 0, 0, NULL }, + [7] = { "HZ", 55, /* RFC 1843, Sec. 4, Example 1 */ + "The next sentence is in GB.~{<:Ky2;S{#,NpJ)l6HK!#~}Bye.", + "UTF-8", 61, (const char[61]) { + 0x54,0x68,0x65,0x20, 0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e, 0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73, 0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0xe5, 0xb7,0xb1,0xe6,0x89, + 0x80,0xe4,0xb8,0x8d, 0xe6,0xac,0xb2,0xef, + 0xbc,0x8c,0xe5,0x8b, 0xbf,0xe6,0x96,0xbd, + 0xe6,0x96,0xbc,0xe4, 0xba,0xba,0xe3,0x80, + 0x82,0x42,0x79,0x65, 0x2e + }, + 0, 0, NULL }, + /* Same as above but with HZ8 instead of HZ. */ + [8] = { "HZ8", 55, (const char[55]) { + 0x54,0x68,0x65,0x20,0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e,0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73,0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0x7e,0x7b,0xbc,0xba,0xcb, + 0xf9,0xb2,0xbb,0xd3,0xfb,0xa3,0xac,0xce, + 0xf0,0xca,0xa9,0xec,0xb6,0xc8,0xcb,0xa1, + 0xa3,0x7e,0x7d,0x42,0x79,0x65,0x2e + }, + "UTF-8", 61, (const char[61]) { + 0x54,0x68,0x65,0x20, 0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e, 0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73, 0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0xe5, 0xb7,0xb1,0xe6,0x89, + 0x80,0xe4,0xb8,0x8d, 0xe6,0xac,0xb2,0xef, + 0xbc,0x8c,0xe5,0x8b, 0xbf,0xe6,0x96,0xbd, + 0xe6,0x96,0xbc,0xe4, 0xba,0xba,0xe3,0x80, + 0x82,0x42,0x79,0x65, 0x2e + }, + 0, 0, NULL }, +}; + +#ifdef MIN +#undef MIN +#endif +#define MIN(x, y) ((x) < (y) ? (x) : (y)) + +static void +test_sample_bounded(const char *title, const struct sample *S, + size_t nsrc, size_t ndst) +{ + char inbuf[4096], inguard = arc4random(); + char outbuf[4096], outguard = arc4random(); + iconv_t C; + char *src0, *src, *dst0, *dst; + size_t srcleft0, srcleft, dstleft0, dstleft; + size_t ninval; + int error; + + ATF_REQUIRE_MSG(S->nsrc < sizeof(inbuf) - 2, "[%s]", title); + ATF_REQUIRE_MSG(S->ndst < sizeof(outbuf) - 2, "[%s]", title); + + memset(inbuf, inguard, sizeof(inbuf)); + memset(outbuf, outguard, sizeof(outbuf)); + src = src0 = inbuf + 1; + memcpy(src, S->src, nsrc); + dst = dst0 = outbuf + 1; + srcleft = srcleft0 = nsrc; + dstleft = dstleft0 = ndst; + + C = iconv_open(S->dst_codeset, S->src_codeset); + if (C == (iconv_t)-1) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv_open: %s (%d)", title, + strerror(error), error); + return; + } + + ninval = iconv(C, &src, &srcleft, &dst, &dstleft); + if (ninval == (size_t)-1) { + error = errno; + /* + * Incomplete input manifests as EINVAL -- ignore that, + * unless we're trying the full-size input. + * + * Truncated output manifests as E2BIG -- ignore that, + * unless we're trying the full-size output. + */ + if ((error != EINVAL || nsrc == S->nsrc) && + (error != E2BIG || ndst == S->ndst)) { + atf_tc_fail_nonfatal("[%s] iconv: %s (%d)", + title, strerror(error), error); + goto next; + } + } else if (ninval != S->ninval) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv:" + " %zu invalid, expected %zu", + title, ninval, S->ninval); + } + + ATF_CHECK_MSG(src0 <= src && src <= src0 + srcleft0, "[%s] iconv:" + " src went from %p to %p, expected [%p,%p]", + title, src0, src, src0, src0 + srcleft0); + ATF_CHECK_MSG(srcleft <= srcleft0, "[%s] iconv:" + " srcleft went from %zu to %zu", + title, srcleft0, srcleft); + ATF_CHECK_MSG(dst0 <= dst && dst <= dst0 + dstleft0, "[%s] iconv:" + " dst went from %p to %p, expected [%p,%p]", + title, dst0, dst, dst0, dst0 + dstleft0); + ATF_CHECK_MSG(dstleft <= dstleft0, "[%s] iconv:" + " dstleft went from %zu to %zu", + title, dstleft0, dstleft); + if (memcmp(dst0, S->dst, MIN(ndst, dstleft0 - dstleft)) != 0) { + size_t k; + + atf_tc_fail_nonfatal("[%s] iconv: bad conv", title); + fprintf(stderr, "[%s] input: ", title); + for (k = 0; k < nsrc; k++) + fprintf(stderr, " %02x", (unsigned char)S->src[k]); + fprintf(stderr, "\n"); + fprintf(stderr, "[%s] expected: ", title); + for (k = 0; k < ndst; k++) + fprintf(stderr, " %02x", (unsigned char)S->dst[k]); + fprintf(stderr, "\n"); + fprintf(stderr, "[%s] got: ", title); + for (k = 0; k < ndst; k++) + fprintf(stderr, " %02x", (unsigned char)dst0[k]); + fprintf(stderr, "\n"); + } + +next: if (dst0[-1] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran before buffer:" + " dst0[-1] = 0x%02x, expected 0x%02x", + title, dst0[-1], outguard); + } + if (dst0[ndst] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran after buffer:" + " dst0[ndst=%zu] = 0x%02x, expected 0x%02x", + title, ndst, dst0[ndst], outguard); + } + if (dst[0] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran past updated dst:" + " dst[0] = 0x%02x, expected 0x%02x", + title, dst[0], outguard); + } + + if (iconv_close(C) == -1) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv_close: %s (%d)", + title, strerror(error), error); + } +} + +static void +test_sample(const char *title, const struct sample *S) +{ + char buf[128]; + size_t nsrc, ndst; + + fprintf(stderr, "test %s from %s to %s\n", + title, S->src_codeset, S->dst_codeset); + + for (nsrc = 0; nsrc <= S->nsrc; nsrc++) { + snprintf(buf, sizeof(buf), "%s %zu/%zu", title, nsrc, S->ndst); + test_sample_bounded(buf, S, nsrc, S->ndst); + } + + for (ndst = 0; ndst <= S->ndst; ndst++) { + snprintf(buf, sizeof(buf), "%s %zu/%zu", title, S->nsrc, ndst); + test_sample_bounded(buf, S, S->nsrc, ndst); + } +} + +ATF_TC(iconv_samples); +ATF_TC_HEAD(iconv_samples, tc) +{ + + atf_tc_set_md_var(tc, "descr", "Test iconv on various fixed samples"); +} +ATF_TC_BODY(iconv_samples, tc) +{ + unsigned i; + + for (i = 0; i < __arraycount(samples); i++) { + const struct sample *S = &samples[i]; + struct sample reverse = { + .src_codeset = S->dst_codeset, + .dst_codeset = S->src_codeset, + .nsrc = S->ndst, + .src = S->dst, + .ndst = S->nsrc, + .dst = S->src, + .ninval = S->ninval_rev, + }; + char buf[128]; + + if (S->xfail) + atf_tc_expect_fail("%s", S->xfail); + + snprintf(buf, sizeof(buf), "case %u: %s to %s", i, + S->src_codeset, S->dst_codeset); + test_sample(buf, S); + if (S->ninval_rev != IRREVERSIBLE) { + snprintf(buf, sizeof(buf), "case %u: %s to %s", i, + S->dst_codeset, S->src_codeset); + test_sample(buf, &reverse); + } + + if (S->xfail) + atf_tc_expect_pass(); + } +} + +ATF_TC(iconv_pr59019_hz8); +ATF_TC_HEAD(iconv_pr59019_hz8, tc) +{ + + atf_tc_set_md_var(tc, "descr", "Truncated HZ8 input from PR 59019"); +} +ATF_TC_BODY(iconv_pr59019_hz8, tc) +{ + const char title[] = "iconv_pr59019_hz8"; + char in[4] = "\x7e\x7b\x7e\x7e"; /* ~{~~ */ + char out[4096], guard = arc4random(); + char *src0, *src, *dst0, *dst; + size_t srcleft0, srcleft, dstleft0, dstleft; + iconv_t C; + size_t ninval; + + memset(out, guard, sizeof(out)); + + REQUIRE_LIBC((C = iconv_open(/*to*/"UTF-8", /*from*/"HZ8")), + (iconv_t)-1); + + src = src0 = in; + srcleft = srcleft0 = sizeof(in); + dst = dst0 = out + 1; + dstleft = dstleft0 = sizeof(out) - 2; + + ninval = iconv(C, &src, &srcleft, &dst, &dstleft); + + /* + * XXX Not actually 100% sure this is the correct result -- I + * can't find a reference for the HZ8 encoding. + */ + ATF_CHECK_EQ_MSG(ninval, (size_t)-1, "[%s] iconv: ninval=%zu", title, + ninval); + + ATF_CHECK_MSG(src0 <= src && src <= src0 + srcleft0, "[%s] iconv:" + " src went from %p to %p, expected [%p,%p)", + title, src0, src, src0, src0 + srcleft0); + ATF_CHECK_MSG(srcleft <= srcleft0, "[%s] iconv:" + " srcleft went from %zu to %zu", + title, srcleft0, srcleft); + ATF_CHECK_MSG(dst0 <= dst && dst <= dst0 + dstleft0, "[%s] iconv:" + " dst went from %p to %p, expected [%p,%p)", + title, dst0, dst, dst0, dst0 + dstleft0); + ATF_CHECK_MSG(dstleft <= dstleft0, "[%s] iconv:" + " dstleft went from %zu to %zu", + title, dstleft0, dstleft); + + ATF_CHECK_EQ(dst0[-1], guard); + ATF_CHECK_EQ(dst0[dstleft0], guard); + + RL(iconv_close(C)); +} + +ATF_TP_ADD_TCS(tp) +{ + + ATF_TP_ADD_TC(tp, iconv_pr59019_hz8); + ATF_TP_ADD_TC(tp, iconv_samples); + + return atf_no_error(); +} diff --git a/lib/libc/tests/locale/Makefile b/lib/libc/tests/locale/Makefile index 70905cc58d24..2f9a08f65086 100644 --- a/lib/libc/tests/locale/Makefile +++ b/lib/libc/tests/locale/Makefile @@ -21,6 +21,7 @@ ATF_TESTS_C+= wctomb_2_test # Note: io_test requires zh_TW.Big5 locale (see ^/head@r315568) #NETBSD_ATF_TESTS_C= io_test +NETBSD_ATF_TESTS_C+= iconv_test NETBSD_ATF_TESTS_C+= mbrtowc_test NETBSD_ATF_TESTS_C+= mbstowcs_test NETBSD_ATF_TESTS_C+= mbsnrtowcs_test From nobody Tue Jun 30 17:20:18 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJy5vf2z6jY3p for ; Tue, 30 Jun 2026 17:20:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJy2Dqlz3q9r for ; Tue, 30 Jun 2026 17:20:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840018; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=IaQi8c7qESFCwpysIg4g2yCQsBIoaKntAFj5V1rrLhQ=; b=q/umJsG1T6bE2ESeMea1VAbTEHQy3XkxxtMug6ZCA8smMFvBpt3M/LsoeFUp1W0D8rXnGb UKFw9KAPYb4RCfHBimC1mZKMMAjhEnPBKvndfRH7F4LUWkrcssmZB4UeG0BlSaH7Ag1cYH VUv+IaVXjf+eK2NfxGz/wftHdyXCHMten+n+XGj3wTA7eGEEHV4DZyENH0+Yr2xRH2x4kC xGdjkH997fgrRfZNu5eaActEerxP+QPSdRpN8lktVUdQrgFc/ntYURkmsF/2/TiQ9+7HkW bGvzVrKnm/XU0jOShQjFX5HzK5CvuiWAVwWsaz5u0UI3Czib0LLybc3EgVr3Ow== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840018; a=rsa-sha256; cv=none; b=SrQPj9V7IyvxaqV5zaPKZR+FrdCnxXLgwyyGbsI4cdui3r1As/wWdBILWgeBlCTUviBqAI EbPCP0eB0rNglb2cTNHI7QwD8b1ZMKXKGf9Bhxt/XWL7H/OFLRfQDdsI1fpiEXvaWb80MB 1w2WHTE6s+WX69/toJwuJJlsgFUmzPNbDfAiZInd2lAwgBkCVLPuBpKDlqNkVol9gN/Hie YqwZECm6/pwZfgGsvGOD0ZRNcs26fVYOZsduHOCIrWWpB6Hq6wXmP0t9sxpcDkfQYoA+2g +3iBSPvJzIkh9j//VYO7m/0WjvbUOmXAtYkqDYcKRRDJUkshc2nlLJ/8qH1dEw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840018; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=IaQi8c7qESFCwpysIg4g2yCQsBIoaKntAFj5V1rrLhQ=; b=cWs2yjmWvxPsrjvJ/Tq7WrvJGYna6mNpX1ygK+4oNW7MdXfnBR50+LobeA0SfuaM05Vke9 DpY2xrPE/R6JFzogII02Wn4cXI/hzOeyUoLkFMaW30hcj4sW740CGwuhmUZYEUt7CDSfBl kdc0idGGvKxeGz8rO8myubUuFAb2PPADFTE9SpAu5KV90+AJEiWrN2sbSCK3GoVIXmE8E/ qVjni0zDV75Ns4Ev6vyquFByc2YK+SssPq+5T68ITey6B5BDppMcAr366MjVpV6Gn/J84d ZlTYx3BFJihkta5p8gvxcrKi8TDT6RU6g9dQDvF4Qr0Gv734bnME7C67dah1YQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJy11FDztRf for ; Tue, 30 Jun 2026 17:20:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45a1b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:18 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Taylor R Campbell From: Mark Johnston Subject: git: b3041ac4f2cd - stable/15 - iconv(3): Fix problems in various encodings List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: b3041ac4f2cdbc514dc13625ab1c43a4b198d860 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:18 +0000 Message-Id: <6a43fad2.45a1b.6c8669ab@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=b3041ac4f2cdbc514dc13625ab1c43a4b198d860 commit b3041ac4f2cdbc514dc13625ab1c43a4b198d860 Author: Taylor R Campbell AuthorDate: 2026-06-22 21:15:25 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 iconv(3): Fix problems in various encodings Fix null pointer dereference with HZ8 encoding. Fix output buffer overrun in UTF-7, VIQR, ZW encodings. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57947 --- lib/libiconv_modules/HZ/citrus_hz.c | 2 ++ lib/libiconv_modules/UTF7/citrus_utf7.c | 20 +++++++++++++++----- lib/libiconv_modules/VIQR/citrus_viqr.c | 6 +++++- lib/libiconv_modules/ZW/citrus_zw.c | 7 +++++-- 4 files changed, 27 insertions(+), 8 deletions(-) diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index f12938a7dab8..db738b8f812e 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -262,6 +262,8 @@ _citrus_HZ_mbrtowc_priv(_HZEncodingInfo * __restrict ei, tail = psenc->chlen = 0; continue; } + if (graphic == NULL) + break; } else if (ch & 0x80) { if (graphic != GR(psenc->inuse)) break; diff --git a/lib/libiconv_modules/UTF7/citrus_utf7.c b/lib/libiconv_modules/UTF7/citrus_utf7.c index f924366551f1..e7c6a0862c54 100644 --- a/lib/libiconv_modules/UTF7/citrus_utf7.c +++ b/lib/libiconv_modules/UTF7/citrus_utf7.c @@ -296,7 +296,7 @@ done: static int _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei, - char * __restrict s, size_t n __unused, uint16_t u16, + char * __restrict s, size_t n, uint16_t u16, _UTF7State * __restrict psenc, size_t * __restrict nresult) { int bits, i; @@ -336,6 +336,8 @@ _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei, psenc->ch[psenc->chlen++] = base64[i]; } } + if (n < (size_t)psenc->chlen) + return (E2BIG); memcpy(s, psenc->ch, psenc->chlen); *nresult = psenc->chlen; psenc->chlen = 0; @@ -352,6 +354,8 @@ _citrus_UTF7_wcrtomb_priv(_UTF7EncodingInfo * __restrict ei, uint16_t u16[2]; int err, i, len; size_t nr, siz; + char buf[8], *bufp = buf; + _UTF7State psenc_save = *psenc; u32 = (uint32_t)wchar; if (u32 <= UTF16_MAX) { @@ -367,14 +371,20 @@ _citrus_UTF7_wcrtomb_priv(_UTF7EncodingInfo * __restrict ei, return (EILSEQ); } siz = 0; + if (n > sizeof(buf)) + n = sizeof(buf); for (i = 0; i < len; ++i) { - err = _citrus_UTF7_utf16tomb(ei, s, n, u16[i], psenc, &nr); - if (err != 0) - return (err); /* XXX: state has been modified */ - s += nr; + err = _citrus_UTF7_utf16tomb(ei, bufp, n, u16[i], psenc, &nr); + if (err != 0) { + *nresult = (size_t)-1; + *psenc = psenc_save; /* restore state */ + return (err); + } + bufp += nr; n -= nr; siz += nr; } + memcpy(s, buf, siz); *nresult = siz; return (0); diff --git a/lib/libiconv_modules/VIQR/citrus_viqr.c b/lib/libiconv_modules/VIQR/citrus_viqr.c index 1747c0a1705e..c1e88f188aab 100644 --- a/lib/libiconv_modules/VIQR/citrus_viqr.c +++ b/lib/libiconv_modules/VIQR/citrus_viqr.c @@ -323,7 +323,11 @@ _citrus_VIQR_wcrtomb_priv(_VIQREncodingInfo * __restrict ei, int ch = 0; switch (psenc->chlen) { - case 0: case 1: + case 0: + break; + case 1: + if (n-- < 1) + goto e2big; break; default: return (EINVAL); diff --git a/lib/libiconv_modules/ZW/citrus_zw.c b/lib/libiconv_modules/ZW/citrus_zw.c index 3c650c46d0f4..cf66581c3336 100644 --- a/lib/libiconv_modules/ZW/citrus_zw.c +++ b/lib/libiconv_modules/ZW/citrus_zw.c @@ -263,9 +263,12 @@ _citrus_ZW_wcrtomb_priv(_ZWEncodingInfo * __restrict ei __unused, ch = (unsigned char)wc; switch (psenc->charset) { case NONE: - if (ch == '\0' || ch == '\n') + if (ch == '\0' || ch == '\n') { + if (n < 1) + return (E2BIG); + n -= 1; psenc->ch[psenc->chlen++] = ch; - else { + } else { if (n < 4) return (E2BIG); n -= 4; From nobody Tue Jun 30 17:20:21 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVK20Grvz6jXp6 for ; Tue, 30 Jun 2026 17:20:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVK15Ztwz3qPg for ; Tue, 30 Jun 2026 17:20:21 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840021; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=E+6pvRZlO26mEWWORg78wFMmrCD3H8Xnjp7RcGbT1Pg=; b=Hf78a61rDS2ZqgENGOF0PIL6umm9MD8fYyCZ4bEJI6G/kZhxYvCWUGvoJi3wbAcESIoFzo ugslwyB0ipLhSurcQLeYmh/OB3wTp8nX6b59z6Qws3Dc471RCb8ghBYI4TYaiymZvaQ3hy DAan1Vqtbm5IgMdQE5HOXsmfiwS6wgqvC0YJ6T0vpxgJ7z+kLNWGptmyloUbfeAiDytZM6 ukD0zy2EBsilffO2kruJr4SOtVyJH6iJGGBUFDHHPaMkgtWoAOE1HHGkVojV37jEY6A1zl V/ayK0KWy14m2FcXMTdUfGQhJLFoQvuu0rm/IwVEESCyrM8XPICkM3/JAqvRtg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840021; a=rsa-sha256; cv=none; b=NJBoaJwpiFwpjkny9K1f/nxsUS8whmBM/hOxXSto4Yotbjc726WRf6m+EIeTqrXpVZ0tdF iIsQNv+1K49Pi31ji9yjkKKUNDv59r4VqvazMGN1oHBTbEo5WI+fQV0TfVWpmY9dAb5aqR uHp9l2PdtZbRwpmvGgaw8NiwEWcOIrvYHPwSBEVsQwkmuyCS6hgewVqKjeIIDfm+X15R0b 5xhXjBgJX3yGIyS+qpF/o7XxyEctlJXT+ZUCBsOdaAEuP2oCSbQVh5Dejxo/EoUyJv9/n7 PSD7Y/ioq8E6lYaXyGUiq3iaK2W7s7d+pHxjNls4I7hEkL5ShGr0LTYPXUdJBQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840021; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=E+6pvRZlO26mEWWORg78wFMmrCD3H8Xnjp7RcGbT1Pg=; b=ov7TGzQaU12W+19YjNu964ruVXxdvLfSjOvH12zDgKF2DlEnbTIBQWItAC3O0FkoIhGw+c lpKqa3VKe2EGGBblQLl4UAHG5zixQ58/zW14g2J6Yc4WV9Knij78OjAEiS2nuN8irVqHkd gH0eVn9b+wKJjIOZI9c3jrT2y00ak4BG4frEvSmDM09W/XrRuA9eRnGGYkuhyfda3dCWDj /1d/wRSuDnD1gwIIJCtYl6TkENuC1bGM8Y7Yrn8JerMKSpGLpg0cJtp/oQEte1EwrCLvdx 8BpzEUm7QRR7FJ/br4A9rWjS2v9yzRK1GUyxo0MJLvVAW5qlhcAEDV9/k5NA3Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVK128wxztDL for ; Tue, 30 Jun 2026 17:20:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45e8d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:21 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 034e21efa19d - stable/15 - iconv: Fix a stack buffer overflow in _ISO2022_sputwchar() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 034e21efa19d065ee8921f6f23bdd32b545de166 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:21 +0000 Message-Id: <6a43fad5.45e8d.3a29a16f@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=034e21efa19d065ee8921f6f23bdd32b545de166 commit 034e21efa19d065ee8921f6f23bdd32b545de166 Author: Mark Johnston AuthorDate: 2026-06-23 17:45:28 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 iconv: Fix a stack buffer overflow in _ISO2022_sputwchar() In the ISO2022-CN encoding, characters may require at least seven bytes, and MB_LEN_MAX==6 is insufficient. From code inspection, _ISO2022_sputwchar() can emit 10 bytes in the worst case, so use that to size buffers. Add a regression test. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58082 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57950 --- contrib/netbsd-tests/lib/libc/locale/t_iconv.c | 20 ++++++++++++++++++++ lib/libiconv_modules/ISO2022/citrus_iso2022.c | 8 ++++---- 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c index f25c061bb170..199774769827 100644 --- a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c +++ b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c @@ -117,6 +117,26 @@ static const struct sample { 0x82,0x42,0x79,0x65, 0x2e }, 0, 0, NULL }, + /* 馬 from CNS 11643-1 */ + [9] = { "UTF-8", 3, (const char[3]){0xe9,0xa6,0xac}, + "ISO-2022-CN", 8, + (const char[8]){0x1b,0x24,0x29,0x47,0x0e,0x58,0x6b,0x0f}, + 0, 0, NULL }, + /* 馬毦 shifting from CNS 11643-1 to CNS 11643-2 */ + [10] = { "UTF-8", 6, (const char[6]){0xe9,0xa6,0xac,0xe6,0xaf,0xa6}, + "ISO-2022-CN", 16, + (const char[16]){ + /* ESC $ ) G (shift G1 to CNS 11643 plane 1) */ + 0x1b,0x24,0x29,0x47, + 0x0e, /* GL is G1 from now on */ + 0x58,0x6b, /* 馬 */ + /* ESC $ * H (shift G2 to CNS 11643 plane 2) */ + 0x1b,0x24,0x2a,0x48, + 0x1b,0x4e, /* GL is G2 for next char */ + 0x30,0x21, /* 毦 */ + 0x0f, /* GL is G0 from now on */ + }, + 0, 0, "PR lib/59019: various iconv issues ([case 10: ISO-2022-CN to UTF-8 14/6] iconv: Illegal byte sequence (85))" }, }; #ifdef MIN diff --git a/lib/libiconv_modules/ISO2022/citrus_iso2022.c b/lib/libiconv_modules/ISO2022/citrus_iso2022.c index 126d38316df4..a28dc0be0022 100644 --- a/lib/libiconv_modules/ISO2022/citrus_iso2022.c +++ b/lib/libiconv_modules/ISO2022/citrus_iso2022.c @@ -129,7 +129,7 @@ typedef struct { #define _FUNCNAME(m) _citrus_ISO2022_##m #define _ENCODING_INFO _ISO2022EncodingInfo #define _ENCODING_STATE _ISO2022State -#define _ENCODING_MB_CUR_MAX(_ei_) MB_LEN_MAX +#define _ENCODING_MB_CUR_MAX(_ei_) 10 #define _ENCODING_IS_STATE_DEPENDENT 1 #define _STATE_NEEDS_EXPLICIT_INIT(_ps_) \ (!((_ps_)->flags & _ISO2022STATE_FLAG_INITIALIZED)) @@ -1012,7 +1012,7 @@ _ISO2022_sputwchar(_ISO2022EncodingInfo * __restrict ei, wchar_t wc, { _ISO2022Charset cs; char *p; - char tmp[MB_LEN_MAX]; + char tmp[10]; size_t len; int bit8, i = 0, target; unsigned char mask; @@ -1177,7 +1177,7 @@ _citrus_ISO2022_put_state_reset(_ISO2022EncodingInfo * __restrict ei, size_t * __restrict nresult) { char *result; - char buf[MB_LEN_MAX]; + char buf[10]; size_t len; int ret; @@ -1206,7 +1206,7 @@ _citrus_ISO2022_wcrtomb_priv(_ISO2022EncodingInfo * __restrict ei, _ISO2022State * __restrict psenc, size_t * __restrict nresult) { char *result; - char buf[MB_LEN_MAX]; + char buf[10]; size_t len; int ret; From nobody Tue Jun 30 17:20:27 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVK81zMcz6jY47 for ; Tue, 30 Jun 2026 17:20:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVK76KNzz3qQR for ; Tue, 30 Jun 2026 17:20:27 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840027; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wH/kqJp8QZzyLhEpT30E/GCOJYLQQ/JsluMLFCEdT24=; b=jfvooN8f9mg2JfH1VZQn1+BAjdEY5f7Q6eeJyX3kwbzBPgzXD4oHtFg4zi8gGNIaI1kT61 tBadI8X6nv8vBgkywA6WxmpoMQFV/8YFbKX45wUpBWRib3v+zKuQBbwWBu4EVFNWlUXx1F xRWXFO04BBTMkzemFa7DIFyfibaJWJG7j9bfQDa9cRf42ZVgwhcTmMS4R2UmQWrVaTT2s5 BwDuoBA1iHD2aHTJL/pe9RtZ1GsBERpzCkBwNkTAgVHresITZS070MsxWgxXDB7OeFdjPJ jWkLK6uK8180j9OrDvDsRLwRVaXxga2gnYj0UczgNj+3lUPA7L8v/Rtc9eq8oA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840027; a=rsa-sha256; cv=none; b=T1CQxlvXZ1GETNDoIvdN1jjErcb0itjfIuaccY/2rDW5tzmVDhsnbpsnUEMP8GhmXexJiI BBaT/NWQjT5e+QMy194Jqsje18r5bvX2BraodUNqvF+TUgaML97nvXrzxE5c//Lx84263/ 5xDVW0kg8pIusQLm2H5Ud0L0FZf9mTZc4GKpmFEDkElka6ZgwYhi9rLFh3Eh9ze2N/gmTy nrOKe74ljkbZs94/OAQa0xJxWBCQ3BrskWrb1NYdWVcEA7MZgKiVzY17T22JusyQMvnzL6 bUVn/Jit/JV03HZfnak+OLJU+j+UwmZryP6gRYb4+vGr6LGzwyNmMtvnXYl4bw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840027; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wH/kqJp8QZzyLhEpT30E/GCOJYLQQ/JsluMLFCEdT24=; b=UbsHw25ulwILQVT7yNdmYoYpJ1BFEfxubFZ+rgEXiM4RZ9RUbhrVfHg3MJBsStKmX0arx0 uw6xVuROCBt0KPpS0m+Hbk6ma/iEBb5aeOrlnzHhL+jbMQUqLEl93pKTlI7AkPdbqVQL+R zLXHAl+DaqAzLMoCLEPqYqoT9f3V2RySIXnqR7cltPWAfEWbBzn40tVO3ObCgNCXpVNuwm RPQeD2mkjs7F4o6tLgabDcBu+Eo9+gWpMMcUkOl98lGiRlunVx2b20L3C3dVQFe+v+8xNe RzXmVtxn5p1XOYIcUz7UU4oHP7JzozhHBKg7+BdvTASb08Z9iTP24yc+CkeKzg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVK75DYbzsXm for ; Tue, 30 Jun 2026 17:20:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45fa0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:27 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 78bd098b9f83 - releng/14.3 - device_pager: Avoid double-insertion of pages into the pager list List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 78bd098b9f8398595ebdc509beaf09b79e32978f Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:27 +0000 Message-Id: <6a43fadb.45fa0.53402566@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=78bd098b9f8398595ebdc509beaf09b79e32978f commit 78bd098b9f8398595ebdc509beaf09b79e32978f Author: Mark Johnston AuthorDate: 2026-06-22 14:40:22 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:01 +0000 device_pager: Avoid double-insertion of pages into the pager list Unmanaged device pager objects maintain a linked list of pages that were returned from the fault handler. Initially, such pages are valid, but msync(MS_INVALIDATE) can mark them invalid (and clean). They are not removed from page tables (since they are unmanaged), but a subsequent mlock() call can trigger a page fault that is handled by the pager. dev_pager_getpages() then re-inserts the page into the linked list even though it's already present there. This patch fixes the problem by removing the linked list. OBJ_PG_DTOR is set, so vm_object_terminate_pages() does nothing, and dev_pager_dealloc() instead handles cleanup of the object. Add a regression test case which triggers a queue.h assertion failure in unpatched kernels. Note, in stable branches we should avoid changing the layout of struct vm_object. Approved by: so Security: FreeBSD-SA-26:37.vm Security: CVE-2026-49418 Reported by: slidybat Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57743 --- sys/vm/device_pager.c | 34 +++++++++++++++++----------------- sys/vm/vm_object.h | 2 +- sys/vm/vm_page.c | 6 ++++-- tests/sys/vm/mmap_test.c | 30 ++++++++++++++++++++++++++++++ 4 files changed, 52 insertions(+), 20 deletions(-) diff --git a/sys/vm/device_pager.c b/sys/vm/device_pager.c index bceff38a41c3..b32d18fc3354 100644 --- a/sys/vm/device_pager.c +++ b/sys/vm/device_pager.c @@ -210,7 +210,8 @@ again: object1 = NULL; object->handle = handle; object->un_pager.devp.ops = ops; - TAILQ_INIT(&object->un_pager.devp.devp_pglist); + if (object->type == OBJT_DEVICE) + vm_object_set_flag(object, OBJ_PG_DTOR); TAILQ_INSERT_TAIL(&dev_pager_object_list, object, pager_object_list); mtx_unlock(&dev_pager_mtx); @@ -282,15 +283,12 @@ dev_pager_free_page(vm_object_t object, vm_page_t m) KASSERT((object->type == OBJT_DEVICE && (m->oflags & VPO_UNMANAGED) != 0), ("Managed device or page obj %p m %p", object, m)); - TAILQ_REMOVE(&object->un_pager.devp.devp_pglist, m, plinks.q); vm_page_putfake(m); } static void dev_pager_dealloc(vm_object_t object) { - vm_page_t m; - VM_OBJECT_WUNLOCK(object); object->un_pager.devp.ops->cdev_pg_dtor(object->un_pager.devp.handle); @@ -300,15 +298,21 @@ dev_pager_dealloc(vm_object_t object) VM_OBJECT_WLOCK(object); if (object->type == OBJT_DEVICE) { - /* - * Free up our fake pages. - */ - while ((m = TAILQ_FIRST(&object->un_pager.devp.devp_pglist)) - != NULL) { - if (vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL) == 0) - continue; - - dev_pager_free_page(object, m); + vm_page_t m, mtmp; + +restart: + TAILQ_FOREACH_SAFE(m, &object->memq, listq, mtmp) { + if (!vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL)) + goto restart; + if (vm_page_remove(m)) { + /* + * We could end up with invalid pages installed + * by the generic page fault handler. Typically + * these are replaced by the device pager. + */ + vm_page_free(m); + } else if ((m->flags & PG_FICTITIOUS) != 0) + dev_pager_free_page(object, m); } } object->handle = NULL; @@ -337,10 +341,6 @@ dev_pager_getpages(vm_object_t object, vm_page_t *ma, int count, int *rbehind, (object->type == OBJT_MGTDEVICE && (ma[0]->oflags & VPO_UNMANAGED) == 0), ("Wrong page type %p %p", ma[0], object)); - if (object->type == OBJT_DEVICE) { - TAILQ_INSERT_TAIL(&object->un_pager.devp.devp_pglist, - ma[0], plinks.q); - } if (rbehind) *rbehind = 0; if (rahead) diff --git a/sys/vm/vm_object.h b/sys/vm/vm_object.h index bd71820bed3c..997f69c10065 100644 --- a/sys/vm/vm_object.h +++ b/sys/vm/vm_object.h @@ -137,7 +137,7 @@ struct vm_object { * devp_pglist - list of allocated pages */ struct { - TAILQ_HEAD(, vm_page) devp_pglist; + void *spare[2]; const struct cdev_pager_ops *ops; void *handle; } devp; diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c index ac922f4a3bc8..181429488c93 100644 --- a/sys/vm/vm_page.c +++ b/sys/vm/vm_page.c @@ -1297,8 +1297,10 @@ vm_page_putfake(vm_page_t m) KASSERT((m->oflags & VPO_UNMANAGED) != 0, ("managed %p", m)); KASSERT((m->flags & PG_FICTITIOUS) != 0, ("vm_page_putfake: bad page %p", m)); - vm_page_assert_xbusied(m); - vm_page_busy_free(m); + if (m->object != NULL) { + vm_page_assert_xbusied(m); + vm_page_busy_free(m); + } uma_zfree(fakepg_zone, m); } diff --git a/tests/sys/vm/mmap_test.c b/tests/sys/vm/mmap_test.c index 6bc30f73ca95..a94fb56c46cf 100644 --- a/tests/sys/vm/mmap_test.c +++ b/tests/sys/vm/mmap_test.c @@ -362,6 +362,35 @@ ATF_TC_BODY(mmap__maxprot_shm, tc) ATF_REQUIRE(close(fd) == 0); } +/* A regression test for a bug in the device pager. */ +ATF_TC_WITHOUT_HEAD(mmap__device_reinsert); +ATF_TC_BODY(mmap__device_reinsert, tc) +{ + void *p; + int fd; + + fd = open("/dev/devstat", O_RDONLY); + ATF_REQUIRE(fd >= 0); + + p = mmap(NULL, getpagesize(), PROT_READ, MAP_SHARED, fd, 0); + ATF_REQUIRE(p != MAP_FAILED); + + /* + * Use mlock() to trigger a fault, since msync() will not actually + * remove the page from the process page tables. + */ + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + ATF_REQUIRE(msync(p, getpagesize(), MS_INVALIDATE) == 0); + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + ATF_REQUIRE(msync(p, getpagesize(), MS_INVALIDATE) == 0); + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + + ATF_REQUIRE(munmap(p, getpagesize()) == 0); +} + ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TC(tp, mmap__map_at_zero); @@ -371,6 +400,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, mmap__write_only); ATF_TP_ADD_TC(tp, mmap__maxprot_basic); ATF_TP_ADD_TC(tp, mmap__maxprot_shm); + ATF_TP_ADD_TC(tp, mmap__device_reinsert); return (atf_no_error()); } From nobody Tue Jun 30 17:20:26 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVK74QTDz6jY43 for ; Tue, 30 Jun 2026 17:20:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVK66RhQz3qSL for ; Tue, 30 Jun 2026 17:20:26 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840027; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dR/o/f0VCDJZhMKad7OCb7cQe93lnvQCyPn0uueKaXU=; b=nSkdRpYQX//wKymcFy3X4y6SUgrViRgm0FymD4GrNI0u4Ib83L6xewbr035c2njLFCB7cQ SlyrF5RoAWyApO2jtBvwZ6drnCIftreSrw3T3+Y89KczJa31eSfcDlVYdOlZEJ45J+31yB xFVVWihuMKDEo5hln0DfFsp0ulJFBCU0zKc+KUouPYBGOteCfmbZrDnaGEfqARp47Tmc9w hR7MPeawAfoZht7S4u+N7wpPIp0m4qO+4nx3RGvQCpHnhsxE/svBj8ylwfsB+/bqeFHPXo TIHA4Jtn7gmKIaFhILPb0aTUD8msf2lvyGISC3g1tATGTNDo/CaU+ONVtB3AmA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840027; a=rsa-sha256; cv=none; b=gisncWARq5H33lnj7uqmgtSMBFxCRrEiyc7g6OY4a/zqyRlEJqA6oOmkBt1EYqg94XjLZA /OhEQwQ/ClUvRcEQOrRFK+6r5p6XbALZTrxB8EgLXqNUNAMec3INNYYtP1hg+K72kDQGEC gsMdgNdhwV4/H0DyP8GWHJnwC6UVbzDjrpF4kT14tlHA4Fv76rnblMori838YaZaw75GdA cw9vpvUZlwxwHeQe4PcGkMNgd8tqQfrdHgYO1Qn8utNd2hcU4yB9yuzerM6DnDSuuhzG1E Am3X8oAu1720Jwtq7aEWqHSpTqH2ibn0e3FaCL2ftXd8bBkogcDgA7wuupcNDg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840027; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dR/o/f0VCDJZhMKad7OCb7cQe93lnvQCyPn0uueKaXU=; b=TYcoZ7DlDCB9z8gSaT93lsnnWE0JYeSSmpzEbmTG6XJtZxfOeL/bQC/t/Qn6wxmwReHnPT l+Zo5MaFQdz1VyHOQrzP5Nsz8HuupHiaMoZigeaKoILlrApc8Y0Oik3AjJKsjyPP+58JK8 InvfMtiOptJDlk5R8R3yiAq/Dr1zQI+Y70Mlc/w7AAgoWW3ZFT60FjCTeTDSL2NXORpa0X 9CXMRYFujPEmK1gcp7ZM5xQCyNKUnoBpbZolQnmVehiFF4cs6fYOnkfV+1vY4YiXfYf6+d Dmg9giHN62GoiPDP3rI+P9U5Z/oXY4Q4t1vrQOQXp7VhRx49R4STKTO8uZKuow== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVK64NzTztVC for ; Tue, 30 Jun 2026 17:20:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45891 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:26 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Piotr Kubaj From: Mark Johnston Subject: git: e96d0e1fccf5 - releng/14.3 - sys/arm64: fix return values of freebsd32_{set,swap}context() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: e96d0e1fccf5bbc59f43403b4dc7582f4b75ca70 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:26 +0000 Message-Id: <6a43fada.45891.4c636a87@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=e96d0e1fccf5bbc59f43403b4dc7582f4b75ca70 commit e96d0e1fccf5bbc59f43403b4dc7582f4b75ca70 Author: Piotr Kubaj AuthorDate: 2026-06-11 11:41:29 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:31:57 +0000 sys/arm64: fix return values of freebsd32_{set,swap}context() This patch aligns the return values of freebsd32_{set,swap}context() with their counterparts on amd64 and powerpc64, fixing the setcontext() and swapcontext() calls in armv7 applications running on aarch64. In particular, this fixes random crashes in armv7 Ruby applications running on aarch64 hosts. Approved by: so Security: FreeBSD-EN-26:16.arm64 Tested by: fuz MFC after: 1 week (cherry picked from commit 92ae21e8a155734f73589b7ef9fa19a6bb6d042f) (cherry picked from commit 58a15fe75cc59a73016f00069f2dad001d798edf) --- sys/arm64/arm64/freebsd32_machdep.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/arm64/arm64/freebsd32_machdep.c b/sys/arm64/arm64/freebsd32_machdep.c index 1cf8403e0a0e..dc0e536c2bbc 100644 --- a/sys/arm64/arm64/freebsd32_machdep.c +++ b/sys/arm64/arm64/freebsd32_machdep.c @@ -292,7 +292,7 @@ freebsd32_setcontext(struct thread *td, struct freebsd32_setcontext_args *uap) NULL, 0); } } - return (ret); + return (ret == 0 ? EJUSTRETURN : ret); } int @@ -340,7 +340,7 @@ freebsd32_swapcontext(struct thread *td, struct freebsd32_swapcontext_args *uap) } } } - return (ret); + return (ret == 0 ? EJUSTRETURN : ret); } void From nobody Tue Jun 30 17:20:28 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVK92QPxz6jYCq for ; Tue, 30 Jun 2026 17:20:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVK903lgz3qR1 for ; Tue, 30 Jun 2026 17:20:29 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840029; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mMK4aX6vwFf9Bdz3X+ii6VLlxxyTepV4GlpoJAtBHNA=; b=Mh1dWWHa+SYZQxIU+5ppTVOd8hJroXmNRXA4yJdpnlx0pw8X4X4a6ININrhwAX0NvSSYIL oaaVfWiYaSjpSx/+q5lVbua1uVUYNQp8l3rEhpSc7KaLnAYc6a5phl4nro9R1I0deIDuK7 R1P41ZNuPq7f7pB24M6eSGmLt0zgxZ5woX0p4pAsCUNgenVtUi+uSGnjQqCeJF9NVYi/oe oZkzOKMy8MEWvThMOJOoHRRmE5px6eEMF5DL3kiZlbeGREq9LC41qKg89Ct9HBW/yemdk/ CYa7JAjqSaJnMTjYCNnKqazqGzM75Pd+0jWA6+Vxqqi5j7TflgevD6VrHM6Qzw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840029; a=rsa-sha256; cv=none; b=jcVoiUc6ZGDQDTRjTFccExzoQ11cH5V95EYBlKDCZpdo5roAhaM2kv62kjj6c6e7up0+mU 3C2uNyqGo27e44zFMlkw7PwPWTNYAVOgI1j2mrWhofbTT6ecqOqIyKonjpwd08T7EjVwCH 7oroTceVOr5jkxuMtjniXKkcYtOAl7A/tVMzXOKSV+7djM0JVZckqqLgY3faw1nYpVAU7+ P0B0VLzjdgOOZ7zFKaGpfpGzkGEW37MWLSMRvILIt4JGRpX42+b3Ef42Ije8cgVhx15Hvo WZlwamxkf666ShWAlJs26+p1bJD9SZqiOwIXzvl80fRiADEUQCncLeaLpvoBWw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840029; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mMK4aX6vwFf9Bdz3X+ii6VLlxxyTepV4GlpoJAtBHNA=; b=yHKyWtK1RvZNlqV2b8zfZ8Dd1w1zHfI/rLEX8NsJ0m0HoN/EbDYC7E3IB8uTW8V8GHYTAt kAYthduNSWE/JC4lps9b7dg0yPx0ba3T2PAy/JuE7hC0vSCz7LUv2h5sa6Gwn6zJuq69St QlLLhy0sld0To0kjeZxOswZWJtAvmXW5RMI85SxZeaPy1DgW6n/Px1G7wtZFjpW/FkraGH PqnPnd86zf7K/CT73Hg7Ga7/BtGnXW6rd7YcE8B2RguDx2cpRWHncMkhXUF6Me/ydt6rIT XD8OJDllxYtL3ja13YbbVz1A0qaTUMRzW7rGFa3qX12Ul3qPlZ2QEd90PnYxGA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVK8646NztVF for ; Tue, 30 Jun 2026 17:20:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45e07 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:28 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Konstantin Belousov From: Mark Johnston Subject: git: 6772a8ece2c0 - releng/14.3 - execve_block(): a mechanism for mutual exclusion with execve() on the process List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 6772a8ece2c01362e37d25be00967f815b9c2b62 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:28 +0000 Message-Id: <6a43fadc.45e07.2dd98d12@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=6772a8ece2c01362e37d25be00967f815b9c2b62 commit 6772a8ece2c01362e37d25be00967f815b9c2b62 Author: Konstantin Belousov AuthorDate: 2026-05-26 17:36:20 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:01 +0000 execve_block(): a mechanism for mutual exclusion with execve() on the process (cherry picked from commit e1a84b7708c2514769625c2af6c5034694013b6a) (cherry picked from commit dc94d15a7136c4cfe3342c005d8a319f0583ed9a) proc: Allow to make proc_rwmem() operate on a consistent address space (cherry picked from commit e1b0d051bbf7e4e730470cbd6622f71a639834c3) (cherry picked from commit e7578e37d832ecf1eee8cd3fed10df0e0cb1aa7e) kern_proc.c: ensure stability of the vmspace we read the strings from (cherry picked from commit a22c044cce41864a32af6b8281a3c416a2664d7f) (cherry picked from commit 1f062247ef4e920e7fdd1ebe91b4600d69fe1e91) kern_proc.c: ensure stability of the vmspace for sysctl kern.proc.vmmap (cherry picked from commit 5fe6e08d2db56b530f0df2903ef24cfabab7b8ea) (cherry picked from commit e856c10a4d6dfe30a730246b2050d9dd438085db) kern_proc.c: ensure stability of the vmspace for sysctl kern.proc.vm_layout (cherry picked from commit 31fa677e4af00b795bf671847b4dc72960c90f14) (cherry picked from commit da1398dd6962b458fdcf25799fcb512f4d9c070d) kern_proc.c: make kern.proc.osrel atomic (cherry picked from commit 80626f34ee985671bb8c60ee986b89587b7a1511) (cherry picked from commit b3f99ce653d456c9c829359b0dc83c4867f044b7) kern_proc.c: disallow execve around sysctl kern.proc.kstacks (cherry picked from commit 8b5abd9027b8b1f6290c756730ee3adebed007f4) (cherry picked from commit 197f367cdda7919578d15b1562225d6db462c5ad) kern_proc.c: disallow execve around sysctl kern.proc.rlimit (cherry picked from commit 5a91fa5a7656c99e527fe7e6f6bf6bd9e85ab589) (cherry picked from commit 35b95beb06cab0b10a7e3a697931851315fe3dc2) kern_event: block the target process from execing for sysctl kern.proc.kqueue (cherry picked from commit 79b384bd8fdff4869ce4799edb0342ff5c25b6fa) (cherry picked from commit adb14791b752cf0f07dce44d840f01340aa6d6cb) kern_resource.c: disallow execve around sysctl kern.proc.rlimitusage (cherry picked from commit 836749817036b90b60af0584fa21f2d9dbd60ff7) (cherry picked from commit 190d6677b11a1deed6bd0ef14fd4f990eea20f5b) kern_procctl(PROC_WX_MAPPINGS_PERMIT): ensure stability of the target vmspace (cherry picked from commit 6a572920f251ac8ac6a80a55d4d039736ea7dd65) (cherry picked from commit 23ebf0c97ac5fcd6adb6cda8a8707b99257721a6) linux_prlimit(): block execve for the target (cherry picked from commit e41c28e67fac9cd22a85b160c5c9d0477ed03600) (cherry picked from commit a11c4f036c1136ba90fbfda5d2025d18116562d8) pfs_readdir(): block the target process from execing (cherry picked from commit 4c0a0909f928baac982b7de4bfa5b5ca7de5291a) (cherry picked from commit caa2e5cf7cfb07c115d143023ffb21546a60556a) pseudofs: ensure that the target process vmspace is stable for VOP_READ/WRITE (cherry picked from commit a4993bac41350e85bc9affb862d2974a1a09bb5e) (cherry picked from commit ec0d7d01d6c45eff4043cf178addf65d1933d62a) procfs, linprocfs: ensure target process vmspace stability (cherry picked from commit 5db31f1b47b586a5091eb41fc957236f28b78dba) (cherry picked from commit d7d5337291c983ba969e24c95df0bcab46b44621) sys_set*id(9): wait for the execblocks to pass (cherry picked from commit d0384f50dad25d3358d76f7556969ea1d515ba68) (cherry picked from commit 34b95f53e7ac3a055b3d866d101a79e85d0022c4) kern_exec.c: explicitly include sys/limits.h for UINT_MAX (cherry picked from commit f5fce0bcc370a9700249e64901eabf2e0be4ecb0) (cherry picked from commit bb1154f3ea20291b0c02821743084a6f1a7dd844) Approved by: so Security: FreeBSD-SA-26:39.execve Security: CVE-2026-49415 --- sys/compat/linprocfs/linprocfs.c | 16 +--- sys/compat/linux/linux_misc.c | 15 +++ sys/fs/cuse/cuse.c | 4 +- sys/fs/procfs/procfs_map.c | 17 ++-- sys/fs/procfs/procfs_mem.c | 6 +- sys/fs/pseudofs/pseudofs_vnops.c | 69 ++++++++++---- sys/kern/kern_event.c | 22 ++++- sys/kern/kern_exec.c | 81 ++++++++++++++++- sys/kern/kern_exit.c | 1 + sys/kern/kern_fork.c | 1 + sys/kern/kern_proc.c | 191 +++++++++++++++++++++++---------------- sys/kern/kern_procctl.c | 23 +++-- sys/kern/kern_prot.c | 20 +++- sys/kern/kern_resource.c | 27 ++++-- sys/kern/sys_process.c | 124 +++++++++++++++++++++---- sys/sys/imgact.h | 4 + sys/sys/proc.h | 3 + sys/sys/ptrace.h | 15 ++- 18 files changed, 467 insertions(+), 172 deletions(-) diff --git a/sys/compat/linprocfs/linprocfs.c b/sys/compat/linprocfs/linprocfs.c index d4f38b491471..b42cbea61d09 100644 --- a/sys/compat/linprocfs/linprocfs.c +++ b/sys/compat/linprocfs/linprocfs.c @@ -1317,19 +1317,13 @@ linprocfs_doprocmaps(PFS_FILL_ARGS) struct vattr vat; bool private; - PROC_LOCK(p); - error = p_candebug(td, p); - PROC_UNLOCK(p); - if (error) - return (error); - if (uio->uio_rw != UIO_READ) return (EOPNOTSUPP); - error = 0; - vm = vmspace_acquire_ref(p); - if (vm == NULL) - return (ESRCH); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, + &vm); + if (error != 0) + return (error); if (SV_CURPROC_FLAG(SV_LP64)) l_map_str = l64_map_str; @@ -1427,7 +1421,7 @@ linprocfs_doprocmaps(PFS_FILL_ARGS) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_CHECK_DEBUG | PRVM_BLOCK_EXEC, vm); return (error); } diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c index b87c05322e16..41977e5a899c 100644 --- a/sys/compat/linux/linux_misc.c +++ b/sys/compat/linux/linux_misc.c @@ -2007,6 +2007,7 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) u_int which; int flags; int error; + bool exec_blocked; if (args->new == NULL && args->old != NULL) { if (linux_get_dummy_limit(args->resource, &rlim)) { @@ -2034,6 +2035,7 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) return (error); } + exec_blocked = false; flags = PGET_HOLD | PGET_NOTWEXIT; if (args->new != NULL) flags |= PGET_CANDEBUG; @@ -2046,6 +2048,14 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) error = pget(args->pid, flags, &p); if (error != 0) return (error); + exec_blocked = true; + PROC_LOCK(p); + execve_block_wait(td, p); + error = args->new != NULL ? p_candebug(td, p) : + p_cansee(td, p); + PROC_UNLOCK(p); + if (error != 0) + goto out; } if (args->old != NULL) { PROC_LOCK(p); @@ -2068,6 +2078,11 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) error = kern_proc_setrlimit(td, p, which, &nrlim); out: + if (exec_blocked) { + PROC_LOCK(p); + execve_unblock(td, p); + PROC_UNLOCK(p); + } PRELE(p); return (error); } diff --git a/sys/fs/cuse/cuse.c b/sys/fs/cuse/cuse.c index d63a7d4691cf..b9423fd3543d 100644 --- a/sys/fs/cuse/cuse.c +++ b/sys/fs/cuse/cuse.c @@ -914,7 +914,7 @@ cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s, }; PHOLD(proc_s); - error = proc_rwmem(proc_s, &uio); + error = proc_rwmem(proc_s, &uio, 0); PRELE(proc_s); } else if (proc_cur == proc_s) { @@ -933,7 +933,7 @@ cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s, }; PHOLD(proc_d); - error = proc_rwmem(proc_d, &uio); + error = proc_rwmem(proc_d, &uio, 0); PRELE(proc_d); } else { error = EINVAL; diff --git a/sys/fs/procfs/procfs_map.c b/sys/fs/procfs/procfs_map.c index db6b225f6426..5ccef979856b 100644 --- a/sys/fs/procfs/procfs_map.c +++ b/sys/fs/procfs/procfs_map.c @@ -42,6 +42,7 @@ #include #include #include +#include #include #include #include @@ -95,15 +96,14 @@ procfs_doprocmap(PFS_FILL_ARGS) bool wrap32; #endif - PROC_LOCK(p); - error = p_candebug(td, p); - PROC_UNLOCK(p); - if (error) - return (error); - if (uio->uio_rw != UIO_READ) return (EOPNOTSUPP); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, + &vm); + if (error != 0) + return (error); + #ifdef COMPAT_FREEBSD32 wrap32 = false; if (SV_CURPROC_FLAG(SV_ILP32)) { @@ -113,9 +113,6 @@ procfs_doprocmap(PFS_FILL_ARGS) } #endif - vm = vmspace_acquire_ref(p); - if (vm == NULL) - return (ESRCH); map = &vm->vm_map; vm_map_lock_read(map); VM_MAP_ENTRY_FOREACH(entry, map) { @@ -240,6 +237,6 @@ procfs_doprocmap(PFS_FILL_ARGS) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, vm); return (error); } diff --git a/sys/fs/procfs/procfs_mem.c b/sys/fs/procfs/procfs_mem.c index c74954db37d6..5fc0c1acf140 100644 --- a/sys/fs/procfs/procfs_mem.c +++ b/sys/fs/procfs/procfs_mem.c @@ -61,11 +61,7 @@ procfs_doprocmem(PFS_FILL_ARGS) if (uio->uio_resid == 0) return (0); - PROC_LOCK(p); - error = p_candebug(td, p); - PROC_UNLOCK(p); - if (error == 0) - error = proc_rwmem(p, uio); + error = proc_rwmem(p, uio, PRVM_CHECK_DEBUG | PRVM_BLOCK_EXEC); return (error); } diff --git a/sys/fs/pseudofs/pseudofs_vnops.c b/sys/fs/pseudofs/pseudofs_vnops.c index 0bdfedffafcb..0695c2f727ea 100644 --- a/sys/fs/pseudofs/pseudofs_vnops.c +++ b/sys/fs/pseudofs/pseudofs_vnops.c @@ -37,6 +37,7 @@ #include #include #include +#include #include #include #include @@ -132,6 +133,7 @@ static int pfs_lookup_proc(pid_t pid, struct proc **p) { struct proc *proc; + struct thread *td; proc = pfind(pid); if (proc == NULL) @@ -141,8 +143,10 @@ pfs_lookup_proc(pid_t pid, struct proc **p) return (0); } _PHOLD(proc); - PROC_UNLOCK(proc); + td = curthread; + execve_block_wait(td, proc); *p = proc; + PROC_UNLOCK(proc); return (1); } @@ -672,6 +676,7 @@ pfs_read(struct vop_read_args *va) struct pfs_node *pn = pvd->pvd_pn; struct uio *uio = va->a_uio; struct proc *proc; + struct thread *td; struct sbuf *sb = NULL; int error, locked; off_t buflen, buflim; @@ -690,21 +695,30 @@ pfs_read(struct vop_read_args *va) if (pn->pn_fill == NULL) PFS_RETURN (EIO); + td = curthread; + /* * This is necessary because either process' privileges may * have changed since the open() call. */ - if (!pfs_visible(curthread, pn, pvd->pvd_pid, &proc)) + if (!pfs_visible(td, pn, pvd->pvd_pid, &proc)) PFS_RETURN (EIO); - if (proc != NULL) { - _PHOLD(proc); - PROC_UNLOCK(proc); - } vhold(vn); locked = VOP_ISLOCKED(vn); VOP_UNLOCK(vn); + if (proc != NULL) { + _PHOLD(proc); + execve_block_wait(td, proc); + if (!pfs_visible_proc(td, pn, proc)) { + PROC_UNLOCK(proc); + error = EIO; + goto ret; + } + PROC_UNLOCK(proc); + } + if (pn->pn_flags & PFS_RAWRD) { PFS_TRACE(("%zd resid", uio->uio_resid)); error = pn_fill(curthread, proc, pn, NULL, uio); @@ -774,8 +788,12 @@ pfs_read(struct vop_read_args *va) ret: vn_lock(vn, locked | LK_RETRY); vdrop(vn); - if (proc != NULL) - PRELE(proc); + if (proc != NULL) { + PROC_LOCK(proc); + execve_unblock(td, proc); + _PRELE(proc); + PROC_UNLOCK(proc); + } PFS_RETURN (error); } @@ -846,6 +864,7 @@ pfs_readdir(struct vop_readdir_args *va) struct pfs_node *pd = pvd->pvd_pn; pid_t pid = pvd->pvd_pid; struct proc *p, *proc; + struct thread *td; struct pfs_node *pn; struct uio *uio; struct pfsentry *pfsent, *pfsent2; @@ -884,11 +903,13 @@ pfs_readdir(struct vop_readdir_args *va) KASSERT(pid == NO_PID || proc != NULL, ("%s(): no process for pid %lu", __func__, (unsigned long)pid)); + td = curthread; if (pid != NO_PID) { PROC_LOCK(proc); /* check if the directory is visible to the caller */ if (!pfs_visible_proc(curthread, pd, proc)) { + execve_unblock(td, proc); _PRELE(proc); PROC_UNLOCK(proc); pfs_unlock(pd); @@ -956,6 +977,7 @@ pfs_readdir(struct vop_readdir_args *va) resid -= PFS_DELEN; } if (proc != NULL) { + execve_unblock(td, proc); _PRELE(proc); PROC_UNLOCK(proc); } @@ -1080,6 +1102,7 @@ pfs_write(struct vop_write_args *va) struct pfs_node *pn = pvd->pvd_pn; struct uio *uio = va->a_uio; struct proc *proc; + struct thread *td; struct sbuf sb; int error; @@ -1099,36 +1122,44 @@ pfs_write(struct vop_write_args *va) if (uio->uio_resid > PFS_MAXBUFSIZ) PFS_RETURN (EIO); + td = curthread; + /* * This is necessary because either process' privileges may * have changed since the open() call. */ - if (!pfs_visible(curthread, pn, pvd->pvd_pid, &proc)) + if (!pfs_visible(td, pn, pvd->pvd_pid, &proc)) PFS_RETURN (EIO); if (proc != NULL) { _PHOLD(proc); + execve_block_wait(td, proc); + if (!pfs_visible_proc(td, pn, proc)) { + PROC_UNLOCK(proc); + error = EIO; + goto out; + } PROC_UNLOCK(proc); } if (pn->pn_flags & PFS_RAWWR) { error = pn_fill(curthread, proc, pn, NULL, uio); - if (proc != NULL) - PRELE(proc); - PFS_RETURN (error); + goto out; } sbuf_uionew(&sb, uio, &error); - if (error) { - if (proc != NULL) - PRELE(proc); - PFS_RETURN (error); - } + if (error != 0) + goto out; error = pn_fill(curthread, proc, pn, &sb, uio); sbuf_delete(&sb); - if (proc != NULL) - PRELE(proc); +out: + if (proc != NULL) { + PROC_LOCK(proc); + execve_unblock(td, proc); + _PRELE(proc); + PROC_UNLOCK(proc); + } PFS_RETURN (error); } diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c index eb77a5064113..089548dad97d 100644 --- a/sys/kern/kern_event.c +++ b/sys/kern/kern_event.c @@ -50,6 +50,7 @@ #include #include #include +#include #include #include #include @@ -3028,10 +3029,6 @@ sysctl_kern_proc_kqueue(SYSCTL_HANDLER_ARGS) if ((u_int)arg2 > 2 || (u_int)arg2 == 0) return (EINVAL); - error = pget((pid_t)name[0], PGET_HOLD | PGET_CANDEBUG, &p); - if (error != 0) - return (error); - td = curthread; #ifdef FREEBSD_COMPAT32 compat32 = SV_CURPROC_FLAG(SV_ILP32); @@ -3039,6 +3036,17 @@ sysctl_kern_proc_kqueue(SYSCTL_HANDLER_ARGS) compat32 = false; #endif + error = pget((pid_t)name[0], PGET_NOTWEXIT, &p); + if (error != 0) + return (error); + + _PHOLD(p); + execve_block_wait(td, p); + error = p_candebug(td, p); + if (error != 0) + goto out1; + PROC_UNLOCK(p); + s = sbuf_new_for_sysctl(&sm, NULL, 0, req); if (s == NULL) { error = ENOMEM; @@ -3059,7 +3067,11 @@ sysctl_kern_proc_kqueue(SYSCTL_HANDLER_ARGS) sbuf_delete(s); out: - PRELE(p); + PROC_LOCK(p); +out1: + execve_unblock(td, p); + _PRELE(p); + PROC_UNLOCK(p); return (error); } diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index 484adaac91ec..b6b599ffd281 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -26,7 +26,6 @@ * SUCH DAMAGE. */ -#include #include "opt_capsicum.h" #include "opt_hwpmc_hooks.h" #include "opt_ktrace.h" @@ -45,6 +44,7 @@ #include #include #include +#include #include #include #include @@ -373,6 +373,77 @@ execve_nosetid(struct image_params *imgp) } } +/* + * Returns true if the execblock was obtained, in this case the + * process lock is kept. Returns false if the execblock was not + * obtained, but the function slept and the lock was dropped. + */ +bool +execve_block(struct thread *td, struct proc *p) +{ + PROC_LOCK_ASSERT(p, MA_OWNED); + MPASS(td == curthread); + MPASS(p != td->td_proc || (p->p_flag & P_INEXEC) == 0); + + if (p != td->td_proc && (p->p_flag & P_INEXEC) != 0) { + p->p_flag2 |= P2_INEXEC_WAIT; + msleep(&p->p_execblock, &p->p_mtx, PDROP, "inexec", 0); + return (false); + } + MPASS(p->p_execblock < UINT_MAX); + p->p_execblock++; + return (true); +} + +/* + * Might drop the process lock internally, callers must re-check the + * invariants afterward. + */ +void +execve_block_wait(struct thread *td, struct proc *p) +{ + bool first; + + PROC_ASSERT_HELD(p); + PROC_LOCK_ASSERT(p, MA_OWNED); + + for (first = true;; first = false) { + if (!first) + PROC_LOCK(p); + if (execve_block(td, p)) + return; + } +} + +void +execve_unblock(struct thread *td, struct proc *p) +{ + PROC_LOCK_ASSERT(p, MA_OWNED); + MPASS(td == curthread); + + MPASS(p->p_execblock > 0); + p->p_execblock--; + if (p->p_execblock == 0 && (p->p_flag2 & P2_INEXEC_WAIT) != 0) { + p->p_flag2 &= ~P2_INEXEC_WAIT; + wakeup(&p->p_execblock); + } +} + +void +execve_block_pass(struct thread *td) +{ + struct proc *p; + + MPASS(td == curthread); + p = td->td_proc; + PROC_LOCK_ASSERT(p, MA_OWNED); + + while (p->p_execblock != 0) { + p->p_flag2 |= P2_INEXEC_WAIT; + msleep(&p->p_execblock, &p->p_mtx, 0, "exeblk", 0); + } +} + /* * In-kernel implementation of execve(). All arguments are assumed to be * userspace pointers from the passed thread. @@ -428,6 +499,7 @@ do_execve(struct thread *td, struct image_args *args, struct mac *mac_p, PROC_LOCK(p); KASSERT((p->p_flag & P_INEXEC) == 0, ("%s(): process already has P_INEXEC flag", __func__)); + execve_block_pass(td); p->p_flag |= P_INEXEC; PROC_UNLOCK(p); @@ -896,7 +968,11 @@ interpret: * as we're now a bona fide freshly-execed process. */ KNOTE_LOCKED(p->p_klist, NOTE_EXEC); + MPASS(p->p_execblock == 0); + if ((p->p_flag2 & P2_INEXEC_WAIT) != 0) + wakeup(&p->p_execblock); p->p_flag &= ~P_INEXEC; + p->p_flag2 &= ~P2_INEXEC_WAIT; /* clear "fork but no exec" flag, as we _are_ execing */ p->p_acflag &= ~AFORK; @@ -978,7 +1054,10 @@ exec_fail_dealloc: exec_fail: /* we're done here, clear P_INEXEC */ PROC_LOCK(p); + if ((p->p_flag2 & P2_INEXEC_WAIT) != 0) + wakeup(&p->p_execblock); p->p_flag &= ~P_INEXEC; + p->p_flag2 &= ~P2_INEXEC_WAIT; PROC_UNLOCK(p); SDT_PROBE1(proc, , , exec__failure, error); diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c index 0c3070f2e360..5bcd4219bf91 100644 --- a/sys/kern/kern_exit.c +++ b/sys/kern/kern_exit.c @@ -325,6 +325,7 @@ exit1(struct thread *td, int rval, int signo) while (p->p_lock > 0) msleep(&p->p_lock, &p->p_mtx, PWAIT, "exithold", 0); + MPASS(p->p_execblock == 0); PROC_UNLOCK(p); /* Drain the limit callout while we don't have the proc locked */ callout_drain(&p->p_limco); diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c index ee58ad42bce6..96ed239fafb0 100644 --- a/sys/kern/kern_fork.c +++ b/sys/kern/kern_fork.c @@ -384,6 +384,7 @@ do_fork(struct thread *td, struct fork_req *fr, struct proc *p2, struct thread * bzero(&p2->p_startzero, __rangeof(struct proc, p_startzero, p_endzero)); + p2->p_execblock = 0; /* Tell the prison that we exist. */ prison_proc_hold(p2->p_ucred->cr_prison); diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c index b7fa7bfb60e9..d8a57ac46673 100644 --- a/sys/kern/kern_proc.c +++ b/sys/kern/kern_proc.c @@ -45,6 +45,7 @@ #include #include #include +#include #include #include #include @@ -1833,8 +1834,8 @@ pargs_drop(struct pargs *pa) } static int -proc_read_string(struct thread *td, struct proc *p, const char *sptr, char *buf, - size_t len) +proc_read_string(struct thread *td, struct vmspace *vm, const char *sptr, + char *buf, size_t len) { ssize_t n; @@ -1843,7 +1844,7 @@ proc_read_string(struct thread *td, struct proc *p, const char *sptr, char *buf, * and is aligned at the end of the page, and the following page is not * mapped. */ - n = proc_readmem(td, p, (vm_offset_t)sptr, buf, len); + n = vmspace_iop(td, vm, (vm_offset_t)sptr, buf, len, UIO_READ); if (n <= 0) return (ENOMEM); return (0); @@ -1859,8 +1860,8 @@ enum proc_vector_type { #ifdef COMPAT_FREEBSD32 static int -get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, - size_t *vsizep, enum proc_vector_type type) +get_proc_vector32(struct thread *td, struct proc *p, struct vmspace *vm, + char ***proc_vectorp, size_t *vsizep, enum proc_vector_type type) { struct freebsd32_ps_strings pss; Elf32_Auxinfo aux; @@ -1871,8 +1872,8 @@ get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, int i, error; error = 0; - if (proc_readmem(td, p, PROC_PS_STRINGS(p), &pss, sizeof(pss)) != - sizeof(pss)) + if (vmspace_iop(td, vm, PROC_PS_STRINGS(p), &pss, sizeof(pss), + UIO_READ) != sizeof(pss)) return (ENOMEM); switch (type) { case PROC_ARG: @@ -1895,8 +1896,8 @@ get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, if (vptr % 4 != 0) return (ENOEXEC); for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) { - if (proc_readmem(td, p, ptr, &aux, sizeof(aux)) != - sizeof(aux)) + if (vmspace_iop(td, vm, ptr, &aux, sizeof(aux), + UIO_READ) != sizeof(aux)) return (ENOMEM); if (aux.a_type == AT_NULL) break; @@ -1912,7 +1913,7 @@ get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, return (EINVAL); } proc_vector32 = malloc(size, M_TEMP, M_WAITOK); - if (proc_readmem(td, p, vptr, proc_vector32, size) != size) { + if (vmspace_iop(td, vm, vptr, proc_vector32, size, UIO_READ) != size) { error = ENOMEM; goto done; } @@ -1933,8 +1934,8 @@ done: #endif static int -get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, - size_t *vsizep, enum proc_vector_type type) +get_proc_vector(struct thread *td, struct proc *p, struct vmspace *vm, + char ***proc_vectorp, size_t *vsizep, enum proc_vector_type type) { struct ps_strings pss; Elf_Auxinfo aux; @@ -1944,11 +1945,13 @@ get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, int i; #ifdef COMPAT_FREEBSD32 - if (SV_PROC_FLAG(p, SV_ILP32) != 0) - return (get_proc_vector32(td, p, proc_vectorp, vsizep, type)); + if (SV_PROC_FLAG(p, SV_ILP32) != 0) { + return (get_proc_vector32(td, p, vm, proc_vectorp, + vsizep, type)); + } #endif - if (proc_readmem(td, p, PROC_PS_STRINGS(p), &pss, sizeof(pss)) != - sizeof(pss)) + if (vmspace_iop(td, vm, PROC_PS_STRINGS(p), &pss, sizeof(pss), + UIO_READ) != sizeof(pss)) return (ENOMEM); switch (type) { case PROC_ARG: @@ -1986,8 +1989,8 @@ get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, * to the allocated proc_vector. */ for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) { - if (proc_readmem(td, p, ptr, &aux, sizeof(aux)) != - sizeof(aux)) + if (vmspace_iop(td, vm, ptr, &aux, sizeof(aux), + UIO_READ) != sizeof(aux)) return (ENOMEM); if (aux.a_type == AT_NULL) break; @@ -2009,7 +2012,7 @@ get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, return (EINVAL); /* In case we are built without INVARIANTS. */ } proc_vector = malloc(size, M_TEMP, M_WAITOK); - if (proc_readmem(td, p, vptr, proc_vector, size) != size) { + if (vmspace_iop(td, vm, vptr, proc_vector, size, UIO_READ) != size) { free(proc_vector, M_TEMP); return (ENOMEM); } @@ -2025,6 +2028,7 @@ static int get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, enum proc_vector_type type) { + struct vmspace *vm; size_t done, len, nchr, vsize; int error, i; char **proc_vector, *sptr; @@ -2037,9 +2041,14 @@ get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, */ nchr = 2 * (PATH_MAX + ARG_MAX); - error = get_proc_vector(td, p, &proc_vector, &vsize, type); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | + PRVM_CHECK_VISIBILITY, &vm); if (error != 0) return (error); + + error = get_proc_vector(td, p, vm, &proc_vector, &vsize, type); + if (error != 0) + goto out; for (done = 0, i = 0; i < (int)vsize && done < nchr; i++) { /* * The program may have scribbled into its argv array, e.g. to @@ -2049,7 +2058,7 @@ get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, if (proc_vector[i] == NULL) break; for (sptr = proc_vector[i]; ; sptr += GET_PS_STRINGS_CHUNK_SZ) { - error = proc_read_string(td, p, sptr, pss_string, + error = proc_read_string(td, vm, sptr, pss_string, sizeof(pss_string)); if (error != 0) goto done; @@ -2066,6 +2075,8 @@ get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, } done: free(proc_vector, M_TEMP); +out: + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_VISIBILITY, vm); return (error); } @@ -2086,11 +2097,17 @@ proc_getenvv(struct thread *td, struct proc *p, struct sbuf *sb) int proc_getauxv(struct thread *td, struct proc *p, struct sbuf *sb) { + struct vmspace *vm; size_t vsize, size; char **auxv; int error; - error = get_proc_vector(td, p, &auxv, &vsize, PROC_AUX); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, + &vm); + if (error != 0) + return (error); + error = get_proc_vector(td, p, vm, &auxv, &vsize, PROC_AUX); + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, vm); if (error == 0) { #ifdef COMPAT_FREEBSD32 if (SV_PROC_FLAG(p, SV_ILP32) != 0) @@ -2403,6 +2420,7 @@ sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS) int error, *name; struct vnode *vp; struct proc *p; + struct thread *td; vm_map_t map; struct vmspace *vm; @@ -2411,11 +2429,12 @@ sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS) return (EINVAL); name = (int *)arg1; + td = curthread; error = pget((pid_t)name[0], PGET_WANTREAD, &p); if (error != 0) return (error); - vm = vmspace_acquire_ref(p); - if (vm == NULL) { + error = proc_vmspace_ref(td, p, PRVM_CHECK_DEBUG, &vm); + if (error != 0) { PRELE(p); return (ESRCH); } @@ -2527,7 +2546,7 @@ sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_CHECK_DEBUG, vm); PRELE(p); free(kve, M_TEMP); return (error); @@ -2618,6 +2637,7 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) struct vmspace *vm; struct cdev *cdev; struct cdevsw *csw; + struct thread *td; vm_offset_t addr; unsigned int last_timestamp; int error, ref; @@ -2629,10 +2649,11 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) _PHOLD(p); PROC_UNLOCK(p); - vm = vmspace_acquire_ref(p); - if (vm == NULL) { + td = curthread; + error = proc_vmspace_ref(td, p, PRVM_CHECK_DEBUG, &vm); + if (error != 0) { PRELE(p); - return (ESRCH); + return (error); } kve = malloc(sizeof(*kve), M_TEMP, M_WAITOK | M_ZERO); @@ -2747,7 +2768,7 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) if (vp != NULL) { vn_fullpath(vp, &fullpath, &freepath); kve->kve_vn_type = vntype_to_kinfo(vp->v_type); - cred = curthread->td_ucred; + cred = td->td_ucred; vn_lock(vp, LK_SHARED | LK_RETRY); if (VOP_GETATTR(vp, &va, cred) == 0) { kve->kve_vn_fileid = va.va_fileid; @@ -2803,7 +2824,7 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_CHECK_DEBUG, vm); PRELE(p); free(kve, M_TEMP); return (error); @@ -2842,7 +2863,7 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) struct kinfo_kstack *kkstp; int error, i, *name, numthreads; lwpid_t *lwpidarray; - struct thread *td; + struct thread *td, *ctd; struct stack *st; struct sbuf sb; struct proc *p; @@ -2853,7 +2874,8 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) return (EINVAL); name = (int *)arg1; - error = pget((pid_t)name[0], PGET_NOTINEXEC | PGET_WANTREAD, &p); + ctd = curthread; + error = pget((pid_t)name[0], PGET_WANTREAD, &p); if (error != 0) return (error); @@ -2862,6 +2884,14 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) lwpidarray = NULL; PROC_LOCK(p); + execve_block_wait(ctd, p); + error = p_candebug(ctd, p); + if (error != 0) { + execve_unblock(ctd, p); + _PRELE(p); + PROC_UNLOCK(p); + return (error); + } do { if (lwpidarray != NULL) { free(lwpidarray, M_TEMP); @@ -2874,15 +2904,6 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) PROC_LOCK(p); } while (numthreads < p->p_numthreads); - /* - * XXXRW: During the below loop, execve(2) and countless other sorts - * of changes could have taken place. Should we check to see if the - * vmspace has been replaced, or the like, in order to prevent - * giving a snapshot that spans, say, execve(2), with some threads - * before and some after? Among other things, the credentials could *** 695 LINES SKIPPED *** From nobody Tue Jun 30 17:20:29 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKB3mK8z6jYCs for ; Tue, 30 Jun 2026 17:20:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKB1KCKz3qYk for ; Tue, 30 Jun 2026 17:20:30 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840030; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=c1cud1Zkl+HUOc5QlETDBHhMh8bTBzRuP73XZ+IY8vY=; b=cp97Q1V6s9xFGV/vYEboxbpzELDi4Ijb/GCs9jBpL+lTr5IEDphGW/PgCWWcU4gjUW25q5 /b0Tn1rqwBp6NdcA3Brit2nwCnck0WAM31gI2oMf71KF/wu0iS47xYhPkHIsOato1mYlic 7Pe5Msay1C+KUvf+JLTWV9QYL2WejbGpTZxLlxmuhv7TTnZbC0vKWYpMdgPfuotH2CerO3 PPP4XeBMCrFk1urZPd/ahiJnkpwP4xGiBVUnsy6beSTNej5yA664tZmd5fJ1qDBIbeL5p/ TgaFS0h1G07moo5nOBXU9FRY4f70TcC7K80iQy/BCl5Ob6W50azamiBSUoHEbg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840030; a=rsa-sha256; cv=none; b=m8MVnF1r5pKdTZ2Xy28ciUokrFg383RJ95hNzJOWAb7MfrSLlCoxu2IfFDnsvCyp45QKay rqqCqO6gmjWLCt2vlvifglMmd9pKEP3DdOpRJGyFj9+cjmYzzVHkIi0MR2jgRwxfn/syGw BU2L+mnEg+/UMT48DjX7PZpTBzkNB/zwgyd0argz7pJ4W7d5ta+wDnYLhYb6jTdk9AaH8y w1Phn+lgWs9cn/eWGa3leMpHg7xgMK+9mI1WUBqMBu3AVIZEG/QzLfZHIkLCd9Og5McmkK 7WXhvt6a0l5JzFblBUrRRN8pny4vFsQRa9vbiJLa8xsRjA8k5vWPpYss8KF6ZA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840030; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=c1cud1Zkl+HUOc5QlETDBHhMh8bTBzRuP73XZ+IY8vY=; b=sEocuEixarf/6hStrJpjiwWnsU1pSB9UQszE5ZxranypPx1quOukcbVX18k2zG0MK+C42g Oh2dakqOyxOSa2Memd6rk9DRe/iPU9mdtMAYHUk+jib+tJBJ9FQXdK68hZwVywvazPKSDL lWL0FVFVZKAtxDik35j7nZh6IVKaQOwXdr2VSl/+QUGPRDwF0ibI3UayxN0yodSSVfielf G8V5VumqVQK1S1tm6FgwhplvdItACyXByIKcMfKXEeeqlOBT5opcttCupaoSQL7KpRpjJ7 rvdBBxlnRJEQ1+oEwonuqQ0tvfY3cvFOMQDgJXuBu8SgK3B9kr8le87nH/e0Bw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVK9702vztB3 for ; Tue, 30 Jun 2026 17:20:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45640 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:29 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 6503d56e7c63 - releng/14.3 - zfs: Roll up several upstream commits List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 6503d56e7c6323bb85bcbf535669d3264c2fc644 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:29 +0000 Message-Id: <6a43fadd.45640.2eb2deab@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=6503d56e7c6323bb85bcbf535669d3264c2fc644 commit 6503d56e7c6323bb85bcbf535669d3264c2fc644 Author: Mark Johnston AuthorDate: 2026-06-28 22:00:10 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:01 +0000 zfs: Roll up several upstream commits This commit squashes the following upstream commits: #18604 63a0ff6cd nvpair: Check for un-terminated strings in packed nvlist #18617 38cd6adcb Extend dataset zfs_ioc_set_prop() secpolicy #18615 738791027 Fix the integer type in zfs_ioc_userspace_many() #18623 06d8cfedb Add additional verification of size fields and strings Approved by: so Security: FreeBSD-SA-26:40.zfs Security: CVE-2026-49429 Security: CVE-2026-49430 Security: CVE-2026-49431 --- sys/contrib/openzfs/module/nvpair/nvpair.c | 49 ++++-- sys/contrib/openzfs/module/zfs/dmu_recv.c | 44 ++++-- sys/contrib/openzfs/module/zfs/vdev_label.c | 1 + sys/contrib/openzfs/module/zfs/zfs_ioctl.c | 34 +++- sys/contrib/openzfs/module/zfs/zfs_quota.c | 8 +- .../tests/zfs-tests/cmd/libzfs_input_check.c | 172 ++++++++++++++++++++- 6 files changed, 272 insertions(+), 36 deletions(-) diff --git a/sys/contrib/openzfs/module/nvpair/nvpair.c b/sys/contrib/openzfs/module/nvpair/nvpair.c index 887f7d32df4a..04141bb58111 100644 --- a/sys/contrib/openzfs/module/nvpair/nvpair.c +++ b/sys/contrib/openzfs/module/nvpair/nvpair.c @@ -134,7 +134,8 @@ #define NVP_SIZE_CALC(name_len, data_len) \ (NV_ALIGN((sizeof (nvpair_t)) + name_len) + NV_ALIGN(data_len)) -static int i_get_value_size(data_type_t type, const void *data, uint_t nelem); +static int i_get_value_size(data_type_t type, const void *data, uint_t nelem, + size_t max_size); static int nvlist_add_common(nvlist_t *nvl, const char *name, data_type_t type, uint_t nelem, const void *data); @@ -809,8 +810,10 @@ i_validate_nvpair(nvpair_t *nvp) * verify nvp_type, nvp_value_elem, and also possibly * verify string values and get the value size. */ - size2 = i_get_value_size(type, NVP_VALUE(nvp), NVP_NELEM(nvp)); size1 = nvp->nvp_size - NVP_VALOFF(nvp); + size2 = i_get_value_size(type, NVP_VALUE(nvp), NVP_NELEM(nvp), + size1); + if (size2 < 0 || size1 != NV_ALIGN(size2)) return (EFAULT); @@ -1001,12 +1004,21 @@ nvlist_remove_nvpair(nvlist_t *nvl, nvpair_t *nvp) * DATA_TYPE_STRING and * DATA_TYPE_STRING_ARRAY * Is data == NULL then the size of the string(s) is excluded. + * + * If 'max_size' is non-zero, then don't look beyond 'max_size' number of + * bytes when calculating a value size. Note that 'max_size' should include + * the NULL terminator byte when calculating string size. If 'max_size' is 0, + * it is ignored. */ static int -i_get_value_size(data_type_t type, const void *data, uint_t nelem) +i_get_value_size(data_type_t type, const void *data, uint_t nelem, + size_t max_size) { uint64_t value_sz; + if (max_size == 0) + max_size = INT32_MAX; + if (i_validate_type_nelem(type, nelem) != 0) return (-1); @@ -1051,10 +1063,15 @@ i_get_value_size(data_type_t type, const void *data, uint_t nelem) break; #endif case DATA_TYPE_STRING: - if (data == NULL) + if (data == NULL) { value_sz = 0; - else - value_sz = strlen(data) + 1; + } else { + value_sz = strnlen(data, max_size); + if (value_sz >= max_size) { + return (-1); /* string not terminated */ + } + value_sz += 1; + } break; case DATA_TYPE_BOOLEAN_ARRAY: value_sz = (uint64_t)nelem * sizeof (boolean_t); @@ -1088,16 +1105,23 @@ i_get_value_size(data_type_t type, const void *data, uint_t nelem) break; case DATA_TYPE_STRING_ARRAY: value_sz = (uint64_t)nelem * sizeof (uint64_t); - if (data != NULL) { char *const *strs = data; uint_t i; + size_t newsize; /* no alignment requirement for strings */ for (i = 0; i < nelem; i++) { if (strs[i] == NULL) return (-1); - value_sz += strlen(strs[i]) + 1; + + newsize = strnlen(strs[i], max_size); + + if (newsize == max_size) + return (-1); /* not terminated */ + + value_sz += newsize + 1; /* +1 for NULL */ + max_size -= newsize + 1; } } break; @@ -1162,7 +1186,7 @@ nvlist_add_common(nvlist_t *nvl, const char *name, * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) included. */ - if ((value_sz = i_get_value_size(type, data, nelem)) < 0) + if ((value_sz = i_get_value_size(type, data, nelem, 0)) < 0) return (EINVAL); if (i_validate_nvpair_value(type, nelem, data) != 0) @@ -1587,7 +1611,7 @@ nvpair_value_common(const nvpair_t *nvp, data_type_t type, uint_t *nelem, #endif if (data == NULL) return (EINVAL); - if ((value_sz = i_get_value_size(type, NULL, 1)) < 0) + if ((value_sz = i_get_value_size(type, NULL, 1, 0)) < 0) return (EINVAL); memcpy(data, NVP_VALUE(nvp), (size_t)value_sz); if (nelem != NULL) @@ -3017,7 +3041,8 @@ nvs_native_nvp_op(nvstream_t *nvs, nvpair_t *nvp) * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) excluded. */ - if ((value_sz = i_get_value_size(type, NULL, NVP_NELEM(nvp))) < 0) + if ((value_sz = i_get_value_size(type, NULL, NVP_NELEM(nvp), + NVP_SIZE(nvp))) < 0) return (EFAULT); if (NVP_SIZE_CALC(nvp->nvp_name_sz, value_sz) > nvp->nvp_size) @@ -3332,7 +3357,7 @@ nvs_xdr_nvp_op(nvstream_t *nvs, nvpair_t *nvp) * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) excluded. */ - if ((value_sz = i_get_value_size(type, NULL, nelem)) < 0) + if ((value_sz = i_get_value_size(type, NULL, nelem, NVP_SIZE(nvp)) < 0)) return (EFAULT); /* if there is no data to extract then return */ diff --git a/sys/contrib/openzfs/module/zfs/dmu_recv.c b/sys/contrib/openzfs/module/zfs/dmu_recv.c index 883ee192f07f..cc6ea5cb998f 100644 --- a/sys/contrib/openzfs/module/zfs/dmu_recv.c +++ b/sys/contrib/openzfs/module/zfs/dmu_recv.c @@ -2824,16 +2824,20 @@ receive_read_record(dmu_recv_cookie_t *drc) { struct drr_object *drro = &drc->drc_rrd->header.drr_u.drr_object; - uint32_t size = DRR_OBJECT_PAYLOAD_SIZE(drro); + uint32_t size; void *buf = NULL; dmu_object_info_t doi; + size = DRR_OBJECT_PAYLOAD_SIZE(drro); + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + if (size != 0) - buf = kmem_zalloc(size, KM_SLEEP); + buf = vmem_zalloc(size, KM_SLEEP); err = receive_read_payload_and_next_header(drc, size, buf); if (err != 0) { - kmem_free(buf, size); + vmem_free(buf, size); return (err); } err = dmu_object_info(drc->drc_os, drro->drr_object, &doi); @@ -2857,7 +2861,11 @@ receive_read_record(dmu_recv_cookie_t *drc) case DRR_WRITE: { struct drr_write *drrw = &drc->drc_rrd->header.drr_u.drr_write; - int size = DRR_WRITE_PAYLOAD_SIZE(drrw); + uint64_t size = DRR_WRITE_PAYLOAD_SIZE(drrw); + + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + abd_t *abd = abd_alloc_linear(size, B_FALSE); err = receive_read_payload_and_next_header(drc, size, abd_to_buf(abd)); @@ -2874,12 +2882,18 @@ receive_read_record(dmu_recv_cookie_t *drc) { struct drr_write_embedded *drrwe = &drc->drc_rrd->header.drr_u.drr_write_embedded; - uint32_t size = P2ROUNDUP(drrwe->drr_psize, 8); - void *buf = kmem_zalloc(size, KM_SLEEP); + uint32_t size; + void *buf; + + size = P2ROUNDUP(drrwe->drr_psize, 8); + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + + buf = vmem_zalloc(size, KM_SLEEP); err = receive_read_payload_and_next_header(drc, size, buf); if (err != 0) { - kmem_free(buf, size); + vmem_free(buf, size); return (err); } @@ -2908,7 +2922,11 @@ receive_read_record(dmu_recv_cookie_t *drc) case DRR_SPILL: { struct drr_spill *drrs = &drc->drc_rrd->header.drr_u.drr_spill; - int size = DRR_SPILL_PAYLOAD_SIZE(drrs); + uint64_t size = DRR_SPILL_PAYLOAD_SIZE(drrs); + + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + abd_t *abd = abd_alloc_linear(size, B_FALSE); err = receive_read_payload_and_next_header(drc, size, abd_to_buf(abd)); @@ -3059,7 +3077,7 @@ receive_process_record(struct receive_writer_arg *rwa, abd_free(rrd->abd); rrd->abd = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } return (0); @@ -3073,7 +3091,7 @@ receive_process_record(struct receive_writer_arg *rwa, rrd->abd = NULL; rrd->payload = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } @@ -3086,7 +3104,7 @@ receive_process_record(struct receive_writer_arg *rwa, { struct drr_object *drro = &rrd->header.drr_u.drr_object; err = receive_object(rwa, drro, rrd->payload); - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; break; } @@ -3124,7 +3142,7 @@ receive_process_record(struct receive_writer_arg *rwa, struct drr_write_embedded *drrwe = &rrd->header.drr_u.drr_write_embedded; err = receive_write_embedded(rwa, drrwe, rrd->payload); - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; break; } @@ -3193,7 +3211,7 @@ receive_writer_thread(void *arg) rrd->abd = NULL; rrd->payload = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } /* diff --git a/sys/contrib/openzfs/module/zfs/vdev_label.c b/sys/contrib/openzfs/module/zfs/vdev_label.c index 5c0e750c4614..85d361941ccb 100644 --- a/sys/contrib/openzfs/module/zfs/vdev_label.c +++ b/sys/contrib/openzfs/module/zfs/vdev_label.c @@ -1360,6 +1360,7 @@ vdev_label_read_bootenv(vdev_t *rvd, nvlist_t *bootenv) VB_NVLIST); break; } + vbe->vbe_bootenv[sizeof (vbe->vbe_bootenv) - 1] = '\0'; fnvlist_add_string(bootenv, FREEBSD_BOOTONCE, buf); } diff --git a/sys/contrib/openzfs/module/zfs/zfs_ioctl.c b/sys/contrib/openzfs/module/zfs/zfs_ioctl.c index 8f28687bb36b..121968bcdbb4 100644 --- a/sys/contrib/openzfs/module/zfs/zfs_ioctl.c +++ b/sys/contrib/openzfs/module/zfs/zfs_ioctl.c @@ -913,6 +913,23 @@ zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr) ZFS_DELEG_PERM_CREATE, cr)); } +/* + * Policy for dataset set property operations. Individual properties checked by + * zfs_check_settable(), additionally require zfs_secpolicy_recv() when setting + * properties as part of a receive. + */ +static int +zfs_secpolicy_setprops(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr) +{ + boolean_t received = zc->zc_cookie; + int error; + + if (received && (error = zfs_secpolicy_recv(zc, innvl, cr))) + return (error); + + return (zfs_secpolicy_read(zc, innvl, cr)); +} + int zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr) { @@ -3642,7 +3659,6 @@ static int zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl) { (void) unused, (void) outnvl; - const char *message; char *poolname; spa_t *spa; int error; @@ -3663,7 +3679,7 @@ zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl) if (error != 0) return (error); - message = fnvlist_lookup_string(innvl, "message"); + const char *message = fnvlist_lookup_string(innvl, "message"); if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) { spa_close(spa, FTAG); @@ -5994,21 +6010,27 @@ zfs_ioc_userspace_one(zfs_cmd_t *zc) * outputs: * zc_nvlist_dst[_size] data buffer (array of zfs_useracct_t) * zc_cookie zap cursor + * + * The zc_nvlist_dst output array is limited to 1000 entries. */ static int zfs_ioc_userspace_many(zfs_cmd_t *zc) { + const size_t batch_limit = 1000 * sizeof (zfs_useracct_t); + uint64_t bufsize = MIN(zc->zc_nvlist_dst_size, batch_limit); zfsvfs_t *zfsvfs; - int bufsize = zc->zc_nvlist_dst_size; - if (bufsize <= 0) + if (bufsize < sizeof (zfs_useracct_t)) { + zc->zc_nvlist_dst_size = sizeof (zfs_useracct_t); return (SET_ERROR(ENOMEM)); + } int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE); if (error != 0) return (error); void *buf = vmem_alloc(bufsize, KM_SLEEP); + zc->zc_nvlist_dst_size = bufsize; error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie, buf, &zc->zc_nvlist_dst_size); @@ -6499,7 +6521,7 @@ zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl) dsl_pool_t *dp; dsl_dataset_t *new, *old; const char *firstsnap; - uint64_t used, comp, uncomp; + uint64_t used = 0, comp = 0, uncomp = 0; firstsnap = fnvlist_lookup_string(innvl, "firstsnap"); @@ -7374,7 +7396,7 @@ zfs_ioctl_init(void) zfs_ioc_send, zfs_secpolicy_send); zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop, - zfs_secpolicy_none); + zfs_secpolicy_setprops); zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy, zfs_secpolicy_destroy); zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename, diff --git a/sys/contrib/openzfs/module/zfs/zfs_quota.c b/sys/contrib/openzfs/module/zfs/zfs_quota.c index 9b351eefc04e..c5ffd60609b2 100644 --- a/sys/contrib/openzfs/module/zfs/zfs_quota.c +++ b/sys/contrib/openzfs/module/zfs/zfs_quota.c @@ -85,10 +85,14 @@ zpl_get_file_info(dmu_object_type_t bonustype, const void *data, sa.sa_layout_info = BSWAP_16(sa.sa_layout_info); swap = B_TRUE; } - VERIFY3U(sa.sa_magic, ==, SA_MAGIC); + + if (unlikely(sa.sa_magic != SA_MAGIC)) + return (SET_ERROR(EINVAL)); int hdrsize = sa_hdrsize(&sa); - VERIFY3U(hdrsize, >=, sizeof (sa_hdr_phys_t)); + + if (unlikely(hdrsize < sizeof (sa_hdr_phys_t))) + return (SET_ERROR(EINVAL)); uintptr_t data_after_hdr = (uintptr_t)data + hdrsize; zoi->zfi_user = *((uint64_t *)(data_after_hdr + SA_UID_OFFSET)); diff --git a/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c b/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c index 7d9ce4fada1b..4f8977ffa47a 100644 --- a/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c +++ b/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c @@ -84,7 +84,6 @@ static const zfs_ioc_t ioc_skip[] = { ZFS_IOC_DSOBJ_TO_DSNAME, ZFS_IOC_OBJ_TO_PATH, ZFS_IOC_POOL_SET_PROPS, - ZFS_IOC_POOL_GET_PROPS, ZFS_IOC_SET_FSACL, ZFS_IOC_GET_FSACL, ZFS_IOC_SHARE, @@ -124,11 +123,136 @@ static const zfs_ioc_t ioc_skip[] = { lzc_ioctl_test(ioc, name, req, opt, err, wild); \ } while (0) +#define IOC_INPUT_TEST_INJECT(ioc, name, innvl) \ + do { \ + active_test = __func__ + 5; \ + lzc_ioctl_run_impl(ioc, name, innvl, 0, B_TRUE); \ + } while (0) + +/* + * Given a zfs_cmd_t containing an already packed nvlist in zc->zc_nvlist_src, + * and its original innvl, look in innvl for the last string nvpair, or last + * string array nvpair, and remove the string terminator. The idea is to + * corrupt the nvlist string value so that anyone doing a strlen() on it will + * read past the end of the packed nvlist buffer and trigger a crash. + */ +static void +do_bad_string(zfs_cmd_t *zc, nvlist_t *innvl) +{ + nvpair_t *elem = NULL; + nvpair_t *lastseen = NULL; + const char *str = NULL; + const char **arr; + uint_t n; + char *off; + char *packed; + uint64_t size, off_size; + + while ((elem = nvlist_next_nvpair(innvl, elem)) != NULL) { + if ((nvpair_type(elem) == DATA_TYPE_STRING) || + (nvpair_type(elem) == DATA_TYPE_STRING_ARRAY)) + lastseen = elem; + } + + if (lastseen == NULL) + return; /* No strings */ + + /* + * Lookup either the last string, or the last string in the last + * string array in the nvlist. We will use this to corrupt from the + * string to the end of the nvlist buffer. Any attempts to strlen this + * string should run pass the end of the packed buffer. + */ + if (nvpair_value_string(lastseen, &str) != 0) { + if (nvpair_value_string_array(lastseen, &arr, &n) == 0) + str = arr[n-1]; + } + + /* + * We now have the last string. Corrupt everything from the NULL + * terminator byte for the last string to the end of the packed nvlist + * buffer. + */ + packed = (char *)zc->zc_nvlist_src; + size = zc->zc_nvlist_src_size; + + off = memmem(packed, size, str, strlen(str)); + off_size = strlen(str); + + memset(&off[off_size - 1], '!', (packed + size) - + (&off[off_size - 1])); + +} + +/* + * For each byte in the packed nvlist list in zc, corrupt a single byte, then + * try doing the ioctl. This tests how well the kernel handles fuzzed nvlists. + * + * NOTE - make sure you are doing this with a "safe" ioctl! You don't want to + * run this on an ioctl that can potentially corrupt data (like a zpool create). + */ +static void +do_fuzz(int zfs_fd, zfs_ioc_t ioc, zfs_cmd_t *zc) +{ + uint64_t size; + uint64_t i; + unsigned char old = 0; + unsigned char *pos; + zfs_cmd_t orig_zc = *zc; + + pos = (unsigned char *) zc->zc_nvlist_src; + size = zc->zc_nvlist_src_size; + + /* + * Fuzz each byte in the packed nvlist, one byte at a time, and do the + * ioctl. If the kernel doesn't crash, then the test passed. + */ + for (i = 0; i < size; i++) { + /* Restore the previously corrupted byte */ + if (i > 0) + pos[i-1] = old; + + old = pos[i]; + + /* Corrupt the new byte */ + pos[i]++; + + /* + * Do the ioctl and ignore the return code. We just want to + * see if the kernel panics. + */ + lzc_ioctl_fd(zfs_fd, ioc, zc); + + /* + * Restore 'zc' with original fields since the ioctl may + * have modified them. + */ + *zc = orig_zc; + } + /* Restore last byte */ + if (i > 0) + pos[i - 1] = old; + + /* + * Try fuzzing the packed nvlist size field. Test it with one byte + * bigger and one byte smaller than the current value. + */ + zc->zc_nvlist_src_size--; + lzc_ioctl_fd(zfs_fd, ioc, zc); + + zc->zc_nvlist_src_size += 2; + lzc_ioctl_fd(zfs_fd, ioc, zc); + + /* Restore to normal */ + zc->zc_nvlist_src_size -= 1; +} + /* * run a zfs ioctl command, verify expected results and log failures */ static void -lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) +lzc_ioctl_run_impl(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, + int expected, boolean_t do_corrupt) { zfs_cmd_t zc = {"\0"}; char *packed = NULL; @@ -159,10 +283,30 @@ lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) zc.zc_nvlist_dst_size = MAX(size * 2, 128 * 1024); zc.zc_nvlist_dst = (uint64_t)(uintptr_t)malloc(zc.zc_nvlist_dst_size); + if (do_corrupt) { + /* + * Try changing bytes in the packed nvlist to see if it will + * panic the kernel when you do the ioctl. + */ + do_fuzz(zfs_fd, ioc, &zc); + + /* + * Corrupt the last string in the packed nvlist so it has no + * NULL terminator. + */ + do_bad_string(&zc, innvl); + + } + if (lzc_ioctl_fd(zfs_fd, ioc, &zc) != 0) error = errno; - if (error != expected) { + /* + * If we're corrupting the nvlist we don't care about the specific + * error code that gets returned, as it could be one of many. We only + * care if it panics the kernel. + */ + if (!do_corrupt && error != expected) { unexpected_failures = B_TRUE; (void) fprintf(stderr, "%s: Unexpected result with %s, " "error %d (expecting %d)\n", @@ -173,6 +317,12 @@ lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) free((void *)(uintptr_t)zc.zc_nvlist_dst); } +static void +lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) +{ + return (lzc_ioctl_run_impl(ioc, name, innvl, expected, B_FALSE)); +} + /* * Test each ioc for the following ioctl input errors: * ZFS_ERR_IOC_ARG_UNAVAIL an input argument is not supported by kernel @@ -309,6 +459,7 @@ test_log_history(const char *pool) fnvlist_add_string(required, "message", "input check"); IOC_INPUT_TEST(ZFS_IOC_LOG_HISTORY, pool, required, NULL, 0); + IOC_INPUT_TEST_INJECT(ZFS_IOC_LOG_HISTORY, pool, required); nvlist_free(required); } @@ -790,6 +941,20 @@ test_set_bootenv(const char *pool) nvlist_free(required); } +static void +test_zpool_get(const char *pool) +{ + const char *strs[] = {ZPOOL_DEDUPCACHED_PROP_NAME}; + nvlist_t *optional = fnvlist_alloc(); + + fnvlist_add_string_array(optional, ZPOOL_GET_PROPS_NAMES, strs, 1); + + IOC_INPUT_TEST(ZFS_IOC_POOL_GET_PROPS, pool, NULL, optional, 0); + IOC_INPUT_TEST_INJECT(ZFS_IOC_POOL_GET_PROPS, pool, optional); + + nvlist_free(optional); +} + static void zfs_ioc_input_tests(const char *pool) { @@ -884,6 +1049,7 @@ zfs_ioc_input_tests(const char *pool) test_scrub(pool); + test_zpool_get(pool); /* * cleanup */ From nobody Tue Jun 30 17:20:31 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKC56FBz6jY6b for ; Tue, 30 Jun 2026 17:20:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKC1lqWz3qKn for ; Tue, 30 Jun 2026 17:20:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840031; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yIH0V2o9ypNcLX19jhXw+npxxP6sf5gOKL1YW3REn9Q=; b=HXMdmpvtZoUbyybP6IeqWBVfSDEG/LxRwLzGfEKeux0gdforoYutoyZVB6Rl07U0N18Ttn +W+6LZvXQdXxE0lw76pdM0YcziKm33L27qDIQtHylHko0OgjNn2ogzn4r9CcH5kdRYPKG2 U3DIDl8MoswaScPnWRkqDxDjb+iT5bRiLAFL95wN2UCAR3GWiK3KanqwGQrdm3EhT21Z0J dAcL7Q/D4ppzitm/qJNVe4WzlLJOXQ03eq1FwVEFgn8Gd84WKQ5Q4jobOg9rcQfDn9qqyD uqur9Mm1gOugfl7odUhdocGpYHaF/kWMnt8l5LaCuYMTuLxZWSbHEXkt8dzlug== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840031; a=rsa-sha256; cv=none; b=A/SGc63E+G96nqkq5DG5LVXLkJWIO04g/wNvj4mMwNs+XRaDSzl64CYiCFOGz2DVb5y04m mR+h0U577pF9KJ5tG+JL6Q3CUle/TceITQISEE8db7rlYeyosYuF6mPJayqrvFRwZGRO3M fSJuztR2ivxLmPA9sXcZB5Q9exECO6MdtXGn/pgIdQ3Afm/KfPUAQm4ANtRaZp2FROMfPx EY/ZvYrE3oVl247ivvQPFveYuR1hHZsN8pL9waF8gdQCQA8BctbjP12Wd6nbwN/Au9D1Gd eOLzYzPGd/QVyw/oYy7Nxejp9RFbrAIBWGbSwKty+3ewdZ1r0kBbS07xJII//g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840031; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yIH0V2o9ypNcLX19jhXw+npxxP6sf5gOKL1YW3REn9Q=; b=TB6y8Qz0EiPRZdpXYZUOfvHHuiyRj3QWPARPbaG9nPTzTftKcxBylbw+QnCzaaLGFylMRY H8uCEiX91BdgTNttJx6465eQQ4pN3lbeeQbMIUENFeu/1F/aAdyvwdSpM/PYH/3kE98K/m 2isIIUMF9ytMuuuiYIp0R+vy1EvzIz9Kl1Lv01rYByV7b8pPLmtS2GpWjzznJ9x6hge+x6 xrJwuCc+qHgiaZAGv2f8Ew5kFHSEuhg5XN+0jFdnHRrlUyeVk0yV2me5McZT86VBndAJ9h lyIqNa05caYQtDVnXkMdqFpJm9lYGdHhhyNohOinY348owGPDbsNKMCyUTlvMg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKC0dVxztRk for ; Tue, 30 Jun 2026 17:20:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45e0c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:31 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav From: Mark Johnston Subject: git: 28cf6170eaa1 - releng/14.3 - libalias: Fix buffer overflow in RTSP aliasing List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 28cf6170eaa1af8a53c7daffaabfc20e9e4e60a5 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:31 +0000 Message-Id: <6a43fadf.45e0c.7ba04a2@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=28cf6170eaa1af8a53c7daffaabfc20e9e4e60a5 commit 28cf6170eaa1af8a53c7daffaabfc20e9e4e60a5 Author: Dag-Erling Smørgrav AuthorDate: 2026-06-28 22:10:40 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:01 +0000 libalias: Fix buffer overflow in RTSP aliasing In alias_rtsp_out(), we construct a new packet in a fixed-length buffer before copying it back into the original buffer. We never checked if the data we were writing to this temporary buffer fit in it, nor if the result fit in the original buffer. * Use a dynamically sized allocated buffer instead of a fixed-length stack buffer. * Check for overflow before appending to our temporary buffer. * Check for overflow before copying the data back to the packet buffer. * While here, use size_t for sizes and bool for booleans. Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 MFC after: 1 week Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D57753 --- sys/netinet/libalias/alias_smedia.c | 156 ++++++++++++++++++++---------------- 1 file changed, 89 insertions(+), 67 deletions(-) diff --git a/sys/netinet/libalias/alias_smedia.c b/sys/netinet/libalias/alias_smedia.c index 6c67e0d8f006..af1f6ed4aca8 100644 --- a/sys/netinet/libalias/alias_smedia.c +++ b/sys/netinet/libalias/alias_smedia.c @@ -104,8 +104,9 @@ #include #include #else -#include #include +#include +#include #include #include #endif @@ -128,9 +129,9 @@ #define RTSP_CONTROL_PORT_NUMBER_2 7070 #define TFTP_PORT_NUMBER 69 -static void -AliasHandleRtspOut(struct libalias *, struct ip *, struct alias_link *, - int maxpacketsize); +static void AliasHandleRtspOut(struct libalias *, struct ip *, + struct alias_link *, size_t); + static int fingerprint(struct libalias *la, struct alias_data *ah) { @@ -154,7 +155,8 @@ protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah) if (ntohs(*ah->dport) == TFTP_PORT_NUMBER) FindRtspOut(la, pip->ip_src, pip->ip_dst, *ah->sport, *ah->aport, IPPROTO_UDP); - else AliasHandleRtspOut(la, pip, ah->lnk, ah->maxpktsize); + else + AliasHandleRtspOut(la, pip, ah->lnk, ah->maxpktsize); return (0); } @@ -208,13 +210,15 @@ MODULE_DEPEND(alias_smedia, libalias, 1, 1, 1); #define ISDIGIT(a) (((a) >= '0') && ((a) <= '9')) -static int -search_string(char *data, int dlen, const char *search_str) +static ssize_t +search_string(char *data, size_t dlen, const char *search_str) { - int i, j, k; - int search_str_len; + size_t i, j, k; + size_t search_str_len; search_str_len = strlen(search_str); + if (search_str_len > dlen) + return (-1); for (i = 0; i < dlen - search_str_len; i++) { for (j = i, k = 0; j < dlen - search_str_len; j++, k++) { if (data[j] != search_str[k] && @@ -230,18 +234,21 @@ search_string(char *data, int dlen, const char *search_str) static int alias_rtsp_out(struct libalias *la, struct ip *pip, struct alias_link *lnk, - char *data, + char *data, size_t maxlen, const char *port_str) { - int hlen, tlen, dlen; + size_t hlen, tlen, dlen; + size_t i, j; struct tcphdr *tc; - int i, j, pos, state, port_dlen, new_dlen, delta; + int delta, state; + ssize_t pos, slen; + size_t new_dlen, port_dlen, port_slen; u_short p[2], new_len; u_short sport, eport, base_port; u_short salias = 0, ealias = 0, base_alias = 0; const char *transport_str = "transport:"; - char newdata[2048], *port_data, *port_newdata, stemp[80]; - int links_created = 0, pkt_updated = 0; + char *newdata, *port_data; + bool links_created = false, pkt_updated = false; struct alias_link *rtsp_lnk = NULL; struct in_addr null_addr; @@ -250,6 +257,9 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, hlen = (pip->ip_hl + tc->th_off) << 2; tlen = ntohs(pip->ip_len); dlen = tlen - hlen; + if (hlen > tlen || tlen > maxlen) + return (-1); + port_slen = strlen(port_str); /* Find keyword, "Transport: " */ pos = search_string(data, dlen, transport_str); @@ -259,17 +269,21 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, port_data = data + pos; port_dlen = dlen - pos; + /* Allocate temporary buffer */ + maxlen -= hlen; + if ((newdata = malloc(maxlen)) == NULL) + return (-1); memcpy(newdata, data, pos); - port_newdata = newdata + pos; + new_dlen = pos; - while (port_dlen > (int)strlen(port_str)) { + while (port_dlen > port_slen) { /* Find keyword, appropriate port string */ pos = search_string(port_data, port_dlen, port_str); - if (pos < 0) + if (pos < 0 || (size_t)pos + 1 > maxlen - new_dlen) break; - memcpy(port_newdata, port_data, pos + 1); - port_newdata += (pos + 1); + memcpy(newdata + new_dlen, port_data, pos + 1); + new_dlen += pos + 1; p[0] = p[1] = 0; sport = eport = 0; @@ -300,7 +314,7 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, eport = htons(p[1]); if (!links_created) { - links_created = 1; + links_created = true; /* * Find an even numbered port * number base that satisfies the @@ -349,24 +363,30 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, ealias = htons(base_alias + (RTSP_PORT_GROUP - 1)); } if (salias && rtsp_lnk) { - pkt_updated = 1; + pkt_updated = true; /* Copy into IP packet */ - sprintf(stemp, "%d", ntohs(salias)); - memcpy(port_newdata, stemp, strlen(stemp)); - port_newdata += strlen(stemp); + slen = snprintf(newdata + new_dlen, + maxlen - new_dlen, "%d", ntohs(salias)); + if (slen < 0 || slen >= maxlen - new_dlen) + goto fail; + new_dlen += slen; if (eport != 0) { - *port_newdata = '-'; - port_newdata++; + if (new_dlen == maxlen) + goto fail; + newdata[new_dlen++] = '-'; /* Copy into IP packet */ - sprintf(stemp, "%d", ntohs(ealias)); - memcpy(port_newdata, stemp, strlen(stemp)); - port_newdata += strlen(stemp); + slen = snprintf(newdata + new_dlen, + maxlen - new_dlen, "%d", ntohs(ealias)); + if (slen < 0 || slen >= maxlen - new_dlen) + goto fail; + new_dlen += slen; } - *port_newdata = ';'; - port_newdata++; + if (new_dlen == maxlen) + goto fail; + newdata[new_dlen++] = ';'; } state++; break; @@ -380,20 +400,20 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, } if (!pkt_updated) - return (-1); - - memcpy(port_newdata, port_data, port_dlen); - port_newdata += port_dlen; - *port_newdata = '\0'; + goto fail; /* Create new packet */ - new_dlen = port_newdata - newdata; + if (new_dlen + port_dlen > maxlen) + goto fail; + memmove(data + new_dlen, port_data, port_dlen); memcpy(data, newdata, new_dlen); + new_dlen += port_dlen; + free(newdata); SetAckModified(lnk); tc = (struct tcphdr *)ip_next(pip); delta = GetDeltaSeqOut(tc->th_seq, lnk); - AddSeq(lnk, delta + new_dlen - dlen, pip->ip_hl, pip->ip_len, + AddSeq(lnk, delta + (int)(new_dlen - dlen), pip->ip_hl, pip->ip_len, tc->th_seq, tc->th_off); new_len = htons(hlen + new_dlen); @@ -407,6 +427,9 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, tc->th_sum = TcpChecksum(pip); #endif return (0); +fail: + free(newdata); + return (-1); } /* Support the protocol used by early versions of RealPlayer */ @@ -415,13 +438,13 @@ static int alias_pna_out(struct libalias *la, struct ip *pip, struct alias_link *lnk, char *data, - int dlen) + size_t dlen) { struct alias_link *pna_links; - u_short msg_id, msg_len; char *work; - u_short alias_port, port; struct tcphdr *tc; + u_short msg_id, msg_len; + u_short alias_port, port; work = data; work += 5; @@ -433,7 +456,7 @@ alias_pna_out(struct libalias *la, struct ip *pip, if (ntohs(msg_id) == 0) /* end of options */ return (0); - if ((ntohs(msg_id) == 1) || (ntohs(msg_id) == 7)) { + if (ntohs(msg_id) == 1 || ntohs(msg_id) == 7) { memcpy(&port, work, 2); pna_links = FindUdpTcpOut(la, pip->ip_src, GetDestAddress(lnk), port, 0, IPPROTO_UDP, 1); @@ -462,22 +485,23 @@ alias_pna_out(struct libalias *la, struct ip *pip, } static void -AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, int maxpacketsize) +AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, + size_t maxlen) { - int hlen, tlen, dlen; struct tcphdr *tc; char *data; const char *setup = "SETUP", *pna = "PNA", *str200 = "200"; const char *okstr = "OK", *client_port_str = "client_port"; const char *server_port_str = "server_port"; - int i, parseOk; - - (void)maxpacketsize; + size_t hlen, tlen, dlen; + size_t i; tc = (struct tcphdr *)ip_next(pip); hlen = (pip->ip_hl + tc->th_off) << 2; tlen = ntohs(pip->ip_len); dlen = tlen - hlen; + if (hlen > tlen || tlen > maxlen) + return; data = (char *)pip; data += hlen; @@ -485,13 +509,14 @@ AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, /* When aliasing a client, check for the SETUP request */ if ((ntohs(tc->th_dport) == RTSP_CONTROL_PORT_NUMBER_1) || (ntohs(tc->th_dport) == RTSP_CONTROL_PORT_NUMBER_2)) { - if (dlen >= (int)strlen(setup) && + if (dlen >= strlen(setup) && memcmp(data, setup, strlen(setup)) == 0) { - alias_rtsp_out(la, pip, lnk, data, client_port_str); + alias_rtsp_out(la, pip, lnk, data, maxlen, + client_port_str); return; } - if (dlen >= (int)strlen(pna) && + if (dlen >= strlen(pna) && memcmp(data, pna, strlen(pna)) == 0) alias_pna_out(la, pip, lnk, data, dlen); } else { @@ -499,24 +524,21 @@ AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, * When aliasing a server, check for the 200 reply * Accommodate varying number of blanks between 200 & OK */ - - if (dlen >= (int)strlen(str200)) { - for (parseOk = 0, i = 0; - i <= dlen - (int)strlen(str200); - i++) - if (memcmp(&data[i], str200, strlen(str200)) == 0) { - parseOk = 1; - break; - } - - if (parseOk) { - i += strlen(str200); /* skip string found */ - while (data[i] == ' ') /* skip blank(s) */ + if (dlen < strlen(str200) + 1 + strlen(okstr)) + return; + for (i = 0; i <= dlen - strlen(str200) - 1; i++) { + if (memcmp(&data[i], str200, strlen(str200)) == 0 && + data[i + strlen(str200)] == ' ') { + i += strlen(str200); /* skip 200 */ + while (i < dlen && data[i] == ' ') /* skip blank(s) */ i++; - - if ((dlen - i) >= (int)strlen(okstr)) - if (memcmp(&data[i], okstr, strlen(okstr)) == 0) - alias_rtsp_out(la, pip, lnk, data, server_port_str); + if (dlen - i >= strlen(okstr)) { + if (memcmp(&data[i], okstr, strlen(okstr)) == 0) { + alias_rtsp_out(la, pip, lnk, data, + maxlen, server_port_str); + break; + } + } } } } From nobody Tue Jun 30 17:20:32 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKD66Pgz6jXxN for ; Tue, 30 Jun 2026 17:20:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKD2m1wz3qYy for ; Tue, 30 Jun 2026 17:20:32 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840032; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2WxQZLzZ2/qh5T2bHABbO5age5v7PF8odyH/e6R4xZo=; b=sgYvQCzpEIkAe+Dfjj6Ymt6H1uBJ569OgG00JM7HJb11Swy7LA+4k95+96QVNP5p/ILDLp vI+ytCn4snt3+Kh2qzHYowiMxYUThmDuzPB5NlBfVQxVaF8WS6z0M/7ZdzfcxKAnFRAmZC qzRsGa9/0CEW9fqVwTeXppKcJlu2bLnn/HYGS/1d3bmVW67YhTpaCWgm96qYD4v/LVbJ38 UN2OGTo5IbPjMb+2lnF/QpKf/ILIswI+vS9oRK1he/jGtMvnSiH3dXU3mhTSAMMJZBYxBr o90pcBcUzxcK58UQs2LcAcospFsRx+4iNNPOpqmWgvqna0tNMOGVYUXlofryVA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840032; a=rsa-sha256; cv=none; b=ap1Me/FmrCQYFVU6uhMEl57kQajSI1EpqzMtYSp7+diH0YJK0HscNAOwOYgJBMm97MI7uI drT+TJiB4OvItXkTkgMTGlQoYj/neZ2RG8hOsFnyWz4VwOPIdSc76rXjysUqfNuGTgyleB mbkv/blh9QR7lAkPr0qoZKPvR3IfakYyTi+E7qAKFBVvfGq4JYSYCUdeDUNfyY/O8z2y36 bApgZLwOg6+T1ZIIqWN+lS2Ii+rc8kcaFKv3fUcFNcAB6PJhc3da7Y2hP8NaGOd1r5fhI7 1M9I0ZMDmPdqJLzYXAunUUjjnOjYwPdlEveOD8o/xr0LKBJIPkFkNt1cFSzKYg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840032; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2WxQZLzZ2/qh5T2bHABbO5age5v7PF8odyH/e6R4xZo=; b=xQ+jiOL1q4Tn92427sPQupaPeY7iJLGY60OrL41HKqMqJ7/cP8o34vy9M6fPhYjD/6scyG hJmvWkgYxIpq8hTkoOIO2lN+8OkkL/SUadV6dRRUAEuLNVASjKxQSfaYnrEKobl3S/pnDo 469EcG4zZnGtqVb1w/ppg7fnjCQxgcL8imQRVzoF2c9U/SlGxf7CScD4+kJmraSwTNhOXp yZSQqokdkeZw7aVuJJbmOU3ZPClXM3MRVC6Qk8gtkhMH/nxj0rZPMP48SFIf9JBaCDmwnY OLUX8G6MlacNlM9zc3UBv/niOwuY/gCPacjcBFiI9ExCR849Zo6JAyRh3R22kQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKD1LqbzsXp for ; Tue, 30 Jun 2026 17:20:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45fa4 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:32 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 935a96aa77be - releng/14.3 - tests/libalias: Add a regression test for an alias_smedia bug List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 935a96aa77be18eb33ae80a2b4611da44261396b Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:32 +0000 Message-Id: <6a43fae0.45fa4.5735a657@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=935a96aa77be18eb33ae80a2b4611da44261396b commit 935a96aa77be18eb33ae80a2b4611da44261396b Author: Mark Johnston AuthorDate: 2026-06-22 17:25:56 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:01 +0000 tests/libalias: Add a regression test for an alias_smedia bug Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57747 --- tests/sys/netinet/libalias/Makefile | 4 ++ tests/sys/netinet/libalias/smedia.c | 74 +++++++++++++++++++++++++++++++++++++ 2 files changed, 78 insertions(+) diff --git a/tests/sys/netinet/libalias/Makefile b/tests/sys/netinet/libalias/Makefile index 20d904511538..5f83eaee9900 100644 --- a/tests/sys/netinet/libalias/Makefile +++ b/tests/sys/netinet/libalias/Makefile @@ -4,6 +4,10 @@ PACKAGE= tests TESTSDIR= ${TESTSBASE}/sys/netinet/libalias BINDIR= ${TESTSDIR} +PLAIN_TESTS_C+= smedia + +LIBADD.smedia+= sbuf + ATF_TESTS_C+= 1_instance \ 2_natout \ 3_natin \ diff --git a/tests/sys/netinet/libalias/smedia.c b/tests/sys/netinet/libalias/smedia.c new file mode 100644 index 000000000000..e181a7a538af --- /dev/null +++ b/tests/sys/netinet/libalias/smedia.c @@ -0,0 +1,74 @@ +/* + * Copyright (c) 2026 The FreeBSD Foundation + * + * This software was developed by Mark Johnston under sponsorship from + * the FreeBSD Foundation. + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +/* + * A minimal regression test for a buffer overflow in alias_rtsp_out(). + */ + +#include +#include + +#include +#include +#include +#include + +#include +#include + +#include + +int +main(void) +{ + uint8_t *packet; + struct ip ip; + struct tcphdr tcp; + struct sbuf sb; + struct libalias *la; + + sbuf_new(&sb, NULL, 0, SBUF_AUTOEXTEND); + sbuf_printf(&sb, "SETUP rtsp://example.com/media.mp4 RTSP/1.0\r\n"); + sbuf_printf(&sb, "CSeq: 1\r\n"); + sbuf_printf(&sb, "Transport: RTP/AVP;unicast;"); + for (int i = 0; i < 200; i++) + sbuf_printf(&sb, "client_port=%d-%d;", 2 * i, 2 * i + 1); + sbuf_printf(&sb, "\r\n\r\n"); + sbuf_finish(&sb); + + memset(&tcp, 0, sizeof(tcp)); + tcp.th_sport = htons(1234); + tcp.th_dport = htons(554); + tcp.th_off = 5; + + memset(&ip, 0, sizeof(ip)); + ip.ip_v = IPVERSION; + ip.ip_hl = sizeof(ip) / 4; + ip.ip_len = htons(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)); + ip.ip_id = htons(1); + ip.ip_ttl = 64; + ip.ip_p = IPPROTO_TCP; + ip.ip_src.s_addr = inet_addr("127.0.0.1"); + ip.ip_dst.s_addr = inet_addr("127.0.0.2"); + + packet = malloc(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)); + memcpy(packet, &ip, sizeof(ip)); + memcpy(packet + sizeof(ip), &tcp, sizeof(tcp)); + memcpy(packet + sizeof(ip) + sizeof(tcp), sbuf_data(&sb), + sbuf_len(&sb)); + + la = LibAliasInit(NULL); + LibAliasSetAddress(la, + (struct in_addr){.s_addr = inet_addr("127.0.0.1")}); + if (LibAliasOut(la, packet, sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)) != + PKT_ALIAS_OK) + return (1); + LibAliasUninit(la); + return (0); +} From nobody Tue Jun 30 17:20:33 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKG1MDLz6jY97 for ; Tue, 30 Jun 2026 17:20:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKF3KhWz3qbv for ; Tue, 30 Jun 2026 17:20:33 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840033; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=76AnUywevDdzn6sQk1aUF5AtIVUZRa49vnwjVB6BwdY=; b=SYLhdVANGeHsPzCeVFPOa+kaFEBrsX1kMTSwMtT/eOsp5GOo1yVQr9ddklBjXRl2HJa76z ImaAvWEEoLDaU/NijQUobr/Ob7v+Rp65Wyj1pUdSacj4wA0+uUT/ltQtIJTv9YYNauXyPq z6DK8yhnrU4VH4sesDu7PhwvADm/2eKImvG/0bgQ9aMdXCG9H5mbsAPtcnTGgxYje8Y7CA P6DElYVV0dEFzqHXU3f+HmRzFvAQnQkshH3K9lDil+4kEvTubOZfFJp+vjO9k9zsJj+Nu/ SDiBB82OhIPIXpI7lNVE+RsafpJnQFgFH9SthuSVcbhu7XIvDQtstXhoRBQvAw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840033; a=rsa-sha256; cv=none; b=uCdXiBbEniNjLmtutDZ9BwX3pk6yq8DHCwvgyj7MaR4zmgVVDul6susyAYAWf+exU5lV4y cpb9keUo6Jcgf265x5+NvAON6k3RqZtkj9MIt8vI0hrn9nfqRGvIAa16YthkuZ+0uQ3XhQ utGRAExNkiT9+4EvWySfilrpY+ZAT0a3IkNPm/V1w5+nh90izlgnnQKPguvIa+hZ4rqz5L 0dfRDvmiGFHKdKYHdTr/eXT6LdSi/6ynOflm4G2Dzlu59ajsKUfGWFj5NAvr36XRorjDAV xIym4tiMiRmz1tuL+xwcSF8m55CuYc0KWkD057m4JwCcGvtIV4OgWzEc6vLQCQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840033; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=76AnUywevDdzn6sQk1aUF5AtIVUZRa49vnwjVB6BwdY=; b=Dj1r6DMCt1hw2FSvAURd6A0a/phXi83xMWsNu6E84oyFYBKQy/zaPCmhZCEIMa9E49KT9T db8NjEoyHZIs0X9wqs5GF/e3umGz6QXQF9ReM1GfGtety/zvZsLVS10UQ+xi3cvtV4yVLq SZI+TMecphx4LiQ5e7lvlRAbICHSSJhGct4UPJNx1cvsZ3nKkU4DFjsoZys9ufxjekkMKJ OdTkHbkALtewX/Vg8P5mytFifL3zhdz0B0s3HUUfAyofDwBCwWgaOpRXjXtWUp5iR+dhdY MFTk4XGTfkhmUq/saspyRnrzu7R945K1CPPaquhzXAWMvPxI7zpa2oyXOAxcTQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKF29llztDR for ; Tue, 30 Jun 2026 17:20:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44eed by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:33 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: acfff8b35bfe - releng/14.3 - unlinkat: Pass flags down to the work functions List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: acfff8b35bfe31c53f92cf6ac040afa4a9a0f0ef Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:33 +0000 Message-Id: <6a43fae1.44eed.26baa565@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=acfff8b35bfe31c53f92cf6ac040afa4a9a0f0ef commit acfff8b35bfe31c53f92cf6ac040afa4a9a0f0ef Author: Mark Johnston AuthorDate: 2026-06-23 20:43:53 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:01 +0000 unlinkat: Pass flags down to the work functions The unlinkat(2) and funlinkat(2) system calls were ignoring AT_RESOLVE_BENEATH. Also pass pathseg through instead of assuming it's UIO_USERSPACE. Add some tests which make sure that AT_RESOLVE_BENEATH is handled properly by various system calls. Approved by: so Security: FreeBSD-SA-26:42.unlinkat Security: CVE-2026-49421 Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57790 --- sys/kern/vfs_syscalls.c | 11 +- tests/sys/kern/Makefile | 1 + tests/sys/kern/resolve_beneath_test.c | 220 ++++++++++++++++++++++++++++++++++ 3 files changed, 227 insertions(+), 5 deletions(-) diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index ded3a87e7f8b..d58cfcd3bcba 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -1892,16 +1892,17 @@ sys_unlink(struct thread *td, struct unlink_args *uap) static int kern_funlinkat_ex(struct thread *td, int dfd, const char *path, int fd, - int flag, enum uio_seg pathseg, ino_t oldinum) + int flags, enum uio_seg pathseg, ino_t oldinum) { - if ((flag & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) + if ((flags & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) return (EINVAL); - if ((flag & AT_REMOVEDIR) != 0) - return (kern_frmdirat(td, dfd, path, fd, UIO_USERSPACE, 0)); + if ((flags & AT_REMOVEDIR) != 0) + return (kern_frmdirat(td, dfd, path, fd, pathseg, + flags & ~AT_REMOVEDIR)); - return (kern_funlinkat(td, dfd, path, fd, UIO_USERSPACE, 0, 0)); + return (kern_funlinkat(td, dfd, path, fd, pathseg, flags, 0)); } #ifndef _SYS_SYSPROTO_H_ diff --git a/tests/sys/kern/Makefile b/tests/sys/kern/Makefile index 82bac2aa8b80..a7d9b125b28f 100644 --- a/tests/sys/kern/Makefile +++ b/tests/sys/kern/Makefile @@ -29,6 +29,7 @@ ATF_TESTS_C+= procdesc ATF_TESTS_C+= ptrace_test TEST_METADATA.ptrace_test+= timeout="15" ATF_TESTS_C+= reaper +ATF_TESTS_C+= resolve_beneath_test ATF_TESTS_C+= sched_affinity ATF_TESTS_C+= sigaltstack ATF_TESTS_C+= sigwait diff --git a/tests/sys/kern/resolve_beneath_test.c b/tests/sys/kern/resolve_beneath_test.c new file mode 100644 index 000000000000..b83926038ded --- /dev/null +++ b/tests/sys/kern/resolve_beneath_test.c @@ -0,0 +1,220 @@ +/* + * Copyright (c) 2026 The FreeBSD Foundation + * + * This software was written by Mark Johnston under sponsorship from + * the FreeBSD Foundation. + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +#include +#include + +#include +#include +#include + +#include + +/* + * Verify that AT_RESOLVE_BENEATH is respected by various system calls. + */ + +static int +setup(void) +{ + int fd, tfd; + + ATF_REQUIRE_EQ(0, mkdir("base", 0755)); + ATF_REQUIRE_EQ(0, mkdir("outside", 0755)); + ATF_REQUIRE((tfd = open("outside/target", O_CREAT | O_WRONLY, 0644)) >= + 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("outside/dir", 0755)); + ATF_REQUIRE((tfd = open("base/file", O_CREAT | O_WRONLY, 0644)) >= 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("base/subdir", 0755)); + ATF_REQUIRE((fd = open("base", O_DIRECTORY | O_RDONLY)) >= 0); + return (fd); +} + +ATF_TC_WITHOUT_HEAD(faccessat_beneath); +ATF_TC_BODY(faccessat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + faccessat(fd, "file", F_OK, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + faccessat(fd, "../outside/target", F_OK, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(chflagsat_beneath); +ATF_TC_BODY(chflagsat_beneath, tc) +{ + int fd, ret; + + fd = setup(); + ret = chflagsat(fd, "file", UF_NODUMP, AT_RESOLVE_BENEATH); + if (ret != 0) + ATF_REQUIRE_EQ(EOPNOTSUPP, errno); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + chflagsat(fd, "../outside/target", UF_NODUMP, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchmodat_beneath); +ATF_TC_BODY(fchmodat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchmodat(fd, "file", 0644, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchmodat(fd, "../outside/target", 0644, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchownat_beneath); +ATF_TC_BODY(fchownat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchownat(fd, "file", -1, -1, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchownat(fd, "../outside/target", 0, 0, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(utimensat_beneath); +ATF_TC_BODY(utimensat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + utimensat(fd, "file", NULL, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + utimensat(fd, "../outside/target", NULL, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(linkat_beneath); +ATF_TC_BODY(linkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + linkat(fd, "file", fd, "hardlink", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + linkat(fd, "../outside/target", fd, "hardlink2", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_beneath); +ATF_TC_BODY(unlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "file", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/target", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_rmdir_beneath); +ATF_TC_BODY(unlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "subdir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/dir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_beneath); +ATF_TC_BODY(funlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "file", FD_NONE, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/target", FD_NONE, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_rmdir_beneath); +ATF_TC_BODY(funlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, mkdir("base/subdir2", 0755)); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "subdir2", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/dir", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC(getfhat_beneath); +ATF_TC_HEAD(getfhat_beneath, tc) +{ + atf_tc_set_md_var(tc, "require.user", "root"); +} +ATF_TC_BODY(getfhat_beneath, tc) +{ + fhandle_t fh; + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + getfhat(fd, "file", &fh, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + getfhat(fd, "../outside/target", &fh, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TP_ADD_TCS(tp) +{ + ATF_TP_ADD_TC(tp, faccessat_beneath); + ATF_TP_ADD_TC(tp, chflagsat_beneath); + ATF_TP_ADD_TC(tp, fchmodat_beneath); + ATF_TP_ADD_TC(tp, fchownat_beneath); + ATF_TP_ADD_TC(tp, utimensat_beneath); + ATF_TP_ADD_TC(tp, linkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, funlinkat_beneath); + ATF_TP_ADD_TC(tp, funlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, getfhat_beneath); + return (atf_no_error()); +} From nobody Tue Jun 30 17:20:35 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKJ1601z6jXxW for ; Tue, 30 Jun 2026 17:20:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKH4tGNz3qhW for ; Tue, 30 Jun 2026 17:20:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840035; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=CaRGY8YurmV98dhlH7Bl1WjusTPxlEALHjCb8knTwoQ=; b=uzXzu38K1LOkGteXlvB2xsnK20uFVqOSnw0GBRQi2eCod7lMxJ3lE9Gn9KNRuvUS9ZvpyY 0mQXUmIqKfhdIigErjxWzmocOADuWHpNhmoh6TYWKL2IUTaDhsvuM59x7iv4rCvqhisAHt oQTL8TTJXbxdcu7DpS/7JnhdzO4PbZ5GEKjbKgslpV65AyCzv9MOSMSJzkhDdV6atrtlkS oRD8kACEnlTAA3eRCUfYIbd+RGV8ToztArDQyLSImRFo0Nc61LQxbFW+uke7jr39whpYq6 sdc58yHo4TFsdDDXmuywNYCabvTFOavoUTKqmmxk31YFyN2neTkqBiGithMqHw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840035; a=rsa-sha256; cv=none; b=GqTwpsqOKSbpis7krCmybIgFlr/MddkWEw8NC280ZIoDR00EXJDtoRk3iWyfPXdrns7QST 7JKqnY3fiQ2X+C2+UDTuxs7X9NoIIe/fX08B53qoVgcWmmwSzg74A27peT3xQa92ORGmqc A3sJLTyA0BX8bfoBf4y0gCkNV4wL4Ljky14orjQbZc/snbUPzbZYWIWxpx3EiY7bvzkabO xXPxATeFC9FP7D1fM3c5w9rFLuTZdXbE2OEwVV+zfxvbxOcjztdZoIODZ2IF5a642pTruz T6V2dOMi68ySuuAL9DWygg1iEeBpaFJQyYKGMCjZljVjSEJcCDK8RtYmMnZjYQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840035; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=CaRGY8YurmV98dhlH7Bl1WjusTPxlEALHjCb8knTwoQ=; b=nnsIPv3xNuj942A4EBqWHMBhkhVv53C0fV2zTfpSB4lgGhXAxPgKd0M4dx986HbQiMc317 drtjAQSn01fKtgE7zSX/4yb76vWp3Zlc9tJIjLJW8fSnTpO0xhw9Ir6OEjo64P1PNwFPfU jjgcs0D7+pv6/xX5NCiVbp7nNuQtI21fV8NoafhHj98gITfoOPOP3PhvFdP7hXSLn0xGmm iXOAbgyOAIeepu6UOOyimt5EThF3lxD3FL+RGVuuBgCVmq6tXVqj1YmVvUAwo3XTRLPSPy Ha28TrwdzPmalrZmymKw4mSicqvVf0ZBFac8BMjmFWwvyawd2BpTCY6AzM3h9Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKH3VBvztVK for ; Tue, 30 Jun 2026 17:20:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44f5d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:35 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 25f7efc5339b - releng/14.3 - posixshm: Disallow fspacectl() on largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 25f7efc5339bb0d5901d5f929f8dd58c8befd583 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:35 +0000 Message-Id: <6a43fae3.44f5d.5a2464d1@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=25f7efc5339bb0d5901d5f929f8dd58c8befd583 commit 25f7efc5339bb0d5901d5f929f8dd58c8befd583 Author: Mark Johnston AuthorDate: 2026-06-24 19:56:07 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:01 +0000 posixshm: Disallow fspacectl() on largepage objects As with truncation, the operation isn't supported, but nothing prevented it. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57830 --- sys/kern/uipc_shm.c | 5 ++++- tests/sys/posixshm/posixshm_test.c | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index c8d5521c5ab1..5849569f2dfc 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -2095,11 +2095,14 @@ shm_fspacectl(struct file *fp, int cmd, off_t *offset, off_t *length, int flags, ("shm_fspacectl: non-zero flags")); KASSERT(*offset >= 0 && *length > 0 && *length <= OFF_MAX - *offset, ("shm_fspacectl: offset/length overflow or underflow")); - error = EINVAL; + shmfd = fp->f_data; off = *offset; len = *length; + if (shm_largepage(shmfd)) + return (ENOTSUP); + rl_cookie = shm_rangelock_wlock(shmfd, off, off + len); switch (cmd) { case SPACECTL_DEALLOC: diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index 314bf5e3ff5b..dfcb5a72fefb 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -1380,6 +1380,27 @@ ATF_TC_BODY(largepage_config, tc) ATF_REQUIRE(close(fd) == 0); } +ATF_TC_WITHOUT_HEAD(largepage_fspacectl); +ATF_TC_BODY(largepage_fspacectl, tc) +{ + struct spacectl_range range; + size_t ps[MAXPAGESIZES]; + int fd, pscnt; + + pscnt = pagesizes(ps); + + for (int i = 1; i < pscnt; i++) { + fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, ps[i]); + + range.r_offset = 0; + range.r_len = ps[i]; + ATF_REQUIRE_ERRNO(ENOTSUP, + fspacectl(fd, SPACECTL_DEALLOC, &range, 0, &range) == -1); + + ATF_REQUIRE(close(fd) == 0); + } +} + ATF_TC_WITHOUT_HEAD(largepage_mmap); ATF_TC_BODY(largepage_mmap, tc) { @@ -2168,6 +2189,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, mmap_prot); ATF_TP_ADD_TC(tp, largepage_basic); ATF_TP_ADD_TC(tp, largepage_config); + ATF_TP_ADD_TC(tp, largepage_fspacectl); ATF_TP_ADD_TC(tp, largepage_mmap); ATF_TP_ADD_TC(tp, largepage_munmap); ATF_TP_ADD_TC(tp, largepage_madvise); From nobody Tue Jun 30 17:20:34 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKG70bjz6jY6j for ; Tue, 30 Jun 2026 17:20:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKG4BJyz3qn1 for ; Tue, 30 Jun 2026 17:20:34 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840034; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9fTXEgi/SeHrWbAwn36R4163jtYwYTTYRfxMWIlM0+w=; b=dFM/lfvC4Z0XdfVUD0bHP+ht8EZSuZA6/9U+JYs1oK7uIpP5B2V/J1iLcYTBUTAZ5SOeQQ l+POU4phDaW4Wr9EV22y9dzm2//xFcZVpKB7P8pv8B2JFGW7kxjLngU8+Lk4//nZbdN8ye sliG/gtLXKEw0a5ndA6SekaBhw2pjKt+MceHnRVCR92p9znjLGwQsDS/4Ik/Fegw6xssr7 RJwPcEPX5lWreSJSDOzYnNleISlbjJilp+qfJQTIAkGXSuF/29lT7pic4clhqZ7HSkN3ZE uQwndsG8NGd/emP2Mfk1GQGoa3yJ0RZ9mpIGc2kKq9LBshQ5DdzeZdaGhB6L2Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840034; a=rsa-sha256; cv=none; b=LQ11bHeSlAdd0MBjw9d7c8WwjgGCOr1NsPcGO9O9PBYQfRhjKZAjaQYPIC5FMhv0vGa2V+ i3Zf9D/LmF4eyZzk8F7VlA2dfjTmjaxax1MukFvGek3/EQDzJgWl+OYd/V6M9HhTnBxwYJ Z0NkJljlglb+wzqnUzvWyQccOZlZUA2eo35o6NZH+Jwl8GhKfzhIizOGxmPQzoAf/OODaW xBIi9RfDxM8g+kn6fkbsYs40bqth92yPFpUuh/CHU3VZLvCmuum53AKp4elI2e5An1tXma DWlDyvxFOjaS+TnuijcGdyr0GgCfViuShPCwiw8b0Jhjvl8GnPlnI6GhkRv8yg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840034; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9fTXEgi/SeHrWbAwn36R4163jtYwYTTYRfxMWIlM0+w=; b=lgpoy3LZC44Pm3wH/WahJb0YYNBrd9AhUHh0UNuwIXtxE+Ufi0IyJBNAIaVjjEYEKISiK/ iTPcFni4O1/n0OZGyttY1GHGTfsv+Ysk8oqu1fdyJRtTmfMXlCUOS3DswRhiA937tk4KwL G/pDHgBZ/QsBU1gESQYUD6PfwxQ9F4XoKMQWNel72HeOm92cps6wU76IGbt8UCMBabneDr kT4oGKJMsNK4WLPdtL2+R/drQcMzdBGbJnpjDzjxzT1lXsU5hJPyt8zdqzwHyoa6a94IBy NyLEbNT8tO0KLc5/Yj2zVhhNiKqwQDm8acnE5A6h3wvYeaSxbhJ7PGovqcA+SA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKG34gcztDS for ; Tue, 30 Jun 2026 17:20:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45b8a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 8845978fec03 - releng/14.3 - rack: Reload the TCP stack PCB after reacquiring the inpcb lock List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 8845978fec035db3a9643d7f36843dfc7c6c68d8 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:34 +0000 Message-Id: <6a43fae2.45b8a.278628a4@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8845978fec035db3a9643d7f36843dfc7c6c68d8 commit 8845978fec035db3a9643d7f36843dfc7c6c68d8 Author: Mark Johnston AuthorDate: 2026-06-23 21:46:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:01 +0000 rack: Reload the TCP stack PCB after reacquiring the inpcb lock Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791 --- sys/netinet/tcp_stacks/rack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index f90b747cc2e4..3d6734b6874b 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -23934,6 +23934,7 @@ process_opt: INP_WUNLOCK(inp); return (ENOPROTOOPT); } + rack = (struct tcp_rack *)tp->t_fb_ptr; if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_HYBRID_PACING) && From nobody Tue Jun 30 17:20:36 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKK2RxYz6jY2B for ; Tue, 30 Jun 2026 17:20:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKJ5Nc0z3qWc for ; Tue, 30 Jun 2026 17:20:36 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840036; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qYekwYqt8HLT54Z93pCwzX+TtUBdIqhsNSZkWxsF9EI=; b=KpLPsqOeiPqdWjZ/egMb3/UpGqGm401xrwYkfZ/2ct48bGGG5axngLfRNc0RF7RgzGQciv wWaPv6UXwYIV9AE37CBVHixsFU/+RrMZtR7j/0qmv2bW9XYgspq01EM5xrWTFKurpMJpye xZ9L8WpBgL+bezkIVga7ufNTljX01PFiXle/XABF41zV2ZMxKlg14mq5Q+a1NGCmTZ+s+w X22esQDTp4PdquKIB39wU0VJcnWwubSTLMT6ThY9kLES4L9ge7oRM4mUWw+MSxbZjIw5wy cF+nwOITLsM9JXbiB0NSslmH4feBHSlIeZvOf/xtMirh2JeqYeYSgA+TC+AMng== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840036; a=rsa-sha256; cv=none; b=bCuTqDeMLtI1kt3LbAwtTofH0Yp+VuCsv4Q9OJTP8FH7U/OBp20vmfjJqMGwrFha1ioW6u jcYE4zeShk52V/GDc5jdZsXAoS7W6AUaGpbTXUch1rIszF+1eQKs7pCmtqf21xl9jYyVTb p+57NKCccmJwuZN48yNiIKqVoaCYdwdhWdAfVATG/uN8Atul/yknxG7rEPgrnhfLWyxQC4 76bkbbxLBbUMAxKLtBYWCGovCjlxCshhbNwbqLtBvCuXbTINUILaEe8FUczcopN6DKCmgh yg0LDsrEnptM2sMy8BRQLGogSfQNK+O1moEmHcXwMk7hUTJUY3VxehuY74NBmg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840036; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qYekwYqt8HLT54Z93pCwzX+TtUBdIqhsNSZkWxsF9EI=; b=WZWr9tENDt2zWJNZvE0mURj13ZEUGxNrWQqMQKS+ZAickqHkqKc3uz6Eth99F2kWSg2zRf yXI9YYjYaldXr9t8RlxLk2OzjJJNdxOveW4JPQWjpUjNooSLzSVUclGrJAKrH2jsxB/phg Wq/Xdn8j10lVhQCZXVrX1t5wglDxNLOPCggAMe/dP+PKJxVzqhjaWIlOtRrR+G9UCxgsso V6Xb9PONXPa7z+O6PF3hJCYQWBluZtDoR4vGVtRcpg21eSZ/9c3OA3zubkXaCqYHFwxtlK yTxpJrbS6yo4OymfdLC8gfRD3jbtzDwUkN37sl6An/kYRAK9DomOE4HG5quPCg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKJ4JJjztDV for ; Tue, 30 Jun 2026 17:20:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45644 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:36 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: d6e382c17691 - releng/14.3 - posixshm: Disallow truncation of largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: d6e382c17691eee21f7b4907ffd41d622af4200b Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:36 +0000 Message-Id: <6a43fae4.45644.253446e9@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=d6e382c17691eee21f7b4907ffd41d622af4200b commit d6e382c17691eee21f7b4907ffd41d622af4200b Author: Mark Johnston AuthorDate: 2026-06-23 22:47:02 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:01 +0000 posixshm: Disallow truncation of largepage objects We correctly handled ftruncate(), but not open(O_TRUNC). Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57831 --- sys/kern/uipc_shm.c | 8 +++----- tests/sys/posixshm/posixshm_test.c | 38 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 5 deletions(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index 5849569f2dfc..b3dd7a91d473 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -824,7 +824,7 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) vm_pindex_t oldobjsz __unused; int aflags, error, i, psind, try; - KASSERT(length >= 0, ("shm_dotruncate: length < 0")); + KASSERT(length >= 0, ("shm_dotruncate_largepage: length < 0")); object = shmfd->shm_object; VM_OBJECT_ASSERT_WLOCKED(object); rangelock_cookie_assert(rl_cookie, RA_WLOCKED); @@ -1344,15 +1344,13 @@ kern_shm_open2(struct thread *td, const char *userpath, int flags, mode_t mode, if (error == 0 && (flags & (O_ACCMODE | O_TRUNC)) == (O_RDWR | O_TRUNC)) { - VM_OBJECT_WLOCK(shmfd->shm_object); #ifdef MAC error = mac_posixshm_check_truncate( - td->td_ucred, fp->f_cred, shmfd); + td->td_ucred, fp->f_cred, shmfd); if (error == 0) #endif - error = shm_dotruncate_locked(shmfd, 0, + error = shm_dotruncate_cookie(shmfd, 0, rl_cookie); - VM_OBJECT_WUNLOCK(shmfd->shm_object); } if (error == 0) { /* diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index dfcb5a72fefb..c792a85de9e3 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -2151,6 +2151,43 @@ ATF_TC_BODY(largepage_reopen, tc) "close failed; errno=%d", errno); } +ATF_TC_WITHOUT_HEAD(largepage_truncate); +ATF_TC_BODY(largepage_truncate, tc) +{ + size_t ps[MAXPAGESIZES]; + int fd, psind; + + (void)pagesizes(ps); + psind = 1; + + gen_test_path(); + fd = shm_create_largepage(test_path, O_CREAT | O_RDWR, psind, + SHM_LARGEPAGE_ALLOC_DEFAULT, 0600); + if (fd < 0 && errno == ENOTTY) + atf_tc_skip("no large page support"); + ATF_REQUIRE_MSG(fd >= 0, "shm_create_largepage failed; error=%d", errno); + + ATF_REQUIRE_MSG(ftruncate(fd, ps[psind]) == 0, + "ftruncate failed; error=%d", errno); + + ATF_REQUIRE_MSG(close(fd) == 0, "close failed; error=%d", errno); + + fd = shm_open(test_path, O_RDWR | O_TRUNC, 0); + ATF_REQUIRE_MSG(fd == -1, "shm_open(O_TRUNC) should have failed"); + ATF_REQUIRE_ERRNO(ENOTSUP, fd == -1); + + fd = shm_open(test_path, O_RDWR, 0); + ATF_REQUIRE_MSG(fd >= 0, "shm_open failed; error=%d", errno); + + ATF_REQUIRE_MSG(ftruncate(fd, ps[psind]) == 0, + "ftruncate to same size failed; error=%d", errno); + + ATF_REQUIRE_MSG(shm_unlink(test_path) == 0, + "shm_unlink failed; errno=%d", errno); + ATF_REQUIRE_MSG(close(fd) == 0, + "close failed; errno=%d", errno); +} + ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TC(tp, remap_object); @@ -2202,6 +2239,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, largepage_pkru); #endif ATF_TP_ADD_TC(tp, largepage_reopen); + ATF_TP_ADD_TC(tp, largepage_truncate); return (atf_no_error()); } From nobody Tue Jun 30 17:20:37 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKM1xB9z6jY4g for ; Tue, 30 Jun 2026 17:20:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKK68kNz3qhs for ; Tue, 30 Jun 2026 17:20:37 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840037; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rIM2X2eK+dyFSsVWxLHoQsRXpk7SGOEeO5h39BHCSYU=; b=WEdide1+2IyNWZSErMi0vnqP9GI+UYcS6eVb0cqSsahuNhi25O2222IQ2UfuVz4ZCs3JSd YGY95GL5wMSeskPuR0kal7FK/UJQ8JpkBX0YPwAQYXp35fKUlk3ggJ2P20BiNg3POUgzD4 BgIwiBP0F//VEh2pq06F9GRBBqWgUb2Acfu1yWM1ekZaIuZfWnfSF2xfqAOMmQt+AVPbdw qy14dhKrFxWrdCPf18oxG4HVso5N6z8HZA3St85F9fMiYTNLdWdgzyLr2n+Vm2q+3zTTz2 rdlT+XHqv90Sf+qVuvuUnTXh6yCOrQ7KZduZxgJP7sX2BbxOo+ytBH5+KMnw7Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840037; a=rsa-sha256; cv=none; b=V4c5bExktYXUc7xruynm66HqgA1DzknmFIkbd+gnvZTcK5i8XPzr8UueAQ6do3kiO0aICG s1PXvEMG9KWi9PWOMakbCHGCTw8XwyEqhe6TqiK3vbKlYeZ2Qod6yBS/KvySGd7GWypq0G L6ijfXE6Z0F4ZrbjznbGFYM/d9DmkhXsYQaSUbwJNHhopmWXBD5kNWnoYgobVXTi7QOcza o2OBPeT51gGWCCjcG+ARt4qcMFyQtXfNj6WaS+px0EKRSsSimNzaKuutwGg38/I86/6EqW 8oaZzzpNl1LS8CF5lAzy+8tm0yKFG6wEp5Tsvwr7nGY9rzSXJHOLkwC7Dkbmhw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840037; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rIM2X2eK+dyFSsVWxLHoQsRXpk7SGOEeO5h39BHCSYU=; b=ULa57a/v6r0v6MTNvuVLfluCWjmKT3GpPz0Xkt6Q+oTYUFaw197paZvvqLZ/D+FshmDAdg g6yhZgRNDApFs89pq1n3NJv7VcIUTY4SiBg3+PGgJdFLARcyv/H2YbFzXLpyDtq9VnyLkr hCDcDi7A5ZH2JawtYKDCH7O9zYA5Md6fcHA0q/l9Z2JzTjL9p9xmWqr8m5tnr3/AURlAnN sqdpHtxJvseuKfsEHc6ogFy2w+IUDIrAIxHfZ/bsN/QCo5PVo6UKNIqWQ7eddlmvB+ubtD mDepJ2VJTZHlURzFBTXZx0Cfm4UEY0k6/+2kJkDpnQKNrGqiDETi73yu9cgVjA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKK58H9zsyl for ; Tue, 30 Jun 2026 17:20:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45d43 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:37 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 5272af920126 - releng/14.3 - posixshm: Fix handling of sendfile() with largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 5272af92012650787a4a3c2a403faa500adf7e89 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:37 +0000 Message-Id: <6a43fae5.45d43.39d91527@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=5272af92012650787a4a3c2a403faa500adf7e89 commit 5272af92012650787a4a3c2a403faa500adf7e89 Author: Mark Johnston AuthorDate: 2026-06-24 19:57:00 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:01 +0000 posixshm: Fix handling of sendfile() with largepage objects sendfile(2) can transmit POSIX shared memory objects. Typically it will look up and wire each page before sending it to a socket; once transmission is complete, the page is unwired and typically released back into the page queues. sendfile() has an advisory flag, SF_NOCACHE, which means, "try to free the page once transmission is complete." This is implemented in vm_page_release(), which expects to operate on managed pages. Pages belonging a largepage object are de-facto wired not explicitly so. Thus, vm_page_release() will unwire and, having found no additional references, free the page. Because mappings of largepage objects are unmanaged, userspace can still access the now freed page. Fix the problem by explicitly wiring largepage pages. Make the VM object destructor responsible for unwiring and freeing them. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49427 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57832 --- sys/kern/uipc_shm.c | 19 ++++++-- sys/vm/vm_page.c | 23 +++++----- tests/sys/posixshm/posixshm_test.c | 89 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 118 insertions(+), 13 deletions(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index b3dd7a91d473..6a8614aa7d8a 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -323,6 +323,7 @@ static void shm_largepage_phys_ctor(vm_object_t object, vm_prot_t prot, vm_ooffset_t foff, struct ucred *cred) { + object->flags |= OBJ_PG_DTOR; } static void @@ -330,11 +331,24 @@ shm_largepage_phys_dtor(vm_object_t object) { int psind; + VM_OBJECT_ASSERT_WLOCKED(object); + psind = object->un_pager.phys.data_val; if (psind != 0) { + vm_page_t m, mtmp; + bool removed __diagused; + +restart: + TAILQ_FOREACH_SAFE(m, &object->memq, listq, mtmp) { + if (!vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL)) { + goto restart; + } + removed = vm_page_remove(m); + KASSERT(!removed, ("%s: page %p not wired", __func__, m)); + vm_page_unwire(m, PQ_NONE); + } atomic_subtract_long(&count_largepages[psind], object->size / (pagesizes[psind] / PAGE_SIZE)); - vm_wire_sub(object->size); } else { KASSERT(object->size == 0, ("largepage phys obj %p not initialized bit size %#jx > 0", @@ -856,7 +870,7 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) if ((shmfd->shm_seals & F_SEAL_GROW) != 0) return (EPERM); - aflags = VM_ALLOC_NORMAL | VM_ALLOC_ZERO; + aflags = VM_ALLOC_NORMAL | VM_ALLOC_ZERO | VM_ALLOC_WIRED; if (shmfd->shm_lp_alloc_policy == SHM_LARGEPAGE_ALLOC_NOWAIT) aflags |= VM_ALLOC_WAITFAIL; try = 0; @@ -903,7 +917,6 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) object->size += OFF_TO_IDX(pagesizes[psind]); shmfd->shm_size += pagesizes[psind]; atomic_add_long(&count_largepages[psind], 1); - vm_wire_add(atop(pagesizes[psind])); } return (0); } diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c index 181429488c93..f20de33810bf 100644 --- a/sys/vm/vm_page.c +++ b/sys/vm/vm_page.c @@ -4077,6 +4077,9 @@ vm_page_unwire_managed(vm_page_t m, uint8_t nqueue, bool noreuse) { u_int old; + KASSERT(nqueue < PQ_COUNT, + ("vm_page_unwire: invalid queue %u request for page %p", + nqueue, m)); KASSERT((m->oflags & VPO_UNMANAGED) == 0, ("%s: page %p is unmanaged", __func__, m)); @@ -4135,17 +4138,15 @@ vm_page_unwire_managed(vm_page_t m, uint8_t nqueue, bool noreuse) void vm_page_unwire(vm_page_t m, uint8_t nqueue) { - - KASSERT(nqueue < PQ_COUNT, - ("vm_page_unwire: invalid queue %u request for page %p", - nqueue, m)); + KASSERT(nqueue < PQ_COUNT || nqueue == PQ_NONE, + ("%s: invalid queue %u request for page %p", __func__, nqueue, m)); if ((m->oflags & VPO_UNMANAGED) != 0) { if (vm_page_unwire_noq(m) && m->ref_count == 0) vm_page_free(m); - return; + } else { + vm_page_unwire_managed(m, nqueue, false); } - vm_page_unwire_managed(m, nqueue, false); } /* @@ -4319,13 +4320,15 @@ vm_page_release_toq(vm_page_t m, uint8_t nqueue, const bool noreuse) void vm_page_release(vm_page_t m, int flags) { - vm_object_t object; - - KASSERT((m->oflags & VPO_UNMANAGED) == 0, - ("vm_page_release: page %p is unmanaged", m)); + if ((m->oflags & VPO_UNMANAGED) != 0) { + vm_page_unwire(m, PQ_NONE); + return; + } if ((flags & VPR_TRYFREE) != 0) { for (;;) { + vm_object_t object; + object = atomic_load_ptr(&m->object); if (object == NULL) break; diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index c792a85de9e3..dccc5add12a9 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -34,6 +34,7 @@ #include #include #include +#include #include #include #include @@ -2151,6 +2152,93 @@ ATF_TC_BODY(largepage_reopen, tc) "close failed; errno=%d", errno); } +static unsigned char +largepage_sendfile_expected(size_t off) +{ + + return ((unsigned char)(off * 131 + (off >> 8))); +} + +ATF_TC_WITHOUT_HEAD(largepage_sendfile); +ATF_TC_BODY(largepage_sendfile, tc) +{ + static const int flags[] = { 0, SF_NOCACHE }; + char *addr; + off_t sbytes; + size_t ps[MAXPAGESIZES]; + int error, fd, pscnt, sd[2], status; + pid_t child; + + pscnt = pagesizes(ps); + + for (int i = 1; i < pscnt; i++) { + for (int fi = 0; fi < (int)nitems(flags); fi++) { + fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, + ps[i]); + addr = mmap(NULL, ps[i], PROT_READ | PROT_WRITE, + MAP_SHARED, fd, 0); + ATF_REQUIRE_MSG(addr != MAP_FAILED, + "mmap(%zu bytes) failed; error=%d", ps[i], errno); + + /* Fill with a verifiable pattern. */ + for (size_t j = 0; j < ps[i]; j++) + addr[j] = largepage_sendfile_expected(j); + + ATF_REQUIRE(socketpair(PF_LOCAL, SOCK_STREAM, 0, + sd) == 0); + + child = fork(); + ATF_REQUIRE_MSG(child != -1, + "fork() failed; error=%d", errno); + if (child == 0) { + char buf[BUFSIZ]; + ssize_t len; + size_t off, resid; + + (void)close(sd[0]); + off = 0; + for (resid = ps[i]; resid > 0; resid -= len) { + len = read(sd[1], buf, sizeof(buf)); + if (len <= 0) + _exit(1); + for (ssize_t k = 0; k < len; k++) { + if ((unsigned char)buf[k] != + largepage_sendfile_expected( + off + k)) + _exit(2); + } + off += len; + } + _exit(0); + } + ATF_REQUIRE(close(sd[1]) == 0); + + sbytes = 0; + error = sendfile(fd, sd[0], 0, ps[i], NULL, &sbytes, + flags[fi]); + ATF_REQUIRE_MSG(error == 0, + "sendfile() failed; error=%d flags=%#x", + errno, flags[fi]); + ATF_REQUIRE_MSG(sbytes == (off_t)ps[i], + "sendfile() short; sbytes=%jd expected=%zu flags=%#x", + (intmax_t)sbytes, ps[i], flags[fi]); + + ATF_REQUIRE(close(sd[0]) == 0); + + ATF_REQUIRE_MSG(waitpid(child, &status, 0) == child, + "waitpid() failed; error=%d", errno); + ATF_REQUIRE_MSG(WIFEXITED(status), + "child killed by signal %d", WTERMSIG(status)); + ATF_REQUIRE_MSG(WEXITSTATUS(status) == 0, + "child exited with status %d (flags=%#x)", + WEXITSTATUS(status), flags[fi]); + + ATF_REQUIRE(munmap(addr, ps[i]) == 0); + ATF_REQUIRE(close(fd) == 0); + } + } +} + ATF_TC_WITHOUT_HEAD(largepage_truncate); ATF_TC_BODY(largepage_truncate, tc) { @@ -2239,6 +2327,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, largepage_pkru); #endif ATF_TP_ADD_TC(tp, largepage_reopen); + ATF_TP_ADD_TC(tp, largepage_sendfile); ATF_TP_ADD_TC(tp, largepage_truncate); return (atf_no_error()); From nobody Tue Jun 30 17:20:39 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKN3qJGz6jY9x for ; Tue, 30 Jun 2026 17:20:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKN0LGxz3qX7 for ; Tue, 30 Jun 2026 17:20:40 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840040; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wzfISqwffxiUxhDUfV5JnQltv5nwJAeAmY+vtfcWjyU=; b=ZzaDm43TtU1cfuxg3wX9yFWoU7+R4Pu5HtNwECtqb0G67fSqH9bHkTnuus7NWAgYMnAIFz Lj9TfQxMptOGHJGdkL/O9bJyXFhdoxlvkC14JJk7Kg5JZXI2bMuTBN/HDQyYZSXjo0taAC OGSdpFm4zegoXFLQVn7gx+tNW3x4/L2ooqBKmvoTlcgnPT4Fl+xHpWMkiDGPg7y+W0V9NZ j86nhmgzEXoHa+VLXHmqakgyCiZFRJdmCTBdXsoxfgv8AN4GDMhzKC0jWpVByVWoykYYnq Qd24aRHQn2HLYIaBDsX51bUQFQzrge3/UDt4S70UyCVxsEL/KUhzoztJ8MAwuQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840040; a=rsa-sha256; cv=none; b=kbLyiOfz11PePfYs2avxisLMOC/w/8vhiCsL/jn+6bdcO4VHSlHa6c0XBaHWfb2NTbBT0C 4VRB5cV3VQuA/Z1mHj1Kzwz5rUfmuXPrQmZhkPbLkgKWL3sjCbTZJRK7EAiniQ63QAZy4d WtwNWSB6eWxiwkOO13pYmAUVeMT2aC8eL84FKjAiuxq6II8WlGGVbcFHpA76Wipi+dz3nQ q+DGR0D1SlQ1j+MIQDoUxJxvhSa1GaaqfmMGtY+oL4qbMXolHJTmLifoaUbLApC1kfFmh1 Hbz46JWPkiSzrr1aNeuuGjKbsFVr29VN+nE9ZzuKUy85dO27HcHDysd55uXOWw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840040; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wzfISqwffxiUxhDUfV5JnQltv5nwJAeAmY+vtfcWjyU=; b=sPxDxJURaW5WtbROUcdlfxeVNoYLkA3QHR5HcBk9ZbT1dsxBh3oPqoyUydQ1b/AP13vHoh FumBUfXKm1CCCywKWFfog8SaIc+6vC0lMrwFpjSROybigrKO7TU+vhg56NbhVl4Wz+Yp1X OT5rRDoVzvf6S5ZDy9Gg0zErmfMMwgcqLb0ElVEZxkulgWPv8EhV8Na2vvPtrqPWRhyrOA 9q4Hc/jymPKhm7Ea8suJE31psBH5vpQhX4iP9ahFKfnX/NmiIfy4CNE39PBewnTiZogH0q u4nOn92vReOvXgCVZZubIC4/Fd5bKUKVcrThtOJzvalPHLsBr9aDBwJf1PUExA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKM6WmcztVM for ; Tue, 30 Jun 2026 17:20:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44f61 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:39 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: John Baldwin From: Mark Johnston Subject: git: f769a69b2da3 - releng/14.3 - ktls CBC decrypt: Only increment iovec index when an entry is used List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: f769a69b2da3850d320431605fecf9c4910dac9b Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:39 +0000 Message-Id: <6a43fae7.44f61.2c3e5a79@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=f769a69b2da3850d320431605fecf9c4910dac9b commit f769a69b2da3850d320431605fecf9c4910dac9b Author: John Baldwin AuthorDate: 2026-06-24 01:14:11 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:02 +0000 ktls CBC decrypt: Only increment iovec index when an entry is used If an mbuf in the chain was skipped because it only contained bytes from the header, the iovec index ('i') was incremented even though the entry was not populated. Only increment 'i' when an iovec entry is consumed. Add a new type of KTLS receive test which writes a single TLS record via two separate write(2) calls over a TCP_NODELAY socket to trigger a split in the mbuf chain in the kernel. Test various split locations including after the "plain" TLS header (5 bytes), after the full TLS header, in the middle of the data payload, just before the start of the trailer, and in the middle of the trailer. These tests are also run against all supported ciphers, not just CBC. The 'header' test for CBC ciphersuites was able to trigger the bug. Approved by: so Security: FreeBSD-SA-26:46.ktls Security: CVE-2026-49423 Sponsored by: Chelsio Communications --- sys/opencrypto/ktls_ocf.c | 3 +- tests/sys/kern/ktls_test.c | 110 ++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 110 insertions(+), 3 deletions(-) diff --git a/sys/opencrypto/ktls_ocf.c b/sys/opencrypto/ktls_ocf.c index f61fb7f73b5d..3c8b2e4f4589 100644 --- a/sys/opencrypto/ktls_ocf.c +++ b/sys/opencrypto/ktls_ocf.c @@ -503,13 +503,14 @@ ktls_ocf_tls_cbc_decrypt(struct ktls_session *tls, iov[0].iov_base = &ad; iov[0].iov_len = sizeof(ad); skip = sizeof(*hdr) + AES_BLOCK_LEN; - for (i = 1, n = m; n != NULL; i++, n = n->m_next) { + for (i = 1, n = m; n != NULL; n = n->m_next) { if (n->m_len < skip) { skip -= n->m_len; continue; } iov[i].iov_base = mtod(n, char *) + skip; iov[i].iov_len = n->m_len - skip; + i++; skip = 0; } uio.uio_iov = iov; diff --git a/tests/sys/kern/ktls_test.c b/tests/sys/kern/ktls_test.c index 3970083e7f72..7003b86fb4e2 100644 --- a/tests/sys/kern/ktls_test.c +++ b/tests/sys/kern/ktls_test.c @@ -303,6 +303,15 @@ fd_set_blocking(int fd) ATF_REQUIRE(fcntl(fd, F_SETFL, flags) != -1); } +static void +tcp_nodelay(int fd) +{ + int nodelay = 1; + + ATF_REQUIRE(setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &nodelay, + sizeof(nodelay)) == 0); +} + static bool cbc_crypt(const EVP_CIPHER *cipher, const char *key, const char *iv, const char *input, char *output, size_t size, int enc) @@ -1920,6 +1929,55 @@ test_ktls_receive_bad_size(const atf_tc_t *tc, struct tls_enable *en, close_sockets_ignore_errors(sockets); } +static void +test_ktls_receive_split_record(const atf_tc_t *tc, struct tls_enable *en, + uint64_t seqno, size_t len, size_t first_len) +{ + char *plaintext, *received, *outbuf; + size_t outbuf_cap, outbuf_len; + ssize_t rv; + int sockets[2]; + + ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); + + plaintext = alloc_buffer(len); + received = malloc(len); + outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); + outbuf = malloc(outbuf_cap); + + ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); + + ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, + sizeof(*en)) == 0); + check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); + + fd_set_blocking(sockets[0]); + fd_set_blocking(sockets[1]); + + outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, + plaintext, len, outbuf, outbuf_cap, 0); + ATF_REQUIRE(first_len < outbuf_len); + + tcp_nodelay(sockets[1]); + rv = write(sockets[1], outbuf, first_len); + ATF_REQUIRE_INTEQ((ssize_t)(first_len), rv); + + rv = write(sockets[1], outbuf + first_len, outbuf_len - first_len); + ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len - first_len), rv); + + rv = ktls_receive_tls_record(en, sockets[0], TLS_RLTYPE_APP, received, + len); + ATF_REQUIRE_INTEQ((ssize_t)len, rv); + + ATF_REQUIRE(memcmp(plaintext, received, len) == 0); + + free(outbuf); + free(received); + free(plaintext); + + close_sockets(sockets); +} + #define TLS_10_TESTS(M) \ M(aes128_cbc_1_0_sha1, CRYPTO_AES_CBC, 128 / 8, \ CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO) \ @@ -2360,6 +2418,26 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ auth_alg, minor, name) \ ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name); +#define GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, name, len, first_len) \ +ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_split_##name); \ +ATF_TC_BODY(ktls_receive_##cipher_name##_split_##name, tc) \ +{ \ + struct tls_enable en; \ + uint64_t seqno; \ + \ + ATF_REQUIRE_KTLS(); \ + seqno = random(); \ + build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ + seqno, &en); \ + test_ktls_receive_split_record(tc, &en, seqno, len, first_len); \ + free_tls_enable(&en); \ +} + +#define ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, name) \ + ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_split_##name); + #define GEN_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ minor) \ GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ @@ -2381,7 +2459,22 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ tls_minimum_record_payload(&en) - 1) \ GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ auth_alg, minor, oversized_record, \ - TLS_MAX_MSG_SIZE_V10_2 * 2) + TLS_MAX_MSG_SIZE_V10_2 * 2) \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, header, 64, \ + sizeof(struct tls_record_layer)); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, full_header, 64, \ + tls_header_len(&en)); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, half, 64, \ + tls_header_len(&en) + 32); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_start, 64, \ + tls_header_len(&en) + 64); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_middle, 64, \ + tls_header_len(&en) + 64 + tls_trailer_len(&en) / 2); #define ADD_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ minor) \ @@ -2402,7 +2495,17 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ auth_alg, minor, small_record) \ ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ - auth_alg, minor, oversized_record) + auth_alg, minor, oversized_record) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, header) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, full_header) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, half) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_start) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_middle) \ /* * For each supported cipher suite, run several receive tests: @@ -2425,6 +2528,9 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ * size * * - a test with an oversized TLS record + * + * - tests of a single record whose data is split across two writes, + * with each test using a different split point */ AES_CBC_NONZERO_TESTS(GEN_RECEIVE_TESTS); AES_GCM_TESTS(GEN_RECEIVE_TESTS); From nobody Tue Jun 30 17:20:38 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKN2lJ5z6jYDM for ; Tue, 30 Jun 2026 17:20:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKM04chz3qfY for ; Tue, 30 Jun 2026 17:20:39 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840039; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mCOkVAfHRSduh33P4XaNamdNff4zc/f6QE/q/eThZWE=; b=HLNCQw49oCGn6xnQZTTVM1Mv6yMKrBSBcPMaF7WjtnzFs0jFlnqz4T/5NeFs2gyF/7R9OW aWJZhZr+B/XPL4wQEMHGeRzdaRfsYK7ShDI7m167pBrkN3rF7kIz4DZmCIfamjIUeOmhHD BlFRSIOVVTMapC+OStwBkRvhOpk8t7wTuqrRTMvSY1BOrxyR55cXWZGXQR6D6hG0gtZOSH 5OGTAHgUk8o2en+GB3/ZdnA5Q2IuUYLEjqp/MzXdnGSjas4I3cC1RK1xkk+hqJsOGQbF98 4jFZPbZbRSgNDHPu5GbWjKikRzwjkMuXNAEXbBaNSoohcnk70dt0NX7KnAcvEw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840039; a=rsa-sha256; cv=none; b=LN4fXR0I2+gS7GpCo4Vt/nShCNaxCMNoShCuECApR2mc3ywAsT5SwBVGNrvwrE2xddDRuy dDtZU1cVK0pnN70Z6VTGsQaVxXzyxmiXX1n0D8WE14iv7YB9iBv7QLK4x5A6kd1g52l8Sx aaNdOYCtl6nv8cyyghcyX0UsA+PbMGn+1A5dIRiiBuasonkPYDqzMdH0S6BUmsGUW1kEak yLTadwGA8W1+tSpkF2k41Ipmj24S4UYgj0qvPsEwVZ0SnnQfD7k1MYTBk/tBgXXHecfz2i jNmVZcVfxFstS9bhWdrV7OhMU2BC6a4Aq8BemSuGlsv8E20bCv2FnIUueDwqiw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840039; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mCOkVAfHRSduh33P4XaNamdNff4zc/f6QE/q/eThZWE=; b=YmIPnI7PKHefL0yh9JEev5C9iwKJ++2X+UttVmVubsd8YZ/9Go+vYpZneBMGDNHtt/EMcI Pdw09Ca570c6l3HkV9pci5Lpyeq2jFnRbswhMfa9Y/MJyp3Y5NjRd/A23C5DD9jvNlUGZk lhCxaRSWm6RUj4FfiguMjaDvyRnspWJp4ZmrfpwTpJvdqlPCX+Jly8YYS+CPGJaXDFgiNh H75VIgNutbs5ZCYI0k485iDeqpGLHbZiAMfvM5a8sddEQTgQNIj0Zg6OeUpZUtSoXEKRJv QU5hqdyKQD1TaX0D5EAhBXOXz79ydTzcxuDW8OGA6+a3nhzkcWuntHbOFGywKA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKL602TztRp for ; Tue, 30 Jun 2026 17:20:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45c37 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:38 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Kyle Evans From: Mark Johnston Subject: git: 8b11e7df3a62 - releng/14.3 - kern: fix auditing of ptrace(2) syscall requests List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 8b11e7df3a62de6469d6d265d3e68b59763d82f4 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:38 +0000 Message-Id: <6a43fae6.45c37.50d915a@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8b11e7df3a62de6469d6d265d3e68b59763d82f4 commit 8b11e7df3a62de6469d6d265d3e68b59763d82f4 Author: Kyle Evans AuthorDate: 2026-06-25 17:02:47 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:02 +0000 kern: fix auditing of ptrace(2) syscall requests `error` here is the return value of syscall_thread_enter() rather than the syscall itself, so the committed audit records do not reflect reality. This is less harmful than them recording an error when the operation actually succeeded, but it could still possibly be used to throw off IDS techniques with things like bsmtrace. Approved by: so Security: FreeBSD-SA-26:45.audit Security: CVE-2026-49426 Reviewed by: des, kib, markj, csjp Differential Revision: https://reviews.freebsd.org/D57847 --- sys/kern/kern_sig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c index eda533d73522..41bedf2c1972 100644 --- a/sys/kern/kern_sig.c +++ b/sys/kern/kern_sig.c @@ -2764,7 +2764,7 @@ ptrace_syscallreq(struct thread *td, struct proc *p, td->td_errno = nerror; if (audited) - AUDIT_SYSCALL_EXIT(error, td); + AUDIT_SYSCALL_EXIT(tsr->ts_ret.sr_error, td); if (!sy_thr_static) syscall_thread_exit(td, se); } From nobody Tue Jun 30 17:20:42 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKQ51Plz6jY72 for ; Tue, 30 Jun 2026 17:20:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKQ1pwdz3qrf for ; Tue, 30 Jun 2026 17:20:42 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840042; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=y7NuTa8f6/DkfviBXaJWo6WFLkoXTEcU3cHAH/xVqEw=; b=dWLK0/6FqZ84RaFgz7A5BD5Y0CU6AlxrT06G+56dScdJ5dZFWfzMQwrQuxzWORpzdSDM5i Xtq8Gyl/bBRthJtZNdNJxfJcEQT91OWKFmRxdrdmzniNUTu+imtVWn0FL/kzLKoahi4Xhk Iaw8tOMYZ5U9OiFRK9XkP1OXha2TUIY6vZVKNs1gM6ajVIHF3O5ir9SaESbiE9X3bsvXEA ab1ZUTag6fBfayanQFdHfpr96RdDztbY1vInl2t5K5sDLB+XbpZc9mNXsNtoadLXbp/obx SELOhti0h+0odTIBjv6EIAyu9km0HmljeXKA+kAa6cmvgHEb43c3Qf9dj34Hsw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840042; a=rsa-sha256; cv=none; b=K1HzFs6mScyTQ35ah8agXLUhBrgzQCQYsVQHKc2gRv+vtetfVrHnCe1FM9Bq9tSw/cEIB9 FWqGWq94oYj8dpveW6MoB8guMprcabLKsW94wsNM/puT6dfYaTFXBYd/EdNhhO9uacZV7L uo+ydZimLWRbFPh3GIXcl1m7/g64s7qJLv/CEnWIYcsVXoPD8CQlBdrJlXhA/35HP3LlZ2 c5+hcrFKFMM71jZpSwHgpnDtv06RCEhY+i/DlyHWGtl/CPhHIht3K1O2nViqW7qk2Kf7zZ sOHhBcp1TAHxRGSssM74/hR+83vuBMaGu0h11uW1sqvSS8aHI6btBdhcrjkuoA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840042; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=y7NuTa8f6/DkfviBXaJWo6WFLkoXTEcU3cHAH/xVqEw=; b=iC+94OvHKJTHU/6aQP0W6hQptRIu+v/gU0h/+dTL/Qwrw1QivQOp6ZVb06ohf+M8zFO+yK Km6xJUcLZ6WIKDCa11awM2xZ8eu2yo20pTxSNcanDNVLvQWzWXZDK/tBVTIGdH8ixzrAIk viO0dRaHSWH6542fv5QDE9SOlkrCnDoLAeEVOip48eAZ3rgiQwvlWlrOVED/Zcy8Ni9Nmd e3QIvGf791BvHRE723bDDWNm1yY1VtIDwmeBb+xYstKSKP4uRnFKPlue1R+U28qWz0UJVC K1l1ZP6mjd9jxUYJpdIcYRPB4bKHFpoA6B+woD1H156so2hOFwqbFcQmdonARA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKQ0qjcztPV for ; Tue, 30 Jun 2026 17:20:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45648 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:42 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Ed Maste From: Mark Johnston Subject: git: 495ee4943cd5 - releng/14.3 - compat32: Zero struct to avoid stack disclosure List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 495ee4943cd52a03ac013624e71828447a83149b Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:42 +0000 Message-Id: <6a43faea.45648.2310e1f9@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=495ee4943cd52a03ac013624e71828447a83149b commit 495ee4943cd52a03ac013624e71828447a83149b Author: Ed Maste AuthorDate: 2026-03-11 15:02:18 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:02 +0000 compat32: Zero struct to avoid stack disclosure Approved by: so Security: FreeBSD-SA-26:48.compat32 Security: CVE-2026-49425 Reported by: Adam Crosser, Praetorian Reviewed by: philip Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D55811 (cherry picked from commit 097cb4e9f0432c543c704cec712ce1cd3302335c) (cherry picked from commit 4551ea3b3f04650cd5300a9eae8994bdb080db91) (cherry picked from commit 6a808cd7534802d30010fb0a7f46381ff9f6ef3f) --- sys/compat/freebsd32/freebsd32_misc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/compat/freebsd32/freebsd32_misc.c b/sys/compat/freebsd32/freebsd32_misc.c index 81715ed102b3..03ab5ea0f7c8 100644 --- a/sys/compat/freebsd32/freebsd32_misc.c +++ b/sys/compat/freebsd32/freebsd32_misc.c @@ -766,7 +766,7 @@ static int freebsd32_kevent_copyout(void *arg, struct kevent *kevp, int count) { struct freebsd32_kevent_args *uap; - struct kevent32 ks32[KQ_NEVENTS]; + struct kevent32 ks32[KQ_NEVENTS] = {}; int i, error; KASSERT(count <= KQ_NEVENTS, ("count (%d) > KQ_NEVENTS", count)); From nobody Tue Jun 30 17:20:41 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKP4JbGz6jYLx for ; Tue, 30 Jun 2026 17:20:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKP19Zsz3qrX for ; Tue, 30 Jun 2026 17:20:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840041; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5KZd/LKV5Ak+0r4Z7VvroQSiN2es/dFE7fWz3F/urI0=; b=ZN4EMVgiqaBRJCsCzZu2I2QgGDKoWzxn3nLn7mCfNQ/yCv4CCujsr+sbCcqzhCMVVnaX2d o321bbGnI2oM1BWyusgPMBpB5TTXVQ+daJyKIguAtn5TxrzfDnb20Y/3y5jprWFndaR/40 7hnNATrIfVKwuf/f5aCdt1Di833UTVFq+LIDpbVTvrAwFPAOLPcq0bbW6rfj0piQg0Oxaa 1bwdjWsaCgi66AjSliE5QmSx+5eZpD5Tcia3Qc4jGGIi8KAH/AMery8SqoOEh5N7dMqXzX V/hjOgrMvTP5la/EfiuiUhVhbGiWaYPQ1S3fI9rNf1iPL6bQlqOa3OU6YMyVjA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840041; a=rsa-sha256; cv=none; b=q0Q9CL07yOHipxkQSVdu3nMDak8lrJ+PINUzcedjWB8C60Y4xXCy3owMQoipKwpNhlc71K 5UUX2vWWURE1M8mXGdNGUiz9FrW96JRXQeGMpK5+5XI9kP4CHXGpDAzKYS+KISp17b/YRc Sh+XvL6tF01D9A7odDUSKKio6Cr1ekGt9tPzXmHY4xuVWkrvgHenrjqrk3sBnXuB+K/mls iMhstU7C+V1tOqY6cwwWF5LZUJtaRl36loY7Y31tMlDDe2RFCLkEplmM3Us+4oyqd42Kji T6+j9QNaPHEeysg0hPYdh5Y6AVntRiJbz70HaTETdsu9G0fAOClgEoBd4srRgQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840041; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5KZd/LKV5Ak+0r4Z7VvroQSiN2es/dFE7fWz3F/urI0=; b=Sn5Gb6pRW4Nqbol5+mOYeezRMiZYVJktpJPCBlGU5zN8GWjKQYvAqLUQqYEDtE6b5d2kkL 9ZLJr/LzrXyDzmMB67eqQQR/3Cyz07jrFcW0s9BLztP+JPftAZAVufwMsJ25lj6vaocq/h K5pcfcFqcKnfAnc4bVlH1+klwvIScuJAbZFhkLNnrQhFldTlH0b/LeAApgX2ZaE4LvlUNi gmrZKLwCYXMuYmnED7dGKUTq3qWhetVROHnHZ2Z6JeIml5kkDg7dVMR9A5zzva/Ap6EoHU haw+A7//1ot75JpUrCf6eWlG6Qo2LRfO7T+wpbJZGSbLNom6xwK/aYJ4XvgTcg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKP0CV9zsyq for ; Tue, 30 Jun 2026 17:20:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45c3c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:41 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Ed Maste From: Mark Johnston Subject: git: 6d0438693721 - releng/14.3 - compat/linux: Avoid waitid() kernel stack disclosure List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 6d0438693721739ae704c4463133c8c6d4a9ea2c Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:41 +0000 Message-Id: <6a43fae9.45c3c.25e75b01@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=6d0438693721739ae704c4463133c8c6d4a9ea2c commit 6d0438693721739ae704c4463133c8c6d4a9ea2c Author: Ed Maste AuthorDate: 2026-03-10 13:53:46 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:02 +0000 compat/linux: Avoid waitid() kernel stack disclosure Approved by: so Security: FreeBSD-SA-26:47.linux Security: CVE-2026-49424 Reported by: Adam Crosser, Praetorian Reviewed by: philip Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D55812 (cherry picked from commit 9a9f93bcf1aa0059d759b2f3ea6faeb2760a11bd) (cherry picked from commit 9f8db9cc67fb86eeb2b645ce7f8aa748e99241a9) (cherry picked from commit a347e6e20e75ad6224afefcf650ef738c3de094d) --- sys/compat/linux/linux_misc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c index 41977e5a899c..be47c15121a2 100644 --- a/sys/compat/linux/linux_misc.c +++ b/sys/compat/linux/linux_misc.c @@ -748,6 +748,7 @@ linux_common_wait(struct thread *td, idtype_t idtype, int id, int *statusp, error = linux_copyout_rusage(&wru.wru_self, rup); if (error == 0 && infop != NULL && td->td_retval[0] != 0) { sig = bsd_to_linux_signal(siginfo.si_signo); + memset(&lsi, 0, sizeof(lsi)); siginfo_to_lsiginfo(&siginfo, &lsi, sig); error = copyout(&lsi, infop, sizeof(lsi)); } From nobody Tue Jun 30 17:20:43 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKS1FzDz6jY79 for ; Tue, 30 Jun 2026 17:20:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKR2jt5z3r07 for ; Tue, 30 Jun 2026 17:20:43 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840043; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=geFZYhudT/w13lYp/8FBFW6vHaiCeu9tA+GYNhHBBsw=; b=JHIorrH2SOXpCGdom8HXoiGEVZ3n9R2iTBZPes6nVUXutVsqbZOg+rR76t+4EYoe9V++vs BxFItqKj8a1HAtBrWO97RMym4VodWxc3sScxwt1fUtjnMrKWO478fgwrCBfOfdNehY1qyw M2Dm4bYSvKNZ6fy4YCeSVgVwkp9MR3T/xM194eXmE2KBHhVFG0nskEwEoBgnWlJ+NuIURL H7Jijmj0wfYuqcdNdv+4GfAIT0TAv1jjd+92dovZBRbMdbiDtKPJCQsWW+KYKkn8IMoUdY wMuNKaqI0TOxlFc80+GHJcg4RuVTzG72FWAAFOuvLu1F8y91gB4GXUdUS/63qg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840043; a=rsa-sha256; cv=none; b=IllXxVe5cCBd8yT24+aq4bYp4FFCdxqEQe4BJn4LaZRhpllN/zxIDJJXwFpUl5SOfmMZEz i2yeSlBIr8SU0O7A2dxABAYg5ElTmvqJV1bbcUgEC9L8PI0Zyuqvem3sSbIIj2yCYVp/80 4o36R0lX+EeUl0gknTIvdmA6PUroW0ho+qi2DO+GfJh47pmAGnKKdHcURttf8yMA1cxFYL O1wFTbUSrg9spff6oL0QquaHDBjcpFznQnCHeoCut7GHGeJ/T8tInhQsuciKtyPCZJsSp8 a8LjMJ2H+qhNZd6mR/JHZq0YOsQ/GkAARXtaY+yVEt37gbTIx3ale4p08ITK/w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840043; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=geFZYhudT/w13lYp/8FBFW6vHaiCeu9tA+GYNhHBBsw=; b=Y7ulLo6mAVevFZe9oUSyVLskl9amAgdZPz4eOmIKY9BRqLA7484x4Mey+lax2t2who9169 YmZr6+VHCxU/oZL+HdAerbBMpr/mO9g7oBSSBoB3eP05eYnwXUyLpZdD1NxV/NamZR1abW tHIBQmLw6HYRkBCKAFGaAFAbaX9N1qjZMCiPtYZH6kBzK1/J2YqE23waqDbWnGOH/RTbb5 kbskD6IAcNLHIiRQsGQPfZmEOAQZS5A0e7E0/k7WDHTR2gtEWKV4I5BewxeHJ0qWIOG9st CcBO/SS2yeSx8DAwGUnTqyMjY6XgeJUt/SOlLSBwQSFK5088yMYouyqEfSh3jg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKR1JRVzsXr for ; Tue, 30 Jun 2026 17:20:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44753 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:43 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Taylor R Campbell From: Mark Johnston Subject: git: 2329d94e49d3 - releng/14.3 - iconv(3): Fix problems in various encodings List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 2329d94e49d3a2d6e4272513c4e6a794f82e6a20 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:43 +0000 Message-Id: <6a43faeb.44753.39707898@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=2329d94e49d3a2d6e4272513c4e6a794f82e6a20 commit 2329d94e49d3a2d6e4272513c4e6a794f82e6a20 Author: Taylor R Campbell AuthorDate: 2026-06-22 21:15:25 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:02 +0000 iconv(3): Fix problems in various encodings Fix null pointer dereference with HZ8 encoding. Fix output buffer overrun in UTF-7, VIQR, ZW encodings. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57947 --- lib/libiconv_modules/HZ/citrus_hz.c | 2 ++ lib/libiconv_modules/UTF7/citrus_utf7.c | 20 +++++++++++++++----- lib/libiconv_modules/VIQR/citrus_viqr.c | 6 +++++- lib/libiconv_modules/ZW/citrus_zw.c | 7 +++++-- 4 files changed, 27 insertions(+), 8 deletions(-) diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index f12938a7dab8..db738b8f812e 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -262,6 +262,8 @@ _citrus_HZ_mbrtowc_priv(_HZEncodingInfo * __restrict ei, tail = psenc->chlen = 0; continue; } + if (graphic == NULL) + break; } else if (ch & 0x80) { if (graphic != GR(psenc->inuse)) break; diff --git a/lib/libiconv_modules/UTF7/citrus_utf7.c b/lib/libiconv_modules/UTF7/citrus_utf7.c index f924366551f1..e7c6a0862c54 100644 --- a/lib/libiconv_modules/UTF7/citrus_utf7.c +++ b/lib/libiconv_modules/UTF7/citrus_utf7.c @@ -296,7 +296,7 @@ done: static int _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei, - char * __restrict s, size_t n __unused, uint16_t u16, + char * __restrict s, size_t n, uint16_t u16, _UTF7State * __restrict psenc, size_t * __restrict nresult) { int bits, i; @@ -336,6 +336,8 @@ _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei, psenc->ch[psenc->chlen++] = base64[i]; } } + if (n < (size_t)psenc->chlen) + return (E2BIG); memcpy(s, psenc->ch, psenc->chlen); *nresult = psenc->chlen; psenc->chlen = 0; @@ -352,6 +354,8 @@ _citrus_UTF7_wcrtomb_priv(_UTF7EncodingInfo * __restrict ei, uint16_t u16[2]; int err, i, len; size_t nr, siz; + char buf[8], *bufp = buf; + _UTF7State psenc_save = *psenc; u32 = (uint32_t)wchar; if (u32 <= UTF16_MAX) { @@ -367,14 +371,20 @@ _citrus_UTF7_wcrtomb_priv(_UTF7EncodingInfo * __restrict ei, return (EILSEQ); } siz = 0; + if (n > sizeof(buf)) + n = sizeof(buf); for (i = 0; i < len; ++i) { - err = _citrus_UTF7_utf16tomb(ei, s, n, u16[i], psenc, &nr); - if (err != 0) - return (err); /* XXX: state has been modified */ - s += nr; + err = _citrus_UTF7_utf16tomb(ei, bufp, n, u16[i], psenc, &nr); + if (err != 0) { + *nresult = (size_t)-1; + *psenc = psenc_save; /* restore state */ + return (err); + } + bufp += nr; n -= nr; siz += nr; } + memcpy(s, buf, siz); *nresult = siz; return (0); diff --git a/lib/libiconv_modules/VIQR/citrus_viqr.c b/lib/libiconv_modules/VIQR/citrus_viqr.c index 1747c0a1705e..c1e88f188aab 100644 --- a/lib/libiconv_modules/VIQR/citrus_viqr.c +++ b/lib/libiconv_modules/VIQR/citrus_viqr.c @@ -323,7 +323,11 @@ _citrus_VIQR_wcrtomb_priv(_VIQREncodingInfo * __restrict ei, int ch = 0; switch (psenc->chlen) { - case 0: case 1: + case 0: + break; + case 1: + if (n-- < 1) + goto e2big; break; default: return (EINVAL); diff --git a/lib/libiconv_modules/ZW/citrus_zw.c b/lib/libiconv_modules/ZW/citrus_zw.c index 93590e550952..c59064e65465 100644 --- a/lib/libiconv_modules/ZW/citrus_zw.c +++ b/lib/libiconv_modules/ZW/citrus_zw.c @@ -264,9 +264,12 @@ _citrus_ZW_wcrtomb_priv(_ZWEncodingInfo * __restrict ei __unused, ch = (unsigned char)wc; switch (psenc->charset) { case NONE: - if (ch == '\0' || ch == '\n') + if (ch == '\0' || ch == '\n') { + if (n < 1) + return (E2BIG); + n -= 1; psenc->ch[psenc->chlen++] = ch; - else { + } else { if (n < 4) return (E2BIG); n -= 4; From nobody Tue Jun 30 17:20:44 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKT39dzz6jYGD for ; Tue, 30 Jun 2026 17:20:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKS2vK9z3qgG for ; Tue, 30 Jun 2026 17:20:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840044; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=D/3vwXOtPLWBuGvK8JWgCl8aLUW+6dGWI5TCqrMwJl8=; b=w7VxecyL7ZZUx37+WwOyiA//0YCyJVaa8uTn+t7XrAOQm7TOZ9sbMjSs1uGuwct0PqX9se pfVJ6Qn8Tl6EyVvFU8XzhM1vIhJFRW0lRMu2k53o+Ahqh/3lPiRoFiR8PFFv7Xskx3119V AgZ3U08ftzww7v2wRkCqHS+LWFqG0MXTkfzzoWuoh+nCQNeTMND+txCjyPYMLVOl/pU9zS WAwb6sZ3fUCbe/LmnQE9/Hlkt3KFsVzvitVJld+LL+ouzrd+rBassmN9Z6HHwVtRnomcGF TBsMtqXriEZmHTR28xScWR+tqBxTbFbIKlacVsRaFNlYaG5u8OenMArDloRGaQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840044; a=rsa-sha256; cv=none; b=YuRKnFMZ0jLgYvUwqeevUU1bZPdtf6H9fotFRC8QYrH6u7JxqW78YkJaYFpDbsVWMRwOjq JXmo3P6GEK50aKPIIsZSaJ9Joo81SiFGNsy2IgPvW/L52i1XkdA7dukAYjK6bnnwqvsf1N MwZw9A3wOh6fRN6UF4U/E5OLyObuf33BtMAis6DOsTWZXqUg2GpUQ2CGgbEbIwUCoMJtb+ hH5BR2je1BoFf3cGiQo3yU2YAQ2XnpgnQm+5dd448lnv2K/NMMD5LyZ4x21sThowfOnWh2 gwwd3o4QvhjRkFutNgmblYxP5lB95gs67qHX+P8beJIjFynxuxUbhGygVNqSnA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840044; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=D/3vwXOtPLWBuGvK8JWgCl8aLUW+6dGWI5TCqrMwJl8=; b=RgUKJqtYyCZzS5XzpkBKxrOXBvOwKXpgx+eEzairdnLKBIfUhfXLYhD460pLQ3rTGCkaKD zFXy6haQL1QUEa0mupC8hAVu5oxrAQlqAkv88sYk9mLof2ZX+ouI1ZgiI5417nt3lS/LaC EV+SOzlhGxgMyk84fS9bQtnG24VlFfCnqRmw2kxvEB8+JEEcCVQGTu0FUNmZEoQeM5fl9y rRf6YFZlGT3NsH2vYvUcCrKjPjAu9FA3/QdsHZUMN9LgJDoDs1Z33wtk0/q7fD5PF1B0pf ZHD4P9LdDyVuHdc2c32547YJyhf/ijx3eUBrLim0OEPynaDhHLDRaOhCzCcNww== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKS1w98ztRv for ; Tue, 30 Jun 2026 17:20:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44ceb by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:44 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Taylor R Campbell From: Mark Johnston Subject: git: 01738cff0336 - releng/14.3 - iconv(3): Draft some automatic tests. List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 01738cff03367035e7c8a693e9e7aa0f21eace86 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:44 +0000 Message-Id: <6a43faec.44ceb.58fb43a2@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=01738cff03367035e7c8a693e9e7aa0f21eace86 commit 01738cff03367035e7c8a693e9e7aa0f21eace86 Author: Taylor R Campbell AuthorDate: 2026-06-22 19:44:55 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:02 +0000 iconv(3): Draft some automatic tests. Based on a report by Nick Wellnhofer. Approved by: so Security: FreeBSD-SA-26:49.iconv Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57948 --- contrib/netbsd-tests/lib/libc/locale/t_iconv.c | 355 +++++++++++++++++++++++++ lib/libc/tests/locale/Makefile | 1 + 2 files changed, 356 insertions(+) diff --git a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c new file mode 100644 index 000000000000..f25c061bb170 --- /dev/null +++ b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c @@ -0,0 +1,355 @@ +/* $NetBSD$ */ + +/*- + * Copyright (c) 2025 The NetBSD Foundation, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS + * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +/* + * iconv(3) + */ + +#include +__RCSID("$NetBSD: t_mbrtoc8.c,v 1.3 2024/08/20 17:43:09 riastradh Exp $"); + +#include +#include +#include +#include +#include +#include +#include + +#include "h_macros.h" + +static const struct sample { + const char *src_codeset; + size_t nsrc; + const char *src; + const char *dst_codeset; + size_t ndst; + const char *dst; + size_t ninval; + size_t ninval_rev; + const char *xfail; +#define IRREVERSIBLE ((size_t)-1) +} samples[] = { + [0] = { "us-ascii", 6, "hello", + "us-ascii", 6, "hello", + 0, 0, NULL }, + /* LATIN SMALL LETTER E WITH ACUTE ACCENT */ + [1] = { "iso-8859-1", 1, (const char[1]){0xe9}, + "UTF-8", 2, (const char[2]){0xc3,0xa9}, + 0, 0, NULL }, + /* LEFT CURLY BRACKET */ + [2] = { "UTF-8", 2, (const char[2]){0x00,0x7b}, + "ZW", 6, (const char[6]){0x00,0x7a,0x57,0x20,0x7b,0x0a}, + 0, 0, NULL }, + /* LATIN SMALL LETTER O, TILDE */ + [3] = { "UTF-8", 2, (const char[2]){0x4f,0x7e}, + "VIQR", 3, (const char[3]){0x4f,0x5c,0x7e}, + 0, 0, NULL }, + /* LEFT CURLY BRACKET (optionally encoded in UTF-7) */ + [4] = { "UTF-7", 1, (const char[1]){0x7b}, + "UTF-8", 1, (const char[1]){0x7b}, + 0, IRREVERSIBLE, NULL }, + [5] = { "UTF-7", 4, "+AHs-", + "UTF-8", 1, (const char[1]){0x7b}, + 0, 0, NULL }, + /* éclair */ + [6] = { "UTF-7", 10, "+AOk-clair", + "UTF-8", 7, (const char[7]){ + 0xc3,0xa9,0x63,0x6c,0x61,0x69,0x72, + }, + 0, 0, NULL }, + [7] = { "HZ", 55, /* RFC 1843, Sec. 4, Example 1 */ + "The next sentence is in GB.~{<:Ky2;S{#,NpJ)l6HK!#~}Bye.", + "UTF-8", 61, (const char[61]) { + 0x54,0x68,0x65,0x20, 0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e, 0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73, 0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0xe5, 0xb7,0xb1,0xe6,0x89, + 0x80,0xe4,0xb8,0x8d, 0xe6,0xac,0xb2,0xef, + 0xbc,0x8c,0xe5,0x8b, 0xbf,0xe6,0x96,0xbd, + 0xe6,0x96,0xbc,0xe4, 0xba,0xba,0xe3,0x80, + 0x82,0x42,0x79,0x65, 0x2e + }, + 0, 0, NULL }, + /* Same as above but with HZ8 instead of HZ. */ + [8] = { "HZ8", 55, (const char[55]) { + 0x54,0x68,0x65,0x20,0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e,0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73,0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0x7e,0x7b,0xbc,0xba,0xcb, + 0xf9,0xb2,0xbb,0xd3,0xfb,0xa3,0xac,0xce, + 0xf0,0xca,0xa9,0xec,0xb6,0xc8,0xcb,0xa1, + 0xa3,0x7e,0x7d,0x42,0x79,0x65,0x2e + }, + "UTF-8", 61, (const char[61]) { + 0x54,0x68,0x65,0x20, 0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e, 0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73, 0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0xe5, 0xb7,0xb1,0xe6,0x89, + 0x80,0xe4,0xb8,0x8d, 0xe6,0xac,0xb2,0xef, + 0xbc,0x8c,0xe5,0x8b, 0xbf,0xe6,0x96,0xbd, + 0xe6,0x96,0xbc,0xe4, 0xba,0xba,0xe3,0x80, + 0x82,0x42,0x79,0x65, 0x2e + }, + 0, 0, NULL }, +}; + +#ifdef MIN +#undef MIN +#endif +#define MIN(x, y) ((x) < (y) ? (x) : (y)) + +static void +test_sample_bounded(const char *title, const struct sample *S, + size_t nsrc, size_t ndst) +{ + char inbuf[4096], inguard = arc4random(); + char outbuf[4096], outguard = arc4random(); + iconv_t C; + char *src0, *src, *dst0, *dst; + size_t srcleft0, srcleft, dstleft0, dstleft; + size_t ninval; + int error; + + ATF_REQUIRE_MSG(S->nsrc < sizeof(inbuf) - 2, "[%s]", title); + ATF_REQUIRE_MSG(S->ndst < sizeof(outbuf) - 2, "[%s]", title); + + memset(inbuf, inguard, sizeof(inbuf)); + memset(outbuf, outguard, sizeof(outbuf)); + src = src0 = inbuf + 1; + memcpy(src, S->src, nsrc); + dst = dst0 = outbuf + 1; + srcleft = srcleft0 = nsrc; + dstleft = dstleft0 = ndst; + + C = iconv_open(S->dst_codeset, S->src_codeset); + if (C == (iconv_t)-1) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv_open: %s (%d)", title, + strerror(error), error); + return; + } + + ninval = iconv(C, &src, &srcleft, &dst, &dstleft); + if (ninval == (size_t)-1) { + error = errno; + /* + * Incomplete input manifests as EINVAL -- ignore that, + * unless we're trying the full-size input. + * + * Truncated output manifests as E2BIG -- ignore that, + * unless we're trying the full-size output. + */ + if ((error != EINVAL || nsrc == S->nsrc) && + (error != E2BIG || ndst == S->ndst)) { + atf_tc_fail_nonfatal("[%s] iconv: %s (%d)", + title, strerror(error), error); + goto next; + } + } else if (ninval != S->ninval) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv:" + " %zu invalid, expected %zu", + title, ninval, S->ninval); + } + + ATF_CHECK_MSG(src0 <= src && src <= src0 + srcleft0, "[%s] iconv:" + " src went from %p to %p, expected [%p,%p]", + title, src0, src, src0, src0 + srcleft0); + ATF_CHECK_MSG(srcleft <= srcleft0, "[%s] iconv:" + " srcleft went from %zu to %zu", + title, srcleft0, srcleft); + ATF_CHECK_MSG(dst0 <= dst && dst <= dst0 + dstleft0, "[%s] iconv:" + " dst went from %p to %p, expected [%p,%p]", + title, dst0, dst, dst0, dst0 + dstleft0); + ATF_CHECK_MSG(dstleft <= dstleft0, "[%s] iconv:" + " dstleft went from %zu to %zu", + title, dstleft0, dstleft); + if (memcmp(dst0, S->dst, MIN(ndst, dstleft0 - dstleft)) != 0) { + size_t k; + + atf_tc_fail_nonfatal("[%s] iconv: bad conv", title); + fprintf(stderr, "[%s] input: ", title); + for (k = 0; k < nsrc; k++) + fprintf(stderr, " %02x", (unsigned char)S->src[k]); + fprintf(stderr, "\n"); + fprintf(stderr, "[%s] expected: ", title); + for (k = 0; k < ndst; k++) + fprintf(stderr, " %02x", (unsigned char)S->dst[k]); + fprintf(stderr, "\n"); + fprintf(stderr, "[%s] got: ", title); + for (k = 0; k < ndst; k++) + fprintf(stderr, " %02x", (unsigned char)dst0[k]); + fprintf(stderr, "\n"); + } + +next: if (dst0[-1] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran before buffer:" + " dst0[-1] = 0x%02x, expected 0x%02x", + title, dst0[-1], outguard); + } + if (dst0[ndst] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran after buffer:" + " dst0[ndst=%zu] = 0x%02x, expected 0x%02x", + title, ndst, dst0[ndst], outguard); + } + if (dst[0] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran past updated dst:" + " dst[0] = 0x%02x, expected 0x%02x", + title, dst[0], outguard); + } + + if (iconv_close(C) == -1) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv_close: %s (%d)", + title, strerror(error), error); + } +} + +static void +test_sample(const char *title, const struct sample *S) +{ + char buf[128]; + size_t nsrc, ndst; + + fprintf(stderr, "test %s from %s to %s\n", + title, S->src_codeset, S->dst_codeset); + + for (nsrc = 0; nsrc <= S->nsrc; nsrc++) { + snprintf(buf, sizeof(buf), "%s %zu/%zu", title, nsrc, S->ndst); + test_sample_bounded(buf, S, nsrc, S->ndst); + } + + for (ndst = 0; ndst <= S->ndst; ndst++) { + snprintf(buf, sizeof(buf), "%s %zu/%zu", title, S->nsrc, ndst); + test_sample_bounded(buf, S, S->nsrc, ndst); + } +} + +ATF_TC(iconv_samples); +ATF_TC_HEAD(iconv_samples, tc) +{ + + atf_tc_set_md_var(tc, "descr", "Test iconv on various fixed samples"); +} +ATF_TC_BODY(iconv_samples, tc) +{ + unsigned i; + + for (i = 0; i < __arraycount(samples); i++) { + const struct sample *S = &samples[i]; + struct sample reverse = { + .src_codeset = S->dst_codeset, + .dst_codeset = S->src_codeset, + .nsrc = S->ndst, + .src = S->dst, + .ndst = S->nsrc, + .dst = S->src, + .ninval = S->ninval_rev, + }; + char buf[128]; + + if (S->xfail) + atf_tc_expect_fail("%s", S->xfail); + + snprintf(buf, sizeof(buf), "case %u: %s to %s", i, + S->src_codeset, S->dst_codeset); + test_sample(buf, S); + if (S->ninval_rev != IRREVERSIBLE) { + snprintf(buf, sizeof(buf), "case %u: %s to %s", i, + S->dst_codeset, S->src_codeset); + test_sample(buf, &reverse); + } + + if (S->xfail) + atf_tc_expect_pass(); + } +} + +ATF_TC(iconv_pr59019_hz8); +ATF_TC_HEAD(iconv_pr59019_hz8, tc) +{ + + atf_tc_set_md_var(tc, "descr", "Truncated HZ8 input from PR 59019"); +} +ATF_TC_BODY(iconv_pr59019_hz8, tc) +{ + const char title[] = "iconv_pr59019_hz8"; + char in[4] = "\x7e\x7b\x7e\x7e"; /* ~{~~ */ + char out[4096], guard = arc4random(); + char *src0, *src, *dst0, *dst; + size_t srcleft0, srcleft, dstleft0, dstleft; + iconv_t C; + size_t ninval; + + memset(out, guard, sizeof(out)); + + REQUIRE_LIBC((C = iconv_open(/*to*/"UTF-8", /*from*/"HZ8")), + (iconv_t)-1); + + src = src0 = in; + srcleft = srcleft0 = sizeof(in); + dst = dst0 = out + 1; + dstleft = dstleft0 = sizeof(out) - 2; + + ninval = iconv(C, &src, &srcleft, &dst, &dstleft); + + /* + * XXX Not actually 100% sure this is the correct result -- I + * can't find a reference for the HZ8 encoding. + */ + ATF_CHECK_EQ_MSG(ninval, (size_t)-1, "[%s] iconv: ninval=%zu", title, + ninval); + + ATF_CHECK_MSG(src0 <= src && src <= src0 + srcleft0, "[%s] iconv:" + " src went from %p to %p, expected [%p,%p)", + title, src0, src, src0, src0 + srcleft0); + ATF_CHECK_MSG(srcleft <= srcleft0, "[%s] iconv:" + " srcleft went from %zu to %zu", + title, srcleft0, srcleft); + ATF_CHECK_MSG(dst0 <= dst && dst <= dst0 + dstleft0, "[%s] iconv:" + " dst went from %p to %p, expected [%p,%p)", + title, dst0, dst, dst0, dst0 + dstleft0); + ATF_CHECK_MSG(dstleft <= dstleft0, "[%s] iconv:" + " dstleft went from %zu to %zu", + title, dstleft0, dstleft); + + ATF_CHECK_EQ(dst0[-1], guard); + ATF_CHECK_EQ(dst0[dstleft0], guard); + + RL(iconv_close(C)); +} + +ATF_TP_ADD_TCS(tp) +{ + + ATF_TP_ADD_TC(tp, iconv_pr59019_hz8); + ATF_TP_ADD_TC(tp, iconv_samples); + + return atf_no_error(); +} diff --git a/lib/libc/tests/locale/Makefile b/lib/libc/tests/locale/Makefile index 03e89571aacd..62af569a1100 100644 --- a/lib/libc/tests/locale/Makefile +++ b/lib/libc/tests/locale/Makefile @@ -22,6 +22,7 @@ ATF_TESTS_C+= wctomb_2_test # Note: io_test requires zh_TW.Big5 locale (see ^/head@r315568) #NETBSD_ATF_TESTS_C= io_test +NETBSD_ATF_TESTS_C+= iconv_test NETBSD_ATF_TESTS_C+= mbrtowc_test NETBSD_ATF_TESTS_C+= mbstowcs_test NETBSD_ATF_TESTS_C+= mbsnrtowcs_test From nobody Tue Jun 30 17:20:45 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKT6NCXz6jYB9 for ; Tue, 30 Jun 2026 17:20:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKT3dRrz3r0T for ; Tue, 30 Jun 2026 17:20:45 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840045; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4O+NChnA+3P7wtnf8UlKFMUvi4sKMEjik6aF+4DfPLQ=; b=ZqgSxLjqJDKNA/LeOnMXxnDSgxhhT9+zLqGWl4xrz9/RHWITh6BfKxscId3ZoFK9WZfaL0 lsTH8a9ib/OPNncelY4zGAYKdmApzJk8StUreINGDYsGPxE/hnT/P0pcFkKSvfr+fncsV5 dEU+UhZpoxUdrEcSJmlD6mtyP2w0bOPwN546RYQsdL+OGe8+pKif6Hzq1sizv8esMCgzRX uHpfCJX2yBFsYU2LEUI0ZyS3SUoy2oRIRqkPdNQBnl1Q8E8DNJu0VtDQYR4DAp7e+UHnsa jJZXgUkk69IVZl045wX6jppwCVzxAxT/0ukc/CivEUCL2T6DNxHnGNw7QcF+IQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840045; a=rsa-sha256; cv=none; b=v7MRJuzaXDu+MvFlG2X/s/a7DHgnlnWNp2N/IsldDupvagfvccWjGUJQorF39TxgOrFzy7 yBQLZa9c5l++Gk/i8kyklKeFNlBEx21nLyaKv5BraJtu/4yrNLADkDGqFGggTLJRZ2CNXH CAAMW43KG4dytdPf5NFTNjXatP5qfT3sMbVJw/Vm+/LQfOwkgH5TANdTctdUQkxwgCpFbd 34SDQvNLVGYGtiazS/ju0a3PPyiq7MkXBHZHDsDjSLyFoekpTigVWmt31ukL+b/w4Npo+0 KC1mfOckT2DtEENuEJasiUERmmGaRnfaL9+4tDARovlI/LOW07+lte0f/HMaOA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840045; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4O+NChnA+3P7wtnf8UlKFMUvi4sKMEjik6aF+4DfPLQ=; b=ZiJvXgysSrufAqStEZDLuf3oYlWcQgfOhmC9elHundZtGtQ/0SXbBzuc9Q+k+wh5CIDk+3 dNhuN3vl9vGujQvRp5PNcuAMpjx6AcmKe5izLcbZiyTvGi5Er6sjwYu1EBooKaaWIj3z5d oVGkrZd8Va/4tWpfLCdWAYx11eJQxqOKoNHg3GotEEypplRqwrVbV7yv+1AtUb8tyj3Kdb 88Pc0rgF6iP628JddGnVLxpOU0bVYDThrZ/ai9OGum+tr+xQ9b2pPSXYLAkedqsfP1g/xc Yu8OCc+yNfHTFf82uZbd6Tfd8tnpk1G1QgIQ7RCNUwIAQbXgIH2SBfepYszlMA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKT2KFNztBH for ; Tue, 30 Jun 2026 17:20:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 444e8 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:45 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 0b49a3af873d - releng/14.3 - iconv: Fix a buffer overflow in the HZ encoding List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 0b49a3af873dd062538e806722348ef02dd20dac Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:45 +0000 Message-Id: <6a43faed.444e8.577b65da@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=0b49a3af873dd062538e806722348ef02dd20dac commit 0b49a3af873dd062538e806722348ef02dd20dac Author: Mark Johnston AuthorDate: 2026-06-23 16:05:31 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:02 +0000 iconv: Fix a buffer overflow in the HZ encoding wcrtomb may store up to 2 2-byte escape sequences to the state buffer in addition to the character itself. In the worst case, a 3-byte heap overflow is possible. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57949 --- lib/libiconv_modules/HZ/citrus_hz.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index db738b8f812e..e16ab3a8e34c 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -132,7 +132,7 @@ typedef struct { typedef struct { escape_t *inuse; int chlen; - char ch[ROWCOL_MAX]; + char ch[4 + ROWCOL_MAX]; } _HZState; #define _CEI_TO_EI(_cei_) (&(_cei_)->ei) From nobody Tue Jun 30 17:20:47 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKX0s7Bz6jY2T for ; Tue, 30 Jun 2026 17:20:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKW4ygPz3qm9 for ; Tue, 30 Jun 2026 17:20:47 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840047; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wqKndIFWGPLhjNByxpl4JT+0j8/p8Gbzlny5Ep/TkMQ=; b=r6/0vxSqJKZjaVA+lwvl4leqoClRdYB/7+S28HeD2Rd/fomZoNygxGGOSlRO1BPUQIDGv+ JR8krvZkZF3Ea4m1uhzlO3kRwmkuIoaDJpZ9Lfx1N0hIsZb7MhKf4qBWRDfW2wg5M3LFDY lQtI0wpi8sTcMX3NhMv410mDQOjmszdgg36FddCsoEOX2gIXtM1MIQjURLTp9bWPsNXYfb M1Y7n7Vkb1N7KRv3awW55TW1h/M279Lhjtj7qhE72kJotUis5iQrxToHa4uLcpwN4qBAqP aMkEc+I8M7JCTYcl51k3xyO4BxznZJ11OovLpLK55y7SCipdy7RzvBxsQxrQww== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840047; a=rsa-sha256; cv=none; b=xkKKWsUEyY0vr1QV9udEGIur/gVLAl+Hx2p7+KY5bFPqPBR/6C3A9jchAqSOHIiGHioDVZ HcuCq7pqIFFhvCUeVFAv2SPw7DzVq3xMATf3OEIidLrZ1k3Dk8X2LOUrxiUoO6Y3CUGPIS x4jIudPykyXjIsk55ywe2p8AM2RLZHJlxwD12gT3nw73iC6kRcF2/3uYYXpcBloEVArJTC Z9dh0pJN1n+XIA8IZBc8qtpUmNRlaYAplXVeoJ5IHx2ktNT6kD3ILd++tutAgC4YR6UDBa 4kD7kYiJup6Y9TiyLgrMS+6WVqZxF5o9qrQzyk/108ENvRdeOCWPmvcIFCmq3Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840047; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wqKndIFWGPLhjNByxpl4JT+0j8/p8Gbzlny5Ep/TkMQ=; b=kgp7fWDcASQUV93Uq6lE2TiSIZb/5R8dbyqAqH2PRsiAYccxJG3O70XjqiflOheFufLZ85 u28dEE7zkWUfB+/TMoSmXxzEOiogDvb3VP2Sr5VkNjtFDHclu7WScqMrYTk18QKyU5Fgd2 BwLsQ/omzcb0UB0/FO89GK/ebwS17XxHKaoxK96S3qYeQzjWqGLAQBRFnfehxtqwCWBfiJ kEm+iO8JsLsgp84hE4znYBDZS4jpwdTJI5Z1+1rYrWnC3N5OODt98KmYgtQOqmgf6qOeoG Opip1Lqb82LeK4JTcD8Pk4U6bNgOtOCdTlKJeMB8aTFDvG+2DgWGdphhlbRt4Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKW3hrvzsyt for ; Tue, 30 Jun 2026 17:20:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45896 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:47 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 833d39bd2e38 - releng/14.3 - Add UPDATING entries and bump version List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 833d39bd2e38421a14ea489a956261a0fa993fbc Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:47 +0000 Message-Id: <6a43faef.45896.33887711@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=833d39bd2e38421a14ea489a956261a0fa993fbc commit 833d39bd2e38421a14ea489a956261a0fa993fbc Author: Mark Johnston AuthorDate: 2026-06-26 21:43:23 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:02 +0000 Add UPDATING entries and bump version Approved by: so --- UPDATING | 39 +++++++++++++++++++++++++++++++++++++++ sys/conf/newvers.sh | 2 +- 2 files changed, 40 insertions(+), 1 deletion(-) diff --git a/UPDATING b/UPDATING index 54f8fba0e6a2..3f06714fa011 100644 --- a/UPDATING +++ b/UPDATING @@ -12,6 +12,45 @@ Items affecting the ports and packages system can be found in /usr/ports/UPDATING. Please read that file before updating system packages and/or ports. +20260630: + 14.3-RELEASE-p16 EN-26:16.arm64 + SA-26:37.vm + SA-26:39.execve + SA-26:40.zfs + SA-26:41.libalias + SA-26:42.unlinkat + SA-26:43.tcp + SA-26:44.posixshm + SA-26:45.audit + SA-26:46.ktls + SA-26:47.linux + SA-26:48.compat32 + SA-26:49.iconv + + 32-bit setcontext(2) and swapcontext(2) fail on arm64. [EN-26:16.arm64] + + Use-after-free in device pager page list. [SA-26:37.vm] + + Local privilege escalation via execve(2) TOCTOU race. [SA-26:39.execve] + + Multiple vulnerabilities in OpenZFS. [SA-26:40.zfs] + + Buffer overflow in libalias RTSP handler. [SA-26:41.libalias] + + unlinkat(2) ignores AT_RESOLVE_BENEATH flag. [SA-26:42.unlinkat] + + Use-after-free in TCP RACK stack option handler. [SA-26:43.tcp] + + Incorrect audit records for ptrace(2) syscall requests. [SA-26:45.audit] + + Remote DOS via uninitialized memory access in KTLS receive. [SA-26:46.ktls] + + Kernel stack disclosure in Linux compatibility layer. [SA-26:47.linux] + + Kernel stack disclosure in 32-bit compatibility support. [SA-26:48.compat32] + + Multiple vulnerabilities in iconv(3). [SA-26:49.iconv] + 20260609: 14.3-RELEASE-p15 EN-26:15.openssl SA-26:25.thr diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index 0617bc4d8e1a..97f7cf58628d 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -53,7 +53,7 @@ TYPE="FreeBSD" REVISION="14.3" -BRANCH="RELEASE-p15" +BRANCH="RELEASE-p16" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi From nobody Tue Jun 30 17:20:46 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKW3C6fz6jYJZ for ; Tue, 30 Jun 2026 17:20:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKV4gHhz3r2b for ; Tue, 30 Jun 2026 17:20:46 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840046; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=m4/xDV1vjMn7ErPd3nA01vQL+cbX+ubNWnMhUuAaPqo=; b=JKP+u7dMNMieB7kOFcChpwuJzXloHAXZhDk9yazImD345TdeajkaTshfUpVV2XUS8aVDgs yUq7egD4V4VqRaAX3KJo8/51l+kqmr+p2rjN+aoyFrnTvZkVmniPowi97x9aV2sHsKWMGu SqBP3PXpTEAJZc8FdPrppaO6e+cUKtxrTJgFXpU9f1ApfLkQ7jrOUAmBVB661DW00WX3Jo BixU9WLJIlEW0gE9kFU/3Xv3sLnw4smlag7DYs+91W9o61JXzE8HLUKUdqg3y3RhL2pkm5 NsNxh9QWg0MYUBhlmLNxhWp0kVu+EZklONLB/lwEi3jMlf1NkYlSL2xCJnzDiQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840046; a=rsa-sha256; cv=none; b=prL1bubJ1oi++vnC7eAKfl9OoYSJzir+Zh0Fgre/WBcmkhZxQKlj1kSu1sa9d1gG/JFSGI RqZo098kC7vzUQE1Of7UU6coegZS+yKRkS//qaW/lLeOLiWNMgONDKNVD42qkVyKmMIeqj E1SUmhoptsYNr/vGcfD+2NBsgdISHbjxDgX3Wy/6QWF/jgJffXSTT+ssGl6ftA6EvejHmD GPHU9RUu5gO70aROSYnZaZSjQUr2CeUbMZJCWyx/9cI6HH48SEeVc8f7h6Xqj7q1p5NRUK i5GOoTV9VxI+YExGfEMVbO1uc1f67SDEICdV+GKsnNOuYr0B2UgjGs9J/I+uHg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840046; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=m4/xDV1vjMn7ErPd3nA01vQL+cbX+ubNWnMhUuAaPqo=; b=APwpMGPBWN0SucCP5nAf3WCsp2C/iO/lPHX6zhD3LyxYpAlATgDvd7wcKFYPscEhXXSP8L 4vNKoHeqTHHnPz4sG7Y7beBDs0J214eOZtJFstHB5q2soy1Kd38d3TsGMuP2Bh/oGw2ly0 D5f/cOlq5Ldz7jMiuWObNAcHsjEJT0FziHIH8RdBGyCo6j153zie6ya/LNWPj2IXXJiq04 TaU9+OTzOjZMCDJX3VICSUcUNkfWpqJHinzUSONti3vB38mScUx183vRf9lMkMlXbFjpkT mMsOGoXUuNHxY6TgeC628SjjaQGmB2YYSA/uQ+pyqQq1sMcuh/y+pOuu1333kA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKV2wWDztXd for ; Tue, 30 Jun 2026 17:20:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 444ec by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:46 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 32f296b69571 - releng/14.3 - iconv: Fix a stack buffer overflow in _ISO2022_sputwchar() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 32f296b695717b7b76ad2e2e950c5718274c48d6 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:46 +0000 Message-Id: <6a43faee.444ec.346b493@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=32f296b695717b7b76ad2e2e950c5718274c48d6 commit 32f296b695717b7b76ad2e2e950c5718274c48d6 Author: Mark Johnston AuthorDate: 2026-06-23 17:45:28 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:02 +0000 iconv: Fix a stack buffer overflow in _ISO2022_sputwchar() In the ISO2022-CN encoding, characters may require at least seven bytes, and MB_LEN_MAX==6 is insufficient. From code inspection, _ISO2022_sputwchar() can emit 10 bytes in the worst case, so use that to size buffers. Add a regression test. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58082 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57950 --- contrib/netbsd-tests/lib/libc/locale/t_iconv.c | 20 ++++++++++++++++++++ lib/libiconv_modules/ISO2022/citrus_iso2022.c | 8 ++++---- 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c index f25c061bb170..199774769827 100644 --- a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c +++ b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c @@ -117,6 +117,26 @@ static const struct sample { 0x82,0x42,0x79,0x65, 0x2e }, 0, 0, NULL }, + /* 馬 from CNS 11643-1 */ + [9] = { "UTF-8", 3, (const char[3]){0xe9,0xa6,0xac}, + "ISO-2022-CN", 8, + (const char[8]){0x1b,0x24,0x29,0x47,0x0e,0x58,0x6b,0x0f}, + 0, 0, NULL }, + /* 馬毦 shifting from CNS 11643-1 to CNS 11643-2 */ + [10] = { "UTF-8", 6, (const char[6]){0xe9,0xa6,0xac,0xe6,0xaf,0xa6}, + "ISO-2022-CN", 16, + (const char[16]){ + /* ESC $ ) G (shift G1 to CNS 11643 plane 1) */ + 0x1b,0x24,0x29,0x47, + 0x0e, /* GL is G1 from now on */ + 0x58,0x6b, /* 馬 */ + /* ESC $ * H (shift G2 to CNS 11643 plane 2) */ + 0x1b,0x24,0x2a,0x48, + 0x1b,0x4e, /* GL is G2 for next char */ + 0x30,0x21, /* 毦 */ + 0x0f, /* GL is G0 from now on */ + }, + 0, 0, "PR lib/59019: various iconv issues ([case 10: ISO-2022-CN to UTF-8 14/6] iconv: Illegal byte sequence (85))" }, }; #ifdef MIN diff --git a/lib/libiconv_modules/ISO2022/citrus_iso2022.c b/lib/libiconv_modules/ISO2022/citrus_iso2022.c index a311dbc26e59..b2de13d9d13a 100644 --- a/lib/libiconv_modules/ISO2022/citrus_iso2022.c +++ b/lib/libiconv_modules/ISO2022/citrus_iso2022.c @@ -130,7 +130,7 @@ typedef struct { #define _FUNCNAME(m) _citrus_ISO2022_##m #define _ENCODING_INFO _ISO2022EncodingInfo #define _ENCODING_STATE _ISO2022State -#define _ENCODING_MB_CUR_MAX(_ei_) MB_LEN_MAX +#define _ENCODING_MB_CUR_MAX(_ei_) 10 #define _ENCODING_IS_STATE_DEPENDENT 1 #define _STATE_NEEDS_EXPLICIT_INIT(_ps_) \ (!((_ps_)->flags & _ISO2022STATE_FLAG_INITIALIZED)) @@ -1013,7 +1013,7 @@ _ISO2022_sputwchar(_ISO2022EncodingInfo * __restrict ei, wchar_t wc, { _ISO2022Charset cs; char *p; - char tmp[MB_LEN_MAX]; + char tmp[10]; size_t len; int bit8, i = 0, target; unsigned char mask; @@ -1178,7 +1178,7 @@ _citrus_ISO2022_put_state_reset(_ISO2022EncodingInfo * __restrict ei, size_t * __restrict nresult) { char *result; - char buf[MB_LEN_MAX]; + char buf[10]; size_t len; int ret; @@ -1207,7 +1207,7 @@ _citrus_ISO2022_wcrtomb_priv(_ISO2022EncodingInfo * __restrict ei, _ISO2022State * __restrict psenc, size_t * __restrict nresult) { char *result; - char buf[MB_LEN_MAX]; + char buf[10]; size_t len; int ret; From nobody Tue Jun 30 17:20:53 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKf2QWTz6jYBN for ; Tue, 30 Jun 2026 17:20:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKd1fsPz3r1b for ; Tue, 30 Jun 2026 17:20:53 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840053; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YIA0D4D5bKfiFHK9idqyS/4Cnl8WdmRvaz2X3q3Asv4=; b=EJmD6wwcmr4oL5iHYhAWXsIxU4w0wH68G+F0TPsnXLZrPa31Wtcvrd7NBQ45TOJTBmFGob hB4kCXXVW6li8Z08y3mEvOZGpk+EGl+5kbgroowkMA2vU6LynJM5LfTEucnaJrt0LCzr+c uEpKpvUZ8uyEaq1ON354lYopoWEtPdUjwvch3hNVXeL2rQ9tfRmHGBzs5ggYzGxIr6AhLy XFUO//4AV7K3Mka6OLyMZS6yd7BBrRT2kovqyQSvVDHY0w19Mdf/wfPtF5xLAPXlZ4cZ6w YiRiFOuoj33DhHALjpZw6T093XVSA2zAST2S/uNF+FalcIRVMuzJv+ihZzxe/Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840053; a=rsa-sha256; cv=none; b=EKYNCktnpPR6FD7bEPhrGHcIZm5IYN/aff/5KqZert+loMcbJLHelEc3lmt23ahfyqAT7U L2lfIlbuFdyKC2fxnUXwld4em6Sdaa9fcgBe0ayLN5nzNKqXTnNlQsdJgu/XSy+uqpRdBJ 6vrLrXR5ux9OGispFcUsq8pOFiS+gPfz868ANL344U07S4gEP3vid8pUxGrsr0JGjGED2N MGDmjFHEor+Vp3dhgBwg/q3S/dcw91EyA1QmaiLH8b/mCQ3PTOPdgtgG65LcLYyJfTmsXo i/ELn6DJR/X79YrujGD278yKmqQXlwcjSWg5stmK37QoWzw2MBDn1cZzPuC5Jw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840053; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YIA0D4D5bKfiFHK9idqyS/4Cnl8WdmRvaz2X3q3Asv4=; b=YIhfsohbGVdymYQ6dmrX1nC7Y+1qQv2/OG1EcNsbAY2Ggw39p1f8K7vuzGdHj4E5z7pkJV N0Zeyb9931k/3dB479KzMXjSu/UtJ6M2ynrGTSW2FItkpITh7g9osTBBsLOA/8St1BT+98 4oNqhBRNB/Z3UVmNOBEjVTd8GkaUvHCLlxqy8FPEBbvYhbOtffCR6cEYJuTXySgnF8ULYj NiIalhsQhmIFQijExjjk3nSjqXMi4kEp8v2MWcVs8j7yg5tm4DexP5kFnH1cjPhTZtboAn bufzXI+1H7F0BAjis6/bCloz8LmNNY4zvoQ/0mXvnW2ob4JvoIB9o9OM1lxj+w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKd0kgpztPY for ; Tue, 30 Jun 2026 17:20:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45e11 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:53 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Piotr Kubaj From: Mark Johnston Subject: git: f902821db095 - releng/14.4 - sys/arm64: fix return values of freebsd32_{set,swap}context() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: f902821db0950cffaa76bbd1fe31294a0f2bba94 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:53 +0000 Message-Id: <6a43faf5.45e11.52fdfac@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=f902821db0950cffaa76bbd1fe31294a0f2bba94 commit f902821db0950cffaa76bbd1fe31294a0f2bba94 Author: Piotr Kubaj AuthorDate: 2026-06-11 11:41:29 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:18 +0000 sys/arm64: fix return values of freebsd32_{set,swap}context() This patch aligns the return values of freebsd32_{set,swap}context() with their counterparts on amd64 and powerpc64, fixing the setcontext() and swapcontext() calls in armv7 applications running on aarch64. In particular, this fixes random crashes in armv7 Ruby applications running on aarch64 hosts. Approved by: so Security: FreeBSD-EN-26:16.arm64 Tested by: fuz MFC after: 1 week (cherry picked from commit 92ae21e8a155734f73589b7ef9fa19a6bb6d042f) (cherry picked from commit 58a15fe75cc59a73016f00069f2dad001d798edf) --- sys/arm64/arm64/freebsd32_machdep.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/arm64/arm64/freebsd32_machdep.c b/sys/arm64/arm64/freebsd32_machdep.c index 1cf8403e0a0e..dc0e536c2bbc 100644 --- a/sys/arm64/arm64/freebsd32_machdep.c +++ b/sys/arm64/arm64/freebsd32_machdep.c @@ -292,7 +292,7 @@ freebsd32_setcontext(struct thread *td, struct freebsd32_setcontext_args *uap) NULL, 0); } } - return (ret); + return (ret == 0 ? EJUSTRETURN : ret); } int @@ -340,7 +340,7 @@ freebsd32_swapcontext(struct thread *td, struct freebsd32_swapcontext_args *uap) } } } - return (ret); + return (ret == 0 ? EJUSTRETURN : ret); } void From nobody Tue Jun 30 17:20:54 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKf5rHcz6jYBQ for ; Tue, 30 Jun 2026 17:20:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKf3twsz3rBH for ; Tue, 30 Jun 2026 17:20:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840054; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1qgxe6iNWgJyyficJHs/DrgmDNmJIknfevubqqroZ8k=; b=GNDitkHic7bhy27hiToamss3tUUfp6nI8KbeM977lWpb7Aspn+PX6DgXa9d6gzyoDHQ2uF McZKVHi7Bbdh5Ud4SThuOeEzvY/+uX7im5SpePlNPNW4sKNy2OF1epKIVQkEBMkYY8cAJV u1kQ+Vb4SnBQiB6WzkdydAFrsMykJxUvRnt4Oej75ZvDBI5RdPw5s+ihd9obsKfUqPQN8D 8725ykhmkbYGCi9m3OV7ALIPrI3wgBt8wVY4Vp289IKf9Bp3yNuflqEnJ56sXTMfLg0IpQ alN4vN8D2uMq9b45KCI8A1Wh6/mzaa5rwKVsHrl424TA2ZN2MfAr82syoMLptA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840054; a=rsa-sha256; cv=none; b=WclRYHp0KdBd1ViceNEUrEurwOL1IREeTP3XrkGT3tqSX6o6mE8sC8xoZYBpsY2oxjmVl2 dfPIxx3E+CclnoW9T+2oV8WDSqHQL/LAs4GHKItb1ie/fXKWPCZZ2QRJS0jgvZ8Wl9+B/f WRy2Ph2xsElWmfLLA7uLV8RgYBsp68jJaByAUb1SjlWZebkSeXW11upuYvnc+NlfxOTwYs w/clRl21njuGy6LPjzLwdWhyanGJ1WKopHtbyJ3LRVlVTx4YG+wLkhd7OiDitwe7snq4HG EhiYbkWeRtgUkMsI+AB8Idx4Tfq1JEUe+BIpTLmfb0zvUGSVff/LxWvhrbYwiA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840054; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1qgxe6iNWgJyyficJHs/DrgmDNmJIknfevubqqroZ8k=; b=P4aEjtqgcyK74wNTYnuhH/kSNmWlzKCXsBbQvFIWezwVYJcUXLf6Dh50NOFlGm9daqSD7W ktQC+6kyXvJdCWsGHmg/usdpE8Fqycr083vNZagxwCvWX+uq92y3B4kV3HGorf0vipQ3aE TK215Pm+C2/PDbQiqFpKczhjiwFR/Zcs/bLNjgmTHYlD0G2wQtoVRoqgB70TR60aYCsnty f1tMAy+NOpwJ3N7wUQHM6KCGJ50pMOyoiLWf0KPZ44eZCFvT0b5vdX2ZmYAgpUvfSjUmvY bn0Ak/4524qQ7eMiCH0t1HGvD/xDXlB9VljrxUBVhe9hQu9vlKSsGaIGt9D6Ew== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKf1bjDztXh for ; Tue, 30 Jun 2026 17:20:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 444f0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:54 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 4c9e89c85d7c - releng/14.4 - device_pager: Avoid double-insertion of pages into the pager list List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 4c9e89c85d7c6cf50b09865de4dacedd015c5f39 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:54 +0000 Message-Id: <6a43faf6.444f0.1cfb9040@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=4c9e89c85d7c6cf50b09865de4dacedd015c5f39 commit 4c9e89c85d7c6cf50b09865de4dacedd015c5f39 Author: Mark Johnston AuthorDate: 2026-06-22 14:40:22 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:29 +0000 device_pager: Avoid double-insertion of pages into the pager list Unmanaged device pager objects maintain a linked list of pages that were returned from the fault handler. Initially, such pages are valid, but msync(MS_INVALIDATE) can mark them invalid (and clean). They are not removed from page tables (since they are unmanaged), but a subsequent mlock() call can trigger a page fault that is handled by the pager. dev_pager_getpages() then re-inserts the page into the linked list even though it's already present there. This patch fixes the problem by removing the linked list. OBJ_PG_DTOR is set, so vm_object_terminate_pages() does nothing, and dev_pager_dealloc() instead handles cleanup of the object. Add a regression test case which triggers a queue.h assertion failure in unpatched kernels. Note, in stable branches we should avoid changing the layout of struct vm_object. Approved by: so Security: FreeBSD-SA-26:37.vm Security: CVE-2026-49418 Reported by: slidybat Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57743 --- sys/vm/device_pager.c | 34 +++++++++++++++++----------------- sys/vm/vm_object.h | 2 +- sys/vm/vm_page.c | 6 ++++-- tests/sys/vm/mmap_test.c | 30 ++++++++++++++++++++++++++++++ 4 files changed, 52 insertions(+), 20 deletions(-) diff --git a/sys/vm/device_pager.c b/sys/vm/device_pager.c index bceff38a41c3..b32d18fc3354 100644 --- a/sys/vm/device_pager.c +++ b/sys/vm/device_pager.c @@ -210,7 +210,8 @@ again: object1 = NULL; object->handle = handle; object->un_pager.devp.ops = ops; - TAILQ_INIT(&object->un_pager.devp.devp_pglist); + if (object->type == OBJT_DEVICE) + vm_object_set_flag(object, OBJ_PG_DTOR); TAILQ_INSERT_TAIL(&dev_pager_object_list, object, pager_object_list); mtx_unlock(&dev_pager_mtx); @@ -282,15 +283,12 @@ dev_pager_free_page(vm_object_t object, vm_page_t m) KASSERT((object->type == OBJT_DEVICE && (m->oflags & VPO_UNMANAGED) != 0), ("Managed device or page obj %p m %p", object, m)); - TAILQ_REMOVE(&object->un_pager.devp.devp_pglist, m, plinks.q); vm_page_putfake(m); } static void dev_pager_dealloc(vm_object_t object) { - vm_page_t m; - VM_OBJECT_WUNLOCK(object); object->un_pager.devp.ops->cdev_pg_dtor(object->un_pager.devp.handle); @@ -300,15 +298,21 @@ dev_pager_dealloc(vm_object_t object) VM_OBJECT_WLOCK(object); if (object->type == OBJT_DEVICE) { - /* - * Free up our fake pages. - */ - while ((m = TAILQ_FIRST(&object->un_pager.devp.devp_pglist)) - != NULL) { - if (vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL) == 0) - continue; - - dev_pager_free_page(object, m); + vm_page_t m, mtmp; + +restart: + TAILQ_FOREACH_SAFE(m, &object->memq, listq, mtmp) { + if (!vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL)) + goto restart; + if (vm_page_remove(m)) { + /* + * We could end up with invalid pages installed + * by the generic page fault handler. Typically + * these are replaced by the device pager. + */ + vm_page_free(m); + } else if ((m->flags & PG_FICTITIOUS) != 0) + dev_pager_free_page(object, m); } } object->handle = NULL; @@ -337,10 +341,6 @@ dev_pager_getpages(vm_object_t object, vm_page_t *ma, int count, int *rbehind, (object->type == OBJT_MGTDEVICE && (ma[0]->oflags & VPO_UNMANAGED) == 0), ("Wrong page type %p %p", ma[0], object)); - if (object->type == OBJT_DEVICE) { - TAILQ_INSERT_TAIL(&object->un_pager.devp.devp_pglist, - ma[0], plinks.q); - } if (rbehind) *rbehind = 0; if (rahead) diff --git a/sys/vm/vm_object.h b/sys/vm/vm_object.h index 9a3bba4ef396..75a44fb66be4 100644 --- a/sys/vm/vm_object.h +++ b/sys/vm/vm_object.h @@ -137,7 +137,7 @@ struct vm_object { * devp_pglist - list of allocated pages */ struct { - TAILQ_HEAD(, vm_page) devp_pglist; + void *spare[2]; const struct cdev_pager_ops *ops; void *handle; } devp; diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c index b23c44ae083d..178b104ab95f 100644 --- a/sys/vm/vm_page.c +++ b/sys/vm/vm_page.c @@ -1301,8 +1301,10 @@ vm_page_putfake(vm_page_t m) KASSERT((m->oflags & VPO_UNMANAGED) != 0, ("managed %p", m)); KASSERT((m->flags & PG_FICTITIOUS) != 0, ("vm_page_putfake: bad page %p", m)); - vm_page_assert_xbusied(m); - vm_page_busy_free(m); + if (m->object != NULL) { + vm_page_assert_xbusied(m); + vm_page_busy_free(m); + } uma_zfree(fakepg_zone, m); } diff --git a/tests/sys/vm/mmap_test.c b/tests/sys/vm/mmap_test.c index 6bc30f73ca95..a94fb56c46cf 100644 --- a/tests/sys/vm/mmap_test.c +++ b/tests/sys/vm/mmap_test.c @@ -362,6 +362,35 @@ ATF_TC_BODY(mmap__maxprot_shm, tc) ATF_REQUIRE(close(fd) == 0); } +/* A regression test for a bug in the device pager. */ +ATF_TC_WITHOUT_HEAD(mmap__device_reinsert); +ATF_TC_BODY(mmap__device_reinsert, tc) +{ + void *p; + int fd; + + fd = open("/dev/devstat", O_RDONLY); + ATF_REQUIRE(fd >= 0); + + p = mmap(NULL, getpagesize(), PROT_READ, MAP_SHARED, fd, 0); + ATF_REQUIRE(p != MAP_FAILED); + + /* + * Use mlock() to trigger a fault, since msync() will not actually + * remove the page from the process page tables. + */ + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + ATF_REQUIRE(msync(p, getpagesize(), MS_INVALIDATE) == 0); + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + ATF_REQUIRE(msync(p, getpagesize(), MS_INVALIDATE) == 0); + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + + ATF_REQUIRE(munmap(p, getpagesize()) == 0); +} + ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TC(tp, mmap__map_at_zero); @@ -371,6 +400,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, mmap__write_only); ATF_TP_ADD_TC(tp, mmap__maxprot_basic); ATF_TP_ADD_TC(tp, mmap__maxprot_shm); + ATF_TP_ADD_TC(tp, mmap__device_reinsert); return (atf_no_error()); } From nobody Tue Jun 30 17:20:56 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKj0XvCz6jYF3 for ; Tue, 30 Jun 2026 17:20:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKh4vp3z3qyC for ; Tue, 30 Jun 2026 17:20:56 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840056; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MmL2BJp4c5Rsd1zu1juzxS2W1/ip40d2W/f9T6AM49w=; b=s22Zd1qndVOjbxMkCwZDTkfGIulTjDmO6uj2VNmHwGCwzHu/fv+QbxgxrzPaaiIChORYUu c5YdDvOoiSsXOwj0g85ibb08PkvZWu1+c9mlMigWto/9EF9/+FR5y3btV+7eBpriPTwTlq +Qt+vAQjB15JS9Eu72iKULzUileOvMigAsdDC+JHGja8+o535Z9plrmJokwTXKXQfmyG1M 8fPx2dGx0XoHKONmvCoxYzT2CCYfozUqYkQd/wPzvUK670ssp9n8mZUm5pJ6B+jwP4JyTh cMX4bXXcaeGEA/Cww3WCiF3H6E6btqYlFXu8tV/GZ0wwYSGspzOEgPeANd54Kw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840056; a=rsa-sha256; cv=none; b=t5oxxhb/DiEKdnrH4vB1vDdsIgln7GF+ZGlpq3ojndckcWkqoc5w0b1NlC047L02lVLxr9 tUKQaPG+Zko7M8qTYIBOFm88/XnK5X39Vvx1tiFjfmC+9T4UGZ60gF/GBmBJLZybaZwpdv WDo7rQBbBA3cmoXOfkT+9xI8nXSRB3SVMm//kFDX5nE+atDyMfuQxAPae22gfH0ymLTi8c bZXR9RuuewI4tjrHy1T8wfdAlbJxX64Ba0rGAU6+56tGRb7iGMLMpQppIBRDxm7J2CdGIk rjO6nEytFip9tb89l7iYgZPDvN+UARSPyot0W7xiuFYvQfwH8o3D/eypAasZqQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840056; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MmL2BJp4c5Rsd1zu1juzxS2W1/ip40d2W/f9T6AM49w=; b=BFOdPH+Xv6ldIt5YEYNciYoP41A2dj7SG0TEJitgZpAazpbBLnINBJPEJshExBy5F5GKU0 Zfq25t2A2tBLNDgHUWGT8ttnFV4OdJaZuVCpJ1kN10K9CAmY3EOWwAdy5f8qkpxPgKCOKT vvC+v5OUvPGaaXB0k+pAmypDrEvgERViRhyn/Bm/DFwz9QNzfE//rk9BT9rSmYT2qOFBIL CVFPXUJLLFr9b8tHp2Cvxp3HgujZkUMkN/8L1pz98Y8fMwHjA4HSKUWTJ4xSbdnNQWQQ/a KHDZwo48e8xz8RhFBHbEluP5Ral7PrDP531BU3V4GTchM1vOY+9xzQRZCCQNEg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKh3ScjztS7 for ; Tue, 30 Jun 2026 17:20:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45720 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:56 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 62f64d81b50e - releng/14.4 - zfs: Roll up several upstream commits List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 62f64d81b50e56b7942a59786574cfb7905ea72d Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:56 +0000 Message-Id: <6a43faf8.45720.7bb4dc10@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=62f64d81b50e56b7942a59786574cfb7905ea72d commit 62f64d81b50e56b7942a59786574cfb7905ea72d Author: Mark Johnston AuthorDate: 2026-06-28 22:00:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:29 +0000 zfs: Roll up several upstream commits This commit squashes the following upstream commits: #18604 63a0ff6cd nvpair: Check for un-terminated strings in packed nvlist #18617 38cd6adcb Extend dataset zfs_ioc_set_prop() secpolicy #18615 738791027 Fix the integer type in zfs_ioc_userspace_many() #18623 06d8cfedb Add additional verification of size fields and strings Approved by: so Security: FreeBSD-SA-26:40.zfs Security: CVE-2026-49429 Security: CVE-2026-49430 Security: CVE-2026-49431 --- sys/contrib/openzfs/module/nvpair/nvpair.c | 49 ++++-- sys/contrib/openzfs/module/zfs/dmu_recv.c | 44 ++++-- sys/contrib/openzfs/module/zfs/vdev_label.c | 1 + sys/contrib/openzfs/module/zfs/zfs_ioctl.c | 34 +++- sys/contrib/openzfs/module/zfs/zfs_quota.c | 8 +- .../tests/zfs-tests/cmd/libzfs_input_check.c | 172 ++++++++++++++++++++- 6 files changed, 272 insertions(+), 36 deletions(-) diff --git a/sys/contrib/openzfs/module/nvpair/nvpair.c b/sys/contrib/openzfs/module/nvpair/nvpair.c index 887f7d32df4a..04141bb58111 100644 --- a/sys/contrib/openzfs/module/nvpair/nvpair.c +++ b/sys/contrib/openzfs/module/nvpair/nvpair.c @@ -134,7 +134,8 @@ #define NVP_SIZE_CALC(name_len, data_len) \ (NV_ALIGN((sizeof (nvpair_t)) + name_len) + NV_ALIGN(data_len)) -static int i_get_value_size(data_type_t type, const void *data, uint_t nelem); +static int i_get_value_size(data_type_t type, const void *data, uint_t nelem, + size_t max_size); static int nvlist_add_common(nvlist_t *nvl, const char *name, data_type_t type, uint_t nelem, const void *data); @@ -809,8 +810,10 @@ i_validate_nvpair(nvpair_t *nvp) * verify nvp_type, nvp_value_elem, and also possibly * verify string values and get the value size. */ - size2 = i_get_value_size(type, NVP_VALUE(nvp), NVP_NELEM(nvp)); size1 = nvp->nvp_size - NVP_VALOFF(nvp); + size2 = i_get_value_size(type, NVP_VALUE(nvp), NVP_NELEM(nvp), + size1); + if (size2 < 0 || size1 != NV_ALIGN(size2)) return (EFAULT); @@ -1001,12 +1004,21 @@ nvlist_remove_nvpair(nvlist_t *nvl, nvpair_t *nvp) * DATA_TYPE_STRING and * DATA_TYPE_STRING_ARRAY * Is data == NULL then the size of the string(s) is excluded. + * + * If 'max_size' is non-zero, then don't look beyond 'max_size' number of + * bytes when calculating a value size. Note that 'max_size' should include + * the NULL terminator byte when calculating string size. If 'max_size' is 0, + * it is ignored. */ static int -i_get_value_size(data_type_t type, const void *data, uint_t nelem) +i_get_value_size(data_type_t type, const void *data, uint_t nelem, + size_t max_size) { uint64_t value_sz; + if (max_size == 0) + max_size = INT32_MAX; + if (i_validate_type_nelem(type, nelem) != 0) return (-1); @@ -1051,10 +1063,15 @@ i_get_value_size(data_type_t type, const void *data, uint_t nelem) break; #endif case DATA_TYPE_STRING: - if (data == NULL) + if (data == NULL) { value_sz = 0; - else - value_sz = strlen(data) + 1; + } else { + value_sz = strnlen(data, max_size); + if (value_sz >= max_size) { + return (-1); /* string not terminated */ + } + value_sz += 1; + } break; case DATA_TYPE_BOOLEAN_ARRAY: value_sz = (uint64_t)nelem * sizeof (boolean_t); @@ -1088,16 +1105,23 @@ i_get_value_size(data_type_t type, const void *data, uint_t nelem) break; case DATA_TYPE_STRING_ARRAY: value_sz = (uint64_t)nelem * sizeof (uint64_t); - if (data != NULL) { char *const *strs = data; uint_t i; + size_t newsize; /* no alignment requirement for strings */ for (i = 0; i < nelem; i++) { if (strs[i] == NULL) return (-1); - value_sz += strlen(strs[i]) + 1; + + newsize = strnlen(strs[i], max_size); + + if (newsize == max_size) + return (-1); /* not terminated */ + + value_sz += newsize + 1; /* +1 for NULL */ + max_size -= newsize + 1; } } break; @@ -1162,7 +1186,7 @@ nvlist_add_common(nvlist_t *nvl, const char *name, * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) included. */ - if ((value_sz = i_get_value_size(type, data, nelem)) < 0) + if ((value_sz = i_get_value_size(type, data, nelem, 0)) < 0) return (EINVAL); if (i_validate_nvpair_value(type, nelem, data) != 0) @@ -1587,7 +1611,7 @@ nvpair_value_common(const nvpair_t *nvp, data_type_t type, uint_t *nelem, #endif if (data == NULL) return (EINVAL); - if ((value_sz = i_get_value_size(type, NULL, 1)) < 0) + if ((value_sz = i_get_value_size(type, NULL, 1, 0)) < 0) return (EINVAL); memcpy(data, NVP_VALUE(nvp), (size_t)value_sz); if (nelem != NULL) @@ -3017,7 +3041,8 @@ nvs_native_nvp_op(nvstream_t *nvs, nvpair_t *nvp) * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) excluded. */ - if ((value_sz = i_get_value_size(type, NULL, NVP_NELEM(nvp))) < 0) + if ((value_sz = i_get_value_size(type, NULL, NVP_NELEM(nvp), + NVP_SIZE(nvp))) < 0) return (EFAULT); if (NVP_SIZE_CALC(nvp->nvp_name_sz, value_sz) > nvp->nvp_size) @@ -3332,7 +3357,7 @@ nvs_xdr_nvp_op(nvstream_t *nvs, nvpair_t *nvp) * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) excluded. */ - if ((value_sz = i_get_value_size(type, NULL, nelem)) < 0) + if ((value_sz = i_get_value_size(type, NULL, nelem, NVP_SIZE(nvp)) < 0)) return (EFAULT); /* if there is no data to extract then return */ diff --git a/sys/contrib/openzfs/module/zfs/dmu_recv.c b/sys/contrib/openzfs/module/zfs/dmu_recv.c index 41b279d48464..cd8a491e81c8 100644 --- a/sys/contrib/openzfs/module/zfs/dmu_recv.c +++ b/sys/contrib/openzfs/module/zfs/dmu_recv.c @@ -2834,16 +2834,20 @@ receive_read_record(dmu_recv_cookie_t *drc) { struct drr_object *drro = &drc->drc_rrd->header.drr_u.drr_object; - uint32_t size = DRR_OBJECT_PAYLOAD_SIZE(drro); + uint32_t size; void *buf = NULL; dmu_object_info_t doi; + size = DRR_OBJECT_PAYLOAD_SIZE(drro); + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + if (size != 0) - buf = kmem_zalloc(size, KM_SLEEP); + buf = vmem_zalloc(size, KM_SLEEP); err = receive_read_payload_and_next_header(drc, size, buf); if (err != 0) { - kmem_free(buf, size); + vmem_free(buf, size); return (err); } err = dmu_object_info(drc->drc_os, drro->drr_object, &doi); @@ -2867,7 +2871,11 @@ receive_read_record(dmu_recv_cookie_t *drc) case DRR_WRITE: { struct drr_write *drrw = &drc->drc_rrd->header.drr_u.drr_write; - int size = DRR_WRITE_PAYLOAD_SIZE(drrw); + uint64_t size = DRR_WRITE_PAYLOAD_SIZE(drrw); + + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + abd_t *abd = abd_alloc_linear(size, B_FALSE); err = receive_read_payload_and_next_header(drc, size, abd_to_buf(abd)); @@ -2884,12 +2892,18 @@ receive_read_record(dmu_recv_cookie_t *drc) { struct drr_write_embedded *drrwe = &drc->drc_rrd->header.drr_u.drr_write_embedded; - uint32_t size = P2ROUNDUP(drrwe->drr_psize, 8); - void *buf = kmem_zalloc(size, KM_SLEEP); + uint32_t size; + void *buf; + + size = P2ROUNDUP(drrwe->drr_psize, 8); + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + + buf = vmem_zalloc(size, KM_SLEEP); err = receive_read_payload_and_next_header(drc, size, buf); if (err != 0) { - kmem_free(buf, size); + vmem_free(buf, size); return (err); } @@ -2918,7 +2932,11 @@ receive_read_record(dmu_recv_cookie_t *drc) case DRR_SPILL: { struct drr_spill *drrs = &drc->drc_rrd->header.drr_u.drr_spill; - int size = DRR_SPILL_PAYLOAD_SIZE(drrs); + uint64_t size = DRR_SPILL_PAYLOAD_SIZE(drrs); + + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + abd_t *abd = abd_alloc_linear(size, B_FALSE); err = receive_read_payload_and_next_header(drc, size, abd_to_buf(abd)); @@ -3069,7 +3087,7 @@ receive_process_record(struct receive_writer_arg *rwa, abd_free(rrd->abd); rrd->abd = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } return (0); @@ -3083,7 +3101,7 @@ receive_process_record(struct receive_writer_arg *rwa, rrd->abd = NULL; rrd->payload = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } @@ -3096,7 +3114,7 @@ receive_process_record(struct receive_writer_arg *rwa, { struct drr_object *drro = &rrd->header.drr_u.drr_object; err = receive_object(rwa, drro, rrd->payload); - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; break; } @@ -3134,7 +3152,7 @@ receive_process_record(struct receive_writer_arg *rwa, struct drr_write_embedded *drrwe = &rrd->header.drr_u.drr_write_embedded; err = receive_write_embedded(rwa, drrwe, rrd->payload); - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; break; } @@ -3203,7 +3221,7 @@ receive_writer_thread(void *arg) rrd->abd = NULL; rrd->payload = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } /* diff --git a/sys/contrib/openzfs/module/zfs/vdev_label.c b/sys/contrib/openzfs/module/zfs/vdev_label.c index a64cd1690684..ee10cc845ce5 100644 --- a/sys/contrib/openzfs/module/zfs/vdev_label.c +++ b/sys/contrib/openzfs/module/zfs/vdev_label.c @@ -1362,6 +1362,7 @@ vdev_label_read_bootenv(vdev_t *rvd, nvlist_t *bootenv) VB_NVLIST); break; } + vbe->vbe_bootenv[sizeof (vbe->vbe_bootenv) - 1] = '\0'; fnvlist_add_string(bootenv, FREEBSD_BOOTONCE, buf); } diff --git a/sys/contrib/openzfs/module/zfs/zfs_ioctl.c b/sys/contrib/openzfs/module/zfs/zfs_ioctl.c index 8f28687bb36b..121968bcdbb4 100644 --- a/sys/contrib/openzfs/module/zfs/zfs_ioctl.c +++ b/sys/contrib/openzfs/module/zfs/zfs_ioctl.c @@ -913,6 +913,23 @@ zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr) ZFS_DELEG_PERM_CREATE, cr)); } +/* + * Policy for dataset set property operations. Individual properties checked by + * zfs_check_settable(), additionally require zfs_secpolicy_recv() when setting + * properties as part of a receive. + */ +static int +zfs_secpolicy_setprops(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr) +{ + boolean_t received = zc->zc_cookie; + int error; + + if (received && (error = zfs_secpolicy_recv(zc, innvl, cr))) + return (error); + + return (zfs_secpolicy_read(zc, innvl, cr)); +} + int zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr) { @@ -3642,7 +3659,6 @@ static int zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl) { (void) unused, (void) outnvl; - const char *message; char *poolname; spa_t *spa; int error; @@ -3663,7 +3679,7 @@ zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl) if (error != 0) return (error); - message = fnvlist_lookup_string(innvl, "message"); + const char *message = fnvlist_lookup_string(innvl, "message"); if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) { spa_close(spa, FTAG); @@ -5994,21 +6010,27 @@ zfs_ioc_userspace_one(zfs_cmd_t *zc) * outputs: * zc_nvlist_dst[_size] data buffer (array of zfs_useracct_t) * zc_cookie zap cursor + * + * The zc_nvlist_dst output array is limited to 1000 entries. */ static int zfs_ioc_userspace_many(zfs_cmd_t *zc) { + const size_t batch_limit = 1000 * sizeof (zfs_useracct_t); + uint64_t bufsize = MIN(zc->zc_nvlist_dst_size, batch_limit); zfsvfs_t *zfsvfs; - int bufsize = zc->zc_nvlist_dst_size; - if (bufsize <= 0) + if (bufsize < sizeof (zfs_useracct_t)) { + zc->zc_nvlist_dst_size = sizeof (zfs_useracct_t); return (SET_ERROR(ENOMEM)); + } int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE); if (error != 0) return (error); void *buf = vmem_alloc(bufsize, KM_SLEEP); + zc->zc_nvlist_dst_size = bufsize; error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie, buf, &zc->zc_nvlist_dst_size); @@ -6499,7 +6521,7 @@ zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl) dsl_pool_t *dp; dsl_dataset_t *new, *old; const char *firstsnap; - uint64_t used, comp, uncomp; + uint64_t used = 0, comp = 0, uncomp = 0; firstsnap = fnvlist_lookup_string(innvl, "firstsnap"); @@ -7374,7 +7396,7 @@ zfs_ioctl_init(void) zfs_ioc_send, zfs_secpolicy_send); zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop, - zfs_secpolicy_none); + zfs_secpolicy_setprops); zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy, zfs_secpolicy_destroy); zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename, diff --git a/sys/contrib/openzfs/module/zfs/zfs_quota.c b/sys/contrib/openzfs/module/zfs/zfs_quota.c index 9b351eefc04e..c5ffd60609b2 100644 --- a/sys/contrib/openzfs/module/zfs/zfs_quota.c +++ b/sys/contrib/openzfs/module/zfs/zfs_quota.c @@ -85,10 +85,14 @@ zpl_get_file_info(dmu_object_type_t bonustype, const void *data, sa.sa_layout_info = BSWAP_16(sa.sa_layout_info); swap = B_TRUE; } - VERIFY3U(sa.sa_magic, ==, SA_MAGIC); + + if (unlikely(sa.sa_magic != SA_MAGIC)) + return (SET_ERROR(EINVAL)); int hdrsize = sa_hdrsize(&sa); - VERIFY3U(hdrsize, >=, sizeof (sa_hdr_phys_t)); + + if (unlikely(hdrsize < sizeof (sa_hdr_phys_t))) + return (SET_ERROR(EINVAL)); uintptr_t data_after_hdr = (uintptr_t)data + hdrsize; zoi->zfi_user = *((uint64_t *)(data_after_hdr + SA_UID_OFFSET)); diff --git a/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c b/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c index 7d9ce4fada1b..4f8977ffa47a 100644 --- a/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c +++ b/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c @@ -84,7 +84,6 @@ static const zfs_ioc_t ioc_skip[] = { ZFS_IOC_DSOBJ_TO_DSNAME, ZFS_IOC_OBJ_TO_PATH, ZFS_IOC_POOL_SET_PROPS, - ZFS_IOC_POOL_GET_PROPS, ZFS_IOC_SET_FSACL, ZFS_IOC_GET_FSACL, ZFS_IOC_SHARE, @@ -124,11 +123,136 @@ static const zfs_ioc_t ioc_skip[] = { lzc_ioctl_test(ioc, name, req, opt, err, wild); \ } while (0) +#define IOC_INPUT_TEST_INJECT(ioc, name, innvl) \ + do { \ + active_test = __func__ + 5; \ + lzc_ioctl_run_impl(ioc, name, innvl, 0, B_TRUE); \ + } while (0) + +/* + * Given a zfs_cmd_t containing an already packed nvlist in zc->zc_nvlist_src, + * and its original innvl, look in innvl for the last string nvpair, or last + * string array nvpair, and remove the string terminator. The idea is to + * corrupt the nvlist string value so that anyone doing a strlen() on it will + * read past the end of the packed nvlist buffer and trigger a crash. + */ +static void +do_bad_string(zfs_cmd_t *zc, nvlist_t *innvl) +{ + nvpair_t *elem = NULL; + nvpair_t *lastseen = NULL; + const char *str = NULL; + const char **arr; + uint_t n; + char *off; + char *packed; + uint64_t size, off_size; + + while ((elem = nvlist_next_nvpair(innvl, elem)) != NULL) { + if ((nvpair_type(elem) == DATA_TYPE_STRING) || + (nvpair_type(elem) == DATA_TYPE_STRING_ARRAY)) + lastseen = elem; + } + + if (lastseen == NULL) + return; /* No strings */ + + /* + * Lookup either the last string, or the last string in the last + * string array in the nvlist. We will use this to corrupt from the + * string to the end of the nvlist buffer. Any attempts to strlen this + * string should run pass the end of the packed buffer. + */ + if (nvpair_value_string(lastseen, &str) != 0) { + if (nvpair_value_string_array(lastseen, &arr, &n) == 0) + str = arr[n-1]; + } + + /* + * We now have the last string. Corrupt everything from the NULL + * terminator byte for the last string to the end of the packed nvlist + * buffer. + */ + packed = (char *)zc->zc_nvlist_src; + size = zc->zc_nvlist_src_size; + + off = memmem(packed, size, str, strlen(str)); + off_size = strlen(str); + + memset(&off[off_size - 1], '!', (packed + size) - + (&off[off_size - 1])); + +} + +/* + * For each byte in the packed nvlist list in zc, corrupt a single byte, then + * try doing the ioctl. This tests how well the kernel handles fuzzed nvlists. + * + * NOTE - make sure you are doing this with a "safe" ioctl! You don't want to + * run this on an ioctl that can potentially corrupt data (like a zpool create). + */ +static void +do_fuzz(int zfs_fd, zfs_ioc_t ioc, zfs_cmd_t *zc) +{ + uint64_t size; + uint64_t i; + unsigned char old = 0; + unsigned char *pos; + zfs_cmd_t orig_zc = *zc; + + pos = (unsigned char *) zc->zc_nvlist_src; + size = zc->zc_nvlist_src_size; + + /* + * Fuzz each byte in the packed nvlist, one byte at a time, and do the + * ioctl. If the kernel doesn't crash, then the test passed. + */ + for (i = 0; i < size; i++) { + /* Restore the previously corrupted byte */ + if (i > 0) + pos[i-1] = old; + + old = pos[i]; + + /* Corrupt the new byte */ + pos[i]++; + + /* + * Do the ioctl and ignore the return code. We just want to + * see if the kernel panics. + */ + lzc_ioctl_fd(zfs_fd, ioc, zc); + + /* + * Restore 'zc' with original fields since the ioctl may + * have modified them. + */ + *zc = orig_zc; + } + /* Restore last byte */ + if (i > 0) + pos[i - 1] = old; + + /* + * Try fuzzing the packed nvlist size field. Test it with one byte + * bigger and one byte smaller than the current value. + */ + zc->zc_nvlist_src_size--; + lzc_ioctl_fd(zfs_fd, ioc, zc); + + zc->zc_nvlist_src_size += 2; + lzc_ioctl_fd(zfs_fd, ioc, zc); + + /* Restore to normal */ + zc->zc_nvlist_src_size -= 1; +} + /* * run a zfs ioctl command, verify expected results and log failures */ static void -lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) +lzc_ioctl_run_impl(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, + int expected, boolean_t do_corrupt) { zfs_cmd_t zc = {"\0"}; char *packed = NULL; @@ -159,10 +283,30 @@ lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) zc.zc_nvlist_dst_size = MAX(size * 2, 128 * 1024); zc.zc_nvlist_dst = (uint64_t)(uintptr_t)malloc(zc.zc_nvlist_dst_size); + if (do_corrupt) { + /* + * Try changing bytes in the packed nvlist to see if it will + * panic the kernel when you do the ioctl. + */ + do_fuzz(zfs_fd, ioc, &zc); + + /* + * Corrupt the last string in the packed nvlist so it has no + * NULL terminator. + */ + do_bad_string(&zc, innvl); + + } + if (lzc_ioctl_fd(zfs_fd, ioc, &zc) != 0) error = errno; - if (error != expected) { + /* + * If we're corrupting the nvlist we don't care about the specific + * error code that gets returned, as it could be one of many. We only + * care if it panics the kernel. + */ + if (!do_corrupt && error != expected) { unexpected_failures = B_TRUE; (void) fprintf(stderr, "%s: Unexpected result with %s, " "error %d (expecting %d)\n", @@ -173,6 +317,12 @@ lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) free((void *)(uintptr_t)zc.zc_nvlist_dst); } +static void +lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) +{ + return (lzc_ioctl_run_impl(ioc, name, innvl, expected, B_FALSE)); +} + /* * Test each ioc for the following ioctl input errors: * ZFS_ERR_IOC_ARG_UNAVAIL an input argument is not supported by kernel @@ -309,6 +459,7 @@ test_log_history(const char *pool) fnvlist_add_string(required, "message", "input check"); IOC_INPUT_TEST(ZFS_IOC_LOG_HISTORY, pool, required, NULL, 0); + IOC_INPUT_TEST_INJECT(ZFS_IOC_LOG_HISTORY, pool, required); nvlist_free(required); } @@ -790,6 +941,20 @@ test_set_bootenv(const char *pool) nvlist_free(required); } +static void +test_zpool_get(const char *pool) +{ + const char *strs[] = {ZPOOL_DEDUPCACHED_PROP_NAME}; + nvlist_t *optional = fnvlist_alloc(); + + fnvlist_add_string_array(optional, ZPOOL_GET_PROPS_NAMES, strs, 1); + + IOC_INPUT_TEST(ZFS_IOC_POOL_GET_PROPS, pool, NULL, optional, 0); + IOC_INPUT_TEST_INJECT(ZFS_IOC_POOL_GET_PROPS, pool, optional); + + nvlist_free(optional); +} + static void zfs_ioc_input_tests(const char *pool) { @@ -884,6 +1049,7 @@ zfs_ioc_input_tests(const char *pool) test_scrub(pool); + test_zpool_get(pool); /* * cleanup */ From nobody Tue Jun 30 17:20:55 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKg6YPmz6jYBX for ; Tue, 30 Jun 2026 17:20:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKg3jd0z3r1v for ; Tue, 30 Jun 2026 17:20:55 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840055; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iGo3GjcIRTeGZzNF0y3ZCbDbFyGZz0GigJi2AYnoljM=; b=TmfzAjpwpSeEfXduOP77aw2Mu0z7RQZoNFsvDWqGsCd3w1RDwtrYdoDro22K9kDw1n8Cx5 C8oV4QrZ1aIAJXwgw0iCyvRFFok5AiGCWXYQBRtVwr+j1HoJZjjm7BUeaTMtv0S87dR2eC bvdnQeEPUuTK0pEm0VbKmWmfGepEYxM2ZbqR3I0JdKku9JxNjnAOzC5oBK6UZ8I5qb/naj vtK5Pz2zAFbhHfi/nmOLHHpNN/8apne/+e3XVUTWaTTF//GPuI/IniAl2jOK673i//SWbL orpAAbXEYTRNh3i2bFeOVZ8WV176rJtUTUlhgf4Plirqczv72guGSSJoN9PtOQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840055; a=rsa-sha256; cv=none; b=qVdKlMx6c/ejsEmYGDDAZpblCef8c9kvIAPzkhIIHV60z+b6LQMrd9rusRXWGQOeX4q2S2 TX5RyAWH2dNTK7zTItI8REzGJyZLbe50UnOIBZXLfIMiCfd8tod0/pKzgYggUchfEeK/Rn M3eCR8uf8+qarCjdnyuN283qur74LYRqz+d/85OdbIgxtyKyz/ucKQW/4z0B1HsHQKfkLN dct8/2ucAUF+5EXw4AZtUWy3WMBOxYAhZVkfkLKmGZzixSDHoUR0X7xgnfJquwRx7mDzUC AZuoqS66QIfnpICyUEaM+gY8GxGQaaj3faWJYDH2Dg6LSa2FZjD8uw1Hn06zTQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840055; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iGo3GjcIRTeGZzNF0y3ZCbDbFyGZz0GigJi2AYnoljM=; b=U7TdpCwBsITecSi87PBjozq0LAKkwSuE0KZRHzoGsYmk6sujJTb/eo7GG8wFi36AP9d6su dinICEUB5cXAYtrDk+trfGIlnhajU045Y+0mNcN/no+jKIvt+07JTMQUMeI4i6KEHybxmr d1HRv6ByCDx0ar5+06sapLPGW7186kMdpl87vPI9Q20pdInRXT4CsuRcwJOmVI4x9s5T95 9rQTXLFEBwTuLiEEFyv46XNCSLH5ZqejnIsw4w/VjvqolmyYVJelqH1Hg/v3nN2NUsfNum FwNd67lHH0MwMLUZRM9E6d+j7UNKHF+KqKmkD1Cvx494cPsTxLWeduB680XNmA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKg2bSjztPc for ; Tue, 30 Jun 2026 17:20:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4564d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:55 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Konstantin Belousov From: Mark Johnston Subject: git: 8fbbc185a3ff - releng/14.4 - execve_block(): a mechanism for mutual exclusion with execve() on the process List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 8fbbc185a3ff66d95c30d9b9062d6d8a349f0454 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:55 +0000 Message-Id: <6a43faf7.4564d.3acf24b2@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8fbbc185a3ff66d95c30d9b9062d6d8a349f0454 commit 8fbbc185a3ff66d95c30d9b9062d6d8a349f0454 Author: Konstantin Belousov AuthorDate: 2026-05-26 17:36:20 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:29 +0000 execve_block(): a mechanism for mutual exclusion with execve() on the process (cherry picked from commit e1a84b7708c2514769625c2af6c5034694013b6a) (cherry picked from commit dc94d15a7136c4cfe3342c005d8a319f0583ed9a) proc: Allow to make proc_rwmem() operate on a consistent address space (cherry picked from commit e1b0d051bbf7e4e730470cbd6622f71a639834c3) (cherry picked from commit e7578e37d832ecf1eee8cd3fed10df0e0cb1aa7e) kern_proc.c: ensure stability of the vmspace we read the strings from (cherry picked from commit a22c044cce41864a32af6b8281a3c416a2664d7f) (cherry picked from commit 1f062247ef4e920e7fdd1ebe91b4600d69fe1e91) kern_proc.c: ensure stability of the vmspace for sysctl kern.proc.vmmap (cherry picked from commit 5fe6e08d2db56b530f0df2903ef24cfabab7b8ea) (cherry picked from commit e856c10a4d6dfe30a730246b2050d9dd438085db) kern_proc.c: ensure stability of the vmspace for sysctl kern.proc.vm_layout (cherry picked from commit 31fa677e4af00b795bf671847b4dc72960c90f14) (cherry picked from commit da1398dd6962b458fdcf25799fcb512f4d9c070d) kern_proc.c: make kern.proc.osrel atomic (cherry picked from commit 80626f34ee985671bb8c60ee986b89587b7a1511) (cherry picked from commit b3f99ce653d456c9c829359b0dc83c4867f044b7) kern_proc.c: disallow execve around sysctl kern.proc.kstacks (cherry picked from commit 8b5abd9027b8b1f6290c756730ee3adebed007f4) (cherry picked from commit 197f367cdda7919578d15b1562225d6db462c5ad) kern_proc.c: disallow execve around sysctl kern.proc.rlimit (cherry picked from commit 5a91fa5a7656c99e527fe7e6f6bf6bd9e85ab589) (cherry picked from commit 35b95beb06cab0b10a7e3a697931851315fe3dc2) kern_event: block the target process from execing for sysctl kern.proc.kqueue (cherry picked from commit 79b384bd8fdff4869ce4799edb0342ff5c25b6fa) (cherry picked from commit adb14791b752cf0f07dce44d840f01340aa6d6cb) kern_resource.c: disallow execve around sysctl kern.proc.rlimitusage (cherry picked from commit 836749817036b90b60af0584fa21f2d9dbd60ff7) (cherry picked from commit 190d6677b11a1deed6bd0ef14fd4f990eea20f5b) kern_procctl(PROC_WX_MAPPINGS_PERMIT): ensure stability of the target vmspace (cherry picked from commit 6a572920f251ac8ac6a80a55d4d039736ea7dd65) (cherry picked from commit 23ebf0c97ac5fcd6adb6cda8a8707b99257721a6) linux_prlimit(): block execve for the target (cherry picked from commit e41c28e67fac9cd22a85b160c5c9d0477ed03600) (cherry picked from commit a11c4f036c1136ba90fbfda5d2025d18116562d8) pfs_readdir(): block the target process from execing (cherry picked from commit 4c0a0909f928baac982b7de4bfa5b5ca7de5291a) (cherry picked from commit caa2e5cf7cfb07c115d143023ffb21546a60556a) pseudofs: ensure that the target process vmspace is stable for VOP_READ/WRITE (cherry picked from commit a4993bac41350e85bc9affb862d2974a1a09bb5e) (cherry picked from commit ec0d7d01d6c45eff4043cf178addf65d1933d62a) procfs, linprocfs: ensure target process vmspace stability (cherry picked from commit 5db31f1b47b586a5091eb41fc957236f28b78dba) (cherry picked from commit d7d5337291c983ba969e24c95df0bcab46b44621) sys_set*id(9): wait for the execblocks to pass (cherry picked from commit d0384f50dad25d3358d76f7556969ea1d515ba68) (cherry picked from commit 34b95f53e7ac3a055b3d866d101a79e85d0022c4) kern_exec.c: explicitly include sys/limits.h for UINT_MAX (cherry picked from commit f5fce0bcc370a9700249e64901eabf2e0be4ecb0) (cherry picked from commit bb1154f3ea20291b0c02821743084a6f1a7dd844) Approved by: so Security: FreeBSD-SA-26:39.execve Security: CVE-2026-49415 --- sys/compat/linprocfs/linprocfs.c | 16 +--- sys/compat/linux/linux_misc.c | 15 +++ sys/fs/cuse/cuse.c | 4 +- sys/fs/procfs/procfs_map.c | 17 ++-- sys/fs/procfs/procfs_mem.c | 6 +- sys/fs/pseudofs/pseudofs_vnops.c | 69 ++++++++++---- sys/kern/kern_event.c | 22 ++++- sys/kern/kern_exec.c | 81 ++++++++++++++++- sys/kern/kern_exit.c | 1 + sys/kern/kern_fork.c | 1 + sys/kern/kern_proc.c | 191 +++++++++++++++++++++++---------------- sys/kern/kern_procctl.c | 23 +++-- sys/kern/kern_prot.c | 20 +++- sys/kern/kern_resource.c | 27 ++++-- sys/kern/sys_process.c | 124 +++++++++++++++++++++---- sys/sys/imgact.h | 4 + sys/sys/proc.h | 3 + sys/sys/ptrace.h | 15 ++- 18 files changed, 467 insertions(+), 172 deletions(-) diff --git a/sys/compat/linprocfs/linprocfs.c b/sys/compat/linprocfs/linprocfs.c index d4f38b491471..b42cbea61d09 100644 --- a/sys/compat/linprocfs/linprocfs.c +++ b/sys/compat/linprocfs/linprocfs.c @@ -1317,19 +1317,13 @@ linprocfs_doprocmaps(PFS_FILL_ARGS) struct vattr vat; bool private; - PROC_LOCK(p); - error = p_candebug(td, p); - PROC_UNLOCK(p); - if (error) - return (error); - if (uio->uio_rw != UIO_READ) return (EOPNOTSUPP); - error = 0; - vm = vmspace_acquire_ref(p); - if (vm == NULL) - return (ESRCH); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, + &vm); + if (error != 0) + return (error); if (SV_CURPROC_FLAG(SV_LP64)) l_map_str = l64_map_str; @@ -1427,7 +1421,7 @@ linprocfs_doprocmaps(PFS_FILL_ARGS) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_CHECK_DEBUG | PRVM_BLOCK_EXEC, vm); return (error); } diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c index 2ae10a487813..2414c76eb173 100644 --- a/sys/compat/linux/linux_misc.c +++ b/sys/compat/linux/linux_misc.c @@ -2006,6 +2006,7 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) u_int which; int flags; int error; + bool exec_blocked; if (args->new == NULL && args->old != NULL) { if (linux_get_dummy_limit(args->resource, &rlim)) { @@ -2033,6 +2034,7 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) return (error); } + exec_blocked = false; flags = PGET_HOLD | PGET_NOTWEXIT; if (args->new != NULL) flags |= PGET_CANDEBUG; @@ -2045,6 +2047,14 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) error = pget(args->pid, flags, &p); if (error != 0) return (error); + exec_blocked = true; + PROC_LOCK(p); + execve_block_wait(td, p); + error = args->new != NULL ? p_candebug(td, p) : + p_cansee(td, p); + PROC_UNLOCK(p); + if (error != 0) + goto out; } if (args->old != NULL) { PROC_LOCK(p); @@ -2067,6 +2077,11 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) error = kern_proc_setrlimit(td, p, which, &nrlim); out: + if (exec_blocked) { + PROC_LOCK(p); + execve_unblock(td, p); + PROC_UNLOCK(p); + } PRELE(p); return (error); } diff --git a/sys/fs/cuse/cuse.c b/sys/fs/cuse/cuse.c index d63a7d4691cf..b9423fd3543d 100644 --- a/sys/fs/cuse/cuse.c +++ b/sys/fs/cuse/cuse.c @@ -914,7 +914,7 @@ cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s, }; PHOLD(proc_s); - error = proc_rwmem(proc_s, &uio); + error = proc_rwmem(proc_s, &uio, 0); PRELE(proc_s); } else if (proc_cur == proc_s) { @@ -933,7 +933,7 @@ cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s, }; PHOLD(proc_d); - error = proc_rwmem(proc_d, &uio); + error = proc_rwmem(proc_d, &uio, 0); PRELE(proc_d); } else { error = EINVAL; diff --git a/sys/fs/procfs/procfs_map.c b/sys/fs/procfs/procfs_map.c index db6b225f6426..5ccef979856b 100644 --- a/sys/fs/procfs/procfs_map.c +++ b/sys/fs/procfs/procfs_map.c @@ -42,6 +42,7 @@ #include #include #include +#include #include #include #include @@ -95,15 +96,14 @@ procfs_doprocmap(PFS_FILL_ARGS) bool wrap32; #endif - PROC_LOCK(p); - error = p_candebug(td, p); - PROC_UNLOCK(p); - if (error) - return (error); - if (uio->uio_rw != UIO_READ) return (EOPNOTSUPP); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, + &vm); + if (error != 0) + return (error); + #ifdef COMPAT_FREEBSD32 wrap32 = false; if (SV_CURPROC_FLAG(SV_ILP32)) { @@ -113,9 +113,6 @@ procfs_doprocmap(PFS_FILL_ARGS) } #endif - vm = vmspace_acquire_ref(p); - if (vm == NULL) - return (ESRCH); map = &vm->vm_map; vm_map_lock_read(map); VM_MAP_ENTRY_FOREACH(entry, map) { @@ -240,6 +237,6 @@ procfs_doprocmap(PFS_FILL_ARGS) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, vm); return (error); } diff --git a/sys/fs/procfs/procfs_mem.c b/sys/fs/procfs/procfs_mem.c index c74954db37d6..5fc0c1acf140 100644 --- a/sys/fs/procfs/procfs_mem.c +++ b/sys/fs/procfs/procfs_mem.c @@ -61,11 +61,7 @@ procfs_doprocmem(PFS_FILL_ARGS) if (uio->uio_resid == 0) return (0); - PROC_LOCK(p); - error = p_candebug(td, p); - PROC_UNLOCK(p); - if (error == 0) - error = proc_rwmem(p, uio); + error = proc_rwmem(p, uio, PRVM_CHECK_DEBUG | PRVM_BLOCK_EXEC); return (error); } diff --git a/sys/fs/pseudofs/pseudofs_vnops.c b/sys/fs/pseudofs/pseudofs_vnops.c index 8cd092118d0e..059e8fd0e8b2 100644 --- a/sys/fs/pseudofs/pseudofs_vnops.c +++ b/sys/fs/pseudofs/pseudofs_vnops.c @@ -37,6 +37,7 @@ #include #include #include +#include #include #include #include @@ -132,6 +133,7 @@ static int pfs_lookup_proc(pid_t pid, struct proc **p) { struct proc *proc; + struct thread *td; proc = pfind(pid); if (proc == NULL) @@ -141,8 +143,10 @@ pfs_lookup_proc(pid_t pid, struct proc **p) return (0); } _PHOLD(proc); - PROC_UNLOCK(proc); + td = curthread; + execve_block_wait(td, proc); *p = proc; + PROC_UNLOCK(proc); return (1); } @@ -672,6 +676,7 @@ pfs_read(struct vop_read_args *va) struct pfs_node *pn = pvd->pvd_pn; struct uio *uio = va->a_uio; struct proc *proc; + struct thread *td; struct sbuf *sb = NULL; int error, locked; off_t buflen, buflim; @@ -690,21 +695,30 @@ pfs_read(struct vop_read_args *va) if (pn->pn_fill == NULL) PFS_RETURN (EIO); + td = curthread; + /* * This is necessary because either process' privileges may * have changed since the open() call. */ - if (!pfs_visible(curthread, pn, pvd->pvd_pid, &proc)) + if (!pfs_visible(td, pn, pvd->pvd_pid, &proc)) PFS_RETURN (EIO); - if (proc != NULL) { - _PHOLD(proc); - PROC_UNLOCK(proc); - } vhold(vn); locked = VOP_ISLOCKED(vn); VOP_UNLOCK(vn); + if (proc != NULL) { + _PHOLD(proc); + execve_block_wait(td, proc); + if (!pfs_visible_proc(td, pn, proc)) { + PROC_UNLOCK(proc); + error = EIO; + goto ret; + } + PROC_UNLOCK(proc); + } + if (pn->pn_flags & PFS_RAWRD) { PFS_TRACE(("%zd resid", uio->uio_resid)); error = pn_fill(curthread, proc, pn, NULL, uio); @@ -774,8 +788,12 @@ pfs_read(struct vop_read_args *va) ret: vn_lock(vn, locked | LK_RETRY); vdrop(vn); - if (proc != NULL) - PRELE(proc); + if (proc != NULL) { + PROC_LOCK(proc); + execve_unblock(td, proc); + _PRELE(proc); + PROC_UNLOCK(proc); + } PFS_RETURN (error); } @@ -846,6 +864,7 @@ pfs_readdir(struct vop_readdir_args *va) struct pfs_node *pd = pvd->pvd_pn; pid_t pid = pvd->pvd_pid; struct proc *p, *proc; + struct thread *td; struct pfs_node *pn; struct uio *uio; struct pfsentry *pfsent, *pfsent2; @@ -891,11 +910,13 @@ pfs_readdir(struct vop_readdir_args *va) KASSERT(pid == NO_PID || proc != NULL, ("%s(): no process for pid %lu", __func__, (unsigned long)pid)); + td = curthread; if (pid != NO_PID) { PROC_LOCK(proc); /* check if the directory is visible to the caller */ if (!pfs_visible_proc(curthread, pd, proc)) { + execve_unblock(td, proc); _PRELE(proc); PROC_UNLOCK(proc); pfs_unlock(pd); @@ -955,6 +976,7 @@ pfs_readdir(struct vop_readdir_args *va) resid -= PFS_DELEN; } if (proc != NULL) { + execve_unblock(td, proc); _PRELE(proc); PROC_UNLOCK(proc); } @@ -1079,6 +1101,7 @@ pfs_write(struct vop_write_args *va) struct pfs_node *pn = pvd->pvd_pn; struct uio *uio = va->a_uio; struct proc *proc; + struct thread *td; struct sbuf sb; int error; @@ -1098,36 +1121,44 @@ pfs_write(struct vop_write_args *va) if (uio->uio_resid > PFS_MAXBUFSIZ) PFS_RETURN (EIO); + td = curthread; + /* * This is necessary because either process' privileges may * have changed since the open() call. */ - if (!pfs_visible(curthread, pn, pvd->pvd_pid, &proc)) + if (!pfs_visible(td, pn, pvd->pvd_pid, &proc)) PFS_RETURN (EIO); if (proc != NULL) { _PHOLD(proc); + execve_block_wait(td, proc); + if (!pfs_visible_proc(td, pn, proc)) { + PROC_UNLOCK(proc); + error = EIO; + goto out; + } PROC_UNLOCK(proc); } if (pn->pn_flags & PFS_RAWWR) { error = pn_fill(curthread, proc, pn, NULL, uio); - if (proc != NULL) - PRELE(proc); - PFS_RETURN (error); + goto out; } sbuf_uionew(&sb, uio, &error); - if (error) { - if (proc != NULL) - PRELE(proc); - PFS_RETURN (error); - } + if (error != 0) + goto out; error = pn_fill(curthread, proc, pn, &sb, uio); sbuf_delete(&sb); - if (proc != NULL) - PRELE(proc); +out: + if (proc != NULL) { + PROC_LOCK(proc); + execve_unblock(td, proc); + _PRELE(proc); + PROC_UNLOCK(proc); + } PFS_RETURN (error); } diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c index 920256f8c1bd..c937505a7270 100644 --- a/sys/kern/kern_event.c +++ b/sys/kern/kern_event.c @@ -50,6 +50,7 @@ #include #include #include +#include #include #include #include @@ -3038,10 +3039,6 @@ sysctl_kern_proc_kqueue(SYSCTL_HANDLER_ARGS) if ((u_int)arg2 > 2 || (u_int)arg2 == 0) return (EINVAL); - error = pget((pid_t)name[0], PGET_HOLD | PGET_CANDEBUG, &p); - if (error != 0) - return (error); - td = curthread; #ifdef COMPAT_FREEBSD32 compat32 = SV_CURPROC_FLAG(SV_ILP32); @@ -3049,6 +3046,17 @@ sysctl_kern_proc_kqueue(SYSCTL_HANDLER_ARGS) compat32 = false; #endif + error = pget((pid_t)name[0], PGET_NOTWEXIT, &p); + if (error != 0) + return (error); + + _PHOLD(p); + execve_block_wait(td, p); + error = p_candebug(td, p); + if (error != 0) + goto out1; + PROC_UNLOCK(p); + s = sbuf_new_for_sysctl(&sm, NULL, 0, req); if (s == NULL) { error = ENOMEM; @@ -3069,7 +3077,11 @@ sysctl_kern_proc_kqueue(SYSCTL_HANDLER_ARGS) sbuf_delete(s); out: - PRELE(p); + PROC_LOCK(p); +out1: + execve_unblock(td, p); + _PRELE(p); + PROC_UNLOCK(p); return (error); } diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index 349e13915b29..3cedf7ee36f5 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -26,7 +26,6 @@ * SUCH DAMAGE. */ -#include #include "opt_capsicum.h" #include "opt_hwpmc_hooks.h" #include "opt_ktrace.h" @@ -45,6 +44,7 @@ #include #include #include +#include #include #include #include @@ -370,6 +370,77 @@ execve_nosetid(struct image_params *imgp) } } +/* + * Returns true if the execblock was obtained, in this case the + * process lock is kept. Returns false if the execblock was not + * obtained, but the function slept and the lock was dropped. + */ +bool +execve_block(struct thread *td, struct proc *p) +{ + PROC_LOCK_ASSERT(p, MA_OWNED); + MPASS(td == curthread); + MPASS(p != td->td_proc || (p->p_flag & P_INEXEC) == 0); + + if (p != td->td_proc && (p->p_flag & P_INEXEC) != 0) { + p->p_flag2 |= P2_INEXEC_WAIT; + msleep(&p->p_execblock, &p->p_mtx, PDROP, "inexec", 0); + return (false); + } + MPASS(p->p_execblock < UINT_MAX); + p->p_execblock++; + return (true); +} + +/* + * Might drop the process lock internally, callers must re-check the + * invariants afterward. + */ +void +execve_block_wait(struct thread *td, struct proc *p) +{ + bool first; + + PROC_ASSERT_HELD(p); + PROC_LOCK_ASSERT(p, MA_OWNED); + + for (first = true;; first = false) { + if (!first) + PROC_LOCK(p); + if (execve_block(td, p)) + return; + } +} + +void +execve_unblock(struct thread *td, struct proc *p) +{ + PROC_LOCK_ASSERT(p, MA_OWNED); + MPASS(td == curthread); + + MPASS(p->p_execblock > 0); + p->p_execblock--; + if (p->p_execblock == 0 && (p->p_flag2 & P2_INEXEC_WAIT) != 0) { + p->p_flag2 &= ~P2_INEXEC_WAIT; + wakeup(&p->p_execblock); + } +} + +void +execve_block_pass(struct thread *td) +{ + struct proc *p; + + MPASS(td == curthread); + p = td->td_proc; + PROC_LOCK_ASSERT(p, MA_OWNED); + + while (p->p_execblock != 0) { + p->p_flag2 |= P2_INEXEC_WAIT; + msleep(&p->p_execblock, &p->p_mtx, 0, "exeblk", 0); + } +} + /* * In-kernel implementation of execve(). All arguments are assumed to be * userspace pointers from the passed thread. @@ -425,6 +496,7 @@ do_execve(struct thread *td, struct image_args *args, struct mac *mac_p, PROC_LOCK(p); KASSERT((p->p_flag & P_INEXEC) == 0, ("%s(): process already has P_INEXEC flag", __func__)); + execve_block_pass(td); p->p_flag |= P_INEXEC; PROC_UNLOCK(p); @@ -893,7 +965,11 @@ interpret: * as we're now a bona fide freshly-execed process. */ KNOTE_LOCKED(p->p_klist, NOTE_EXEC); + MPASS(p->p_execblock == 0); + if ((p->p_flag2 & P2_INEXEC_WAIT) != 0) + wakeup(&p->p_execblock); p->p_flag &= ~P_INEXEC; + p->p_flag2 &= ~P2_INEXEC_WAIT; /* clear "fork but no exec" flag, as we _are_ execing */ p->p_acflag &= ~AFORK; @@ -975,7 +1051,10 @@ exec_fail_dealloc: exec_fail: /* we're done here, clear P_INEXEC */ PROC_LOCK(p); + if ((p->p_flag2 & P2_INEXEC_WAIT) != 0) + wakeup(&p->p_execblock); p->p_flag &= ~P_INEXEC; + p->p_flag2 &= ~P2_INEXEC_WAIT; PROC_UNLOCK(p); SDT_PROBE1(proc, , , exec__failure, error); diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c index bbd30dfb9480..baa5cad2bdc8 100644 --- a/sys/kern/kern_exit.c +++ b/sys/kern/kern_exit.c @@ -325,6 +325,7 @@ exit1(struct thread *td, int rval, int signo) while (p->p_lock > 0) msleep(&p->p_lock, &p->p_mtx, PWAIT, "exithold", 0); + MPASS(p->p_execblock == 0); PROC_UNLOCK(p); /* Drain the limit callout while we don't have the proc locked */ callout_drain(&p->p_limco); diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c index 7731ae4d14f3..d8578f01677b 100644 --- a/sys/kern/kern_fork.c +++ b/sys/kern/kern_fork.c @@ -384,6 +384,7 @@ do_fork(struct thread *td, struct fork_req *fr, struct proc *p2, struct thread * bzero(&p2->p_startzero, __rangeof(struct proc, p_startzero, p_endzero)); + p2->p_execblock = 0; /* Tell the prison that we exist. */ prison_proc_hold(p2->p_ucred->cr_prison); diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c index c4d5356bb292..061a9f7fa4dd 100644 --- a/sys/kern/kern_proc.c +++ b/sys/kern/kern_proc.c @@ -45,6 +45,7 @@ #include #include #include +#include #include #include #include @@ -1833,8 +1834,8 @@ pargs_drop(struct pargs *pa) } static int -proc_read_string(struct thread *td, struct proc *p, const char *sptr, char *buf, - size_t len) +proc_read_string(struct thread *td, struct vmspace *vm, const char *sptr, + char *buf, size_t len) { ssize_t n; @@ -1843,7 +1844,7 @@ proc_read_string(struct thread *td, struct proc *p, const char *sptr, char *buf, * and is aligned at the end of the page, and the following page is not * mapped. */ - n = proc_readmem(td, p, (vm_offset_t)sptr, buf, len); + n = vmspace_iop(td, vm, (vm_offset_t)sptr, buf, len, UIO_READ); if (n <= 0) return (ENOMEM); return (0); @@ -1859,8 +1860,8 @@ enum proc_vector_type { #ifdef COMPAT_FREEBSD32 static int -get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, - size_t *vsizep, enum proc_vector_type type) +get_proc_vector32(struct thread *td, struct proc *p, struct vmspace *vm, + char ***proc_vectorp, size_t *vsizep, enum proc_vector_type type) { struct freebsd32_ps_strings pss; Elf32_Auxinfo aux; @@ -1871,8 +1872,8 @@ get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, int i, error; error = 0; - if (proc_readmem(td, p, PROC_PS_STRINGS(p), &pss, sizeof(pss)) != - sizeof(pss)) + if (vmspace_iop(td, vm, PROC_PS_STRINGS(p), &pss, sizeof(pss), + UIO_READ) != sizeof(pss)) return (ENOMEM); switch (type) { case PROC_ARG: @@ -1895,8 +1896,8 @@ get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, if (vptr % 4 != 0) return (ENOEXEC); for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) { - if (proc_readmem(td, p, ptr, &aux, sizeof(aux)) != - sizeof(aux)) + if (vmspace_iop(td, vm, ptr, &aux, sizeof(aux), + UIO_READ) != sizeof(aux)) return (ENOMEM); if (aux.a_type == AT_NULL) break; @@ -1912,7 +1913,7 @@ get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, return (EINVAL); } proc_vector32 = malloc(size, M_TEMP, M_WAITOK); - if (proc_readmem(td, p, vptr, proc_vector32, size) != size) { + if (vmspace_iop(td, vm, vptr, proc_vector32, size, UIO_READ) != size) { error = ENOMEM; goto done; } @@ -1933,8 +1934,8 @@ done: #endif static int -get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, - size_t *vsizep, enum proc_vector_type type) +get_proc_vector(struct thread *td, struct proc *p, struct vmspace *vm, + char ***proc_vectorp, size_t *vsizep, enum proc_vector_type type) { struct ps_strings pss; Elf_Auxinfo aux; @@ -1944,11 +1945,13 @@ get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, int i; #ifdef COMPAT_FREEBSD32 - if (SV_PROC_FLAG(p, SV_ILP32) != 0) - return (get_proc_vector32(td, p, proc_vectorp, vsizep, type)); + if (SV_PROC_FLAG(p, SV_ILP32) != 0) { + return (get_proc_vector32(td, p, vm, proc_vectorp, + vsizep, type)); + } #endif - if (proc_readmem(td, p, PROC_PS_STRINGS(p), &pss, sizeof(pss)) != - sizeof(pss)) + if (vmspace_iop(td, vm, PROC_PS_STRINGS(p), &pss, sizeof(pss), + UIO_READ) != sizeof(pss)) return (ENOMEM); switch (type) { case PROC_ARG: @@ -1986,8 +1989,8 @@ get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, * to the allocated proc_vector. */ for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) { - if (proc_readmem(td, p, ptr, &aux, sizeof(aux)) != - sizeof(aux)) + if (vmspace_iop(td, vm, ptr, &aux, sizeof(aux), + UIO_READ) != sizeof(aux)) return (ENOMEM); if (aux.a_type == AT_NULL) break; @@ -2009,7 +2012,7 @@ get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, return (EINVAL); /* In case we are built without INVARIANTS. */ } proc_vector = malloc(size, M_TEMP, M_WAITOK); - if (proc_readmem(td, p, vptr, proc_vector, size) != size) { + if (vmspace_iop(td, vm, vptr, proc_vector, size, UIO_READ) != size) { free(proc_vector, M_TEMP); return (ENOMEM); } @@ -2025,6 +2028,7 @@ static int get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, enum proc_vector_type type) { + struct vmspace *vm; size_t done, len, nchr, vsize; int error, i; char **proc_vector, *sptr; @@ -2037,9 +2041,14 @@ get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, */ nchr = 2 * (PATH_MAX + ARG_MAX); - error = get_proc_vector(td, p, &proc_vector, &vsize, type); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | + PRVM_CHECK_VISIBILITY, &vm); if (error != 0) return (error); + + error = get_proc_vector(td, p, vm, &proc_vector, &vsize, type); + if (error != 0) + goto out; for (done = 0, i = 0; i < (int)vsize && done < nchr; i++) { /* * The program may have scribbled into its argv array, e.g. to @@ -2049,7 +2058,7 @@ get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, if (proc_vector[i] == NULL) break; for (sptr = proc_vector[i]; ; sptr += GET_PS_STRINGS_CHUNK_SZ) { - error = proc_read_string(td, p, sptr, pss_string, + error = proc_read_string(td, vm, sptr, pss_string, sizeof(pss_string)); if (error != 0) goto done; @@ -2066,6 +2075,8 @@ get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, } done: free(proc_vector, M_TEMP); +out: + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_VISIBILITY, vm); return (error); } @@ -2086,11 +2097,17 @@ proc_getenvv(struct thread *td, struct proc *p, struct sbuf *sb) int proc_getauxv(struct thread *td, struct proc *p, struct sbuf *sb) { + struct vmspace *vm; size_t vsize, size; char **auxv; int error; - error = get_proc_vector(td, p, &auxv, &vsize, PROC_AUX); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, + &vm); + if (error != 0) + return (error); + error = get_proc_vector(td, p, vm, &auxv, &vsize, PROC_AUX); + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, vm); if (error == 0) { #ifdef COMPAT_FREEBSD32 if (SV_PROC_FLAG(p, SV_ILP32) != 0) @@ -2403,6 +2420,7 @@ sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS) int error, *name; struct vnode *vp; struct proc *p; + struct thread *td; vm_map_t map; struct vmspace *vm; @@ -2411,11 +2429,12 @@ sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS) return (EINVAL); name = (int *)arg1; + td = curthread; error = pget((pid_t)name[0], PGET_WANTREAD, &p); if (error != 0) return (error); - vm = vmspace_acquire_ref(p); - if (vm == NULL) { + error = proc_vmspace_ref(td, p, PRVM_CHECK_DEBUG, &vm); + if (error != 0) { PRELE(p); return (ESRCH); } @@ -2527,7 +2546,7 @@ sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_CHECK_DEBUG, vm); PRELE(p); free(kve, M_TEMP); return (error); @@ -2618,6 +2637,7 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) struct vmspace *vm; struct cdev *cdev; struct cdevsw *csw; + struct thread *td; vm_offset_t addr; unsigned int last_timestamp; int error, ref; @@ -2629,10 +2649,11 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) _PHOLD(p); PROC_UNLOCK(p); - vm = vmspace_acquire_ref(p); - if (vm == NULL) { + td = curthread; + error = proc_vmspace_ref(td, p, PRVM_CHECK_DEBUG, &vm); + if (error != 0) { PRELE(p); - return (ESRCH); + return (error); } kve = malloc(sizeof(*kve), M_TEMP, M_WAITOK | M_ZERO); @@ -2747,7 +2768,7 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) if (vp != NULL) { vn_fullpath(vp, &fullpath, &freepath); kve->kve_vn_type = vntype_to_kinfo(vp->v_type); - cred = curthread->td_ucred; + cred = td->td_ucred; vn_lock(vp, LK_SHARED | LK_RETRY); if (VOP_GETATTR(vp, &va, cred) == 0) { kve->kve_vn_fileid = va.va_fileid; @@ -2803,7 +2824,7 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_CHECK_DEBUG, vm); PRELE(p); free(kve, M_TEMP); return (error); @@ -2842,7 +2863,7 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) struct kinfo_kstack *kkstp; int error, i, *name, numthreads; lwpid_t *lwpidarray; - struct thread *td; + struct thread *td, *ctd; struct stack *st; struct sbuf sb; struct proc *p; @@ -2853,7 +2874,8 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) return (EINVAL); name = (int *)arg1; - error = pget((pid_t)name[0], PGET_NOTINEXEC | PGET_WANTREAD, &p); + ctd = curthread; + error = pget((pid_t)name[0], PGET_WANTREAD, &p); if (error != 0) return (error); @@ -2862,6 +2884,14 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) lwpidarray = NULL; PROC_LOCK(p); + execve_block_wait(ctd, p); + error = p_candebug(ctd, p); + if (error != 0) { + execve_unblock(ctd, p); + _PRELE(p); + PROC_UNLOCK(p); + return (error); + } do { if (lwpidarray != NULL) { free(lwpidarray, M_TEMP); @@ -2874,15 +2904,6 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) PROC_LOCK(p); } while (numthreads < p->p_numthreads); - /* - * XXXRW: During the below loop, execve(2) and countless other sorts - * of changes could have taken place. Should we check to see if the - * vmspace has been replaced, or the like, in order to prevent - * giving a snapshot that spans, say, execve(2), with some threads - * before and some after? Among other things, the credentials could *** 695 LINES SKIPPED *** From nobody Tue Jun 30 17:20:57 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKk19kyz6jY7h for ; Tue, 30 Jun 2026 17:20:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKj552Nz3rH1 for ; Tue, 30 Jun 2026 17:20:57 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840057; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ATxbXPKZkius4lty+DsQuSvOUgsNyGblmUL9d14511I=; b=E9R8RTvt77dwQbW50hBnTpXBvE9uZNjv/qVjkiKkqoIR2ca3HzhOoJvV3u2hXmj+51sN0w 6RJ5CyxojHzvlg4lvvIDcprR9wNOExNDElnohhJTEPuFf5SATHLY/S2+8rchBvvd001hte IRcB39zXVnCZsDK0GGW9fHOfU+TmHnriW7EF5E1Uj+OBhk7b8DvH1jgkn20cvwg0FPmq3t yUQgTWgk/P/YaEzlsW/AaBFL4fp059zOoqmR3kQzFyrafsqOrS9AiHbJUi0hKfR7rXgam7 6cAwrqK44QObg8VEXVX6GceXSVpiJpeleMHme9J4/GzyS2zbnWxMpzhtY93s2A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840057; a=rsa-sha256; cv=none; b=ke/0TiSwM++sOuegvSSSO63NC5iMmGo3Fjejl1Bdo8PmML/3PGh3L8FGo6jWSogyr3rp5Z 2Fup7+cd2lpAqx+tRwG39jrDCgwmz3wJj43Xp8vR6ItWwYQTu2Xmb9z7lhhU/Z/h9GmR+y 7iQb+nuD3caSlcOVU0k+enEUvcLL8yv+OSCqmrAq03E9q1SEFLiPgYjxq9XmVrbK1Bz0Bn HSYUAyDWtyrySeRsYjw1P/AXPix2VUJc4PNdQkAcjB81H+oJJGLIWDHbgPYLHtrPRhM/BF kwINjNkEJM0ivJsHmOliPlQrgjCp/gHAqWRzylWuqonVQJbtI9+W3isnioGkwg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840057; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ATxbXPKZkius4lty+DsQuSvOUgsNyGblmUL9d14511I=; b=DR8yzoKorJ4CU/aQ8Y9wHRcOy4WpOTVYBle/7KZoi3sUKLP/uNXkRwwJ98deMldIzydctX b2eoJvgi4FxsEaIFSmmCzVh8sAR59PC9FgYtDd1axLMsBRFsMg1ZxzLfMn4GXJ0H6DAitt n19BsvzJAvoX6l5AytwjKswbz+fhoYRMi+mlO4uXftBv3//TDH3FJgf7i6NDmzbrfA5AAs ATa69xlwEif+jGwOfl4cGyrznPexzacpWou6m8KVOzJ7FhjctrPlpVuWyf0RkGa5xz67XZ W989hBj6eA/RvaOfk+nlxeJ6Q6Ilo8K/juq0kR7abUswsXmaml9AWreqcuVLCA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKj3zTHztVS for ; Tue, 30 Jun 2026 17:20:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45872 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:57 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav From: Mark Johnston Subject: git: 66efc521e0ff - releng/14.4 - libalias: Fix buffer overflow in RTSP aliasing List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 66efc521e0ffbed1fd6d8481d7a7a66be3e56571 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:57 +0000 Message-Id: <6a43faf9.45872.139908e9@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=66efc521e0ffbed1fd6d8481d7a7a66be3e56571 commit 66efc521e0ffbed1fd6d8481d7a7a66be3e56571 Author: Dag-Erling Smørgrav AuthorDate: 2026-06-28 22:10:40 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:30 +0000 libalias: Fix buffer overflow in RTSP aliasing In alias_rtsp_out(), we construct a new packet in a fixed-length buffer before copying it back into the original buffer. We never checked if the data we were writing to this temporary buffer fit in it, nor if the result fit in the original buffer. * Use a dynamically sized allocated buffer instead of a fixed-length stack buffer. * Check for overflow before appending to our temporary buffer. * Check for overflow before copying the data back to the packet buffer. * While here, use size_t for sizes and bool for booleans. Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 MFC after: 1 week Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D57753 --- sys/netinet/libalias/alias_smedia.c | 156 ++++++++++++++++++++---------------- 1 file changed, 89 insertions(+), 67 deletions(-) diff --git a/sys/netinet/libalias/alias_smedia.c b/sys/netinet/libalias/alias_smedia.c index 6c67e0d8f006..af1f6ed4aca8 100644 --- a/sys/netinet/libalias/alias_smedia.c +++ b/sys/netinet/libalias/alias_smedia.c @@ -104,8 +104,9 @@ #include #include #else -#include #include +#include +#include #include #include #endif @@ -128,9 +129,9 @@ #define RTSP_CONTROL_PORT_NUMBER_2 7070 #define TFTP_PORT_NUMBER 69 -static void -AliasHandleRtspOut(struct libalias *, struct ip *, struct alias_link *, - int maxpacketsize); +static void AliasHandleRtspOut(struct libalias *, struct ip *, + struct alias_link *, size_t); + static int fingerprint(struct libalias *la, struct alias_data *ah) { @@ -154,7 +155,8 @@ protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah) if (ntohs(*ah->dport) == TFTP_PORT_NUMBER) FindRtspOut(la, pip->ip_src, pip->ip_dst, *ah->sport, *ah->aport, IPPROTO_UDP); - else AliasHandleRtspOut(la, pip, ah->lnk, ah->maxpktsize); + else + AliasHandleRtspOut(la, pip, ah->lnk, ah->maxpktsize); return (0); } @@ -208,13 +210,15 @@ MODULE_DEPEND(alias_smedia, libalias, 1, 1, 1); #define ISDIGIT(a) (((a) >= '0') && ((a) <= '9')) -static int -search_string(char *data, int dlen, const char *search_str) +static ssize_t +search_string(char *data, size_t dlen, const char *search_str) { - int i, j, k; - int search_str_len; + size_t i, j, k; + size_t search_str_len; search_str_len = strlen(search_str); + if (search_str_len > dlen) + return (-1); for (i = 0; i < dlen - search_str_len; i++) { for (j = i, k = 0; j < dlen - search_str_len; j++, k++) { if (data[j] != search_str[k] && @@ -230,18 +234,21 @@ search_string(char *data, int dlen, const char *search_str) static int alias_rtsp_out(struct libalias *la, struct ip *pip, struct alias_link *lnk, - char *data, + char *data, size_t maxlen, const char *port_str) { - int hlen, tlen, dlen; + size_t hlen, tlen, dlen; + size_t i, j; struct tcphdr *tc; - int i, j, pos, state, port_dlen, new_dlen, delta; + int delta, state; + ssize_t pos, slen; + size_t new_dlen, port_dlen, port_slen; u_short p[2], new_len; u_short sport, eport, base_port; u_short salias = 0, ealias = 0, base_alias = 0; const char *transport_str = "transport:"; - char newdata[2048], *port_data, *port_newdata, stemp[80]; - int links_created = 0, pkt_updated = 0; + char *newdata, *port_data; + bool links_created = false, pkt_updated = false; struct alias_link *rtsp_lnk = NULL; struct in_addr null_addr; @@ -250,6 +257,9 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, hlen = (pip->ip_hl + tc->th_off) << 2; tlen = ntohs(pip->ip_len); dlen = tlen - hlen; + if (hlen > tlen || tlen > maxlen) + return (-1); + port_slen = strlen(port_str); /* Find keyword, "Transport: " */ pos = search_string(data, dlen, transport_str); @@ -259,17 +269,21 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, port_data = data + pos; port_dlen = dlen - pos; + /* Allocate temporary buffer */ + maxlen -= hlen; + if ((newdata = malloc(maxlen)) == NULL) + return (-1); memcpy(newdata, data, pos); - port_newdata = newdata + pos; + new_dlen = pos; - while (port_dlen > (int)strlen(port_str)) { + while (port_dlen > port_slen) { /* Find keyword, appropriate port string */ pos = search_string(port_data, port_dlen, port_str); - if (pos < 0) + if (pos < 0 || (size_t)pos + 1 > maxlen - new_dlen) break; - memcpy(port_newdata, port_data, pos + 1); - port_newdata += (pos + 1); + memcpy(newdata + new_dlen, port_data, pos + 1); + new_dlen += pos + 1; p[0] = p[1] = 0; sport = eport = 0; @@ -300,7 +314,7 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, eport = htons(p[1]); if (!links_created) { - links_created = 1; + links_created = true; /* * Find an even numbered port * number base that satisfies the @@ -349,24 +363,30 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, ealias = htons(base_alias + (RTSP_PORT_GROUP - 1)); } if (salias && rtsp_lnk) { - pkt_updated = 1; + pkt_updated = true; /* Copy into IP packet */ - sprintf(stemp, "%d", ntohs(salias)); - memcpy(port_newdata, stemp, strlen(stemp)); - port_newdata += strlen(stemp); + slen = snprintf(newdata + new_dlen, + maxlen - new_dlen, "%d", ntohs(salias)); + if (slen < 0 || slen >= maxlen - new_dlen) + goto fail; + new_dlen += slen; if (eport != 0) { - *port_newdata = '-'; - port_newdata++; + if (new_dlen == maxlen) + goto fail; + newdata[new_dlen++] = '-'; /* Copy into IP packet */ - sprintf(stemp, "%d", ntohs(ealias)); - memcpy(port_newdata, stemp, strlen(stemp)); - port_newdata += strlen(stemp); + slen = snprintf(newdata + new_dlen, + maxlen - new_dlen, "%d", ntohs(ealias)); + if (slen < 0 || slen >= maxlen - new_dlen) + goto fail; + new_dlen += slen; } - *port_newdata = ';'; - port_newdata++; + if (new_dlen == maxlen) + goto fail; + newdata[new_dlen++] = ';'; } state++; break; @@ -380,20 +400,20 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, } if (!pkt_updated) - return (-1); - - memcpy(port_newdata, port_data, port_dlen); - port_newdata += port_dlen; - *port_newdata = '\0'; + goto fail; /* Create new packet */ - new_dlen = port_newdata - newdata; + if (new_dlen + port_dlen > maxlen) + goto fail; + memmove(data + new_dlen, port_data, port_dlen); memcpy(data, newdata, new_dlen); + new_dlen += port_dlen; + free(newdata); SetAckModified(lnk); tc = (struct tcphdr *)ip_next(pip); delta = GetDeltaSeqOut(tc->th_seq, lnk); - AddSeq(lnk, delta + new_dlen - dlen, pip->ip_hl, pip->ip_len, + AddSeq(lnk, delta + (int)(new_dlen - dlen), pip->ip_hl, pip->ip_len, tc->th_seq, tc->th_off); new_len = htons(hlen + new_dlen); @@ -407,6 +427,9 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, tc->th_sum = TcpChecksum(pip); #endif return (0); +fail: + free(newdata); + return (-1); } /* Support the protocol used by early versions of RealPlayer */ @@ -415,13 +438,13 @@ static int alias_pna_out(struct libalias *la, struct ip *pip, struct alias_link *lnk, char *data, - int dlen) + size_t dlen) { struct alias_link *pna_links; - u_short msg_id, msg_len; char *work; - u_short alias_port, port; struct tcphdr *tc; + u_short msg_id, msg_len; + u_short alias_port, port; work = data; work += 5; @@ -433,7 +456,7 @@ alias_pna_out(struct libalias *la, struct ip *pip, if (ntohs(msg_id) == 0) /* end of options */ return (0); - if ((ntohs(msg_id) == 1) || (ntohs(msg_id) == 7)) { + if (ntohs(msg_id) == 1 || ntohs(msg_id) == 7) { memcpy(&port, work, 2); pna_links = FindUdpTcpOut(la, pip->ip_src, GetDestAddress(lnk), port, 0, IPPROTO_UDP, 1); @@ -462,22 +485,23 @@ alias_pna_out(struct libalias *la, struct ip *pip, } static void -AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, int maxpacketsize) +AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, + size_t maxlen) { - int hlen, tlen, dlen; struct tcphdr *tc; char *data; const char *setup = "SETUP", *pna = "PNA", *str200 = "200"; const char *okstr = "OK", *client_port_str = "client_port"; const char *server_port_str = "server_port"; - int i, parseOk; - - (void)maxpacketsize; + size_t hlen, tlen, dlen; + size_t i; tc = (struct tcphdr *)ip_next(pip); hlen = (pip->ip_hl + tc->th_off) << 2; tlen = ntohs(pip->ip_len); dlen = tlen - hlen; + if (hlen > tlen || tlen > maxlen) + return; data = (char *)pip; data += hlen; @@ -485,13 +509,14 @@ AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, /* When aliasing a client, check for the SETUP request */ if ((ntohs(tc->th_dport) == RTSP_CONTROL_PORT_NUMBER_1) || (ntohs(tc->th_dport) == RTSP_CONTROL_PORT_NUMBER_2)) { - if (dlen >= (int)strlen(setup) && + if (dlen >= strlen(setup) && memcmp(data, setup, strlen(setup)) == 0) { - alias_rtsp_out(la, pip, lnk, data, client_port_str); + alias_rtsp_out(la, pip, lnk, data, maxlen, + client_port_str); return; } - if (dlen >= (int)strlen(pna) && + if (dlen >= strlen(pna) && memcmp(data, pna, strlen(pna)) == 0) alias_pna_out(la, pip, lnk, data, dlen); } else { @@ -499,24 +524,21 @@ AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, * When aliasing a server, check for the 200 reply * Accommodate varying number of blanks between 200 & OK */ - - if (dlen >= (int)strlen(str200)) { - for (parseOk = 0, i = 0; - i <= dlen - (int)strlen(str200); - i++) - if (memcmp(&data[i], str200, strlen(str200)) == 0) { - parseOk = 1; - break; - } - - if (parseOk) { - i += strlen(str200); /* skip string found */ - while (data[i] == ' ') /* skip blank(s) */ + if (dlen < strlen(str200) + 1 + strlen(okstr)) + return; + for (i = 0; i <= dlen - strlen(str200) - 1; i++) { + if (memcmp(&data[i], str200, strlen(str200)) == 0 && + data[i + strlen(str200)] == ' ') { + i += strlen(str200); /* skip 200 */ + while (i < dlen && data[i] == ' ') /* skip blank(s) */ i++; - - if ((dlen - i) >= (int)strlen(okstr)) - if (memcmp(&data[i], okstr, strlen(okstr)) == 0) - alias_rtsp_out(la, pip, lnk, data, server_port_str); + if (dlen - i >= strlen(okstr)) { + if (memcmp(&data[i], okstr, strlen(okstr)) == 0) { + alias_rtsp_out(la, pip, lnk, data, + maxlen, server_port_str); + break; + } + } } } } From nobody Tue Jun 30 17:20:58 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKl2fGnz6jYGp for ; Tue, 30 Jun 2026 17:20:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKk5kzGz3qyV for ; Tue, 30 Jun 2026 17:20:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840058; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JDgYOnDCRBnNdlUfcZrcpwdzzP1/nbgzWGSw16mAEDM=; b=THXiqv14+cLAPPfhtbSTj8ZFz6F7nO/1QeFusa7t0PgfSuhFI451WsasEP8hqtVuoekOJp vgK0uHgNrn/D20A5kyyEK6MJTsYFvYHUGZzCBMUi34Hn1ASBCGWKCZ+/Boq4CvdfSU4v7t 7tJhrBG9kP3cR8jnUHuqk58UXygN/HSsULX6flkDJQUYO9FbWTqm6pMpVNvoSK5OabEZdW 0LBKrcswskF57nznUfIdnLriOPquvuWOdylC6tRTNeKUFDHCnCOFOEvcVKW7f5stAj5dVl YP662Px061XyjdEPExpoNOMVfdTEHxbC6Hf/R+CW1h7CGvBMSl48RKjHL/VD/g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840058; a=rsa-sha256; cv=none; b=LDokEDh6Ykp18oZ4nrsclrkB2IYr1Ox4/6qfLRGMCHaTkPrr6CG5YJSjEKsoc7zbaizwJE v3txqkYev3NTIX0bI2e3In7xx/G/KSHHKXg5/C62MRI5Qecx0yo1mp5wgtzqYnWdK+Zcxe EexmGx5MjTd+Cf+WT1eo4kwMgol6mDSg8htEAt+LurXsWhGpF8j4qtPsWdyxCaZTgJtbiW SHHdc+/0rHjEoVo8kJVJrzHCfIplF48Pgh4HjdnDk6DJLheoqocfYi0dGHYP65BteVCnYC mRfmu3HkPJ2mvRYyDeXIs/OKTKrLBxktPzkS96WwKg5hOtm5M0veNwK1FvhPeA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840058; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JDgYOnDCRBnNdlUfcZrcpwdzzP1/nbgzWGSw16mAEDM=; b=bQ+jWMmaL5xF2dZ3jaYY21wmt4Qkq09cbSc53k2vH3KIcDM6kmzceeRJtu2uMhZhRfrlsU mGx+RwnimBL5pg82g6woMxp3yr76MiQ0iob9opNqBehXWSgzTErG4yMu6FyUPuS+q6WUCz bayvd3eMvkQdajBftb5aveeRVMWqMW/lhKGrHu00B8SshNI5176yaxSrptb/zCAtvcs4cz Z4xHw2FoI0t/RSUH8AkU27dJOQ6MR+IggAs3E7amxsHgSyl3sdPYH124D1UL0tBuHrXYeG bC7vN6vB3hTk+uQ7atQ29FWEpGpuhKt0Q1tJ3EpEZAfhZF6xQv2fEvPlXHQeFw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKk4V4DztPd for ; Tue, 30 Jun 2026 17:20:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45c41 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:58 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 0a7dd3d960c8 - releng/14.4 - tests/libalias: Add a regression test for an alias_smedia bug List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 0a7dd3d960c8f31112db30ed69f0503ed99f077f Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:58 +0000 Message-Id: <6a43fafa.45c41.50df1d30@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=0a7dd3d960c8f31112db30ed69f0503ed99f077f commit 0a7dd3d960c8f31112db30ed69f0503ed99f077f Author: Mark Johnston AuthorDate: 2026-06-22 17:25:56 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:30 +0000 tests/libalias: Add a regression test for an alias_smedia bug Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57747 --- tests/sys/netinet/libalias/Makefile | 4 ++ tests/sys/netinet/libalias/smedia.c | 74 +++++++++++++++++++++++++++++++++++++ 2 files changed, 78 insertions(+) diff --git a/tests/sys/netinet/libalias/Makefile b/tests/sys/netinet/libalias/Makefile index 20d904511538..5f83eaee9900 100644 --- a/tests/sys/netinet/libalias/Makefile +++ b/tests/sys/netinet/libalias/Makefile @@ -4,6 +4,10 @@ PACKAGE= tests TESTSDIR= ${TESTSBASE}/sys/netinet/libalias BINDIR= ${TESTSDIR} +PLAIN_TESTS_C+= smedia + +LIBADD.smedia+= sbuf + ATF_TESTS_C+= 1_instance \ 2_natout \ 3_natin \ diff --git a/tests/sys/netinet/libalias/smedia.c b/tests/sys/netinet/libalias/smedia.c new file mode 100644 index 000000000000..e181a7a538af --- /dev/null +++ b/tests/sys/netinet/libalias/smedia.c @@ -0,0 +1,74 @@ +/* + * Copyright (c) 2026 The FreeBSD Foundation + * + * This software was developed by Mark Johnston under sponsorship from + * the FreeBSD Foundation. + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +/* + * A minimal regression test for a buffer overflow in alias_rtsp_out(). + */ + +#include +#include + +#include +#include +#include +#include + +#include +#include + +#include + +int +main(void) +{ + uint8_t *packet; + struct ip ip; + struct tcphdr tcp; + struct sbuf sb; + struct libalias *la; + + sbuf_new(&sb, NULL, 0, SBUF_AUTOEXTEND); + sbuf_printf(&sb, "SETUP rtsp://example.com/media.mp4 RTSP/1.0\r\n"); + sbuf_printf(&sb, "CSeq: 1\r\n"); + sbuf_printf(&sb, "Transport: RTP/AVP;unicast;"); + for (int i = 0; i < 200; i++) + sbuf_printf(&sb, "client_port=%d-%d;", 2 * i, 2 * i + 1); + sbuf_printf(&sb, "\r\n\r\n"); + sbuf_finish(&sb); + + memset(&tcp, 0, sizeof(tcp)); + tcp.th_sport = htons(1234); + tcp.th_dport = htons(554); + tcp.th_off = 5; + + memset(&ip, 0, sizeof(ip)); + ip.ip_v = IPVERSION; + ip.ip_hl = sizeof(ip) / 4; + ip.ip_len = htons(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)); + ip.ip_id = htons(1); + ip.ip_ttl = 64; + ip.ip_p = IPPROTO_TCP; + ip.ip_src.s_addr = inet_addr("127.0.0.1"); + ip.ip_dst.s_addr = inet_addr("127.0.0.2"); + + packet = malloc(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)); + memcpy(packet, &ip, sizeof(ip)); + memcpy(packet + sizeof(ip), &tcp, sizeof(tcp)); + memcpy(packet + sizeof(ip) + sizeof(tcp), sbuf_data(&sb), + sbuf_len(&sb)); + + la = LibAliasInit(NULL); + LibAliasSetAddress(la, + (struct in_addr){.s_addr = inet_addr("127.0.0.1")}); + if (LibAliasOut(la, packet, sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)) != + PKT_ALIAS_OK) + return (1); + LibAliasUninit(la); + return (0); +} From nobody Tue Jun 30 17:20:59 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKm1b2yz6jYF5 for ; Tue, 30 Jun 2026 17:21:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKl6xSvz3rHL for ; Tue, 30 Jun 2026 17:20:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840060; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tRkJ/uqfKQ4GgdPcZslKCXttvm/wB50+3id77640VKc=; b=OQYhs90rU+uQmOL4Z7hZwJGsjYsJ8TO+giS+R9TGyeh/Y7+5B9BMJ655bUht3nfzVV8gOV 8lpCiFGMggnteVHGUaQMronmYN+tzeyY5cD8s6XP5pjNzOSXvV6M2c5WFIEhRW9Q4UcFt7 o9i471JTugvhzDEDLmX08zdBPRch3c0hAmciTt16xJrAoR7IlYukIxOaCUL5SniFlmL1Io 1xJV4mld/QGACyV3uLbNge/FT+caDoInsPb8Co/epNjto0muGAvMs6bQ97jogx9QX1PWnR sxVaec1Eo04YolYoVBfFtPFIleHiku8/LSpUF+ScMt8EGvppjbcCRyxPgHyksA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840060; a=rsa-sha256; cv=none; b=b61OZjuwTzl+Prso2hSLnjp6NkzmmoOSdZy9vkViJA2ZN5IcAsyesHjiPUCXS/ZooCTYhI VFpTw63odV2HP4AeRy+C5wbzpf7a0ooQ+NNLIAFYn22kxlf0mG37jrkVdnrgfpPQW4FxNL ayXpVK9Dms9yOXGFz+QjHcfA3/HiHlCbQJoKFoXx0fBIp7Rd3N3BtBnDeoNb2JY9p5pZpp 3I9IT6TLF0HrsGkGsoJyBzj4PPzhJClsphHA2xx4r75soLiA5DiDNQLDyf83m8zjELelI6 SdI6OSKTaS5u7QEcNqN0D2w1Q0vUDjTQQco8JGvEBPJgSLPxNXeWtVo6C/00KA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840060; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tRkJ/uqfKQ4GgdPcZslKCXttvm/wB50+3id77640VKc=; b=nXO+cz8sCJCBB9dPwGIii63W/4gB+W2xtwPgoWGR/Hzpnil8W3pnRKJ4N3pKRN8hz0ziOu NX292LFd3/UxwdHcA9Pztyhh9YfDws2AYsfPwRZqCE+AsfpuO/5KkwfvZmYvXMStAPhP8S AIuxKlX8VdGj/YcqSLTqrI2mQB8X+PJxnmNZkjKb5HMTqgWdmb8DdXI09g3oO3SdwFF2+j i+q3v0vIPXa60GQyg7u68JS+75PZv9k7vSb41rhZpKSBQwdMvVgBzghdm7dthBwXHBstYW 3xlTSuDIjqBZyEyyLfoCJQL+PUzyTMSo+WzdIeKmALq3FlOEcc0mO07iP/otGw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKl5JYZzsyy for ; Tue, 30 Jun 2026 17:20:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45b8e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 9a6bccc57c68 - releng/14.4 - unlinkat: Pass flags down to the work functions List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 9a6bccc57c68b7bd6fed50720d7a4aa1a4ef9d6c Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:59 +0000 Message-Id: <6a43fafb.45b8e.34b5f46e@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=9a6bccc57c68b7bd6fed50720d7a4aa1a4ef9d6c commit 9a6bccc57c68b7bd6fed50720d7a4aa1a4ef9d6c Author: Mark Johnston AuthorDate: 2026-06-23 20:43:53 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:30 +0000 unlinkat: Pass flags down to the work functions The unlinkat(2) and funlinkat(2) system calls were ignoring AT_RESOLVE_BENEATH. Also pass pathseg through instead of assuming it's UIO_USERSPACE. Add some tests which make sure that AT_RESOLVE_BENEATH is handled properly by various system calls. Approved by: so Security: FreeBSD-SA-26:42.unlinkat Security: CVE-2026-49421 Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57790 --- sys/kern/vfs_syscalls.c | 11 +- tests/sys/kern/Makefile | 1 + tests/sys/kern/resolve_beneath_test.c | 220 ++++++++++++++++++++++++++++++++++ 3 files changed, 227 insertions(+), 5 deletions(-) diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index 5c59d4dda2fd..de2261256875 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -1889,16 +1889,17 @@ sys_unlink(struct thread *td, struct unlink_args *uap) static int kern_funlinkat_ex(struct thread *td, int dfd, const char *path, int fd, - int flag, enum uio_seg pathseg, ino_t oldinum) + int flags, enum uio_seg pathseg, ino_t oldinum) { - if ((flag & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) + if ((flags & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) return (EINVAL); - if ((flag & AT_REMOVEDIR) != 0) - return (kern_frmdirat(td, dfd, path, fd, UIO_USERSPACE, 0)); + if ((flags & AT_REMOVEDIR) != 0) + return (kern_frmdirat(td, dfd, path, fd, pathseg, + flags & ~AT_REMOVEDIR)); - return (kern_funlinkat(td, dfd, path, fd, UIO_USERSPACE, 0, 0)); + return (kern_funlinkat(td, dfd, path, fd, pathseg, flags, 0)); } #ifndef _SYS_SYSPROTO_H_ diff --git a/tests/sys/kern/Makefile b/tests/sys/kern/Makefile index 67cdf19f6d6e..1c41c62b43a5 100644 --- a/tests/sys/kern/Makefile +++ b/tests/sys/kern/Makefile @@ -32,6 +32,7 @@ ATF_TESTS_C+= procdesc ATF_TESTS_C+= ptrace_test TEST_METADATA.ptrace_test+= timeout="15" ATF_TESTS_C+= reaper +ATF_TESTS_C+= resolve_beneath_test ATF_TESTS_C+= sched_affinity ATF_TESTS_C+= sigaltstack ATF_TESTS_C+= sigwait diff --git a/tests/sys/kern/resolve_beneath_test.c b/tests/sys/kern/resolve_beneath_test.c new file mode 100644 index 000000000000..b83926038ded --- /dev/null +++ b/tests/sys/kern/resolve_beneath_test.c @@ -0,0 +1,220 @@ +/* + * Copyright (c) 2026 The FreeBSD Foundation + * + * This software was written by Mark Johnston under sponsorship from + * the FreeBSD Foundation. + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +#include +#include + +#include +#include +#include + +#include + +/* + * Verify that AT_RESOLVE_BENEATH is respected by various system calls. + */ + +static int +setup(void) +{ + int fd, tfd; + + ATF_REQUIRE_EQ(0, mkdir("base", 0755)); + ATF_REQUIRE_EQ(0, mkdir("outside", 0755)); + ATF_REQUIRE((tfd = open("outside/target", O_CREAT | O_WRONLY, 0644)) >= + 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("outside/dir", 0755)); + ATF_REQUIRE((tfd = open("base/file", O_CREAT | O_WRONLY, 0644)) >= 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("base/subdir", 0755)); + ATF_REQUIRE((fd = open("base", O_DIRECTORY | O_RDONLY)) >= 0); + return (fd); +} + +ATF_TC_WITHOUT_HEAD(faccessat_beneath); +ATF_TC_BODY(faccessat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + faccessat(fd, "file", F_OK, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + faccessat(fd, "../outside/target", F_OK, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(chflagsat_beneath); +ATF_TC_BODY(chflagsat_beneath, tc) +{ + int fd, ret; + + fd = setup(); + ret = chflagsat(fd, "file", UF_NODUMP, AT_RESOLVE_BENEATH); + if (ret != 0) + ATF_REQUIRE_EQ(EOPNOTSUPP, errno); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + chflagsat(fd, "../outside/target", UF_NODUMP, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchmodat_beneath); +ATF_TC_BODY(fchmodat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchmodat(fd, "file", 0644, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchmodat(fd, "../outside/target", 0644, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchownat_beneath); +ATF_TC_BODY(fchownat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchownat(fd, "file", -1, -1, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchownat(fd, "../outside/target", 0, 0, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(utimensat_beneath); +ATF_TC_BODY(utimensat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + utimensat(fd, "file", NULL, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + utimensat(fd, "../outside/target", NULL, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(linkat_beneath); +ATF_TC_BODY(linkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + linkat(fd, "file", fd, "hardlink", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + linkat(fd, "../outside/target", fd, "hardlink2", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_beneath); +ATF_TC_BODY(unlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "file", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/target", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_rmdir_beneath); +ATF_TC_BODY(unlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "subdir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/dir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_beneath); +ATF_TC_BODY(funlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "file", FD_NONE, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/target", FD_NONE, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_rmdir_beneath); +ATF_TC_BODY(funlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, mkdir("base/subdir2", 0755)); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "subdir2", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/dir", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC(getfhat_beneath); +ATF_TC_HEAD(getfhat_beneath, tc) +{ + atf_tc_set_md_var(tc, "require.user", "root"); +} +ATF_TC_BODY(getfhat_beneath, tc) +{ + fhandle_t fh; + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + getfhat(fd, "file", &fh, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + getfhat(fd, "../outside/target", &fh, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TP_ADD_TCS(tp) +{ + ATF_TP_ADD_TC(tp, faccessat_beneath); + ATF_TP_ADD_TC(tp, chflagsat_beneath); + ATF_TP_ADD_TC(tp, fchmodat_beneath); + ATF_TP_ADD_TC(tp, fchownat_beneath); + ATF_TP_ADD_TC(tp, utimensat_beneath); + ATF_TP_ADD_TC(tp, linkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, funlinkat_beneath); + ATF_TP_ADD_TC(tp, funlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, getfhat_beneath); + return (atf_no_error()); +} From nobody Tue Jun 30 17:21:01 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKp3p0xz6jYMX for ; Tue, 30 Jun 2026 17:21:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKp0pHyz3r4h for ; Tue, 30 Jun 2026 17:21:02 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840062; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ABUAD07zjWQRpK3PcJ422n0zl09NGrCnKHhyrDDrPOc=; b=J72ZjUaRr9yVHh9iYrlWI5dzbBh6WVJw0ThXI7f/wzNf18+8IgqNuIJ4+NtJRBC7mhYF3Z bFaYcBWbQmB7H0/PrSHjcKR7b0cy/424zkD8QsKznNJ1opk3eSYrBd0WjDNBPw1lcxr76E wrsr5yYWXl7ueuSaJZ7TiyOId1RqsSRPtTe++58ka6QxLdRuTCX2EIkBs+ZQy5UPXXdHrY WWIEHvOoC7reSJ56kTtu7TYO42UdnX2fe14ekJo2kTLWJH4COjc+OECSW5MxMKHHV+A5R2 2kH+ytpnos2s6lqyhSFTv4LbPq2i3zv1/qKb90E00uVZHJockQJ3zbgnsFYd3Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840062; a=rsa-sha256; cv=none; b=ZZrvyNdqURjPR8cfqvsGWuFAMrLZ92WmZ7Xt9SCp/vJCHO6Ztu2jVJGlF20Fhs0QfIXhrb WlWGq6Q7QjCr3sYopQzA+S6UQiunTReAIHAIdFWQA/8cpYQs3tbl92Ug+R+nOAiCFpg4rX MnRkucAQBE+6ffiePVE6VDO8QwuEAUty/Y5dV1GKgv1crgnA6YNTY4/p2ZTqxTuzGJDIKx cM0vVnzLCpwJGmKkMwBMRJKj9+EvC2iFakQzhGMS6/62BovYf+lrIiVFd+XZwt2Tyv86pj atp9Jzd97QwfX+gnjykTQf3Rs3x1fzon22df/orcZqQ5io8TT8k+b8DtTqunYQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840062; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ABUAD07zjWQRpK3PcJ422n0zl09NGrCnKHhyrDDrPOc=; b=fCJ38yPTqwPzX2SVqFUwjffoJ/fPnMNfng/15YyLihIVm++voIfyU9tV0aMOdmZ2yJZsu8 xyXhGI/44AmMGa+DfcQ3Shzh0bPdxviOuVwjlfSRRpWDMrm6nK+wvuvlCTm6HbvLnqEaVg GNvKIB1FfyxImBqRDVvL1CS3ZEWFvWwc8P/zfZ4nsWMf622xchB3u6ayybq3fX9H2qopkw Z2xWMAmwwt6twkYnd9RjHmKu2KJ7tWHI8zD74erle22h67G2NOZcRrllogj+qD0L0liOmD x+nb/WF/63PcI1qGoy17ZBYzhlbQThmbZkrfxOjoe+HNpBwMB7MWk50MRz/Kmw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKn6jfQztPf for ; Tue, 30 Jun 2026 17:21:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4475c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:01 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 1c49551def57 - releng/14.4 - posixshm: Disallow fspacectl() on largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 1c49551def57bb91348bcf737e6388d018d76eb7 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:01 +0000 Message-Id: <6a43fafd.4475c.1f02c2b9@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=1c49551def57bb91348bcf737e6388d018d76eb7 commit 1c49551def57bb91348bcf737e6388d018d76eb7 Author: Mark Johnston AuthorDate: 2026-06-24 19:56:07 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:30 +0000 posixshm: Disallow fspacectl() on largepage objects As with truncation, the operation isn't supported, but nothing prevented it. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57830 --- sys/kern/uipc_shm.c | 5 ++++- tests/sys/posixshm/posixshm_test.c | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index a07dd097f7b8..1c63c8bd3f1b 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -2096,11 +2096,14 @@ shm_fspacectl(struct file *fp, int cmd, off_t *offset, off_t *length, int flags, ("shm_fspacectl: non-zero flags")); KASSERT(*offset >= 0 && *length > 0 && *length <= OFF_MAX - *offset, ("shm_fspacectl: offset/length overflow or underflow")); - error = EINVAL; + shmfd = fp->f_data; off = *offset; len = *length; + if (shm_largepage(shmfd)) + return (ENOTSUP); + rl_cookie = shm_rangelock_wlock(shmfd, off, off + len); switch (cmd) { case SPACECTL_DEALLOC: diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index 314bf5e3ff5b..dfcb5a72fefb 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -1380,6 +1380,27 @@ ATF_TC_BODY(largepage_config, tc) ATF_REQUIRE(close(fd) == 0); } +ATF_TC_WITHOUT_HEAD(largepage_fspacectl); +ATF_TC_BODY(largepage_fspacectl, tc) +{ + struct spacectl_range range; + size_t ps[MAXPAGESIZES]; + int fd, pscnt; + + pscnt = pagesizes(ps); + + for (int i = 1; i < pscnt; i++) { + fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, ps[i]); + + range.r_offset = 0; + range.r_len = ps[i]; + ATF_REQUIRE_ERRNO(ENOTSUP, + fspacectl(fd, SPACECTL_DEALLOC, &range, 0, &range) == -1); + + ATF_REQUIRE(close(fd) == 0); + } +} + ATF_TC_WITHOUT_HEAD(largepage_mmap); ATF_TC_BODY(largepage_mmap, tc) { @@ -2168,6 +2189,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, mmap_prot); ATF_TP_ADD_TC(tp, largepage_basic); ATF_TP_ADD_TC(tp, largepage_config); + ATF_TP_ADD_TC(tp, largepage_fspacectl); ATF_TP_ADD_TC(tp, largepage_mmap); ATF_TP_ADD_TC(tp, largepage_munmap); ATF_TP_ADD_TC(tp, largepage_madvise); From nobody Tue Jun 30 17:21:00 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKn3lyQz6jYGq for ; Tue, 30 Jun 2026 17:21:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKn0Lrmz3rFQ for ; Tue, 30 Jun 2026 17:21:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840061; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=o7RDYVaBugVmifiFNK1qlSD//tBz9Dp/TVOxtNZ5C5o=; b=QjXKctxSG/+uqMq08v41mIraw5z5wSxvxB/iR6uD3POpq6TfavJOnnW8dADZungMTvMP41 /IHdGhmYdNuCkfki749lyfDW2MINTEWN8m/L2YbTdLkAox1vUvK3IE66rOyun9RPLMJ8Iy caYtj5JdFglbFdMr8q4Ta08NJ1UDyTg5VMsUqpOGKbeA0hl/m/qJE/B7Vg0Rw9qQTWELN8 1i5YH1pWGMaXiwd9MJ1+eMxtL9HTQQ+ZAd6jpRaG9OjthrwuocyDBzHuGZmB9C42XiMPg0 bBc69BUjLTgW8eBuXGA2LF51FB7dxviycR9AwJPSQph3Flq+iLe44kLEOURSvg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840061; a=rsa-sha256; cv=none; b=KYpOjfsRYJTjuevjDtapIWh15ztfmWFAfztw3AlsMIF/jf1gzsvtxTJY5fHNk/ATsV1pLC 9++PAjn1HGm14kvrAA2E2ZThxhjvI8uCi9sEJMtNfFPh+44SNjgoa0tMwWlPBdrwEdQ/ZA MQlXYifZ07b9NYdEXCEuQKKuU3bghOAgO8Bcv+j8wWN2zqvOs6JNov/7hRS+A46ZI80hqK 4mJ5b14NOyBT57mq0Ajb6dKTGLyUSpHASN+iCtXYz20JD5HFO0IS9UKARbiZmevxrpnzt/ FWLhPpOtLplyJtUTOj8XTxNVtxELkLz5ImNv+54gSK5e4gsuVZZHrg3teqkWIA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840061; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=o7RDYVaBugVmifiFNK1qlSD//tBz9Dp/TVOxtNZ5C5o=; b=xJ6bNYaWKHv2SHV9x2zae0y2KdI/wWL4RsMqicg4fLWcy9dB515kqPxm3oqZDTzQ8yubBL xxjX5cSkwX1pL4xDQgPA4FyYSni+w9A31cQokyIskQ4LcrdApyGTCS8oIHLdRo0AfriZz1 N91oSZZQo+SiX50zaBzAzia9ax8lPzOUwVWcg4oR7uiztgZa7KlLFNRL7lv7FqZ1+Tq59/ 6pbhODwt/mthFpkVFXGibh/bpUmkdNF0lBxskjUebJlM1JPZaLxFbvhC51HQaju7v9Puo1 QudIKpN1uzaeIFI18JhiHB4V+dSzhQRUVeGeit9Z764ZdDPxXiV49rsGmJkJTA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKm6CnTzt00 for ; Tue, 30 Jun 2026 17:21:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45b92 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:00 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 800acf75eb80 - releng/14.4 - rack: Reload the TCP stack PCB after reacquiring the inpcb lock List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 800acf75eb80d299fd8ba1e151050da58d481232 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:00 +0000 Message-Id: <6a43fafc.45b92.cc63fef@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=800acf75eb80d299fd8ba1e151050da58d481232 commit 800acf75eb80d299fd8ba1e151050da58d481232 Author: Mark Johnston AuthorDate: 2026-06-23 21:46:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:30 +0000 rack: Reload the TCP stack PCB after reacquiring the inpcb lock Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791 --- sys/netinet/tcp_stacks/rack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index 9b35fbb7797b..41a57eeedfde 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -23936,6 +23936,7 @@ process_opt: INP_WUNLOCK(inp); return (ENOPROTOOPT); } + rack = (struct tcp_rack *)tp->t_fb_ptr; if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_HYBRID_PACING) && From nobody Tue Jun 30 17:21:03 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKq5fLGz6jYMb for ; Tue, 30 Jun 2026 17:21:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKq1X3mz3rNR for ; Tue, 30 Jun 2026 17:21:03 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840063; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KvduvR5MBDePnrZCpnV5d38+bOD1yolNeFiyoIRhFY8=; b=wyjovjx8RbuNDA3vhpgcc1dAcPwTzoRT+ReMkoDqs1BxzG8mJlke063ke4sISOc9N362ML CSNszml10VnxNPKZxbPo4s4cKUpSXnqXWSUO6BY7Dr04SiWIOwJFcgCj6650dfm3whcngq fUdr9/vvgbXgcHzkY21Mz/5ixE2me2eG/XIxmoFOyVsHJBZmCiIkTJhD8g01aqB4fjtiEQ vvE/1wqwL96BjZFo0qGZNq5c0+ggg8Vn7uP0AZCHdeg9Tw9TJbq5QTpaP/Oph5ViWxl1HN IafjLrEoOstz1UPerATgZ5acsINNGthIdKAGwO3I6YtQVxw4kHHm6JhZLnxTPg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840063; a=rsa-sha256; cv=none; b=MJx7rTHHEcYJJoLKUtjtOTN+KImEnYceQFpkVA2yA0ojxb+D7QaaFdMVKGJ5E1RD23KZCC P6m9896TZZ3DRlMU+L+oK/3d9Ywvg60j5HHmFRES477Bfo85i1jg6oZnLyp3ikBzlMtcVQ g5AC8ixYbn/nDQsRZ4xgr54ejM7smDU/vHlsqWp9yrcTQfEXsIRMg2HKwSHsvPQDyqj353 27PRISAF68xr5VoTh5DP2fG5noPpQInBJfZsNaByXlFvMNc3h7jtms8ePnr7QfJiMMU7KD NljIfpmaFGlrcs+x/qqg2qjpxUqK4d3m1F7NJXlhu8zphMBNQNMXlo0DffTqdw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840063; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KvduvR5MBDePnrZCpnV5d38+bOD1yolNeFiyoIRhFY8=; b=bhEa3Yog5s71BjiJlxrT2FzFTITJykqloFtT7iRPXExDpUp4f75wfvHx/xJ8FWQse5oF/d RSnLPuG9151L5IhTqX89d7L+WHSuomj0knkqKACJT7CmK9NFVxLtoTCnVu85wfhF5Dltlf ixHMYX9WWR2WfZmCCpB5kOqqHjLhgg9CfFFMelIoJ3y1uzjrmeiwFFQkTYO5P4WrECJVa3 OZLQFmWiMbXxfO3pprXOUFnE1/J8fUzdU3MBs6O3y4n4kDem1914Y4aoVMj0XIm72XzEq7 weyN1W9gI2vXeC0ToTiq3NwP+UI7y3yAOM/2ycilrxdMN/rugpUOUATGy0uauA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKq0PT7ztBS for ; Tue, 30 Jun 2026 17:21:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44cec by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:03 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 9c06b54ab6bc - releng/14.4 - posixshm: Disallow truncation of largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 9c06b54ab6bcffa3a803114d606a2f176de1a2c8 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:03 +0000 Message-Id: <6a43faff.44cec.282e3cca@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=9c06b54ab6bcffa3a803114d606a2f176de1a2c8 commit 9c06b54ab6bcffa3a803114d606a2f176de1a2c8 Author: Mark Johnston AuthorDate: 2026-06-23 22:47:02 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:30 +0000 posixshm: Disallow truncation of largepage objects We correctly handled ftruncate(), but not open(O_TRUNC). Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57831 --- sys/kern/uipc_shm.c | 8 +++----- tests/sys/posixshm/posixshm_test.c | 38 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 5 deletions(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index 1c63c8bd3f1b..8542510299a9 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -824,7 +824,7 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) vm_pindex_t oldobjsz __unused; int aflags, error, i, psind, try; - KASSERT(length >= 0, ("shm_dotruncate: length < 0")); + KASSERT(length >= 0, ("shm_dotruncate_largepage: length < 0")); object = shmfd->shm_object; VM_OBJECT_ASSERT_WLOCKED(object); rangelock_cookie_assert(rl_cookie, RA_WLOCKED); @@ -1345,15 +1345,13 @@ kern_shm_open2(struct thread *td, const char *userpath, int flags, mode_t mode, if (error == 0 && (flags & (O_ACCMODE | O_TRUNC)) == (O_RDWR | O_TRUNC)) { - VM_OBJECT_WLOCK(shmfd->shm_object); #ifdef MAC error = mac_posixshm_check_truncate( - td->td_ucred, fp->f_cred, shmfd); + td->td_ucred, fp->f_cred, shmfd); if (error == 0) #endif - error = shm_dotruncate_locked(shmfd, 0, + error = shm_dotruncate_cookie(shmfd, 0, rl_cookie); - VM_OBJECT_WUNLOCK(shmfd->shm_object); } if (error == 0) { /* diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index dfcb5a72fefb..c792a85de9e3 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -2151,6 +2151,43 @@ ATF_TC_BODY(largepage_reopen, tc) "close failed; errno=%d", errno); } +ATF_TC_WITHOUT_HEAD(largepage_truncate); +ATF_TC_BODY(largepage_truncate, tc) +{ + size_t ps[MAXPAGESIZES]; + int fd, psind; + + (void)pagesizes(ps); + psind = 1; + + gen_test_path(); + fd = shm_create_largepage(test_path, O_CREAT | O_RDWR, psind, + SHM_LARGEPAGE_ALLOC_DEFAULT, 0600); + if (fd < 0 && errno == ENOTTY) + atf_tc_skip("no large page support"); + ATF_REQUIRE_MSG(fd >= 0, "shm_create_largepage failed; error=%d", errno); + + ATF_REQUIRE_MSG(ftruncate(fd, ps[psind]) == 0, + "ftruncate failed; error=%d", errno); + + ATF_REQUIRE_MSG(close(fd) == 0, "close failed; error=%d", errno); + + fd = shm_open(test_path, O_RDWR | O_TRUNC, 0); + ATF_REQUIRE_MSG(fd == -1, "shm_open(O_TRUNC) should have failed"); + ATF_REQUIRE_ERRNO(ENOTSUP, fd == -1); + + fd = shm_open(test_path, O_RDWR, 0); + ATF_REQUIRE_MSG(fd >= 0, "shm_open failed; error=%d", errno); + + ATF_REQUIRE_MSG(ftruncate(fd, ps[psind]) == 0, + "ftruncate to same size failed; error=%d", errno); + + ATF_REQUIRE_MSG(shm_unlink(test_path) == 0, + "shm_unlink failed; errno=%d", errno); + ATF_REQUIRE_MSG(close(fd) == 0, + "close failed; errno=%d", errno); +} + ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TC(tp, remap_object); @@ -2202,6 +2239,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, largepage_pkru); #endif ATF_TP_ADD_TC(tp, largepage_reopen); + ATF_TP_ADD_TC(tp, largepage_truncate); return (atf_no_error()); } From nobody Tue Jun 30 17:21:04 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKr5Tmtz6jYK7 for ; Tue, 30 Jun 2026 17:21:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKr2Hwqz3rNX for ; Tue, 30 Jun 2026 17:21:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840064; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Dghh36/3eNykcbm/gZ9gew+hAxfdL6ADrFF2F8UoZlo=; b=A4Ejar0ghWfxNUzPkRRf5BHLSPJB7z+7LXonMEcI0pDFyO/Bl5Q1zWXcmsZ+m2affMeN+8 sxv+sx3orwYsE/9YgUnoYXTuqjJh3PC0svW7kHoZxYAH0WrsXVaHDF6pta/+xCzRT3Thrn Vh+orB5fVLmDz1MWz8kRxNtGI+fLAWkBJ955JeqsF+yX3iFQVlHpg/SYxABe1mjM9uJQnC EIICdFWJvThs77c23RZEAgzqnlLklyLR4b/1Psn16bHPA3my0Upex0hnXtYnnUdb6X27+E yzt/F+lsBjn6mRiJZI7koVT9s1/i7y9pHD1lUXkdRO8ddmRJOv0D2rQQxE0gNQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840064; a=rsa-sha256; cv=none; b=orwreQiOM6HPHGKNd4nxdj72oqQsfrXJlI0W2PSF+llCZoTAzrNDVA5ybok5VKtOzYKTIQ h4tndjXa/rEZUIwyeFv5Cw6tqYt+WuJbgNx6hQd46XkiP6RKpkkYUpVEnvSSJIUOUQp9AB oXX7zZINHavLgI0Rjty9Hnd4IXFNQ1AQos5EeBEOS1nRMGJiRV7tr00+7pbE9kI3fOWNKy JgsWFdq1mUI2XIdAmPl3iwhLG6M7h74xXQ+zSZesceajH8G2al1KcG/QcobWe7byoToXAW 5cdQXrFBv/jEkjOlZFbbFSVQKqhg+RBOEh8V+GRM+r7rfPsaMvO9n1SX6GCekw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840064; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Dghh36/3eNykcbm/gZ9gew+hAxfdL6ADrFF2F8UoZlo=; b=OH7684fmPkSGeLC5Wu7aRf+dCYN2PdwCWViN4mxDH3Qn+SLiJnVmiXs5kVJjfwxyNvwUJ1 2hiVXv80YoOWb7hAdk6mOIT8LUPl/8xj6Fl13J6GCW4pr+uItU5dv3Qx2rXf/0yrHxayzF eN91OdZSXuDVeWpdgFHX4P0Mv23nonPC4qh39oWMH/zMSAd5UuNVKr3ztsnV1kihWnSIHa M6xMmOxb7vBCrO/4mV5HzZSgCUDTj012f8UDdDJFHEwXSJJEkS+W0khPNdj+B1AlNRm5Uk QA8f7sS9VYfQqiZmwDYFB5P6/0vVE69trqkOB3BnGL4gT2PEshIP+gFSuDxTog== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKr1FspztDj for ; Tue, 30 Jun 2026 17:21:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44fb2 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:04 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 0848cdea83fd - releng/14.4 - posixshm: Fix handling of sendfile() with largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 0848cdea83fd46a5f23f813e3069b11df31a7233 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:04 +0000 Message-Id: <6a43fb00.44fb2.7ad2ccd0@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=0848cdea83fd46a5f23f813e3069b11df31a7233 commit 0848cdea83fd46a5f23f813e3069b11df31a7233 Author: Mark Johnston AuthorDate: 2026-06-24 19:57:00 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:30 +0000 posixshm: Fix handling of sendfile() with largepage objects sendfile(2) can transmit POSIX shared memory objects. Typically it will look up and wire each page before sending it to a socket; once transmission is complete, the page is unwired and typically released back into the page queues. sendfile() has an advisory flag, SF_NOCACHE, which means, "try to free the page once transmission is complete." This is implemented in vm_page_release(), which expects to operate on managed pages. Pages belonging a largepage object are de-facto wired not explicitly so. Thus, vm_page_release() will unwire and, having found no additional references, free the page. Because mappings of largepage objects are unmanaged, userspace can still access the now freed page. Fix the problem by explicitly wiring largepage pages. Make the VM object destructor responsible for unwiring and freeing them. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49427 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57832 --- sys/kern/uipc_shm.c | 19 ++++++-- sys/vm/vm_page.c | 23 +++++----- tests/sys/posixshm/posixshm_test.c | 89 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 118 insertions(+), 13 deletions(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index 8542510299a9..937784e5e860 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -323,6 +323,7 @@ static void shm_largepage_phys_ctor(vm_object_t object, vm_prot_t prot, vm_ooffset_t foff, struct ucred *cred) { + object->flags |= OBJ_PG_DTOR; } static void @@ -330,11 +331,24 @@ shm_largepage_phys_dtor(vm_object_t object) { int psind; + VM_OBJECT_ASSERT_WLOCKED(object); + psind = object->un_pager.phys.data_val; if (psind != 0) { + vm_page_t m, mtmp; + bool removed __diagused; + +restart: + TAILQ_FOREACH_SAFE(m, &object->memq, listq, mtmp) { + if (!vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL)) { + goto restart; + } + removed = vm_page_remove(m); + KASSERT(!removed, ("%s: page %p not wired", __func__, m)); + vm_page_unwire(m, PQ_NONE); + } atomic_subtract_long(&count_largepages[psind], object->size / (pagesizes[psind] / PAGE_SIZE)); - vm_wire_sub(object->size); } else { KASSERT(object->size == 0, ("largepage phys obj %p not initialized bit size %#jx > 0", @@ -856,7 +870,7 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) if ((shmfd->shm_seals & F_SEAL_GROW) != 0) return (EPERM); - aflags = VM_ALLOC_NORMAL | VM_ALLOC_ZERO; + aflags = VM_ALLOC_NORMAL | VM_ALLOC_ZERO | VM_ALLOC_WIRED; if (shmfd->shm_lp_alloc_policy == SHM_LARGEPAGE_ALLOC_NOWAIT) aflags |= VM_ALLOC_WAITFAIL; try = 0; @@ -904,7 +918,6 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) object->size += OFF_TO_IDX(pagesizes[psind]); shmfd->shm_size += pagesizes[psind]; atomic_add_long(&count_largepages[psind], 1); - vm_wire_add(atop(pagesizes[psind])); } return (0); } diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c index 178b104ab95f..284895658651 100644 --- a/sys/vm/vm_page.c +++ b/sys/vm/vm_page.c @@ -4121,6 +4121,9 @@ vm_page_unwire_managed(vm_page_t m, uint8_t nqueue, bool noreuse) { u_int old; + KASSERT(nqueue < PQ_COUNT, + ("vm_page_unwire: invalid queue %u request for page %p", + nqueue, m)); KASSERT((m->oflags & VPO_UNMANAGED) == 0, ("%s: page %p is unmanaged", __func__, m)); @@ -4179,17 +4182,15 @@ vm_page_unwire_managed(vm_page_t m, uint8_t nqueue, bool noreuse) void vm_page_unwire(vm_page_t m, uint8_t nqueue) { - - KASSERT(nqueue < PQ_COUNT, - ("vm_page_unwire: invalid queue %u request for page %p", - nqueue, m)); + KASSERT(nqueue < PQ_COUNT || nqueue == PQ_NONE, + ("%s: invalid queue %u request for page %p", __func__, nqueue, m)); if ((m->oflags & VPO_UNMANAGED) != 0) { if (vm_page_unwire_noq(m) && m->ref_count == 0) vm_page_free(m); - return; + } else { + vm_page_unwire_managed(m, nqueue, false); } - vm_page_unwire_managed(m, nqueue, false); } /* @@ -4363,13 +4364,15 @@ vm_page_release_toq(vm_page_t m, uint8_t nqueue, const bool noreuse) void vm_page_release(vm_page_t m, int flags) { - vm_object_t object; - - KASSERT((m->oflags & VPO_UNMANAGED) == 0, - ("vm_page_release: page %p is unmanaged", m)); + if ((m->oflags & VPO_UNMANAGED) != 0) { + vm_page_unwire(m, PQ_NONE); + return; + } if ((flags & VPR_TRYFREE) != 0) { for (;;) { + vm_object_t object; + object = atomic_load_ptr(&m->object); if (object == NULL) break; diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index c792a85de9e3..dccc5add12a9 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -34,6 +34,7 @@ #include #include #include +#include #include #include #include @@ -2151,6 +2152,93 @@ ATF_TC_BODY(largepage_reopen, tc) "close failed; errno=%d", errno); } +static unsigned char +largepage_sendfile_expected(size_t off) +{ + + return ((unsigned char)(off * 131 + (off >> 8))); +} + +ATF_TC_WITHOUT_HEAD(largepage_sendfile); +ATF_TC_BODY(largepage_sendfile, tc) +{ + static const int flags[] = { 0, SF_NOCACHE }; + char *addr; + off_t sbytes; + size_t ps[MAXPAGESIZES]; + int error, fd, pscnt, sd[2], status; + pid_t child; + + pscnt = pagesizes(ps); + + for (int i = 1; i < pscnt; i++) { + for (int fi = 0; fi < (int)nitems(flags); fi++) { + fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, + ps[i]); + addr = mmap(NULL, ps[i], PROT_READ | PROT_WRITE, + MAP_SHARED, fd, 0); + ATF_REQUIRE_MSG(addr != MAP_FAILED, + "mmap(%zu bytes) failed; error=%d", ps[i], errno); + + /* Fill with a verifiable pattern. */ + for (size_t j = 0; j < ps[i]; j++) + addr[j] = largepage_sendfile_expected(j); + + ATF_REQUIRE(socketpair(PF_LOCAL, SOCK_STREAM, 0, + sd) == 0); + + child = fork(); + ATF_REQUIRE_MSG(child != -1, + "fork() failed; error=%d", errno); + if (child == 0) { + char buf[BUFSIZ]; + ssize_t len; + size_t off, resid; + + (void)close(sd[0]); + off = 0; + for (resid = ps[i]; resid > 0; resid -= len) { + len = read(sd[1], buf, sizeof(buf)); + if (len <= 0) + _exit(1); + for (ssize_t k = 0; k < len; k++) { + if ((unsigned char)buf[k] != + largepage_sendfile_expected( + off + k)) + _exit(2); + } + off += len; + } + _exit(0); + } + ATF_REQUIRE(close(sd[1]) == 0); + + sbytes = 0; + error = sendfile(fd, sd[0], 0, ps[i], NULL, &sbytes, + flags[fi]); + ATF_REQUIRE_MSG(error == 0, + "sendfile() failed; error=%d flags=%#x", + errno, flags[fi]); + ATF_REQUIRE_MSG(sbytes == (off_t)ps[i], + "sendfile() short; sbytes=%jd expected=%zu flags=%#x", + (intmax_t)sbytes, ps[i], flags[fi]); + + ATF_REQUIRE(close(sd[0]) == 0); + + ATF_REQUIRE_MSG(waitpid(child, &status, 0) == child, + "waitpid() failed; error=%d", errno); + ATF_REQUIRE_MSG(WIFEXITED(status), + "child killed by signal %d", WTERMSIG(status)); + ATF_REQUIRE_MSG(WEXITSTATUS(status) == 0, + "child exited with status %d (flags=%#x)", + WEXITSTATUS(status), flags[fi]); + + ATF_REQUIRE(munmap(addr, ps[i]) == 0); + ATF_REQUIRE(close(fd) == 0); + } + } +} + ATF_TC_WITHOUT_HEAD(largepage_truncate); ATF_TC_BODY(largepage_truncate, tc) { @@ -2239,6 +2327,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, largepage_pkru); #endif ATF_TP_ADD_TC(tp, largepage_reopen); + ATF_TP_ADD_TC(tp, largepage_sendfile); ATF_TP_ADD_TC(tp, largepage_truncate); return (atf_no_error()); From nobody Tue Jun 30 17:21:05 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKs4xQZz6jYFL for ; Tue, 30 Jun 2026 17:21:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKs2jTmz3rMK for ; Tue, 30 Jun 2026 17:21:05 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840065; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ciXXa/QL2KQVS8/TEemW5x6B7MQ2eF39vOzVT86ihg4=; b=vlwufaOuArUrQdxJUdBJnOyB+zftxKwz/INR2Bq7PBXdwxJaLjgvZUYtnF6/lZPLMBeuJO +1bl44gUKx0Z0R4bchmZUT0yDKi3s1MwXsF9O42camh/94NcE2sSkN837nmXwEaU2atKAE nNefPwan9Tzr4+NXC/CLowI1O5upJslAkz2vu6wQWuhv7SygAhoC75qnTHx9sXoHxq6V5v 5pCEpKzDKxKv/VEeqZQugoV+NJTsd+8Ab96TZ2AClhFfuUaTKu7uhXxBFIvHVF/Xdplcn0 J8V7gi0E3UFe3sBQb9zduBqiMJsXehNVtL1xSXUVtGcKOE7DOt0zkka7kLPdgg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840065; a=rsa-sha256; cv=none; b=GSDWcMXUOFq+reu31skBjByF08Q9wM1sXGtj4us9BdUzjsozgIOd20Is8YvjmZSwmehYhZ 9jOshXlJmx8I/sU0SgbmgdwWYduBdhComjuneIF+wsdnKu0Cbg415456JEcdJacXtaFJxa 4l4GJ5RRdQxXOGbpskd2soFIcJUQUPv1WUQYEN9EijrUWDLFlaybENsk514ZlQx2Fh9csN 8jifC0L+z0f/ezIKj/hYCCmfuslUU5aCETwJJ8nzKQhsf/+uJKT2XIa1KU4hxg9uvENgxd q3QBraxoh4s2ryYEfcHqf6cnnHhVZDIOilTQ5HxKpbWQlq7ZnvMpJ3DPHADfPg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840065; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ciXXa/QL2KQVS8/TEemW5x6B7MQ2eF39vOzVT86ihg4=; b=pmJEiteOYeBTRvfBUyHGhYne3VXqYxds8+g8trGllZqcnF3ZpOHti0S33mtaeTaBRfPI8j RP8qLbBRbJ7FexEOM807jqkxSyOyjWnyHniIEbcZy6J5Sb1HHCYs24rxHVN0qYhLMkUKkn uMMJD/RLsxQ5nSUGztXMu5INnfOrgi4U4D3Hazny3FesTr3nPQ/h+aLMbBtc+SlB+gHI4Q WU5XP4C0iwyGWlbuxncDnOW2NysliIs0m+MIW2gVBMQMhRhXC9bhQ6VKvQ7ZSPci+XYglZ J3gQGuibtYBbTf7RlP83Qz8YLQJS5cnQs52eQHki2a1jvvDuUx7EonDwT8UeYg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKs1kj6zsY3 for ; Tue, 30 Jun 2026 17:21:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45b96 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:05 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Kyle Evans From: Mark Johnston Subject: git: d68c2e77d70c - releng/14.4 - kern: fix auditing of ptrace(2) syscall requests List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: d68c2e77d70c81d51c27120baffcfe3ebbd4c849 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:05 +0000 Message-Id: <6a43fb01.45b96.1937bc5f@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=d68c2e77d70c81d51c27120baffcfe3ebbd4c849 commit d68c2e77d70c81d51c27120baffcfe3ebbd4c849 Author: Kyle Evans AuthorDate: 2026-06-25 17:02:47 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:30 +0000 kern: fix auditing of ptrace(2) syscall requests `error` here is the return value of syscall_thread_enter() rather than the syscall itself, so the committed audit records do not reflect reality. This is less harmful than them recording an error when the operation actually succeeded, but it could still possibly be used to throw off IDS techniques with things like bsmtrace. Approved by: so Security: FreeBSD-SA-26:45.audit Security: CVE-2026-49426 Reviewed by: des, kib, markj, csjp Differential Revision: https://reviews.freebsd.org/D57847 --- sys/kern/kern_sig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c index 7f399586f639..88c93b98b646 100644 --- a/sys/kern/kern_sig.c +++ b/sys/kern/kern_sig.c @@ -2779,7 +2779,7 @@ ptrace_syscallreq(struct thread *td, struct proc *p, td->td_errno = nerror; if (audited) - AUDIT_SYSCALL_EXIT(error, td); + AUDIT_SYSCALL_EXIT(tsr->ts_ret.sr_error, td); if (!sy_thr_static) syscall_thread_exit(td, se); } From nobody Tue Jun 30 17:21:06 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKv2PQ3z6jYKL for ; Tue, 30 Jun 2026 17:21:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKt3VHkz3rWh for ; Tue, 30 Jun 2026 17:21:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840066; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sfPbh/R8HDZQN+sFXqpQTqrahCGY++7wI3k+P0YSSos=; b=W5o+Sd7IkZhjTmqn+ycEPU9eWCXSZwS1WDSXPtMCHMrqw7Ajm8ynSysZ7MvfxbZW3sklqm 98JtbfZiPXwcrZPDNC+QOZUq9eOu2a5wrR/+WaSFZhjfJ4PVuW0J84thH7SclbPc8x/VkV lwr9f+BRht4ufP1fCTSLbttng/YY7pWOu8i1mEX7zWgUbSoYO1ol75BFuk7vnSAZVw3nUd Iqweu5zeLu3SpnQ34VSJIIoXJeLeh3TG3aFSSGN05Coo0TTvsFoXOH2oz6YR+V5/QWqa0n Y3BTn0d4j6Dore+PpXA+g8MvcgMtX1XBwvGQNaSyzJ0Fo6/6f3n8cCW79sYZcA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840066; a=rsa-sha256; cv=none; b=UtZPdjmhXwnHlYbetIQlci9uNfrRsphFUbsmalNqEQuF0wChxHCTDNXrq6xbvpuKH6VA+B RkneKgPwEQCOOOZKJ4BjTt+LLjmZ6reKFW81Q5T43AzsaJ9nN3SQRhOJxFhh1BZzYo4Otl xBGKZfwxo6pk2tQBk4lXXgFS6d6OPldMhESTK5NUQxie46BH82qClxPcYceXN7n6n1x6RV /rCcJ/Umd5ESNlbVKQoTst/IxQdywj0rGdSL6MVmWRbrRU6hBtcqgGiLY123fRiDa9zjTy /STC8lLpICbOT1BF5KVZNECj4Yc3WZy4Xs0j5jR6LILWbf5wrY2VreioX91shA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840066; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sfPbh/R8HDZQN+sFXqpQTqrahCGY++7wI3k+P0YSSos=; b=qY2hPaZdjk/ryTrmo/ISF/IHUIoJDIVYGVxqeYJ+t/zMBLqx106QhDKr/rICPfwuYSArkj i/pcMfjxv4Bk1YZOH8ziVnV6dX2fVPCm0HWjlLoQxi0f7mn+u/ntwNVp4yoj3YjJAVss3C 4z8tgvm4hfER2v23napQM6lq5lX1btVBdj4kYSW+sgh4Qdgf2gj+Y7yzhdtOgWbCEV0V9g 0yTMmCCm6QYzxSUUbb2QcKqPzdwDpATfxAoGf5E2Af6dXc+UC6wDrANrAwE/OrtzsD/jQV 70tHrY4S1sIH2eS9A33g+usjYteK0VhDGEfofZXVre+k06Qt1V1VN7rZYqH1zg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKt27TdztkJ for ; Tue, 30 Jun 2026 17:21:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45873 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:06 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: John Baldwin From: Mark Johnston Subject: git: 5f83a1c159a3 - releng/14.4 - ktls CBC decrypt: Only increment iovec index when an entry is used List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 5f83a1c159a3149d65bbc0f004c7dd6c1ffb698c Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:06 +0000 Message-Id: <6a43fb02.45873.3dd5a364@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=5f83a1c159a3149d65bbc0f004c7dd6c1ffb698c commit 5f83a1c159a3149d65bbc0f004c7dd6c1ffb698c Author: John Baldwin AuthorDate: 2026-06-24 01:14:11 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:30 +0000 ktls CBC decrypt: Only increment iovec index when an entry is used If an mbuf in the chain was skipped because it only contained bytes from the header, the iovec index ('i') was incremented even though the entry was not populated. Only increment 'i' when an iovec entry is consumed. Add a new type of KTLS receive test which writes a single TLS record via two separate write(2) calls over a TCP_NODELAY socket to trigger a split in the mbuf chain in the kernel. Test various split locations including after the "plain" TLS header (5 bytes), after the full TLS header, in the middle of the data payload, just before the start of the trailer, and in the middle of the trailer. These tests are also run against all supported ciphers, not just CBC. The 'header' test for CBC ciphersuites was able to trigger the bug. Approved by: so Security: FreeBSD-SA-26:46.ktls Security: CVE-2026-49423 Sponsored by: Chelsio Communications --- sys/opencrypto/ktls_ocf.c | 3 +- tests/sys/kern/ktls_test.c | 110 ++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 110 insertions(+), 3 deletions(-) diff --git a/sys/opencrypto/ktls_ocf.c b/sys/opencrypto/ktls_ocf.c index f61fb7f73b5d..3c8b2e4f4589 100644 --- a/sys/opencrypto/ktls_ocf.c +++ b/sys/opencrypto/ktls_ocf.c @@ -503,13 +503,14 @@ ktls_ocf_tls_cbc_decrypt(struct ktls_session *tls, iov[0].iov_base = &ad; iov[0].iov_len = sizeof(ad); skip = sizeof(*hdr) + AES_BLOCK_LEN; - for (i = 1, n = m; n != NULL; i++, n = n->m_next) { + for (i = 1, n = m; n != NULL; n = n->m_next) { if (n->m_len < skip) { skip -= n->m_len; continue; } iov[i].iov_base = mtod(n, char *) + skip; iov[i].iov_len = n->m_len - skip; + i++; skip = 0; } uio.uio_iov = iov; diff --git a/tests/sys/kern/ktls_test.c b/tests/sys/kern/ktls_test.c index 3970083e7f72..7003b86fb4e2 100644 --- a/tests/sys/kern/ktls_test.c +++ b/tests/sys/kern/ktls_test.c @@ -303,6 +303,15 @@ fd_set_blocking(int fd) ATF_REQUIRE(fcntl(fd, F_SETFL, flags) != -1); } +static void +tcp_nodelay(int fd) +{ + int nodelay = 1; + + ATF_REQUIRE(setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &nodelay, + sizeof(nodelay)) == 0); +} + static bool cbc_crypt(const EVP_CIPHER *cipher, const char *key, const char *iv, const char *input, char *output, size_t size, int enc) @@ -1920,6 +1929,55 @@ test_ktls_receive_bad_size(const atf_tc_t *tc, struct tls_enable *en, close_sockets_ignore_errors(sockets); } +static void +test_ktls_receive_split_record(const atf_tc_t *tc, struct tls_enable *en, + uint64_t seqno, size_t len, size_t first_len) +{ + char *plaintext, *received, *outbuf; + size_t outbuf_cap, outbuf_len; + ssize_t rv; + int sockets[2]; + + ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); + + plaintext = alloc_buffer(len); + received = malloc(len); + outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); + outbuf = malloc(outbuf_cap); + + ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); + + ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, + sizeof(*en)) == 0); + check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); + + fd_set_blocking(sockets[0]); + fd_set_blocking(sockets[1]); + + outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, + plaintext, len, outbuf, outbuf_cap, 0); + ATF_REQUIRE(first_len < outbuf_len); + + tcp_nodelay(sockets[1]); + rv = write(sockets[1], outbuf, first_len); + ATF_REQUIRE_INTEQ((ssize_t)(first_len), rv); + + rv = write(sockets[1], outbuf + first_len, outbuf_len - first_len); + ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len - first_len), rv); + + rv = ktls_receive_tls_record(en, sockets[0], TLS_RLTYPE_APP, received, + len); + ATF_REQUIRE_INTEQ((ssize_t)len, rv); + + ATF_REQUIRE(memcmp(plaintext, received, len) == 0); + + free(outbuf); + free(received); + free(plaintext); + + close_sockets(sockets); +} + #define TLS_10_TESTS(M) \ M(aes128_cbc_1_0_sha1, CRYPTO_AES_CBC, 128 / 8, \ CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO) \ @@ -2360,6 +2418,26 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ auth_alg, minor, name) \ ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name); +#define GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, name, len, first_len) \ +ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_split_##name); \ +ATF_TC_BODY(ktls_receive_##cipher_name##_split_##name, tc) \ +{ \ + struct tls_enable en; \ + uint64_t seqno; \ + \ + ATF_REQUIRE_KTLS(); \ + seqno = random(); \ + build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ + seqno, &en); \ + test_ktls_receive_split_record(tc, &en, seqno, len, first_len); \ + free_tls_enable(&en); \ +} + +#define ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, name) \ + ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_split_##name); + #define GEN_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ minor) \ GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ @@ -2381,7 +2459,22 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ tls_minimum_record_payload(&en) - 1) \ GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ auth_alg, minor, oversized_record, \ - TLS_MAX_MSG_SIZE_V10_2 * 2) + TLS_MAX_MSG_SIZE_V10_2 * 2) \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, header, 64, \ + sizeof(struct tls_record_layer)); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, full_header, 64, \ + tls_header_len(&en)); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, half, 64, \ + tls_header_len(&en) + 32); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_start, 64, \ + tls_header_len(&en) + 64); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_middle, 64, \ + tls_header_len(&en) + 64 + tls_trailer_len(&en) / 2); #define ADD_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ minor) \ @@ -2402,7 +2495,17 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ auth_alg, minor, small_record) \ ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ - auth_alg, minor, oversized_record) + auth_alg, minor, oversized_record) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, header) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, full_header) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, half) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_start) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_middle) \ /* * For each supported cipher suite, run several receive tests: @@ -2425,6 +2528,9 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ * size * * - a test with an oversized TLS record + * + * - tests of a single record whose data is split across two writes, + * with each test using a different split point */ AES_CBC_NONZERO_TESTS(GEN_RECEIVE_TESTS); AES_GCM_TESTS(GEN_RECEIVE_TESTS); From nobody Tue Jun 30 17:21:07 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKv5Cvvz6jYKM for ; Tue, 30 Jun 2026 17:21:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKv3yn4z3rRY for ; Tue, 30 Jun 2026 17:21:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840067; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KvfKTK/3en7j2Dfv985FYFTnch1XECz4tjwhRk+osQ8=; b=xRpgRnXgvvNJXJSVQPdCY/Q9CeJiVS41SEhUthGA+Dz0lgPd1yJxRrJhXB7aBE5AQhE7jz KOFd0YguBOsJ0PLLHBIrzRqOpJnjeP97RPirrTWNdoZr13P5sajkJBmjkp//3sNb5aQjBL a1aYWZjdaT8SeFVRo1H8rKnfC8X2EK6Y/x+FBqj4pb1zzy0c6hApfUMfjsXEI7zvxFiSLB HtNjzohceWQWjyagwPpbi3+KYIxMgw3FbF5DAIQ+YnbxEOGuzYTfE1AAFaFex69LHNkZL+ nEeJHDDgVxWb9YsaN9b1c29oljIk9Aa/t3SdifV9p0Dl03eoiMlU/EMYfTBQ+g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840067; a=rsa-sha256; cv=none; b=v87AYc1StqTPEbS19TvPzZwjnC+wEjTfrMNvpcuRA+/SwTwM+C5Ct/a2iubNo4Tw6a9Htp YmtRdQX0bahQIQs1ktGbYzELpeLEryHkx5wGpgWE1S2m/KvA/Keg32/xCbaYr2bwMQ1teb xPhTK2FumW3fFFoqaiRv4LtVFRJH3Mu98kNc7Au/wf8qPIhbCteg3Dja0gTT1ueRmRkvrA QDFL+SMD+6BeCsMX9i1BlDnKWZ6N1UnDMOc/v2eajTITh53eWBgulBQlYBRiQRPcJtE2V6 Zwl4nkUtuGIbQGvHKMI1IpbvClxU5eIAkqlo7IFrgQJr///g2m/l+uFEnMyY4A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840067; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KvfKTK/3en7j2Dfv985FYFTnch1XECz4tjwhRk+osQ8=; b=dCq9K4ckdf1Rylrugwcep6N01OhaX1QoMTTtcf/8IeJryorYYHzBjKg92B85ecB/NaXehL 1xTJD6SWZsXxDCu4kRxk6/rbSsjMxBHPIajDHtVzYd6QdiECNSggcaTA/8UKwfC9X9n3Tb q/5FLJ5wRNegM20FMhmyl5KI0q3sxeFOyI27ZR3K6/OHvh81sGnJ32eX24mdnD54CVJOyf ti6oHfh+cdCo2JivRgTYXtJf/7r8U8r8Ry+dUzsdfQfWrtZPzWNngMOcieWzKA5JJJzVyK HsdTLUNHufFm23ZxonJ+tz0NABmy1ARZv9MjAXTmK7XbC/PyFsuOnaxkM/LzKQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKv2wjJztBf for ; Tue, 30 Jun 2026 17:21:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45b9b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:07 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Ed Maste From: Mark Johnston Subject: git: 99d936f98589 - releng/14.4 - compat/linux: Avoid waitid() kernel stack disclosure List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 99d936f9858985c6387ef930ab6d66f013203edb Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:07 +0000 Message-Id: <6a43fb03.45b9b.6b1b75e4@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=99d936f9858985c6387ef930ab6d66f013203edb commit 99d936f9858985c6387ef930ab6d66f013203edb Author: Ed Maste AuthorDate: 2026-03-10 13:53:46 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:30 +0000 compat/linux: Avoid waitid() kernel stack disclosure Approved by: so Security: FreeBSD-SA-26:47.linux Security: CVE-2026-49424 Reported by: Adam Crosser, Praetorian Reviewed by: philip Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D55812 (cherry picked from commit 9a9f93bcf1aa0059d759b2f3ea6faeb2760a11bd) (cherry picked from commit 9f8db9cc67fb86eeb2b645ce7f8aa748e99241a9) (cherry picked from commit a347e6e20e75ad6224afefcf650ef738c3de094d) --- sys/compat/linux/linux_misc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c index 2414c76eb173..008f695de36b 100644 --- a/sys/compat/linux/linux_misc.c +++ b/sys/compat/linux/linux_misc.c @@ -748,6 +748,7 @@ linux_common_wait(struct thread *td, idtype_t idtype, int id, int *statusp, error = linux_copyout_rusage(&wru.wru_self, rup); if (error == 0 && infop != NULL && td->td_retval[0] != 0) { sig = bsd_to_linux_signal(siginfo.si_signo); + memset(&lsi, 0, sizeof(lsi)); siginfo_to_lsiginfo(&siginfo, &lsi, sig); error = copyout(&lsi, infop, sizeof(lsi)); } From nobody Tue Jun 30 17:21:12 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL20xcJz6jYTy for ; Tue, 30 Jun 2026 17:21:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVL11Ctpz3rcj for ; Tue, 30 Jun 2026 17:21:13 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840073; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=n6nF3L10DJo9mcasxSt9261RUOYfmlEUBoyIlpghXfg=; b=sWGqKjYY7cxV339VyQtBXh7o2fbR6gicKEM2Grk6Jx54vRTCmiUTH3GiLnFBRNQE7+V090 rBFVu4XHfyK857P8bzwtV7zp6P0lYR12wtp8S594G6qLRDDTGIKJuIwl3iSeyNbL0FiV+i EjhBIB3lrSz7qrfk8vjiftmvdluAZ1LHBYmhiu+XIa6mwayOtEO8S8tF8gKuPF1/S7VQOW TgH60JKiRMqrEV5HTwtplISoRjYSwIh2Jx9ote1EDwEe674/V3rhcJoTwDWVd3b0UScDtv fa68ksE2C+GlRe5D1Ix8uXdDqlSWjyTQorYeK3gBLItRDehmfdTeWdmOg6S0+A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840073; a=rsa-sha256; cv=none; b=dre8AfDLHWCxSCINNJ3ugMVG5J8OY26USeQcuMzj+QuZLoUYbiWpxohikI6GrsucYpvHt1 THMdwmJsXQRll3uzjaDVfkSlljtnV60SiTNTKwmNfgIzCkIrtdlb7hCiPznLicb52cvy+l if5oCvrINVwdRuyfsM9nFYFj4ZaenMbb8jh9zWD01ESyGE4eDEqzEU0p7WIFsWC4aDDfn+ xbsq7P4GcfzEHd7jDCeyIg/eURkg3SuyauPdJuE/pe8F3B8xNULuHAwJK/Cc9G7qMf0327 astw6WTbhR5G/WwwIvKYoVAlWsc66ozIM9IFlFXjN6LWv0+9yp0hTG2b7oOZbw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840073; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=n6nF3L10DJo9mcasxSt9261RUOYfmlEUBoyIlpghXfg=; b=iSRvH4D5vYAcRcEiKNAUZUFWbXskvRR6A8ewBS9kFLS16NYRzfNqGpBYdnyoJN2Lp1wEM3 gZ3CMtcQU0noJXl+jDL+O7NmxEoVUsFqSMoDxYMdsM+T4QhwIWdNcD9b2J4BNww1jJddVo 7OyMCFyOFgrk4wE/O7RJwtk1Qngkbfv41NmVT4DeGwmtCHfLRNo3qQzYVlTZ7KpkySaN8z kuo9mSuv6DdvlPLTbbGk+eRQHXfxpRuH2UmObZqPlFCVimHaOHRoxcpj3+uz4FbIUihUjc u1BJx0tLTn2WijFzsREBOAPjnx7+Xr849NhYZHgMMl0tlBB0SRhaHKhRzkMlMg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL06cfRztSY for ; Tue, 30 Jun 2026 17:21:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44d48 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:12 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: b819674449de - releng/14.4 - iconv: Fix a stack buffer overflow in _ISO2022_sputwchar() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: b819674449de138c16cd8e115c8139880bedce50 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:12 +0000 Message-Id: <6a43fb08.44d48.19eec41a@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=b819674449de138c16cd8e115c8139880bedce50 commit b819674449de138c16cd8e115c8139880bedce50 Author: Mark Johnston AuthorDate: 2026-06-23 17:45:28 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 21:26:44 +0000 iconv: Fix a stack buffer overflow in _ISO2022_sputwchar() In the ISO2022-CN encoding, characters may require at least seven bytes, and MB_LEN_MAX==6 is insufficient. From code inspection, _ISO2022_sputwchar() can emit 10 bytes in the worst case, so use that to size buffers. Add a regression test. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58082 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57950 --- contrib/netbsd-tests/lib/libc/locale/t_iconv.c | 20 ++++++++++++++++++++ lib/libiconv_modules/ISO2022/citrus_iso2022.c | 8 ++++---- 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c index f25c061bb170..199774769827 100644 --- a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c +++ b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c @@ -117,6 +117,26 @@ static const struct sample { 0x82,0x42,0x79,0x65, 0x2e }, 0, 0, NULL }, + /* 馬 from CNS 11643-1 */ + [9] = { "UTF-8", 3, (const char[3]){0xe9,0xa6,0xac}, + "ISO-2022-CN", 8, + (const char[8]){0x1b,0x24,0x29,0x47,0x0e,0x58,0x6b,0x0f}, + 0, 0, NULL }, + /* 馬毦 shifting from CNS 11643-1 to CNS 11643-2 */ + [10] = { "UTF-8", 6, (const char[6]){0xe9,0xa6,0xac,0xe6,0xaf,0xa6}, + "ISO-2022-CN", 16, + (const char[16]){ + /* ESC $ ) G (shift G1 to CNS 11643 plane 1) */ + 0x1b,0x24,0x29,0x47, + 0x0e, /* GL is G1 from now on */ + 0x58,0x6b, /* 馬 */ + /* ESC $ * H (shift G2 to CNS 11643 plane 2) */ + 0x1b,0x24,0x2a,0x48, + 0x1b,0x4e, /* GL is G2 for next char */ + 0x30,0x21, /* 毦 */ + 0x0f, /* GL is G0 from now on */ + }, + 0, 0, "PR lib/59019: various iconv issues ([case 10: ISO-2022-CN to UTF-8 14/6] iconv: Illegal byte sequence (85))" }, }; #ifdef MIN diff --git a/lib/libiconv_modules/ISO2022/citrus_iso2022.c b/lib/libiconv_modules/ISO2022/citrus_iso2022.c index a311dbc26e59..b2de13d9d13a 100644 --- a/lib/libiconv_modules/ISO2022/citrus_iso2022.c +++ b/lib/libiconv_modules/ISO2022/citrus_iso2022.c @@ -130,7 +130,7 @@ typedef struct { #define _FUNCNAME(m) _citrus_ISO2022_##m #define _ENCODING_INFO _ISO2022EncodingInfo #define _ENCODING_STATE _ISO2022State -#define _ENCODING_MB_CUR_MAX(_ei_) MB_LEN_MAX +#define _ENCODING_MB_CUR_MAX(_ei_) 10 #define _ENCODING_IS_STATE_DEPENDENT 1 #define _STATE_NEEDS_EXPLICIT_INIT(_ps_) \ (!((_ps_)->flags & _ISO2022STATE_FLAG_INITIALIZED)) @@ -1013,7 +1013,7 @@ _ISO2022_sputwchar(_ISO2022EncodingInfo * __restrict ei, wchar_t wc, { _ISO2022Charset cs; char *p; - char tmp[MB_LEN_MAX]; + char tmp[10]; size_t len; int bit8, i = 0, target; unsigned char mask; @@ -1178,7 +1178,7 @@ _citrus_ISO2022_put_state_reset(_ISO2022EncodingInfo * __restrict ei, size_t * __restrict nresult) { char *result; - char buf[MB_LEN_MAX]; + char buf[10]; size_t len; int ret; @@ -1207,7 +1207,7 @@ _citrus_ISO2022_wcrtomb_priv(_ISO2022EncodingInfo * __restrict ei, _ISO2022State * __restrict psenc, size_t * __restrict nresult) { char *result; - char buf[MB_LEN_MAX]; + char buf[10]; size_t len; int ret; From nobody Tue Jun 30 17:21:08 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKx5GWWz6jYQm for ; Tue, 30 Jun 2026 17:21:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKw4pzhz3rPL for ; Tue, 30 Jun 2026 17:21:08 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840068; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=nE7s2E3WD+QxA0BtVKMlgyEzf/rK2Y3m9M2TaI29U6U=; b=UDxu8pQl7Bb6GW9D5ridCoArSAHSGs1AKRfWSB/9LF8Hvpp0sasPxkFwQvz7aykikKYeJC JQSxO15g8xNVZnlGQramNtu8SoSrDvfy3ef2GZLGBJtgDIvZto42juL7gS45JDzRLILBme OrwDYmcZ5YKvyYntG2FrsmhC3SZS2h7tUfkyb1ymO7wJsYioulcEfQrIjetqVbn0HabPKZ 3ok0k7WwvfawXnWzDc0bRfxyDE2iVZVi+/J5V+A9Jq+aTEXVMYwqWUCotQcR16Ao73IcCB 0+o0EicI1CRE7IMYa4Nyg1OETrrDT1OKNP6yADAIp5soSJQ+Etqfsa6iD5B8tQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840068; a=rsa-sha256; cv=none; b=im5w74jluHYBw3UE6pQq+sSAJasIK/iQ6BOb38TbyE2yd6fNfXBKZGKGnKrU+qOuAxgl4m 5I/bA3dYxUbZCkdPtEP0BGx0UMLLb2wwvq86ArHJsvqVbOM5Jh1OKxhi+4jvemaSF3xJcG oH/fOWjUQc71+dfr6nBn59ASy0hckv/yoiyvyAQjYpnFEtIM7WVZwHiwWVoj962K21sa63 ANlGVJmZ+u9b9Tr5bLhgsPB9Px/s/xt5RQVF/H5LlzzNThtOO0cMb4S7vdG8n8DDv46Uyv x/jLatMXizV2JIJQEoNy9mj0PkCcMOE15QTiaep1USqvVLh1npVCuHg9h32hzw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840068; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=nE7s2E3WD+QxA0BtVKMlgyEzf/rK2Y3m9M2TaI29U6U=; b=Vlbh8I03v0EszrnxzdJ2VRlPKoTEjM15ay8SkAReQrR3NATJYinIc7nNKEzk0cjQq7patm qofgF3Z8L03oJfFedyLt84LS2ce2K4fY2OSrFNr1BLjO8BmQffd5jX+qSH5mETUY2VsSus YqUCZUNRiXQbtdrgiZf2nELfS77R9946UzZW62WUMMhmKMD6CeFszpupgCUACQsx8c8T/G N7R0f+WRnyDZdgY4HLV2VxHs9y6hGWvCS5PARn5CPQn9dzunk650MxNtnOO6/yfkZo4jbu fYMVI0GUl1d9ZrWwfmf55IU8cvQOQ0dUuc21lovCv2aYJBUq2hEKku8YKnQDlw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKw3jzXztPj for ; Tue, 30 Jun 2026 17:21:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44fb6 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:08 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Ed Maste From: Mark Johnston Subject: git: f145e3c02b46 - releng/14.4 - compat32: Zero struct to avoid stack disclosure List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: f145e3c02b46eef1178be175338f27b6a5154122 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:08 +0000 Message-Id: <6a43fb04.44fb6.45c8398b@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=f145e3c02b46eef1178be175338f27b6a5154122 commit f145e3c02b46eef1178be175338f27b6a5154122 Author: Ed Maste AuthorDate: 2026-03-11 15:02:18 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:30 +0000 compat32: Zero struct to avoid stack disclosure Approved by: so Security: FreeBSD-SA-26:48.compat32 Security: CVE-2026-49425 Reported by: Adam Crosser, Praetorian Reviewed by: philip Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D55811 (cherry picked from commit 097cb4e9f0432c543c704cec712ce1cd3302335c) (cherry picked from commit 4551ea3b3f04650cd5300a9eae8994bdb080db91) (cherry picked from commit 6a808cd7534802d30010fb0a7f46381ff9f6ef3f) --- sys/compat/freebsd32/freebsd32_misc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/compat/freebsd32/freebsd32_misc.c b/sys/compat/freebsd32/freebsd32_misc.c index 13152d9d3588..df388a7d67d1 100644 --- a/sys/compat/freebsd32/freebsd32_misc.c +++ b/sys/compat/freebsd32/freebsd32_misc.c @@ -765,7 +765,7 @@ static int freebsd32_kevent_copyout(void *arg, struct kevent *kevp, int count) { struct freebsd32_kevent_args *uap; - struct kevent32 ks32[KQ_NEVENTS]; + struct kevent32 ks32[KQ_NEVENTS] = {}; int i, error; KASSERT(count <= KQ_NEVENTS, ("count (%d) > KQ_NEVENTS", count)); From nobody Tue Jun 30 17:21:14 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL26gChz6jYY8 for ; Tue, 30 Jun 2026 17:21:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVL21TrQz3rcm for ; Tue, 30 Jun 2026 17:21:14 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840074; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vCotY+kf4aE29+iLP0PtQPAMmgO+pwdTFx+CILCvu0M=; b=r9b7avmLgJOWlhAL6EFbiTrG5FP47CMmXGJwZ4TfKDCb4QS46rUiySkwinjw5fUulrY50X 6++DCV+sIeFVsQBSQKQfeWST5FFTFgqHufgCnb1Y3aSOYE+pOnZt0AyzxLbtSo6qz/aoic KxJPLwUIJgtcMUAPcWCgb1jZUrxokXt5+r8WRw2kZTVFGd3mJT3NVuWruBxTVvrTeXuT7Z CgPGeftMaUKdIlqGQ2yI5jcNkhmNQKzfL3Snus6fUzCi+pYDQJQxpMsq8+W4uQi6kXKw10 w3ZiODUs7XAZTAma3kNakPg/dafRod5fgJH+XWX2LMSQ3Clz3DNc3eZAfWEPgg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840074; a=rsa-sha256; cv=none; b=OH8NyuuQJQ1cIYRE+IH2gSUT0jMiTkCnkiOs3adMXkdFTnbh8YpZjKl2KZhkZ9ba1j3oSb t2rIKUCrhwok6OdfpG0x9aUW2hAZl/MAYvB8zdiBiO3UbfrTW6lA2ztEtSTjNnFf3jAsPb IN1yqQveHYN4f6jG3OnIG720RJP9yK+BZwb9FMLDMNlHrKI7N/gTG/65CkjUskl73hJx6d JedkH9zvCElwGvpyLjm5R5lgGKhSOuIQpIO7L3MitRJ5lpZPA2henlM6bvNBbz2uTvRIEw 1hCrigIppo1PX6A3FG0HW7OK+uqtiyiMuCI1Sm6dksTjT0yQhThbmR2AoqPSHw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840074; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vCotY+kf4aE29+iLP0PtQPAMmgO+pwdTFx+CILCvu0M=; b=P8vGMZkger1NGrxpnhrs/kQAxr17bcHCkR1wqVdoLyWMkDQzj7OqT+0Um0MWVQmJJCBVJW vAzamrDDWBT/H7lfV56WfOwx5nJxGQdlAa9coimyV8UFoqHsSQ0z+3xMYcUACj9nFr0vlI gxOVO6IgDMn2flgyayQcA50onJlkjWTbuQyt6r7BZXq17RU19lpOEvhI+5n9qd7Q0tod6s xa28MsdwTA6E0tuDkNtUVUastKZAdmA4I/bQ+aFMKqoFZqqDW0dZvVxDFdHRvojsLoKyDP OtcG9w6RdFK/SVvMrrlzU0mIAI4ZIwuwNBC9sKCrNGdzdJEAGWpUt2LhCE+kPg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL20Hw9ztn1 for ; Tue, 30 Jun 2026 17:21:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 444f9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:14 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 3827644480bd - releng/14.4 - Add UPDATING entries and bump version List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 3827644480bdd01c00bd1d5bb66011bb2e0ac75b Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:14 +0000 Message-Id: <6a43fb0a.444f9.7e65cafd@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=3827644480bdd01c00bd1d5bb66011bb2e0ac75b commit 3827644480bdd01c00bd1d5bb66011bb2e0ac75b Author: Mark Johnston AuthorDate: 2026-06-26 21:43:59 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 21:26:44 +0000 Add UPDATING entries and bump version Approved by: so --- UPDATING | 39 +++++++++++++++++++++++++++++++++++++++ sys/conf/newvers.sh | 2 +- 2 files changed, 40 insertions(+), 1 deletion(-) diff --git a/UPDATING b/UPDATING index 6433576d48b2..321c8e4e5376 100644 --- a/UPDATING +++ b/UPDATING @@ -12,6 +12,45 @@ Items affecting the ports and packages system can be found in /usr/ports/UPDATING. Please read that file before updating system packages and/or ports. +20260630: + 14.4-RELEASE-p7 EN-26:16.arm64 + SA-26:37.vm + SA-26:39.execve + SA-26:40.zfs + SA-26:41.libalias + SA-26:42.unlinkat + SA-26:43.tcp + SA-26:44.posixshm + SA-26:45.audit + SA-26:46.ktls + SA-26:47.linux + SA-26:48.compat32 + SA-26:49.iconv + + 32-bit setcontext(2) and swapcontext(2) fail on arm64. [EN-26:16.arm64] + + Use-after-free in device pager page list. [SA-26:37.vm] + + Local privilege escalation via execve(2) TOCTOU race. [SA-26:39.execve] + + Multiple vulnerabilities in OpenZFS. [SA-26:40.zfs] + + Buffer overflow in libalias RTSP handler. [SA-26:41.libalias] + + unlinkat(2) ignores AT_RESOLVE_BENEATH flag. [SA-26:42.unlinkat] + + Use-after-free in TCP RACK stack option handler. [SA-26:43.tcp] + + Incorrect audit records for ptrace(2) syscall requests. [SA-26:45.audit] + + Remote DOS via uninitialized memory access in KTLS receive. [SA-26:46.ktls] + + Kernel stack disclosure in Linux compatibility layer. [SA-26:47.linux] + + Kernel stack disclosure in 32-bit compatibility support. [SA-26:48.compat32] + + Multiple vulnerabilities in iconv(3). [SA-26:49.iconv] + 20260609: 14.4-RELEASE-p6 EN-26:15.openssl SA-26:25.thr diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index 3d7d8d5145a5..2ab49a6e20bb 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -53,7 +53,7 @@ TYPE="FreeBSD" REVISION="14.4" -BRANCH="RELEASE-p6" +BRANCH="RELEASE-p7" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi From nobody Tue Jun 30 17:21:10 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL03LgPz6jYVb for ; Tue, 30 Jun 2026 17:21:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKy6RZ1z3rZG for ; Tue, 30 Jun 2026 17:21:10 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840071; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BaCzux63ucmQLYzdfjZwRYESfYlAX+asYMarqfgvcm4=; b=BQKcg16Jp3iI0MDTLpL4MEols4jPhW8AHMIC5PGbBmf5a9b0BUVqfhE2+DYJjfmGojV+SQ i5RlLq5JWAFnUmSlQ+ECtZom20TXqAAR2w/jxSOYzZaxgi3N5PVQs3WwQYMThg6phd7p1V 1fLYE0I4Tbpftd38MmMU2gks0erQ6rge1suft+lqZyJs5gCTP9PexDEKKKObVIdXb+Odkk 98A88jI5r6g8Kc4D378T07UNDNIRqjsoddS1sQe8Dj0Iirfw9/dVzimUlDJrBGXD2QYX7/ 4ZeCBfx/b1K/xpTChAA0lwFh7MRnf/ZeYdZpp6C6wVoeW9Ox4xAA5fjOdn6uAA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840071; a=rsa-sha256; cv=none; b=ifYAFafpX2gZ61nx0txrYin/U2NGWmGZYbSy4KG1KQ1TWYvW1uwOfZVI/ZyJp1ETBPFEZg QpQ+znO6OT+0p7Rc9eD08bzJ8ekM5ZWsP0k++cHSm6ZqHYMXBhITMEfm5NgfupYoPuoD0j JW8+4HdVhesAR4DYUcd1XNIkcBXnv7USg8jHAZd9BMHnM7eu4R8qlKHJuDGAHfYWsLs67a oMlAWf5N+TeOWThI3IjKRyEZV8XKsajtuxSgM5OC6Rq1r9PhABQWpvQanuegBtVvCauC76 rAC974IhDfJs0+YogIPwkdOBRzITyU1Db0V6+hZ2fFZuCG+wDoUTZVHmzqXUwg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840071; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BaCzux63ucmQLYzdfjZwRYESfYlAX+asYMarqfgvcm4=; b=tg4XQcOYEwwiwUhPNj9R61xFRD++8zUUaAz6XbeKoR5I/hbU6KpV6zIdvkiZkTAwNelGci x6Itu4ZSDx2K9SJKJNbET/A2PkCVvcVpKzJ0Rm1UkXQqH5WFNPR7jHd9GZ1pUGsDFEscVq SIp7VasRsTFx/FJGs53s8MQ55V+HzADOynp3jaSNCHKNjsM/YyMw8+QZ++n9AKjt3cMtUs oJvmX8wxyjLljDnDdTQAL0MgTORz8tcZPw7IYZhIshosES1qMu9b/KPfZ71luQOpKSCEwA BC+eGDfHV4E4+Xh4dNbqlIi4L1JMOlOR58QAy1Rrvv2j4O34QX9UFM60wcZB5A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKy5HscztDp for ; Tue, 30 Jun 2026 17:21:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 444f4 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:10 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Taylor R Campbell From: Mark Johnston Subject: git: d760b7f9b08e - releng/14.4 - iconv(3): Draft some automatic tests. List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: d760b7f9b08ed56d794319f9a4687ddf16714884 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:10 +0000 Message-Id: <6a43fb06.444f4.1a2e1624@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=d760b7f9b08ed56d794319f9a4687ddf16714884 commit d760b7f9b08ed56d794319f9a4687ddf16714884 Author: Taylor R Campbell AuthorDate: 2026-06-22 19:44:55 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 21:26:44 +0000 iconv(3): Draft some automatic tests. Based on a report by Nick Wellnhofer. Approved by: so Security: FreeBSD-SA-26:49.iconv Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57948 --- contrib/netbsd-tests/lib/libc/locale/t_iconv.c | 355 +++++++++++++++++++++++++ lib/libc/tests/locale/Makefile | 1 + 2 files changed, 356 insertions(+) diff --git a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c new file mode 100644 index 000000000000..f25c061bb170 --- /dev/null +++ b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c @@ -0,0 +1,355 @@ +/* $NetBSD$ */ + +/*- + * Copyright (c) 2025 The NetBSD Foundation, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS + * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +/* + * iconv(3) + */ + +#include +__RCSID("$NetBSD: t_mbrtoc8.c,v 1.3 2024/08/20 17:43:09 riastradh Exp $"); + +#include +#include +#include +#include +#include +#include +#include + +#include "h_macros.h" + +static const struct sample { + const char *src_codeset; + size_t nsrc; + const char *src; + const char *dst_codeset; + size_t ndst; + const char *dst; + size_t ninval; + size_t ninval_rev; + const char *xfail; +#define IRREVERSIBLE ((size_t)-1) +} samples[] = { + [0] = { "us-ascii", 6, "hello", + "us-ascii", 6, "hello", + 0, 0, NULL }, + /* LATIN SMALL LETTER E WITH ACUTE ACCENT */ + [1] = { "iso-8859-1", 1, (const char[1]){0xe9}, + "UTF-8", 2, (const char[2]){0xc3,0xa9}, + 0, 0, NULL }, + /* LEFT CURLY BRACKET */ + [2] = { "UTF-8", 2, (const char[2]){0x00,0x7b}, + "ZW", 6, (const char[6]){0x00,0x7a,0x57,0x20,0x7b,0x0a}, + 0, 0, NULL }, + /* LATIN SMALL LETTER O, TILDE */ + [3] = { "UTF-8", 2, (const char[2]){0x4f,0x7e}, + "VIQR", 3, (const char[3]){0x4f,0x5c,0x7e}, + 0, 0, NULL }, + /* LEFT CURLY BRACKET (optionally encoded in UTF-7) */ + [4] = { "UTF-7", 1, (const char[1]){0x7b}, + "UTF-8", 1, (const char[1]){0x7b}, + 0, IRREVERSIBLE, NULL }, + [5] = { "UTF-7", 4, "+AHs-", + "UTF-8", 1, (const char[1]){0x7b}, + 0, 0, NULL }, + /* éclair */ + [6] = { "UTF-7", 10, "+AOk-clair", + "UTF-8", 7, (const char[7]){ + 0xc3,0xa9,0x63,0x6c,0x61,0x69,0x72, + }, + 0, 0, NULL }, + [7] = { "HZ", 55, /* RFC 1843, Sec. 4, Example 1 */ + "The next sentence is in GB.~{<:Ky2;S{#,NpJ)l6HK!#~}Bye.", + "UTF-8", 61, (const char[61]) { + 0x54,0x68,0x65,0x20, 0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e, 0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73, 0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0xe5, 0xb7,0xb1,0xe6,0x89, + 0x80,0xe4,0xb8,0x8d, 0xe6,0xac,0xb2,0xef, + 0xbc,0x8c,0xe5,0x8b, 0xbf,0xe6,0x96,0xbd, + 0xe6,0x96,0xbc,0xe4, 0xba,0xba,0xe3,0x80, + 0x82,0x42,0x79,0x65, 0x2e + }, + 0, 0, NULL }, + /* Same as above but with HZ8 instead of HZ. */ + [8] = { "HZ8", 55, (const char[55]) { + 0x54,0x68,0x65,0x20,0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e,0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73,0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0x7e,0x7b,0xbc,0xba,0xcb, + 0xf9,0xb2,0xbb,0xd3,0xfb,0xa3,0xac,0xce, + 0xf0,0xca,0xa9,0xec,0xb6,0xc8,0xcb,0xa1, + 0xa3,0x7e,0x7d,0x42,0x79,0x65,0x2e + }, + "UTF-8", 61, (const char[61]) { + 0x54,0x68,0x65,0x20, 0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e, 0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73, 0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0xe5, 0xb7,0xb1,0xe6,0x89, + 0x80,0xe4,0xb8,0x8d, 0xe6,0xac,0xb2,0xef, + 0xbc,0x8c,0xe5,0x8b, 0xbf,0xe6,0x96,0xbd, + 0xe6,0x96,0xbc,0xe4, 0xba,0xba,0xe3,0x80, + 0x82,0x42,0x79,0x65, 0x2e + }, + 0, 0, NULL }, +}; + +#ifdef MIN +#undef MIN +#endif +#define MIN(x, y) ((x) < (y) ? (x) : (y)) + +static void +test_sample_bounded(const char *title, const struct sample *S, + size_t nsrc, size_t ndst) +{ + char inbuf[4096], inguard = arc4random(); + char outbuf[4096], outguard = arc4random(); + iconv_t C; + char *src0, *src, *dst0, *dst; + size_t srcleft0, srcleft, dstleft0, dstleft; + size_t ninval; + int error; + + ATF_REQUIRE_MSG(S->nsrc < sizeof(inbuf) - 2, "[%s]", title); + ATF_REQUIRE_MSG(S->ndst < sizeof(outbuf) - 2, "[%s]", title); + + memset(inbuf, inguard, sizeof(inbuf)); + memset(outbuf, outguard, sizeof(outbuf)); + src = src0 = inbuf + 1; + memcpy(src, S->src, nsrc); + dst = dst0 = outbuf + 1; + srcleft = srcleft0 = nsrc; + dstleft = dstleft0 = ndst; + + C = iconv_open(S->dst_codeset, S->src_codeset); + if (C == (iconv_t)-1) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv_open: %s (%d)", title, + strerror(error), error); + return; + } + + ninval = iconv(C, &src, &srcleft, &dst, &dstleft); + if (ninval == (size_t)-1) { + error = errno; + /* + * Incomplete input manifests as EINVAL -- ignore that, + * unless we're trying the full-size input. + * + * Truncated output manifests as E2BIG -- ignore that, + * unless we're trying the full-size output. + */ + if ((error != EINVAL || nsrc == S->nsrc) && + (error != E2BIG || ndst == S->ndst)) { + atf_tc_fail_nonfatal("[%s] iconv: %s (%d)", + title, strerror(error), error); + goto next; + } + } else if (ninval != S->ninval) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv:" + " %zu invalid, expected %zu", + title, ninval, S->ninval); + } + + ATF_CHECK_MSG(src0 <= src && src <= src0 + srcleft0, "[%s] iconv:" + " src went from %p to %p, expected [%p,%p]", + title, src0, src, src0, src0 + srcleft0); + ATF_CHECK_MSG(srcleft <= srcleft0, "[%s] iconv:" + " srcleft went from %zu to %zu", + title, srcleft0, srcleft); + ATF_CHECK_MSG(dst0 <= dst && dst <= dst0 + dstleft0, "[%s] iconv:" + " dst went from %p to %p, expected [%p,%p]", + title, dst0, dst, dst0, dst0 + dstleft0); + ATF_CHECK_MSG(dstleft <= dstleft0, "[%s] iconv:" + " dstleft went from %zu to %zu", + title, dstleft0, dstleft); + if (memcmp(dst0, S->dst, MIN(ndst, dstleft0 - dstleft)) != 0) { + size_t k; + + atf_tc_fail_nonfatal("[%s] iconv: bad conv", title); + fprintf(stderr, "[%s] input: ", title); + for (k = 0; k < nsrc; k++) + fprintf(stderr, " %02x", (unsigned char)S->src[k]); + fprintf(stderr, "\n"); + fprintf(stderr, "[%s] expected: ", title); + for (k = 0; k < ndst; k++) + fprintf(stderr, " %02x", (unsigned char)S->dst[k]); + fprintf(stderr, "\n"); + fprintf(stderr, "[%s] got: ", title); + for (k = 0; k < ndst; k++) + fprintf(stderr, " %02x", (unsigned char)dst0[k]); + fprintf(stderr, "\n"); + } + +next: if (dst0[-1] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran before buffer:" + " dst0[-1] = 0x%02x, expected 0x%02x", + title, dst0[-1], outguard); + } + if (dst0[ndst] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran after buffer:" + " dst0[ndst=%zu] = 0x%02x, expected 0x%02x", + title, ndst, dst0[ndst], outguard); + } + if (dst[0] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran past updated dst:" + " dst[0] = 0x%02x, expected 0x%02x", + title, dst[0], outguard); + } + + if (iconv_close(C) == -1) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv_close: %s (%d)", + title, strerror(error), error); + } +} + +static void +test_sample(const char *title, const struct sample *S) +{ + char buf[128]; + size_t nsrc, ndst; + + fprintf(stderr, "test %s from %s to %s\n", + title, S->src_codeset, S->dst_codeset); + + for (nsrc = 0; nsrc <= S->nsrc; nsrc++) { + snprintf(buf, sizeof(buf), "%s %zu/%zu", title, nsrc, S->ndst); + test_sample_bounded(buf, S, nsrc, S->ndst); + } + + for (ndst = 0; ndst <= S->ndst; ndst++) { + snprintf(buf, sizeof(buf), "%s %zu/%zu", title, S->nsrc, ndst); + test_sample_bounded(buf, S, S->nsrc, ndst); + } +} + +ATF_TC(iconv_samples); +ATF_TC_HEAD(iconv_samples, tc) +{ + + atf_tc_set_md_var(tc, "descr", "Test iconv on various fixed samples"); +} +ATF_TC_BODY(iconv_samples, tc) +{ + unsigned i; + + for (i = 0; i < __arraycount(samples); i++) { + const struct sample *S = &samples[i]; + struct sample reverse = { + .src_codeset = S->dst_codeset, + .dst_codeset = S->src_codeset, + .nsrc = S->ndst, + .src = S->dst, + .ndst = S->nsrc, + .dst = S->src, + .ninval = S->ninval_rev, + }; + char buf[128]; + + if (S->xfail) + atf_tc_expect_fail("%s", S->xfail); + + snprintf(buf, sizeof(buf), "case %u: %s to %s", i, + S->src_codeset, S->dst_codeset); + test_sample(buf, S); + if (S->ninval_rev != IRREVERSIBLE) { + snprintf(buf, sizeof(buf), "case %u: %s to %s", i, + S->dst_codeset, S->src_codeset); + test_sample(buf, &reverse); + } + + if (S->xfail) + atf_tc_expect_pass(); + } +} + +ATF_TC(iconv_pr59019_hz8); +ATF_TC_HEAD(iconv_pr59019_hz8, tc) +{ + + atf_tc_set_md_var(tc, "descr", "Truncated HZ8 input from PR 59019"); +} +ATF_TC_BODY(iconv_pr59019_hz8, tc) +{ + const char title[] = "iconv_pr59019_hz8"; + char in[4] = "\x7e\x7b\x7e\x7e"; /* ~{~~ */ + char out[4096], guard = arc4random(); + char *src0, *src, *dst0, *dst; + size_t srcleft0, srcleft, dstleft0, dstleft; + iconv_t C; + size_t ninval; + + memset(out, guard, sizeof(out)); + + REQUIRE_LIBC((C = iconv_open(/*to*/"UTF-8", /*from*/"HZ8")), + (iconv_t)-1); + + src = src0 = in; + srcleft = srcleft0 = sizeof(in); + dst = dst0 = out + 1; + dstleft = dstleft0 = sizeof(out) - 2; + + ninval = iconv(C, &src, &srcleft, &dst, &dstleft); + + /* + * XXX Not actually 100% sure this is the correct result -- I + * can't find a reference for the HZ8 encoding. + */ + ATF_CHECK_EQ_MSG(ninval, (size_t)-1, "[%s] iconv: ninval=%zu", title, + ninval); + + ATF_CHECK_MSG(src0 <= src && src <= src0 + srcleft0, "[%s] iconv:" + " src went from %p to %p, expected [%p,%p)", + title, src0, src, src0, src0 + srcleft0); + ATF_CHECK_MSG(srcleft <= srcleft0, "[%s] iconv:" + " srcleft went from %zu to %zu", + title, srcleft0, srcleft); + ATF_CHECK_MSG(dst0 <= dst && dst <= dst0 + dstleft0, "[%s] iconv:" + " dst went from %p to %p, expected [%p,%p)", + title, dst0, dst, dst0, dst0 + dstleft0); + ATF_CHECK_MSG(dstleft <= dstleft0, "[%s] iconv:" + " dstleft went from %zu to %zu", + title, dstleft0, dstleft); + + ATF_CHECK_EQ(dst0[-1], guard); + ATF_CHECK_EQ(dst0[dstleft0], guard); + + RL(iconv_close(C)); +} + +ATF_TP_ADD_TCS(tp) +{ + + ATF_TP_ADD_TC(tp, iconv_pr59019_hz8); + ATF_TP_ADD_TC(tp, iconv_samples); + + return atf_no_error(); +} diff --git a/lib/libc/tests/locale/Makefile b/lib/libc/tests/locale/Makefile index 03e89571aacd..62af569a1100 100644 --- a/lib/libc/tests/locale/Makefile +++ b/lib/libc/tests/locale/Makefile @@ -22,6 +22,7 @@ ATF_TESTS_C+= wctomb_2_test # Note: io_test requires zh_TW.Big5 locale (see ^/head@r315568) #NETBSD_ATF_TESTS_C= io_test +NETBSD_ATF_TESTS_C+= iconv_test NETBSD_ATF_TESTS_C+= mbrtowc_test NETBSD_ATF_TESTS_C+= mbstowcs_test NETBSD_ATF_TESTS_C+= mbsnrtowcs_test From nobody Tue Jun 30 17:21:09 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL01h2pz6jYMp for ; Tue, 30 Jun 2026 17:21:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKy2vhDz3rX9 for ; Tue, 30 Jun 2026 17:21:10 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840070; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/QJWRLXD2gEmNwssdzczXvIx7RDEX7kQQwjgvArpEn4=; b=AXj/Bq0MWFftyjlYHal0lxJS/dzaBCnLCpYm9K2ABR0tvrlPC3cjliWyv5LzYCEbuJ6S26 KsEXVCKUM7BPRNOJ3NYPocKExDz3miYLM4XSJMhYYDF9x6NwA8sjTxrJ8oXhLOAtTaH2Kh SOFc79gerJDGHP70DKmkto1VQVCNbXdoOCZwGm08L1x9M0IPOBWL0hf7CIRUjvhbqAw6GG JZhB1QcoJ9BRLOhHMTxavph79NX7/q6zgEuQQi65i8NB650/7C+ZzaTnU0XgAJA3utxH+e KeI20ZvxESYggti/FQdb7zVQ8Uqwn1EmsO5OhhYxsqlGsfh+0TlJBKaqtu1qiw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840070; a=rsa-sha256; cv=none; b=ZIw6tYM+i4B8nGpi2uB4PP6DcP7QhaoQ1b26IRT+wKy1O0gLXZN76vT/f7JNi1u6Ws9mId Nd8LJ8x5KWbAHjdZD9MX1Ow80m4UNokjkAkXJvSp0Bx3V9u2sBNUY+BvKkSfqSUFY4+zzC 80rj40YJYL/KlJhjMwU6Y92JUtvFRolv4RND+nCf7k0jaeZYdWfnNrefTxWxnv8jQU12Gt j2HAFc9wGoZUTRRgnSKCGYnATjXWa9sPNkFLkRd8652tOjtK0RkTd3WMAuVUmMZkxQk5ZY rl83aDqmBRKgUC/pazvRWOZehZPT8R4BjFJod0SDHFfbindip2rEGoVGanEnGQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840070; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/QJWRLXD2gEmNwssdzczXvIx7RDEX7kQQwjgvArpEn4=; b=KrGoi1HaMeq9m+fK+gojteCrdpvEkeFItzmWz04FLDF4d0H+qwehrM+t1qmGztkVq1XXWu YGiF9+cRS2h04BBFRmOh+v2MUWEbDQMqUNXkliW35GnJXZ81G1IdP6Rk/Iu/H7KvBOl84A yTtzfoBYSbWnmUDaskFA6cmmPOkU/JyRzriBYTTtpwM/Zh63Q+m7Nn0Z0MJj/Bq8gcxujw D4DIGURtkHK+8I1aNM8eubft1j4lINcCGHG7Of104tHn4dFPYFpqU7Np1m23U7xKnMpfUA MBO5PC9u0tlcvbxoaLEaEbRs5drk9VuklXm48Nj6C8Ku6fJrTm5GJTibzyNX8A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKx4WsyztSR for ; Tue, 30 Jun 2026 17:21:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44cf0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Taylor R Campbell From: Mark Johnston Subject: git: 07a27f8c8edc - releng/14.4 - iconv(3): Fix problems in various encodings List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 07a27f8c8edc171ae235f3f9ff7e56ecdc594faa Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:09 +0000 Message-Id: <6a43fb05.44cf0.531b5aa@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=07a27f8c8edc171ae235f3f9ff7e56ecdc594faa commit 07a27f8c8edc171ae235f3f9ff7e56ecdc594faa Author: Taylor R Campbell AuthorDate: 2026-06-22 21:15:25 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 21:26:44 +0000 iconv(3): Fix problems in various encodings Fix null pointer dereference with HZ8 encoding. Fix output buffer overrun in UTF-7, VIQR, ZW encodings. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57947 --- lib/libiconv_modules/HZ/citrus_hz.c | 2 ++ lib/libiconv_modules/UTF7/citrus_utf7.c | 20 +++++++++++++++----- lib/libiconv_modules/VIQR/citrus_viqr.c | 6 +++++- lib/libiconv_modules/ZW/citrus_zw.c | 7 +++++-- 4 files changed, 27 insertions(+), 8 deletions(-) diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index f12938a7dab8..db738b8f812e 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -262,6 +262,8 @@ _citrus_HZ_mbrtowc_priv(_HZEncodingInfo * __restrict ei, tail = psenc->chlen = 0; continue; } + if (graphic == NULL) + break; } else if (ch & 0x80) { if (graphic != GR(psenc->inuse)) break; diff --git a/lib/libiconv_modules/UTF7/citrus_utf7.c b/lib/libiconv_modules/UTF7/citrus_utf7.c index f924366551f1..e7c6a0862c54 100644 --- a/lib/libiconv_modules/UTF7/citrus_utf7.c +++ b/lib/libiconv_modules/UTF7/citrus_utf7.c @@ -296,7 +296,7 @@ done: static int _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei, - char * __restrict s, size_t n __unused, uint16_t u16, + char * __restrict s, size_t n, uint16_t u16, _UTF7State * __restrict psenc, size_t * __restrict nresult) { int bits, i; @@ -336,6 +336,8 @@ _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei, psenc->ch[psenc->chlen++] = base64[i]; } } + if (n < (size_t)psenc->chlen) + return (E2BIG); memcpy(s, psenc->ch, psenc->chlen); *nresult = psenc->chlen; psenc->chlen = 0; @@ -352,6 +354,8 @@ _citrus_UTF7_wcrtomb_priv(_UTF7EncodingInfo * __restrict ei, uint16_t u16[2]; int err, i, len; size_t nr, siz; + char buf[8], *bufp = buf; + _UTF7State psenc_save = *psenc; u32 = (uint32_t)wchar; if (u32 <= UTF16_MAX) { @@ -367,14 +371,20 @@ _citrus_UTF7_wcrtomb_priv(_UTF7EncodingInfo * __restrict ei, return (EILSEQ); } siz = 0; + if (n > sizeof(buf)) + n = sizeof(buf); for (i = 0; i < len; ++i) { - err = _citrus_UTF7_utf16tomb(ei, s, n, u16[i], psenc, &nr); - if (err != 0) - return (err); /* XXX: state has been modified */ - s += nr; + err = _citrus_UTF7_utf16tomb(ei, bufp, n, u16[i], psenc, &nr); + if (err != 0) { + *nresult = (size_t)-1; + *psenc = psenc_save; /* restore state */ + return (err); + } + bufp += nr; n -= nr; siz += nr; } + memcpy(s, buf, siz); *nresult = siz; return (0); diff --git a/lib/libiconv_modules/VIQR/citrus_viqr.c b/lib/libiconv_modules/VIQR/citrus_viqr.c index 1747c0a1705e..c1e88f188aab 100644 --- a/lib/libiconv_modules/VIQR/citrus_viqr.c +++ b/lib/libiconv_modules/VIQR/citrus_viqr.c @@ -323,7 +323,11 @@ _citrus_VIQR_wcrtomb_priv(_VIQREncodingInfo * __restrict ei, int ch = 0; switch (psenc->chlen) { - case 0: case 1: + case 0: + break; + case 1: + if (n-- < 1) + goto e2big; break; default: return (EINVAL); diff --git a/lib/libiconv_modules/ZW/citrus_zw.c b/lib/libiconv_modules/ZW/citrus_zw.c index 93590e550952..c59064e65465 100644 --- a/lib/libiconv_modules/ZW/citrus_zw.c +++ b/lib/libiconv_modules/ZW/citrus_zw.c @@ -264,9 +264,12 @@ _citrus_ZW_wcrtomb_priv(_ZWEncodingInfo * __restrict ei __unused, ch = (unsigned char)wc; switch (psenc->charset) { case NONE: - if (ch == '\0' || ch == '\n') + if (ch == '\0' || ch == '\n') { + if (n < 1) + return (E2BIG); + n -= 1; psenc->ch[psenc->chlen++] = ch; - else { + } else { if (n < 4) return (E2BIG); n -= 4; From nobody Tue Jun 30 17:21:11 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL10hmFz6jYXt for ; Tue, 30 Jun 2026 17:21:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVL00bzWz3rcd for ; Tue, 30 Jun 2026 17:21:12 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840072; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bDuZCxb2eoJHTwYn/lBD4MYqPrt/3dozbmTC1RtkKro=; b=Ve8yy712AJXHqXiF+XTwOhPOiZBYFFCDhRfOjfB142X6zKYpEGgQkgnfdA2yLXMv6PS5Rp 0DuXIcQ8QWLB8HYS1ej+LuCcuHUrqsNys9oAw26NrdyIx0LQuzvMwb5HrvFstfb+ROKBVn 2AN7czSuI1YhRylJxNsZUPNow32kQncqgIb+f+YzuWeGtStRXbkrZPYd30bwBJSe/apUrn 4q4ybwkiAGqkv3ODvX1UHOpXOWVGVoKxUtsQrn6FY3aOt6JgDgPGzZp/QIqXHRdRhPfoOG lTzcQq/pBpVr0PWjTcoYKJ5SZI3GhljrnqHS7xrv4/cB4on8daKQEJJQz3NgmQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840072; a=rsa-sha256; cv=none; b=PepJVyoy7o0X/6qKVrEDxuPxQwrH+tvDMDOZYwTAUzxgaMUbQ2CxN5/7NT7YvsA8Sqvqjn k0aPTlKZK+LQlppbV8l/taIaeIDNbyFy44zRCu2/n6dfgaUV0ozpI5be+l733WuVxxE6uq f26bs7ycg79ISAXjI0fQevf7/53aq3mHG0uv9R+qWggLlcfZMuT1N07N7gnAwMOY/I9vLR pD7Wis4C88xlOsw1UZ2pWkQnrw1oAw5yOIkzqtQvpc+4CVTLhtQXeY5TyKFBAKdTA59vrK 1cQ3qxFlILN2X98n2E/GYFz/QtND9Z1rZg2IkoU9SU71aOm138W2KgPC4FLgRA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840072; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bDuZCxb2eoJHTwYn/lBD4MYqPrt/3dozbmTC1RtkKro=; b=LZCX/9ouWB9heFIJeSMyQbVshFJ7/a0vfYpn6R9JrBtFibd9m4WqCxfAc+eoB8ugWCytFa Pe0S+sIEtdiZFHPyQmOK/IhIZQs6Odx9s+41uKzqJfZZc+ucUmDR6r+r/ZhmhDNB+QzlJ1 e/Hf7goIBnAl4elb9bEfXUHT81OgpaI//5nuUK1hESAykvedhaUrI95ECwE548u8Zkv8cf ns3FRB6bTuonaDtjCIfnJfWV/jzXIJSK5bGFftRqJyYixVqMDLeZYg/uaVvnrR4hNtkhkw Bw/7cwodmoAHFPB6gR89lNpTSdttx9kDikRxv1eXaKiKiRTb04BKteSdE4NAvw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKz656qztXy for ; Tue, 30 Jun 2026 17:21:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44cf5 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:11 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: ce422ff3fcc6 - releng/14.4 - iconv: Fix a buffer overflow in the HZ encoding List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: ce422ff3fcc621bd6857c69fea0b2e637c319ef3 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:11 +0000 Message-Id: <6a43fb07.44cf5.791a392e@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=ce422ff3fcc621bd6857c69fea0b2e637c319ef3 commit ce422ff3fcc621bd6857c69fea0b2e637c319ef3 Author: Mark Johnston AuthorDate: 2026-06-23 16:05:31 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 21:26:44 +0000 iconv: Fix a buffer overflow in the HZ encoding wcrtomb may store up to 2 2-byte escape sequences to the state buffer in addition to the character itself. In the worst case, a 3-byte heap overflow is possible. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57949 --- lib/libiconv_modules/HZ/citrus_hz.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index db738b8f812e..e16ab3a8e34c 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -132,7 +132,7 @@ typedef struct { typedef struct { escape_t *inuse; int chlen; - char ch[ROWCOL_MAX]; + char ch[4 + ROWCOL_MAX]; } _HZState; #define _CEI_TO_EI(_cei_) (&(_cei_)->ei) From nobody Tue Jun 30 17:21:18 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL65CPhz6jYHG for ; Tue, 30 Jun 2026 17:21:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVL62wVwz3rdL for ; Tue, 30 Jun 2026 17:21:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840078; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TA6LftWMz5XwRj/+TqpZKVYuo1vb7//D7++2rKbj7zA=; b=I7Ky0AIon4qTWnh4/OOjpng8JZNn9/O55L/S62Fr2Na9eRUA6zk/ryzYHc7FqyVhYcHyXo mzQf9Dj2MnXhn2kCzn+PteDzJLav+TqGhLeEewnHdn8L7KJkrMavZI8nBdA4YdmEgcV2lr oI8XRRJNcjErD+j/l6z0RBYNSl6hjWh2jtaN0K6pazgI/tgTaC0tGmHtFFBTZxKQjc/mOI fZdnbFXHaf06Tn4ccLRaehcfSk+sRKnxbpiwyz1qs/cuABlVlznWUgqRA4wu6OQjIXNuFT Zj+bibTmAtSNDaSSKo4HpqYqXpcj5J7XulRr68P1kYxiUyk7MHCvpZ4/peB0CA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840078; a=rsa-sha256; cv=none; b=H4vACQSCndT6ulxnE04dq1R7TUT/98tWfqmoc5JcdeT02A2sJfcVPRlqYl/FGrZLuTzAUC IrLMZdfA9RtQrwByF4x2bsqZLqpr0sneQ8nGd55NiDFTBvDGI3rz9DnQiV6wtIZpw0fZ3U XZdMe3eZJbSa7Q8COS1XhXeTLrpNZzdtAjtvlRq36XxK8n+9QSAYjFTYlTXf+/SNTVMkYp 7aFdSGPI2UitTDFbGl2oBTk3fN5DZLYMQ5OodgI8OxYNYaGjCZfwiJ4oLXuujGPM5H/HX7 L8Q0d3z83WbepRxE1f+KXgypNK5iwRvjIniM9sOH6NitZemV8H99R1PC4BeLEw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840078; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TA6LftWMz5XwRj/+TqpZKVYuo1vb7//D7++2rKbj7zA=; b=KK3FfuEAWG9lk6M+XD5XbhGpGwq3N9LVFKR2lNjA7RiX7iOFw6ly/hSJz4ugMPVqj/Upjs 2RH5P0qpTArh8XrEsHIO6W6BF13bBhy1tT4V06BVvCaOXzbUhcJTY74cjw6TbM0u2jPFzp bnKpGOfAN7R6WUi5Hvb+Y70Ux3GeFdvxsUf/fJJqgOLrvriu/oi0JZzkhgJr10YMC0JMOu X5ea+6laWJsJ9RF0p1INl6IG0D5D+ev1aQG6uLk4eQd8hmEVWqHBjakP5VjYH3IU4ka4RE zFtJrRQkZ+MEEX92wqoBwjsBB0IsNUwQSzNUPg6J9DS2NUuEq39hB7hy9jqUMQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL620MfztF2 for ; Tue, 30 Jun 2026 17:21:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45878 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:18 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Piotr Kubaj From: Mark Johnston Subject: git: b77d19dcc0d5 - releng/15.0 - sys/arm64: fix return values of freebsd32_{set,swap}context() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: b77d19dcc0d5ff8fc704ae255630b92b7a91f05d Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:18 +0000 Message-Id: <6a43fb0e.45878.3ad2120d@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=b77d19dcc0d5ff8fc704ae255630b92b7a91f05d commit b77d19dcc0d5ff8fc704ae255630b92b7a91f05d Author: Piotr Kubaj AuthorDate: 2026-06-11 11:41:29 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:51 +0000 sys/arm64: fix return values of freebsd32_{set,swap}context() This patch aligns the return values of freebsd32_{set,swap}context() with their counterparts on amd64 and powerpc64, fixing the setcontext() and swapcontext() calls in armv7 applications running on aarch64. In particular, this fixes random crashes in armv7 Ruby applications running on aarch64 hosts. Approved by: so Security: FreeBSD-EN-26:16.arm64 Tested by: fuz MFC after: 1 week (cherry picked from commit 92ae21e8a155734f73589b7ef9fa19a6bb6d042f) (cherry picked from commit 964215aa1347c9da457ecaced0521c29eaaf7b21) --- sys/arm64/arm64/freebsd32_machdep.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/arm64/arm64/freebsd32_machdep.c b/sys/arm64/arm64/freebsd32_machdep.c index d0218dc1dc80..3c7040bf5bb4 100644 --- a/sys/arm64/arm64/freebsd32_machdep.c +++ b/sys/arm64/arm64/freebsd32_machdep.c @@ -293,7 +293,7 @@ freebsd32_setcontext(struct thread *td, struct freebsd32_setcontext_args *uap) NULL, 0); } } - return (ret); + return (ret == 0 ? EJUSTRETURN : ret); } int @@ -341,7 +341,7 @@ freebsd32_swapcontext(struct thread *td, struct freebsd32_swapcontext_args *uap) } } } - return (ret); + return (ret == 0 ? EJUSTRETURN : ret); } void From nobody Tue Jun 30 17:21:19 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL8056Gz6jYNJ for ; Tue, 30 Jun 2026 17:21:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVL73x2Vz3rmL for ; Tue, 30 Jun 2026 17:21:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840079; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vf6Aq7tby/c3CwG/JikHChhMQYxW7iPmSfGUBmQoDDQ=; b=rncADX5Ki7mcdd09EYnjbwpDTzEnKL7NEg6lul31yZBqJ/17jUp28NdETftJr7UO6hc8Gc KGLLRxO3lTrZoU859HfDYLOdECvzjOfikobZqZVvsKNfsJeDv4Jsoysmqg8eQlGdRIiZxw Mffhuc4XyNzfmDJTRkTSJ6tSfkMuULorn6ON7L26/8QdHSNgFbFBbCPHx3Yp4wTu1djRQL HPQJoCxvxeTc3K98MBPzFJOtmps6CBmewrP/zsVg6kH2TlNgMcrPby2cJB2vLBLd7R1//P nAzwtzsgvjGPTjR0sZm25FNgDTLUH9xFKIz11w4AOg80Subb2E5SR0LvS5/TPQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840079; a=rsa-sha256; cv=none; b=bdN9ODbwvvTL93f5XqH+Ekc4GofoCNL/9CMzP1hmaOtDE5Q66+2elNxejptXuUfHo+VOPN EkBSGvVIhZH0bRfJqbJJaC0RLSXZ+CtSk9FpTFJSepL1fO2E922AyfwdPpM4axvW92nAxX pA8ZSada9YXdw4X2GxGYM8+C7DZYyDGgxLSZ+3qRwsCQKbXvqdyPzGyllLJoDfV0LllshZ 2uSrcpbf1iF7oW8dmKVJxhmiv4havsA8KS9TjqIS325QPMmH4bzDA2oZCHI4SlxJdi3hvH ++Q6CA+34DRUZ1099muVF/RuUVYmGDOoBWUn374IYVbkk7mZod63PL2m/YYcgQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840079; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vf6Aq7tby/c3CwG/JikHChhMQYxW7iPmSfGUBmQoDDQ=; b=adXmk0Aa7Qm2Yni2WMLFmf7F958L+QeN9Jx+q0o3oFjijyEAbSrlH9svjNCGTcFWiP2O58 gVEsWhB9xYZbv1vHUkXQ/vJbK8vUsdFkOrrpjCqdkUZQ1s/IY9/vMv+VnN3Howy4saTPoU gtdOM5gHlPCoxHAAI790sahoiiGobR7EK4d3dsa/G21Rxvre/sqp0XBubdx5oMAk64ddjM b7Q2TXDGPBcKReMSdC8IQDsp5mPqbsA+zw1V+mhFdYAXyayw0pzjovSNKioGxw2set2OKp KOMmADx3vSc8TO1usNxrdylB5OclvY1vt3T57AqqPAM2seewGCY4lCafhe3YwQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL72pJmztPp for ; Tue, 30 Jun 2026 17:21:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45fa8 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:19 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 7b3373d4eb5f - releng/15.0 - rpcsec_tls: Avoid a socket reference underflow in rpctls_server() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 7b3373d4eb5f86345e743e1233866fa7b0ff6160 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:19 +0000 Message-Id: <6a43fb0f.45fa8.69b8edf8@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=7b3373d4eb5f86345e743e1233866fa7b0ff6160 commit 7b3373d4eb5f86345e743e1233866fa7b0ff6160 Author: Mark Johnston AuthorDate: 2026-06-15 15:52:24 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 rpcsec_tls: Avoid a socket reference underflow in rpctls_server() The upcall_sockets tree owns a ref on any resident socket. When a socket is removed after a TLS handshake failure, rpctls_rpc_failed() thus calls soclose(). rpctls_server() does not acquire an extra ref to compensate for this. So, if the upcall fails, e.g., because rpc.tlsservd is not running, we'll call soclose() to drop the reference, but this effectively releases the xprt layer's reference. Fix the problem by explicitly acquiring a socket reference when adding a socket to the upcall tree. Approved by: so Security: FreeBSD-EN-26:17.rpcsec_tls PR: 289734 Reviewed by: rmacklem, glebius MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57555 (cherry picked from commit fc7993cf2d6ddba9f94683565838bf8fabc0145c) (cherry picked from commit f3b14134dec11c2f09980f25c4c60accbfea0f1e) --- sys/rpc/rpcsec_tls/rpctls_impl.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/sys/rpc/rpcsec_tls/rpctls_impl.c b/sys/rpc/rpcsec_tls/rpctls_impl.c index 51fe270b13d9..4d5f30b7a60a 100644 --- a/sys/rpc/rpcsec_tls/rpctls_impl.c +++ b/sys/rpc/rpcsec_tls/rpctls_impl.c @@ -190,7 +190,6 @@ sys_rpctls_syscall(struct thread *td, struct rpctls_syscall_args *uap) KRPC_CURVNET_RESTORE(); return (error); } - soref(ups.so); if (ups.server) { /* * Once this file descriptor is associated @@ -277,6 +276,7 @@ rpctls_connect(CLIENT *newclient, char *certname, struct socket *so, if (stat != RPC_SUCCESS) return (RPC_SYSTEMERROR); + soref(so); mtx_lock(&rpctls_lock); RB_INSERT(upsock_t, &upcall_sockets, &ups); mtx_unlock(&rpctls_lock); @@ -294,9 +294,16 @@ rpctls_connect(CLIENT *newclient, char *certname, struct socket *so, stat = rpctlscd_connect_2(&arg, &res, rpctls_connect_handle); if (stat == RPC_SUCCESS) *reterr = res.reterr; - else + else { rpctls_rpc_failed(&ups, so); + /* + * The socket was closed, make sure the krpc code doesn't close + * it a second time. + */ + CLNT_CONTROL(newclient, CLSET_TLS, &(int){RPCTLS_INHANDSHAKE}); + } + /* Unblock reception. */ CLNT_CONTROL(newclient, CLSET_BLOCKRCV, &(int){0}); @@ -388,6 +395,7 @@ rpctls_server(SVCXPRT *xprt, uint32_t *flags, uid_t *uid, int *ngrps, uint32_t *gidv; int i; + soref(xprt->xp_socket); mtx_lock(&rpctls_lock); RB_INSERT(upsock_t, &upcall_sockets, &ups); mtx_unlock(&rpctls_lock); @@ -407,9 +415,18 @@ rpctls_server(SVCXPRT *xprt, uint32_t *flags, uid_t *uid, int *ngrps, for (i = 0; i < *ngrps; i++) *gidp++ = *gidv++; } - } else + } else { rpctls_rpc_failed(&ups, xprt->xp_socket); + /* + * The socket was closed, make sure the krpc code doesn't close + * it a second time. + */ + sx_xlock(&ups.xp->xp_lock); + ups.xp->xp_tls = RPCTLS_FLAGS_HANDSHFAIL; + sx_xunlock(&ups.xp->xp_lock); + } + mem_free(res.gid.gid_val, 0); #ifdef INVARIANTS From nobody Tue Jun 30 17:21:20 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL92767z6jYbK for ; Tue, 30 Jun 2026 17:21:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVL85LMtz3rYW for ; Tue, 30 Jun 2026 17:21:20 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840080; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eTF0aATep2sHZjuznnNlKqX4FpaU44y1Vo/lKx2Urfk=; b=o1WU4gWeNZ4hMhJcPltrkuVVgj8eIawAFWSWghflF+BWY8FkiJTiZtEMKN8TiiTHwzehe6 UTGgQfMSQSfBVOsv9lmk456c+KZcXCNDjHbO+j6f646EMR6tltwMABG2AzhkzA4AzEntK9 5qA/UAuIk9ddLOAHF5RqHbvR56CYVwjjgAvN3SABRSq/+EtAbVEDaHa8olonLYaYsR41qx Ey+aj3j2q4PhwdNyaA0JWVGEvrm5gGQlmzMvtRZ5GHI9j9rCdpmWIHvS0dmS+rPEPHgOjF dlw4qdfjt4FONwWeijya/5YyIF1pZrpHh5hlFTDiBZYiKagevuKoxola3T8FCg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840080; a=rsa-sha256; cv=none; b=H4oELKKiuzxE7fO5v+CBWus9ZSE4jkZiw6f0+nfqHlvg5Het1n+wqgRzEnst8zlz8kKueg /crmKPzB6lvNxgzSPyoHL4TtRan/Fe/ujTGBUkuTB4vdwLc0oxa14P8j7VgnCTEr0KXxGO +TvgOetqZzl64C2dt21D7N2z6N5XmFJo+S75Y9QaZfQpbL+fWQ7ZbOmdKdAsI6VsmNG7Co hzAtp+FTCADhFkCpXCGAfcqVrvN+runbadnKSlUMZTv/gHWL2+GZhXCSK0Q6ZZnPUD8GKH mFn2lRe/jTpQ0/FW+kTcWFMYSk4pngbc9SKcuNhFm/4q6D3lsYbrT/4mouwLHA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840080; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eTF0aATep2sHZjuznnNlKqX4FpaU44y1Vo/lKx2Urfk=; b=JAAAZpKpJ5eqPTbZe/8JwatlUt4VIJ7lTosSvUW4xZ8effolSbQTzb8c2xa7sPkzsG5PCJ K6freRQb5Pp/m/y1BxuPpdGykV4opanW0pKpKbM0+fp9o4ynJ97WPXPyeoCH4KarZfzH/h AcyDxvEKjfeV409ms3NSMHYymZdphSGGLskEMK4qXcsELr4PQHbIPynLOri/XqeW0ubXuE rCxKoWiuPWNAn1XoYiZ/q1oaJgm8sz9of/29JL/2ToX7PhGk3bfyburX/Y77keDpp5wWxI dMt/zM6/MaBwXX59igOaBXsW8eS+FF7F2Vp/pC7n5mDip3JNOXW1wvLsONUtqA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL83fcXztSh for ; Tue, 30 Jun 2026 17:21:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44d4c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:20 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 2baf56862bfd - releng/15.0 - device_pager: Avoid double-insertion of pages into the pager list List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 2baf56862bfd8fe498df54984435bc3975f83298 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:20 +0000 Message-Id: <6a43fb10.44d4c.6c6d999c@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=2baf56862bfd8fe498df54984435bc3975f83298 commit 2baf56862bfd8fe498df54984435bc3975f83298 Author: Mark Johnston AuthorDate: 2026-06-22 14:40:22 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 device_pager: Avoid double-insertion of pages into the pager list Unmanaged device pager objects maintain a linked list of pages that were returned from the fault handler. Initially, such pages are valid, but msync(MS_INVALIDATE) can mark them invalid (and clean). They are not removed from page tables (since they are unmanaged), but a subsequent mlock() call can trigger a page fault that is handled by the pager. dev_pager_getpages() then re-inserts the page into the linked list even though it's already present there. This patch fixes the problem by removing the linked list. OBJ_PG_DTOR is set, so vm_object_terminate_pages() does nothing, and dev_pager_dealloc() instead handles cleanup of the object. Add a regression test case which triggers a queue.h assertion failure in unpatched kernels. Note, in stable branches we should avoid changing the layout of struct vm_object. Approved by: so Security: FreeBSD-SA-26:37.vm Security: CVE-2026-49418 Reported by: slidybat Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57743 --- sys/vm/device_pager.c | 36 ++++++++++++++++++++---------------- sys/vm/vm_object.h | 2 +- sys/vm/vm_page.c | 6 ++++-- tests/sys/vm/mmap_test.c | 30 ++++++++++++++++++++++++++++++ 4 files changed, 55 insertions(+), 19 deletions(-) diff --git a/sys/vm/device_pager.c b/sys/vm/device_pager.c index 221969307ba4..9277d6255418 100644 --- a/sys/vm/device_pager.c +++ b/sys/vm/device_pager.c @@ -213,7 +213,8 @@ again: object1 = NULL; object->handle = handle; object->un_pager.devp.ops = ops; - TAILQ_INIT(&object->un_pager.devp.devp_pglist); + if (object->type == OBJT_DEVICE) + vm_object_set_flag(object, OBJ_PG_DTOR); TAILQ_INSERT_TAIL(&dev_pager_object_list, object, pager_object_list); mtx_unlock(&dev_pager_mtx); @@ -325,15 +326,12 @@ dev_pager_free_page(vm_object_t object, vm_page_t m) KASSERT((object->type == OBJT_DEVICE && (m->oflags & VPO_UNMANAGED) != 0), ("Managed device or page obj %p m %p", object, m)); - TAILQ_REMOVE(&object->un_pager.devp.devp_pglist, m, plinks.q); vm_page_putfake(m); } static void dev_pager_dealloc(vm_object_t object) { - vm_page_t m; - VM_OBJECT_WUNLOCK(object); object->un_pager.devp.ops->cdev_pg_dtor(object->un_pager.devp.handle); @@ -343,15 +341,25 @@ dev_pager_dealloc(vm_object_t object) VM_OBJECT_WLOCK(object); if (object->type == OBJT_DEVICE) { - /* - * Free up our fake pages. - */ - while ((m = TAILQ_FIRST(&object->un_pager.devp.devp_pglist)) - != NULL) { - if (vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL) == 0) - continue; + struct pctrie_iter pages; + vm_page_t m; - dev_pager_free_page(object, m); + vm_page_iter_init(&pages, object); +restart: + VM_RADIX_FOREACH(m, &pages) { + if (!vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL)) { + pctrie_iter_reset(&pages); + goto restart; + } + if (vm_page_iter_remove(&pages, m)) { + /* + * We could end up with invalid pages installed + * by the generic page fault handler. Typically + * these are replaced by the device pager. + */ + vm_page_free(m); + } else if ((m->flags & PG_FICTITIOUS) != 0) + dev_pager_free_page(object, m); } } object->handle = NULL; @@ -380,10 +388,6 @@ dev_pager_getpages(vm_object_t object, vm_page_t *ma, int count, int *rbehind, (object->type == OBJT_MGTDEVICE && (ma[0]->oflags & VPO_UNMANAGED) == 0), ("Wrong page type %p %p", ma[0], object)); - if (object->type == OBJT_DEVICE) { - TAILQ_INSERT_TAIL(&object->un_pager.devp.devp_pglist, - ma[0], plinks.q); - } if (rbehind) *rbehind = 0; if (rahead) diff --git a/sys/vm/vm_object.h b/sys/vm/vm_object.h index 20e9fc1fcdcd..cf1ced134ae8 100644 --- a/sys/vm/vm_object.h +++ b/sys/vm/vm_object.h @@ -134,7 +134,7 @@ struct vm_object { * devp_pglist - list of allocated pages */ struct { - TAILQ_HEAD(, vm_page) devp_pglist; + void *spare[2]; const struct cdev_pager_ops *ops; void *handle; } devp; diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c index 16878604fa11..9de91d2503f2 100644 --- a/sys/vm/vm_page.c +++ b/sys/vm/vm_page.c @@ -1355,8 +1355,10 @@ vm_page_putfake(vm_page_t m) KASSERT((m->oflags & VPO_UNMANAGED) != 0, ("managed %p", m)); KASSERT((m->flags & PG_FICTITIOUS) != 0, ("vm_page_putfake: bad page %p", m)); - vm_page_assert_xbusied(m); - vm_page_busy_free(m); + if (m->object != NULL) { + vm_page_assert_xbusied(m); + vm_page_busy_free(m); + } uma_zfree(fakepg_zone, m); } diff --git a/tests/sys/vm/mmap_test.c b/tests/sys/vm/mmap_test.c index 6bc30f73ca95..a94fb56c46cf 100644 --- a/tests/sys/vm/mmap_test.c +++ b/tests/sys/vm/mmap_test.c @@ -362,6 +362,35 @@ ATF_TC_BODY(mmap__maxprot_shm, tc) ATF_REQUIRE(close(fd) == 0); } +/* A regression test for a bug in the device pager. */ +ATF_TC_WITHOUT_HEAD(mmap__device_reinsert); +ATF_TC_BODY(mmap__device_reinsert, tc) +{ + void *p; + int fd; + + fd = open("/dev/devstat", O_RDONLY); + ATF_REQUIRE(fd >= 0); + + p = mmap(NULL, getpagesize(), PROT_READ, MAP_SHARED, fd, 0); + ATF_REQUIRE(p != MAP_FAILED); + + /* + * Use mlock() to trigger a fault, since msync() will not actually + * remove the page from the process page tables. + */ + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + ATF_REQUIRE(msync(p, getpagesize(), MS_INVALIDATE) == 0); + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + ATF_REQUIRE(msync(p, getpagesize(), MS_INVALIDATE) == 0); + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + + ATF_REQUIRE(munmap(p, getpagesize()) == 0); +} + ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TC(tp, mmap__map_at_zero); @@ -371,6 +400,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, mmap__write_only); ATF_TP_ADD_TC(tp, mmap__maxprot_basic); ATF_TP_ADD_TC(tp, mmap__maxprot_shm); + ATF_TP_ADD_TC(tp, mmap__device_reinsert); return (atf_no_error()); } From nobody Tue Jun 30 17:21:21 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLB156tz6jYRH for ; Tue, 30 Jun 2026 17:21:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVL964l1z3rbf for ; Tue, 30 Jun 2026 17:21:21 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840081; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=a0/4j0+QjMZFkRjJMFc5wMejhLZe8i1zbkYas6Z9tVs=; b=qC7icv8Bkb2IZL+pFPGTwyxp6WsAHDjW2Dq4bTesGQrdTJgDW70+nJqwAfvxPgxUCXnzT7 ozCxvdpH8QF7twqH9g0q1K0pNe4Zw+fTi7wjRbPxFMdKru1BzEOPv4R/H/WyuusNm1SZFT HDdYvsZ0YNRkoi9GG5VRCqj/sZFMRkcmjrLjSPPZvvh0I/Zdn2W8uO6+J4ZiXgF1jTiWCr NFj+AD3fAhfEgd+ya1oZHZeGwp2iMA7dHwTq96mnoLmUJQyilAgVlIZjM76TGEgaqz9eHT DdunpptOTGiFwg6/JRdz7cMl20W/tgZZs9vnT23+IoM3OEfCCMlbrXHIjKPL7Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840081; a=rsa-sha256; cv=none; b=P8o2ZcHZ+cDRJndlwNBDdG3sqNdT5UU+avuwwFdHteDoP23PZrCtGYNd9KUs1u6ksRsd8L xgWiszQm3hR/UnHSz9Adzhas4gFAa1sTWCmXdlFdpeF/AtgaGQlJnkXVGlIxrExmU5vO3K +p7rgpKlkuUlfyimCq3t4Wje8slpwK4q814DR7895+t7Ed9BEpXsiy9l6S+hG2IcfhB+Dp h6lRAXngyY9l5rUMJ+GTSZINRz9pb4rGBpJ+1OAwN3+FBwZ9boOL6E7F2xbLBTgL1MeVHY FX5ZwRh58bglgGUQOFyqzjmMYsNEmfdOl8MDQa7rKgxt4xUSMoHIOH5h/Kl0jQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840081; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=a0/4j0+QjMZFkRjJMFc5wMejhLZe8i1zbkYas6Z9tVs=; b=TL9jCVTMXjr1V/kXcB9rOdTpQWGpEddIk94HDvuJJQRkf/sDPJckdStWxduRtrSau0GOa9 AkY8cmldnMG5AUjBRdk2rVoDuj5TOkNkMxCt1Y3UUxChS5dWmg3Sq71w0qbeKmI+Xu1Sgq p2HuA53Xg8wUwV/82oTroXcuW+IRL7CoJCZYWlAfOPsH24gHKyLKX90R8wkb0viiDq65RB JNQ2xXyMgv1kVoJuugtKBFC5Z+kHNbdnEmfts/i4vFI5ZUJenrzfIPRGRIYlwlx3SDkSuL Bh1dokvhqXouKclGzlZDhMjBP5WxtRtyCiFxUi8Le8azyf89UHM6xfvJz4ULww== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL948VVztY4 for ; Tue, 30 Jun 2026 17:21:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4589a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:21 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Jamie Gritton From: Mark Johnston Subject: git: 029528221261 - releng/15.0 - jail: Don't double-free the current prison in kern_jail_set/get List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 029528221261c56a5c6480e897c861fc91583315 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:21 +0000 Message-Id: <6a43fb11.4589a.14918014@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=029528221261c56a5c6480e897c861fc91583315 commit 029528221261c56a5c6480e897c861fc91583315 Author: Jamie Gritton AuthorDate: 2026-06-09 22:31:40 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 jail: Don't double-free the current prison in kern_jail_set/get Approved by: so Security: FreeBSD-SA-26:38.jail Security: CVE-2026-49419 Reported by: Yuxiang Yang, et al Discussed with: markj (cherry picked from commit b52dc2067618fc73e8d4d20e4035d1a67a8b455d) (cherry picked from commit 4938fd9361b497241df8f442f1f87cc73ef81d6c) --- sys/kern/kern_jail.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 523b7e314a10..40b2d7a69e3e 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -1097,14 +1097,17 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) * Look up and create jails based on the * descriptor's prison. */ - prison_free(mypr); - error = jaildesc_find(td, jfd_in, &mypr, NULL); + struct prison *jdpr; + + error = jaildesc_find(td, jfd_in, &jdpr, NULL); if (error != 0) { vfs_opterror(opts, error == ENOENT ? "descriptor to dead jail" : "not a jail descriptor"); goto done_errmsg; } + prison_free(mypr); + mypr = jdpr; if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0) { error = EPERM; goto done_free; @@ -2545,14 +2548,17 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags) } if (flags & JAIL_AT_DESC) { /* Look up jails based on the descriptor's prison. */ - prison_free(mypr); - error = jaildesc_find(td, jfd_in, &mypr, NULL); + struct prison *jdpr; + + error = jaildesc_find(td, jfd_in, &jdpr, NULL); if (error != 0) { vfs_opterror(opts, error == ENOENT ? "descriptor to dead jail" : "not a jail descriptor"); goto done; } + prison_free(mypr); + mypr = jdpr; } if (flags & (JAIL_GET_DESC | JAIL_OWN_DESC)) { /* Allocate a jail descriptor to return later. */ From nobody Tue Jun 30 17:21:22 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLC1G01z6jYRJ for ; Tue, 30 Jun 2026 17:21:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLB6FbDz3rf0 for ; Tue, 30 Jun 2026 17:21:22 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840082; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JNh5oTPdW54T3utvc/FrZfEShvZUIpfdgjSCLdL17Lo=; b=LQHe9NHBr08n5acYL5C5gNrBVlWqxel6CR5yiTpdW834IhFOirJ3I6JuEVn379/ktkGWyJ lI/JdzbSA4/iZegUZl43J4uWvBEMNbL1sCxH1pXYlpFgrxk4J/dkWr6HHQxTLF6qgXa48k Eb5QcPqFNMR2+a8oZQ3yWIjHzfaObDiTr5aSiKEEUw4vVfrwdoDh/bjfH4NnuSIha86dc0 0dwUEEVCyyW4sxONm69n7rEnjIM+V5AP8aXrjsUmlmfu8+X0zYLULwIfFUbup3R/Yw2A/K FaoQsV3kJcC9cd9Uz+g3raBBexdoCAka1R4NItKcxOeAtE0ekZ4Hn1st1m5f6g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840082; a=rsa-sha256; cv=none; b=j+6gzBz/o9f/NcrDVAS8wNFLyx0sjrGzkw7UpeOXaozPiuVd5opqH0d50urta4d8Vt0Pec rPskNosXqbuioIKnxbCc530WzdkePgSE15WdrN4UXF7pQGJ1dPY49xsFJi2OTvWtgEfQVG SVZq4LKZkjpbaYEvWUN1r1YEa1UlvldQv0w3Dw0TVUzrV6Vq2cuGAOR3XINc41W0iWBeca 92wp9qHDqkp+wx0pQk8Wms1aAlUjfeFv0u7C+haByKQjtRsN/7i59vEUFn+73MXbAybcUZ iEVtwGnbgtMEljaQ42Nli8gemCcqemabrLOJfrh0+dnmjQc95YQ0YaJD67IVSA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840082; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JNh5oTPdW54T3utvc/FrZfEShvZUIpfdgjSCLdL17Lo=; b=hD/sZGhQXKIF7rbFz0Ma4Z5YK+Ma3tEVh4AK3WIKuu0nF7oiI1KkjfAnmC2lWiFqD/b+Z2 88PhWs4j+eY4oHfGiW85jSvl2O0AKUnW6mZPvZsquA5pJhGztYt7qRsnS/ixCDdUH0bWn9 ue/pFRxjnyPb5eyGt0W32adNi35PwvVBlOWMXXTLDh83Qfdap0TTcmx3PKvIEbemmjd9ik 4krtDU7jO1yp3TpSuAuZH0uMl2tepZIOc5ayHe0MqWzYMSshYCdtT6tuJq5RSYluYmBqlD S1V8kE5mVJHsqJzvGb0/sVMFAXalg0UHFEfLsdv8F4vwqGPFz5ZsMJhmYZBUrg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLB56BWztnC for ; Tue, 30 Jun 2026 17:21:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45f6a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:22 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Konstantin Belousov From: Mark Johnston Subject: git: de7144f7c391 - releng/15.0 - execve_block(): a mechanism for mutual exclusion with execve() on the process List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: de7144f7c3912818f80138dae914c361f04d06fb Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:22 +0000 Message-Id: <6a43fb12.45f6a.45323ebb@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=de7144f7c3912818f80138dae914c361f04d06fb commit de7144f7c3912818f80138dae914c361f04d06fb Author: Konstantin Belousov AuthorDate: 2026-05-26 17:36:20 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 execve_block(): a mechanism for mutual exclusion with execve() on the process (cherry picked from commit e1a84b7708c2514769625c2af6c5034694013b6a) (cherry picked from commit a80e40ce9ee0a0641927730a193ff1f5641e71b6) execve_block_pass(9): a helper to wait for the execblock to pass (cherry picked from commit 450fe67d19eb2ea8e27109214ff21064fdcf808c) (cherry picked from commit cbd58477285888b1b7ff21bdd0bc039f7ffad4ef) proc: Allow to make proc_rwmem() operate on a consistent address space (cherry picked from commit e1b0d051bbf7e4e730470cbd6622f71a639834c3) (cherry picked from commit be6e5131066753dc23f8e9f223acc023b7618b63) kern_proc.c: ensure stability of the vmspace we read the strings from (cherry picked from commit a22c044cce41864a32af6b8281a3c416a2664d7f) (cherry picked from commit 3748c2e257046056b969a5d47231695798198f4d) kern_proc.c: ensure stability of the vmspace for sysctl kern.proc.vmmap (cherry picked from commit 5fe6e08d2db56b530f0df2903ef24cfabab7b8ea) (cherry picked from commit 20ed389b365030b868298d7ab4e8a01270c06c9f) kern_proc.c: ensure stability of the vmspace for sysctl kern.proc.vm_layout (cherry picked from commit 31fa677e4af00b795bf671847b4dc72960c90f14) (cherry picked from commit eb03358c407d6f3c073320bdc26a5e4ceb923ca1) kern_proc.c: make kern.proc.osrel atomic (cherry picked from commit 80626f34ee985671bb8c60ee986b89587b7a1511) (cherry picked from commit 5e633db3f8e126578c097c9649ba3be552664c6a) kern_proc.c: disallow execve around sysctl kern.proc.kstacks (cherry picked from commit 8b5abd9027b8b1f6290c756730ee3adebed007f4) (cherry picked from commit 60d8df61846fc1f5f7e2a400d2b0237c9f1a6be8) kern_proc.c: disallow execve around sysctl kern.proc.rlimit (cherry picked from commit 5a91fa5a7656c99e527fe7e6f6bf6bd9e85ab589) (cherry picked from commit 24d8b3364405e5c32618c6930d4fdd8bc543a08f) kern_event: block the target process from execing for sysctl kern.proc.kqueue (cherry picked from commit 79b384bd8fdff4869ce4799edb0342ff5c25b6fa) (cherry picked from commit d172933cf69fb4dc58e07261653481a33cdf1da0) kern_resource.c: disallow execve around sysctl kern.proc.rlimitusage (cherry picked from commit 836749817036b90b60af0584fa21f2d9dbd60ff7) (cherry picked from commit 035f66ff2924808f534df9065388aabf66e77266) kern_procctl(PROC_WX_MAPPINGS_PERMIT): ensure stability of the target vmspace (cherry picked from commit 6a572920f251ac8ac6a80a55d4d039736ea7dd65) (cherry picked from commit d80a7fd6e6df65b4d85e6977557c3fbe8d9ff02e) linux_prlimit(): block execve for the target (cherry picked from commit e41c28e67fac9cd22a85b160c5c9d0477ed03600) (cherry picked from commit e9002239571fb1502505ff85061934ef0ebd2e1e) pfs_readdir(): block the target process from execing (cherry picked from commit 4c0a0909f928baac982b7de4bfa5b5ca7de5291a) (cherry picked from commit 1744ce4b052d4aea94c1c3b87fefabd0952e6082) pseudofs: ensure that the target process vmspace is stable for VOP_READ/WRITE (cherry picked from commit a4993bac41350e85bc9affb862d2974a1a09bb5e) (cherry picked from commit 277f612073d0b086604448814867cadaacad4ca8) procfs, linprocfs: ensure target process vmspace stability (cherry picked from commit 5db31f1b47b586a5091eb41fc957236f28b78dba) (cherry picked from commit 78981848b85fdd826eb830dfdd6d92c14b0f8bb3) sys_set*id(9): wait for the execblocks to pass (cherry picked from commit d0384f50dad25d3358d76f7556969ea1d515ba68) (cherry picked from commit e0492444761b638ff072222d39ba5d6088a63370) kern_exec.c: explicitly include sys/limits.h for UINT_MAX (cherry picked from commit f5fce0bcc370a9700249e64901eabf2e0be4ecb0) (cherry picked from commit 42d8b0bf7a5a074c7035585a06dd44aed1b2cbdd) Approved by: so Security: FreeBSD-SA-26:39.execve Security: CVE-2026-49415 --- sys/compat/linprocfs/linprocfs.c | 16 +--- sys/compat/linux/linux_misc.c | 15 +++ sys/fs/cuse/cuse.c | 4 +- sys/fs/procfs/procfs_map.c | 17 ++-- sys/fs/procfs/procfs_mem.c | 6 +- sys/fs/pseudofs/pseudofs_vnops.c | 69 ++++++++++---- sys/kern/kern_event.c | 22 ++++- sys/kern/kern_exec.c | 83 ++++++++++++++++- sys/kern/kern_exit.c | 1 + sys/kern/kern_fork.c | 1 + sys/kern/kern_proc.c | 191 +++++++++++++++++++++++---------------- sys/kern/kern_procctl.c | 21 +++-- sys/kern/kern_prot.c | 20 +++- sys/kern/kern_resource.c | 27 ++++-- sys/kern/sys_process.c | 131 ++++++++++++++++++++++----- sys/sys/imgact.h | 4 + sys/sys/proc.h | 3 +- sys/sys/ptrace.h | 15 ++- 18 files changed, 470 insertions(+), 176 deletions(-) diff --git a/sys/compat/linprocfs/linprocfs.c b/sys/compat/linprocfs/linprocfs.c index 7ac48786c77b..df3434848a81 100644 --- a/sys/compat/linprocfs/linprocfs.c +++ b/sys/compat/linprocfs/linprocfs.c @@ -1315,19 +1315,13 @@ linprocfs_doprocmaps(PFS_FILL_ARGS) struct vattr vat; bool private; - PROC_LOCK(p); - error = p_candebug(td, p); - PROC_UNLOCK(p); - if (error) - return (error); - if (uio->uio_rw != UIO_READ) return (EOPNOTSUPP); - error = 0; - vm = vmspace_acquire_ref(p); - if (vm == NULL) - return (ESRCH); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, + &vm); + if (error != 0) + return (error); if (SV_CURPROC_FLAG(SV_LP64)) l_map_str = l64_map_str; @@ -1425,7 +1419,7 @@ linprocfs_doprocmaps(PFS_FILL_ARGS) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_CHECK_DEBUG | PRVM_BLOCK_EXEC, vm); return (error); } diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c index 0925ffb64480..9e9536335cf2 100644 --- a/sys/compat/linux/linux_misc.c +++ b/sys/compat/linux/linux_misc.c @@ -2008,6 +2008,7 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) u_int which; int flags; int error; + bool exec_blocked; if (args->new == NULL && args->old != NULL) { if (linux_get_dummy_limit(td, args->resource, &rlim)) { @@ -2035,6 +2036,7 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) return (error); } + exec_blocked = false; flags = PGET_HOLD | PGET_NOTWEXIT; if (args->new != NULL) flags |= PGET_CANDEBUG; @@ -2047,6 +2049,14 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) error = pget(args->pid, flags, &p); if (error != 0) return (error); + exec_blocked = true; + PROC_LOCK(p); + execve_block_wait(td, p); + error = args->new != NULL ? p_candebug(td, p) : + p_cansee(td, p); + PROC_UNLOCK(p); + if (error != 0) + goto out; } if (args->old != NULL) { PROC_LOCK(p); @@ -2069,6 +2079,11 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) error = kern_proc_setrlimit(td, p, which, &nrlim); out: + if (exec_blocked) { + PROC_LOCK(p); + execve_unblock(td, p); + PROC_UNLOCK(p); + } PRELE(p); return (error); } diff --git a/sys/fs/cuse/cuse.c b/sys/fs/cuse/cuse.c index d63a7d4691cf..b9423fd3543d 100644 --- a/sys/fs/cuse/cuse.c +++ b/sys/fs/cuse/cuse.c @@ -914,7 +914,7 @@ cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s, }; PHOLD(proc_s); - error = proc_rwmem(proc_s, &uio); + error = proc_rwmem(proc_s, &uio, 0); PRELE(proc_s); } else if (proc_cur == proc_s) { @@ -933,7 +933,7 @@ cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s, }; PHOLD(proc_d); - error = proc_rwmem(proc_d, &uio); + error = proc_rwmem(proc_d, &uio, 0); PRELE(proc_d); } else { error = EINVAL; diff --git a/sys/fs/procfs/procfs_map.c b/sys/fs/procfs/procfs_map.c index d4913a7b0f1d..1ed785f1ad90 100644 --- a/sys/fs/procfs/procfs_map.c +++ b/sys/fs/procfs/procfs_map.c @@ -40,6 +40,7 @@ #include #include #include +#include #include #include #include @@ -93,15 +94,14 @@ procfs_doprocmap(PFS_FILL_ARGS) bool wrap32; #endif - PROC_LOCK(p); - error = p_candebug(td, p); - PROC_UNLOCK(p); - if (error) - return (error); - if (uio->uio_rw != UIO_READ) return (EOPNOTSUPP); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, + &vm); + if (error != 0) + return (error); + #ifdef COMPAT_FREEBSD32 wrap32 = false; if (SV_CURPROC_FLAG(SV_ILP32)) { @@ -111,9 +111,6 @@ procfs_doprocmap(PFS_FILL_ARGS) } #endif - vm = vmspace_acquire_ref(p); - if (vm == NULL) - return (ESRCH); map = &vm->vm_map; vm_map_lock_read(map); VM_MAP_ENTRY_FOREACH(entry, map) { @@ -238,6 +235,6 @@ procfs_doprocmap(PFS_FILL_ARGS) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, vm); return (error); } diff --git a/sys/fs/procfs/procfs_mem.c b/sys/fs/procfs/procfs_mem.c index 0020b8f8a8d8..eb692c32923b 100644 --- a/sys/fs/procfs/procfs_mem.c +++ b/sys/fs/procfs/procfs_mem.c @@ -60,11 +60,7 @@ procfs_doprocmem(PFS_FILL_ARGS) if (uio->uio_resid == 0) return (0); - PROC_LOCK(p); - error = p_candebug(td, p); - PROC_UNLOCK(p); - if (error == 0) - error = proc_rwmem(p, uio); + error = proc_rwmem(p, uio, PRVM_CHECK_DEBUG | PRVM_BLOCK_EXEC); return (error); } diff --git a/sys/fs/pseudofs/pseudofs_vnops.c b/sys/fs/pseudofs/pseudofs_vnops.c index 8cd092118d0e..059e8fd0e8b2 100644 --- a/sys/fs/pseudofs/pseudofs_vnops.c +++ b/sys/fs/pseudofs/pseudofs_vnops.c @@ -37,6 +37,7 @@ #include #include #include +#include #include #include #include @@ -132,6 +133,7 @@ static int pfs_lookup_proc(pid_t pid, struct proc **p) { struct proc *proc; + struct thread *td; proc = pfind(pid); if (proc == NULL) @@ -141,8 +143,10 @@ pfs_lookup_proc(pid_t pid, struct proc **p) return (0); } _PHOLD(proc); - PROC_UNLOCK(proc); + td = curthread; + execve_block_wait(td, proc); *p = proc; + PROC_UNLOCK(proc); return (1); } @@ -672,6 +676,7 @@ pfs_read(struct vop_read_args *va) struct pfs_node *pn = pvd->pvd_pn; struct uio *uio = va->a_uio; struct proc *proc; + struct thread *td; struct sbuf *sb = NULL; int error, locked; off_t buflen, buflim; @@ -690,21 +695,30 @@ pfs_read(struct vop_read_args *va) if (pn->pn_fill == NULL) PFS_RETURN (EIO); + td = curthread; + /* * This is necessary because either process' privileges may * have changed since the open() call. */ - if (!pfs_visible(curthread, pn, pvd->pvd_pid, &proc)) + if (!pfs_visible(td, pn, pvd->pvd_pid, &proc)) PFS_RETURN (EIO); - if (proc != NULL) { - _PHOLD(proc); - PROC_UNLOCK(proc); - } vhold(vn); locked = VOP_ISLOCKED(vn); VOP_UNLOCK(vn); + if (proc != NULL) { + _PHOLD(proc); + execve_block_wait(td, proc); + if (!pfs_visible_proc(td, pn, proc)) { + PROC_UNLOCK(proc); + error = EIO; + goto ret; + } + PROC_UNLOCK(proc); + } + if (pn->pn_flags & PFS_RAWRD) { PFS_TRACE(("%zd resid", uio->uio_resid)); error = pn_fill(curthread, proc, pn, NULL, uio); @@ -774,8 +788,12 @@ pfs_read(struct vop_read_args *va) ret: vn_lock(vn, locked | LK_RETRY); vdrop(vn); - if (proc != NULL) - PRELE(proc); + if (proc != NULL) { + PROC_LOCK(proc); + execve_unblock(td, proc); + _PRELE(proc); + PROC_UNLOCK(proc); + } PFS_RETURN (error); } @@ -846,6 +864,7 @@ pfs_readdir(struct vop_readdir_args *va) struct pfs_node *pd = pvd->pvd_pn; pid_t pid = pvd->pvd_pid; struct proc *p, *proc; + struct thread *td; struct pfs_node *pn; struct uio *uio; struct pfsentry *pfsent, *pfsent2; @@ -891,11 +910,13 @@ pfs_readdir(struct vop_readdir_args *va) KASSERT(pid == NO_PID || proc != NULL, ("%s(): no process for pid %lu", __func__, (unsigned long)pid)); + td = curthread; if (pid != NO_PID) { PROC_LOCK(proc); /* check if the directory is visible to the caller */ if (!pfs_visible_proc(curthread, pd, proc)) { + execve_unblock(td, proc); _PRELE(proc); PROC_UNLOCK(proc); pfs_unlock(pd); @@ -955,6 +976,7 @@ pfs_readdir(struct vop_readdir_args *va) resid -= PFS_DELEN; } if (proc != NULL) { + execve_unblock(td, proc); _PRELE(proc); PROC_UNLOCK(proc); } @@ -1079,6 +1101,7 @@ pfs_write(struct vop_write_args *va) struct pfs_node *pn = pvd->pvd_pn; struct uio *uio = va->a_uio; struct proc *proc; + struct thread *td; struct sbuf sb; int error; @@ -1098,36 +1121,44 @@ pfs_write(struct vop_write_args *va) if (uio->uio_resid > PFS_MAXBUFSIZ) PFS_RETURN (EIO); + td = curthread; + /* * This is necessary because either process' privileges may * have changed since the open() call. */ - if (!pfs_visible(curthread, pn, pvd->pvd_pid, &proc)) + if (!pfs_visible(td, pn, pvd->pvd_pid, &proc)) PFS_RETURN (EIO); if (proc != NULL) { _PHOLD(proc); + execve_block_wait(td, proc); + if (!pfs_visible_proc(td, pn, proc)) { + PROC_UNLOCK(proc); + error = EIO; + goto out; + } PROC_UNLOCK(proc); } if (pn->pn_flags & PFS_RAWWR) { error = pn_fill(curthread, proc, pn, NULL, uio); - if (proc != NULL) - PRELE(proc); - PFS_RETURN (error); + goto out; } sbuf_uionew(&sb, uio, &error); - if (error) { - if (proc != NULL) - PRELE(proc); - PFS_RETURN (error); - } + if (error != 0) + goto out; error = pn_fill(curthread, proc, pn, &sb, uio); sbuf_delete(&sb); - if (proc != NULL) - PRELE(proc); +out: + if (proc != NULL) { + PROC_LOCK(proc); + execve_unblock(td, proc); + _PRELE(proc); + PROC_UNLOCK(proc); + } PFS_RETURN (error); } diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c index 72cbff6c1371..41d7fbdeaa09 100644 --- a/sys/kern/kern_event.c +++ b/sys/kern/kern_event.c @@ -50,6 +50,7 @@ #include #include #include +#include #include #include #include @@ -3122,10 +3123,6 @@ sysctl_kern_proc_kqueue(SYSCTL_HANDLER_ARGS) if ((u_int)arg2 > 2 || (u_int)arg2 == 0) return (EINVAL); - error = pget((pid_t)name[0], PGET_HOLD | PGET_CANDEBUG, &p); - if (error != 0) - return (error); - td = curthread; #ifdef COMPAT_FREEBSD32 compat32 = SV_CURPROC_FLAG(SV_ILP32); @@ -3133,6 +3130,17 @@ sysctl_kern_proc_kqueue(SYSCTL_HANDLER_ARGS) compat32 = false; #endif + error = pget((pid_t)name[0], PGET_NOTWEXIT, &p); + if (error != 0) + return (error); + + _PHOLD(p); + execve_block_wait(td, p); + error = p_candebug(td, p); + if (error != 0) + goto out1; + PROC_UNLOCK(p); + s = sbuf_new_for_sysctl(&sm, NULL, 0, req); if (s == NULL) { error = ENOMEM; @@ -3153,7 +3161,11 @@ sysctl_kern_proc_kqueue(SYSCTL_HANDLER_ARGS) sbuf_delete(s); out: - PRELE(p); + PROC_LOCK(p); +out1: + execve_unblock(td, p); + _PRELE(p); + PROC_UNLOCK(p); return (error); } diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index 5b79b8d96fc8..3dc3e54ee762 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -26,7 +26,6 @@ * SUCH DAMAGE. */ -#include #include "opt_capsicum.h" #include "opt_hwpmc_hooks.h" #include "opt_hwt_hooks.h" @@ -46,6 +45,7 @@ #include #include #include +#include #include #include #include @@ -385,6 +385,77 @@ execve_nosetid(struct image_params *imgp) } } +/* + * Returns true if the execblock was obtained, in this case the + * process lock is kept. Returns false if the execblock was not + * obtained, but the function slept and the lock was dropped. + */ +bool +execve_block(struct thread *td, struct proc *p) +{ + PROC_LOCK_ASSERT(p, MA_OWNED); + MPASS(td == curthread); + MPASS(p != td->td_proc || (p->p_flag & P_INEXEC) == 0); + + if (p != td->td_proc && (p->p_flag & P_INEXEC) != 0) { + p->p_flag |= P_INEXEC_WAIT; + msleep(&p->p_execblock, &p->p_mtx, PDROP, "inexec", 0); + return (false); + } + MPASS(p->p_execblock < UINT_MAX); + p->p_execblock++; + return (true); +} + +/* + * Might drop the process lock internally, callers must re-check the + * invariants afterward. + */ +void +execve_block_wait(struct thread *td, struct proc *p) +{ + bool first; + + PROC_ASSERT_HELD(p); + PROC_LOCK_ASSERT(p, MA_OWNED); + + for (first = true;; first = false) { + if (!first) + PROC_LOCK(p); + if (execve_block(td, p)) + return; + } +} + +void +execve_unblock(struct thread *td, struct proc *p) +{ + PROC_LOCK_ASSERT(p, MA_OWNED); + MPASS(td == curthread); + + MPASS(p->p_execblock > 0); + p->p_execblock--; + if (p->p_execblock == 0 && (p->p_flag & P_INEXEC_WAIT) != 0) { + p->p_flag &= ~P_INEXEC_WAIT; + wakeup(&p->p_execblock); + } +} + +void +execve_block_pass(struct thread *td) +{ + struct proc *p; + + MPASS(td == curthread); + p = td->td_proc; + PROC_LOCK_ASSERT(p, MA_OWNED); + + while (p->p_execblock != 0) { + p->p_flag |= P_INEXEC_WAIT; + msleep(&p->p_execblock, &p->p_mtx, 0, "exeblk", 0); + } +} + /* * In-kernel implementation of execve(). All arguments are assumed to be * userspace pointers from the passed thread. @@ -440,6 +511,7 @@ do_execve(struct thread *td, struct image_args *args, struct mac *mac_p, PROC_LOCK(p); KASSERT((p->p_flag & P_INEXEC) == 0, ("%s(): process already has P_INEXEC flag", __func__)); + execve_block_pass(td); p->p_flag |= P_INEXEC; PROC_UNLOCK(p); @@ -909,7 +981,10 @@ interpret: * as we're now a bona fide freshly-execed process. */ KNOTE_LOCKED(p->p_klist, NOTE_EXEC); - p->p_flag &= ~P_INEXEC; + MPASS(p->p_execblock == 0); + if ((p->p_flag & P_INEXEC_WAIT) != 0) + wakeup(&p->p_execblock); + p->p_flag &= ~(P_INEXEC | P_INEXEC_WAIT); /* clear "fork but no exec" flag, as we _are_ execing */ p->p_acflag &= ~AFORK; @@ -1005,7 +1080,9 @@ exec_fail_dealloc: exec_fail: /* we're done here, clear P_INEXEC */ PROC_LOCK(p); - p->p_flag &= ~P_INEXEC; + if ((p->p_flag & P_INEXEC_WAIT) != 0) + wakeup(&p->p_execblock); + p->p_flag &= ~(P_INEXEC | P_INEXEC_WAIT); PROC_UNLOCK(p); SDT_PROBE1(proc, , , exec__failure, error); diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c index a32b5a1b3354..82db30e02c8a 100644 --- a/sys/kern/kern_exit.c +++ b/sys/kern/kern_exit.c @@ -323,6 +323,7 @@ exit1(struct thread *td, int rval, int signo) while (p->p_lock > 0) msleep(&p->p_lock, &p->p_mtx, PWAIT, "exithold", 0); + MPASS(p->p_execblock == 0); PROC_UNLOCK(p); /* Drain the limit callout while we don't have the proc locked */ callout_drain(&p->p_limco); diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c index 2ab9b363f8b5..e61bbde06c42 100644 --- a/sys/kern/kern_fork.c +++ b/sys/kern/kern_fork.c @@ -382,6 +382,7 @@ do_fork(struct thread *td, struct fork_req *fr, struct proc *p2, struct thread * bzero(&p2->p_startzero, __rangeof(struct proc, p_startzero, p_endzero)); + p2->p_execblock = 0; /* Tell the prison that we exist. */ prison_proc_hold(p2->p_ucred->cr_prison); diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c index 6e56664d12ce..f13b5f1f892d 100644 --- a/sys/kern/kern_proc.c +++ b/sys/kern/kern_proc.c @@ -43,6 +43,7 @@ #include #include #include +#include #include #include #include @@ -1833,8 +1834,8 @@ pargs_drop(struct pargs *pa) } static int -proc_read_string(struct thread *td, struct proc *p, const char *sptr, char *buf, - size_t len) +proc_read_string(struct thread *td, struct vmspace *vm, const char *sptr, + char *buf, size_t len) { ssize_t n; @@ -1843,7 +1844,7 @@ proc_read_string(struct thread *td, struct proc *p, const char *sptr, char *buf, * and is aligned at the end of the page, and the following page is not * mapped. */ - n = proc_readmem(td, p, (vm_offset_t)sptr, buf, len); + n = vmspace_iop(td, vm, (vm_offset_t)sptr, buf, len, UIO_READ); if (n <= 0) return (ENOMEM); return (0); @@ -1859,8 +1860,8 @@ enum proc_vector_type { #ifdef COMPAT_FREEBSD32 static int -get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, - size_t *vsizep, enum proc_vector_type type) +get_proc_vector32(struct thread *td, struct proc *p, struct vmspace *vm, + char ***proc_vectorp, size_t *vsizep, enum proc_vector_type type) { struct freebsd32_ps_strings pss; Elf32_Auxinfo aux; @@ -1871,8 +1872,8 @@ get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, int i, error; error = 0; - if (proc_readmem(td, p, PROC_PS_STRINGS(p), &pss, sizeof(pss)) != - sizeof(pss)) + if (vmspace_iop(td, vm, PROC_PS_STRINGS(p), &pss, sizeof(pss), + UIO_READ) != sizeof(pss)) return (ENOMEM); switch (type) { case PROC_ARG: @@ -1895,8 +1896,8 @@ get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, if (vptr % 4 != 0) return (ENOEXEC); for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) { - if (proc_readmem(td, p, ptr, &aux, sizeof(aux)) != - sizeof(aux)) + if (vmspace_iop(td, vm, ptr, &aux, sizeof(aux), + UIO_READ) != sizeof(aux)) return (ENOMEM); if (aux.a_type == AT_NULL) break; @@ -1912,7 +1913,7 @@ get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, return (EINVAL); } proc_vector32 = malloc(size, M_TEMP, M_WAITOK); - if (proc_readmem(td, p, vptr, proc_vector32, size) != size) { + if (vmspace_iop(td, vm, vptr, proc_vector32, size, UIO_READ) != size) { error = ENOMEM; goto done; } @@ -1933,8 +1934,8 @@ done: #endif static int -get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, - size_t *vsizep, enum proc_vector_type type) +get_proc_vector(struct thread *td, struct proc *p, struct vmspace *vm, + char ***proc_vectorp, size_t *vsizep, enum proc_vector_type type) { struct ps_strings pss; Elf_Auxinfo aux; @@ -1944,11 +1945,13 @@ get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, int i; #ifdef COMPAT_FREEBSD32 - if (SV_PROC_FLAG(p, SV_ILP32) != 0) - return (get_proc_vector32(td, p, proc_vectorp, vsizep, type)); + if (SV_PROC_FLAG(p, SV_ILP32) != 0) { + return (get_proc_vector32(td, p, vm, proc_vectorp, + vsizep, type)); + } #endif - if (proc_readmem(td, p, PROC_PS_STRINGS(p), &pss, sizeof(pss)) != - sizeof(pss)) + if (vmspace_iop(td, vm, PROC_PS_STRINGS(p), &pss, sizeof(pss), + UIO_READ) != sizeof(pss)) return (ENOMEM); switch (type) { case PROC_ARG: @@ -1986,8 +1989,8 @@ get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, * to the allocated proc_vector. */ for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) { - if (proc_readmem(td, p, ptr, &aux, sizeof(aux)) != - sizeof(aux)) + if (vmspace_iop(td, vm, ptr, &aux, sizeof(aux), + UIO_READ) != sizeof(aux)) return (ENOMEM); if (aux.a_type == AT_NULL) break; @@ -2009,7 +2012,7 @@ get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, return (EINVAL); /* In case we are built without INVARIANTS. */ } proc_vector = malloc(size, M_TEMP, M_WAITOK); - if (proc_readmem(td, p, vptr, proc_vector, size) != size) { + if (vmspace_iop(td, vm, vptr, proc_vector, size, UIO_READ) != size) { free(proc_vector, M_TEMP); return (ENOMEM); } @@ -2025,6 +2028,7 @@ static int get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, enum proc_vector_type type) { + struct vmspace *vm; size_t done, len, nchr, vsize; int error, i; char **proc_vector, *sptr; @@ -2037,9 +2041,14 @@ get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, */ nchr = 2 * (PATH_MAX + ARG_MAX); - error = get_proc_vector(td, p, &proc_vector, &vsize, type); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | + PRVM_CHECK_VISIBILITY, &vm); if (error != 0) return (error); + + error = get_proc_vector(td, p, vm, &proc_vector, &vsize, type); + if (error != 0) + goto out; for (done = 0, i = 0; i < (int)vsize && done < nchr; i++) { /* * The program may have scribbled into its argv array, e.g. to @@ -2049,7 +2058,7 @@ get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, if (proc_vector[i] == NULL) break; for (sptr = proc_vector[i]; ; sptr += GET_PS_STRINGS_CHUNK_SZ) { - error = proc_read_string(td, p, sptr, pss_string, + error = proc_read_string(td, vm, sptr, pss_string, sizeof(pss_string)); if (error != 0) goto done; @@ -2066,6 +2075,8 @@ get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, } done: free(proc_vector, M_TEMP); +out: + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_VISIBILITY, vm); return (error); } @@ -2086,11 +2097,17 @@ proc_getenvv(struct thread *td, struct proc *p, struct sbuf *sb) int proc_getauxv(struct thread *td, struct proc *p, struct sbuf *sb) { + struct vmspace *vm; size_t vsize, size; char **auxv; int error; - error = get_proc_vector(td, p, &auxv, &vsize, PROC_AUX); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, + &vm); + if (error != 0) + return (error); + error = get_proc_vector(td, p, vm, &auxv, &vsize, PROC_AUX); + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, vm); if (error == 0) { #ifdef COMPAT_FREEBSD32 if (SV_PROC_FLAG(p, SV_ILP32) != 0) @@ -2403,6 +2420,7 @@ sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS) int error, *name; struct vnode *vp; struct proc *p; + struct thread *td; vm_map_t map; struct vmspace *vm; @@ -2411,11 +2429,12 @@ sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS) return (EINVAL); name = (int *)arg1; + td = curthread; error = pget((pid_t)name[0], PGET_WANTREAD, &p); if (error != 0) return (error); - vm = vmspace_acquire_ref(p); - if (vm == NULL) { + error = proc_vmspace_ref(td, p, PRVM_CHECK_DEBUG, &vm); + if (error != 0) { PRELE(p); return (ESRCH); } @@ -2527,7 +2546,7 @@ sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_CHECK_DEBUG, vm); PRELE(p); free(kve, M_TEMP); return (error); @@ -2622,6 +2641,7 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) struct ucred *cred; struct vnode *vp; struct vmspace *vm; + struct thread *td; vm_offset_t addr; unsigned int last_timestamp; int error; @@ -2633,10 +2653,11 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) _PHOLD(p); PROC_UNLOCK(p); - vm = vmspace_acquire_ref(p); - if (vm == NULL) { + td = curthread; + error = proc_vmspace_ref(td, p, PRVM_CHECK_DEBUG, &vm); + if (error != 0) { PRELE(p); - return (ESRCH); + return (error); } kve = malloc(sizeof(*kve), M_TEMP, M_WAITOK | M_ZERO); @@ -2740,7 +2761,7 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) if (vp != NULL) { vn_fullpath(vp, &fullpath, &freepath); kve->kve_vn_type = vntype_to_kinfo(vp->v_type); - cred = curthread->td_ucred; + cred = td->td_ucred; vn_lock(vp, LK_SHARED | LK_RETRY); if (VOP_GETATTR(vp, &va, cred) == 0) { kve->kve_vn_fileid = va.va_fileid; @@ -2796,7 +2817,7 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_CHECK_DEBUG, vm); PRELE(p); free(kve, M_TEMP); return (error); @@ -2835,7 +2856,7 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) struct kinfo_kstack *kkstp; int error, i, *name, numthreads; lwpid_t *lwpidarray; - struct thread *td; + struct thread *td, *ctd; struct stack *st; struct sbuf sb; struct proc *p; @@ -2846,7 +2867,8 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) return (EINVAL); name = (int *)arg1; - error = pget((pid_t)name[0], PGET_NOTINEXEC | PGET_WANTREAD, &p); + ctd = curthread; + error = pget((pid_t)name[0], PGET_WANTREAD, &p); if (error != 0) return (error); @@ -2855,6 +2877,14 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) lwpidarray = NULL; PROC_LOCK(p); + execve_block_wait(ctd, p); + error = p_candebug(ctd, p); + if (error != 0) { + execve_unblock(ctd, p); + _PRELE(p); + PROC_UNLOCK(p); + return (error); + } do { if (lwpidarray != NULL) { free(lwpidarray, M_TEMP); @@ -2867,15 +2897,6 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) PROC_LOCK(p); } while (numthreads < p->p_numthreads); - /* *** 716 LINES SKIPPED *** From nobody Tue Jun 30 17:21:23 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLD5vkwz6jY5c for ; Tue, 30 Jun 2026 17:21:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLD0DkTz3rbl for ; Tue, 30 Jun 2026 17:21:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840084; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tCPUQ4svKpP9umCK4qMj2UPIpe0Y2y8yoMryiAS7kVc=; b=jt11S8oV0xEUt9JTL/IqlwJW0Ow5ZHvG2tLfyx8224Q42Y/Ft6A0IfrJXZP0EEeoHqteFR cl1KzWHo7DyB80Av02NDMY7ReMbw/s4byQQssdPy7/bSkAp2ErnepJlnIAOpQe4ilZArwX lUFuF4YnZF7t7LaXFXgcWVaMkcPAHh8bQUW261kK7+7aBZNxSLLMxpUwjMqZOn+THpNxae TsaEY4AScRDNwGnOdgaaGYB0BqiZviL3FAE5nH/CaG3uCIwG4bXYS8TGJzgCHdT97jCLWA 70oSKnCxQaLDoy9QiAIvHNQ2+5w3rNC2CspwyiCH4v3FA4q4CU9AL2Qar/PFkw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840084; a=rsa-sha256; cv=none; b=csJTumXm+qloRz8vmQ2PH7crWDAv0eYhHpyewGiCJRhOcODnvm+jdCPqEWpHS6UU7DrlxL ptnDebbciW2iC7Fah/o0145q0L81CQ6+PqQz7Qz7niRkiRRUg+qNQhs8QCMaT9qedFwh0L uUfC+zyVvd1rfmQdnjyPJdp4bdEHPLSoaK6kvs1LXkDGU5ZJHrlOtSxbIEveMMqjGWJLTk 5pL13/t2ireeJfcJNr0kPIjHNV1IfNlql7Bb/VxCK88SEwHSs+ZZzbX7gr0dScpP+eLezq 9cyiuErtXrhbTBYOhI50lQuRcBWZzB6cdWp1oO74drahs3NfDUcHFWSBjtJZDQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840084; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tCPUQ4svKpP9umCK4qMj2UPIpe0Y2y8yoMryiAS7kVc=; b=Kw27cvMyftZUKARw2ROnR++DuBjgJQLBuYugs37J0CRRsat1UzpplJp1pjetRAATV6g7Je DqEQ+oya9ZS1kO0jlce2HYvgr6KxlZBm0N5GUqJVvk6VbgtYrtIIaJve2isgpkd7AsnrRB AbCF4AeZdeOgTFjeNJ44+lHM0rVA7wI4/0N73OHcL0/BCxR/p37jN50sYXxn1Bl7FM0eJb 6yDyrODUxX27aM08NPH34VtMlK4MrKFLDXe3lS0CVG9tBlWVn2MVVPb1WyBEVXTzMx84Rh r37YxbXhzMHiYaYYDAWM+GIewm5FoY5CnNGLVROKlGoRt8oYGrD4RReQDo3E6Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLC5zL9ztPr for ; Tue, 30 Jun 2026 17:21:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 444fd by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:23 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 2318d229b76a - releng/15.0 - zfs: Roll up several upstream commits List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 2318d229b76a4b6e463c7a78694e42377c3a8042 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:23 +0000 Message-Id: <6a43fb13.444fd.6ae69859@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=2318d229b76a4b6e463c7a78694e42377c3a8042 commit 2318d229b76a4b6e463c7a78694e42377c3a8042 Author: Mark Johnston AuthorDate: 2026-06-28 22:00:26 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 zfs: Roll up several upstream commits This commit squashes the following upstream commits: #18604 63a0ff6cd nvpair: Check for un-terminated strings in packed nvlist #18617 38cd6adcb Extend dataset zfs_ioc_set_prop() secpolicy #18615 738791027 Fix the integer type in zfs_ioc_userspace_many() #18623 06d8cfedb Add additional verification of size fields and strings Approved by: so Security: FreeBSD-SA-26:40.zfs Security: CVE-2026-49429 Security: CVE-2026-49430 Security: CVE-2026-49431 --- sys/contrib/openzfs/module/nvpair/nvpair.c | 49 ++++-- sys/contrib/openzfs/module/zfs/dmu_recv.c | 44 ++++-- sys/contrib/openzfs/module/zfs/vdev_label.c | 1 + sys/contrib/openzfs/module/zfs/zfs_ioctl.c | 34 +++- sys/contrib/openzfs/module/zfs/zfs_quota.c | 8 +- .../tests/zfs-tests/cmd/libzfs_input_check.c | 172 ++++++++++++++++++++- 6 files changed, 272 insertions(+), 36 deletions(-) diff --git a/sys/contrib/openzfs/module/nvpair/nvpair.c b/sys/contrib/openzfs/module/nvpair/nvpair.c index eb8c14b4a783..525cd2711f00 100644 --- a/sys/contrib/openzfs/module/nvpair/nvpair.c +++ b/sys/contrib/openzfs/module/nvpair/nvpair.c @@ -135,7 +135,8 @@ #define NVP_SIZE_CALC(name_len, data_len) \ (NV_ALIGN((sizeof (nvpair_t)) + name_len) + NV_ALIGN(data_len)) -static int i_get_value_size(data_type_t type, const void *data, uint_t nelem); +static int i_get_value_size(data_type_t type, const void *data, uint_t nelem, + size_t max_size); static int nvlist_add_common(nvlist_t *nvl, const char *name, data_type_t type, uint_t nelem, const void *data); @@ -810,8 +811,10 @@ i_validate_nvpair(nvpair_t *nvp) * verify nvp_type, nvp_value_elem, and also possibly * verify string values and get the value size. */ - size2 = i_get_value_size(type, NVP_VALUE(nvp), NVP_NELEM(nvp)); size1 = nvp->nvp_size - NVP_VALOFF(nvp); + size2 = i_get_value_size(type, NVP_VALUE(nvp), NVP_NELEM(nvp), + size1); + if (size2 < 0 || size1 != NV_ALIGN(size2)) return (EFAULT); @@ -1002,12 +1005,21 @@ nvlist_remove_nvpair(nvlist_t *nvl, nvpair_t *nvp) * DATA_TYPE_STRING and * DATA_TYPE_STRING_ARRAY * Is data == NULL then the size of the string(s) is excluded. + * + * If 'max_size' is non-zero, then don't look beyond 'max_size' number of + * bytes when calculating a value size. Note that 'max_size' should include + * the NULL terminator byte when calculating string size. If 'max_size' is 0, + * it is ignored. */ static int -i_get_value_size(data_type_t type, const void *data, uint_t nelem) +i_get_value_size(data_type_t type, const void *data, uint_t nelem, + size_t max_size) { uint64_t value_sz; + if (max_size == 0) + max_size = INT32_MAX; + if (i_validate_type_nelem(type, nelem) != 0) return (-1); @@ -1052,10 +1064,15 @@ i_get_value_size(data_type_t type, const void *data, uint_t nelem) break; #endif case DATA_TYPE_STRING: - if (data == NULL) + if (data == NULL) { value_sz = 0; - else - value_sz = strlen(data) + 1; + } else { + value_sz = strnlen(data, max_size); + if (value_sz >= max_size) { + return (-1); /* string not terminated */ + } + value_sz += 1; + } break; case DATA_TYPE_BOOLEAN_ARRAY: value_sz = (uint64_t)nelem * sizeof (boolean_t); @@ -1089,16 +1106,23 @@ i_get_value_size(data_type_t type, const void *data, uint_t nelem) break; case DATA_TYPE_STRING_ARRAY: value_sz = (uint64_t)nelem * sizeof (uint64_t); - if (data != NULL) { char *const *strs = data; uint_t i; + size_t newsize; /* no alignment requirement for strings */ for (i = 0; i < nelem; i++) { if (strs[i] == NULL) return (-1); - value_sz += strlen(strs[i]) + 1; + + newsize = strnlen(strs[i], max_size); + + if (newsize == max_size) + return (-1); /* not terminated */ + + value_sz += newsize + 1; /* +1 for NULL */ + max_size -= newsize + 1; } } break; @@ -1163,7 +1187,7 @@ nvlist_add_common(nvlist_t *nvl, const char *name, * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) included. */ - if ((value_sz = i_get_value_size(type, data, nelem)) < 0) + if ((value_sz = i_get_value_size(type, data, nelem, 0)) < 0) return (EINVAL); if (i_validate_nvpair_value(type, nelem, data) != 0) @@ -1588,7 +1612,7 @@ nvpair_value_common(const nvpair_t *nvp, data_type_t type, uint_t *nelem, #endif if (data == NULL) return (EINVAL); - if ((value_sz = i_get_value_size(type, NULL, 1)) < 0) + if ((value_sz = i_get_value_size(type, NULL, 1, 0)) < 0) return (EINVAL); memcpy(data, NVP_VALUE(nvp), (size_t)value_sz); if (nelem != NULL) @@ -3018,7 +3042,8 @@ nvs_native_nvp_op(nvstream_t *nvs, nvpair_t *nvp) * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) excluded. */ - if ((value_sz = i_get_value_size(type, NULL, NVP_NELEM(nvp))) < 0) + if ((value_sz = i_get_value_size(type, NULL, NVP_NELEM(nvp), + NVP_SIZE(nvp))) < 0) return (EFAULT); if (NVP_SIZE_CALC(nvp->nvp_name_sz, value_sz) > nvp->nvp_size) @@ -3331,7 +3356,7 @@ nvs_xdr_nvp_op(nvstream_t *nvs, nvpair_t *nvp) * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) excluded. */ - if ((value_sz = i_get_value_size(type, NULL, nelem)) < 0) + if ((value_sz = i_get_value_size(type, NULL, nelem, NVP_SIZE(nvp)) < 0)) return (EFAULT); /* if there is no data to extract then return */ diff --git a/sys/contrib/openzfs/module/zfs/dmu_recv.c b/sys/contrib/openzfs/module/zfs/dmu_recv.c index 45c7af2bdcd2..e9945b2d9660 100644 --- a/sys/contrib/openzfs/module/zfs/dmu_recv.c +++ b/sys/contrib/openzfs/module/zfs/dmu_recv.c @@ -2883,16 +2883,20 @@ receive_read_record(dmu_recv_cookie_t *drc) { struct drr_object *drro = &drc->drc_rrd->header.drr_u.drr_object; - uint32_t size = DRR_OBJECT_PAYLOAD_SIZE(drro); + uint32_t size; void *buf = NULL; dmu_object_info_t doi; + size = DRR_OBJECT_PAYLOAD_SIZE(drro); + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + if (size != 0) - buf = kmem_zalloc(size, KM_SLEEP); + buf = vmem_zalloc(size, KM_SLEEP); err = receive_read_payload_and_next_header(drc, size, buf); if (err != 0) { - kmem_free(buf, size); + vmem_free(buf, size); return (err); } err = dmu_object_info(drc->drc_os, drro->drr_object, &doi); @@ -2916,7 +2920,11 @@ receive_read_record(dmu_recv_cookie_t *drc) case DRR_WRITE: { struct drr_write *drrw = &drc->drc_rrd->header.drr_u.drr_write; - int size = DRR_WRITE_PAYLOAD_SIZE(drrw); + uint64_t size = DRR_WRITE_PAYLOAD_SIZE(drrw); + + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + abd_t *abd = abd_alloc_linear(size, B_FALSE); err = receive_read_payload_and_next_header(drc, size, abd_to_buf(abd)); @@ -2933,12 +2941,18 @@ receive_read_record(dmu_recv_cookie_t *drc) { struct drr_write_embedded *drrwe = &drc->drc_rrd->header.drr_u.drr_write_embedded; - uint32_t size = P2ROUNDUP(drrwe->drr_psize, 8); - void *buf = kmem_zalloc(size, KM_SLEEP); + uint32_t size; + void *buf; + + size = P2ROUNDUP(drrwe->drr_psize, 8); + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + + buf = vmem_zalloc(size, KM_SLEEP); err = receive_read_payload_and_next_header(drc, size, buf); if (err != 0) { - kmem_free(buf, size); + vmem_free(buf, size); return (err); } @@ -2967,7 +2981,11 @@ receive_read_record(dmu_recv_cookie_t *drc) case DRR_SPILL: { struct drr_spill *drrs = &drc->drc_rrd->header.drr_u.drr_spill; - int size = DRR_SPILL_PAYLOAD_SIZE(drrs); + uint64_t size = DRR_SPILL_PAYLOAD_SIZE(drrs); + + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + abd_t *abd = abd_alloc_linear(size, B_FALSE); err = receive_read_payload_and_next_header(drc, size, abd_to_buf(abd)); @@ -3118,7 +3136,7 @@ receive_process_record(struct receive_writer_arg *rwa, abd_free(rrd->abd); rrd->abd = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } return (0); @@ -3132,7 +3150,7 @@ receive_process_record(struct receive_writer_arg *rwa, rrd->abd = NULL; rrd->payload = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } @@ -3145,7 +3163,7 @@ receive_process_record(struct receive_writer_arg *rwa, { struct drr_object *drro = &rrd->header.drr_u.drr_object; err = receive_object(rwa, drro, rrd->payload); - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; break; } @@ -3183,7 +3201,7 @@ receive_process_record(struct receive_writer_arg *rwa, struct drr_write_embedded *drrwe = &rrd->header.drr_u.drr_write_embedded; err = receive_write_embedded(rwa, drrwe, rrd->payload); - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; break; } @@ -3252,7 +3270,7 @@ receive_writer_thread(void *arg) rrd->abd = NULL; rrd->payload = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } /* diff --git a/sys/contrib/openzfs/module/zfs/vdev_label.c b/sys/contrib/openzfs/module/zfs/vdev_label.c index 7e222eac5edc..a3f78af51ba5 100644 --- a/sys/contrib/openzfs/module/zfs/vdev_label.c +++ b/sys/contrib/openzfs/module/zfs/vdev_label.c @@ -1371,6 +1371,7 @@ vdev_label_read_bootenv(vdev_t *rvd, nvlist_t *bootenv) VB_NVLIST); break; } + vbe->vbe_bootenv[sizeof (vbe->vbe_bootenv) - 1] = '\0'; fnvlist_add_string(bootenv, FREEBSD_BOOTONCE, buf); } diff --git a/sys/contrib/openzfs/module/zfs/zfs_ioctl.c b/sys/contrib/openzfs/module/zfs/zfs_ioctl.c index 1b2392aeaa85..0b0dd5b682a3 100644 --- a/sys/contrib/openzfs/module/zfs/zfs_ioctl.c +++ b/sys/contrib/openzfs/module/zfs/zfs_ioctl.c @@ -937,6 +937,23 @@ zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr) ZFS_DELEG_PERM_CREATE, cr)); } +/* + * Policy for dataset set property operations. Individual properties checked by + * zfs_check_settable(), additionally require zfs_secpolicy_recv() when setting + * properties as part of a receive. + */ +static int +zfs_secpolicy_setprops(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr) +{ + boolean_t received = zc->zc_cookie; + int error; + + if (received && (error = zfs_secpolicy_recv(zc, innvl, cr))) + return (error); + + return (zfs_secpolicy_read(zc, innvl, cr)); +} + int zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr) { @@ -3883,7 +3900,6 @@ static int zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl) { (void) unused, (void) outnvl; - const char *message; char *poolname; spa_t *spa; int error; @@ -3904,7 +3920,7 @@ zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl) if (error != 0) return (error); - message = fnvlist_lookup_string(innvl, "message"); + const char *message = fnvlist_lookup_string(innvl, "message"); if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) { spa_close(spa, FTAG); @@ -6364,21 +6380,27 @@ zfs_ioc_userspace_one(zfs_cmd_t *zc) * outputs: * zc_nvlist_dst[_size] data buffer (array of zfs_useracct_t) * zc_cookie zap cursor + * + * The zc_nvlist_dst output array is limited to 1000 entries. */ static int zfs_ioc_userspace_many(zfs_cmd_t *zc) { + const size_t batch_limit = 1000 * sizeof (zfs_useracct_t); + uint64_t bufsize = MIN(zc->zc_nvlist_dst_size, batch_limit); zfsvfs_t *zfsvfs; - int bufsize = zc->zc_nvlist_dst_size; - if (bufsize <= 0) + if (bufsize < sizeof (zfs_useracct_t)) { + zc->zc_nvlist_dst_size = sizeof (zfs_useracct_t); return (SET_ERROR(ENOMEM)); + } int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE); if (error != 0) return (error); void *buf = vmem_alloc(bufsize, KM_SLEEP); + zc->zc_nvlist_dst_size = bufsize; error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie, buf, &zc->zc_nvlist_dst_size, &zc->zc_guid); @@ -6869,7 +6891,7 @@ zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl) dsl_pool_t *dp; dsl_dataset_t *new, *old; const char *firstsnap; - uint64_t used, comp, uncomp; + uint64_t used = 0, comp = 0, uncomp = 0; firstsnap = fnvlist_lookup_string(innvl, "firstsnap"); @@ -7756,7 +7778,7 @@ zfs_ioctl_init(void) zfs_ioc_send, zfs_secpolicy_send); zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop, - zfs_secpolicy_none); + zfs_secpolicy_setprops); zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy, zfs_secpolicy_destroy); zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename, diff --git a/sys/contrib/openzfs/module/zfs/zfs_quota.c b/sys/contrib/openzfs/module/zfs/zfs_quota.c index 2e91ccc27d6d..e00ca67dae13 100644 --- a/sys/contrib/openzfs/module/zfs/zfs_quota.c +++ b/sys/contrib/openzfs/module/zfs/zfs_quota.c @@ -86,10 +86,14 @@ zpl_get_file_info(dmu_object_type_t bonustype, const void *data, sa.sa_layout_info = BSWAP_16(sa.sa_layout_info); swap = B_TRUE; } - VERIFY3U(sa.sa_magic, ==, SA_MAGIC); + + if (unlikely(sa.sa_magic != SA_MAGIC)) + return (SET_ERROR(EINVAL)); int hdrsize = sa_hdrsize(&sa); - VERIFY3U(hdrsize, >=, sizeof (sa_hdr_phys_t)); + + if (unlikely(hdrsize < sizeof (sa_hdr_phys_t))) + return (SET_ERROR(EINVAL)); uintptr_t data_after_hdr = (uintptr_t)data + hdrsize; zoi->zfi_user = *((uint64_t *)(data_after_hdr + SA_UID_OFFSET)); diff --git a/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c b/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c index 4ef249bbd4a1..8f7e36d9efa7 100644 --- a/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c +++ b/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c @@ -85,7 +85,6 @@ static const zfs_ioc_t ioc_skip[] = { ZFS_IOC_DSOBJ_TO_DSNAME, ZFS_IOC_OBJ_TO_PATH, ZFS_IOC_POOL_SET_PROPS, - ZFS_IOC_POOL_GET_PROPS, ZFS_IOC_SET_FSACL, ZFS_IOC_GET_FSACL, ZFS_IOC_SHARE, @@ -125,11 +124,136 @@ static const zfs_ioc_t ioc_skip[] = { lzc_ioctl_test(ioc, name, req, opt, err, wild); \ } while (0) +#define IOC_INPUT_TEST_INJECT(ioc, name, innvl) \ + do { \ + active_test = __func__ + 5; \ + lzc_ioctl_run_impl(ioc, name, innvl, 0, B_TRUE); \ + } while (0) + +/* + * Given a zfs_cmd_t containing an already packed nvlist in zc->zc_nvlist_src, + * and its original innvl, look in innvl for the last string nvpair, or last + * string array nvpair, and remove the string terminator. The idea is to + * corrupt the nvlist string value so that anyone doing a strlen() on it will + * read past the end of the packed nvlist buffer and trigger a crash. + */ +static void +do_bad_string(zfs_cmd_t *zc, nvlist_t *innvl) +{ + nvpair_t *elem = NULL; + nvpair_t *lastseen = NULL; + const char *str = NULL; + const char **arr; + uint_t n; + char *off; + char *packed; + uint64_t size, off_size; + + while ((elem = nvlist_next_nvpair(innvl, elem)) != NULL) { + if ((nvpair_type(elem) == DATA_TYPE_STRING) || + (nvpair_type(elem) == DATA_TYPE_STRING_ARRAY)) + lastseen = elem; + } + + if (lastseen == NULL) + return; /* No strings */ + + /* + * Lookup either the last string, or the last string in the last + * string array in the nvlist. We will use this to corrupt from the + * string to the end of the nvlist buffer. Any attempts to strlen this + * string should run pass the end of the packed buffer. + */ + if (nvpair_value_string(lastseen, &str) != 0) { + if (nvpair_value_string_array(lastseen, &arr, &n) == 0) + str = arr[n-1]; + } + + /* + * We now have the last string. Corrupt everything from the NULL + * terminator byte for the last string to the end of the packed nvlist + * buffer. + */ + packed = (char *)zc->zc_nvlist_src; + size = zc->zc_nvlist_src_size; + + off = memmem(packed, size, str, strlen(str)); + off_size = strlen(str); + + memset(&off[off_size - 1], '!', (packed + size) - + (&off[off_size - 1])); + +} + +/* + * For each byte in the packed nvlist list in zc, corrupt a single byte, then + * try doing the ioctl. This tests how well the kernel handles fuzzed nvlists. + * + * NOTE - make sure you are doing this with a "safe" ioctl! You don't want to + * run this on an ioctl that can potentially corrupt data (like a zpool create). + */ +static void +do_fuzz(int zfs_fd, zfs_ioc_t ioc, zfs_cmd_t *zc) +{ + uint64_t size; + uint64_t i; + unsigned char old = 0; + unsigned char *pos; + zfs_cmd_t orig_zc = *zc; + + pos = (unsigned char *) zc->zc_nvlist_src; + size = zc->zc_nvlist_src_size; + + /* + * Fuzz each byte in the packed nvlist, one byte at a time, and do the + * ioctl. If the kernel doesn't crash, then the test passed. + */ + for (i = 0; i < size; i++) { + /* Restore the previously corrupted byte */ + if (i > 0) + pos[i-1] = old; + + old = pos[i]; + + /* Corrupt the new byte */ + pos[i]++; + + /* + * Do the ioctl and ignore the return code. We just want to + * see if the kernel panics. + */ + lzc_ioctl_fd(zfs_fd, ioc, zc); + + /* + * Restore 'zc' with original fields since the ioctl may + * have modified them. + */ + *zc = orig_zc; + } + /* Restore last byte */ + if (i > 0) + pos[i - 1] = old; + + /* + * Try fuzzing the packed nvlist size field. Test it with one byte + * bigger and one byte smaller than the current value. + */ + zc->zc_nvlist_src_size--; + lzc_ioctl_fd(zfs_fd, ioc, zc); + + zc->zc_nvlist_src_size += 2; + lzc_ioctl_fd(zfs_fd, ioc, zc); + + /* Restore to normal */ + zc->zc_nvlist_src_size -= 1; +} + /* * run a zfs ioctl command, verify expected results and log failures */ static void -lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) +lzc_ioctl_run_impl(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, + int expected, boolean_t do_corrupt) { zfs_cmd_t zc = {"\0"}; char *packed = NULL; @@ -160,10 +284,30 @@ lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) zc.zc_nvlist_dst_size = MAX(size * 2, 128 * 1024); zc.zc_nvlist_dst = (uint64_t)(uintptr_t)malloc(zc.zc_nvlist_dst_size); + if (do_corrupt) { + /* + * Try changing bytes in the packed nvlist to see if it will + * panic the kernel when you do the ioctl. + */ + do_fuzz(zfs_fd, ioc, &zc); + + /* + * Corrupt the last string in the packed nvlist so it has no + * NULL terminator. + */ + do_bad_string(&zc, innvl); + + } + if (lzc_ioctl_fd(zfs_fd, ioc, &zc) != 0) error = errno; - if (error != expected) { + /* + * If we're corrupting the nvlist we don't care about the specific + * error code that gets returned, as it could be one of many. We only + * care if it panics the kernel. + */ + if (!do_corrupt && error != expected) { unexpected_failures = B_TRUE; (void) fprintf(stderr, "%s: Unexpected result with %s, " "error %d (expecting %d)\n", @@ -174,6 +318,12 @@ lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) free((void *)(uintptr_t)zc.zc_nvlist_dst); } +static void +lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) +{ + return (lzc_ioctl_run_impl(ioc, name, innvl, expected, B_FALSE)); +} + /* * Test each ioc for the following ioctl input errors: * ZFS_ERR_IOC_ARG_UNAVAIL an input argument is not supported by kernel @@ -310,6 +460,7 @@ test_log_history(const char *pool) fnvlist_add_string(required, "message", "input check"); IOC_INPUT_TEST(ZFS_IOC_LOG_HISTORY, pool, required, NULL, 0); + IOC_INPUT_TEST_INJECT(ZFS_IOC_LOG_HISTORY, pool, required); nvlist_free(required); } @@ -791,6 +942,20 @@ test_set_bootenv(const char *pool) nvlist_free(required); } +static void +test_zpool_get(const char *pool) +{ + const char *strs[] = {ZPOOL_DEDUPCACHED_PROP_NAME}; + nvlist_t *optional = fnvlist_alloc(); + + fnvlist_add_string_array(optional, ZPOOL_GET_PROPS_NAMES, strs, 1); + + IOC_INPUT_TEST(ZFS_IOC_POOL_GET_PROPS, pool, NULL, optional, 0); + IOC_INPUT_TEST_INJECT(ZFS_IOC_POOL_GET_PROPS, pool, optional); + + nvlist_free(optional); +} + static void zfs_ioc_input_tests(const char *pool) { @@ -885,6 +1050,7 @@ zfs_ioc_input_tests(const char *pool) test_scrub(pool); + test_zpool_get(pool); /* * cleanup */ From nobody Tue Jun 30 17:21:24 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLF2vx1z6jYRR for ; Tue, 30 Jun 2026 17:21:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLF18zDz3rsc for ; Tue, 30 Jun 2026 17:21:25 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840085; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SaIS9V+7C13g5EOwFclM2eNPKBXoXGetU6nfRHxLc6U=; b=Q4c3+kCpaW08Y713VUEzD/7OfKAK3gZBLgOfaGiJjdNjEZz9BVABefIplNjQU0+2ypHn8z GMJuzPtKcCimhCRivFZJsGQDS6maRr3HFufEDNSTSnTsGMfSPsxURjf8It7WmOVXV4ITE/ 52WkBcTa2FIJ+NPozncDCZecKlE8cnhR1tUMzn4mR7ALqVwyPZ/c8Z9FEqtblSxUgNCn1D NfQ36AtBjpTcUXZ1OnXhEysSFdMuO8XREdtdPTngexuA/CRaq8Oq8/IOgGfuiW9ya9iOpO GLbznRT/3e2nHBIrJU6EEf4X66+kGsR24sBrrsAQiHdVdmCU7428VT0PIULhDA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840085; a=rsa-sha256; cv=none; b=ttayEtZRAhibR8G5gR6jAEoVDJOWsEld3Pku4yEk0pLtnR8Jcrtmgqwuvixs5H8VvwsyFW Ps+XUYPgH0aV4RiEltbVcJ4hwnKNX3liRt9O0b9eE+YgYdLhVor2EyPNG71ze+FvB0KMnF daug4yXAm/PGHiQ9EgwBNfi7Edi4y654Xk7lLlBaeetIyWqLGMxTLNibjJTx8RiNG7zoIe tNlAgx56V4ejTDuPDkbSoXwuk+0JFTUqYB6tyeDP8zXcaY5iiJQMagAA3nkm4b5/QbvdnS oUbRiR6bSBRvsgw8RZxPp4/ENQiSGjQfv9JtxCExDkgEHz/TbRP5kgpkC7qd2w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840085; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SaIS9V+7C13g5EOwFclM2eNPKBXoXGetU6nfRHxLc6U=; b=m94Xu/88VAPCeON+3/XJcFfNYNmO0P7/y1TtZGQLxdY2N/Sg3VRtmtVUZitQgacWsj1+rB QX92AM4oXeJ98t40Ih5Ul2z4crTaOHLNxVU7IlGoPfdRikF6dcieI4QhZuWkczlguIAUUm O4pEZ3ZVVy3fOv3gIhcPEhcDm2rD4sLi6b+a8cTVvwryEPx4V6zzmjQeziU3xVnriofKbg U02Ekx0zmWdiN0liwJ/bfyvKJbH3DSkOql2BQmP9KZLBox4C7gOXanm2xXSC43VVZQkqiW XawOxvC2pta7ajeCEPphBiIFLKdByFoeacpx2kiXojkCchNuM8wjpLBXcla69g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLD6rrcztSk for ; Tue, 30 Jun 2026 17:21:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44f67 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:24 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav From: Mark Johnston Subject: git: 0ec96664d73f - releng/15.0 - libalias: Fix buffer overflow in RTSP aliasing List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 0ec96664d73fadebb0515e8e0853646db5867b35 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:24 +0000 Message-Id: <6a43fb14.44f67.437db4f2@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=0ec96664d73fadebb0515e8e0853646db5867b35 commit 0ec96664d73fadebb0515e8e0853646db5867b35 Author: Dag-Erling Smørgrav AuthorDate: 2026-06-28 22:10:40 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 libalias: Fix buffer overflow in RTSP aliasing In alias_rtsp_out(), we construct a new packet in a fixed-length buffer before copying it back into the original buffer. We never checked if the data we were writing to this temporary buffer fit in it, nor if the result fit in the original buffer. * Use a dynamically sized allocated buffer instead of a fixed-length stack buffer. * Check for overflow before appending to our temporary buffer. * Check for overflow before copying the data back to the packet buffer. * While here, use size_t for sizes and bool for booleans. Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 MFC after: 1 week Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D57753 --- sys/netinet/libalias/alias_smedia.c | 156 ++++++++++++++++++++---------------- 1 file changed, 89 insertions(+), 67 deletions(-) diff --git a/sys/netinet/libalias/alias_smedia.c b/sys/netinet/libalias/alias_smedia.c index badd75a45c61..cbfe30940596 100644 --- a/sys/netinet/libalias/alias_smedia.c +++ b/sys/netinet/libalias/alias_smedia.c @@ -104,8 +104,9 @@ #include #include #else -#include #include +#include +#include #include #include #endif @@ -128,9 +129,9 @@ #define RTSP_CONTROL_PORT_NUMBER_2 7070 #define TFTP_PORT_NUMBER 69 -static void -AliasHandleRtspOut(struct libalias *, struct ip *, struct alias_link *, - int maxpacketsize); +static void AliasHandleRtspOut(struct libalias *, struct ip *, + struct alias_link *, size_t); + static int fingerprint(struct libalias *la, struct alias_data *ah) { @@ -154,7 +155,8 @@ protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah) if (ntohs(*ah->dport) == TFTP_PORT_NUMBER) FindRtspOut(la, pip->ip_src, pip->ip_dst, *ah->sport, *ah->aport, IPPROTO_UDP); - else AliasHandleRtspOut(la, pip, ah->lnk, ah->maxpktsize); + else + AliasHandleRtspOut(la, pip, ah->lnk, ah->maxpktsize); return (0); } @@ -208,13 +210,15 @@ MODULE_DEPEND(alias_smedia, libalias, 1, 1, 1); #define ISDIGIT(a) (((a) >= '0') && ((a) <= '9')) -static int -search_string(char *data, int dlen, const char *search_str) +static ssize_t +search_string(char *data, size_t dlen, const char *search_str) { - int i, j, k; - int search_str_len; + size_t i, j, k; + size_t search_str_len; search_str_len = strlen(search_str); + if (search_str_len > dlen) + return (-1); for (i = 0; i < dlen - search_str_len; i++) { for (j = i, k = 0; j < dlen - search_str_len; j++, k++) { if (data[j] != search_str[k] && @@ -230,18 +234,21 @@ search_string(char *data, int dlen, const char *search_str) static int alias_rtsp_out(struct libalias *la, struct ip *pip, struct alias_link *lnk, - char *data, + char *data, size_t maxlen, const char *port_str) { - int hlen, tlen, dlen; + size_t hlen, tlen, dlen; + size_t i, j; struct tcphdr *tc; - int i, j, pos, state, port_dlen, new_dlen, delta; + int delta, state; + ssize_t pos, slen; + size_t new_dlen, port_dlen, port_slen; u_short p[2], new_len; u_short sport, eport, base_port; u_short salias = 0, ealias = 0, base_alias = 0; const char *transport_str = "transport:"; - char newdata[2048], *port_data, *port_newdata, stemp[80]; - int links_created = 0, pkt_updated = 0; + char *newdata, *port_data; + bool links_created = false, pkt_updated = false; struct alias_link *rtsp_lnk = NULL; struct in_addr null_addr; @@ -250,6 +257,9 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, hlen = (pip->ip_hl + tc->th_off) << 2; tlen = ntohs(pip->ip_len); dlen = tlen - hlen; + if (hlen > tlen || tlen > maxlen) + return (-1); + port_slen = strlen(port_str); /* Find keyword, "Transport: " */ pos = search_string(data, dlen, transport_str); @@ -259,17 +269,21 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, port_data = data + pos; port_dlen = dlen - pos; + /* Allocate temporary buffer */ + maxlen -= hlen; + if ((newdata = malloc(maxlen)) == NULL) + return (-1); memcpy(newdata, data, pos); - port_newdata = newdata + pos; + new_dlen = pos; - while (port_dlen > (int)strlen(port_str)) { + while (port_dlen > port_slen) { /* Find keyword, appropriate port string */ pos = search_string(port_data, port_dlen, port_str); - if (pos < 0) + if (pos < 0 || (size_t)pos + 1 > maxlen - new_dlen) break; - memcpy(port_newdata, port_data, pos + 1); - port_newdata += (pos + 1); + memcpy(newdata + new_dlen, port_data, pos + 1); + new_dlen += pos + 1; p[0] = p[1] = 0; sport = eport = 0; @@ -300,7 +314,7 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, eport = htons(p[1]); if (!links_created) { - links_created = 1; + links_created = true; /* * Find an even numbered port * number base that satisfies the @@ -349,24 +363,30 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, ealias = htons(base_alias + (RTSP_PORT_GROUP - 1)); } if (salias && rtsp_lnk) { - pkt_updated = 1; + pkt_updated = true; /* Copy into IP packet */ - sprintf(stemp, "%d", ntohs(salias)); - memcpy(port_newdata, stemp, strlen(stemp)); - port_newdata += strlen(stemp); + slen = snprintf(newdata + new_dlen, + maxlen - new_dlen, "%d", ntohs(salias)); + if (slen < 0 || slen >= maxlen - new_dlen) + goto fail; + new_dlen += slen; if (eport != 0) { - *port_newdata = '-'; - port_newdata++; + if (new_dlen == maxlen) + goto fail; + newdata[new_dlen++] = '-'; /* Copy into IP packet */ - sprintf(stemp, "%d", ntohs(ealias)); - memcpy(port_newdata, stemp, strlen(stemp)); - port_newdata += strlen(stemp); + slen = snprintf(newdata + new_dlen, + maxlen - new_dlen, "%d", ntohs(ealias)); + if (slen < 0 || slen >= maxlen - new_dlen) + goto fail; + new_dlen += slen; } - *port_newdata = ';'; - port_newdata++; + if (new_dlen == maxlen) + goto fail; + newdata[new_dlen++] = ';'; } state++; break; @@ -380,20 +400,20 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, } if (!pkt_updated) - return (-1); - - memcpy(port_newdata, port_data, port_dlen); - port_newdata += port_dlen; - *port_newdata = '\0'; + goto fail; /* Create new packet */ - new_dlen = port_newdata - newdata; + if (new_dlen + port_dlen > maxlen) + goto fail; + memmove(data + new_dlen, port_data, port_dlen); memcpy(data, newdata, new_dlen); + new_dlen += port_dlen; + free(newdata); SetAckModified(lnk); tc = (struct tcphdr *)ip_next(pip); delta = GetDeltaSeqOut(tc->th_seq, lnk); - AddSeq(lnk, delta + new_dlen - dlen, pip->ip_hl, pip->ip_len, + AddSeq(lnk, delta + (int)(new_dlen - dlen), pip->ip_hl, pip->ip_len, tc->th_seq, tc->th_off); new_len = htons(hlen + new_dlen); @@ -407,6 +427,9 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, tc->th_sum = TcpChecksum(pip); #endif return (0); +fail: + free(newdata); + return (-1); } /* Support the protocol used by early versions of RealPlayer */ @@ -415,13 +438,13 @@ static int alias_pna_out(struct libalias *la, struct ip *pip, struct alias_link *lnk, char *data, - int dlen) + size_t dlen) { struct alias_link *pna_links; - u_short msg_id, msg_len; char *work; - u_short alias_port, port; struct tcphdr *tc; + u_short msg_id, msg_len; + u_short alias_port, port; work = data; work += 5; @@ -433,7 +456,7 @@ alias_pna_out(struct libalias *la, struct ip *pip, if (ntohs(msg_id) == 0) /* end of options */ return (0); - if ((ntohs(msg_id) == 1) || (ntohs(msg_id) == 7)) { + if (ntohs(msg_id) == 1 || ntohs(msg_id) == 7) { memcpy(&port, work, 2); (void)FindUdpTcpOut(la, pip->ip_src, GetDestAddress(lnk), port, 0, IPPROTO_UDP, 1, &pna_links); @@ -462,22 +485,23 @@ alias_pna_out(struct libalias *la, struct ip *pip, } static void -AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, int maxpacketsize) +AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, + size_t maxlen) { - int hlen, tlen, dlen; struct tcphdr *tc; char *data; const char *setup = "SETUP", *pna = "PNA", *str200 = "200"; const char *okstr = "OK", *client_port_str = "client_port"; const char *server_port_str = "server_port"; - int i, parseOk; - - (void)maxpacketsize; + size_t hlen, tlen, dlen; + size_t i; tc = (struct tcphdr *)ip_next(pip); hlen = (pip->ip_hl + tc->th_off) << 2; tlen = ntohs(pip->ip_len); dlen = tlen - hlen; + if (hlen > tlen || tlen > maxlen) + return; data = (char *)pip; data += hlen; @@ -485,13 +509,14 @@ AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, /* When aliasing a client, check for the SETUP request */ if ((ntohs(tc->th_dport) == RTSP_CONTROL_PORT_NUMBER_1) || (ntohs(tc->th_dport) == RTSP_CONTROL_PORT_NUMBER_2)) { - if (dlen >= (int)strlen(setup) && + if (dlen >= strlen(setup) && memcmp(data, setup, strlen(setup)) == 0) { - alias_rtsp_out(la, pip, lnk, data, client_port_str); + alias_rtsp_out(la, pip, lnk, data, maxlen, + client_port_str); return; } - if (dlen >= (int)strlen(pna) && + if (dlen >= strlen(pna) && memcmp(data, pna, strlen(pna)) == 0) alias_pna_out(la, pip, lnk, data, dlen); } else { @@ -499,24 +524,21 @@ AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, * When aliasing a server, check for the 200 reply * Accommodate varying number of blanks between 200 & OK */ - - if (dlen >= (int)strlen(str200)) { - for (parseOk = 0, i = 0; - i <= dlen - (int)strlen(str200); - i++) - if (memcmp(&data[i], str200, strlen(str200)) == 0) { - parseOk = 1; - break; - } - - if (parseOk) { - i += strlen(str200); /* skip string found */ - while (data[i] == ' ') /* skip blank(s) */ + if (dlen < strlen(str200) + 1 + strlen(okstr)) + return; + for (i = 0; i <= dlen - strlen(str200) - 1; i++) { + if (memcmp(&data[i], str200, strlen(str200)) == 0 && + data[i + strlen(str200)] == ' ') { + i += strlen(str200); /* skip 200 */ + while (i < dlen && data[i] == ' ') /* skip blank(s) */ i++; - - if ((dlen - i) >= (int)strlen(okstr)) - if (memcmp(&data[i], okstr, strlen(okstr)) == 0) - alias_rtsp_out(la, pip, lnk, data, server_port_str); + if (dlen - i >= strlen(okstr)) { + if (memcmp(&data[i], okstr, strlen(okstr)) == 0) { + alias_rtsp_out(la, pip, lnk, data, + maxlen, server_port_str); + break; + } + } } } } From nobody Tue Jun 30 17:21:26 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLG6jz5z6jYNc for ; Tue, 30 Jun 2026 17:21:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLG1SNwz3rvx for ; Tue, 30 Jun 2026 17:21:26 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840086; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PRbhUQIlxFvcbWlyHbP9iw91OjCL1lJ2vkVgP06P5oE=; b=Y3xkxykxsy+cjrOtRvi0/OMrI+ChWsj0atH4Edv3n1onYSnkVBpDWdocn5ma14A5+4O70B PyuMnQGBnetJAsIU1CcPBxaptAjXZeTQUHUwn3UVe5sBrUhUJNrBfwVMFzyaLb5JTSIeCG idiunYgGJlzFXqvQWf/Fk91Z8qy3ebkpJCxhMxaypakVxX9sBTCHhe+are7ODIOEQehBfL EocM0geDxzcWle//bFdIqq9/gJM69hF88PxMRHISfQ379T3rHW7Fwhvcf9UWIcuIpT3Wjz F3hgNQCqfzQ3eb+qxs+5Eo4QQkpYOXqTrtsB2WwqO5kW8W99i/O2zafvGr8oKA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840086; a=rsa-sha256; cv=none; b=sF3u2UK9DpcGg/+eNlE3I8XcpK4pSaj+sWk0ZfwElm6d0jOQxeRHBHynt1KBFV6cjdKSi/ feiL5IiVEOCtm7MQZoKXmlXuXDoAKd64/S00391ww9Y6bv88Sm99gdCnaGxnSdTmMESFKR lOuTz5wA/eptUWztGO6tBufHamkEeo6hZO1NbfxlJpj+ZxYuUSxNhRA7pBAsexQQDTI6zN X2VnDfXEAP+bvw26fyKAemZheM8ygpoHTjb3QedF4MoHPsLwEctt6n99UQsGDOiLy6dg6l JRSwPaaSUmJenCcpQhU48QLZNp6uNfPh5rsVkAm9niROsekDvU9EUIyHO0yWBQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840086; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PRbhUQIlxFvcbWlyHbP9iw91OjCL1lJ2vkVgP06P5oE=; b=LGooNGhBMiOApUiKdgoMRYr9cJn9DoreoTvYr2Z8zWR3VdDCwGgDkhv2447kMaFVm5mkwi 7CNkalsHo0oODv6yAcZgmlvPOGpkfOgnM3k+e45xp1HOLKkXfJXmkHY0oMVUaM0O59hfCx WpNoYuqTh2W357Qtqe/UDMD2zJzolkPySHqFnyXqYmidPTaM54Gm+dWfir0HABow+HHXKW P9+ymLNutE7A3YtJCm5cnZQkR6OL2v3lS96E1Q83QiyP2rGcTDTHU4wpWG3sFahBlxUKu6 t0XQQNTlsrZTk7ifDcVtH7Fcm0rsFJglx+G25oqb1W3C5dzFj2SjOE0OePqwpg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLG0YJFztSl for ; Tue, 30 Jun 2026 17:21:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45e91 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:26 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 64ce87df6876 - releng/15.0 - tests/libalias: Add a regression test for an alias_smedia bug List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 64ce87df6876219fc71afc53c9a3b0a2d2225c5d Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:26 +0000 Message-Id: <6a43fb16.45e91.2a0d6b0a@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=64ce87df6876219fc71afc53c9a3b0a2d2225c5d commit 64ce87df6876219fc71afc53c9a3b0a2d2225c5d Author: Mark Johnston AuthorDate: 2026-06-22 17:25:56 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 tests/libalias: Add a regression test for an alias_smedia bug Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57747 --- tests/sys/netinet/libalias/Makefile | 4 ++ tests/sys/netinet/libalias/smedia.c | 74 +++++++++++++++++++++++++++++++++++++ 2 files changed, 78 insertions(+) diff --git a/tests/sys/netinet/libalias/Makefile b/tests/sys/netinet/libalias/Makefile index 43bef996fae7..95816444a6d2 100644 --- a/tests/sys/netinet/libalias/Makefile +++ b/tests/sys/netinet/libalias/Makefile @@ -3,6 +3,10 @@ PACKAGE= tests TESTSDIR= ${TESTSBASE}/sys/netinet/libalias BINDIR= ${TESTSDIR} +PLAIN_TESTS_C+= smedia + +LIBADD.smedia+= sbuf + ATF_TESTS_C+= 1_instance \ 2_natout \ 3_natin \ diff --git a/tests/sys/netinet/libalias/smedia.c b/tests/sys/netinet/libalias/smedia.c new file mode 100644 index 000000000000..e181a7a538af --- /dev/null +++ b/tests/sys/netinet/libalias/smedia.c @@ -0,0 +1,74 @@ +/* + * Copyright (c) 2026 The FreeBSD Foundation + * + * This software was developed by Mark Johnston under sponsorship from + * the FreeBSD Foundation. + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +/* + * A minimal regression test for a buffer overflow in alias_rtsp_out(). + */ + +#include +#include + +#include +#include +#include +#include + +#include +#include + +#include + +int +main(void) +{ + uint8_t *packet; + struct ip ip; + struct tcphdr tcp; + struct sbuf sb; + struct libalias *la; + + sbuf_new(&sb, NULL, 0, SBUF_AUTOEXTEND); + sbuf_printf(&sb, "SETUP rtsp://example.com/media.mp4 RTSP/1.0\r\n"); + sbuf_printf(&sb, "CSeq: 1\r\n"); + sbuf_printf(&sb, "Transport: RTP/AVP;unicast;"); + for (int i = 0; i < 200; i++) + sbuf_printf(&sb, "client_port=%d-%d;", 2 * i, 2 * i + 1); + sbuf_printf(&sb, "\r\n\r\n"); + sbuf_finish(&sb); + + memset(&tcp, 0, sizeof(tcp)); + tcp.th_sport = htons(1234); + tcp.th_dport = htons(554); + tcp.th_off = 5; + + memset(&ip, 0, sizeof(ip)); + ip.ip_v = IPVERSION; + ip.ip_hl = sizeof(ip) / 4; + ip.ip_len = htons(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)); + ip.ip_id = htons(1); + ip.ip_ttl = 64; + ip.ip_p = IPPROTO_TCP; + ip.ip_src.s_addr = inet_addr("127.0.0.1"); + ip.ip_dst.s_addr = inet_addr("127.0.0.2"); + + packet = malloc(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)); + memcpy(packet, &ip, sizeof(ip)); + memcpy(packet + sizeof(ip), &tcp, sizeof(tcp)); + memcpy(packet + sizeof(ip) + sizeof(tcp), sbuf_data(&sb), + sbuf_len(&sb)); + + la = LibAliasInit(NULL); + LibAliasSetAddress(la, + (struct in_addr){.s_addr = inet_addr("127.0.0.1")}); + if (LibAliasOut(la, packet, sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)) != + PKT_ALIAS_OK) + return (1); + LibAliasUninit(la); + return (0); +} From nobody Tue Jun 30 17:21:28 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLJ5rQlz6jYWn for ; Tue, 30 Jun 2026 17:21:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLJ2pCnz3rnr for ; Tue, 30 Jun 2026 17:21:28 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840088; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ErhmJZ/IF6pOvu/ju56WJhNYwwxddcJXRUMJnOf0C6s=; b=HkTJNNBiHwMiM1QIEZdJagT9c8MXRQB2iJdloedVCrIhjqAOQgNBH6u4HOKP8FCggCpNjd i6kWij26C+UXPsT0VroLZKdBLKX5FpQ0oyYNDq/rCIGEoA8lEpxq/MhB+Qb/VqKkGCpa03 2i97KfQ1YQJVeC9DNVcK0XW+jruK4PFtIAiISj7wleQHzwJSpq9BGxuOxFDUTQy6l3wIK2 9TV6bUYmQIJqn+MJKJyuMIiWbBSMHejprcPxCMjRM74bTpcO3A9pbWYDEYeqSu0G/F/dvr NI42H3C6+axhgJ6LRBEHOd94iZ6urTtk7zl4byi5YeMhSzz4vXz2MSbUhmoUjQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840088; a=rsa-sha256; cv=none; b=tQDgV97ADxSKyF0D5sp99jlP8maWz6m/s1WR+JBgxO/xcmgS3fD1umXDlxGYQmbwJ74W7a buYODaKDnAZgUkmG7ckGzbeSC1yqweJUVEU1DpDVI6FwD3Ujdr5B+SwagOFEYPiUJmU1X2 LIPMTpOR5r+UdXMJsafrCklWLgVWaxYc2cTEUSK2IRqjKpEY6DL0E0sKEO6OwLvwm/OoEk 8PPOBzGkiycQGaDCuKiwEZJkpYixF8IaKpYmmJhDtRqF7LHPYKeoJEEpa1v9MCUgouhCB8 JFyovWcnjrecAEoWSoYYZxRKHR7TPcqG/RIu8TZpE2ps/2ltjy+p+TjaKJAg8w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840088; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ErhmJZ/IF6pOvu/ju56WJhNYwwxddcJXRUMJnOf0C6s=; b=QEkYXmiLG6uLLU4kdkZ6G6Aolr/zCQZn4PTJcFMi11oLAk40tuZtt2opkta6ULHWSB9R9s miAGjuOtIBpJkZihjMZiTrTzHC9YyA8pTGveBA3u/Ak4+FVfT/QuU4LwHu3dJPxkqbfRCO WQi9CEZRorPttYKbdxKLUP8D2xZl7eokswKJEC6tMni0njQlOYCHjUy9qJ5n1uZ+nkx2MR KqaqnDn06cKigbuyegDfgYFd9Svo2KZjlXhMcchBI+SpcFWwXSWeq2/wxz+McXSnuK2VGT Xvjxh5j4BfpIY+dkomHuMnJWXU4pdaTf1aoTiw28GhcJQuEzryylpDgWv2g18g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLJ1sRcztQ0 for ; Tue, 30 Jun 2026 17:21:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 445cc by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:28 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 57b3853cc9bb - releng/15.0 - rack: Reload the TCP stack PCB after reacquiring the inpcb lock List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 57b3853cc9bbe164a82844eb9a0d5196ff52a8e7 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:28 +0000 Message-Id: <6a43fb18.445cc.2a00bccc@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=57b3853cc9bbe164a82844eb9a0d5196ff52a8e7 commit 57b3853cc9bbe164a82844eb9a0d5196ff52a8e7 Author: Mark Johnston AuthorDate: 2026-06-23 21:46:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 rack: Reload the TCP stack PCB after reacquiring the inpcb lock Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791 --- sys/netinet/tcp_stacks/rack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index 9bc4530afe10..462bd6c6aa0b 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -24138,6 +24138,7 @@ process_opt: INP_WUNLOCK(inp); return (ENOPROTOOPT); } + rack = (struct tcp_rack *)tp->t_fb_ptr; if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_HYBRID_PACING) && From nobody Tue Jun 30 17:21:27 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLJ0gTGz6jY5k for ; Tue, 30 Jun 2026 17:21:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLH2FNmz3rcC for ; Tue, 30 Jun 2026 17:21:27 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840087; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=N83oxNBuzKNv4XQG6djre0mOh2yzXXjJeyrXBAaAUzA=; b=hYTANILLf5E+bUAznWDlWe77cyCrmbQxzIR3eklZwjEEMG0TTixA3T8qM+DdlhtkR7r5F1 g8e6NPaqSqMW9pl9mqVXz97B8g358Uv7CF8/pjGjKDE9LqD6bW3u1/E5OvEIFs9WqT8HOv sve0Ohj84ulm0QA0Irs4a33BSAYJRnQCEDNednOA1ZdJIM3M4JvaRkPUqEHNeP14bWZv+K dzhTtvJQJb1wiEv6O6W2b5T6bYzkHRq0w6x9YLHEilYKE9sk/h/JOF8swYGgM+qNs239du DX4mQzlAlDY8JA4SvpM0ohjhHHgbe0VhuO+JPt4lLLjD/rEcmdBgKv4FKeMxGA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840087; a=rsa-sha256; cv=none; b=WP1d4G7EYQ3j63f97c6SS3cAOj7IDD7Vn1ClX403xgnI+GX7xozL9VnGCSTsSlF8IodoTe zrLgdVrEiMpsmu4DRyPtmlkrSlOqIk0SdrWtBqjBueHJwQNqFONC5BeUJ3Z1Qoa88AQuRC wRmCm+6I/+sRdFJxSagZG6HXO81GAlHKYZRvdHcKI3uyf3/KBHupWUn/k2r5NAOeLFmCCe zlG1y0t37lgVf/6jCfbYAEWYvyFLVhutelcYpzn8XBrcOjSxff//9G0lTdMHscXQ08N9gK JaUOEqZdAskyt+AWB+lhL+8oOfIDHZZjL6unp8cIQFe6SdCaCIAHM5XEnSBjlw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840087; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=N83oxNBuzKNv4XQG6djre0mOh2yzXXjJeyrXBAaAUzA=; b=IKkrEY8+za13ytsyHMy8fAYPw/qnM4IX0WF5fHzDkXmxV0TpvyM4PD+wli8Azf8+ciUmcj LNrSs2DqT6AfNj6tyJ8xJB41mLs/Fy8zGKBeUnX9+QmzQJCrsmYL1NgEP1sfoT6QA/OSrP nYoMe7Gskf8zMPRkHiRwt5JqE9Ic2H8d05r+cjhnLd7JczWh5hXtJiSQn+dgzQROIeEj4p Adj7y0zm2kgfZMK/eoP4GwpVkwsnfHg0mLYKlKcYa/BkS4oUD27Xw4j+iPZlLDQW8pquH6 mGZbga8PZgXeWuo6p4xIwU9TkauNuglneqwyyrB6avLIl999nttJdriNymhLtw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLH1GzZztnG for ; Tue, 30 Jun 2026 17:21:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 446b2 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:27 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 278ebff1ee51 - releng/15.0 - unlinkat: Pass flags down to the work functions List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 278ebff1ee5148d5b5f8a39bcb95791f8b12603d Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:27 +0000 Message-Id: <6a43fb17.446b2.54ca5d69@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=278ebff1ee5148d5b5f8a39bcb95791f8b12603d commit 278ebff1ee5148d5b5f8a39bcb95791f8b12603d Author: Mark Johnston AuthorDate: 2026-06-23 20:43:53 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 unlinkat: Pass flags down to the work functions The unlinkat(2) and funlinkat(2) system calls were ignoring AT_RESOLVE_BENEATH. Also pass pathseg through instead of assuming it's UIO_USERSPACE. Add some tests which make sure that AT_RESOLVE_BENEATH is handled properly by various system calls. Approved by: so Security: FreeBSD-SA-26:42.unlinkat Security: CVE-2026-49421 Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57790 --- sys/kern/vfs_syscalls.c | 11 +- tests/sys/kern/Makefile | 1 + tests/sys/kern/resolve_beneath_test.c | 220 ++++++++++++++++++++++++++++++++++ 3 files changed, 227 insertions(+), 5 deletions(-) diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index bf3ed9d515dc..8295a6d071e7 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -1976,16 +1976,17 @@ sys_unlink(struct thread *td, struct unlink_args *uap) static int kern_funlinkat_ex(struct thread *td, int dfd, const char *path, int fd, - int flag, enum uio_seg pathseg, ino_t oldinum) + int flags, enum uio_seg pathseg, ino_t oldinum) { - if ((flag & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) + if ((flags & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) return (EINVAL); - if ((flag & AT_REMOVEDIR) != 0) - return (kern_frmdirat(td, dfd, path, fd, UIO_USERSPACE, 0)); + if ((flags & AT_REMOVEDIR) != 0) + return (kern_frmdirat(td, dfd, path, fd, pathseg, + flags & ~AT_REMOVEDIR)); - return (kern_funlinkat(td, dfd, path, fd, UIO_USERSPACE, 0, 0)); + return (kern_funlinkat(td, dfd, path, fd, pathseg, flags, 0)); } #ifndef _SYS_SYSPROTO_H_ diff --git a/tests/sys/kern/Makefile b/tests/sys/kern/Makefile index 0384529a5a97..14d4ed1b65dd 100644 --- a/tests/sys/kern/Makefile +++ b/tests/sys/kern/Makefile @@ -37,6 +37,7 @@ ATF_TESTS_C+= procdesc ATF_TESTS_C+= ptrace_test TEST_METADATA.ptrace_test+= timeout="15" ATF_TESTS_C+= reaper +ATF_TESTS_C+= resolve_beneath_test ATF_TESTS_C+= sched_affinity ATF_TESTS_C+= shutdown_dgram ATF_TESTS_C+= sigaltstack diff --git a/tests/sys/kern/resolve_beneath_test.c b/tests/sys/kern/resolve_beneath_test.c new file mode 100644 index 000000000000..b83926038ded --- /dev/null +++ b/tests/sys/kern/resolve_beneath_test.c @@ -0,0 +1,220 @@ +/* + * Copyright (c) 2026 The FreeBSD Foundation + * + * This software was written by Mark Johnston under sponsorship from + * the FreeBSD Foundation. + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +#include +#include + +#include +#include +#include + +#include + +/* + * Verify that AT_RESOLVE_BENEATH is respected by various system calls. + */ + +static int +setup(void) +{ + int fd, tfd; + + ATF_REQUIRE_EQ(0, mkdir("base", 0755)); + ATF_REQUIRE_EQ(0, mkdir("outside", 0755)); + ATF_REQUIRE((tfd = open("outside/target", O_CREAT | O_WRONLY, 0644)) >= + 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("outside/dir", 0755)); + ATF_REQUIRE((tfd = open("base/file", O_CREAT | O_WRONLY, 0644)) >= 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("base/subdir", 0755)); + ATF_REQUIRE((fd = open("base", O_DIRECTORY | O_RDONLY)) >= 0); + return (fd); +} + +ATF_TC_WITHOUT_HEAD(faccessat_beneath); +ATF_TC_BODY(faccessat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + faccessat(fd, "file", F_OK, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + faccessat(fd, "../outside/target", F_OK, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(chflagsat_beneath); +ATF_TC_BODY(chflagsat_beneath, tc) +{ + int fd, ret; + + fd = setup(); + ret = chflagsat(fd, "file", UF_NODUMP, AT_RESOLVE_BENEATH); + if (ret != 0) + ATF_REQUIRE_EQ(EOPNOTSUPP, errno); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + chflagsat(fd, "../outside/target", UF_NODUMP, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchmodat_beneath); +ATF_TC_BODY(fchmodat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchmodat(fd, "file", 0644, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchmodat(fd, "../outside/target", 0644, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchownat_beneath); +ATF_TC_BODY(fchownat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchownat(fd, "file", -1, -1, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchownat(fd, "../outside/target", 0, 0, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(utimensat_beneath); +ATF_TC_BODY(utimensat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + utimensat(fd, "file", NULL, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + utimensat(fd, "../outside/target", NULL, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(linkat_beneath); +ATF_TC_BODY(linkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + linkat(fd, "file", fd, "hardlink", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + linkat(fd, "../outside/target", fd, "hardlink2", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_beneath); +ATF_TC_BODY(unlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "file", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/target", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_rmdir_beneath); +ATF_TC_BODY(unlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "subdir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/dir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_beneath); +ATF_TC_BODY(funlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "file", FD_NONE, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/target", FD_NONE, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_rmdir_beneath); +ATF_TC_BODY(funlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, mkdir("base/subdir2", 0755)); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "subdir2", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/dir", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC(getfhat_beneath); +ATF_TC_HEAD(getfhat_beneath, tc) +{ + atf_tc_set_md_var(tc, "require.user", "root"); +} +ATF_TC_BODY(getfhat_beneath, tc) +{ + fhandle_t fh; + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + getfhat(fd, "file", &fh, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + getfhat(fd, "../outside/target", &fh, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TP_ADD_TCS(tp) +{ + ATF_TP_ADD_TC(tp, faccessat_beneath); + ATF_TP_ADD_TC(tp, chflagsat_beneath); + ATF_TP_ADD_TC(tp, fchmodat_beneath); + ATF_TP_ADD_TC(tp, fchownat_beneath); + ATF_TP_ADD_TC(tp, utimensat_beneath); + ATF_TP_ADD_TC(tp, linkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, funlinkat_beneath); + ATF_TP_ADD_TC(tp, funlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, getfhat_beneath); + return (atf_no_error()); +} From nobody Tue Jun 30 17:21:30 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLM0Xq1z6jYZ5 for ; Tue, 30 Jun 2026 17:21:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLL4Xz9z3rwh for ; Tue, 30 Jun 2026 17:21:30 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840090; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bPxA0XWKmRK0yWPtlTGCd5BCNGWXp8HynSVadpRD2uo=; b=b605xxc8cv2b6xSkAgJupW9YZbggQUc6Bbrc1GF0vMFWwyvcwuE9+lHN+75dPcet/NsV4b bAqjTfCkavOtF4BROsKOtcp0kq3uwbE3CklPTf1bz9pLdOISSyCPnMqXnyRLj4mye6dfs7 23w80YREG/l9BqkhVdC+IIx6BYiy23JBJ7MKYgb+rfSoHYY78FA791/h9+Pv5GHNGTucnu etb90KXRXTrZrDpP1fZ6EkwsEGfAN0mnYqjYumjiEnFAD/OaHfIIh6QoGG+q4ozLj/vIv7 2TxEtZdTbCm0VEShEce6gHT92NYBUGiHp5uAH4AL/MoDo2Ffg2lGjAjzo94BdA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840090; a=rsa-sha256; cv=none; b=VM4mpQrf3MHksAap3JiIPoeALhDywaKWirp0CPdEB/7CJNL1tHWCFHXgKra0Jnuh5JP9FN OGESJH/LE6lFbuaCECYDhWnRchMCoAhOhUeiNIMo+ozQuL7HsdH31HZ0Y/guOovJP6NJYj 1evhzr0g9MGA78CrTXakjSCG0n0SnkCuW2go78A274TIpRDZJXOPkXw72nTB5Rn7nPF3bs GFTNuRWuRX2XZv+kUjohgvTTcnkNPcz3EMBP+/WJGYALLQd4dRou5owwpKmSSL7yEyeHGz QVzHENcBmoUswbza+04txu6tdHre0yBq9g+BP6jQmokWxsQXTlRyj0KUFzgt1w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840090; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bPxA0XWKmRK0yWPtlTGCd5BCNGWXp8HynSVadpRD2uo=; b=qsvONstaM3ieul21B3C1XE4WcHE6sOuJmmetPaN8cZSjMqcYkPChgHz+GzXv7JKMNl+Qxp ceO7K39qgdKNNQCzUYW2/+cJJxBhzDTfQx3anKaRqR/dVE5QU3wA/K+rhh2Lomc2N7r5Lw 9ifeJxz9RB0xUoEWx4NnfDNk6OEP0IMr1G3Ebi8QzynN4xdmK5ZoHPKX4kqrahKrVbY7/3 yijHZFwBp5ylUhrQkUbe5vKotUMCTxkGd/R6dM2UIgM53E1KbzpeDp264J6NUy/pXcIXij aPaGGuWAqWEmN2CEFv91HhJI2m7cpWH63NlFweNQ6jSdVJonR0NSgGrxL/xc6w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLL3LKCztF8 for ; Tue, 30 Jun 2026 17:21:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44f6c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:30 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 47728575b40b - releng/15.0 - posixshm: Disallow truncation of largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 47728575b40b09cf4f3b45f1fc9e89e1db8ead59 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:30 +0000 Message-Id: <6a43fb1a.44f6c.3648fc70@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=47728575b40b09cf4f3b45f1fc9e89e1db8ead59 commit 47728575b40b09cf4f3b45f1fc9e89e1db8ead59 Author: Mark Johnston AuthorDate: 2026-06-23 22:47:02 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 posixshm: Disallow truncation of largepage objects We correctly handled ftruncate(), but not open(O_TRUNC). Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57831 --- sys/kern/uipc_shm.c | 8 +++----- tests/sys/posixshm/posixshm_test.c | 38 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 5 deletions(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index 136bb03246f8..8ab03b5bff32 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -788,7 +788,7 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) vm_pindex_t oldobjsz __unused; int aflags, error, i, psind, try; - KASSERT(length >= 0, ("shm_dotruncate: length < 0")); + KASSERT(length >= 0, ("shm_dotruncate_largepage: length < 0")); object = shmfd->shm_object; VM_OBJECT_ASSERT_WLOCKED(object); rangelock_cookie_assert(rl_cookie, RA_WLOCKED); @@ -1328,15 +1328,13 @@ kern_shm_open2(struct thread *td, const char *userpath, int flags, mode_t mode, if (error == 0 && (flags & (O_ACCMODE | O_TRUNC)) == (O_RDWR | O_TRUNC)) { - VM_OBJECT_WLOCK(shmfd->shm_object); #ifdef MAC error = mac_posixshm_check_truncate( - td->td_ucred, fp->f_cred, shmfd); + td->td_ucred, fp->f_cred, shmfd); if (error == 0) #endif - error = shm_dotruncate_locked(shmfd, 0, + error = shm_dotruncate_cookie(shmfd, 0, rl_cookie); - VM_OBJECT_WUNLOCK(shmfd->shm_object); } if (error == 0) { /* diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index d53e8f57b89e..fbd15f079896 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -2150,6 +2150,43 @@ ATF_TC_BODY(largepage_reopen, tc) "close failed; errno=%d", errno); } +ATF_TC_WITHOUT_HEAD(largepage_truncate); +ATF_TC_BODY(largepage_truncate, tc) +{ + size_t ps[MAXPAGESIZES]; + int fd, psind; + + (void)pagesizes(ps); + psind = 1; + + gen_test_path(); + fd = shm_create_largepage(test_path, O_CREAT | O_RDWR, psind, + SHM_LARGEPAGE_ALLOC_DEFAULT, 0600); + if (fd < 0 && errno == ENOTTY) + atf_tc_skip("no large page support"); + ATF_REQUIRE_MSG(fd >= 0, "shm_create_largepage failed; error=%d", errno); + + ATF_REQUIRE_MSG(ftruncate(fd, ps[psind]) == 0, + "ftruncate failed; error=%d", errno); + + ATF_REQUIRE_MSG(close(fd) == 0, "close failed; error=%d", errno); + + fd = shm_open(test_path, O_RDWR | O_TRUNC, 0); + ATF_REQUIRE_MSG(fd == -1, "shm_open(O_TRUNC) should have failed"); + ATF_REQUIRE_ERRNO(ENOTSUP, fd == -1); + + fd = shm_open(test_path, O_RDWR, 0); + ATF_REQUIRE_MSG(fd >= 0, "shm_open failed; error=%d", errno); + + ATF_REQUIRE_MSG(ftruncate(fd, ps[psind]) == 0, + "ftruncate to same size failed; error=%d", errno); + + ATF_REQUIRE_MSG(shm_unlink(test_path) == 0, + "shm_unlink failed; errno=%d", errno); + ATF_REQUIRE_MSG(close(fd) == 0, + "close failed; errno=%d", errno); +} + ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TC(tp, remap_object); @@ -2201,6 +2238,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, largepage_pkru); #endif ATF_TP_ADD_TC(tp, largepage_reopen); + ATF_TP_ADD_TC(tp, largepage_truncate); return (atf_no_error()); } From nobody Tue Jun 30 17:21:31 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLN0RMWz6jYdv for ; Tue, 30 Jun 2026 17:21:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLM5L2Rz3s6Y for ; Tue, 30 Jun 2026 17:21:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840091; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JmAzxV7yufn9lXxy5MU2wOOjr3R0xVXqDqRfNXsgMgc=; b=WAMp1xRfSH2j8oKOQHwx4hKYfmns2kSLB4a9mn0M1YB7p5D5SbtRXRG5/J1L/iQjJq/9ol IXSL1MRFVOYsUoaPPHmdS6gDBpFRBgFYN9F+yOYYiZGTmGc4zut+uA8pfgWA9XEqizIew8 Ae38rwfqeDw9tqLU2jdsL1+ca7hUnCsTcxT3yDy1MPI3P0gwJExcjkX0m+zSdi0EJpbPus X9UuFU/1ux5KsVilkySFJJ7H2JX5BVMQFxLx0C/GNmQmrD4C2m0zlbzYxnFCRR79j6ItKl f+5Zjs0K34NfiRlpUpuFEW42/JJxNAU+LU9A8nMdjGDEe73U+pWiNy5ume+44g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840091; a=rsa-sha256; cv=none; b=fo9s/KwrX+LuHtSNgveQJP1fBJ3ud+2XR3jCmm4DaFplPxCSxP7lNDAUHbuk/aQK99Jcua 0XQ0jyU17jNRYMgFOaez3Vd08fGPiGFwpRIkVdSSnmnDyB9ZrelPW7NlUc2c76JMIszkcO 8CqheIa2UdoB7wR1jPxTXZa6tiK6EGP9BvWqOxHPvdHg/qhg5uq04yvKm8P6Lnl5aMbJwi 70pTSIEgzi88uWa0QqVFPSI69qzfu7/AsbShLMvyuoLLxiMUx1ql8/A0DTBnjA2jjPSXbl flmAUZ1rRedbyRWj7MCJnvhQQAwhj/D7IOIqK+XRzgQ6lv96WBJ+mYXd+3IGHg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840091; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JmAzxV7yufn9lXxy5MU2wOOjr3R0xVXqDqRfNXsgMgc=; b=BzyNKrKz1F59LTDFBjPIofjP+4bk39FU2VTUlOAT9YGHYJAK5OVPEfXv2050VAB7HaJoMX nqHx3tpPelVN3O+KtpzlGQ+IgZ35amVBxHz0JRF+aiwzdh7Ncf/Jjx0KKXgJQLM8PMdMMM rU4B9WN+yR6NsRDURC5/jxDZ8xS5LG4/tT5Klkxc54oH8G6QP0IXc+7hv6VPpuNQ44tBMi jmf6PHyuEd4E0JvSiVkFl7o4DISFWkHQc2JSqM/d7STPvA6Na2zj2p4/5SSFcm9URmcMAq kWziQGl6FNWePwHLgJfbJ6iQTekjM8J8UheSFdjKpq1e5PHfM36Tq/iX9Aj6cw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLM49yyztQ2 for ; Tue, 30 Jun 2026 17:21:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45a20 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:31 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 8d086f03b9be - releng/15.0 - posixshm: Fix handling of sendfile() with largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 8d086f03b9beebd1caa43549c824b269c8c6bda8 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:31 +0000 Message-Id: <6a43fb1b.45a20.109f875@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8d086f03b9beebd1caa43549c824b269c8c6bda8 commit 8d086f03b9beebd1caa43549c824b269c8c6bda8 Author: Mark Johnston AuthorDate: 2026-06-24 19:57:00 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 posixshm: Fix handling of sendfile() with largepage objects sendfile(2) can transmit POSIX shared memory objects. Typically it will look up and wire each page before sending it to a socket; once transmission is complete, the page is unwired and typically released back into the page queues. sendfile() has an advisory flag, SF_NOCACHE, which means, "try to free the page once transmission is complete." This is implemented in vm_page_release(), which expects to operate on managed pages. Pages belonging a largepage object are de-facto wired not explicitly so. Thus, vm_page_release() will unwire and, having found no additional references, free the page. Because mappings of largepage objects are unmanaged, userspace can still access the now freed page. Fix the problem by explicitly wiring largepage pages. Make the VM object destructor responsible for unwiring and freeing them. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49427 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57832 --- sys/kern/uipc_shm.c | 22 ++++++++-- sys/vm/vm_page.c | 23 +++++----- tests/sys/posixshm/posixshm_test.c | 89 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 121 insertions(+), 13 deletions(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index 8ab03b5bff32..662d2e5e5c8c 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -326,6 +326,7 @@ static void shm_largepage_phys_ctor(vm_object_t object, vm_prot_t prot, vm_ooffset_t foff, struct ucred *cred) { + object->flags |= OBJ_PG_DTOR; } static void @@ -333,11 +334,27 @@ shm_largepage_phys_dtor(vm_object_t object) { int psind; + VM_OBJECT_ASSERT_WLOCKED(object); + psind = object->un_pager.phys.data_val; if (psind != 0) { + struct pctrie_iter pages; + vm_page_t m; + bool removed __diagused; + + vm_page_iter_init(&pages, object); +restart: + VM_RADIX_FOREACH(m, &pages) { + if (!vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL)) { + pctrie_iter_reset(&pages); + goto restart; + } + removed = vm_page_iter_remove(&pages, m); + KASSERT(!removed, ("%s: page %p not wired", __func__, m)); + vm_page_unwire(m, PQ_NONE); + } atomic_subtract_long(&count_largepages[psind], object->size / (pagesizes[psind] / PAGE_SIZE)); - vm_wire_sub(object->size); } else { KASSERT(object->size == 0, ("largepage phys obj %p not initialized bit size %#jx > 0", @@ -820,7 +837,7 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) if ((shmfd->shm_seals & F_SEAL_GROW) != 0) return (EPERM); - aflags = VM_ALLOC_NORMAL | VM_ALLOC_ZERO; + aflags = VM_ALLOC_NORMAL | VM_ALLOC_ZERO | VM_ALLOC_WIRED; if (shmfd->shm_lp_alloc_policy == SHM_LARGEPAGE_ALLOC_NOWAIT) aflags |= VM_ALLOC_WAITFAIL; try = 0; @@ -868,7 +885,6 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) object->size += OFF_TO_IDX(pagesizes[psind]); shmfd->shm_size += pagesizes[psind]; atomic_add_long(&count_largepages[psind], 1); - vm_wire_add(atop(pagesizes[psind])); } return (0); } diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c index 9de91d2503f2..4e42865a622d 100644 --- a/sys/vm/vm_page.c +++ b/sys/vm/vm_page.c @@ -4254,6 +4254,9 @@ vm_page_unwire_managed(vm_page_t m, uint8_t nqueue, bool noreuse) { u_int old; + KASSERT(nqueue < PQ_COUNT, + ("vm_page_unwire: invalid queue %u request for page %p", + nqueue, m)); KASSERT((m->oflags & VPO_UNMANAGED) == 0, ("%s: page %p is unmanaged", __func__, m)); @@ -4312,17 +4315,15 @@ vm_page_unwire_managed(vm_page_t m, uint8_t nqueue, bool noreuse) void vm_page_unwire(vm_page_t m, uint8_t nqueue) { - - KASSERT(nqueue < PQ_COUNT, - ("vm_page_unwire: invalid queue %u request for page %p", - nqueue, m)); + KASSERT(nqueue < PQ_COUNT || nqueue == PQ_NONE, + ("%s: invalid queue %u request for page %p", __func__, nqueue, m)); if ((m->oflags & VPO_UNMANAGED) != 0) { if (vm_page_unwire_noq(m) && m->ref_count == 0) vm_page_free(m); - return; + } else { + vm_page_unwire_managed(m, nqueue, false); } - vm_page_unwire_managed(m, nqueue, false); } /* @@ -4496,13 +4497,15 @@ vm_page_release_toq(vm_page_t m, uint8_t nqueue, const bool noreuse) void vm_page_release(vm_page_t m, int flags) { - vm_object_t object; - - KASSERT((m->oflags & VPO_UNMANAGED) == 0, - ("vm_page_release: page %p is unmanaged", m)); + if ((m->oflags & VPO_UNMANAGED) != 0) { + vm_page_unwire(m, PQ_NONE); + return; + } if ((flags & VPR_TRYFREE) != 0) { for (;;) { + vm_object_t object; + object = atomic_load_ptr(&m->object); if (object == NULL) break; diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index fbd15f079896..22e69255308f 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -33,6 +33,7 @@ #include #include #include +#include #include #include #include @@ -2150,6 +2151,93 @@ ATF_TC_BODY(largepage_reopen, tc) "close failed; errno=%d", errno); } +static unsigned char +largepage_sendfile_expected(size_t off) +{ + + return ((unsigned char)(off * 131 + (off >> 8))); +} + +ATF_TC_WITHOUT_HEAD(largepage_sendfile); +ATF_TC_BODY(largepage_sendfile, tc) +{ + static const int flags[] = { 0, SF_NOCACHE }; + char *addr; + off_t sbytes; + size_t ps[MAXPAGESIZES]; + int error, fd, pscnt, sd[2], status; + pid_t child; + + pscnt = pagesizes(ps); + + for (int i = 1; i < pscnt; i++) { + for (int fi = 0; fi < (int)nitems(flags); fi++) { + fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, + ps[i]); + addr = mmap(NULL, ps[i], PROT_READ | PROT_WRITE, + MAP_SHARED, fd, 0); + ATF_REQUIRE_MSG(addr != MAP_FAILED, + "mmap(%zu bytes) failed; error=%d", ps[i], errno); + + /* Fill with a verifiable pattern. */ + for (size_t j = 0; j < ps[i]; j++) + addr[j] = largepage_sendfile_expected(j); + + ATF_REQUIRE(socketpair(PF_LOCAL, SOCK_STREAM, 0, + sd) == 0); + + child = fork(); + ATF_REQUIRE_MSG(child != -1, + "fork() failed; error=%d", errno); + if (child == 0) { + char buf[BUFSIZ]; + ssize_t len; + size_t off, resid; + + (void)close(sd[0]); + off = 0; + for (resid = ps[i]; resid > 0; resid -= len) { + len = read(sd[1], buf, sizeof(buf)); + if (len <= 0) + _exit(1); + for (ssize_t k = 0; k < len; k++) { + if ((unsigned char)buf[k] != + largepage_sendfile_expected( + off + k)) + _exit(2); + } + off += len; + } + _exit(0); + } + ATF_REQUIRE(close(sd[1]) == 0); + + sbytes = 0; + error = sendfile(fd, sd[0], 0, ps[i], NULL, &sbytes, + flags[fi]); + ATF_REQUIRE_MSG(error == 0, + "sendfile() failed; error=%d flags=%#x", + errno, flags[fi]); + ATF_REQUIRE_MSG(sbytes == (off_t)ps[i], + "sendfile() short; sbytes=%jd expected=%zu flags=%#x", + (intmax_t)sbytes, ps[i], flags[fi]); + + ATF_REQUIRE(close(sd[0]) == 0); + + ATF_REQUIRE_MSG(waitpid(child, &status, 0) == child, + "waitpid() failed; error=%d", errno); + ATF_REQUIRE_MSG(WIFEXITED(status), + "child killed by signal %d", WTERMSIG(status)); + ATF_REQUIRE_MSG(WEXITSTATUS(status) == 0, + "child exited with status %d (flags=%#x)", + WEXITSTATUS(status), flags[fi]); + + ATF_REQUIRE(munmap(addr, ps[i]) == 0); + ATF_REQUIRE(close(fd) == 0); + } + } +} + ATF_TC_WITHOUT_HEAD(largepage_truncate); ATF_TC_BODY(largepage_truncate, tc) { @@ -2238,6 +2326,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, largepage_pkru); #endif ATF_TP_ADD_TC(tp, largepage_reopen); + ATF_TP_ADD_TC(tp, largepage_sendfile); ATF_TP_ADD_TC(tp, largepage_truncate); return (atf_no_error()); From nobody Tue Jun 30 17:21:29 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLL0ZpQz6jYNr for ; Tue, 30 Jun 2026 17:21:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLK4ZJTz3rwX for ; Tue, 30 Jun 2026 17:21:29 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840089; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zIutJ2QKQBLbmQpf8mHkHnC7o83/1b7i9qsbnrXORGI=; b=pUb99rE85HEg5/KkD38icLLTYepds66zOa5oHKqw33FOYUcFv5s1NE5T6FDZ3vOg9lNAD6 k3UbUswpxrHhIVr5r78AjIOFX5OyBUqOfmrr1HuSlLYd/0p7S6iYhC/HHSFiJ68HjoZHXl UCgKXjwJGnIU45pm6o5cqRKohtLiCnin97sK0W0YgNSSWibZ+kCjxPNrFO8lvQMJq65xXy JU0SHI98mdRbnp9LelfdSyfVSl84S8LfPy5NR/kxzkU0rHvhHd/5Lic/kkTPcWzDO5bQbg 7FqCTC0JfD/9RSoQ6ZmhM8n6LqzYuDm1bkCSY+rpHki6te1JsngSumBGFpG7GA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840089; a=rsa-sha256; cv=none; b=hhqIsYkFP0Z9+KFKt3vME1QnC3f2s5z4vzjj+6hGKHkeLAS0OgOhhQY5LHwcQMjhdofpnB MaYAXe/6wcPcTZyhhfXy/9InznZTef7Y1lx680LOzZLZCeVUBZj0KPKruZ0eSarQo2Q7i1 BM4AWmnjfmh1FJO/SnSckZxO9tMqwgFNoW+jtMyVgWcwz0nPv3OlSw9TytLWx1G7TOGbT8 yuSDRg9cUOV66WKaX7Ia/MsueubLqzqSaa8RKLtGZOPRp7myLbXf/YnNuML5GK+zgRa+3R 8eeDQveWkRA/8oiSHbzo4eC/E6RCe8xoBp0/k6MkcXS6xZDjOh5y5KPZ8CnkOA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840089; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zIutJ2QKQBLbmQpf8mHkHnC7o83/1b7i9qsbnrXORGI=; b=tKnYSmOJIxMXC8GtwvnBQlvB91t9DrP6HLCr2jM5NB4hyXAWWQGc2lqyoPM1PIKhQVltuZ he5UHr3snRgdaO5e/Qt/yDpy2UoaQl4713t5how1CKwcDMxuPcqHelYU7lpxz7gpayqk1n V6edil2wgvM/r4+VMwL0D94vMfNTjezL/VdEBjS6Wticw9+e5pye4CjuATGzMqlTVjreix hcsGzh5MGEYYpgWIXWt7kWuepIZN9nq+8t2ydJlxlMhYPbdhigByvQScQVWGt209Nbe7Mh qKK4B/LNeRyMMs0tclhGEsnefrbhAXdhlTXuDDIxRI6d7SmnQDK267w6ddlXvQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLK2Xr8ztSn for ; Tue, 30 Jun 2026 17:21:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45f6f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:29 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 21fe39288f8c - releng/15.0 - posixshm: Disallow fspacectl() on largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 21fe39288f8cf792a4c2589c99f4a0afe55f47a6 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:29 +0000 Message-Id: <6a43fb19.45f6f.5bbca836@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=21fe39288f8cf792a4c2589c99f4a0afe55f47a6 commit 21fe39288f8cf792a4c2589c99f4a0afe55f47a6 Author: Mark Johnston AuthorDate: 2026-06-24 19:56:07 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 posixshm: Disallow fspacectl() on largepage objects As with truncation, the operation isn't supported, but nothing prevented it. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57830 --- sys/kern/uipc_shm.c | 5 ++++- tests/sys/posixshm/posixshm_test.c | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index eb1327f7f2de..136bb03246f8 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -2090,11 +2090,14 @@ shm_fspacectl(struct file *fp, int cmd, off_t *offset, off_t *length, int flags, ("shm_fspacectl: non-zero flags")); KASSERT(*offset >= 0 && *length > 0 && *length <= OFF_MAX - *offset, ("shm_fspacectl: offset/length overflow or underflow")); - error = EINVAL; + shmfd = fp->f_data; off = *offset; len = *length; + if (shm_largepage(shmfd)) + return (ENOTSUP); + rl_cookie = shm_rangelock_wlock(shmfd, off, off + len); switch (cmd) { case SPACECTL_DEALLOC: diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index 1250fcb63a93..d53e8f57b89e 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -1379,6 +1379,27 @@ ATF_TC_BODY(largepage_config, tc) ATF_REQUIRE(close(fd) == 0); } +ATF_TC_WITHOUT_HEAD(largepage_fspacectl); +ATF_TC_BODY(largepage_fspacectl, tc) +{ + struct spacectl_range range; + size_t ps[MAXPAGESIZES]; + int fd, pscnt; + + pscnt = pagesizes(ps); + + for (int i = 1; i < pscnt; i++) { + fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, ps[i]); + + range.r_offset = 0; + range.r_len = ps[i]; + ATF_REQUIRE_ERRNO(ENOTSUP, + fspacectl(fd, SPACECTL_DEALLOC, &range, 0, &range) == -1); + + ATF_REQUIRE(close(fd) == 0); + } +} + ATF_TC_WITHOUT_HEAD(largepage_mmap); ATF_TC_BODY(largepage_mmap, tc) { @@ -2167,6 +2188,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, mmap_prot); ATF_TP_ADD_TC(tp, largepage_basic); ATF_TP_ADD_TC(tp, largepage_config); + ATF_TP_ADD_TC(tp, largepage_fspacectl); ATF_TP_ADD_TC(tp, largepage_mmap); ATF_TP_ADD_TC(tp, largepage_munmap); ATF_TP_ADD_TC(tp, largepage_madvise); From nobody Tue Jun 30 17:21:32 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLP3FYbz6jYnV for ; Tue, 30 Jun 2026 17:21:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLN5y4pz3sCd for ; Tue, 30 Jun 2026 17:21:32 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840092; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=nFmEbI+DDxV9zfxH1IzQpgU8syHAB22/xicQM1en5II=; b=nOOzvm/2KssA7PRpdOdx8FkeWMDIQwadF8P/zsrLJI+2t5h+fapmWg8jzO9qMJhIkgKk2G rKElT5qVvgusb+nNNmt885i82hvzMbfup0eDUtYdBOmLX5vX9XARuHxOAU5OA7C3+1IytM JIxnoUw8CMyS+WtCd/Q1Z4qMVV33S1r9ufjKn8vDLJsBuVkuT1k+dUqMjhNFuFNuF+A9P4 RuvijndWogn43xR2Ig9WE68+l7RHZmI8ikWNc1kI4pXUGL8bTHjeKNxs7/GAwWku1xV0Ts nCFzQEgX+C0gT2bnTAk/6x5gT+/lX2R+zt4y5oER+4RO7TQkscAnovoY0YGOMw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840092; a=rsa-sha256; cv=none; b=hv8SfYzpzMIrz1hSI05FNMKiao2SYTP8t3kr/Nqq+0bwk6JNx1nztXa8lDg0RQeb8zXmYN B6u9aavj833Y59ZRhe60H4cUEyfd6KH9A141kNop/mgehXhvlS1H6dkNOfZwe13OVbkQzP hUzQeXI5ssmgNGdGEoZCUcUGjPEiHkg92zlSe5XTaVj2VETXqnmIpGtiWFcFtuqQ1eknFe +IF5O9ngy2y4qx4wEJxNOtOF299yFCchmvYjKULr60GOQ7IQpXDnl948mU2DNf4DtiyNUo s3FRzSeXxXcB6o2deIZA1l0l9BwD4DeAcdKZSM04iu786hAZ2XgQ3GehM7kdmA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840092; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=nFmEbI+DDxV9zfxH1IzQpgU8syHAB22/xicQM1en5II=; b=Ob2vbWLm5wPKxaM6GpervaKtL6bdXCPmQFrMf3A0059/NJN6GHvqfff9do7YD6d4S/d3Mi VBB5NrWxx3u57BwtCYJbaPqCycd5eCNojaiqDn1MBYsCDGszcLqXPXzWP3xhPxpMCfatJi assjlsJqRT2YlSL30+pG6FELWs8HqogDbPYK+IjHgWA/wu0Os+6rDFd6aDOVWvN74TudTf NDr9BCFDL2zT97mwU40JhkU4U2+smNQ0GJLDKEDRTp5MQdTE1rKNNoFG9SsqY9NY9amkyr E12bPD7gdkAxP+JyKwgJ+ZooqEkeqHVpudxTuLGIP0ZVFRABuiSUKXxN9LZfHw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLN4zTMztnJ for ; Tue, 30 Jun 2026 17:21:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4475d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:32 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Kyle Evans From: Mark Johnston Subject: git: f887a2c04c9e - releng/15.0 - kern: fix auditing of ptrace(2) syscall requests List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: f887a2c04c9ec09c468f6bb0dd510588bf5b1225 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:32 +0000 Message-Id: <6a43fb1c.4475d.65bbb684@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=f887a2c04c9ec09c468f6bb0dd510588bf5b1225 commit f887a2c04c9ec09c468f6bb0dd510588bf5b1225 Author: Kyle Evans AuthorDate: 2026-06-25 17:02:47 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:58 +0000 kern: fix auditing of ptrace(2) syscall requests `error` here is the return value of syscall_thread_enter() rather than the syscall itself, so the committed audit records do not reflect reality. This is less harmful than them recording an error when the operation actually succeeded, but it could still possibly be used to throw off IDS techniques with things like bsmtrace. Approved by: so Security: FreeBSD-SA-26:45.audit Security: CVE-2026-49426 Reviewed by: des, kib, markj, csjp Differential Revision: https://reviews.freebsd.org/D57847 --- sys/kern/kern_sig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c index 40da0a79b810..ac1dc00348c1 100644 --- a/sys/kern/kern_sig.c +++ b/sys/kern/kern_sig.c @@ -2765,7 +2765,7 @@ ptrace_syscallreq(struct thread *td, struct proc *p, td->td_errno = nerror; if (audited) - AUDIT_SYSCALL_EXIT(error, td); + AUDIT_SYSCALL_EXIT(tsr->ts_ret.sr_error, td); if (!sy_thr_static) syscall_thread_exit(td, se); } From nobody Tue Jun 30 17:21:34 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLR2VKxz6jYXJ for ; Tue, 30 Jun 2026 17:21:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLR0bpWz3s7F for ; Tue, 30 Jun 2026 17:21:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840095; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ep2TNUtkSbjkO1AwGP+FOa9PSVtH7FYoUjaN4EHbPg0=; b=ex7XBKM5/qnA9H+AV7exmt3axUzO19ITaOoA4aiKSRtfdgxygS+08Qx6wN+56sZGIjXgZh aU0YYHkzvrqWCPtQcRTzmeaOK2IJ4lQOL1AqhGx6c9qQRlQ6qLGA4Cafk9qK3j1NDBm6WW uIu8OVDZhDcbQaySEp/rmFvTSkZuhhjvWAvZCkgO5y956CDmkOO5yJ9fSJ1nu9Et/ZypwX +rKSo+Fb+3mCcfFhMA7Wqfnb+BD8QC8u0Cgct44FrH5fKDkIds0mXjB1q9IlzR+NJ8ME5j 5CPAqRFD37F4RJY7o3KgVfcdz/w9jcwAtW5e1La5p1v4Vfnr75SzgmzVBpu4gg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840095; a=rsa-sha256; cv=none; b=MjJultGcdFIrbLB8CVuyVXRaqX0ELfJzq82L/KVdHN0opS6ZxHlPCnpOMGt+xzaV9ZBpp3 /8EHGDb4qJnqxZ9FsDLJfNVVOQbWhTLHNG7ia0tkJ0+CMaKXgJiNo1AGkbNkdABvIejK7r rUTSUKpG9QsWSHTaOHPI6Z26ZHFM2RinaNwa2vDzICilXDcdJp6uGoxMtPlfS3+YmmFwfy orxxNJvft9p4qqqQsouw3RduVvtYnd4nvkaEKXhflMafejdlLAq1n8iPJX3JdCn6/7YQZT tQ7WH4iSTfg1wpCE7OQbn0ik6xt8fQ6FyfEz+18tdnTeROGdg6wIJtuovanong== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840095; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ep2TNUtkSbjkO1AwGP+FOa9PSVtH7FYoUjaN4EHbPg0=; b=RDHrllU/iVLn0QivB8FNytL5AVkfCu+K3nzB1HXarmz/DFbUp9Qr6pXa2nQp/dzE8pQ/cH GD1j1Dw3hpu6PnMRKLKFCUvzpHNc4+IfxPsYbeBSC0TK3LvUy/sktpp94t2wGrcz67UlNa crHhQMVRTEzYbjLQymZhUbcTRbsk+XM8wla9hzu9jBhBUypUCsM5Vm8Zxt/YeriTEoHyfL 7sR/aPyIBSdyDcYGYy/lJlrJ9EXmc2wRqLJj3D9dU9W49n46zw+VIJL443Rj0rHiJY40ja G+Ln7A97FUbTIqM4nAT8B1xu0l9+KNlAETTwUME5y11C27GYP4wJ1H4/9Ayy9g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLQ6mR0ztQ3 for ; Tue, 30 Jun 2026 17:21:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44f70 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Ed Maste From: Mark Johnston Subject: git: 008ca5def63b - releng/15.0 - compat/linux: Avoid waitid() kernel stack disclosure List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 008ca5def63b5fd754c1acdf60bbd64786a36abc Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:34 +0000 Message-Id: <6a43fb1e.44f70.4629eb8@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=008ca5def63b5fd754c1acdf60bbd64786a36abc commit 008ca5def63b5fd754c1acdf60bbd64786a36abc Author: Ed Maste AuthorDate: 2026-03-10 13:53:46 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:58 +0000 compat/linux: Avoid waitid() kernel stack disclosure Approved by: so Security: FreeBSD-SA-26:47.linux Security: CVE-2026-49424 Reported by: Adam Crosser, Praetorian Reviewed by: philip Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D55812 (cherry picked from commit 9a9f93bcf1aa0059d759b2f3ea6faeb2760a11bd) (cherry picked from commit 9f8db9cc67fb86eeb2b645ce7f8aa748e99241a9) --- sys/compat/linux/linux_misc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c index 9e9536335cf2..26a3aeee61b0 100644 --- a/sys/compat/linux/linux_misc.c +++ b/sys/compat/linux/linux_misc.c @@ -749,6 +749,7 @@ linux_common_wait(struct thread *td, idtype_t idtype, int id, int *statusp, error = linux_copyout_rusage(&wru.wru_self, rup); if (error == 0 && infop != NULL && td->td_retval[0] != 0) { sig = bsd_to_linux_signal(siginfo.si_signo); + memset(&lsi, 0, sizeof(lsi)); siginfo_to_lsiginfo(&siginfo, &lsi, sig); error = copyout(&lsi, infop, sizeof(lsi)); } From nobody Tue Jun 30 17:21:33 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLQ4VBkz6jYZM for ; Tue, 30 Jun 2026 17:21:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLP75d9z3rvH for ; Tue, 30 Jun 2026 17:21:33 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840094; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=t+gkemx4dENvwZuzrmKq0PoB3cXrSuNrgD+W7/1pjso=; b=woxFaPp4xap/gK9j3WQwMi8X2t5ZKWWi4iWgyjoP1kTzmUn2YAH1ZoqOTIcl/uXyEtyQQz 4yyiZsJTUBetADJYqwPh4lkOza1DEj5hBXJRcHUCCyGuUKGSVN7wr7up8AV6HDmDOeM9A+ GGt/JT4rWfMchxzReA1o75ZdD+L+JpP3/7hao6+jcVgliW91Je4RC7wlsd2QMm0HYGSdGu cP/8ZY8FWs1B8FRqMowUjP4R2s0iFddxWjgHxFHaktBK9mTqDvjj/dsmjNqY203RSNErqn EK5oIlJXeMhNfWk9MVGoxE7828sCCXHr6w1BFupzWQNBWXdGAF1WN4874tXnHg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840094; a=rsa-sha256; cv=none; b=CdYHiwBol6Bs1/9vgb0xWBKbTFA2Jv1nfPnhpfkETW08Itc1wK7s/93dvhK3iwJOLMzdo3 foy4S15FgAEVSL5XxGoVrCal3KxWhvzxYMg1LmGJNQec/MZJspDVr62oOwLSQiwBZ47mw0 HA/YlubKd7NnjgfoTmcgb5xD09toNdt3SBfcn89a73Nh6/seYZDF/GGQvZLgx1fIaAQgA/ diOX1aMAaxvRlJ0E4N2kg0ieaeUcz/xMXJDOixsGSvKnZEu0UiYjoBD4RcRN3ZZR+PM6yI O+LSraMeeULoFKfCztM2XbCV0P9MQg0Srl3CNQnvnM1QtVWYy/mr1+bWuxyUFQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840094; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=t+gkemx4dENvwZuzrmKq0PoB3cXrSuNrgD+W7/1pjso=; b=t4KhF85pEux3N5eh8nZFIWqYisyy8fQwenPa5dBOrTDtaVRI50KwKc+ExoDFgjDULvfYY2 Akm0ONDgUTRxOUvLgAf+qmqA/n6aAPVbwFUQrqTQD/cHGrvdCuhCQOw0wJZEcz1grzQOAG iIj5AwUFEmK0HZUYz8CRyN2u2dBwsnHWJmihJylW+RamQ1ls/331YQcZt/G5TuKHSbuEFo Bex13aGbNqnJHgZ/cg0EjvoDyp+fVKo6h9w8oK9sbdXr2hJfhY65H0Ssb9xvMPuJv7j9UO eFbpvrQqDAf74uV/By1Dl5smTZDy6419KbZeQFH67nBjDNLKc5+hohxul3cK/Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLP5sJfztnM for ; Tue, 30 Jun 2026 17:21:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44cf9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:33 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: John Baldwin From: Mark Johnston Subject: git: 5357f822416a - releng/15.0 - ktls CBC decrypt: Only increment iovec index when an entry is used List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 5357f822416a2ea6adccfefdb88572f7b18065cb Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:33 +0000 Message-Id: <6a43fb1d.44cf9.e64473b@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=5357f822416a2ea6adccfefdb88572f7b18065cb commit 5357f822416a2ea6adccfefdb88572f7b18065cb Author: John Baldwin AuthorDate: 2026-06-24 01:14:11 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:58 +0000 ktls CBC decrypt: Only increment iovec index when an entry is used If an mbuf in the chain was skipped because it only contained bytes from the header, the iovec index ('i') was incremented even though the entry was not populated. Only increment 'i' when an iovec entry is consumed. Add a new type of KTLS receive test which writes a single TLS record via two separate write(2) calls over a TCP_NODELAY socket to trigger a split in the mbuf chain in the kernel. Test various split locations including after the "plain" TLS header (5 bytes), after the full TLS header, in the middle of the data payload, just before the start of the trailer, and in the middle of the trailer. These tests are also run against all supported ciphers, not just CBC. The 'header' test for CBC ciphersuites was able to trigger the bug. Approved by: so Security: FreeBSD-SA-26:46.ktls Security: CVE-2026-49423 Sponsored by: Chelsio Communications --- sys/opencrypto/ktls_ocf.c | 3 +- tests/sys/kern/ktls_test.c | 110 ++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 110 insertions(+), 3 deletions(-) diff --git a/sys/opencrypto/ktls_ocf.c b/sys/opencrypto/ktls_ocf.c index ece509f5f969..e61f607622b0 100644 --- a/sys/opencrypto/ktls_ocf.c +++ b/sys/opencrypto/ktls_ocf.c @@ -500,13 +500,14 @@ ktls_ocf_tls_cbc_decrypt(struct ktls_session *tls, iov[0].iov_base = &ad; iov[0].iov_len = sizeof(ad); skip = sizeof(*hdr) + AES_BLOCK_LEN; - for (i = 1, n = m; n != NULL; i++, n = n->m_next) { + for (i = 1, n = m; n != NULL; n = n->m_next) { if (n->m_len < skip) { skip -= n->m_len; continue; } iov[i].iov_base = mtod(n, char *) + skip; iov[i].iov_len = n->m_len - skip; + i++; skip = 0; } uio.uio_iov = iov; diff --git a/tests/sys/kern/ktls_test.c b/tests/sys/kern/ktls_test.c index 3970083e7f72..7003b86fb4e2 100644 --- a/tests/sys/kern/ktls_test.c +++ b/tests/sys/kern/ktls_test.c @@ -303,6 +303,15 @@ fd_set_blocking(int fd) ATF_REQUIRE(fcntl(fd, F_SETFL, flags) != -1); } +static void +tcp_nodelay(int fd) +{ + int nodelay = 1; + + ATF_REQUIRE(setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &nodelay, + sizeof(nodelay)) == 0); +} + static bool cbc_crypt(const EVP_CIPHER *cipher, const char *key, const char *iv, const char *input, char *output, size_t size, int enc) @@ -1920,6 +1929,55 @@ test_ktls_receive_bad_size(const atf_tc_t *tc, struct tls_enable *en, close_sockets_ignore_errors(sockets); } +static void +test_ktls_receive_split_record(const atf_tc_t *tc, struct tls_enable *en, + uint64_t seqno, size_t len, size_t first_len) +{ + char *plaintext, *received, *outbuf; + size_t outbuf_cap, outbuf_len; + ssize_t rv; + int sockets[2]; + + ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); + + plaintext = alloc_buffer(len); + received = malloc(len); + outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); + outbuf = malloc(outbuf_cap); + + ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); + + ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, + sizeof(*en)) == 0); + check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); + + fd_set_blocking(sockets[0]); + fd_set_blocking(sockets[1]); + + outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, + plaintext, len, outbuf, outbuf_cap, 0); + ATF_REQUIRE(first_len < outbuf_len); + + tcp_nodelay(sockets[1]); + rv = write(sockets[1], outbuf, first_len); + ATF_REQUIRE_INTEQ((ssize_t)(first_len), rv); + + rv = write(sockets[1], outbuf + first_len, outbuf_len - first_len); + ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len - first_len), rv); + + rv = ktls_receive_tls_record(en, sockets[0], TLS_RLTYPE_APP, received, + len); + ATF_REQUIRE_INTEQ((ssize_t)len, rv); + + ATF_REQUIRE(memcmp(plaintext, received, len) == 0); + + free(outbuf); + free(received); + free(plaintext); + + close_sockets(sockets); +} + #define TLS_10_TESTS(M) \ M(aes128_cbc_1_0_sha1, CRYPTO_AES_CBC, 128 / 8, \ CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO) \ @@ -2360,6 +2418,26 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ auth_alg, minor, name) \ ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name); +#define GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, name, len, first_len) \ +ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_split_##name); \ +ATF_TC_BODY(ktls_receive_##cipher_name##_split_##name, tc) \ +{ \ + struct tls_enable en; \ + uint64_t seqno; \ + \ + ATF_REQUIRE_KTLS(); \ + seqno = random(); \ + build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ + seqno, &en); \ + test_ktls_receive_split_record(tc, &en, seqno, len, first_len); \ + free_tls_enable(&en); \ +} + +#define ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, name) \ + ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_split_##name); + #define GEN_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ minor) \ GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ @@ -2381,7 +2459,22 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ tls_minimum_record_payload(&en) - 1) \ GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ auth_alg, minor, oversized_record, \ - TLS_MAX_MSG_SIZE_V10_2 * 2) + TLS_MAX_MSG_SIZE_V10_2 * 2) \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, header, 64, \ + sizeof(struct tls_record_layer)); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, full_header, 64, \ + tls_header_len(&en)); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, half, 64, \ + tls_header_len(&en) + 32); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_start, 64, \ + tls_header_len(&en) + 64); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_middle, 64, \ + tls_header_len(&en) + 64 + tls_trailer_len(&en) / 2); #define ADD_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ minor) \ @@ -2402,7 +2495,17 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ auth_alg, minor, small_record) \ ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ - auth_alg, minor, oversized_record) + auth_alg, minor, oversized_record) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, header) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, full_header) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, half) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_start) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_middle) \ /* * For each supported cipher suite, run several receive tests: @@ -2425,6 +2528,9 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ * size * * - a test with an oversized TLS record + * + * - tests of a single record whose data is split across two writes, + * with each test using a different split point */ AES_CBC_NONZERO_TESTS(GEN_RECEIVE_TESTS); AES_GCM_TESTS(GEN_RECEIVE_TESTS); From nobody Tue Jun 30 17:21:37 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLT4zQdz6jYc4 for ; Tue, 30 Jun 2026 17:21:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLT2j6Vz3sDX for ; Tue, 30 Jun 2026 17:21:37 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840097; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cUmpy02eJT/zmtSH+ZvzNKK98fK/JTgEi+iAcAqT6c0=; b=umyCcFv5ySP6l69gWhDv+J9moaJdY1Tmea+Z8SR6Xnb+4sI3THma1m79b8EGd564BzY9+V +7l5Eywgy8MdAnRHkyVgsW9IvOQi4rboVY+dB/Ol4D2pwN+C5W0Orj5UglNxwSH16iKJXM sf31IkC3ieBKqbTLUGrhnC3GU6AetWAyHbg2cGhjHJs5VE5rZpnwBHZ5QTDM/TOd5FoNvz 0VIG7d70hBL/TFW6Dx//Dy/dEncTADDKE7MXSRW3ZkZCJFfcUG12b70F5aEiUzhDzIi87J sagSo5h/P2yvMFvagsBub2RC4ZfpriQcRB6CzODXKnH7pQDlvRry7xOBJj1/RQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840097; a=rsa-sha256; cv=none; b=ZSTXp8Hi/Hg32O/zZFcRhZPcwKPxp0GEB40xBg0Apgk1ISDDy9POIP7F8K+AluxH4gT5/1 5Hee7C0kIJSAVOE7r/cIG8sEaZnfP6cN6Ju46UI+Co7YO9TT7ywt668sz30DTawlwWLQp/ 4MHZ6d3xemTaP0D83nL6q3N7E1bqk08l/LgW6EhVCGhTzYnUbiPII7b84s2ymZHg5iEOUO EVzXqYTSeTTdMsFsURnQwrAslWYM+OjIzc555GKEWNXnr1ybNglMme8m3+TYO1GrpE7lNo DaonkGcZTCO/h3Xdm+lm28TqY6miWIyxh2GXKf+12XcxCoeOig+zcRKM8TbwtA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840097; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cUmpy02eJT/zmtSH+ZvzNKK98fK/JTgEi+iAcAqT6c0=; b=Gx1Fgb5amvkVKahQVhWkYtDfJ6vv3FRDc2mHDeEpotfPhIJa3Zt34HKQUYXR2hsaw++yN9 V2XyUgxNtGSgFjqqqqzWFmm4PBdFCMABnFjBm/uVD2UIN6lzPdemc8l6LIPmn73uWB7DGm pXfMqO/her+TPOC7GYW9GADK/MUh4Pt4uVdIzSu4NITKu0VHJxjllDko3U6+3alJYv+EWC hI+wEnQkZjXF7XnX9eAxZYnhQha5jY3JuvCZbUjD19H71JtfRFM9fJECGfeopr0UrR9Pck e8Zz7HTCVn0A2MfZAbRAEvrr70TjneRVAknczViH5f3nT9DtQPMns3Gm4u1S6Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLT0zMgztqP for ; Tue, 30 Jun 2026 17:21:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45a24 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:37 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Taylor R Campbell From: Mark Johnston Subject: git: e53ab9aec6e0 - releng/15.0 - iconv(3): Fix problems in various encodings List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: e53ab9aec6e027ae49c64a4f03ee38f256904c3f Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:37 +0000 Message-Id: <6a43fb21.45a24.1e184190@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=e53ab9aec6e027ae49c64a4f03ee38f256904c3f commit e53ab9aec6e027ae49c64a4f03ee38f256904c3f Author: Taylor R Campbell AuthorDate: 2026-06-22 21:15:25 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:58 +0000 iconv(3): Fix problems in various encodings Fix null pointer dereference with HZ8 encoding. Fix output buffer overrun in UTF-7, VIQR, ZW encodings. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57947 --- lib/libiconv_modules/HZ/citrus_hz.c | 2 ++ lib/libiconv_modules/UTF7/citrus_utf7.c | 20 +++++++++++++++----- lib/libiconv_modules/VIQR/citrus_viqr.c | 6 +++++- lib/libiconv_modules/ZW/citrus_zw.c | 7 +++++-- 4 files changed, 27 insertions(+), 8 deletions(-) diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index f12938a7dab8..db738b8f812e 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -262,6 +262,8 @@ _citrus_HZ_mbrtowc_priv(_HZEncodingInfo * __restrict ei, tail = psenc->chlen = 0; continue; } + if (graphic == NULL) + break; } else if (ch & 0x80) { if (graphic != GR(psenc->inuse)) break; diff --git a/lib/libiconv_modules/UTF7/citrus_utf7.c b/lib/libiconv_modules/UTF7/citrus_utf7.c index f924366551f1..e7c6a0862c54 100644 --- a/lib/libiconv_modules/UTF7/citrus_utf7.c +++ b/lib/libiconv_modules/UTF7/citrus_utf7.c @@ -296,7 +296,7 @@ done: static int _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei, - char * __restrict s, size_t n __unused, uint16_t u16, + char * __restrict s, size_t n, uint16_t u16, _UTF7State * __restrict psenc, size_t * __restrict nresult) { int bits, i; @@ -336,6 +336,8 @@ _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei, psenc->ch[psenc->chlen++] = base64[i]; } } + if (n < (size_t)psenc->chlen) + return (E2BIG); memcpy(s, psenc->ch, psenc->chlen); *nresult = psenc->chlen; psenc->chlen = 0; @@ -352,6 +354,8 @@ _citrus_UTF7_wcrtomb_priv(_UTF7EncodingInfo * __restrict ei, uint16_t u16[2]; int err, i, len; size_t nr, siz; + char buf[8], *bufp = buf; + _UTF7State psenc_save = *psenc; u32 = (uint32_t)wchar; if (u32 <= UTF16_MAX) { @@ -367,14 +371,20 @@ _citrus_UTF7_wcrtomb_priv(_UTF7EncodingInfo * __restrict ei, return (EILSEQ); } siz = 0; + if (n > sizeof(buf)) + n = sizeof(buf); for (i = 0; i < len; ++i) { - err = _citrus_UTF7_utf16tomb(ei, s, n, u16[i], psenc, &nr); - if (err != 0) - return (err); /* XXX: state has been modified */ - s += nr; + err = _citrus_UTF7_utf16tomb(ei, bufp, n, u16[i], psenc, &nr); + if (err != 0) { + *nresult = (size_t)-1; + *psenc = psenc_save; /* restore state */ + return (err); + } + bufp += nr; n -= nr; siz += nr; } + memcpy(s, buf, siz); *nresult = siz; return (0); diff --git a/lib/libiconv_modules/VIQR/citrus_viqr.c b/lib/libiconv_modules/VIQR/citrus_viqr.c index 1747c0a1705e..c1e88f188aab 100644 --- a/lib/libiconv_modules/VIQR/citrus_viqr.c +++ b/lib/libiconv_modules/VIQR/citrus_viqr.c @@ -323,7 +323,11 @@ _citrus_VIQR_wcrtomb_priv(_VIQREncodingInfo * __restrict ei, int ch = 0; switch (psenc->chlen) { - case 0: case 1: + case 0: + break; + case 1: + if (n-- < 1) + goto e2big; break; default: return (EINVAL); diff --git a/lib/libiconv_modules/ZW/citrus_zw.c b/lib/libiconv_modules/ZW/citrus_zw.c index 3c650c46d0f4..cf66581c3336 100644 --- a/lib/libiconv_modules/ZW/citrus_zw.c +++ b/lib/libiconv_modules/ZW/citrus_zw.c @@ -263,9 +263,12 @@ _citrus_ZW_wcrtomb_priv(_ZWEncodingInfo * __restrict ei __unused, ch = (unsigned char)wc; switch (psenc->charset) { case NONE: - if (ch == '\0' || ch == '\n') + if (ch == '\0' || ch == '\n') { + if (n < 1) + return (E2BIG); + n -= 1; psenc->ch[psenc->chlen++] = ch; - else { + } else { if (n < 4) return (E2BIG); n -= 4; From nobody Tue Jun 30 17:21:36 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLS40ccz6jYJ9 for ; Tue, 30 Jun 2026 17:21:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLS1Ntgz3s7b for ; Tue, 30 Jun 2026 17:21:36 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840096; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=okPHJYqrTtjlPbav1mcRIyOWaOwVp3405YJ8xEOyH9E=; b=hd7BRR2+WpM+s1Z7wUkVdenWIAIhaxgGC5RRumtOvHSXmhBZC/CqBrqeN/9rtu45zsQSAD CKsn7a1/nJTYoESkVeVZKH3i8mAUSgC5/+rFRJJefTnYgtFxrZ/+Yn7tPaDORlZ1KRNdIg 38diXnS50zTmkk+cNUxsHeYt0HMj7/60agMBfJKJLh7W5mAktvBd8cup8CBLtWHCUQ9Yrz 7M+vv1mcZKJPwXYAUsxWiFUQNvO69h/7TvcjH7ft9huimSFH5rMLCQkHeWuQD6EwJ1hh07 2HvuJr3jYom827633Ejk35ZcrPZSArMRPs+uQhIbBPB53akE2QYmWsICpmCzxA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840096; a=rsa-sha256; cv=none; b=qyRayd5AnJ78cGlIjHNQQcPM6zO6n6BmEUwRPzuGMx5PGwM2TRaHl4gqTSdRZUvIfbHINg RHy33SXa3kDFr1M9k31sYRf4cSv0sp7hbJ0hqnDzC3aX+U0KMPcyylF3UH9VeM/Stwi3+h Gcc+t2v/MdWaJpYfQnZWl17dujY7sRUqPhBeLMFy+INmoWZEPn0GTh3Q5cRvkX5nJfZIsJ 7DMqbBnKXaFjc+GZNMzFGHWhVs5Qy+Z3b7cYfDxKn/PeNQOL7LiSkhfnPxczy9RuRa7Py0 rumRBUlJ72psJ6p6t0WcsP40pFcrfSlUtDD5OsxaAffke5FJcIPcA6KMbEDdEg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840096; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=okPHJYqrTtjlPbav1mcRIyOWaOwVp3405YJ8xEOyH9E=; b=RajnnZp9G48g99/QtTCiwdW/VvYgZlyhW6n7TYthzi+cziUxMj0DuFL1gJVVNSvvcy213D PomtK/qo8g5J4TgG7J31nGl/sPvW5GkVd1G7RrBrGsAxBhBmpR+/9QsuZmyAN8GvcnhHqE 9tZm4d6LQ7BZ2oiz9eCmYzSBoLvCz0Sfqhycw4zaeSz+KMoiG0t1UuDyIYUZt2L5MIdDFZ Ob3WbBecJTlA8qBQFrsRYGDUeKYBk+6A14kkbL1gcvHh2EknijAty+pOV1F+3ZqGk3QHBG ZAOjW19ksMMplX7Zv8KIlWtStW42VqOyAvOhoUUHftlYoEY1WjgkixLb1ig1Mg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLS08gGztSr for ; Tue, 30 Jun 2026 17:21:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45999 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:36 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Ed Maste From: Mark Johnston Subject: git: 760b3f0b86a9 - releng/15.0 - compat32: Zero struct to avoid stack disclosure List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 760b3f0b86a91b774713b03305c6ebe5c18cb642 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:36 +0000 Message-Id: <6a43fb20.45999.3e151995@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=760b3f0b86a91b774713b03305c6ebe5c18cb642 commit 760b3f0b86a91b774713b03305c6ebe5c18cb642 Author: Ed Maste AuthorDate: 2026-03-11 15:02:18 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:58 +0000 compat32: Zero struct to avoid stack disclosure Approved by: so Security: FreeBSD-SA-26:48.compat32 Security: CVE-2026-49425 Reported by: Adam Crosser, Praetorian Reviewed by: philip Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D55811 (cherry picked from commit 097cb4e9f0432c543c704cec712ce1cd3302335c) (cherry picked from commit 4551ea3b3f04650cd5300a9eae8994bdb080db91) --- sys/compat/freebsd32/freebsd32_misc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/compat/freebsd32/freebsd32_misc.c b/sys/compat/freebsd32/freebsd32_misc.c index e62c76924d22..f5e4321c7aa3 100644 --- a/sys/compat/freebsd32/freebsd32_misc.c +++ b/sys/compat/freebsd32/freebsd32_misc.c @@ -765,7 +765,7 @@ static int freebsd32_kevent_copyout(void *arg, struct kevent *kevp, int count) { struct freebsd32_kevent_args *uap; - struct kevent32 ks32[KQ_NEVENTS]; + struct kevent32 ks32[KQ_NEVENTS] = {}; int i, error; KASSERT(count <= KQ_NEVENTS, ("count (%d) > KQ_NEVENTS", count)); From nobody Tue Jun 30 17:21:38 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLV5rZ0z6jYJC for ; Tue, 30 Jun 2026 17:21:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLV2mjJz3s1F for ; Tue, 30 Jun 2026 17:21:38 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840098; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hH9Pi+JleclISjNV+iqJw882tvCtJ2sELTWqaJx4nMM=; b=Nj6P5+1CpO8uVa2gBQsNE1XhY6evb8fA+9YenZykPxlb4KhU+4V8jJCvAaIPFTSdhGIDfK Wwlstu03M0DFDabFSpleDE2qbtRTnx3cKdiYZpu2nSvnrvvTTBvdudw0lTVVigVV+Io3zf MLTb/xXDhlb14pDk2RkfHIvs50T1g+eObmfDBcPfYfrr6OoEdrkcGzlYH7vDY5YDHLr2lX l3G9YiCT1OsZGtbMv8vBVEWL5/eigAzF45HMAKf2ICZvBe3qzK+ck1JW2qwPMES+ZaIaw9 LqPixE44ZHinP849L4NA+beB2BP98SzPiB5eyx1U54HPVScm72lIvr8vU/vK4w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840098; a=rsa-sha256; cv=none; b=fLOUbTSkRMP+gcMbzNKtXGF111ENn1U0LUwjA7P8cWZWa1hLwWhcKEvDAKC/eHSVshRa61 0/IKj/+53NvWijtaVkchVt9kf0eyxj/SigCPwFteoYxf3sl4F0nZDnNp6ZuWUGVYtUfDnL hYodgn+QEDmg8mUYxZjUh1uALPrWbQqOPRpNa0QoXe9eaPVVn5QoIvzFzrOta6vMYorni/ liJuhTaUjF/PVoUHQMkErVMjYdLnlhJOL07YzCKsG1jBOD8cQg7SHk4l/gLB3JdTr+ij6l weKl+YQY30pPXQwCy7jtUEz8hao2WoJIIsza0SK6FPJbJtjM/Jglup68pXc8Og== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840098; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hH9Pi+JleclISjNV+iqJw882tvCtJ2sELTWqaJx4nMM=; b=oI64kKC/SqsnwHrvsS6+bNR2wImwZay29S3MTEpQqcU9TGgHLpvlDu82aCeXMidop+dYBM s1P/vRzT8sV/kzVQO3O/5yKgfDy4d8ahk5NbJnNwfr2sElHlQiY44W96/MvKHwXFHHyFuq UcamLyIaEOfihk+Se7/zE++ruFrOinWv9ETQ2QytHgW3JUqrfpzNr0bYyP2mt3dxdQFkwX JQeb4bqc9SQi4GNaDQuX9g5UwpeTJ9yRVp4R1Jroi9Fqae0pWEttE+se8vLuLdJlvKT09T 2QlzVBbgHeBH67pEO8c2SZudQY37mdTvLY0LwQPCA3qkq9R/phVAKOQYMOKV9g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLV1kqFztYG for ; Tue, 30 Jun 2026 17:21:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44cfe by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:38 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Taylor R Campbell From: Mark Johnston Subject: git: d463196dac27 - releng/15.0 - iconv(3): Draft some automatic tests. List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: d463196dac2776865db6c2057f0709b68167fde0 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:38 +0000 Message-Id: <6a43fb22.44cfe.23320378@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=d463196dac2776865db6c2057f0709b68167fde0 commit d463196dac2776865db6c2057f0709b68167fde0 Author: Taylor R Campbell AuthorDate: 2026-06-22 19:44:55 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:58 +0000 iconv(3): Draft some automatic tests. Based on a report by Nick Wellnhofer. Approved by: so Security: FreeBSD-SA-26:49.iconv Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57948 --- contrib/netbsd-tests/lib/libc/locale/t_iconv.c | 355 +++++++++++++++++++++++++ lib/libc/tests/locale/Makefile | 1 + 2 files changed, 356 insertions(+) diff --git a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c new file mode 100644 index 000000000000..f25c061bb170 --- /dev/null +++ b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c @@ -0,0 +1,355 @@ +/* $NetBSD$ */ + +/*- + * Copyright (c) 2025 The NetBSD Foundation, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS + * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +/* + * iconv(3) + */ + +#include +__RCSID("$NetBSD: t_mbrtoc8.c,v 1.3 2024/08/20 17:43:09 riastradh Exp $"); + +#include +#include +#include +#include +#include +#include +#include + +#include "h_macros.h" + +static const struct sample { + const char *src_codeset; + size_t nsrc; + const char *src; + const char *dst_codeset; + size_t ndst; + const char *dst; + size_t ninval; + size_t ninval_rev; + const char *xfail; +#define IRREVERSIBLE ((size_t)-1) +} samples[] = { + [0] = { "us-ascii", 6, "hello", + "us-ascii", 6, "hello", + 0, 0, NULL }, + /* LATIN SMALL LETTER E WITH ACUTE ACCENT */ + [1] = { "iso-8859-1", 1, (const char[1]){0xe9}, + "UTF-8", 2, (const char[2]){0xc3,0xa9}, + 0, 0, NULL }, + /* LEFT CURLY BRACKET */ + [2] = { "UTF-8", 2, (const char[2]){0x00,0x7b}, + "ZW", 6, (const char[6]){0x00,0x7a,0x57,0x20,0x7b,0x0a}, + 0, 0, NULL }, + /* LATIN SMALL LETTER O, TILDE */ + [3] = { "UTF-8", 2, (const char[2]){0x4f,0x7e}, + "VIQR", 3, (const char[3]){0x4f,0x5c,0x7e}, + 0, 0, NULL }, + /* LEFT CURLY BRACKET (optionally encoded in UTF-7) */ + [4] = { "UTF-7", 1, (const char[1]){0x7b}, + "UTF-8", 1, (const char[1]){0x7b}, + 0, IRREVERSIBLE, NULL }, + [5] = { "UTF-7", 4, "+AHs-", + "UTF-8", 1, (const char[1]){0x7b}, + 0, 0, NULL }, + /* éclair */ + [6] = { "UTF-7", 10, "+AOk-clair", + "UTF-8", 7, (const char[7]){ + 0xc3,0xa9,0x63,0x6c,0x61,0x69,0x72, + }, + 0, 0, NULL }, + [7] = { "HZ", 55, /* RFC 1843, Sec. 4, Example 1 */ + "The next sentence is in GB.~{<:Ky2;S{#,NpJ)l6HK!#~}Bye.", + "UTF-8", 61, (const char[61]) { + 0x54,0x68,0x65,0x20, 0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e, 0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73, 0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0xe5, 0xb7,0xb1,0xe6,0x89, + 0x80,0xe4,0xb8,0x8d, 0xe6,0xac,0xb2,0xef, + 0xbc,0x8c,0xe5,0x8b, 0xbf,0xe6,0x96,0xbd, + 0xe6,0x96,0xbc,0xe4, 0xba,0xba,0xe3,0x80, + 0x82,0x42,0x79,0x65, 0x2e + }, + 0, 0, NULL }, + /* Same as above but with HZ8 instead of HZ. */ + [8] = { "HZ8", 55, (const char[55]) { + 0x54,0x68,0x65,0x20,0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e,0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73,0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0x7e,0x7b,0xbc,0xba,0xcb, + 0xf9,0xb2,0xbb,0xd3,0xfb,0xa3,0xac,0xce, + 0xf0,0xca,0xa9,0xec,0xb6,0xc8,0xcb,0xa1, + 0xa3,0x7e,0x7d,0x42,0x79,0x65,0x2e + }, + "UTF-8", 61, (const char[61]) { + 0x54,0x68,0x65,0x20, 0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e, 0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73, 0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0xe5, 0xb7,0xb1,0xe6,0x89, + 0x80,0xe4,0xb8,0x8d, 0xe6,0xac,0xb2,0xef, + 0xbc,0x8c,0xe5,0x8b, 0xbf,0xe6,0x96,0xbd, + 0xe6,0x96,0xbc,0xe4, 0xba,0xba,0xe3,0x80, + 0x82,0x42,0x79,0x65, 0x2e + }, + 0, 0, NULL }, +}; + +#ifdef MIN +#undef MIN +#endif +#define MIN(x, y) ((x) < (y) ? (x) : (y)) + +static void +test_sample_bounded(const char *title, const struct sample *S, + size_t nsrc, size_t ndst) +{ + char inbuf[4096], inguard = arc4random(); + char outbuf[4096], outguard = arc4random(); + iconv_t C; + char *src0, *src, *dst0, *dst; + size_t srcleft0, srcleft, dstleft0, dstleft; + size_t ninval; + int error; + + ATF_REQUIRE_MSG(S->nsrc < sizeof(inbuf) - 2, "[%s]", title); + ATF_REQUIRE_MSG(S->ndst < sizeof(outbuf) - 2, "[%s]", title); + + memset(inbuf, inguard, sizeof(inbuf)); + memset(outbuf, outguard, sizeof(outbuf)); + src = src0 = inbuf + 1; + memcpy(src, S->src, nsrc); + dst = dst0 = outbuf + 1; + srcleft = srcleft0 = nsrc; + dstleft = dstleft0 = ndst; + + C = iconv_open(S->dst_codeset, S->src_codeset); + if (C == (iconv_t)-1) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv_open: %s (%d)", title, + strerror(error), error); + return; + } + + ninval = iconv(C, &src, &srcleft, &dst, &dstleft); + if (ninval == (size_t)-1) { + error = errno; + /* + * Incomplete input manifests as EINVAL -- ignore that, + * unless we're trying the full-size input. + * + * Truncated output manifests as E2BIG -- ignore that, + * unless we're trying the full-size output. + */ + if ((error != EINVAL || nsrc == S->nsrc) && + (error != E2BIG || ndst == S->ndst)) { + atf_tc_fail_nonfatal("[%s] iconv: %s (%d)", + title, strerror(error), error); + goto next; + } + } else if (ninval != S->ninval) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv:" + " %zu invalid, expected %zu", + title, ninval, S->ninval); + } + + ATF_CHECK_MSG(src0 <= src && src <= src0 + srcleft0, "[%s] iconv:" + " src went from %p to %p, expected [%p,%p]", + title, src0, src, src0, src0 + srcleft0); + ATF_CHECK_MSG(srcleft <= srcleft0, "[%s] iconv:" + " srcleft went from %zu to %zu", + title, srcleft0, srcleft); + ATF_CHECK_MSG(dst0 <= dst && dst <= dst0 + dstleft0, "[%s] iconv:" + " dst went from %p to %p, expected [%p,%p]", + title, dst0, dst, dst0, dst0 + dstleft0); + ATF_CHECK_MSG(dstleft <= dstleft0, "[%s] iconv:" + " dstleft went from %zu to %zu", + title, dstleft0, dstleft); + if (memcmp(dst0, S->dst, MIN(ndst, dstleft0 - dstleft)) != 0) { + size_t k; + + atf_tc_fail_nonfatal("[%s] iconv: bad conv", title); + fprintf(stderr, "[%s] input: ", title); + for (k = 0; k < nsrc; k++) + fprintf(stderr, " %02x", (unsigned char)S->src[k]); + fprintf(stderr, "\n"); + fprintf(stderr, "[%s] expected: ", title); + for (k = 0; k < ndst; k++) + fprintf(stderr, " %02x", (unsigned char)S->dst[k]); + fprintf(stderr, "\n"); + fprintf(stderr, "[%s] got: ", title); + for (k = 0; k < ndst; k++) + fprintf(stderr, " %02x", (unsigned char)dst0[k]); + fprintf(stderr, "\n"); + } + +next: if (dst0[-1] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran before buffer:" + " dst0[-1] = 0x%02x, expected 0x%02x", + title, dst0[-1], outguard); + } + if (dst0[ndst] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran after buffer:" + " dst0[ndst=%zu] = 0x%02x, expected 0x%02x", + title, ndst, dst0[ndst], outguard); + } + if (dst[0] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran past updated dst:" + " dst[0] = 0x%02x, expected 0x%02x", + title, dst[0], outguard); + } + + if (iconv_close(C) == -1) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv_close: %s (%d)", + title, strerror(error), error); + } +} + +static void +test_sample(const char *title, const struct sample *S) +{ + char buf[128]; + size_t nsrc, ndst; + + fprintf(stderr, "test %s from %s to %s\n", + title, S->src_codeset, S->dst_codeset); + + for (nsrc = 0; nsrc <= S->nsrc; nsrc++) { + snprintf(buf, sizeof(buf), "%s %zu/%zu", title, nsrc, S->ndst); + test_sample_bounded(buf, S, nsrc, S->ndst); + } + + for (ndst = 0; ndst <= S->ndst; ndst++) { + snprintf(buf, sizeof(buf), "%s %zu/%zu", title, S->nsrc, ndst); + test_sample_bounded(buf, S, S->nsrc, ndst); + } +} + +ATF_TC(iconv_samples); +ATF_TC_HEAD(iconv_samples, tc) +{ + + atf_tc_set_md_var(tc, "descr", "Test iconv on various fixed samples"); +} +ATF_TC_BODY(iconv_samples, tc) +{ + unsigned i; + + for (i = 0; i < __arraycount(samples); i++) { + const struct sample *S = &samples[i]; + struct sample reverse = { + .src_codeset = S->dst_codeset, + .dst_codeset = S->src_codeset, + .nsrc = S->ndst, + .src = S->dst, + .ndst = S->nsrc, + .dst = S->src, + .ninval = S->ninval_rev, + }; + char buf[128]; + + if (S->xfail) + atf_tc_expect_fail("%s", S->xfail); + + snprintf(buf, sizeof(buf), "case %u: %s to %s", i, + S->src_codeset, S->dst_codeset); + test_sample(buf, S); + if (S->ninval_rev != IRREVERSIBLE) { + snprintf(buf, sizeof(buf), "case %u: %s to %s", i, + S->dst_codeset, S->src_codeset); + test_sample(buf, &reverse); + } + + if (S->xfail) + atf_tc_expect_pass(); + } +} + +ATF_TC(iconv_pr59019_hz8); +ATF_TC_HEAD(iconv_pr59019_hz8, tc) +{ + + atf_tc_set_md_var(tc, "descr", "Truncated HZ8 input from PR 59019"); +} +ATF_TC_BODY(iconv_pr59019_hz8, tc) +{ + const char title[] = "iconv_pr59019_hz8"; + char in[4] = "\x7e\x7b\x7e\x7e"; /* ~{~~ */ + char out[4096], guard = arc4random(); + char *src0, *src, *dst0, *dst; + size_t srcleft0, srcleft, dstleft0, dstleft; + iconv_t C; + size_t ninval; + + memset(out, guard, sizeof(out)); + + REQUIRE_LIBC((C = iconv_open(/*to*/"UTF-8", /*from*/"HZ8")), + (iconv_t)-1); + + src = src0 = in; + srcleft = srcleft0 = sizeof(in); + dst = dst0 = out + 1; + dstleft = dstleft0 = sizeof(out) - 2; + + ninval = iconv(C, &src, &srcleft, &dst, &dstleft); + + /* + * XXX Not actually 100% sure this is the correct result -- I + * can't find a reference for the HZ8 encoding. + */ + ATF_CHECK_EQ_MSG(ninval, (size_t)-1, "[%s] iconv: ninval=%zu", title, + ninval); + + ATF_CHECK_MSG(src0 <= src && src <= src0 + srcleft0, "[%s] iconv:" + " src went from %p to %p, expected [%p,%p)", + title, src0, src, src0, src0 + srcleft0); + ATF_CHECK_MSG(srcleft <= srcleft0, "[%s] iconv:" + " srcleft went from %zu to %zu", + title, srcleft0, srcleft); + ATF_CHECK_MSG(dst0 <= dst && dst <= dst0 + dstleft0, "[%s] iconv:" + " dst went from %p to %p, expected [%p,%p)", + title, dst0, dst, dst0, dst0 + dstleft0); + ATF_CHECK_MSG(dstleft <= dstleft0, "[%s] iconv:" + " dstleft went from %zu to %zu", + title, dstleft0, dstleft); + + ATF_CHECK_EQ(dst0[-1], guard); + ATF_CHECK_EQ(dst0[dstleft0], guard); + + RL(iconv_close(C)); +} + +ATF_TP_ADD_TCS(tp) +{ + + ATF_TP_ADD_TC(tp, iconv_pr59019_hz8); + ATF_TP_ADD_TC(tp, iconv_samples); + + return atf_no_error(); +} diff --git a/lib/libc/tests/locale/Makefile b/lib/libc/tests/locale/Makefile index 70905cc58d24..2f9a08f65086 100644 --- a/lib/libc/tests/locale/Makefile +++ b/lib/libc/tests/locale/Makefile @@ -21,6 +21,7 @@ ATF_TESTS_C+= wctomb_2_test # Note: io_test requires zh_TW.Big5 locale (see ^/head@r315568) #NETBSD_ATF_TESTS_C= io_test +NETBSD_ATF_TESTS_C+= iconv_test NETBSD_ATF_TESTS_C+= mbrtowc_test NETBSD_ATF_TESTS_C+= mbstowcs_test NETBSD_ATF_TESTS_C+= mbsnrtowcs_test From nobody Tue Jun 30 17:21:39 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLW5mhtz6jYng for ; Tue, 30 Jun 2026 17:21:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLW3Qwdz3s5b for ; Tue, 30 Jun 2026 17:21:39 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840099; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=EzyONbmW1bM+26ZNGEJS5Ce7lLZHtOGRYE+p3/uYni0=; b=GNV7PgJl743IOPY3VANcG2EbvJa3WfDoy4xhLs5NxyGUWKGvBXhBLWQuSoQtVBpoZcoQ8G YrRq+ux1n8TXq8YchTD2qbZkArmQl9BZQG4k/AGygZrF6ASw8N2RCABDOO70+JxgW8VnXP 0dGWmn7GfyfulQ5SRybcMJ+bo5wuISPlK1FX6pyWWmlyKGh1uUu2i19eI+HPvbxetG7ilL 4mHKQ0dtUsMvYXbc3VsobkpRk2HhfAxSz23N4PC8cSjoTWj8SESobZI1E+l8oSsWqV+Vn7 miqX/167qPs6OE0bNyodzn7lTFNVdBvpMSxFazlhg59VuqBNAXyGjEZH55CC7g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840099; a=rsa-sha256; cv=none; b=Q7hWSuJkJaXq7oYhaqy4niDMt1qiAApU5k5WMWczLOJJ15Yr/sWMrTHSTcqw3SSfRi2VOR 3KBQjmj8dSY+B/xYnLg/Gp6UObcZxl+f7DwlEmFSsOVcu20rDJQYnp/1SzsHNcnQnuOEek +k+bB8oH2oWGTfIHjunYD22+hU2iFugH0wYLMkv7CREkRXADG53AnOBiatTRY0j6pOF/v9 GJo9sjoaidIlGcGfKyR3GHQn+Ic1sx/rLnJebwrAeF1vo4bhRao/xKYzAfL9zBxNa82ts2 7GpH0Gk0wNxztiS5BwF0fGpMIcvK3C+lEn4pgobn2Be/rYDD/5IL2ZZ3KZc3SQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840099; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=EzyONbmW1bM+26ZNGEJS5Ce7lLZHtOGRYE+p3/uYni0=; b=vsvaYzrbP89VTM7aQqaCa0W6wHW+PBla3mHfwUW4Uf/SlyMc3owbxo37qDzW1DwA//ld84 Wbu7PX7MLWWVoLJcbSQ0ywErCXCF0GisnfMTv62gPV2QxcOio4J7KqQreAcMYenXxMfW91 /xoiBxZNtDpWcqw1ByThhZ6wo3BYdvCWTDyYq5QQG2P6xGNXHSUEjaPRqk4QaUgrv7d4K4 YCyhEk5FkW8a6Y4frxngqadOUKghQcDW3+1mikZ3bVQDBsoYOQjKjSEvTmtmb7OTJF9SfF rbMBpTRK2Po/JbmyIe/Sq1oUay90C39fXaD0vAlx/ui8QYK5VuTLRnSPeQrMeg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLW2WsrztqQ for ; Tue, 30 Jun 2026 17:21:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 446b6 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:39 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: fc6e7313929d - releng/15.0 - iconv: Fix a buffer overflow in the HZ encoding List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: fc6e7313929da2187c2e7662df03022c321e5320 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:39 +0000 Message-Id: <6a43fb23.446b6.6d4d7eae@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=fc6e7313929da2187c2e7662df03022c321e5320 commit fc6e7313929da2187c2e7662df03022c321e5320 Author: Mark Johnston AuthorDate: 2026-06-23 16:05:31 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:58 +0000 iconv: Fix a buffer overflow in the HZ encoding wcrtomb may store up to 2 2-byte escape sequences to the state buffer in addition to the character itself. In the worst case, a 3-byte heap overflow is possible. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57949 --- lib/libiconv_modules/HZ/citrus_hz.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index db738b8f812e..e16ab3a8e34c 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -132,7 +132,7 @@ typedef struct { typedef struct { escape_t *inuse; int chlen; - char ch[ROWCOL_MAX]; + char ch[4 + ROWCOL_MAX]; } _HZState; #define _CEI_TO_EI(_cei_) (&(_cei_)->ei) From nobody Tue Jun 30 17:21:40 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLY0PkQz6jZ0c for ; Tue, 30 Jun 2026 17:21:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLX4LsMz3sFD for ; Tue, 30 Jun 2026 17:21:40 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840100; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=U/Ujg62ze3gZcVbHYIr5sq2TGVV7H2MEOhbNm6AgLTI=; b=Sug5MvuVl1n5tB+1TJFuXb3wQBn+ZCO71F1/RwX+Vcsy0VpXbhI28qGrOvs77ommOk2Emg oeOutITdilzsHG9s6+p01+EvUGehDgjyCcp1/PqOZXQuApWb2i06iWRNfOAHoiBGV8ntVN M8QE91FrmZqg7XJNRFwb/WMzUxCaBQNO5Jtk0AS/ueEevji6MI5OWEujBcfD3Jaas4c6Dg 0HujUMu0NFaXoNovYk2Kp4MI5bsVyxlqjL9utpgEQPnQgKu3GyU46RzIDz3OHZ1yjO4Cfb 6Y2ZfDsVbM8RoJNdzQtgnqZ3jPBU8RZqFeuVlNInfZGhQtbeP2qod48z2OntJw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840100; a=rsa-sha256; cv=none; b=u2Lwho0dSOgRatFeVXwxsiWaY+yVpAe6IofzhcAmShv0jH/VF3OquGH9jjqvsSQrU3eGWe bi/Y7IWpSHn3MsC10oAx2Fvw472gOQaDKD98FRANjxwVWqCEkL+t13nVIK3j6MC7jlEOMQ 4QDNUkBXOO1WHF4vjwMGE6Zzkpj0tczW+fSmTXwsHVjZ1Pb/KdcKqZVrTTuLDjI9PUxQp7 nU11iXqaJOutk1moI+nBUF2J9rutLPq9vgjMrAluM6PKeF3SbV2y2rUk8hnWm7FEiK+pE1 U1T5BeN+zi2EYtjR6LyOiwnprBfq1069ac2eNYVYiD7YP32IpRyuqt3YFD9MRg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840100; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=U/Ujg62ze3gZcVbHYIr5sq2TGVV7H2MEOhbNm6AgLTI=; b=mQFPtburgP8b4gqSBuFXXcGMBt+EQiYH0ZfN1/150ve+wRCKUBgSkQfWolYK6XvvxPkvRS zEdUjRh56mn4hQxm7QFEznUlg3GmKh6DY9i4zSre/P+oQ8fw0cFt3oXPgmJLUxWM81kF5X k8Ylmc8Vi0M3SDSiER7zk7Ti2Om6ls2f3oe9ESADkHzandN1lfMhJvPtY5PRFMtK2PVudv Uur6XA69c6lXO5ck8/dtBwZ+dIvUGLzUclUhcJ3b3TuukDOBr9h04PeG0kmTG0Y7/8651B KVQ/aI5YlOKHXO1SfAETxSe1Ms6p/JSfX/Dx1OWF/IFkeJ2juQe6J6CM3Ru3rQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLX3FBGztQ9 for ; Tue, 30 Jun 2026 17:21:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45e95 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:40 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 2ac85d131d91 - releng/15.0 - iconv: Fix a stack buffer overflow in _ISO2022_sputwchar() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 2ac85d131d91a5b638a9385661337e10c1223689 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:40 +0000 Message-Id: <6a43fb24.45e95.4d6c9592@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=2ac85d131d91a5b638a9385661337e10c1223689 commit 2ac85d131d91a5b638a9385661337e10c1223689 Author: Mark Johnston AuthorDate: 2026-06-23 17:45:28 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:58 +0000 iconv: Fix a stack buffer overflow in _ISO2022_sputwchar() In the ISO2022-CN encoding, characters may require at least seven bytes, and MB_LEN_MAX==6 is insufficient. From code inspection, _ISO2022_sputwchar() can emit 10 bytes in the worst case, so use that to size buffers. Add a regression test. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58082 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57950 --- contrib/netbsd-tests/lib/libc/locale/t_iconv.c | 20 ++++++++++++++++++++ lib/libiconv_modules/ISO2022/citrus_iso2022.c | 8 ++++---- 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c index f25c061bb170..199774769827 100644 --- a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c +++ b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c @@ -117,6 +117,26 @@ static const struct sample { 0x82,0x42,0x79,0x65, 0x2e }, 0, 0, NULL }, + /* 馬 from CNS 11643-1 */ + [9] = { "UTF-8", 3, (const char[3]){0xe9,0xa6,0xac}, + "ISO-2022-CN", 8, + (const char[8]){0x1b,0x24,0x29,0x47,0x0e,0x58,0x6b,0x0f}, + 0, 0, NULL }, + /* 馬毦 shifting from CNS 11643-1 to CNS 11643-2 */ + [10] = { "UTF-8", 6, (const char[6]){0xe9,0xa6,0xac,0xe6,0xaf,0xa6}, + "ISO-2022-CN", 16, + (const char[16]){ + /* ESC $ ) G (shift G1 to CNS 11643 plane 1) */ + 0x1b,0x24,0x29,0x47, + 0x0e, /* GL is G1 from now on */ + 0x58,0x6b, /* 馬 */ + /* ESC $ * H (shift G2 to CNS 11643 plane 2) */ + 0x1b,0x24,0x2a,0x48, + 0x1b,0x4e, /* GL is G2 for next char */ + 0x30,0x21, /* 毦 */ + 0x0f, /* GL is G0 from now on */ + }, + 0, 0, "PR lib/59019: various iconv issues ([case 10: ISO-2022-CN to UTF-8 14/6] iconv: Illegal byte sequence (85))" }, }; #ifdef MIN diff --git a/lib/libiconv_modules/ISO2022/citrus_iso2022.c b/lib/libiconv_modules/ISO2022/citrus_iso2022.c index 126d38316df4..a28dc0be0022 100644 --- a/lib/libiconv_modules/ISO2022/citrus_iso2022.c +++ b/lib/libiconv_modules/ISO2022/citrus_iso2022.c @@ -129,7 +129,7 @@ typedef struct { #define _FUNCNAME(m) _citrus_ISO2022_##m #define _ENCODING_INFO _ISO2022EncodingInfo #define _ENCODING_STATE _ISO2022State -#define _ENCODING_MB_CUR_MAX(_ei_) MB_LEN_MAX +#define _ENCODING_MB_CUR_MAX(_ei_) 10 #define _ENCODING_IS_STATE_DEPENDENT 1 #define _STATE_NEEDS_EXPLICIT_INIT(_ps_) \ (!((_ps_)->flags & _ISO2022STATE_FLAG_INITIALIZED)) @@ -1012,7 +1012,7 @@ _ISO2022_sputwchar(_ISO2022EncodingInfo * __restrict ei, wchar_t wc, { _ISO2022Charset cs; char *p; - char tmp[MB_LEN_MAX]; + char tmp[10]; size_t len; int bit8, i = 0, target; unsigned char mask; @@ -1177,7 +1177,7 @@ _citrus_ISO2022_put_state_reset(_ISO2022EncodingInfo * __restrict ei, size_t * __restrict nresult) { char *result; - char buf[MB_LEN_MAX]; + char buf[10]; size_t len; int ret; @@ -1206,7 +1206,7 @@ _citrus_ISO2022_wcrtomb_priv(_ISO2022EncodingInfo * __restrict ei, _ISO2022State * __restrict psenc, size_t * __restrict nresult) { char *result; - char buf[MB_LEN_MAX]; + char buf[10]; size_t len; int ret; From nobody Tue Jun 30 17:21:41 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLZ2g8gz6jYnp for ; Tue, 30 Jun 2026 17:21:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLY4xvVz3sFQ for ; Tue, 30 Jun 2026 17:21:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840101; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FnKthVXSvdZ4AlluUlqxJ/1k6mHZrWbnaL7rHY8dQ9U=; b=a5TwXOL9caM0S4EHJhexC++YKBY9QdbRF1OJRgaa38EQPfpZ1HWhimDES5Vzi59zEEwglZ IV39cPPMS4IY/XIRwB9NGi5c5p9NBjqLHTSO42EmRMUL41ow7YnJGT3m7oz0d06havzaeK /k5TecIUTS4B3lKL3KVW7WqIGWsrklmfvQyR6bFf0/cuEkpkdg1riRc7muvr2VGW7vufwG dg/W13ANFLu6FsZ4EzSWlHx4BeXS8rTFd1bPbyu8TIoDgRNTYSaW8wDUpTWY69WzBM8bk0 lkpwkBvV/M5jfvM4sehgZsQzyN3Oy+pvqbKX5ezN4E17bHyg/oLyETLjybMgKQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840101; a=rsa-sha256; cv=none; b=tZkSdumILwlMREICE116BMQUHQOICFALJ+GkfBLptSN+Rke3fwcM+N/63dUOOmZyzoW2NM 0DAHJMiSUAKMxH7y02ODfhktDfkmzRXmYfMovtvNoorqTTk0uF9MoJyMYhXGxry4ASFIJI jqwMhJTvjtnQftCcWbu6cnVGC40ALZfbVyExXImrlvRc+QjusVLA6X8Beb54yeXq9lx8iO LUPWZJxSJtYHZuEXHwVk19HC4yXAIk6K7EBRq/DEiMfHB3EamRbdeGcqv3PYHNgywnPia+ 8XoAxJe/vmD/esxIzN37LNpYFEkMO20hOvkYiND+MkMXfMmhjpy8Vm7J55YaTA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840101; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FnKthVXSvdZ4AlluUlqxJ/1k6mHZrWbnaL7rHY8dQ9U=; b=qh8V6KDNNBsOa/oGyaM3LY/l5yQ1ytUbx22KN0mjcLxJQbHk8IePPQ+anG4ZeZIMhtYbWb najhPb0Bujt5h8hd2jzUp+u8XlGLJk0creedIopp4uJE9HKeOHOVYjoRrPzNf2Mw5H+DTU dMnhfKCuYyaoxMxBFRIBJ8vQNt5YCnym3In1GABYsYB6Od2v9sFM4Ji4EHR1bVL9+B0LMh fUTY1qPX6PGahPifW8UvnFJmrcTs1H4U2xudsxrOLPSu/9+59X6aXhzxdMkWxLvtgOA69O 6FTCLBp8PESKRyRiMkB2aOZCGlUHYtmivEJQWFllfkmCgOBgG1cTPzxqz+FFyA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLY42bMztSv for ; Tue, 30 Jun 2026 17:21:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44f75 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:41 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: f05aebcc1452 - releng/15.0 - Add UPDATING entries and bump version List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: f05aebcc1452fe5effb2fe4b08709b74c03aa15b Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:41 +0000 Message-Id: <6a43fb25.44f75.6e10e7aa@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=f05aebcc1452fe5effb2fe4b08709b74c03aa15b commit f05aebcc1452fe5effb2fe4b08709b74c03aa15b Author: Mark Johnston AuthorDate: 2026-06-26 21:44:58 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:58 +0000 Add UPDATING entries and bump version Approved by: so --- UPDATING | 45 +++++++++++++++++++++++++++++++++++++++++++++ sys/conf/newvers.sh | 2 +- 2 files changed, 46 insertions(+), 1 deletion(-) diff --git a/UPDATING b/UPDATING index fa9cc98d6227..87b955da9408 100644 --- a/UPDATING +++ b/UPDATING @@ -12,6 +12,51 @@ Items affecting the ports and packages system can be found in /usr/ports/UPDATING. Please read that file before updating system packages and/or ports. +20260630: + 15.0-RELEASE-p11 EN-26:16.arm64 + EN-26:17.rpcsec_tls + SA-26:37.vm + SA-26:38.jail + SA-26:39.execve + SA-26:40.zfs + SA-26:41.libalias + SA-26:42.unlinkat + SA-26:43.tcp + SA-26:44.posixshm + SA-26:45.audit + SA-26:46.ktls + SA-26:47.linux + SA-26:48.compat32 + SA-26:49.iconv + + Socket refcount underflow in the NFS server. [EN-26:17.rpcsec_tls] + + Use-after-free in device pager page list. [SA-26:37.vm] + + Jail reference count underflow. [SA-26:38.jail] + + Local privilege escalation via execve(2) TOCTOU race. [SA-26:39.execve] + + Multiple vulnerabilities in OpenZFS. [SA-26:40.zfs] + + Buffer overflow in libalias RTSP handler. [SA-26:41.libalias] + + unlinkat(2) ignores AT_RESOLVE_BENEATH flag. [SA-26:42.unlinkat] + + Use-after-free in TCP RACK stack option handler. [SA-26:43.tcp] + + Multiple vulnerabilities in POSIX largepage objects. [SA-26:44.posixshm] + + Incorrect audit records for ptrace(2) syscall requests. [SA-26:45.audit] + + Remote DOS via uninitialized memory access in KTLS receive. [SA-26:46.ktls] + + Kernel stack disclosure in Linux compatibility layer. [SA-26:47.linux] + + Kernel stack disclosure in 32-bit compatibility support. [SA-26:48.compat32] + + Multiple vulnerabilities in iconv(3). [SA-26:49.iconv] + 20260609: 15.0-RELEASE-p10 EN-26:14.syslogd EN-26:15.openssl diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index a68e1021ff1b..1a172a5a577d 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -51,7 +51,7 @@ TYPE="FreeBSD" REVISION="15.0" -BRANCH="RELEASE-p10" +BRANCH="RELEASE-p11" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi From nobody Tue Jun 30 17:21:50 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLk74Ppz6jYfr for ; Tue, 30 Jun 2026 17:21:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLk66FQz3sXD for ; Tue, 30 Jun 2026 17:21:50 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840110; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uBTlXrM9MaRTmgcBNjQ3vTBmg3+/U/oa5U1bkOrPM/g=; b=dRyJSyEWKiQ/uazq/BMldcmvpWlGVOoT5/qEb98zpNVRXQOhSKTePl/6yY+fvAL/OIzfLZ 6uPU9yukZ/qaau/lScafKWmfsF/WFg4jnueY90YNe5zL+thGQg7UlT6dnWSFz0XvWNuW9L bNV1pchNGojvZMd8GogN9z4+vcf9zXNqR/1Jhlfaik4rRpD4Mh/AxXdl5xMYqoo6DXs7DN f6cWo4QMJJluUjCBaHaAHZrJOL0OIIPxkZD3UJMAcSSVBOsdrJy/XqJNibJyDheCHhbH64 tYUH0iI4T8ZBrn4G0g8mGOiMfBkpTtA7sjZIRzKFgLqjKjGPHi7ejNAXSMLq2A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840110; a=rsa-sha256; cv=none; b=NZeaPOqV1LcaTuDaKxNLptdlLJX+RSJ8qQPrTgiZ4TuCbfrllFcFffTIeZMp2liP4va1Qm rs6t9UXk6pCZVI6tUH3yK+X5XjZmBH+xHbINr79rDflAWQWCHLuggY7lW7vd8AeEm0pR/C NrRCEQP/33GZlYF4XTBSZRk4v3LYqm1y5j2Q24FFXvwN2mAsVO/10qtDGE8rORy0YPrsjC k1TNL5RcIt2lsGPQRZXheV4jRZYN01/t9X4IiyX0nbkJZRiIbcXFbWrS7uWvhjrVbs6x2q aVzJjprSle6huXIi5k4jg1HPxDsqd1RfRFDsTDOdg5XHoq9m03Q5i2VaFPERTQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840110; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uBTlXrM9MaRTmgcBNjQ3vTBmg3+/U/oa5U1bkOrPM/g=; b=AkrIOZtl5govuPAES9Knd5n3mMBc/meTmBvg6G9CjGT1RkvI4v5W9LWOPaKqiDJ1VaExGF GIk2t6ady5wZfx5468iaHdKnLGcEWhd1T88SVGVDvygJH2BDnSTUI6rPF7DPwQOgMDZsfh OxafBQG5V+scDy078TVjRLIlIs9zTrdDBvE1IVlCBZjcZ6eySrjhxKRJgX32nJBAThvYps bwGxAWu5SM4cNhobJ8WEMOz1EGcs7it3OCqADssAl+XY76fZHpoXEi8WM8OVslQveQVlyz IONs+MjXjdGZMSqSjBLoqaEYgcsp1Pd6C0B3fJQge9+SDLvTyyEs5Zo6xOVWww== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLk57GrztqX for ; Tue, 30 Jun 2026 17:21:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45a29 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:50 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Piotr Kubaj From: Mark Johnston Subject: git: a2235baa622b - releng/15.1 - sys/arm64: fix return values of freebsd32_{set,swap}context() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: a2235baa622badb7d4e2078cb3447fe77204e948 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:50 +0000 Message-Id: <6a43fb2e.45a29.74d9d25@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=a2235baa622badb7d4e2078cb3447fe77204e948 commit a2235baa622badb7d4e2078cb3447fe77204e948 Author: Piotr Kubaj AuthorDate: 2026-06-11 11:41:29 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:29 +0000 sys/arm64: fix return values of freebsd32_{set,swap}context() This patch aligns the return values of freebsd32_{set,swap}context() with their counterparts on amd64 and powerpc64, fixing the setcontext() and swapcontext() calls in armv7 applications running on aarch64. In particular, this fixes random crashes in armv7 Ruby applications running on aarch64 hosts. Approved by: so Security: FreeBSD-EN-26:16.arm64 Tested by: fuz MFC after: 1 week (cherry picked from commit 92ae21e8a155734f73589b7ef9fa19a6bb6d042f) (cherry picked from commit 964215aa1347c9da457ecaced0521c29eaaf7b21) --- sys/arm64/arm64/freebsd32_machdep.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/arm64/arm64/freebsd32_machdep.c b/sys/arm64/arm64/freebsd32_machdep.c index d0218dc1dc80..3c7040bf5bb4 100644 --- a/sys/arm64/arm64/freebsd32_machdep.c +++ b/sys/arm64/arm64/freebsd32_machdep.c @@ -293,7 +293,7 @@ freebsd32_setcontext(struct thread *td, struct freebsd32_setcontext_args *uap) NULL, 0); } } - return (ret); + return (ret == 0 ? EJUSTRETURN : ret); } int @@ -341,7 +341,7 @@ freebsd32_swapcontext(struct thread *td, struct freebsd32_swapcontext_args *uap) } } } - return (ret); + return (ret == 0 ? EJUSTRETURN : ret); } void From nobody Tue Jun 30 17:21:52 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLn4zyBz6jYcY for ; Tue, 30 Jun 2026 17:21:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLn0jP2z3sRb for ; Tue, 30 Jun 2026 17:21:53 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840113; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DSXQbMn6HWn9VWBwVdng/+enIiVwVVnVkBe7v5NzGno=; b=LB1AlBLIKeXYTF0ToUa5r291CLGdtMAV+aYLtCgV5SsILISFBYAG6CYbiAAwKHFAGaSU8C gJlsH5NkhZsk50vwjISZHAYKLsVaHGjz543u11TJMcxrjFtBTPBo7xWZxTAoEiqW8CayOC FsP1yZFpinGSvgDWCQb0YCUA81Qhf76CsEyCBI4eWhQ8vtbbqOXV0oiu9xIof+HSN8x6vU RIe7LEpg1NkO7qkciwjxriDBooMMdG8fI4tftmEykNctnku3QqUcQ6+4lKCNVfCVziheHA I6DqiIV1FVNUZuebhBkcAmSESs3qOwrIb274hbvRo9i+yHrEwQHS7RviOsgPzQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840113; a=rsa-sha256; cv=none; b=CD5dk5/wo8SGk2xTF2CAk/tDLCpFSqW9EFfUrdzTSCqA5NlOmhlSbUmq3XFA43xoMLlNvj EQFKd3haln2URtx+WbGk0aYVzcyskmXAY3KdjhX+oI/eSa5vo976tZIn8Aivnx2N38bC2L WVB+2N/IR8kewVTeJz8YHjJF0u2kz4vZ3RCw7XKx20dSShkxE9A7LCX+IGSg8qACg+75vz c/OEesqM7I+ON3QRdlohxImd2wUbz3BXuLoAftci9/tEp6tbCF/uHVxkRAfyZFIZptcNZM gTZPdFsLbJkRf8iGPJNYuLEyA4O4t/+FhcfF7LHuJWcNt/XwZ90shBQqxto8nw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840113; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DSXQbMn6HWn9VWBwVdng/+enIiVwVVnVkBe7v5NzGno=; b=i4xP57u/uda3L5+4rScGKkjCnJk6AIX7R7JVulmEbSLjJWm6lC3wYm3gzQUkKxiLFUbob3 pocs/gJfklP5XqdebaZoeJ6xVwp5GEXSMs+l/tKyiB0Q/cPpNmTNw8RhZltX2GR6VhZ6Sc 8QI7ZGZlzs1iEtL8MZiqJ99Tp1UbWopPRFMLnZhfvGrg/nfoVRPQtXoWS7ipBREXemdw/3 NCwUDlOHLG1SY7rYoBgta0JDQMYeyOs5RBI7n0fhKmTMuZ/jdYEWeNhwQyzDfJs8eHaPzu CrSQ0l022wyn9u992FFo9muclkrj/SfMzowyL39gVgXtD1dxi94NXAJ+oiQvsg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLm6gGRztnX for ; Tue, 30 Jun 2026 17:21:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45e16 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:52 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 958de92ab2dc - releng/15.1 - device_pager: Avoid double-insertion of pages into the pager list List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 958de92ab2dc00498681d0ed8b11b2956c317c6d Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:52 +0000 Message-Id: <6a43fb30.45e16.7b790645@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=958de92ab2dc00498681d0ed8b11b2956c317c6d commit 958de92ab2dc00498681d0ed8b11b2956c317c6d Author: Mark Johnston AuthorDate: 2026-06-22 14:40:22 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:40 +0000 device_pager: Avoid double-insertion of pages into the pager list Unmanaged device pager objects maintain a linked list of pages that were returned from the fault handler. Initially, such pages are valid, but msync(MS_INVALIDATE) can mark them invalid (and clean). They are not removed from page tables (since they are unmanaged), but a subsequent mlock() call can trigger a page fault that is handled by the pager. dev_pager_getpages() then re-inserts the page into the linked list even though it's already present there. This patch fixes the problem by removing the linked list. OBJ_PG_DTOR is set, so vm_object_terminate_pages() does nothing, and dev_pager_dealloc() instead handles cleanup of the object. Add a regression test case which triggers a queue.h assertion failure in unpatched kernels. Note, in stable branches we should avoid changing the layout of struct vm_object. Approved by: so Security: FreeBSD-SA-26:37.vm Security: CVE-2026-49418 Reported by: slidybat Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57743 --- sys/vm/device_pager.c | 36 ++++++++++++++++++++---------------- sys/vm/vm_object.h | 2 +- sys/vm/vm_page.c | 6 ++++-- tests/sys/vm/mmap_test.c | 30 ++++++++++++++++++++++++++++++ 4 files changed, 55 insertions(+), 19 deletions(-) diff --git a/sys/vm/device_pager.c b/sys/vm/device_pager.c index 221969307ba4..9277d6255418 100644 --- a/sys/vm/device_pager.c +++ b/sys/vm/device_pager.c @@ -213,7 +213,8 @@ again: object1 = NULL; object->handle = handle; object->un_pager.devp.ops = ops; - TAILQ_INIT(&object->un_pager.devp.devp_pglist); + if (object->type == OBJT_DEVICE) + vm_object_set_flag(object, OBJ_PG_DTOR); TAILQ_INSERT_TAIL(&dev_pager_object_list, object, pager_object_list); mtx_unlock(&dev_pager_mtx); @@ -325,15 +326,12 @@ dev_pager_free_page(vm_object_t object, vm_page_t m) KASSERT((object->type == OBJT_DEVICE && (m->oflags & VPO_UNMANAGED) != 0), ("Managed device or page obj %p m %p", object, m)); - TAILQ_REMOVE(&object->un_pager.devp.devp_pglist, m, plinks.q); vm_page_putfake(m); } static void dev_pager_dealloc(vm_object_t object) { - vm_page_t m; - VM_OBJECT_WUNLOCK(object); object->un_pager.devp.ops->cdev_pg_dtor(object->un_pager.devp.handle); @@ -343,15 +341,25 @@ dev_pager_dealloc(vm_object_t object) VM_OBJECT_WLOCK(object); if (object->type == OBJT_DEVICE) { - /* - * Free up our fake pages. - */ - while ((m = TAILQ_FIRST(&object->un_pager.devp.devp_pglist)) - != NULL) { - if (vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL) == 0) - continue; + struct pctrie_iter pages; + vm_page_t m; - dev_pager_free_page(object, m); + vm_page_iter_init(&pages, object); +restart: + VM_RADIX_FOREACH(m, &pages) { + if (!vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL)) { + pctrie_iter_reset(&pages); + goto restart; + } + if (vm_page_iter_remove(&pages, m)) { + /* + * We could end up with invalid pages installed + * by the generic page fault handler. Typically + * these are replaced by the device pager. + */ + vm_page_free(m); + } else if ((m->flags & PG_FICTITIOUS) != 0) + dev_pager_free_page(object, m); } } object->handle = NULL; @@ -380,10 +388,6 @@ dev_pager_getpages(vm_object_t object, vm_page_t *ma, int count, int *rbehind, (object->type == OBJT_MGTDEVICE && (ma[0]->oflags & VPO_UNMANAGED) == 0), ("Wrong page type %p %p", ma[0], object)); - if (object->type == OBJT_DEVICE) { - TAILQ_INSERT_TAIL(&object->un_pager.devp.devp_pglist, - ma[0], plinks.q); - } if (rbehind) *rbehind = 0; if (rahead) diff --git a/sys/vm/vm_object.h b/sys/vm/vm_object.h index b056ebe9a4b7..694b9d77a12d 100644 --- a/sys/vm/vm_object.h +++ b/sys/vm/vm_object.h @@ -134,7 +134,7 @@ struct vm_object { * devp_pglist - list of allocated pages */ struct { - TAILQ_HEAD(, vm_page) devp_pglist; + void *spare[2]; const struct cdev_pager_ops *ops; void *handle; } devp; diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c index b39d665f9e0f..3753079f2fde 100644 --- a/sys/vm/vm_page.c +++ b/sys/vm/vm_page.c @@ -1363,8 +1363,10 @@ vm_page_putfake(vm_page_t m) KASSERT((m->oflags & VPO_UNMANAGED) != 0, ("managed %p", m)); KASSERT((m->flags & PG_FICTITIOUS) != 0, ("vm_page_putfake: bad page %p", m)); - vm_page_assert_xbusied(m); - vm_page_busy_free(m); + if (m->object != NULL) { + vm_page_assert_xbusied(m); + vm_page_busy_free(m); + } uma_zfree(fakepg_zone, m); } diff --git a/tests/sys/vm/mmap_test.c b/tests/sys/vm/mmap_test.c index 6bc30f73ca95..a94fb56c46cf 100644 --- a/tests/sys/vm/mmap_test.c +++ b/tests/sys/vm/mmap_test.c @@ -362,6 +362,35 @@ ATF_TC_BODY(mmap__maxprot_shm, tc) ATF_REQUIRE(close(fd) == 0); } +/* A regression test for a bug in the device pager. */ +ATF_TC_WITHOUT_HEAD(mmap__device_reinsert); +ATF_TC_BODY(mmap__device_reinsert, tc) +{ + void *p; + int fd; + + fd = open("/dev/devstat", O_RDONLY); + ATF_REQUIRE(fd >= 0); + + p = mmap(NULL, getpagesize(), PROT_READ, MAP_SHARED, fd, 0); + ATF_REQUIRE(p != MAP_FAILED); + + /* + * Use mlock() to trigger a fault, since msync() will not actually + * remove the page from the process page tables. + */ + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + ATF_REQUIRE(msync(p, getpagesize(), MS_INVALIDATE) == 0); + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + ATF_REQUIRE(msync(p, getpagesize(), MS_INVALIDATE) == 0); + ATF_REQUIRE(mlock(p, getpagesize()) == 0); + ATF_REQUIRE(munlock(p, getpagesize()) == 0); + + ATF_REQUIRE(munmap(p, getpagesize()) == 0); +} + ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TC(tp, mmap__map_at_zero); @@ -371,6 +400,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, mmap__write_only); ATF_TP_ADD_TC(tp, mmap__maxprot_basic); ATF_TP_ADD_TC(tp, mmap__maxprot_shm); + ATF_TP_ADD_TC(tp, mmap__device_reinsert); return (atf_no_error()); } From nobody Tue Jun 30 17:21:51 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLm466Bz6jYcT for ; Tue, 30 Jun 2026 17:21:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLl6tvlz3scb for ; Tue, 30 Jun 2026 17:21:51 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840112; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UCOdp+2kyCBJKWm+JthayyqRW0ZSqq58iwi2v+fmlyg=; b=Irns7TjAXMrEbA9+MsxwPukOEV9OHww4I9dyICyNFcFG/+hSEIpAmmspfr7LngbKhXoY8S YQbu+uHqpxOfnmzPcV+Q5S7RwmN8BHFYsh8SWm+faI9sNU3ojP8W9Ug+DlFeZ3bgPM3WSp hhvyl+9ADkaNVKC8AcsGLOHCD/TlMJQbC/eDxH3qKgYBVAgzoSAbberas4pzAFbrzXM3af ChkhTcRbKG9fOmeSck7NETPv69wQYwsor+Q8OXOKOq5+41B5T/wNDtIFe7D1juRjLjWOGF OdfE2wu9rKFHR3LW41HP8JWkRTp2cw+6HH+RO5NyI0ZALHVvCb3N8jsvwTVYVQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840112; a=rsa-sha256; cv=none; b=czhq2MyEVddbnr89qN1u6k6pNdnJjNiGMLVjrYmuI2cQ8h37ZAytICyH0zGW/O72W+yOuY nae+fZREwMQWTeeBUYSzSHMWm9B4LadwFd3J9OiPsEWeptEUh1NmcAo5IQU3UVec+xEMZ2 tIHiGgfCWcAUM+NzPU7A7WppmYz5sPWlArNctKL8eW620HcYy4vow82nkMkkwBpee74RPC d1cbZfwEnG9Z4KWs+fbJZSVuHqq6vlSfjYGge7k79D1gybqpXKdVMldYFAx5bi3lrZCo/O Bp6IX4+4QBEEUy2y0+t+HOKM952pzT1lpU2Jy7VGQ7ma5RECpmemMyZOtf1aRA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840112; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UCOdp+2kyCBJKWm+JthayyqRW0ZSqq58iwi2v+fmlyg=; b=iNeagkP5le6U/DyY+RDL3avT+NRZhoRj+FY4CI2dO7diy5hxbhXz4I3q9xb9mx4jH/7HZr n6JKTPhGZPNr5l2BoGf30lhTaCQZ4qq5ggC+8JVeddKAN/4rMjUgNNioGuoNiITwhXt57c 1iJna4uNKy+dATEwDgcWT0T0koen3rM7ycJQVTtRZZovd2nOKNwETPug+OMcjokymisOyk v8kL/7JQzmw9BI5ffDhWw3rYJEupEqpRCCVoC/u2yrFz0UDOZ2q47WGDR25x1vcr9JQcyJ c1Fq60hFgOeBhL9qT+01Gh+irMKyA+C+E9zS4aDrIpsWJTDP8sHmrkZURdQF1Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLl5qf1zt0Z for ; Tue, 30 Jun 2026 17:21:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44762 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:51 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: c04ca8bd36f7 - releng/15.1 - rpcsec_tls: Avoid a socket reference underflow in rpctls_server() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: c04ca8bd36f778a8190e5aa3249075929a916dbe Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:51 +0000 Message-Id: <6a43fb2f.44762.421945ff@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c04ca8bd36f778a8190e5aa3249075929a916dbe commit c04ca8bd36f778a8190e5aa3249075929a916dbe Author: Mark Johnston AuthorDate: 2026-06-15 15:52:24 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:40 +0000 rpcsec_tls: Avoid a socket reference underflow in rpctls_server() The upcall_sockets tree owns a ref on any resident socket. When a socket is removed after a TLS handshake failure, rpctls_rpc_failed() thus calls soclose(). rpctls_server() does not acquire an extra ref to compensate for this. So, if the upcall fails, e.g., because rpc.tlsservd is not running, we'll call soclose() to drop the reference, but this effectively releases the xprt layer's reference. Fix the problem by explicitly acquiring a socket reference when adding a socket to the upcall tree. Approved by: so Security: FreeBSD-EN-26:17.rpcsec_tls PR: 289734 Reviewed by: rmacklem, glebius MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57555 (cherry picked from commit fc7993cf2d6ddba9f94683565838bf8fabc0145c) (cherry picked from commit f3b14134dec11c2f09980f25c4c60accbfea0f1e) --- sys/rpc/rpcsec_tls/rpctls_impl.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/sys/rpc/rpcsec_tls/rpctls_impl.c b/sys/rpc/rpcsec_tls/rpctls_impl.c index 22ba699a6fab..d8d4a240e0b9 100644 --- a/sys/rpc/rpcsec_tls/rpctls_impl.c +++ b/sys/rpc/rpcsec_tls/rpctls_impl.c @@ -190,7 +190,6 @@ sys_rpctls_syscall(struct thread *td, struct rpctls_syscall_args *uap) KRPC_CURVNET_RESTORE(); return (error); } - soref(ups.so); if (ups.server) { /* * Once this file descriptor is associated @@ -277,6 +276,7 @@ rpctls_connect(CLIENT *newclient, char *certname, struct socket *so, if (stat != RPC_SUCCESS) return (RPC_SYSTEMERROR); + soref(so); mtx_lock(&rpctls_lock); RB_INSERT(upsock_t, &upcall_sockets, &ups); mtx_unlock(&rpctls_lock); @@ -294,9 +294,16 @@ rpctls_connect(CLIENT *newclient, char *certname, struct socket *so, stat = rpctlscd_connect_2(&arg, &res, rpctls_connect_handle); if (stat == RPC_SUCCESS) *reterr = res.reterr; - else + else { rpctls_rpc_failed(&ups, so); + /* + * The socket was closed, make sure the krpc code doesn't close + * it a second time. + */ + CLNT_CONTROL(newclient, CLSET_TLS, &(int){RPCTLS_INHANDSHAKE}); + } + /* Unblock reception. */ CLNT_CONTROL(newclient, CLSET_BLOCKRCV, &(int){0}); @@ -388,6 +395,7 @@ rpctls_server(SVCXPRT *xprt, uint32_t *flags, uid_t *uid, int *ngrps, uint32_t *gidv; int i; + soref(xprt->xp_socket); mtx_lock(&rpctls_lock); RB_INSERT(upsock_t, &upcall_sockets, &ups); mtx_unlock(&rpctls_lock); @@ -407,9 +415,18 @@ rpctls_server(SVCXPRT *xprt, uint32_t *flags, uid_t *uid, int *ngrps, for (i = 0; i < *ngrps; i++) *gidp++ = *gidv++; } - } else + } else { rpctls_rpc_failed(&ups, xprt->xp_socket); + /* + * The socket was closed, make sure the krpc code doesn't close + * it a second time. + */ + sx_xlock(&ups.xp->xp_lock); + ups.xp->xp_tls = RPCTLS_FLAGS_HANDSHFAIL; + sx_xunlock(&ups.xp->xp_lock); + } + mem_free(res.gid.gid_val, 0); #ifdef INVARIANTS From nobody Tue Jun 30 17:21:55 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLq5NNcz6jZ35 for ; Tue, 30 Jun 2026 17:21:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLq2NnDz3snv for ; Tue, 30 Jun 2026 17:21:55 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840115; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Sk+AbLW7qkyvJ9Niu35NBhodZfjV+oqyCU1Sat+IgzA=; b=m/LShn1bdB1t38xrQtd6G997LbOq8FCDbrHDk3WmqtINUQgCgI1JptprH50q+Ba1LuOcSt SkBHUBd78VnqwZ1lpeAuhl2I649Xwphpv6VdX+LZb3BwKI8M5gGLksL3qEnhnS4WtQS+SQ /84I+6nWAqRtaJ6uIpftNnVRIfhULkrz3Y+yb7QCkNeJH8aLdxHTu9m+BIR2f350RPVW8w Ofn5FilDYBWtKHgOvagJ0Dj3QgtIsYBTD9bs75ngXUxJbcLeCJyUnS+DfkE1V+eoQbhoE0 Q5AoaHiF4IQ06XOdDax5Wfh+C3X8NdCv/Xa2ghHSj3UJUWKHeJxN7ko2twfEKw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840115; a=rsa-sha256; cv=none; b=GNgyuVSz5GILORc6GuQaer6hGs3LTJihsN4usZ8XdL6GSl76aEBOviB98jNvS1V9tsQ1Ja rVFOOhWJknjnBsGak8uNIB0UW8P59cPjL2QwBZuY8XL3YitE/ezXTEDPOSutpMUbFD7OXA rufbQZS3AS2MES2Pd3aC1x1dC8w1b9phZqNhxFUo+MBGZOoNANr3Dm+HagOQjadGxC1m+F T4gE9HsAUgjlhOxMpGPZKYdd6UyI7qpk9SMkCNCgxTUdwRBxzMckk4PVYRPGhGCwoj2W+2 hlDkWq0V1R3jeiwTJal589ZOX2HxzkxgRsfAyLdE4eK4F7cfWoh1PmTWbQacfQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840115; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Sk+AbLW7qkyvJ9Niu35NBhodZfjV+oqyCU1Sat+IgzA=; b=xI4IlQFdjVjw7UGXyPI+LyrlsCNW1lX8yDKBsbE6oLyjyGKM0AGBlYzBVGN+kETwIiQHfs UQMw6xyEL9kmhZfKO2zbnzkHX6dC/D9iIAYxzVRlULCRbzJ8HmRIyXsjhwf5oF6rEhJmsw mv32IGWf9rpBz+xV2IewIk3PyllqbNL+n3ux0qGpaWyZ5yAKtlHjU6w0IKouNwTTCvy/wO 6h1BTbwi/Sed43wY/57XAVR5ZqmJil6oj56tRMWdY0kLbT5W4oNUC6zfhc8JsdHIiUtIwE iBeCpVCM5A6fJK+51Ab+NOYl3Nuftynn5e/+jSWWe1JGN9g1TeUZ+WH9x5Vg6w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLq11BNztkc for ; Tue, 30 Jun 2026 17:21:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45e1a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:55 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Konstantin Belousov From: Mark Johnston Subject: git: 46f7b5a64048 - releng/15.1 - execve_block(): a mechanism for mutual exclusion with execve() on the process List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 46f7b5a64048b17d87badc989788cc041ec9f5a3 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:55 +0000 Message-Id: <6a43fb33.45e1a.6097eb@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=46f7b5a64048b17d87badc989788cc041ec9f5a3 commit 46f7b5a64048b17d87badc989788cc041ec9f5a3 Author: Konstantin Belousov AuthorDate: 2026-05-26 17:36:20 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:40 +0000 execve_block(): a mechanism for mutual exclusion with execve() on the process (cherry picked from commit e1a84b7708c2514769625c2af6c5034694013b6a) (cherry picked from commit a80e40ce9ee0a0641927730a193ff1f5641e71b6) execve_block_pass(9): a helper to wait for the execblock to pass (cherry picked from commit 450fe67d19eb2ea8e27109214ff21064fdcf808c) (cherry picked from commit cbd58477285888b1b7ff21bdd0bc039f7ffad4ef) proc: Allow to make proc_rwmem() operate on a consistent address space (cherry picked from commit e1b0d051bbf7e4e730470cbd6622f71a639834c3) (cherry picked from commit be6e5131066753dc23f8e9f223acc023b7618b63) kern_proc.c: ensure stability of the vmspace we read the strings from (cherry picked from commit a22c044cce41864a32af6b8281a3c416a2664d7f) (cherry picked from commit 3748c2e257046056b969a5d47231695798198f4d) kern_proc.c: ensure stability of the vmspace for sysctl kern.proc.vmmap (cherry picked from commit 5fe6e08d2db56b530f0df2903ef24cfabab7b8ea) (cherry picked from commit 20ed389b365030b868298d7ab4e8a01270c06c9f) kern_proc.c: ensure stability of the vmspace for sysctl kern.proc.vm_layout (cherry picked from commit 31fa677e4af00b795bf671847b4dc72960c90f14) (cherry picked from commit eb03358c407d6f3c073320bdc26a5e4ceb923ca1) kern_proc.c: make kern.proc.osrel atomic (cherry picked from commit 80626f34ee985671bb8c60ee986b89587b7a1511) (cherry picked from commit 5e633db3f8e126578c097c9649ba3be552664c6a) kern_proc.c: disallow execve around sysctl kern.proc.kstacks (cherry picked from commit 8b5abd9027b8b1f6290c756730ee3adebed007f4) (cherry picked from commit 60d8df61846fc1f5f7e2a400d2b0237c9f1a6be8) kern_proc.c: disallow execve around sysctl kern.proc.rlimit (cherry picked from commit 5a91fa5a7656c99e527fe7e6f6bf6bd9e85ab589) (cherry picked from commit 24d8b3364405e5c32618c6930d4fdd8bc543a08f) kern_event: block the target process from execing for sysctl kern.proc.kqueue (cherry picked from commit 79b384bd8fdff4869ce4799edb0342ff5c25b6fa) (cherry picked from commit d172933cf69fb4dc58e07261653481a33cdf1da0) kern_resource.c: disallow execve around sysctl kern.proc.rlimitusage (cherry picked from commit 836749817036b90b60af0584fa21f2d9dbd60ff7) (cherry picked from commit 035f66ff2924808f534df9065388aabf66e77266) kern_procctl(PROC_WX_MAPPINGS_PERMIT): ensure stability of the target vmspace (cherry picked from commit 6a572920f251ac8ac6a80a55d4d039736ea7dd65) (cherry picked from commit d80a7fd6e6df65b4d85e6977557c3fbe8d9ff02e) linux_prlimit(): block execve for the target (cherry picked from commit e41c28e67fac9cd22a85b160c5c9d0477ed03600) (cherry picked from commit e9002239571fb1502505ff85061934ef0ebd2e1e) pfs_readdir(): block the target process from execing (cherry picked from commit 4c0a0909f928baac982b7de4bfa5b5ca7de5291a) (cherry picked from commit 1744ce4b052d4aea94c1c3b87fefabd0952e6082) pseudofs: ensure that the target process vmspace is stable for VOP_READ/WRITE (cherry picked from commit a4993bac41350e85bc9affb862d2974a1a09bb5e) (cherry picked from commit 277f612073d0b086604448814867cadaacad4ca8) procfs, linprocfs: ensure target process vmspace stability (cherry picked from commit 5db31f1b47b586a5091eb41fc957236f28b78dba) (cherry picked from commit 78981848b85fdd826eb830dfdd6d92c14b0f8bb3) sys_set*id(9): wait for the execblocks to pass (cherry picked from commit d0384f50dad25d3358d76f7556969ea1d515ba68) (cherry picked from commit e0492444761b638ff072222d39ba5d6088a63370) kern_exec.c: explicitly include sys/limits.h for UINT_MAX (cherry picked from commit f5fce0bcc370a9700249e64901eabf2e0be4ecb0) (cherry picked from commit 42d8b0bf7a5a074c7035585a06dd44aed1b2cbdd) Approved by: so Security: FreeBSD-SA-26:39.execve Security: CVE-2026-49415 --- sys/compat/linprocfs/linprocfs.c | 16 +--- sys/compat/linux/linux_misc.c | 15 +++ sys/fs/cuse/cuse.c | 4 +- sys/fs/procfs/procfs_map.c | 17 ++-- sys/fs/procfs/procfs_mem.c | 6 +- sys/fs/pseudofs/pseudofs_vnops.c | 69 ++++++++++---- sys/kern/kern_event.c | 22 ++++- sys/kern/kern_exec.c | 83 ++++++++++++++++- sys/kern/kern_exit.c | 1 + sys/kern/kern_fork.c | 1 + sys/kern/kern_proc.c | 191 +++++++++++++++++++++++---------------- sys/kern/kern_procctl.c | 21 +++-- sys/kern/kern_prot.c | 20 +++- sys/kern/kern_resource.c | 27 ++++-- sys/kern/sys_process.c | 131 ++++++++++++++++++++++----- sys/sys/imgact.h | 4 + sys/sys/proc.h | 3 +- sys/sys/ptrace.h | 15 ++- 18 files changed, 470 insertions(+), 176 deletions(-) diff --git a/sys/compat/linprocfs/linprocfs.c b/sys/compat/linprocfs/linprocfs.c index 7ac48786c77b..df3434848a81 100644 --- a/sys/compat/linprocfs/linprocfs.c +++ b/sys/compat/linprocfs/linprocfs.c @@ -1315,19 +1315,13 @@ linprocfs_doprocmaps(PFS_FILL_ARGS) struct vattr vat; bool private; - PROC_LOCK(p); - error = p_candebug(td, p); - PROC_UNLOCK(p); - if (error) - return (error); - if (uio->uio_rw != UIO_READ) return (EOPNOTSUPP); - error = 0; - vm = vmspace_acquire_ref(p); - if (vm == NULL) - return (ESRCH); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, + &vm); + if (error != 0) + return (error); if (SV_CURPROC_FLAG(SV_LP64)) l_map_str = l64_map_str; @@ -1425,7 +1419,7 @@ linprocfs_doprocmaps(PFS_FILL_ARGS) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_CHECK_DEBUG | PRVM_BLOCK_EXEC, vm); return (error); } diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c index 937b010c8435..d35429e17f12 100644 --- a/sys/compat/linux/linux_misc.c +++ b/sys/compat/linux/linux_misc.c @@ -2010,6 +2010,7 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) u_int which; int flags; int error; + bool exec_blocked; if (args->new == NULL && args->old != NULL) { if (linux_get_dummy_limit(td, args->resource, &rlim)) { @@ -2037,6 +2038,7 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) return (error); } + exec_blocked = false; flags = PGET_HOLD | PGET_NOTWEXIT; if (args->new != NULL) flags |= PGET_CANDEBUG; @@ -2049,6 +2051,14 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) error = pget(args->pid, flags, &p); if (error != 0) return (error); + exec_blocked = true; + PROC_LOCK(p); + execve_block_wait(td, p); + error = args->new != NULL ? p_candebug(td, p) : + p_cansee(td, p); + PROC_UNLOCK(p); + if (error != 0) + goto out; } if (args->old != NULL) { PROC_LOCK(p); @@ -2071,6 +2081,11 @@ linux_prlimit64(struct thread *td, struct linux_prlimit64_args *args) error = kern_proc_setrlimit(td, p, which, &nrlim); out: + if (exec_blocked) { + PROC_LOCK(p); + execve_unblock(td, p); + PROC_UNLOCK(p); + } PRELE(p); return (error); } diff --git a/sys/fs/cuse/cuse.c b/sys/fs/cuse/cuse.c index b914b2d5017c..8f67c4b5572b 100644 --- a/sys/fs/cuse/cuse.c +++ b/sys/fs/cuse/cuse.c @@ -916,7 +916,7 @@ cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s, }; PHOLD(proc_s); - error = proc_rwmem(proc_s, &uio); + error = proc_rwmem(proc_s, &uio, 0); PRELE(proc_s); } else if (proc_cur == proc_s) { @@ -935,7 +935,7 @@ cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s, }; PHOLD(proc_d); - error = proc_rwmem(proc_d, &uio); + error = proc_rwmem(proc_d, &uio, 0); PRELE(proc_d); } else { error = EINVAL; diff --git a/sys/fs/procfs/procfs_map.c b/sys/fs/procfs/procfs_map.c index d4913a7b0f1d..1ed785f1ad90 100644 --- a/sys/fs/procfs/procfs_map.c +++ b/sys/fs/procfs/procfs_map.c @@ -40,6 +40,7 @@ #include #include #include +#include #include #include #include @@ -93,15 +94,14 @@ procfs_doprocmap(PFS_FILL_ARGS) bool wrap32; #endif - PROC_LOCK(p); - error = p_candebug(td, p); - PROC_UNLOCK(p); - if (error) - return (error); - if (uio->uio_rw != UIO_READ) return (EOPNOTSUPP); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, + &vm); + if (error != 0) + return (error); + #ifdef COMPAT_FREEBSD32 wrap32 = false; if (SV_CURPROC_FLAG(SV_ILP32)) { @@ -111,9 +111,6 @@ procfs_doprocmap(PFS_FILL_ARGS) } #endif - vm = vmspace_acquire_ref(p); - if (vm == NULL) - return (ESRCH); map = &vm->vm_map; vm_map_lock_read(map); VM_MAP_ENTRY_FOREACH(entry, map) { @@ -238,6 +235,6 @@ procfs_doprocmap(PFS_FILL_ARGS) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, vm); return (error); } diff --git a/sys/fs/procfs/procfs_mem.c b/sys/fs/procfs/procfs_mem.c index 0020b8f8a8d8..eb692c32923b 100644 --- a/sys/fs/procfs/procfs_mem.c +++ b/sys/fs/procfs/procfs_mem.c @@ -60,11 +60,7 @@ procfs_doprocmem(PFS_FILL_ARGS) if (uio->uio_resid == 0) return (0); - PROC_LOCK(p); - error = p_candebug(td, p); - PROC_UNLOCK(p); - if (error == 0) - error = proc_rwmem(p, uio); + error = proc_rwmem(p, uio, PRVM_CHECK_DEBUG | PRVM_BLOCK_EXEC); return (error); } diff --git a/sys/fs/pseudofs/pseudofs_vnops.c b/sys/fs/pseudofs/pseudofs_vnops.c index 8cd092118d0e..059e8fd0e8b2 100644 --- a/sys/fs/pseudofs/pseudofs_vnops.c +++ b/sys/fs/pseudofs/pseudofs_vnops.c @@ -37,6 +37,7 @@ #include #include #include +#include #include #include #include @@ -132,6 +133,7 @@ static int pfs_lookup_proc(pid_t pid, struct proc **p) { struct proc *proc; + struct thread *td; proc = pfind(pid); if (proc == NULL) @@ -141,8 +143,10 @@ pfs_lookup_proc(pid_t pid, struct proc **p) return (0); } _PHOLD(proc); - PROC_UNLOCK(proc); + td = curthread; + execve_block_wait(td, proc); *p = proc; + PROC_UNLOCK(proc); return (1); } @@ -672,6 +676,7 @@ pfs_read(struct vop_read_args *va) struct pfs_node *pn = pvd->pvd_pn; struct uio *uio = va->a_uio; struct proc *proc; + struct thread *td; struct sbuf *sb = NULL; int error, locked; off_t buflen, buflim; @@ -690,21 +695,30 @@ pfs_read(struct vop_read_args *va) if (pn->pn_fill == NULL) PFS_RETURN (EIO); + td = curthread; + /* * This is necessary because either process' privileges may * have changed since the open() call. */ - if (!pfs_visible(curthread, pn, pvd->pvd_pid, &proc)) + if (!pfs_visible(td, pn, pvd->pvd_pid, &proc)) PFS_RETURN (EIO); - if (proc != NULL) { - _PHOLD(proc); - PROC_UNLOCK(proc); - } vhold(vn); locked = VOP_ISLOCKED(vn); VOP_UNLOCK(vn); + if (proc != NULL) { + _PHOLD(proc); + execve_block_wait(td, proc); + if (!pfs_visible_proc(td, pn, proc)) { + PROC_UNLOCK(proc); + error = EIO; + goto ret; + } + PROC_UNLOCK(proc); + } + if (pn->pn_flags & PFS_RAWRD) { PFS_TRACE(("%zd resid", uio->uio_resid)); error = pn_fill(curthread, proc, pn, NULL, uio); @@ -774,8 +788,12 @@ pfs_read(struct vop_read_args *va) ret: vn_lock(vn, locked | LK_RETRY); vdrop(vn); - if (proc != NULL) - PRELE(proc); + if (proc != NULL) { + PROC_LOCK(proc); + execve_unblock(td, proc); + _PRELE(proc); + PROC_UNLOCK(proc); + } PFS_RETURN (error); } @@ -846,6 +864,7 @@ pfs_readdir(struct vop_readdir_args *va) struct pfs_node *pd = pvd->pvd_pn; pid_t pid = pvd->pvd_pid; struct proc *p, *proc; + struct thread *td; struct pfs_node *pn; struct uio *uio; struct pfsentry *pfsent, *pfsent2; @@ -891,11 +910,13 @@ pfs_readdir(struct vop_readdir_args *va) KASSERT(pid == NO_PID || proc != NULL, ("%s(): no process for pid %lu", __func__, (unsigned long)pid)); + td = curthread; if (pid != NO_PID) { PROC_LOCK(proc); /* check if the directory is visible to the caller */ if (!pfs_visible_proc(curthread, pd, proc)) { + execve_unblock(td, proc); _PRELE(proc); PROC_UNLOCK(proc); pfs_unlock(pd); @@ -955,6 +976,7 @@ pfs_readdir(struct vop_readdir_args *va) resid -= PFS_DELEN; } if (proc != NULL) { + execve_unblock(td, proc); _PRELE(proc); PROC_UNLOCK(proc); } @@ -1079,6 +1101,7 @@ pfs_write(struct vop_write_args *va) struct pfs_node *pn = pvd->pvd_pn; struct uio *uio = va->a_uio; struct proc *proc; + struct thread *td; struct sbuf sb; int error; @@ -1098,36 +1121,44 @@ pfs_write(struct vop_write_args *va) if (uio->uio_resid > PFS_MAXBUFSIZ) PFS_RETURN (EIO); + td = curthread; + /* * This is necessary because either process' privileges may * have changed since the open() call. */ - if (!pfs_visible(curthread, pn, pvd->pvd_pid, &proc)) + if (!pfs_visible(td, pn, pvd->pvd_pid, &proc)) PFS_RETURN (EIO); if (proc != NULL) { _PHOLD(proc); + execve_block_wait(td, proc); + if (!pfs_visible_proc(td, pn, proc)) { + PROC_UNLOCK(proc); + error = EIO; + goto out; + } PROC_UNLOCK(proc); } if (pn->pn_flags & PFS_RAWWR) { error = pn_fill(curthread, proc, pn, NULL, uio); - if (proc != NULL) - PRELE(proc); - PFS_RETURN (error); + goto out; } sbuf_uionew(&sb, uio, &error); - if (error) { - if (proc != NULL) - PRELE(proc); - PFS_RETURN (error); - } + if (error != 0) + goto out; error = pn_fill(curthread, proc, pn, &sb, uio); sbuf_delete(&sb); - if (proc != NULL) - PRELE(proc); +out: + if (proc != NULL) { + PROC_LOCK(proc); + execve_unblock(td, proc); + _PRELE(proc); + PROC_UNLOCK(proc); + } PFS_RETURN (error); } diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c index 8c7a0949f024..01bd22fbefd1 100644 --- a/sys/kern/kern_event.c +++ b/sys/kern/kern_event.c @@ -49,6 +49,7 @@ #include #include #include +#include #include #include #include @@ -3381,10 +3382,6 @@ sysctl_kern_proc_kqueue(SYSCTL_HANDLER_ARGS) if ((u_int)arg2 > 2 || (u_int)arg2 == 0) return (EINVAL); - error = pget((pid_t)name[0], PGET_HOLD | PGET_CANDEBUG, &p); - if (error != 0) - return (error); - td = curthread; #ifdef COMPAT_FREEBSD32 compat32 = SV_CURPROC_FLAG(SV_ILP32); @@ -3392,6 +3389,17 @@ sysctl_kern_proc_kqueue(SYSCTL_HANDLER_ARGS) compat32 = false; #endif + error = pget((pid_t)name[0], PGET_NOTWEXIT, &p); + if (error != 0) + return (error); + + _PHOLD(p); + execve_block_wait(td, p); + error = p_candebug(td, p); + if (error != 0) + goto out1; + PROC_UNLOCK(p); + s = sbuf_new_for_sysctl(&sm, NULL, 0, req); if (s == NULL) { error = ENOMEM; @@ -3412,7 +3420,11 @@ sysctl_kern_proc_kqueue(SYSCTL_HANDLER_ARGS) sbuf_delete(s); out: - PRELE(p); + PROC_LOCK(p); +out1: + execve_unblock(td, p); + _PRELE(p); + PROC_UNLOCK(p); return (error); } diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index 0a9ae0aabb3e..c75354a4ffa6 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -26,7 +26,6 @@ * SUCH DAMAGE. */ -#include #include "opt_capsicum.h" #include "opt_hwpmc_hooks.h" #include "opt_hwt_hooks.h" @@ -46,6 +45,7 @@ #include #include #include +#include #include #include #include @@ -385,6 +385,77 @@ execve_nosetid(struct image_params *imgp) } } +/* + * Returns true if the execblock was obtained, in this case the + * process lock is kept. Returns false if the execblock was not + * obtained, but the function slept and the lock was dropped. + */ +bool +execve_block(struct thread *td, struct proc *p) +{ + PROC_LOCK_ASSERT(p, MA_OWNED); + MPASS(td == curthread); + MPASS(p != td->td_proc || (p->p_flag & P_INEXEC) == 0); + + if (p != td->td_proc && (p->p_flag & P_INEXEC) != 0) { + p->p_flag |= P_INEXEC_WAIT; + msleep(&p->p_execblock, &p->p_mtx, PDROP, "inexec", 0); + return (false); + } + MPASS(p->p_execblock < UINT_MAX); + p->p_execblock++; + return (true); +} + +/* + * Might drop the process lock internally, callers must re-check the + * invariants afterward. + */ +void +execve_block_wait(struct thread *td, struct proc *p) +{ + bool first; + + PROC_ASSERT_HELD(p); + PROC_LOCK_ASSERT(p, MA_OWNED); + + for (first = true;; first = false) { + if (!first) + PROC_LOCK(p); + if (execve_block(td, p)) + return; + } +} + +void +execve_unblock(struct thread *td, struct proc *p) +{ + PROC_LOCK_ASSERT(p, MA_OWNED); + MPASS(td == curthread); + + MPASS(p->p_execblock > 0); + p->p_execblock--; + if (p->p_execblock == 0 && (p->p_flag & P_INEXEC_WAIT) != 0) { + p->p_flag &= ~P_INEXEC_WAIT; + wakeup(&p->p_execblock); + } +} + +void +execve_block_pass(struct thread *td) +{ + struct proc *p; + + MPASS(td == curthread); + p = td->td_proc; + PROC_LOCK_ASSERT(p, MA_OWNED); + + while (p->p_execblock != 0) { + p->p_flag |= P_INEXEC_WAIT; + msleep(&p->p_execblock, &p->p_mtx, 0, "exeblk", 0); + } +} + /* * In-kernel implementation of execve(). All arguments are assumed to be * userspace pointers from the passed thread. @@ -440,6 +511,7 @@ do_execve(struct thread *td, struct image_args *args, struct mac *mac_p, PROC_LOCK(p); KASSERT((p->p_flag & P_INEXEC) == 0, ("%s(): process already has P_INEXEC flag", __func__)); + execve_block_pass(td); p->p_flag |= P_INEXEC; PROC_UNLOCK(p); @@ -909,7 +981,10 @@ interpret: * as we're now a bona fide freshly-execed process. */ KNOTE_LOCKED(p->p_klist, NOTE_EXEC); - p->p_flag &= ~P_INEXEC; + MPASS(p->p_execblock == 0); + if ((p->p_flag & P_INEXEC_WAIT) != 0) + wakeup(&p->p_execblock); + p->p_flag &= ~(P_INEXEC | P_INEXEC_WAIT); /* clear "fork but no exec" flag, as we _are_ execing */ p->p_acflag &= ~AFORK; @@ -1005,7 +1080,9 @@ exec_fail_dealloc: exec_fail: /* we're done here, clear P_INEXEC */ PROC_LOCK(p); - p->p_flag &= ~P_INEXEC; + if ((p->p_flag & P_INEXEC_WAIT) != 0) + wakeup(&p->p_execblock); + p->p_flag &= ~(P_INEXEC | P_INEXEC_WAIT); PROC_UNLOCK(p); SDT_PROBE1(proc, , , exec__failure, error); diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c index 18ea3a7bd29d..667545bd6ac7 100644 --- a/sys/kern/kern_exit.c +++ b/sys/kern/kern_exit.c @@ -323,6 +323,7 @@ exit1(struct thread *td, int rval, int signo) while (p->p_lock > 0) msleep(&p->p_lock, &p->p_mtx, PWAIT, "exithold", 0); + MPASS(p->p_execblock == 0); PROC_UNLOCK(p); /* Drain the limit callout while we don't have the proc locked */ callout_drain(&p->p_limco); diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c index a453af959bb1..07385752c02d 100644 --- a/sys/kern/kern_fork.c +++ b/sys/kern/kern_fork.c @@ -430,6 +430,7 @@ do_fork(struct thread *td, struct fork_req *fr, struct proc *p2, struct thread * bzero(&p2->p_startzero, __rangeof(struct proc, p_startzero, p_endzero)); + p2->p_execblock = 0; /* Tell the prison that we exist. */ prison_proc_hold(p2->p_ucred->cr_prison); diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c index 758f54c540ab..3f0bb5a915f4 100644 --- a/sys/kern/kern_proc.c +++ b/sys/kern/kern_proc.c @@ -43,6 +43,7 @@ #include #include #include +#include #include #include #include @@ -1838,8 +1839,8 @@ pargs_drop(struct pargs *pa) } static int -proc_read_string(struct thread *td, struct proc *p, const char *sptr, char *buf, - size_t len) +proc_read_string(struct thread *td, struct vmspace *vm, const char *sptr, + char *buf, size_t len) { ssize_t n; @@ -1848,7 +1849,7 @@ proc_read_string(struct thread *td, struct proc *p, const char *sptr, char *buf, * and is aligned at the end of the page, and the following page is not * mapped. */ - n = proc_readmem(td, p, (vm_offset_t)sptr, buf, len); + n = vmspace_iop(td, vm, (vm_offset_t)sptr, buf, len, UIO_READ); if (n <= 0) return (ENOMEM); return (0); @@ -1864,8 +1865,8 @@ enum proc_vector_type { #ifdef COMPAT_FREEBSD32 static int -get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, - size_t *vsizep, enum proc_vector_type type) +get_proc_vector32(struct thread *td, struct proc *p, struct vmspace *vm, + char ***proc_vectorp, size_t *vsizep, enum proc_vector_type type) { struct freebsd32_ps_strings pss; Elf32_Auxinfo aux; @@ -1876,8 +1877,8 @@ get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, int i, error; error = 0; - if (proc_readmem(td, p, PROC_PS_STRINGS(p), &pss, sizeof(pss)) != - sizeof(pss)) + if (vmspace_iop(td, vm, PROC_PS_STRINGS(p), &pss, sizeof(pss), + UIO_READ) != sizeof(pss)) return (ENOMEM); switch (type) { case PROC_ARG: @@ -1900,8 +1901,8 @@ get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, if (vptr % 4 != 0) return (ENOEXEC); for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) { - if (proc_readmem(td, p, ptr, &aux, sizeof(aux)) != - sizeof(aux)) + if (vmspace_iop(td, vm, ptr, &aux, sizeof(aux), + UIO_READ) != sizeof(aux)) return (ENOMEM); if (aux.a_type == AT_NULL) break; @@ -1917,7 +1918,7 @@ get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp, return (EINVAL); } proc_vector32 = malloc(size, M_TEMP, M_WAITOK); - if (proc_readmem(td, p, vptr, proc_vector32, size) != size) { + if (vmspace_iop(td, vm, vptr, proc_vector32, size, UIO_READ) != size) { error = ENOMEM; goto done; } @@ -1938,8 +1939,8 @@ done: #endif static int -get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, - size_t *vsizep, enum proc_vector_type type) +get_proc_vector(struct thread *td, struct proc *p, struct vmspace *vm, + char ***proc_vectorp, size_t *vsizep, enum proc_vector_type type) { struct ps_strings pss; Elf_Auxinfo aux; @@ -1949,11 +1950,13 @@ get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, int i; #ifdef COMPAT_FREEBSD32 - if (SV_PROC_FLAG(p, SV_ILP32) != 0) - return (get_proc_vector32(td, p, proc_vectorp, vsizep, type)); + if (SV_PROC_FLAG(p, SV_ILP32) != 0) { + return (get_proc_vector32(td, p, vm, proc_vectorp, + vsizep, type)); + } #endif - if (proc_readmem(td, p, PROC_PS_STRINGS(p), &pss, sizeof(pss)) != - sizeof(pss)) + if (vmspace_iop(td, vm, PROC_PS_STRINGS(p), &pss, sizeof(pss), + UIO_READ) != sizeof(pss)) return (ENOMEM); switch (type) { case PROC_ARG: @@ -1991,8 +1994,8 @@ get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, * to the allocated proc_vector. */ for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) { - if (proc_readmem(td, p, ptr, &aux, sizeof(aux)) != - sizeof(aux)) + if (vmspace_iop(td, vm, ptr, &aux, sizeof(aux), + UIO_READ) != sizeof(aux)) return (ENOMEM); if (aux.a_type == AT_NULL) break; @@ -2014,7 +2017,7 @@ get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp, return (EINVAL); /* In case we are built without INVARIANTS. */ } proc_vector = malloc(size, M_TEMP, M_WAITOK); - if (proc_readmem(td, p, vptr, proc_vector, size) != size) { + if (vmspace_iop(td, vm, vptr, proc_vector, size, UIO_READ) != size) { free(proc_vector, M_TEMP); return (ENOMEM); } @@ -2030,6 +2033,7 @@ static int get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, enum proc_vector_type type) { + struct vmspace *vm; size_t done, len, nchr, vsize; int error, i; char **proc_vector, *sptr; @@ -2042,9 +2046,14 @@ get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, */ nchr = 2 * (PATH_MAX + ARG_MAX); - error = get_proc_vector(td, p, &proc_vector, &vsize, type); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | + PRVM_CHECK_VISIBILITY, &vm); if (error != 0) return (error); + + error = get_proc_vector(td, p, vm, &proc_vector, &vsize, type); + if (error != 0) + goto out; for (done = 0, i = 0; i < (int)vsize && done < nchr; i++) { /* * The program may have scribbled into its argv array, e.g. to @@ -2054,7 +2063,7 @@ get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, if (proc_vector[i] == NULL) break; for (sptr = proc_vector[i]; ; sptr += GET_PS_STRINGS_CHUNK_SZ) { - error = proc_read_string(td, p, sptr, pss_string, + error = proc_read_string(td, vm, sptr, pss_string, sizeof(pss_string)); if (error != 0) goto done; @@ -2071,6 +2080,8 @@ get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb, } done: free(proc_vector, M_TEMP); +out: + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_VISIBILITY, vm); return (error); } @@ -2091,11 +2102,17 @@ proc_getenvv(struct thread *td, struct proc *p, struct sbuf *sb) int proc_getauxv(struct thread *td, struct proc *p, struct sbuf *sb) { + struct vmspace *vm; size_t vsize, size; char **auxv; int error; - error = get_proc_vector(td, p, &auxv, &vsize, PROC_AUX); + error = proc_vmspace_ref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, + &vm); + if (error != 0) + return (error); + error = get_proc_vector(td, p, vm, &auxv, &vsize, PROC_AUX); + proc_vmspace_unref(td, p, PRVM_BLOCK_EXEC | PRVM_CHECK_DEBUG, vm); if (error == 0) { #ifdef COMPAT_FREEBSD32 if (SV_PROC_FLAG(p, SV_ILP32) != 0) @@ -2408,6 +2425,7 @@ sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS) int error, *name; struct vnode *vp; struct proc *p; + struct thread *td; vm_map_t map; struct vmspace *vm; @@ -2416,11 +2434,12 @@ sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS) return (EINVAL); name = (int *)arg1; + td = curthread; error = pget((pid_t)name[0], PGET_WANTREAD, &p); if (error != 0) return (error); - vm = vmspace_acquire_ref(p); - if (vm == NULL) { + error = proc_vmspace_ref(td, p, PRVM_CHECK_DEBUG, &vm); + if (error != 0) { PRELE(p); return (ESRCH); } @@ -2532,7 +2551,7 @@ sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_CHECK_DEBUG, vm); PRELE(p); free(kve, M_TEMP); return (error); @@ -2627,6 +2646,7 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) struct ucred *cred; struct vnode *vp; struct vmspace *vm; + struct thread *td; vm_offset_t addr; unsigned int last_timestamp; int error; @@ -2638,10 +2658,11 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) _PHOLD(p); PROC_UNLOCK(p); - vm = vmspace_acquire_ref(p); - if (vm == NULL) { + td = curthread; + error = proc_vmspace_ref(td, p, PRVM_CHECK_DEBUG, &vm); + if (error != 0) { PRELE(p); - return (ESRCH); + return (error); } kve = malloc(sizeof(*kve), M_TEMP, M_WAITOK | M_ZERO); @@ -2745,7 +2766,7 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) if (vp != NULL) { vn_fullpath(vp, &fullpath, &freepath); kve->kve_vn_type = vntype_to_kinfo(vp->v_type); - cred = curthread->td_ucred; + cred = td->td_ucred; vn_lock(vp, LK_SHARED | LK_RETRY); if (VOP_GETATTR(vp, &va, cred) == 0) { kve->kve_vn_fileid = va.va_fileid; @@ -2801,7 +2822,7 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags) } } vm_map_unlock_read(map); - vmspace_free(vm); + proc_vmspace_unref(td, p, PRVM_CHECK_DEBUG, vm); PRELE(p); free(kve, M_TEMP); return (error); @@ -2840,7 +2861,7 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) struct kinfo_kstack *kkstp; int error, i, *name, numthreads; lwpid_t *lwpidarray; - struct thread *td; + struct thread *td, *ctd; struct stack *st; struct sbuf sb; struct proc *p; @@ -2851,7 +2872,8 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) return (EINVAL); name = (int *)arg1; - error = pget((pid_t)name[0], PGET_NOTINEXEC | PGET_WANTREAD, &p); + ctd = curthread; + error = pget((pid_t)name[0], PGET_WANTREAD, &p); if (error != 0) return (error); @@ -2860,6 +2882,14 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) lwpidarray = NULL; PROC_LOCK(p); + execve_block_wait(ctd, p); + error = p_candebug(ctd, p); + if (error != 0) { + execve_unblock(ctd, p); + _PRELE(p); + PROC_UNLOCK(p); + return (error); + } do { if (lwpidarray != NULL) { free(lwpidarray, M_TEMP); @@ -2872,15 +2902,6 @@ sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS) PROC_LOCK(p); } while (numthreads < p->p_numthreads); - /* *** 716 LINES SKIPPED *** From nobody Tue Jun 30 17:21:54 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLp66xnz6jZ34 for ; Tue, 30 Jun 2026 17:21:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLp1x4bz3sXs for ; Tue, 30 Jun 2026 17:21:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840114; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+/k4B2whyRFwzCm+JERrp4hFbJR0eRUTiJyEtxuEZtc=; b=G0Zs/FWIFP0PQTJqvOSRqt1VUmuAos3MlRzFzVaY94CihbM4EvzZd2B3mHlEiI92Vz1YaV QF5kzqjqk6kcrHAOd/TcdZEACnjHa1/y/uamFvrsb6Q8bzRSy4WiLXB3ZxWsjRuPLqvNie eDe4pEVq/igyMGyNB5aPbDOvnnxjNmnX/iIEfArpZxRAnNylqj87vGhWi2O8zEQwPopwsM rAw94LTLTXtwWAJmJ4ffPLteE4ggSpMS3BALGT2MkQEtGK7Y0PoaE42JgL5zcRoUUiuEgl MPkZVLE+71lZihhFl8LW9wSUNox0CzWTCIcIeeCENroG2xHYLL393BiJyr9O2A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840114; a=rsa-sha256; cv=none; b=t/hnd/wUPFcYFxpgetEDSGsGVoFuoHy6zGJPMTt4qy5NAfDuarV7IgRedcwmVcuzh45GDk ln+k2v07QAU777kNASqlBejvn0Y8R0JCjqzypC7AsXAqFsPBiQ9pgFHGdWDO1AOgS1ZgWR BRdZ2Jh51PXdQo5YhqicPSS16r6bSf31qGbHp+7KGrtRojaYqZ/en7mXHnjZhULMl1eqXW hZyYhNtNK3xtX2tGMImSj14/f1wU4Cy+guJjYAchnw2qTJ4BvRUs0Y9RjC/jjhgppqNl+n 8xbrB9VoQ77wUClxfcGfMujZdJreCtVFcT+STbkC2ve65Tk6A2M4C0DpNuOIOA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840114; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+/k4B2whyRFwzCm+JERrp4hFbJR0eRUTiJyEtxuEZtc=; b=DuGRG4lQcCbNqJxXRRT1JI7coIAwlu7bW/fAxU8ebnvYFOgR3RyYSuEBZxTi2fqlGux215 qGOvq8DjbBQ5i/noqZZsEE1IMc4k94I42M6Ojl+i6W6BjzuzSD53S9UaFObwzZN8GP+9B1 tobVa3XlFPNTlAhVfRgmhRt7fv1OCYN2lttDS6m8/wKu/hLb7QDRYU3C0qsNhZq3alzX9s /f+Wk1AP9wToFldsDmPaD0ojnoVxVAtlWfrgcUvEUYjiK95uoGxrtawaGNx7HFbFC14j9C 1dQuHN3LUp03ZSkVuuylvFMSWbgpR8NHQtyjQgtskWjkrK2gsTvxM0n4qgsoBQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLp0QC2ztT6 for ; Tue, 30 Jun 2026 17:21:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45652 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:54 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Jamie Gritton From: Mark Johnston Subject: git: fc9fe1b9f024 - releng/15.1 - jail: Don't double-free the current prison in kern_jail_set/get List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: fc9fe1b9f0240f8b7e74f9538f75bb070597b3c8 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:54 +0000 Message-Id: <6a43fb32.45652.7601c031@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=fc9fe1b9f0240f8b7e74f9538f75bb070597b3c8 commit fc9fe1b9f0240f8b7e74f9538f75bb070597b3c8 Author: Jamie Gritton AuthorDate: 2026-06-09 22:31:40 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:40 +0000 jail: Don't double-free the current prison in kern_jail_set/get Approved by: so Security: FreeBSD-SA-26:38.jail Security: CVE-2026-49419 Reported by: Yuxiang Yang, et al Discussed with: markj (cherry picked from commit b52dc2067618fc73e8d4d20e4035d1a67a8b455d) (cherry picked from commit 4938fd9361b497241df8f442f1f87cc73ef81d6c) --- sys/kern/kern_jail.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 9f6916a433a1..43acde461e40 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -1101,14 +1101,17 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) * Look up and create jails based on the * descriptor's prison. */ - prison_free(mypr); - error = jaildesc_find(td, jfd_in, &mypr, NULL); + struct prison *jdpr; + + error = jaildesc_find(td, jfd_in, &jdpr, NULL); if (error != 0) { vfs_opterror(opts, error == ENOENT ? "descriptor to dead jail" : "not a jail descriptor"); goto done_errmsg; } + prison_free(mypr); + mypr = jdpr; if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0) { error = EPERM; goto done_free; @@ -2550,14 +2553,17 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags) } if (flags & JAIL_AT_DESC) { /* Look up jails based on the descriptor's prison. */ - prison_free(mypr); - error = jaildesc_find(td, jfd_in, &mypr, NULL); + struct prison *jdpr; + + error = jaildesc_find(td, jfd_in, &jdpr, NULL); if (error != 0) { vfs_opterror(opts, error == ENOENT ? "descriptor to dead jail" : "not a jail descriptor"); goto done; } + prison_free(mypr); + mypr = jdpr; } if (flags & (JAIL_GET_DESC | JAIL_OWN_DESC)) { /* Allocate a jail descriptor to return later. */ From nobody Tue Jun 30 17:21:57 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLt0P66z6jYb9 for ; Tue, 30 Jun 2026 17:21:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLs3P1vz3sks for ; Tue, 30 Jun 2026 17:21:57 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840117; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=E5Z8z1f/Y4JqUh0EG3U/JW8HnyYS9aXdyN0Y277Ylrk=; b=Xdb2XA9jn+yXfbyDH/r/xnfWbP12qJ+K+z+NWXSfhQzTdwYcfiAWbxKHintImGXcPFfVG+ qvx/k6PGE1w3TM+kVRmNOhn6iwG5tid1/ffV+aeaAOEH7aKoYu63sjI5s7DgYQCX6Msw64 BRRnAYDx/TwmHFtEiqWi0A6sXbIRx/NRROAHEaA8sLhqTGtWaSWlOFm1kL3PGJMZ8ZHC2o JvDqCPoCCy33qEa1ruqHfvFiaRrLo+D2EUH6MuDALTGc7rJylQnbUhxj3bL5S/GaeRO0ZF sS/Z852BasxkZRMpZ+/P4ES4LM/FrCT/pU3yplGXZEbXeiFJF0YdbV20KDkV6g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840117; a=rsa-sha256; cv=none; b=b5S8z+HGuNuO6Ufrrz2HdTWkx1+/ixxycViOh5y/Y4STn5hhSZx3dxxDZacN7iJJzKXqki p5xFdE6eBrwDRBQpw188cSsApuKc+sKRmCMScz/095umZChfBH7Jo6UNY/dxMDIoj11Dot HxROFT4ZSMoCUho88lfNdF50HcuAu3WdFtf8R0dijC/UaiSmu5vRSheiC0QNw45q8g+yCT VYFfUXQvILq5p1PDRK0+Fetp0gE823tqqo9pi0toKX/yr5xXsvas+rFa/758WZTRXel7N3 ie9SEYqo31vcFBUpo3zA15bVTMEwFKY9sgXXrNYb47kx7c6Nunzr4WNVo3xnPw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840117; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=E5Z8z1f/Y4JqUh0EG3U/JW8HnyYS9aXdyN0Y277Ylrk=; b=iOddu+eOQem75EvJTVJvAlMde1oRfGdZF/4X6iXjWg99RdgBicBQW5l5d/464dmD8v5utv JBffnDS8ydV08efjTVCBFj0Oogp1k2g1UWvEMefF0XbIRA6oEOwRGkkhahOJXEFaluyQr4 6mFcy5La77Z//Bpaa61womzkij6xDUF0Bj/gaAgL5vdWgnw7kQ/CDmGddbzUy4+D9iPBTr 0Q3T7yiIlQ42yPEfehpchEWEsAn+nGlA5YwqVGthUIcS5Lk62MMQeat2vV45OUDl0aRJbP D89O14blI8rUp04kMzIdXb3n8gpwcw8bvLhovh4JfiRHF4eO5ATB2nh9MeIrcA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLs2RScztYQ for ; Tue, 30 Jun 2026 17:21:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45f73 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:57 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav From: Mark Johnston Subject: git: 0854a4822187 - releng/15.1 - libalias: Fix buffer overflow in RTSP aliasing List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 0854a4822187583e2ad64efee57a974ff42d79fa Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:57 +0000 Message-Id: <6a43fb35.45f73.7a6adfe6@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=0854a4822187583e2ad64efee57a974ff42d79fa commit 0854a4822187583e2ad64efee57a974ff42d79fa Author: Dag-Erling Smørgrav AuthorDate: 2026-06-28 22:10:40 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:40 +0000 libalias: Fix buffer overflow in RTSP aliasing In alias_rtsp_out(), we construct a new packet in a fixed-length buffer before copying it back into the original buffer. We never checked if the data we were writing to this temporary buffer fit in it, nor if the result fit in the original buffer. * Use a dynamically sized allocated buffer instead of a fixed-length stack buffer. * Check for overflow before appending to our temporary buffer. * Check for overflow before copying the data back to the packet buffer. * While here, use size_t for sizes and bool for booleans. Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 MFC after: 1 week Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D57753 --- sys/netinet/libalias/alias_smedia.c | 156 ++++++++++++++++++++---------------- 1 file changed, 89 insertions(+), 67 deletions(-) diff --git a/sys/netinet/libalias/alias_smedia.c b/sys/netinet/libalias/alias_smedia.c index badd75a45c61..cbfe30940596 100644 --- a/sys/netinet/libalias/alias_smedia.c +++ b/sys/netinet/libalias/alias_smedia.c @@ -104,8 +104,9 @@ #include #include #else -#include #include +#include +#include #include #include #endif @@ -128,9 +129,9 @@ #define RTSP_CONTROL_PORT_NUMBER_2 7070 #define TFTP_PORT_NUMBER 69 -static void -AliasHandleRtspOut(struct libalias *, struct ip *, struct alias_link *, - int maxpacketsize); +static void AliasHandleRtspOut(struct libalias *, struct ip *, + struct alias_link *, size_t); + static int fingerprint(struct libalias *la, struct alias_data *ah) { @@ -154,7 +155,8 @@ protohandler(struct libalias *la, struct ip *pip, struct alias_data *ah) if (ntohs(*ah->dport) == TFTP_PORT_NUMBER) FindRtspOut(la, pip->ip_src, pip->ip_dst, *ah->sport, *ah->aport, IPPROTO_UDP); - else AliasHandleRtspOut(la, pip, ah->lnk, ah->maxpktsize); + else + AliasHandleRtspOut(la, pip, ah->lnk, ah->maxpktsize); return (0); } @@ -208,13 +210,15 @@ MODULE_DEPEND(alias_smedia, libalias, 1, 1, 1); #define ISDIGIT(a) (((a) >= '0') && ((a) <= '9')) -static int -search_string(char *data, int dlen, const char *search_str) +static ssize_t +search_string(char *data, size_t dlen, const char *search_str) { - int i, j, k; - int search_str_len; + size_t i, j, k; + size_t search_str_len; search_str_len = strlen(search_str); + if (search_str_len > dlen) + return (-1); for (i = 0; i < dlen - search_str_len; i++) { for (j = i, k = 0; j < dlen - search_str_len; j++, k++) { if (data[j] != search_str[k] && @@ -230,18 +234,21 @@ search_string(char *data, int dlen, const char *search_str) static int alias_rtsp_out(struct libalias *la, struct ip *pip, struct alias_link *lnk, - char *data, + char *data, size_t maxlen, const char *port_str) { - int hlen, tlen, dlen; + size_t hlen, tlen, dlen; + size_t i, j; struct tcphdr *tc; - int i, j, pos, state, port_dlen, new_dlen, delta; + int delta, state; + ssize_t pos, slen; + size_t new_dlen, port_dlen, port_slen; u_short p[2], new_len; u_short sport, eport, base_port; u_short salias = 0, ealias = 0, base_alias = 0; const char *transport_str = "transport:"; - char newdata[2048], *port_data, *port_newdata, stemp[80]; - int links_created = 0, pkt_updated = 0; + char *newdata, *port_data; + bool links_created = false, pkt_updated = false; struct alias_link *rtsp_lnk = NULL; struct in_addr null_addr; @@ -250,6 +257,9 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, hlen = (pip->ip_hl + tc->th_off) << 2; tlen = ntohs(pip->ip_len); dlen = tlen - hlen; + if (hlen > tlen || tlen > maxlen) + return (-1); + port_slen = strlen(port_str); /* Find keyword, "Transport: " */ pos = search_string(data, dlen, transport_str); @@ -259,17 +269,21 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, port_data = data + pos; port_dlen = dlen - pos; + /* Allocate temporary buffer */ + maxlen -= hlen; + if ((newdata = malloc(maxlen)) == NULL) + return (-1); memcpy(newdata, data, pos); - port_newdata = newdata + pos; + new_dlen = pos; - while (port_dlen > (int)strlen(port_str)) { + while (port_dlen > port_slen) { /* Find keyword, appropriate port string */ pos = search_string(port_data, port_dlen, port_str); - if (pos < 0) + if (pos < 0 || (size_t)pos + 1 > maxlen - new_dlen) break; - memcpy(port_newdata, port_data, pos + 1); - port_newdata += (pos + 1); + memcpy(newdata + new_dlen, port_data, pos + 1); + new_dlen += pos + 1; p[0] = p[1] = 0; sport = eport = 0; @@ -300,7 +314,7 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, eport = htons(p[1]); if (!links_created) { - links_created = 1; + links_created = true; /* * Find an even numbered port * number base that satisfies the @@ -349,24 +363,30 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, ealias = htons(base_alias + (RTSP_PORT_GROUP - 1)); } if (salias && rtsp_lnk) { - pkt_updated = 1; + pkt_updated = true; /* Copy into IP packet */ - sprintf(stemp, "%d", ntohs(salias)); - memcpy(port_newdata, stemp, strlen(stemp)); - port_newdata += strlen(stemp); + slen = snprintf(newdata + new_dlen, + maxlen - new_dlen, "%d", ntohs(salias)); + if (slen < 0 || slen >= maxlen - new_dlen) + goto fail; + new_dlen += slen; if (eport != 0) { - *port_newdata = '-'; - port_newdata++; + if (new_dlen == maxlen) + goto fail; + newdata[new_dlen++] = '-'; /* Copy into IP packet */ - sprintf(stemp, "%d", ntohs(ealias)); - memcpy(port_newdata, stemp, strlen(stemp)); - port_newdata += strlen(stemp); + slen = snprintf(newdata + new_dlen, + maxlen - new_dlen, "%d", ntohs(ealias)); + if (slen < 0 || slen >= maxlen - new_dlen) + goto fail; + new_dlen += slen; } - *port_newdata = ';'; - port_newdata++; + if (new_dlen == maxlen) + goto fail; + newdata[new_dlen++] = ';'; } state++; break; @@ -380,20 +400,20 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, } if (!pkt_updated) - return (-1); - - memcpy(port_newdata, port_data, port_dlen); - port_newdata += port_dlen; - *port_newdata = '\0'; + goto fail; /* Create new packet */ - new_dlen = port_newdata - newdata; + if (new_dlen + port_dlen > maxlen) + goto fail; + memmove(data + new_dlen, port_data, port_dlen); memcpy(data, newdata, new_dlen); + new_dlen += port_dlen; + free(newdata); SetAckModified(lnk); tc = (struct tcphdr *)ip_next(pip); delta = GetDeltaSeqOut(tc->th_seq, lnk); - AddSeq(lnk, delta + new_dlen - dlen, pip->ip_hl, pip->ip_len, + AddSeq(lnk, delta + (int)(new_dlen - dlen), pip->ip_hl, pip->ip_len, tc->th_seq, tc->th_off); new_len = htons(hlen + new_dlen); @@ -407,6 +427,9 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, tc->th_sum = TcpChecksum(pip); #endif return (0); +fail: + free(newdata); + return (-1); } /* Support the protocol used by early versions of RealPlayer */ @@ -415,13 +438,13 @@ static int alias_pna_out(struct libalias *la, struct ip *pip, struct alias_link *lnk, char *data, - int dlen) + size_t dlen) { struct alias_link *pna_links; - u_short msg_id, msg_len; char *work; - u_short alias_port, port; struct tcphdr *tc; + u_short msg_id, msg_len; + u_short alias_port, port; work = data; work += 5; @@ -433,7 +456,7 @@ alias_pna_out(struct libalias *la, struct ip *pip, if (ntohs(msg_id) == 0) /* end of options */ return (0); - if ((ntohs(msg_id) == 1) || (ntohs(msg_id) == 7)) { + if (ntohs(msg_id) == 1 || ntohs(msg_id) == 7) { memcpy(&port, work, 2); (void)FindUdpTcpOut(la, pip->ip_src, GetDestAddress(lnk), port, 0, IPPROTO_UDP, 1, &pna_links); @@ -462,22 +485,23 @@ alias_pna_out(struct libalias *la, struct ip *pip, } static void -AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, int maxpacketsize) +AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, + size_t maxlen) { - int hlen, tlen, dlen; struct tcphdr *tc; char *data; const char *setup = "SETUP", *pna = "PNA", *str200 = "200"; const char *okstr = "OK", *client_port_str = "client_port"; const char *server_port_str = "server_port"; - int i, parseOk; - - (void)maxpacketsize; + size_t hlen, tlen, dlen; + size_t i; tc = (struct tcphdr *)ip_next(pip); hlen = (pip->ip_hl + tc->th_off) << 2; tlen = ntohs(pip->ip_len); dlen = tlen - hlen; + if (hlen > tlen || tlen > maxlen) + return; data = (char *)pip; data += hlen; @@ -485,13 +509,14 @@ AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, /* When aliasing a client, check for the SETUP request */ if ((ntohs(tc->th_dport) == RTSP_CONTROL_PORT_NUMBER_1) || (ntohs(tc->th_dport) == RTSP_CONTROL_PORT_NUMBER_2)) { - if (dlen >= (int)strlen(setup) && + if (dlen >= strlen(setup) && memcmp(data, setup, strlen(setup)) == 0) { - alias_rtsp_out(la, pip, lnk, data, client_port_str); + alias_rtsp_out(la, pip, lnk, data, maxlen, + client_port_str); return; } - if (dlen >= (int)strlen(pna) && + if (dlen >= strlen(pna) && memcmp(data, pna, strlen(pna)) == 0) alias_pna_out(la, pip, lnk, data, dlen); } else { @@ -499,24 +524,21 @@ AliasHandleRtspOut(struct libalias *la, struct ip *pip, struct alias_link *lnk, * When aliasing a server, check for the 200 reply * Accommodate varying number of blanks between 200 & OK */ - - if (dlen >= (int)strlen(str200)) { - for (parseOk = 0, i = 0; - i <= dlen - (int)strlen(str200); - i++) - if (memcmp(&data[i], str200, strlen(str200)) == 0) { - parseOk = 1; - break; - } - - if (parseOk) { - i += strlen(str200); /* skip string found */ - while (data[i] == ' ') /* skip blank(s) */ + if (dlen < strlen(str200) + 1 + strlen(okstr)) + return; + for (i = 0; i <= dlen - strlen(str200) - 1; i++) { + if (memcmp(&data[i], str200, strlen(str200)) == 0 && + data[i + strlen(str200)] == ' ') { + i += strlen(str200); /* skip 200 */ + while (i < dlen && data[i] == ' ') /* skip blank(s) */ i++; - - if ((dlen - i) >= (int)strlen(okstr)) - if (memcmp(&data[i], okstr, strlen(okstr)) == 0) - alias_rtsp_out(la, pip, lnk, data, server_port_str); + if (dlen - i >= strlen(okstr)) { + if (memcmp(&data[i], okstr, strlen(okstr)) == 0) { + alias_rtsp_out(la, pip, lnk, data, + maxlen, server_port_str); + break; + } + } } } } From nobody Tue Jun 30 17:21:56 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLr61Qzz6jZ5R for ; Tue, 30 Jun 2026 17:21:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLr37nXz3skX for ; Tue, 30 Jun 2026 17:21:56 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840116; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OIZxweCFVBi8Uj4EHYoZiMP9snYIoz0lAtPp1K/d57I=; b=A3Oj9dY1ZKDaQFizjcxb9Eu4cktPxnKZ79fUNVf3KNECWQYUG+g4X8iHfFb75MRF5mT0Kc ybTwnMxL4IgQvKX6Smmt/27QvdutIeD1GmXGCX9Z1xOLVMs3hLjmDaZTdSFvFG9wGWcJVd OyRHQ3XnuCLXJ0ZuvHUFCOogdKaIsWmV6n+JVP2QvkK8Te1x27hGcevF30x/VHZokPGJog sd5BLZB/v2kiOFwnXkSXqkDoU7jdc96mBxf0gXMlb9NPMCEVMc0ggiNU9+ou3TZg9jPyrN PNbmNjhIYbwY6o3zn793LjGKn3w54ZSv2mYtOeEWS9eCey63uyPqUh7rmSpR1A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840116; a=rsa-sha256; cv=none; b=I0iWL3mVskFkUJk8tQdN1ONrceJvBCM3l7RqKhrK+c1MClu2WlvtRq6mEeL95ogq79Mepg 6TVs3hRiVAQrBrBSd7ZUboSgjyOkrLVRsp6qYFL/oRE6WX9Sehq+XEzUKAk5/ki82aHeVs 48e4X1j+xVPWOFBJT9gxD0uP35ihM8M+Eu/oxw7SNGDg2kUOgH2hGsiq68SE/+0h9L/OW3 8QKim4SOAlge7e61I4ZHMw9i82ESstdyHyPa3EaIokEq8PlqWg9w5W9BS5I6BldNTWHzNW KNcBQ4IpNFfPqVLIFM+FD9gJaunv1ZEpV6I//WP2qy5YDNA1CNKWUJ6zoBZ8Wg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840116; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OIZxweCFVBi8Uj4EHYoZiMP9snYIoz0lAtPp1K/d57I=; b=MckX32rX9Omqdz53dusHVm6rlze+3SM+w9UY2MxotwF7ASOoQNmm2b+/pu42G++mAoh7qv qYc2CHXSrOnBqXOURRPieXgjuYgQq63jeciW9JJUHrYkAC70sAhznmR7QXElnmk6S22dnI mW+FhLS5+vwj3oFs0WUxto/hp2LzRj/A3WmdZ1gNc+bMxfPBJYXOAgQV6Eka7eGt0U04Rd /3qFeiDOhFuOGPbY/p3DTwKK9LhqtoRvjvAPOqubZSbrXk3N06iRw6bCHb6JzDaLRnt49s 00Q7d4bA9S2vF7k2sICwFyft5v6+L6zQauucFBa/fsujkBDBqqH9NJei8SFrRw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLr1rQnzt0b for ; Tue, 30 Jun 2026 17:21:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45c45 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:56 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 7eeab0afea4d - releng/15.1 - zfs: Roll up several upstream commits List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 7eeab0afea4d3b76f35b76e7b389b317b30c16a8 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:56 +0000 Message-Id: <6a43fb34.45c45.73fb0d9f@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=7eeab0afea4d3b76f35b76e7b389b317b30c16a8 commit 7eeab0afea4d3b76f35b76e7b389b317b30c16a8 Author: Mark Johnston AuthorDate: 2026-06-28 22:00:31 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:40 +0000 zfs: Roll up several upstream commits This commit squashes the following upstream commits: #18604 63a0ff6cd nvpair: Check for un-terminated strings in packed nvlist #18617 38cd6adcb Extend dataset zfs_ioc_set_prop() secpolicy #18615 738791027 Fix the integer type in zfs_ioc_userspace_many() #18623 06d8cfedb Add additional verification of size fields and strings Approved by: so Security: FreeBSD-SA-26:40.zfs Security: CVE-2026-49429 Security: CVE-2026-49430 Security: CVE-2026-49431 --- sys/contrib/openzfs/module/nvpair/nvpair.c | 49 ++++-- sys/contrib/openzfs/module/zfs/dmu_recv.c | 44 ++++-- sys/contrib/openzfs/module/zfs/vdev_label.c | 1 + sys/contrib/openzfs/module/zfs/zfs_ioctl.c | 34 +++- sys/contrib/openzfs/module/zfs/zfs_quota.c | 8 +- .../tests/zfs-tests/cmd/libzfs_input_check.c | 172 ++++++++++++++++++++- 6 files changed, 272 insertions(+), 36 deletions(-) diff --git a/sys/contrib/openzfs/module/nvpair/nvpair.c b/sys/contrib/openzfs/module/nvpair/nvpair.c index 07ac102145e2..52678bb2badb 100644 --- a/sys/contrib/openzfs/module/nvpair/nvpair.c +++ b/sys/contrib/openzfs/module/nvpair/nvpair.c @@ -135,7 +135,8 @@ #define NVP_SIZE_CALC(name_len, data_len) \ (NV_ALIGN((sizeof (nvpair_t)) + name_len) + NV_ALIGN(data_len)) -static int i_get_value_size(data_type_t type, const void *data, uint_t nelem); +static int i_get_value_size(data_type_t type, const void *data, uint_t nelem, + size_t max_size); static int nvlist_add_common(nvlist_t *nvl, const char *name, data_type_t type, uint_t nelem, const void *data); @@ -810,8 +811,10 @@ i_validate_nvpair(nvpair_t *nvp) * verify nvp_type, nvp_value_elem, and also possibly * verify string values and get the value size. */ - size2 = i_get_value_size(type, NVP_VALUE(nvp), NVP_NELEM(nvp)); size1 = nvp->nvp_size - NVP_VALOFF(nvp); + size2 = i_get_value_size(type, NVP_VALUE(nvp), NVP_NELEM(nvp), + size1); + if (size2 < 0 || size1 != NV_ALIGN(size2)) return (EFAULT); @@ -1002,12 +1005,21 @@ nvlist_remove_nvpair(nvlist_t *nvl, nvpair_t *nvp) * DATA_TYPE_STRING and * DATA_TYPE_STRING_ARRAY * Is data == NULL then the size of the string(s) is excluded. + * + * If 'max_size' is non-zero, then don't look beyond 'max_size' number of + * bytes when calculating a value size. Note that 'max_size' should include + * the NULL terminator byte when calculating string size. If 'max_size' is 0, + * it is ignored. */ static int -i_get_value_size(data_type_t type, const void *data, uint_t nelem) +i_get_value_size(data_type_t type, const void *data, uint_t nelem, + size_t max_size) { uint64_t value_sz; + if (max_size == 0) + max_size = INT32_MAX; + if (i_validate_type_nelem(type, nelem) != 0) return (-1); @@ -1052,10 +1064,15 @@ i_get_value_size(data_type_t type, const void *data, uint_t nelem) break; #endif case DATA_TYPE_STRING: - if (data == NULL) + if (data == NULL) { value_sz = 0; - else - value_sz = strlen(data) + 1; + } else { + value_sz = strnlen(data, max_size); + if (value_sz >= max_size) { + return (-1); /* string not terminated */ + } + value_sz += 1; + } break; case DATA_TYPE_BOOLEAN_ARRAY: value_sz = (uint64_t)nelem * sizeof (boolean_t); @@ -1089,16 +1106,23 @@ i_get_value_size(data_type_t type, const void *data, uint_t nelem) break; case DATA_TYPE_STRING_ARRAY: value_sz = (uint64_t)nelem * sizeof (uint64_t); - if (data != NULL) { char *const *strs = data; uint_t i; + size_t newsize; /* no alignment requirement for strings */ for (i = 0; i < nelem; i++) { if (strs[i] == NULL) return (-1); - value_sz += strlen(strs[i]) + 1; + + newsize = strnlen(strs[i], max_size); + + if (newsize == max_size) + return (-1); /* not terminated */ + + value_sz += newsize + 1; /* +1 for NULL */ + max_size -= newsize + 1; } } break; @@ -1163,7 +1187,7 @@ nvlist_add_common(nvlist_t *nvl, const char *name, * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) included. */ - if ((value_sz = i_get_value_size(type, data, nelem)) < 0) + if ((value_sz = i_get_value_size(type, data, nelem, 0)) < 0) return (EINVAL); if (i_validate_nvpair_value(type, nelem, data) != 0) @@ -1588,7 +1612,7 @@ nvpair_value_common(const nvpair_t *nvp, data_type_t type, uint_t *nelem, #endif if (data == NULL) return (EINVAL); - if ((value_sz = i_get_value_size(type, NULL, 1)) < 0) + if ((value_sz = i_get_value_size(type, NULL, 1, 0)) < 0) return (EINVAL); memcpy(data, NVP_VALUE(nvp), (size_t)value_sz); if (nelem != NULL) @@ -3019,7 +3043,8 @@ nvs_native_nvp_op(nvstream_t *nvs, nvpair_t *nvp) * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) excluded. */ - if ((value_sz = i_get_value_size(type, NULL, NVP_NELEM(nvp))) < 0) + if ((value_sz = i_get_value_size(type, NULL, NVP_NELEM(nvp), + NVP_SIZE(nvp))) < 0) return (EFAULT); if (NVP_SIZE_CALC(nvp->nvp_name_sz, value_sz) > nvp->nvp_size) @@ -3333,7 +3358,7 @@ nvs_xdr_nvp_op(nvstream_t *nvs, nvpair_t *nvp) * In case of data types DATA_TYPE_STRING and DATA_TYPE_STRING_ARRAY * is the size of the string(s) excluded. */ - if ((value_sz = i_get_value_size(type, NULL, nelem)) < 0) + if ((value_sz = i_get_value_size(type, NULL, nelem, NVP_SIZE(nvp)) < 0)) return (EFAULT); /* if there is no data to extract then return */ diff --git a/sys/contrib/openzfs/module/zfs/dmu_recv.c b/sys/contrib/openzfs/module/zfs/dmu_recv.c index fa18a2056bbc..74874bb65d37 100644 --- a/sys/contrib/openzfs/module/zfs/dmu_recv.c +++ b/sys/contrib/openzfs/module/zfs/dmu_recv.c @@ -2901,16 +2901,20 @@ receive_read_record(dmu_recv_cookie_t *drc) { struct drr_object *drro = &drc->drc_rrd->header.drr_u.drr_object; - uint32_t size = DRR_OBJECT_PAYLOAD_SIZE(drro); + uint32_t size; void *buf = NULL; dmu_object_info_t doi; + size = DRR_OBJECT_PAYLOAD_SIZE(drro); + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + if (size != 0) - buf = kmem_zalloc(size, KM_SLEEP); + buf = vmem_zalloc(size, KM_SLEEP); err = receive_read_payload_and_next_header(drc, size, buf); if (err != 0) { - kmem_free(buf, size); + vmem_free(buf, size); return (err); } err = dmu_object_info(drc->drc_os, drro->drr_object, &doi); @@ -2934,7 +2938,11 @@ receive_read_record(dmu_recv_cookie_t *drc) case DRR_WRITE: { struct drr_write *drrw = &drc->drc_rrd->header.drr_u.drr_write; - int size = DRR_WRITE_PAYLOAD_SIZE(drrw); + uint64_t size = DRR_WRITE_PAYLOAD_SIZE(drrw); + + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + abd_t *abd = abd_alloc_linear(size, B_FALSE); err = receive_read_payload_and_next_header(drc, size, abd_to_buf(abd)); @@ -2951,12 +2959,18 @@ receive_read_record(dmu_recv_cookie_t *drc) { struct drr_write_embedded *drrwe = &drc->drc_rrd->header.drr_u.drr_write_embedded; - uint32_t size = P2ROUNDUP(drrwe->drr_psize, 8); - void *buf = kmem_zalloc(size, KM_SLEEP); + uint32_t size; + void *buf; + + size = P2ROUNDUP(drrwe->drr_psize, 8); + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + + buf = vmem_zalloc(size, KM_SLEEP); err = receive_read_payload_and_next_header(drc, size, buf); if (err != 0) { - kmem_free(buf, size); + vmem_free(buf, size); return (err); } @@ -2985,7 +2999,11 @@ receive_read_record(dmu_recv_cookie_t *drc) case DRR_SPILL: { struct drr_spill *drrs = &drc->drc_rrd->header.drr_u.drr_spill; - int size = DRR_SPILL_PAYLOAD_SIZE(drrs); + uint64_t size = DRR_SPILL_PAYLOAD_SIZE(drrs); + + if (size > SPA_MAXBLOCKSIZE) + return (SET_ERROR(ERANGE)); + abd_t *abd = abd_alloc_linear(size, B_FALSE); err = receive_read_payload_and_next_header(drc, size, abd_to_buf(abd)); @@ -3136,7 +3154,7 @@ receive_process_record(struct receive_writer_arg *rwa, abd_free(rrd->abd); rrd->abd = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } return (0); @@ -3150,7 +3168,7 @@ receive_process_record(struct receive_writer_arg *rwa, rrd->abd = NULL; rrd->payload = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } @@ -3163,7 +3181,7 @@ receive_process_record(struct receive_writer_arg *rwa, { struct drr_object *drro = &rrd->header.drr_u.drr_object; err = receive_object(rwa, drro, rrd->payload); - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; break; } @@ -3201,7 +3219,7 @@ receive_process_record(struct receive_writer_arg *rwa, struct drr_write_embedded *drrwe = &rrd->header.drr_u.drr_write_embedded; err = receive_write_embedded(rwa, drrwe, rrd->payload); - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; break; } @@ -3270,7 +3288,7 @@ receive_writer_thread(void *arg) rrd->abd = NULL; rrd->payload = NULL; } else if (rrd->payload != NULL) { - kmem_free(rrd->payload, rrd->payload_size); + vmem_free(rrd->payload, rrd->payload_size); rrd->payload = NULL; } /* diff --git a/sys/contrib/openzfs/module/zfs/vdev_label.c b/sys/contrib/openzfs/module/zfs/vdev_label.c index 16ba09c6f295..60c2e265c198 100644 --- a/sys/contrib/openzfs/module/zfs/vdev_label.c +++ b/sys/contrib/openzfs/module/zfs/vdev_label.c @@ -1371,6 +1371,7 @@ vdev_label_read_bootenv(vdev_t *rvd, nvlist_t *bootenv) VB_NVLIST); break; } + vbe->vbe_bootenv[sizeof (vbe->vbe_bootenv) - 1] = '\0'; fnvlist_add_string(bootenv, FREEBSD_BOOTONCE, buf); } diff --git a/sys/contrib/openzfs/module/zfs/zfs_ioctl.c b/sys/contrib/openzfs/module/zfs/zfs_ioctl.c index 4fcfd18e5005..88ae044573b7 100644 --- a/sys/contrib/openzfs/module/zfs/zfs_ioctl.c +++ b/sys/contrib/openzfs/module/zfs/zfs_ioctl.c @@ -937,6 +937,23 @@ zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr) ZFS_DELEG_PERM_CREATE, cr)); } +/* + * Policy for dataset set property operations. Individual properties checked by + * zfs_check_settable(), additionally require zfs_secpolicy_recv() when setting + * properties as part of a receive. + */ +static int +zfs_secpolicy_setprops(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr) +{ + boolean_t received = zc->zc_cookie; + int error; + + if (received && (error = zfs_secpolicy_recv(zc, innvl, cr))) + return (error); + + return (zfs_secpolicy_read(zc, innvl, cr)); +} + int zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr) { @@ -3884,7 +3901,6 @@ static int zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl) { (void) unused, (void) outnvl; - const char *message; char *poolname; spa_t *spa; int error; @@ -3905,7 +3921,7 @@ zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl) if (error != 0) return (error); - message = fnvlist_lookup_string(innvl, "message"); + const char *message = fnvlist_lookup_string(innvl, "message"); if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) { spa_close(spa, FTAG); @@ -6365,21 +6381,27 @@ zfs_ioc_userspace_one(zfs_cmd_t *zc) * outputs: * zc_nvlist_dst[_size] data buffer (array of zfs_useracct_t) * zc_cookie zap cursor + * + * The zc_nvlist_dst output array is limited to 1000 entries. */ static int zfs_ioc_userspace_many(zfs_cmd_t *zc) { + const size_t batch_limit = 1000 * sizeof (zfs_useracct_t); + uint64_t bufsize = MIN(zc->zc_nvlist_dst_size, batch_limit); zfsvfs_t *zfsvfs; - int bufsize = zc->zc_nvlist_dst_size; - if (bufsize <= 0) + if (bufsize < sizeof (zfs_useracct_t)) { + zc->zc_nvlist_dst_size = sizeof (zfs_useracct_t); return (SET_ERROR(ENOMEM)); + } int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE); if (error != 0) return (error); void *buf = vmem_alloc(bufsize, KM_SLEEP); + zc->zc_nvlist_dst_size = bufsize; error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie, buf, &zc->zc_nvlist_dst_size, &zc->zc_guid); @@ -6870,7 +6892,7 @@ zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl) dsl_pool_t *dp; dsl_dataset_t *new, *old; const char *firstsnap; - uint64_t used, comp, uncomp; + uint64_t used = 0, comp = 0, uncomp = 0; firstsnap = fnvlist_lookup_string(innvl, "firstsnap"); @@ -7757,7 +7779,7 @@ zfs_ioctl_init(void) zfs_ioc_send, zfs_secpolicy_send); zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop, - zfs_secpolicy_none); + zfs_secpolicy_setprops); zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy, zfs_secpolicy_destroy); zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename, diff --git a/sys/contrib/openzfs/module/zfs/zfs_quota.c b/sys/contrib/openzfs/module/zfs/zfs_quota.c index 85b7a549b9a9..0b51f8669cb4 100644 --- a/sys/contrib/openzfs/module/zfs/zfs_quota.c +++ b/sys/contrib/openzfs/module/zfs/zfs_quota.c @@ -86,10 +86,14 @@ zpl_get_file_info(dmu_object_type_t bonustype, const void *data, sa.sa_layout_info = BSWAP_16(sa.sa_layout_info); swap = B_TRUE; } - VERIFY3U(sa.sa_magic, ==, SA_MAGIC); + + if (unlikely(sa.sa_magic != SA_MAGIC)) + return (SET_ERROR(EINVAL)); int hdrsize = sa_hdrsize(&sa); - VERIFY3U(hdrsize, >=, sizeof (sa_hdr_phys_t)); + + if (unlikely(hdrsize < sizeof (sa_hdr_phys_t))) + return (SET_ERROR(EINVAL)); uintptr_t data_after_hdr = (uintptr_t)data + hdrsize; zoi->zfi_user = *((uint64_t *)(data_after_hdr + SA_UID_OFFSET)); diff --git a/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c b/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c index 4ef249bbd4a1..8f7e36d9efa7 100644 --- a/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c +++ b/sys/contrib/openzfs/tests/zfs-tests/cmd/libzfs_input_check.c @@ -85,7 +85,6 @@ static const zfs_ioc_t ioc_skip[] = { ZFS_IOC_DSOBJ_TO_DSNAME, ZFS_IOC_OBJ_TO_PATH, ZFS_IOC_POOL_SET_PROPS, - ZFS_IOC_POOL_GET_PROPS, ZFS_IOC_SET_FSACL, ZFS_IOC_GET_FSACL, ZFS_IOC_SHARE, @@ -125,11 +124,136 @@ static const zfs_ioc_t ioc_skip[] = { lzc_ioctl_test(ioc, name, req, opt, err, wild); \ } while (0) +#define IOC_INPUT_TEST_INJECT(ioc, name, innvl) \ + do { \ + active_test = __func__ + 5; \ + lzc_ioctl_run_impl(ioc, name, innvl, 0, B_TRUE); \ + } while (0) + +/* + * Given a zfs_cmd_t containing an already packed nvlist in zc->zc_nvlist_src, + * and its original innvl, look in innvl for the last string nvpair, or last + * string array nvpair, and remove the string terminator. The idea is to + * corrupt the nvlist string value so that anyone doing a strlen() on it will + * read past the end of the packed nvlist buffer and trigger a crash. + */ +static void +do_bad_string(zfs_cmd_t *zc, nvlist_t *innvl) +{ + nvpair_t *elem = NULL; + nvpair_t *lastseen = NULL; + const char *str = NULL; + const char **arr; + uint_t n; + char *off; + char *packed; + uint64_t size, off_size; + + while ((elem = nvlist_next_nvpair(innvl, elem)) != NULL) { + if ((nvpair_type(elem) == DATA_TYPE_STRING) || + (nvpair_type(elem) == DATA_TYPE_STRING_ARRAY)) + lastseen = elem; + } + + if (lastseen == NULL) + return; /* No strings */ + + /* + * Lookup either the last string, or the last string in the last + * string array in the nvlist. We will use this to corrupt from the + * string to the end of the nvlist buffer. Any attempts to strlen this + * string should run pass the end of the packed buffer. + */ + if (nvpair_value_string(lastseen, &str) != 0) { + if (nvpair_value_string_array(lastseen, &arr, &n) == 0) + str = arr[n-1]; + } + + /* + * We now have the last string. Corrupt everything from the NULL + * terminator byte for the last string to the end of the packed nvlist + * buffer. + */ + packed = (char *)zc->zc_nvlist_src; + size = zc->zc_nvlist_src_size; + + off = memmem(packed, size, str, strlen(str)); + off_size = strlen(str); + + memset(&off[off_size - 1], '!', (packed + size) - + (&off[off_size - 1])); + +} + +/* + * For each byte in the packed nvlist list in zc, corrupt a single byte, then + * try doing the ioctl. This tests how well the kernel handles fuzzed nvlists. + * + * NOTE - make sure you are doing this with a "safe" ioctl! You don't want to + * run this on an ioctl that can potentially corrupt data (like a zpool create). + */ +static void +do_fuzz(int zfs_fd, zfs_ioc_t ioc, zfs_cmd_t *zc) +{ + uint64_t size; + uint64_t i; + unsigned char old = 0; + unsigned char *pos; + zfs_cmd_t orig_zc = *zc; + + pos = (unsigned char *) zc->zc_nvlist_src; + size = zc->zc_nvlist_src_size; + + /* + * Fuzz each byte in the packed nvlist, one byte at a time, and do the + * ioctl. If the kernel doesn't crash, then the test passed. + */ + for (i = 0; i < size; i++) { + /* Restore the previously corrupted byte */ + if (i > 0) + pos[i-1] = old; + + old = pos[i]; + + /* Corrupt the new byte */ + pos[i]++; + + /* + * Do the ioctl and ignore the return code. We just want to + * see if the kernel panics. + */ + lzc_ioctl_fd(zfs_fd, ioc, zc); + + /* + * Restore 'zc' with original fields since the ioctl may + * have modified them. + */ + *zc = orig_zc; + } + /* Restore last byte */ + if (i > 0) + pos[i - 1] = old; + + /* + * Try fuzzing the packed nvlist size field. Test it with one byte + * bigger and one byte smaller than the current value. + */ + zc->zc_nvlist_src_size--; + lzc_ioctl_fd(zfs_fd, ioc, zc); + + zc->zc_nvlist_src_size += 2; + lzc_ioctl_fd(zfs_fd, ioc, zc); + + /* Restore to normal */ + zc->zc_nvlist_src_size -= 1; +} + /* * run a zfs ioctl command, verify expected results and log failures */ static void -lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) +lzc_ioctl_run_impl(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, + int expected, boolean_t do_corrupt) { zfs_cmd_t zc = {"\0"}; char *packed = NULL; @@ -160,10 +284,30 @@ lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) zc.zc_nvlist_dst_size = MAX(size * 2, 128 * 1024); zc.zc_nvlist_dst = (uint64_t)(uintptr_t)malloc(zc.zc_nvlist_dst_size); + if (do_corrupt) { + /* + * Try changing bytes in the packed nvlist to see if it will + * panic the kernel when you do the ioctl. + */ + do_fuzz(zfs_fd, ioc, &zc); + + /* + * Corrupt the last string in the packed nvlist so it has no + * NULL terminator. + */ + do_bad_string(&zc, innvl); + + } + if (lzc_ioctl_fd(zfs_fd, ioc, &zc) != 0) error = errno; - if (error != expected) { + /* + * If we're corrupting the nvlist we don't care about the specific + * error code that gets returned, as it could be one of many. We only + * care if it panics the kernel. + */ + if (!do_corrupt && error != expected) { unexpected_failures = B_TRUE; (void) fprintf(stderr, "%s: Unexpected result with %s, " "error %d (expecting %d)\n", @@ -174,6 +318,12 @@ lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) free((void *)(uintptr_t)zc.zc_nvlist_dst); } +static void +lzc_ioctl_run(zfs_ioc_t ioc, const char *name, nvlist_t *innvl, int expected) +{ + return (lzc_ioctl_run_impl(ioc, name, innvl, expected, B_FALSE)); +} + /* * Test each ioc for the following ioctl input errors: * ZFS_ERR_IOC_ARG_UNAVAIL an input argument is not supported by kernel @@ -310,6 +460,7 @@ test_log_history(const char *pool) fnvlist_add_string(required, "message", "input check"); IOC_INPUT_TEST(ZFS_IOC_LOG_HISTORY, pool, required, NULL, 0); + IOC_INPUT_TEST_INJECT(ZFS_IOC_LOG_HISTORY, pool, required); nvlist_free(required); } @@ -791,6 +942,20 @@ test_set_bootenv(const char *pool) nvlist_free(required); } +static void +test_zpool_get(const char *pool) +{ + const char *strs[] = {ZPOOL_DEDUPCACHED_PROP_NAME}; + nvlist_t *optional = fnvlist_alloc(); + + fnvlist_add_string_array(optional, ZPOOL_GET_PROPS_NAMES, strs, 1); + + IOC_INPUT_TEST(ZFS_IOC_POOL_GET_PROPS, pool, NULL, optional, 0); + IOC_INPUT_TEST_INJECT(ZFS_IOC_POOL_GET_PROPS, pool, optional); + + nvlist_free(optional); +} + static void zfs_ioc_input_tests(const char *pool) { @@ -885,6 +1050,7 @@ zfs_ioc_input_tests(const char *pool) test_scrub(pool); + test_zpool_get(pool); /* * cleanup */ From nobody Tue Jun 30 17:21:59 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLw3Fmgz6jYp7 for ; Tue, 30 Jun 2026 17:22:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLv4mh8z3svQ for ; Tue, 30 Jun 2026 17:21:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840119; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dXlkIGTsKUzlDn9mJE+o9cZvrBmIacPVy5L4mzBApVg=; b=h3YjEXfMr5wCTN6fgh1GEN6/Fx+cU1FSZSP77ZiGMCnFT0gXn8zoiTZy1lXWLrOGjUH337 CSpm5a7uV4QFTxcQBji7lIVufL6O7OK7MpWlvdBcmYHVYxRaLwUyjJN94REtiwzwr+bE6m DUHaXXKxIVajP7ZsIJeITaOcS4ruIjR/BPrpdn01q4nV3o7jv89Ye4fHl+690WxdlYdJdt YWsDhPzjJyzlr4HeAyVv1chD4sSpMMvE2UQGBmqSttDzf36feVVJzDvodyqAFZ7nqEJ1ms Fvpqj6/+Rpav5apRBXCm5lJeOlDyPz5564BVIs1ttXqS3hoMW0d/9vtHcOqMrA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840119; a=rsa-sha256; cv=none; b=DJPU4cXMxlhvpG38QahpEJDH8t1KK9gDd4Ile3pdKhGnN9NajPDd0MzHO/AWHRJhwTH3Fn MTdkVdhqdYlESlr4i374E+KpcANsbxNotHyqL8oT8WaVX5PArFlc7G9SHFK93dyhzDhgS8 qudKm3e6MvUDydY9Sl7DjDLNnj8Pp+jiJAtfIqLgSfh7Q42wXlLoGdSOjJvjtX2vc8Nyl2 kRimZS2xaE/WivOep4eA1MwgHjt5DpUFLRg2MAem4bGJhPmQKKNc1pdJAIOIn00kl/kRVp X1VMPkmFTGgERJaXvGEQo9ignCb3AT9q1Nk6nkH9ognZs+7Vml6JNw01R3cQxw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840119; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dXlkIGTsKUzlDn9mJE+o9cZvrBmIacPVy5L4mzBApVg=; b=fenrXabU74OiXTuhiKGLif6ZM4NRkcrVtiGDy9j0BbOE8AZY/Stv7OqnKqigwwvWFfYhYz nhTsn2nBGZkFPrw5WPbAeMK4jlAlke7HN71zd5BlqD7Aq4atej9fqem8OMCdrvOz1cvHtQ s8gsoPJzA22273+ga7Xf2XNSDh0UxG2R/X5Ixotw1VP9Ep6/pfx4Gm5MFzGT3dM0/6q6HI BwKxCkyQjhx83FvgX46yBnfUPumsFZjwPwJPWnuQWfpIe1Oi9fT7g2HYjZNneWpAmJ0DiN wTbux3PYN4V5ReBnhC3B1eZhfr60RXNCI4XQGkhelBAG3ignZMKtwVwr7ysH/g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLv3dNXztsr for ; Tue, 30 Jun 2026 17:21:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4587d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 63a8e7bc0412 - releng/15.1 - unlinkat: Pass flags down to the work functions List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 63a8e7bc0412f6d3d113839ed9e83e5c4bf8fd39 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:59 +0000 Message-Id: <6a43fb37.4587d.234c01f4@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=63a8e7bc0412f6d3d113839ed9e83e5c4bf8fd39 commit 63a8e7bc0412f6d3d113839ed9e83e5c4bf8fd39 Author: Mark Johnston AuthorDate: 2026-06-23 20:43:53 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:40 +0000 unlinkat: Pass flags down to the work functions The unlinkat(2) and funlinkat(2) system calls were ignoring AT_RESOLVE_BENEATH. Also pass pathseg through instead of assuming it's UIO_USERSPACE. Add some tests which make sure that AT_RESOLVE_BENEATH is handled properly by various system calls. Approved by: so Security: FreeBSD-SA-26:42.unlinkat Security: CVE-2026-49421 Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57790 --- sys/kern/vfs_syscalls.c | 11 +- tests/sys/kern/Makefile | 1 + tests/sys/kern/resolve_beneath_test.c | 220 ++++++++++++++++++++++++++++++++++ 3 files changed, 227 insertions(+), 5 deletions(-) diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index dc02e3351fee..a7e708181cdf 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -1976,16 +1976,17 @@ sys_unlink(struct thread *td, struct unlink_args *uap) static int kern_funlinkat_ex(struct thread *td, int dfd, const char *path, int fd, - int flag, enum uio_seg pathseg, ino_t oldinum) + int flags, enum uio_seg pathseg, ino_t oldinum) { - if ((flag & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) + if ((flags & ~(AT_REMOVEDIR | AT_RESOLVE_BENEATH)) != 0) return (EINVAL); - if ((flag & AT_REMOVEDIR) != 0) - return (kern_frmdirat(td, dfd, path, fd, UIO_USERSPACE, 0)); + if ((flags & AT_REMOVEDIR) != 0) + return (kern_frmdirat(td, dfd, path, fd, pathseg, + flags & ~AT_REMOVEDIR)); - return (kern_funlinkat(td, dfd, path, fd, UIO_USERSPACE, 0, 0)); + return (kern_funlinkat(td, dfd, path, fd, pathseg, flags, 0)); } #ifndef _SYS_SYSPROTO_H_ diff --git a/tests/sys/kern/Makefile b/tests/sys/kern/Makefile index 599ccc6519e6..7f8aaff2ed47 100644 --- a/tests/sys/kern/Makefile +++ b/tests/sys/kern/Makefile @@ -39,6 +39,7 @@ ATF_TESTS_C+= procdesc ATF_TESTS_C+= ptrace_test TEST_METADATA.ptrace_test+= timeout="15" ATF_TESTS_C+= reaper +ATF_TESTS_C+= resolve_beneath_test ATF_TESTS_C+= sched_affinity ATF_TESTS_C+= shutdown_dgram ATF_TESTS_C+= sigaltstack diff --git a/tests/sys/kern/resolve_beneath_test.c b/tests/sys/kern/resolve_beneath_test.c new file mode 100644 index 000000000000..b83926038ded --- /dev/null +++ b/tests/sys/kern/resolve_beneath_test.c @@ -0,0 +1,220 @@ +/* + * Copyright (c) 2026 The FreeBSD Foundation + * + * This software was written by Mark Johnston under sponsorship from + * the FreeBSD Foundation. + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +#include +#include + +#include +#include +#include + +#include + +/* + * Verify that AT_RESOLVE_BENEATH is respected by various system calls. + */ + +static int +setup(void) +{ + int fd, tfd; + + ATF_REQUIRE_EQ(0, mkdir("base", 0755)); + ATF_REQUIRE_EQ(0, mkdir("outside", 0755)); + ATF_REQUIRE((tfd = open("outside/target", O_CREAT | O_WRONLY, 0644)) >= + 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("outside/dir", 0755)); + ATF_REQUIRE((tfd = open("base/file", O_CREAT | O_WRONLY, 0644)) >= 0); + ATF_REQUIRE(close(tfd) == 0); + ATF_REQUIRE_EQ(0, mkdir("base/subdir", 0755)); + ATF_REQUIRE((fd = open("base", O_DIRECTORY | O_RDONLY)) >= 0); + return (fd); +} + +ATF_TC_WITHOUT_HEAD(faccessat_beneath); +ATF_TC_BODY(faccessat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + faccessat(fd, "file", F_OK, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + faccessat(fd, "../outside/target", F_OK, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(chflagsat_beneath); +ATF_TC_BODY(chflagsat_beneath, tc) +{ + int fd, ret; + + fd = setup(); + ret = chflagsat(fd, "file", UF_NODUMP, AT_RESOLVE_BENEATH); + if (ret != 0) + ATF_REQUIRE_EQ(EOPNOTSUPP, errno); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + chflagsat(fd, "../outside/target", UF_NODUMP, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchmodat_beneath); +ATF_TC_BODY(fchmodat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchmodat(fd, "file", 0644, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchmodat(fd, "../outside/target", 0644, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(fchownat_beneath); +ATF_TC_BODY(fchownat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + fchownat(fd, "file", -1, -1, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + fchownat(fd, "../outside/target", 0, 0, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(utimensat_beneath); +ATF_TC_BODY(utimensat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + utimensat(fd, "file", NULL, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + utimensat(fd, "../outside/target", NULL, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(linkat_beneath); +ATF_TC_BODY(linkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + linkat(fd, "file", fd, "hardlink", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + linkat(fd, "../outside/target", fd, "hardlink2", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_beneath); +ATF_TC_BODY(unlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "file", AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/target", + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(unlinkat_rmdir_beneath); +ATF_TC_BODY(unlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + unlinkat(fd, "subdir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + unlinkat(fd, "../outside/dir", + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_beneath); +ATF_TC_BODY(funlinkat_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "file", FD_NONE, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/target", FD_NONE, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC_WITHOUT_HEAD(funlinkat_rmdir_beneath); +ATF_TC_BODY(funlinkat_rmdir_beneath, tc) +{ + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, mkdir("base/subdir2", 0755)); + ATF_REQUIRE_EQ(0, + funlinkat(fd, "subdir2", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + funlinkat(fd, "../outside/dir", FD_NONE, + AT_REMOVEDIR | AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE_EQ(0, access("outside/dir", F_OK)); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TC(getfhat_beneath); +ATF_TC_HEAD(getfhat_beneath, tc) +{ + atf_tc_set_md_var(tc, "require.user", "root"); +} +ATF_TC_BODY(getfhat_beneath, tc) +{ + fhandle_t fh; + int fd; + + fd = setup(); + ATF_REQUIRE_EQ(0, + getfhat(fd, "file", &fh, AT_RESOLVE_BENEATH)); + ATF_REQUIRE_ERRNO(ENOTCAPABLE, + getfhat(fd, "../outside/target", &fh, + AT_RESOLVE_BENEATH) == -1); + ATF_REQUIRE(close(fd) == 0); +} + +ATF_TP_ADD_TCS(tp) +{ + ATF_TP_ADD_TC(tp, faccessat_beneath); + ATF_TP_ADD_TC(tp, chflagsat_beneath); + ATF_TP_ADD_TC(tp, fchmodat_beneath); + ATF_TP_ADD_TC(tp, fchownat_beneath); + ATF_TP_ADD_TC(tp, utimensat_beneath); + ATF_TP_ADD_TC(tp, linkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_beneath); + ATF_TP_ADD_TC(tp, unlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, funlinkat_beneath); + ATF_TP_ADD_TC(tp, funlinkat_rmdir_beneath); + ATF_TP_ADD_TC(tp, getfhat_beneath); + return (atf_no_error()); +} From nobody Tue Jun 30 17:22:00 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLx2m4Pz6jZ5Z for ; Tue, 30 Jun 2026 17:22:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLw5rxWz3t3F for ; Tue, 30 Jun 2026 17:22:00 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840120; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0EOBHKMRv8m0oknoUoXxtCM2xdeMhtVY1muDxOYGKO4=; b=L5WXtBNs1q+J8JP778kKz0dT7HFQv3fgMqxvl9wQUWIuRM88bAsHZDl+W8Q7XzUZmSFFLi Z7U57NgXG9rz/0T97Sn6LIQAVR1wzAyDxfHQE7avG2AzobO/F8wOKKF4419685VLvzAT2y POZtsp1Ez4rFCh2/kL44S4GEZYjNlwV1p84vs809H98jyWaSO47FEQZEHFS4n8Pv8J3eVL HURt/93MSPUVD1LgV3T0cIL/UswXIp3H9eQU27QoA755akiPIuyc+4hacWN3msr0eQkUJf DoIII3+wlNYZnzClON8KsiPhBPkbUtNn+wYWD7N0qVBcZhOh2+r3mW2lzGP5/A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840120; a=rsa-sha256; cv=none; b=iCeF7M67KK0bIhoFiSyKeiV8obZsl3k2Pk0KODawO8nU6ZxmG45W8JpbQEUsZFGEvd5W0L FhE5uQ6XWyaWKbnoIaYWwlE9tXv4/F87u5kFzsLJx2vHZRPw8SlXb1EsE3BiLxC2rl3f3X 0MzioDK1usSYngUP9ULKzNBfVF565O8cneZJfdPJv66N9MQEpMXyd2A9U+lWtimwgEoFov nkw+jvUlgn5QwQ82/anZnHA3qkZZuuMXjSEQ54eAY2SOXcl7kmTzi8QbInYgRYNEPiFc9d 7XamLd+Ho1V8vzf8KpjKE0FvM5rvCnim0Cwu+qcyTSC8/o2WZn8tlxNmLa/NLQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840120; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0EOBHKMRv8m0oknoUoXxtCM2xdeMhtVY1muDxOYGKO4=; b=pWC0bTAKCTn9Sk6Lh0W0ac13F+8Bk4e4mGJYyD87DtRndclgalSe0AdFD/tuO74X/pGKar 5e4NIMtsV8gvSVQsctUF5JzpHMTfwtrLu7OHH8OjZMZdaYwBrV48H7v7Urfx3AXDpCUi7E cOTjkNgg2Y+25zwINtT6R3D81Xg8k3luuQP0SmRC25nnR8X1fJWNOGveeq1X0Ky4dY/9E/ LBv8qweVWVE91B+khJ0QivEXSn57tIG3EBDc4uVBACNJ5vYFzxXZJgV8q7x8pxLN64kAEf l9A2zjcZc2KThJbnkkVe+2QvtSJ9WRO+plLJuyAFFeqYIZ/4Nkrg1obzLc/puw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLw4SYRztkh for ; Tue, 30 Jun 2026 17:22:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45d49 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:22:00 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 490e506a1ca8 - releng/15.1 - rack: Reload the TCP stack PCB after reacquiring the inpcb lock List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 490e506a1ca8e766340fdea1a72eeea27e006293 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:22:00 +0000 Message-Id: <6a43fb38.45d49.77d4b6cb@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=490e506a1ca8e766340fdea1a72eeea27e006293 commit 490e506a1ca8e766340fdea1a72eeea27e006293 Author: Mark Johnston AuthorDate: 2026-06-23 21:46:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:40 +0000 rack: Reload the TCP stack PCB after reacquiring the inpcb lock Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791 --- sys/netinet/tcp_stacks/rack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index 219cf2758ff2..86ea34f46a05 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -24136,6 +24136,7 @@ process_opt: INP_WUNLOCK(inp); return (ENOPROTOOPT); } + rack = (struct tcp_rack *)tp->t_fb_ptr; if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_HYBRID_PACING) && From nobody Tue Jun 30 17:22:01 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLy37znz6jZ5b for ; Tue, 30 Jun 2026 17:22:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLx6HWvz3t1B for ; Tue, 30 Jun 2026 17:22:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840121; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cPjXLDVEUgOzj+VFyJHz+IpLpt30NOaIBecPDQXcpIc=; b=Hi4145g8Gaix6stsSs/F/rUiwh6uIVMEqjeDZu/MOKSRVxxCu/o/Y2Txy6eV3grUh5HH0d eywl9YqBnBXmkLzJhdKZBK/0ip1WI0ASOM70JZEhCiWkwREtUe6uTiPw1IBRgBgq6i9Qky znnbvhKSOSQa7f0wkvtH6YyVBlNU6T+RD/RZwKHiLEA9oKOAaSvIEAyZt2ry/dRowXQ8dF lpR1ZlrX/xa6nJhd3m5x4XFtZOh0EVB6nHVCzurc7ftvkTuj7sCSna6by/6zg5SV3lRq1e 0lG84v1OttudEuBIpHWulNpWfa535Pi9dvBl+q2jMahnAchJsyCcA0ENcgAWLg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840121; a=rsa-sha256; cv=none; b=Ookg//zIdTRIZuwpqr/AzywlFM10VU40qwEVf7zqUHOn0MA208vyLH/0XfKuLYPQMr6jPt dy+Z9JC9TVjQnPd4IWbYVpS3y+NmH/uVZag2n6IT9bIiQYRUfa27aMIKJC5abUnJ4/9C83 F70aDl5hwJpnuxkCv+tkeaKOYlzGW0R6+xHWto3/VeEIZJh9687qBd9eDTmBKoN/Y2Vlpl /ynWE3HQ3YUVfvNDY4ZdkYoft3xhgzr2hoTNjtxdxvMQ7dJ9q+KYyymO8HALtQVXSJpImK Chb3Stho/cAjAeI3DLt1e/IfZQSOXy8z6byo0NsMBdpmSa7JgtdSlpVqivKheQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840121; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cPjXLDVEUgOzj+VFyJHz+IpLpt30NOaIBecPDQXcpIc=; b=uQ6+xTjDIS2glKan4Zd+ZTd0biAMhtna8Afqn71Fl4G+S/06Bfzgx5QimHVqSKyCx0WWPb 67Bbh9I0dp6dU7JxAEic5u36bor1ocKiTyIywrPQjl/EUNmZEIUUfI+vsM8FnBGs4D9goS twFJgBalN9LD7IOpyNCBI/OuA3oHD7wANeIgv7Q6od3+r8sobmVj47cVFTjp/eMuqXdksi qYZ1MYWLHMFqeJ7KmRft8/jGjNykBvbr94J6M8/ciG6BlT3v4TPXYXs2l/wuBAlaUsJt7O ud/Je7d22sxHdbK0dlGiClfPA/8ZowX9tYKxkHcjEFHVJNL8uENpGj/CJRkNCQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLx4rP8ztYS for ; Tue, 30 Jun 2026 17:22:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46001 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:22:01 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 35a5b790e8ad - releng/15.1 - posixshm: Disallow fspacectl() on largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 35a5b790e8ad232890fc375e4a1c12d8768d1011 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:22:01 +0000 Message-Id: <6a43fb39.46001.632efd5d@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=35a5b790e8ad232890fc375e4a1c12d8768d1011 commit 35a5b790e8ad232890fc375e4a1c12d8768d1011 Author: Mark Johnston AuthorDate: 2026-06-24 19:56:07 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:41 +0000 posixshm: Disallow fspacectl() on largepage objects As with truncation, the operation isn't supported, but nothing prevented it. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57830 --- sys/kern/uipc_shm.c | 5 ++++- tests/sys/posixshm/posixshm_test.c | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index 197409d97f0c..d965576ecd9c 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -2096,11 +2096,14 @@ shm_fspacectl(struct file *fp, int cmd, off_t *offset, off_t *length, int flags, ("shm_fspacectl: non-zero flags")); KASSERT(*offset >= 0 && *length > 0 && *length <= OFF_MAX - *offset, ("shm_fspacectl: offset/length overflow or underflow")); - error = EINVAL; + shmfd = fp->f_data; off = *offset; len = *length; + if (shm_largepage(shmfd)) + return (ENOTSUP); + rl_cookie = shm_rangelock_wlock(shmfd, off, off + len); switch (cmd) { case SPACECTL_DEALLOC: diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index fe6386c6aa4b..6729c33a789d 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -1369,6 +1369,27 @@ ATF_TC_BODY(largepage_config, tc) ATF_REQUIRE(close(fd) == 0); } +ATF_TC_WITHOUT_HEAD(largepage_fspacectl); +ATF_TC_BODY(largepage_fspacectl, tc) +{ + struct spacectl_range range; + size_t ps[MAXPAGESIZES]; + int fd, pscnt; + + pscnt = pagesizes(ps, true); + + for (int i = 1; i < pscnt; i++) { + fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, ps[i]); + + range.r_offset = 0; + range.r_len = ps[i]; + ATF_REQUIRE_ERRNO(ENOTSUP, + fspacectl(fd, SPACECTL_DEALLOC, &range, 0, &range) == -1); + + ATF_REQUIRE(close(fd) == 0); + } +} + ATF_TC_WITHOUT_HEAD(largepage_mmap); ATF_TC_BODY(largepage_mmap, tc) { @@ -2165,6 +2186,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, mmap_prot); ATF_TP_ADD_TC(tp, largepage_basic); ATF_TP_ADD_TC(tp, largepage_config); + ATF_TP_ADD_TC(tp, largepage_fspacectl); ATF_TP_ADD_TC(tp, largepage_mmap); ATF_TP_ADD_TC(tp, largepage_munmap); ATF_TP_ADD_TC(tp, largepage_madvise); From nobody Tue Jun 30 17:21:58 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLv2bgJz6jYfw for ; Tue, 30 Jun 2026 17:21:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLt4zzbz3snR for ; Tue, 30 Jun 2026 17:21:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840118; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TA8EoOgTBrGxVYGwcy5jDjaFmf2ccc6zoOM3x8hKmuU=; b=IkH/5hVC4tJUNrdIAhsb46fYI2Ld36oggSNC355YzzzyMezIcVGg/2yRTIJpkv45ozL71R B3+8Z7EOGGrNrwqi8VvnPTt/11ml5kiEs2Ac9jFNJWVKAkkXUMmNKxo+nE/sT4bZmvIsvg oNS92BwKwQAhS4Int4/DqB/UPTcpjdCbL2auv/Gdit972JQJowVpePqkvpbZIwO6HXGt+m 2UnNas4ChzW6lDwYcEAgwtRQhLq5VmDqYe6teFNyaPqLlNQfJEiZ5TxmOm+ftTOstxPLnv Hw/k3yig3u8Y434LUCu6tU17+TVLT49ZuISRtQDcETviYd11qv7bisGdrVAoTw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840118; a=rsa-sha256; cv=none; b=tA292kJ/5jmvGNdAOgH+JtD5F6pYCp+fUSGUMxObS+Ak+9eMbmfGiS1vXz00624WW09hJ+ hsiGRS9q3T4eITjpboH3R5qxoDxH7TiddwfRv33l0l2PsiSMWzaKWPDvdLNfwbdb0vVx0X p23PZYQTCChmt80uNDZWCGs/NSWyIdPi+2BGEeY7kpTIi0YygKPDL38b6T2Lg+suVjdWJP kYw57oGe81pPMRs3Fim03JIrh5/NzZkJJOELsVGlY9rnVnPDIw6QkIZxRJDInebQB0qc32 PxOMI5mjDFa4j86lJ4mDlTLkwrIGGgxwFXJhycNmUNWLX+6IU06YhN8Xjklryg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840118; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TA8EoOgTBrGxVYGwcy5jDjaFmf2ccc6zoOM3x8hKmuU=; b=ci3QGBwY5GKGFlw+YfBQy0TPZwgdZpKcEIRPNmV7fg2nnaYAmJWthpCKto9RoM8IiN8vfa vWj8B39zP6EU1HuQk+PpXTMAkYtZk1XjhLNt2j4GVt304TEWgLCr4JlLISeOFtLflczxFJ ilX7bH267Z0Z8sr+7LkDEq4JBPSqXhQN19h8FTcSUEHWDePt0MjLIshqZw441RXIqWPhEy AxBD1fcuc8zotIVgjBCvuaQiYLymP+y9ybc0gDovwqoARWA4uWIID6DIHmCxUkpehLOpBy 5JMrMalqv31PXU/6W8tcdVJn52sT0cjz8OIcBowto2YDJDWqQkDyvdcSSHvFRw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLt3FPmztnh for ; Tue, 30 Jun 2026 17:21:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46083 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:58 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 1b96804ba50d - releng/15.1 - tests/libalias: Add a regression test for an alias_smedia bug List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 1b96804ba50d91ccb80ebef87e67a466dd57c9ed Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:58 +0000 Message-Id: <6a43fb36.46083.70539612@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=1b96804ba50d91ccb80ebef87e67a466dd57c9ed commit 1b96804ba50d91ccb80ebef87e67a466dd57c9ed Author: Mark Johnston AuthorDate: 2026-06-22 17:25:56 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:40 +0000 tests/libalias: Add a regression test for an alias_smedia bug Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57747 --- tests/sys/netinet/libalias/Makefile | 4 ++ tests/sys/netinet/libalias/smedia.c | 74 +++++++++++++++++++++++++++++++++++++ 2 files changed, 78 insertions(+) diff --git a/tests/sys/netinet/libalias/Makefile b/tests/sys/netinet/libalias/Makefile index 43bef996fae7..95816444a6d2 100644 --- a/tests/sys/netinet/libalias/Makefile +++ b/tests/sys/netinet/libalias/Makefile @@ -3,6 +3,10 @@ PACKAGE= tests TESTSDIR= ${TESTSBASE}/sys/netinet/libalias BINDIR= ${TESTSDIR} +PLAIN_TESTS_C+= smedia + +LIBADD.smedia+= sbuf + ATF_TESTS_C+= 1_instance \ 2_natout \ 3_natin \ diff --git a/tests/sys/netinet/libalias/smedia.c b/tests/sys/netinet/libalias/smedia.c new file mode 100644 index 000000000000..e181a7a538af --- /dev/null +++ b/tests/sys/netinet/libalias/smedia.c @@ -0,0 +1,74 @@ +/* + * Copyright (c) 2026 The FreeBSD Foundation + * + * This software was developed by Mark Johnston under sponsorship from + * the FreeBSD Foundation. + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +/* + * A minimal regression test for a buffer overflow in alias_rtsp_out(). + */ + +#include +#include + +#include +#include +#include +#include + +#include +#include + +#include + +int +main(void) +{ + uint8_t *packet; + struct ip ip; + struct tcphdr tcp; + struct sbuf sb; + struct libalias *la; + + sbuf_new(&sb, NULL, 0, SBUF_AUTOEXTEND); + sbuf_printf(&sb, "SETUP rtsp://example.com/media.mp4 RTSP/1.0\r\n"); + sbuf_printf(&sb, "CSeq: 1\r\n"); + sbuf_printf(&sb, "Transport: RTP/AVP;unicast;"); + for (int i = 0; i < 200; i++) + sbuf_printf(&sb, "client_port=%d-%d;", 2 * i, 2 * i + 1); + sbuf_printf(&sb, "\r\n\r\n"); + sbuf_finish(&sb); + + memset(&tcp, 0, sizeof(tcp)); + tcp.th_sport = htons(1234); + tcp.th_dport = htons(554); + tcp.th_off = 5; + + memset(&ip, 0, sizeof(ip)); + ip.ip_v = IPVERSION; + ip.ip_hl = sizeof(ip) / 4; + ip.ip_len = htons(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)); + ip.ip_id = htons(1); + ip.ip_ttl = 64; + ip.ip_p = IPPROTO_TCP; + ip.ip_src.s_addr = inet_addr("127.0.0.1"); + ip.ip_dst.s_addr = inet_addr("127.0.0.2"); + + packet = malloc(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)); + memcpy(packet, &ip, sizeof(ip)); + memcpy(packet + sizeof(ip), &tcp, sizeof(tcp)); + memcpy(packet + sizeof(ip) + sizeof(tcp), sbuf_data(&sb), + sbuf_len(&sb)); + + la = LibAliasInit(NULL); + LibAliasSetAddress(la, + (struct in_addr){.s_addr = inet_addr("127.0.0.1")}); + if (LibAliasOut(la, packet, sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)) != + PKT_ALIAS_OK) + return (1); + LibAliasUninit(la); + return (0); +} From nobody Tue Jun 30 17:22:02 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLz3Bysz6jZ3d for ; Tue, 30 Jun 2026 17:22:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLy6kKhz3ssR for ; Tue, 30 Jun 2026 17:22:02 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840123; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Yc7lboWjlfHdJKRVil7i8FYq+ztZKRGAQ6tLqTSM7BY=; b=bMdpbNLGUTVQu8RRW5+6/8Lnx0eGUqKktLrNnNF+W4McC8NJUCKB1gHmjFobjJ+r4/6nOd SGag3lcaXBZrXgTLPxnsnjff9DnK9Gc7ukgfRHV5I3n2pszMS2xxU+cU7/QZIFo8v9vUcm Kfz5iWQkrxxSufjZrgmbOMZ3lK7pN+2ukzLe9vsrDjcbwZE61ZNUyWV934rJ2bUaoXhx1a PS/pfhkkT4QgpWO7tbfF9F5Z3bOEbqDXIZ4/Qi/rEGxqxH/e3H/GRhrPAOjBhSgf9QkoJA uQswKNJAf0orQpPNotH1z+JUuY5cJ9lXeK6fWDbrL3uOTkzN9YuUXKl5ddTZcg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840123; a=rsa-sha256; cv=none; b=qi5iB1seOlnyGDDLJmvRN4TP7CEnMtc000NwVfuWRHsi9V06rM/C0Uh+9Jo1Ohta+UFpnX St0DB1EhdbGD2NhL9XYLUOrCgwVXYKTJM7I44WfZ9Yd0uv46bzzPuehqSQRNBDZ4yGfF6Y oiPWWuFptBzcO1UubXPf6hcw7mzy6we2kSZ/wVwOfP552yy1WplUlF6Z0tDbE3UMvzdBGG ZC0Fm1i6shAHs9PbNMMLdI405QJfNym2dYYMjw/zMn/uWs42Rh+IgkIFu3+oBMivxPKP5C XZd8JvebQukvix8S4Mvw7ExZzuJp9xhnlMxmTIeE9/n4uOsf/hiANezUifFe8w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840123; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Yc7lboWjlfHdJKRVil7i8FYq+ztZKRGAQ6tLqTSM7BY=; b=n/hhPz+IIYG2xLvA+3X2wjx+ZFwsaBeS9nKG0ONy58cToAJ1X5P6JsuMmqIeLpJv7A8Y6r hLIULTZ6DOZCWM/5gqBm7sS9Pi2GnOFSL4xAlZEmNUiGm2GEE86ff6HVagWXfqAbNH+CiT bhgo2fvi2pnWgDF4zytKGMc2NnLKVDPWBuk9SuqIf1r6eOcKNpvnwITdxX9hIXu7x3l0MK 7gLWFYRcEwuTBYBZAvJ4QDIp47EJ9aQaNFiUV4X3Zyg0tWcw6ppo0vumzL/hNYugMaBsdf +I+rKGcf1zP4KHAfwM6aPHY+XwTEy/Ni+Y5443X96YbvLWd0G7pdG7B0VYn0Aw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLy5f7lztqf for ; Tue, 30 Jun 2026 17:22:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44766 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:22:02 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 761f4722feef - releng/15.1 - posixshm: Disallow truncation of largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 761f4722feeff25225ac5276623159eb148cac6f Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:22:02 +0000 Message-Id: <6a43fb3a.44766.43d3a222@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=761f4722feeff25225ac5276623159eb148cac6f commit 761f4722feeff25225ac5276623159eb148cac6f Author: Mark Johnston AuthorDate: 2026-06-23 22:47:02 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:41 +0000 posixshm: Disallow truncation of largepage objects We correctly handled ftruncate(), but not open(O_TRUNC). Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49428 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57831 --- sys/kern/uipc_shm.c | 8 +++----- tests/sys/posixshm/posixshm_test.c | 38 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 5 deletions(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index d965576ecd9c..b1b6a8657d69 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -786,7 +786,7 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) vm_pindex_t oldobjsz __unused; int aflags, error, i, psind, try; - KASSERT(length >= 0, ("shm_dotruncate: length < 0")); + KASSERT(length >= 0, ("shm_dotruncate_largepage: length < 0")); object = shmfd->shm_object; VM_OBJECT_ASSERT_WLOCKED(object); rangelock_cookie_assert(rl_cookie, RA_WLOCKED); @@ -1334,15 +1334,13 @@ kern_shm_open2(struct thread *td, const char *userpath, int flags, mode_t mode, if (error == 0 && (flags & (O_ACCMODE | O_TRUNC)) == (O_RDWR | O_TRUNC)) { - VM_OBJECT_WLOCK(shmfd->shm_object); #ifdef MAC error = mac_posixshm_check_truncate( - td->td_ucred, fp->f_cred, shmfd); + td->td_ucred, fp->f_cred, shmfd); if (error == 0) #endif - error = shm_dotruncate_locked(shmfd, 0, + error = shm_dotruncate_cookie(shmfd, 0, rl_cookie); - VM_OBJECT_WUNLOCK(shmfd->shm_object); } if (error == 0) { /* diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index 6729c33a789d..e816e2d1efa7 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -2148,6 +2148,43 @@ ATF_TC_BODY(largepage_reopen, tc) "close failed; errno=%d", errno); } +ATF_TC_WITHOUT_HEAD(largepage_truncate); +ATF_TC_BODY(largepage_truncate, tc) +{ + size_t ps[MAXPAGESIZES]; + int fd, psind; + + (void)pagesizes(ps, true); + psind = 1; + + gen_test_path(); + fd = shm_create_largepage(test_path, O_CREAT | O_RDWR, psind, + SHM_LARGEPAGE_ALLOC_DEFAULT, 0600); + if (fd < 0 && errno == ENOTTY) + atf_tc_skip("no large page support"); + ATF_REQUIRE_MSG(fd >= 0, "shm_create_largepage failed; error=%d", errno); + + ATF_REQUIRE_MSG(ftruncate(fd, ps[psind]) == 0, + "ftruncate failed; error=%d", errno); + + ATF_REQUIRE_MSG(close(fd) == 0, "close failed; error=%d", errno); + + fd = shm_open(test_path, O_RDWR | O_TRUNC, 0); + ATF_REQUIRE_MSG(fd == -1, "shm_open(O_TRUNC) should have failed"); + ATF_REQUIRE_ERRNO(ENOTSUP, fd == -1); + + fd = shm_open(test_path, O_RDWR, 0); + ATF_REQUIRE_MSG(fd >= 0, "shm_open failed; error=%d", errno); + + ATF_REQUIRE_MSG(ftruncate(fd, ps[psind]) == 0, + "ftruncate to same size failed; error=%d", errno); + + ATF_REQUIRE_MSG(shm_unlink(test_path) == 0, + "shm_unlink failed; errno=%d", errno); + ATF_REQUIRE_MSG(close(fd) == 0, + "close failed; errno=%d", errno); +} + ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TC(tp, remap_object); @@ -2199,6 +2236,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, largepage_pkru); #endif ATF_TP_ADD_TC(tp, largepage_reopen); + ATF_TP_ADD_TC(tp, largepage_truncate); return (atf_no_error()); } From nobody Tue Jun 30 17:22:03 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM04YFTz6jYgF for ; Tue, 30 Jun 2026 17:22:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVM00YRrz3sqK for ; Tue, 30 Jun 2026 17:22:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840124; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QBfViiJVgwSCf7IYX9Vrm3r+gutBD5RTEfHTxDZDgGw=; b=L1Fue7cMsoX5pxn8pro33Pnc/eBV2EmR/Nb5BBDCjxq+gN/jubsjMcGwVE6eRLp9jUOSYY itob6AGNaOykF/EEBwQmGmphzM0AxQN5/z+qksbiNHYGelnIcJbRBHZQb9vVcaPOAoEWkz gydWcC6Rd2VOpXU998S68zIzBw6+I5fqWXpWuj+fcS4O6q2xOR4LRmMfHpjgi7muKQJlg8 skbZfwDbmJr+qC6Go/8D7QDKhhW/9Syf98MfL+rekSNiBZsWppGJ6tbirFdz+00wL9Vgb6 O5w99aUZROAELVsYWVgWgPsEaXVfT2TTV55hhmXymqngPnhavK2ofx45Bx0TTQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840124; a=rsa-sha256; cv=none; b=B0dOd46UW1Uhp+Gyu5PzFyMrhCg3xLyHS0Lmo+Rffnwh/CkxMaZftzXvGsbN+dpZMNf6wt IsT4Bf+NfT5lTBjkLv+CuelqlamJaLcGKn5uaqHFt4WYH/lySUDL5Hx0d6gBA69CcLusey Vk/ek3T+Uv4uVfBgxotuNjN1hmLMblqqbZVaOoOHHPC6vIYYXeHzGaoqINL02sVKR5anUX Yt+aVal5Hkcd1CHW1iv3WQEfKeV/4YAR5UZ6iXF2v/ZWdUsnzQcibTH4C1v6KsZZLeLolw S5CogkjFtwpheixEvKlZhhZJ86cDBTyDxJEmhqRFJFpEQaswJ6wmQlNDR0fL8w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840124; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QBfViiJVgwSCf7IYX9Vrm3r+gutBD5RTEfHTxDZDgGw=; b=VDMM0fKXZaDs1Tj8sAXqHrTzuWlu/n24Mfqzt7TxixH1BGnb8pR6beLJuU/jMn9zZ6dvEG GnZF8jxbgZcTmF+6IcYXZNtn1/0TW8JrJrnWmRM78qrTbXB+XVSIZUaSWyWuKrWCP/Tg7N Mr3Ynu1XZdMWmKHzT7vjaVE9m5EWq/y7jxLHatz9gRD3ymv9ZXAx1JeHfs/heTnkCWRYDx HTdKKDIRu9xX3kq663rvjPjFSMhG5UFbsJQOWsycywWzeDgAEMTT4gfnX/nTB5rpfXShYX ItslloZRVGTalXVyUqOr1qCl8CTwoQ/0UwGnqvMjysbkSeEpV5fSk1j4CtwGMg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLz6F1Rztnn for ; Tue, 30 Jun 2026 17:22:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45d4d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:22:03 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: b15971f462b6 - releng/15.1 - posixshm: Fix handling of sendfile() with largepage objects List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: b15971f462b6af68aeb8468bddc55efa6ca0bc95 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:22:03 +0000 Message-Id: <6a43fb3b.45d4d.1ed2f36f@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=b15971f462b6af68aeb8468bddc55efa6ca0bc95 commit b15971f462b6af68aeb8468bddc55efa6ca0bc95 Author: Mark Johnston AuthorDate: 2026-06-24 19:57:00 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:41 +0000 posixshm: Fix handling of sendfile() with largepage objects sendfile(2) can transmit POSIX shared memory objects. Typically it will look up and wire each page before sending it to a socket; once transmission is complete, the page is unwired and typically released back into the page queues. sendfile() has an advisory flag, SF_NOCACHE, which means, "try to free the page once transmission is complete." This is implemented in vm_page_release(), which expects to operate on managed pages. Pages belonging a largepage object are de-facto wired not explicitly so. Thus, vm_page_release() will unwire and, having found no additional references, free the page. Because mappings of largepage objects are unmanaged, userspace can still access the now freed page. Fix the problem by explicitly wiring largepage pages. Make the VM object destructor responsible for unwiring and freeing them. Add a regression test. Approved by: so Security: FreeBSD-SA-26:44.posixshm Security: CVE-2026-49427 Reported by: Chris Jarrett-Davies Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57832 --- sys/kern/uipc_shm.c | 22 ++++++++-- sys/vm/vm_page.c | 23 +++++----- tests/sys/posixshm/posixshm_test.c | 89 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 121 insertions(+), 13 deletions(-) diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c index b1b6a8657d69..8341364f4d16 100644 --- a/sys/kern/uipc_shm.c +++ b/sys/kern/uipc_shm.c @@ -326,6 +326,7 @@ static void shm_largepage_phys_ctor(vm_object_t object, vm_prot_t prot, vm_ooffset_t foff, struct ucred *cred) { + object->flags |= OBJ_PG_DTOR; } static void @@ -333,11 +334,27 @@ shm_largepage_phys_dtor(vm_object_t object) { int psind; + VM_OBJECT_ASSERT_WLOCKED(object); + psind = object->un_pager.phys.data_val; if (psind != 0) { + struct pctrie_iter pages; + vm_page_t m; + bool removed __diagused; + + vm_page_iter_init(&pages, object); +restart: + VM_RADIX_FOREACH(m, &pages) { + if (!vm_page_busy_acquire(m, VM_ALLOC_WAITFAIL)) { + pctrie_iter_reset(&pages); + goto restart; + } + removed = vm_page_iter_remove(&pages, m); + KASSERT(!removed, ("%s: page %p not wired", __func__, m)); + vm_page_unwire(m, PQ_NONE); + } atomic_subtract_long(&count_largepages[psind], object->size / (pagesizes[psind] / PAGE_SIZE)); - vm_wire_sub(object->size); } else { KASSERT(object->size == 0, ("largepage phys obj %p not initialized bit size %#jx > 0", @@ -818,7 +835,7 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) if ((shmfd->shm_seals & F_SEAL_GROW) != 0) return (EPERM); - aflags = VM_ALLOC_NORMAL | VM_ALLOC_ZERO; + aflags = VM_ALLOC_NORMAL | VM_ALLOC_ZERO | VM_ALLOC_WIRED; if (shmfd->shm_lp_alloc_policy == SHM_LARGEPAGE_ALLOC_NOWAIT) aflags |= VM_ALLOC_WAITFAIL; try = 0; @@ -874,7 +891,6 @@ shm_dotruncate_largepage(struct shmfd *shmfd, off_t length, void *rl_cookie) object->size += OFF_TO_IDX(pagesizes[psind]); shmfd->shm_size += pagesizes[psind]; atomic_add_long(&count_largepages[psind], 1); - vm_wire_add(atop(pagesizes[psind])); } return (0); } diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c index 3753079f2fde..cd95cc620ad4 100644 --- a/sys/vm/vm_page.c +++ b/sys/vm/vm_page.c @@ -4272,6 +4272,9 @@ vm_page_unwire_managed(vm_page_t m, uint8_t nqueue, bool noreuse) { u_int old; + KASSERT(nqueue < PQ_COUNT, + ("vm_page_unwire: invalid queue %u request for page %p", + nqueue, m)); KASSERT((m->oflags & VPO_UNMANAGED) == 0, ("%s: page %p is unmanaged", __func__, m)); @@ -4330,17 +4333,15 @@ vm_page_unwire_managed(vm_page_t m, uint8_t nqueue, bool noreuse) void vm_page_unwire(vm_page_t m, uint8_t nqueue) { - - KASSERT(nqueue < PQ_COUNT, - ("vm_page_unwire: invalid queue %u request for page %p", - nqueue, m)); + KASSERT(nqueue < PQ_COUNT || nqueue == PQ_NONE, + ("%s: invalid queue %u request for page %p", __func__, nqueue, m)); if ((m->oflags & VPO_UNMANAGED) != 0) { if (vm_page_unwire_noq(m) && m->ref_count == 0) vm_page_free(m); - return; + } else { + vm_page_unwire_managed(m, nqueue, false); } - vm_page_unwire_managed(m, nqueue, false); } /* @@ -4514,13 +4515,15 @@ vm_page_release_toq(vm_page_t m, uint8_t nqueue, const bool noreuse) void vm_page_release(vm_page_t m, int flags) { - vm_object_t object; - - KASSERT((m->oflags & VPO_UNMANAGED) == 0, - ("vm_page_release: page %p is unmanaged", m)); + if ((m->oflags & VPO_UNMANAGED) != 0) { + vm_page_unwire(m, PQ_NONE); + return; + } if ((flags & VPR_TRYFREE) != 0) { for (;;) { + vm_object_t object; + object = atomic_load_ptr(&m->object); if (object == NULL) break; diff --git a/tests/sys/posixshm/posixshm_test.c b/tests/sys/posixshm/posixshm_test.c index e816e2d1efa7..e4b57dec6311 100644 --- a/tests/sys/posixshm/posixshm_test.c +++ b/tests/sys/posixshm/posixshm_test.c @@ -33,6 +33,7 @@ #include #include #include +#include #include #include #include @@ -2148,6 +2149,93 @@ ATF_TC_BODY(largepage_reopen, tc) "close failed; errno=%d", errno); } +static unsigned char +largepage_sendfile_expected(size_t off) +{ + + return ((unsigned char)(off * 131 + (off >> 8))); +} + +ATF_TC_WITHOUT_HEAD(largepage_sendfile); +ATF_TC_BODY(largepage_sendfile, tc) +{ + static const int flags[] = { 0, SF_NOCACHE }; + char *addr; + off_t sbytes; + size_t ps[MAXPAGESIZES]; + int error, fd, pscnt, sd[2], status; + pid_t child; + + pscnt = pagesizes(ps, true); + + for (int i = 1; i < pscnt; i++) { + for (int fi = 0; fi < (int)nitems(flags); fi++) { + fd = shm_open_large(i, SHM_LARGEPAGE_ALLOC_DEFAULT, + ps[i]); + addr = mmap(NULL, ps[i], PROT_READ | PROT_WRITE, + MAP_SHARED, fd, 0); + ATF_REQUIRE_MSG(addr != MAP_FAILED, + "mmap(%zu bytes) failed; error=%d", ps[i], errno); + + /* Fill with a verifiable pattern. */ + for (size_t j = 0; j < ps[i]; j++) + addr[j] = largepage_sendfile_expected(j); + + ATF_REQUIRE(socketpair(PF_LOCAL, SOCK_STREAM, 0, + sd) == 0); + + child = fork(); + ATF_REQUIRE_MSG(child != -1, + "fork() failed; error=%d", errno); + if (child == 0) { + char buf[BUFSIZ]; + ssize_t len; + size_t off, resid; + + (void)close(sd[0]); + off = 0; + for (resid = ps[i]; resid > 0; resid -= len) { + len = read(sd[1], buf, sizeof(buf)); + if (len <= 0) + _exit(1); + for (ssize_t k = 0; k < len; k++) { + if ((unsigned char)buf[k] != + largepage_sendfile_expected( + off + k)) + _exit(2); + } + off += len; + } + _exit(0); + } + ATF_REQUIRE(close(sd[1]) == 0); + + sbytes = 0; + error = sendfile(fd, sd[0], 0, ps[i], NULL, &sbytes, + flags[fi]); + ATF_REQUIRE_MSG(error == 0, + "sendfile() failed; error=%d flags=%#x", + errno, flags[fi]); + ATF_REQUIRE_MSG(sbytes == (off_t)ps[i], + "sendfile() short; sbytes=%jd expected=%zu flags=%#x", + (intmax_t)sbytes, ps[i], flags[fi]); + + ATF_REQUIRE(close(sd[0]) == 0); + + ATF_REQUIRE_MSG(waitpid(child, &status, 0) == child, + "waitpid() failed; error=%d", errno); + ATF_REQUIRE_MSG(WIFEXITED(status), + "child killed by signal %d", WTERMSIG(status)); + ATF_REQUIRE_MSG(WEXITSTATUS(status) == 0, + "child exited with status %d (flags=%#x)", + WEXITSTATUS(status), flags[fi]); + + ATF_REQUIRE(munmap(addr, ps[i]) == 0); + ATF_REQUIRE(close(fd) == 0); + } + } +} + ATF_TC_WITHOUT_HEAD(largepage_truncate); ATF_TC_BODY(largepage_truncate, tc) { @@ -2236,6 +2324,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, largepage_pkru); #endif ATF_TP_ADD_TC(tp, largepage_reopen); + ATF_TP_ADD_TC(tp, largepage_sendfile); ATF_TP_ADD_TC(tp, largepage_truncate); return (atf_no_error()); From nobody Tue Jun 30 17:22:04 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM13CFPz6jYxy for ; Tue, 30 Jun 2026 17:22:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVM110ywz3t1r for ; Tue, 30 Jun 2026 17:22:05 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840125; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BkHe1wv0k/7cM7OjXy7cpcBL6M1epJ5rOwRZJTi47YA=; b=EosXaZMYVXgQogQetMJ2qcaFCHYBiSZkoxGPDU+2m8fXXnvVKrsnuA1p7LOYyUxMFsyWzV xGgQWBRnNISWbeBSNvyZr3shpr3KEpIPUFxIwEyik2MInWHnNh+NB8WPELTxI55SH/p1Zt ZQtnzf8uahAVpp/7d0mTVrV7+4Gi8LV8XhnOGXomnPkcQVmuXfn7MpjVgaod2MT2CwYD3R BGXmpAgHg31COMO7O1073ir+yiyYO5ugz2oZWWd7MlwLgiZz3OAgJ6K5PCiCgQy0Cc0Etk zkbCK5JGCTI3AT+H0YZotMF6syp0FrOaw6l2B9jeeubLVzPX4+9tspFpzRdlcQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840125; a=rsa-sha256; cv=none; b=WCEY2RtUUUDcz7PCBDRY9uHWyXdesG7bN58yW6Njw9+dNSmeVbEtCG4J/PdzXXXvg1O5w1 0CKtMDFPqPAMDrQsg+bwqdbXBczsyR/aNM4OL+UBWToNgMqJkOR77o6ki3Nbh3tEBlmJGm 8zFVIAZVNkv//cLPvzBJDUjl0bvZ9bRRHkc9uL8wl21z+vd1tmqgggOjYPTm6oYZL12c6u +QB0VaMAqj2G4OUWsDlFE0BXccIzY2GZXrbvG+mLUWpbhf0/q0SAxlFgmfo9A/Q0HPFmz8 /TbeW8BwnLxRRqz+8gaNv4r47U0Mvm3dBGzzmOtbwpCwCFZ0WsuETFO0B+D1Xg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840125; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BkHe1wv0k/7cM7OjXy7cpcBL6M1epJ5rOwRZJTi47YA=; b=jUmUNsmSdtoUEnTlEMveGh2lk08hW6WCoWLyCTI9TEYZDBG5Zz3K/oM4cPS4QKxGJe31x2 Mcbfs68tAOV6RNaRfQRn68p8fnqGYO5p867rRf0q2LdTT0ZX8O+8w6eUXjhK318mMdBMhU dVOuYm9px9sM2XCV3X2qlb9aOeo9jErdnlXhIEcYupFBNMbXz/jFBQridyMbfEXM/HKboS hKRjh6gv1wRcMSY/6UxbRvO0T13ivJDneEsatjarSsCxzVET+MVr5W7eQKWWPw/r+8luEG yesaWvbgO9qOhL2x+oBNzsNzOctX0RKRwQWeX5MBCxAng+qOeq1gwVTk3hBIUQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM073QZztkl for ; Tue, 30 Jun 2026 17:22:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45f78 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:22:04 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Kyle Evans From: Mark Johnston Subject: git: 8666a62872de - releng/15.1 - kern: fix auditing of ptrace(2) syscall requests List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 8666a62872def3356d42de5632f47cd33a804363 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:22:04 +0000 Message-Id: <6a43fb3c.45f78.654ccfe7@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8666a62872def3356d42de5632f47cd33a804363 commit 8666a62872def3356d42de5632f47cd33a804363 Author: Kyle Evans AuthorDate: 2026-06-25 17:02:47 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:41 +0000 kern: fix auditing of ptrace(2) syscall requests `error` here is the return value of syscall_thread_enter() rather than the syscall itself, so the committed audit records do not reflect reality. This is less harmful than them recording an error when the operation actually succeeded, but it could still possibly be used to throw off IDS techniques with things like bsmtrace. Approved by: so Security: FreeBSD-SA-26:45.audit Security: CVE-2026-49426 Reviewed by: des, kib, markj, csjp Differential Revision: https://reviews.freebsd.org/D57847 --- sys/kern/kern_sig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c index e48997ed966a..fed5b62ee1c7 100644 --- a/sys/kern/kern_sig.c +++ b/sys/kern/kern_sig.c @@ -2766,7 +2766,7 @@ ptrace_syscallreq(struct thread *td, struct proc *p, td->td_errno = nerror; if (audited) - AUDIT_SYSCALL_EXIT(error, td); + AUDIT_SYSCALL_EXIT(tsr->ts_ret.sr_error, td); if (!sy_thr_static) syscall_thread_exit(td, se); } From nobody Tue Jun 30 17:22:06 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM2527Qz6jZ1Z for ; Tue, 30 Jun 2026 17:22:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVM21vpnz3t25 for ; Tue, 30 Jun 2026 17:22:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840126; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Dwr1aZ7cVz5WWAf70b0ElNKl9J4D3Q0kaGwWn6ScuTM=; b=Npan8XZdSZU/98qredb0F9KAxnEWkDG83VIBlOYzbgeZCn22vgYva2MTvd4UH3qVV241lg twqkzZYsixYyIaVFhy/xK1hmDlf8LfAdlH6koaJST+LqwCliRBsN6m45+HNVL5BxsdhFRX eneBaj0una7bma/o1PP977MikaZQVVW3GJYl+xS7GD8uGiouAWRKw6zWdtmJJTh67dDp+D F+NYEumXGXeEGjjfFko4S62vfkaL43tRUmXRb7a4IaC7AZ4qUk+UixurK+fwETV1Vf54XF HmfjY1IZyoDzwlAixv1vZfA05GJEffARdl9kbVf1d8M3qKezvOTAh+YkWXtTDA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840126; a=rsa-sha256; cv=none; b=rmUgmWMHnujYYd2w3LAYMnnXbDVF7XzxHkE/aa/t59qAgSLIYbiOJdcXWtA4fPtnD0McJ3 GRzN2ifCkF0XHqGJpYUPLppIx2O4wmafIJ3Vlh7GhcFRz8rBPx5cQWBhEsWvhDkvkKt9Ld r+82D9t+gyVG+3/89j7itqKC8rsFC4niZ15acBI5bmBKv+lfHHGhiZYPCRySraPYWsNLQZ XRhO1xHsqLQGboBF1Kvj/iFm6jQkaBf1wSjXn4F88OSyVlVpINk+vQPyO8FVdto58duee3 k4+qRsKphyPvgZRrgKr7L0DMexv/ksXthdU+MfuHm0Q/Bk882Bb9E/kZF34d4A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840126; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Dwr1aZ7cVz5WWAf70b0ElNKl9J4D3Q0kaGwWn6ScuTM=; b=VI4gWpiqM5El/sKuJnO5nRwrWhRF1QLvSEvFQ0/AlHDyGL5KbfVOGA3cBVZgirkN5cN3EP TbrYAQSYpKcPJ1Aaz0CoqcAjFu3io7fF0R5NH1es4FrlA05i9s84nRuzwWTRUCsv3hIL0D 0W8cHVBrTxJzAd2HR5F9uUpUw/AGFb44tWEGe1p5iJpRPmVPh/SGyRKOYvQDCbi8rsW2+9 iuiz5sKWoKVLwEqdBRSPN9YZgxKl/NapcK/hbTPFBg3gPsy9CQpA4/2rCDBIqj8O1O8C+i O7o+uMDvgIsRoWNYCjj4W0qVw6SAYW8FJMc68hRh3WFwbR0i6d7VpuvFU+OlAQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM20dYlztjd for ; Tue, 30 Jun 2026 17:22:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45d52 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:22:06 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: John Baldwin From: Mark Johnston Subject: git: 54372e3b56b7 - releng/15.1 - ktls CBC decrypt: Only increment iovec index when an entry is used List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 54372e3b56b7b7b8946705a8116cc3ed540d511d Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:22:06 +0000 Message-Id: <6a43fb3e.45d52.4513e3d7@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=54372e3b56b7b7b8946705a8116cc3ed540d511d commit 54372e3b56b7b7b8946705a8116cc3ed540d511d Author: John Baldwin AuthorDate: 2026-06-24 01:14:11 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:41 +0000 ktls CBC decrypt: Only increment iovec index when an entry is used If an mbuf in the chain was skipped because it only contained bytes from the header, the iovec index ('i') was incremented even though the entry was not populated. Only increment 'i' when an iovec entry is consumed. Add a new type of KTLS receive test which writes a single TLS record via two separate write(2) calls over a TCP_NODELAY socket to trigger a split in the mbuf chain in the kernel. Test various split locations including after the "plain" TLS header (5 bytes), after the full TLS header, in the middle of the data payload, just before the start of the trailer, and in the middle of the trailer. These tests are also run against all supported ciphers, not just CBC. The 'header' test for CBC ciphersuites was able to trigger the bug. Approved by: so Security: FreeBSD-SA-26:46.ktls Security: CVE-2026-49423 Sponsored by: Chelsio Communications --- sys/opencrypto/ktls_ocf.c | 3 +- tests/sys/kern/ktls_test.c | 110 ++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 110 insertions(+), 3 deletions(-) diff --git a/sys/opencrypto/ktls_ocf.c b/sys/opencrypto/ktls_ocf.c index ece509f5f969..e61f607622b0 100644 --- a/sys/opencrypto/ktls_ocf.c +++ b/sys/opencrypto/ktls_ocf.c @@ -500,13 +500,14 @@ ktls_ocf_tls_cbc_decrypt(struct ktls_session *tls, iov[0].iov_base = &ad; iov[0].iov_len = sizeof(ad); skip = sizeof(*hdr) + AES_BLOCK_LEN; - for (i = 1, n = m; n != NULL; i++, n = n->m_next) { + for (i = 1, n = m; n != NULL; n = n->m_next) { if (n->m_len < skip) { skip -= n->m_len; continue; } iov[i].iov_base = mtod(n, char *) + skip; iov[i].iov_len = n->m_len - skip; + i++; skip = 0; } uio.uio_iov = iov; diff --git a/tests/sys/kern/ktls_test.c b/tests/sys/kern/ktls_test.c index 3970083e7f72..7003b86fb4e2 100644 --- a/tests/sys/kern/ktls_test.c +++ b/tests/sys/kern/ktls_test.c @@ -303,6 +303,15 @@ fd_set_blocking(int fd) ATF_REQUIRE(fcntl(fd, F_SETFL, flags) != -1); } +static void +tcp_nodelay(int fd) +{ + int nodelay = 1; + + ATF_REQUIRE(setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &nodelay, + sizeof(nodelay)) == 0); +} + static bool cbc_crypt(const EVP_CIPHER *cipher, const char *key, const char *iv, const char *input, char *output, size_t size, int enc) @@ -1920,6 +1929,55 @@ test_ktls_receive_bad_size(const atf_tc_t *tc, struct tls_enable *en, close_sockets_ignore_errors(sockets); } +static void +test_ktls_receive_split_record(const atf_tc_t *tc, struct tls_enable *en, + uint64_t seqno, size_t len, size_t first_len) +{ + char *plaintext, *received, *outbuf; + size_t outbuf_cap, outbuf_len; + ssize_t rv; + int sockets[2]; + + ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); + + plaintext = alloc_buffer(len); + received = malloc(len); + outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); + outbuf = malloc(outbuf_cap); + + ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); + + ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, + sizeof(*en)) == 0); + check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); + + fd_set_blocking(sockets[0]); + fd_set_blocking(sockets[1]); + + outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, + plaintext, len, outbuf, outbuf_cap, 0); + ATF_REQUIRE(first_len < outbuf_len); + + tcp_nodelay(sockets[1]); + rv = write(sockets[1], outbuf, first_len); + ATF_REQUIRE_INTEQ((ssize_t)(first_len), rv); + + rv = write(sockets[1], outbuf + first_len, outbuf_len - first_len); + ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len - first_len), rv); + + rv = ktls_receive_tls_record(en, sockets[0], TLS_RLTYPE_APP, received, + len); + ATF_REQUIRE_INTEQ((ssize_t)len, rv); + + ATF_REQUIRE(memcmp(plaintext, received, len) == 0); + + free(outbuf); + free(received); + free(plaintext); + + close_sockets(sockets); +} + #define TLS_10_TESTS(M) \ M(aes128_cbc_1_0_sha1, CRYPTO_AES_CBC, 128 / 8, \ CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO) \ @@ -2360,6 +2418,26 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ auth_alg, minor, name) \ ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name); +#define GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, name, len, first_len) \ +ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_split_##name); \ +ATF_TC_BODY(ktls_receive_##cipher_name##_split_##name, tc) \ +{ \ + struct tls_enable en; \ + uint64_t seqno; \ + \ + ATF_REQUIRE_KTLS(); \ + seqno = random(); \ + build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ + seqno, &en); \ + test_ktls_receive_split_record(tc, &en, seqno, len, first_len); \ + free_tls_enable(&en); \ +} + +#define ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, name) \ + ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_split_##name); + #define GEN_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ minor) \ GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ @@ -2381,7 +2459,22 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ tls_minimum_record_payload(&en) - 1) \ GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ auth_alg, minor, oversized_record, \ - TLS_MAX_MSG_SIZE_V10_2 * 2) + TLS_MAX_MSG_SIZE_V10_2 * 2) \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, header, 64, \ + sizeof(struct tls_record_layer)); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, full_header, 64, \ + tls_header_len(&en)); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, half, 64, \ + tls_header_len(&en) + 32); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_start, 64, \ + tls_header_len(&en) + 64); \ + GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_middle, 64, \ + tls_header_len(&en) + 64 + tls_trailer_len(&en) / 2); #define ADD_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ minor) \ @@ -2402,7 +2495,17 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ auth_alg, minor, small_record) \ ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ - auth_alg, minor, oversized_record) + auth_alg, minor, oversized_record) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, header) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, full_header) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, half) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_start) \ + ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ + key_size, auth_alg, minor, trailer_middle) \ /* * For each supported cipher suite, run several receive tests: @@ -2425,6 +2528,9 @@ ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ * size * * - a test with an oversized TLS record + * + * - tests of a single record whose data is split across two writes, + * with each test using a different split point */ AES_CBC_NONZERO_TESTS(GEN_RECEIVE_TESTS); AES_GCM_TESTS(GEN_RECEIVE_TESTS); From nobody Tue Jun 30 17:22:08 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM45N61z6jZ1f for ; Tue, 30 Jun 2026 17:22:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVM42tSmz3t6r for ; Tue, 30 Jun 2026 17:22:08 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840128; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MweIMYLbFsne44BYGDLCEu0XoahrlnIc59L7Jzk9JFc=; b=qXOwAzfFSxoVApkBiOdKhB/ymFDgdadow4TYIrHR7hHZLkwhqse9Miz5B7ayMQgHmT6Z3b ND8cvlIwmZBSl1CuagaE9kc7yygtWG1Xw8VSJZyyYhqTrqIz5fpYiItGM9Mqf5gMHihJLE pPKRpWAmJsuTRcxvWBJWoGDs9vZfuDrMwHUWLk8oEPb1PWaUzLSG4btbucHGQUQF9LGv+Y yj2Kw4Riz2IMUP73yPzOjbE9PWoNizdSlQ600Ktfkm4j/Ff7HmSr0CKuL4zuee7g853FwG y9PI3wuMtGjLpBsRxjLdbGKXKKNVakZSQI0UkIJrv15preYk61ldMVTuktvTGQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840128; a=rsa-sha256; cv=none; b=r/AjmHYrPTypStYe9lIGuNIHKhFBBVA5S+ysWCwal/Q8yhncS9XyoGkJsb2LsYgg517YX4 BzfNp0vFdeZ0O8lXs1kcepBXXA/nRYEdPQQMXDiuIPVh+z1aNGwOyoduNu+kXur59Cz2IX TwluxmRbIUuKtMx6m4Yhc+AW1ougqNVskIpITfGlqqLhOwn1TPQ9x4zqjlxRRMOcj3Iz8+ p0Z0eySrtpemeoWEHaZIYjLeUVPKYFiP38iPNpCwfZdBt4v69mWETFRIBd+kUqNnlthbb+ OY9sEPyJY6DYgnJMDqBEKW7d22s/IeqPEQHiuMFfdteW4yE1ioeVap8zYvm51Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840128; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MweIMYLbFsne44BYGDLCEu0XoahrlnIc59L7Jzk9JFc=; b=Ko01dNNYUXX4slx6hMZ0NyPNVz/QDL/e/es7v75ChgK4chjQ40CGcP5AKUQgxcER9P+Gmw jcEL3EcT1hO6dISdm4FxUr5QjHEx+of7MgtZ6gfCmpA7txDW3oiM0BsJZzkGfNy2eKr3BR Ruu6vGC0Z5zQDC2CfXtadfLNEpnOWm+vBGzIPQ5tHeTmONmZEg1F1YYF+OoTIw+fDy/f2L YlSmzL17sVEJVhHn/+Pos/jeLVKw/Wxs3qR0EWu5hXX075br0Cer54W1Ci2PHdsemnk/sI MWoJsg3v3+KQ44M85dDGzTjlRA8XfDbxZLWunQJC4D99rGqtV0tHsvL12JLsAw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM41XdZztkp for ; Tue, 30 Jun 2026 17:22:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45d55 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:22:08 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Taylor R Campbell From: Mark Johnston Subject: git: f22b4df4633b - releng/15.1 - iconv(3): Draft some automatic tests. List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: f22b4df4633b019ff9c3f3e6796624c6a7ff15cb Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:22:08 +0000 Message-Id: <6a43fb40.45d55.62bc0ae1@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=f22b4df4633b019ff9c3f3e6796624c6a7ff15cb commit f22b4df4633b019ff9c3f3e6796624c6a7ff15cb Author: Taylor R Campbell AuthorDate: 2026-06-22 19:44:55 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:41 +0000 iconv(3): Draft some automatic tests. Based on a report by Nick Wellnhofer. Approved by: so Security: FreeBSD-SA-26:49.iconv Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57948 --- contrib/netbsd-tests/lib/libc/locale/t_iconv.c | 355 +++++++++++++++++++++++++ lib/libc/tests/locale/Makefile | 1 + 2 files changed, 356 insertions(+) diff --git a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c new file mode 100644 index 000000000000..f25c061bb170 --- /dev/null +++ b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c @@ -0,0 +1,355 @@ +/* $NetBSD$ */ + +/*- + * Copyright (c) 2025 The NetBSD Foundation, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS + * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +/* + * iconv(3) + */ + +#include +__RCSID("$NetBSD: t_mbrtoc8.c,v 1.3 2024/08/20 17:43:09 riastradh Exp $"); + +#include +#include +#include +#include +#include +#include +#include + +#include "h_macros.h" + +static const struct sample { + const char *src_codeset; + size_t nsrc; + const char *src; + const char *dst_codeset; + size_t ndst; + const char *dst; + size_t ninval; + size_t ninval_rev; + const char *xfail; +#define IRREVERSIBLE ((size_t)-1) +} samples[] = { + [0] = { "us-ascii", 6, "hello", + "us-ascii", 6, "hello", + 0, 0, NULL }, + /* LATIN SMALL LETTER E WITH ACUTE ACCENT */ + [1] = { "iso-8859-1", 1, (const char[1]){0xe9}, + "UTF-8", 2, (const char[2]){0xc3,0xa9}, + 0, 0, NULL }, + /* LEFT CURLY BRACKET */ + [2] = { "UTF-8", 2, (const char[2]){0x00,0x7b}, + "ZW", 6, (const char[6]){0x00,0x7a,0x57,0x20,0x7b,0x0a}, + 0, 0, NULL }, + /* LATIN SMALL LETTER O, TILDE */ + [3] = { "UTF-8", 2, (const char[2]){0x4f,0x7e}, + "VIQR", 3, (const char[3]){0x4f,0x5c,0x7e}, + 0, 0, NULL }, + /* LEFT CURLY BRACKET (optionally encoded in UTF-7) */ + [4] = { "UTF-7", 1, (const char[1]){0x7b}, + "UTF-8", 1, (const char[1]){0x7b}, + 0, IRREVERSIBLE, NULL }, + [5] = { "UTF-7", 4, "+AHs-", + "UTF-8", 1, (const char[1]){0x7b}, + 0, 0, NULL }, + /* éclair */ + [6] = { "UTF-7", 10, "+AOk-clair", + "UTF-8", 7, (const char[7]){ + 0xc3,0xa9,0x63,0x6c,0x61,0x69,0x72, + }, + 0, 0, NULL }, + [7] = { "HZ", 55, /* RFC 1843, Sec. 4, Example 1 */ + "The next sentence is in GB.~{<:Ky2;S{#,NpJ)l6HK!#~}Bye.", + "UTF-8", 61, (const char[61]) { + 0x54,0x68,0x65,0x20, 0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e, 0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73, 0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0xe5, 0xb7,0xb1,0xe6,0x89, + 0x80,0xe4,0xb8,0x8d, 0xe6,0xac,0xb2,0xef, + 0xbc,0x8c,0xe5,0x8b, 0xbf,0xe6,0x96,0xbd, + 0xe6,0x96,0xbc,0xe4, 0xba,0xba,0xe3,0x80, + 0x82,0x42,0x79,0x65, 0x2e + }, + 0, 0, NULL }, + /* Same as above but with HZ8 instead of HZ. */ + [8] = { "HZ8", 55, (const char[55]) { + 0x54,0x68,0x65,0x20,0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e,0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73,0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0x7e,0x7b,0xbc,0xba,0xcb, + 0xf9,0xb2,0xbb,0xd3,0xfb,0xa3,0xac,0xce, + 0xf0,0xca,0xa9,0xec,0xb6,0xc8,0xcb,0xa1, + 0xa3,0x7e,0x7d,0x42,0x79,0x65,0x2e + }, + "UTF-8", 61, (const char[61]) { + 0x54,0x68,0x65,0x20, 0x6e,0x65,0x78,0x74, + 0x20,0x73,0x65,0x6e, 0x74,0x65,0x6e,0x63, + 0x65,0x20,0x69,0x73, 0x20,0x69,0x6e,0x20, + 0x47,0x42,0x2e,0xe5, 0xb7,0xb1,0xe6,0x89, + 0x80,0xe4,0xb8,0x8d, 0xe6,0xac,0xb2,0xef, + 0xbc,0x8c,0xe5,0x8b, 0xbf,0xe6,0x96,0xbd, + 0xe6,0x96,0xbc,0xe4, 0xba,0xba,0xe3,0x80, + 0x82,0x42,0x79,0x65, 0x2e + }, + 0, 0, NULL }, +}; + +#ifdef MIN +#undef MIN +#endif +#define MIN(x, y) ((x) < (y) ? (x) : (y)) + +static void +test_sample_bounded(const char *title, const struct sample *S, + size_t nsrc, size_t ndst) +{ + char inbuf[4096], inguard = arc4random(); + char outbuf[4096], outguard = arc4random(); + iconv_t C; + char *src0, *src, *dst0, *dst; + size_t srcleft0, srcleft, dstleft0, dstleft; + size_t ninval; + int error; + + ATF_REQUIRE_MSG(S->nsrc < sizeof(inbuf) - 2, "[%s]", title); + ATF_REQUIRE_MSG(S->ndst < sizeof(outbuf) - 2, "[%s]", title); + + memset(inbuf, inguard, sizeof(inbuf)); + memset(outbuf, outguard, sizeof(outbuf)); + src = src0 = inbuf + 1; + memcpy(src, S->src, nsrc); + dst = dst0 = outbuf + 1; + srcleft = srcleft0 = nsrc; + dstleft = dstleft0 = ndst; + + C = iconv_open(S->dst_codeset, S->src_codeset); + if (C == (iconv_t)-1) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv_open: %s (%d)", title, + strerror(error), error); + return; + } + + ninval = iconv(C, &src, &srcleft, &dst, &dstleft); + if (ninval == (size_t)-1) { + error = errno; + /* + * Incomplete input manifests as EINVAL -- ignore that, + * unless we're trying the full-size input. + * + * Truncated output manifests as E2BIG -- ignore that, + * unless we're trying the full-size output. + */ + if ((error != EINVAL || nsrc == S->nsrc) && + (error != E2BIG || ndst == S->ndst)) { + atf_tc_fail_nonfatal("[%s] iconv: %s (%d)", + title, strerror(error), error); + goto next; + } + } else if (ninval != S->ninval) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv:" + " %zu invalid, expected %zu", + title, ninval, S->ninval); + } + + ATF_CHECK_MSG(src0 <= src && src <= src0 + srcleft0, "[%s] iconv:" + " src went from %p to %p, expected [%p,%p]", + title, src0, src, src0, src0 + srcleft0); + ATF_CHECK_MSG(srcleft <= srcleft0, "[%s] iconv:" + " srcleft went from %zu to %zu", + title, srcleft0, srcleft); + ATF_CHECK_MSG(dst0 <= dst && dst <= dst0 + dstleft0, "[%s] iconv:" + " dst went from %p to %p, expected [%p,%p]", + title, dst0, dst, dst0, dst0 + dstleft0); + ATF_CHECK_MSG(dstleft <= dstleft0, "[%s] iconv:" + " dstleft went from %zu to %zu", + title, dstleft0, dstleft); + if (memcmp(dst0, S->dst, MIN(ndst, dstleft0 - dstleft)) != 0) { + size_t k; + + atf_tc_fail_nonfatal("[%s] iconv: bad conv", title); + fprintf(stderr, "[%s] input: ", title); + for (k = 0; k < nsrc; k++) + fprintf(stderr, " %02x", (unsigned char)S->src[k]); + fprintf(stderr, "\n"); + fprintf(stderr, "[%s] expected: ", title); + for (k = 0; k < ndst; k++) + fprintf(stderr, " %02x", (unsigned char)S->dst[k]); + fprintf(stderr, "\n"); + fprintf(stderr, "[%s] got: ", title); + for (k = 0; k < ndst; k++) + fprintf(stderr, " %02x", (unsigned char)dst0[k]); + fprintf(stderr, "\n"); + } + +next: if (dst0[-1] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran before buffer:" + " dst0[-1] = 0x%02x, expected 0x%02x", + title, dst0[-1], outguard); + } + if (dst0[ndst] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran after buffer:" + " dst0[ndst=%zu] = 0x%02x, expected 0x%02x", + title, ndst, dst0[ndst], outguard); + } + if (dst[0] != outguard) { + atf_tc_fail_nonfatal("[%s] iconv overran past updated dst:" + " dst[0] = 0x%02x, expected 0x%02x", + title, dst[0], outguard); + } + + if (iconv_close(C) == -1) { + error = errno; + atf_tc_fail_nonfatal("[%s] iconv_close: %s (%d)", + title, strerror(error), error); + } +} + +static void +test_sample(const char *title, const struct sample *S) +{ + char buf[128]; + size_t nsrc, ndst; + + fprintf(stderr, "test %s from %s to %s\n", + title, S->src_codeset, S->dst_codeset); + + for (nsrc = 0; nsrc <= S->nsrc; nsrc++) { + snprintf(buf, sizeof(buf), "%s %zu/%zu", title, nsrc, S->ndst); + test_sample_bounded(buf, S, nsrc, S->ndst); + } + + for (ndst = 0; ndst <= S->ndst; ndst++) { + snprintf(buf, sizeof(buf), "%s %zu/%zu", title, S->nsrc, ndst); + test_sample_bounded(buf, S, S->nsrc, ndst); + } +} + +ATF_TC(iconv_samples); +ATF_TC_HEAD(iconv_samples, tc) +{ + + atf_tc_set_md_var(tc, "descr", "Test iconv on various fixed samples"); +} +ATF_TC_BODY(iconv_samples, tc) +{ + unsigned i; + + for (i = 0; i < __arraycount(samples); i++) { + const struct sample *S = &samples[i]; + struct sample reverse = { + .src_codeset = S->dst_codeset, + .dst_codeset = S->src_codeset, + .nsrc = S->ndst, + .src = S->dst, + .ndst = S->nsrc, + .dst = S->src, + .ninval = S->ninval_rev, + }; + char buf[128]; + + if (S->xfail) + atf_tc_expect_fail("%s", S->xfail); + + snprintf(buf, sizeof(buf), "case %u: %s to %s", i, + S->src_codeset, S->dst_codeset); + test_sample(buf, S); + if (S->ninval_rev != IRREVERSIBLE) { + snprintf(buf, sizeof(buf), "case %u: %s to %s", i, + S->dst_codeset, S->src_codeset); + test_sample(buf, &reverse); + } + + if (S->xfail) + atf_tc_expect_pass(); + } +} + +ATF_TC(iconv_pr59019_hz8); +ATF_TC_HEAD(iconv_pr59019_hz8, tc) +{ + + atf_tc_set_md_var(tc, "descr", "Truncated HZ8 input from PR 59019"); +} +ATF_TC_BODY(iconv_pr59019_hz8, tc) +{ + const char title[] = "iconv_pr59019_hz8"; + char in[4] = "\x7e\x7b\x7e\x7e"; /* ~{~~ */ + char out[4096], guard = arc4random(); + char *src0, *src, *dst0, *dst; + size_t srcleft0, srcleft, dstleft0, dstleft; + iconv_t C; + size_t ninval; + + memset(out, guard, sizeof(out)); + + REQUIRE_LIBC((C = iconv_open(/*to*/"UTF-8", /*from*/"HZ8")), + (iconv_t)-1); + + src = src0 = in; + srcleft = srcleft0 = sizeof(in); + dst = dst0 = out + 1; + dstleft = dstleft0 = sizeof(out) - 2; + + ninval = iconv(C, &src, &srcleft, &dst, &dstleft); + + /* + * XXX Not actually 100% sure this is the correct result -- I + * can't find a reference for the HZ8 encoding. + */ + ATF_CHECK_EQ_MSG(ninval, (size_t)-1, "[%s] iconv: ninval=%zu", title, + ninval); + + ATF_CHECK_MSG(src0 <= src && src <= src0 + srcleft0, "[%s] iconv:" + " src went from %p to %p, expected [%p,%p)", + title, src0, src, src0, src0 + srcleft0); + ATF_CHECK_MSG(srcleft <= srcleft0, "[%s] iconv:" + " srcleft went from %zu to %zu", + title, srcleft0, srcleft); + ATF_CHECK_MSG(dst0 <= dst && dst <= dst0 + dstleft0, "[%s] iconv:" + " dst went from %p to %p, expected [%p,%p)", + title, dst0, dst, dst0, dst0 + dstleft0); + ATF_CHECK_MSG(dstleft <= dstleft0, "[%s] iconv:" + " dstleft went from %zu to %zu", + title, dstleft0, dstleft); + + ATF_CHECK_EQ(dst0[-1], guard); + ATF_CHECK_EQ(dst0[dstleft0], guard); + + RL(iconv_close(C)); +} + +ATF_TP_ADD_TCS(tp) +{ + + ATF_TP_ADD_TC(tp, iconv_pr59019_hz8); + ATF_TP_ADD_TC(tp, iconv_samples); + + return atf_no_error(); +} diff --git a/lib/libc/tests/locale/Makefile b/lib/libc/tests/locale/Makefile index 70905cc58d24..2f9a08f65086 100644 --- a/lib/libc/tests/locale/Makefile +++ b/lib/libc/tests/locale/Makefile @@ -21,6 +21,7 @@ ATF_TESTS_C+= wctomb_2_test # Note: io_test requires zh_TW.Big5 locale (see ^/head@r315568) #NETBSD_ATF_TESTS_C= io_test +NETBSD_ATF_TESTS_C+= iconv_test NETBSD_ATF_TESTS_C+= mbrtowc_test NETBSD_ATF_TESTS_C+= mbstowcs_test NETBSD_ATF_TESTS_C+= mbsnrtowcs_test From nobody Tue Jun 30 17:22:07 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM372TDz6jZ8B for ; Tue, 30 Jun 2026 17:22:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVM32QQNz3t48 for ; Tue, 30 Jun 2026 17:22:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840127; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=HmKSaKUdOmz026E7BxRXkmJm4x1VUx03BlP41FnEBLI=; b=Xcg/szn/FcEQ7dBd64PFsAEJtc5+HHUo75GrIOYTT2QOsmr4D/rL406jcTTMlg+bp1RGS5 odj2RLmTb+qtlaVZqSWV57uLGPbFXxoEkcN3d0fB0Rvxzl/FdZc9wKFKrUeX9ut4zQS/wZ T0gmkT3dLkbiMVKQgjmoGcO9JBY1viSxNdlcquDw1KA11ay8E4kWeZnyOlexurwLkipSm7 xIydGUjgPG/mSmTGt3pS00nOfkeMWgh51Xvj60MBGqJqUd9WNHhZKCInxXF293qslezbir 4FQhtCGwYdcCVhe9IEz4J9N9BA7kZzbWCgOQENvhIsBLbgrkpmTux/ogkF5nFA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840127; a=rsa-sha256; cv=none; b=adCXV2zESO64urcjMLwv3hllnbLGDQc5xS+nX02TPaJrR70Yq2NWZQGFXOIHROhXbTaZhl jjICROKoTTPhDHVic0T4t8oUS85hsIAq8WTGNbj9oTeShONgDiMca5UkrzfayAAYn0cdDd k9mPMYJKw0XoiThTW1blqNIJFVEryVcLGLOCD4ddOsnq0Xk0U5z48/th5yiMSJAiRgy08X HqVzKTn5jUIYA1v2sZu2VRo6kpB9hGOtCfI6vWOx7/91jNcAUikn7xNuX/r/3h/fjRIqJl 0uVfltcaUwV/VIfwXWzB8L6ddIc2kr5cAkwBIMZrdhH8dkE8lxyCr+rxpN1gPA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840127; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=HmKSaKUdOmz026E7BxRXkmJm4x1VUx03BlP41FnEBLI=; b=kWxs4FNIw4JtFnoymoa2RBi2dDUQBmD3NN9c2HgaDetZi2omNKXnquRyPNaFnniLGgGCkq 7xadq/UgQAyPwbJ5H9npGlqv8GTyL7qCOe5sP7vgLAeDoc8ZWnc3imTcyfWciFRdHLsoEK E3a3+dVtGwcurUgi1fiCJ7nRNEM73b5iqFm8bV+7OToSln4mg+CJ6hKkiu2aPPS4YBj+DO n33qqAP9ZMHvQKK2cIKtJ07wZqiyqVFwvUPRNIofTtmR1NJcuHFnqnQ5SVqrM3atp6Fu78 rfp5EY09Oi2601yEvt6YxhW6Ate6HzPl4OoygdhWOI+HjfC3ZZR6fU4W3Eqy+w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM3112sztTL for ; Tue, 30 Jun 2026 17:22:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44fbc by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:22:07 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Taylor R Campbell From: Mark Johnston Subject: git: 9f0c4c445008 - releng/15.1 - iconv(3): Fix problems in various encodings List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 9f0c4c44500842fd7bb5fbb1a3ce706894dbf6a8 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:22:07 +0000 Message-Id: <6a43fb3f.44fbc.208f8d29@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=9f0c4c44500842fd7bb5fbb1a3ce706894dbf6a8 commit 9f0c4c44500842fd7bb5fbb1a3ce706894dbf6a8 Author: Taylor R Campbell AuthorDate: 2026-06-22 21:15:25 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:41 +0000 iconv(3): Fix problems in various encodings Fix null pointer dereference with HZ8 encoding. Fix output buffer overrun in UTF-7, VIQR, ZW encodings. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: markj, kevans Differential Revision: https://reviews.freebsd.org/D57947 --- lib/libiconv_modules/HZ/citrus_hz.c | 2 ++ lib/libiconv_modules/UTF7/citrus_utf7.c | 20 +++++++++++++++----- lib/libiconv_modules/VIQR/citrus_viqr.c | 6 +++++- lib/libiconv_modules/ZW/citrus_zw.c | 7 +++++-- 4 files changed, 27 insertions(+), 8 deletions(-) diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index f12938a7dab8..db738b8f812e 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -262,6 +262,8 @@ _citrus_HZ_mbrtowc_priv(_HZEncodingInfo * __restrict ei, tail = psenc->chlen = 0; continue; } + if (graphic == NULL) + break; } else if (ch & 0x80) { if (graphic != GR(psenc->inuse)) break; diff --git a/lib/libiconv_modules/UTF7/citrus_utf7.c b/lib/libiconv_modules/UTF7/citrus_utf7.c index f924366551f1..e7c6a0862c54 100644 --- a/lib/libiconv_modules/UTF7/citrus_utf7.c +++ b/lib/libiconv_modules/UTF7/citrus_utf7.c @@ -296,7 +296,7 @@ done: static int _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei, - char * __restrict s, size_t n __unused, uint16_t u16, + char * __restrict s, size_t n, uint16_t u16, _UTF7State * __restrict psenc, size_t * __restrict nresult) { int bits, i; @@ -336,6 +336,8 @@ _citrus_UTF7_utf16tomb(_UTF7EncodingInfo * __restrict ei, psenc->ch[psenc->chlen++] = base64[i]; } } + if (n < (size_t)psenc->chlen) + return (E2BIG); memcpy(s, psenc->ch, psenc->chlen); *nresult = psenc->chlen; psenc->chlen = 0; @@ -352,6 +354,8 @@ _citrus_UTF7_wcrtomb_priv(_UTF7EncodingInfo * __restrict ei, uint16_t u16[2]; int err, i, len; size_t nr, siz; + char buf[8], *bufp = buf; + _UTF7State psenc_save = *psenc; u32 = (uint32_t)wchar; if (u32 <= UTF16_MAX) { @@ -367,14 +371,20 @@ _citrus_UTF7_wcrtomb_priv(_UTF7EncodingInfo * __restrict ei, return (EILSEQ); } siz = 0; + if (n > sizeof(buf)) + n = sizeof(buf); for (i = 0; i < len; ++i) { - err = _citrus_UTF7_utf16tomb(ei, s, n, u16[i], psenc, &nr); - if (err != 0) - return (err); /* XXX: state has been modified */ - s += nr; + err = _citrus_UTF7_utf16tomb(ei, bufp, n, u16[i], psenc, &nr); + if (err != 0) { + *nresult = (size_t)-1; + *psenc = psenc_save; /* restore state */ + return (err); + } + bufp += nr; n -= nr; siz += nr; } + memcpy(s, buf, siz); *nresult = siz; return (0); diff --git a/lib/libiconv_modules/VIQR/citrus_viqr.c b/lib/libiconv_modules/VIQR/citrus_viqr.c index 1747c0a1705e..c1e88f188aab 100644 --- a/lib/libiconv_modules/VIQR/citrus_viqr.c +++ b/lib/libiconv_modules/VIQR/citrus_viqr.c @@ -323,7 +323,11 @@ _citrus_VIQR_wcrtomb_priv(_VIQREncodingInfo * __restrict ei, int ch = 0; switch (psenc->chlen) { - case 0: case 1: + case 0: + break; + case 1: + if (n-- < 1) + goto e2big; break; default: return (EINVAL); diff --git a/lib/libiconv_modules/ZW/citrus_zw.c b/lib/libiconv_modules/ZW/citrus_zw.c index 3c650c46d0f4..cf66581c3336 100644 --- a/lib/libiconv_modules/ZW/citrus_zw.c +++ b/lib/libiconv_modules/ZW/citrus_zw.c @@ -263,9 +263,12 @@ _citrus_ZW_wcrtomb_priv(_ZWEncodingInfo * __restrict ei __unused, ch = (unsigned char)wc; switch (psenc->charset) { case NONE: - if (ch == '\0' || ch == '\n') + if (ch == '\0' || ch == '\n') { + if (n < 1) + return (E2BIG); + n -= 1; psenc->ch[psenc->chlen++] = ch; - else { + } else { if (n < 4) return (E2BIG); n -= 4; From nobody Tue Jun 30 17:22:10 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM65vRdz6jZ6C for ; Tue, 30 Jun 2026 17:22:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVM63rGfz3t0D for ; Tue, 30 Jun 2026 17:22:10 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840130; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=VCPP8edOC+oK4nLuFY69VIq0SWWGetcdHSU1gTn+2qc=; b=gRPnk5SwJEDJTA9quGSHPT62OAJDYgje5YS4kpaZwhGpkxURQBCNdmeU2E1kPu6D3Zat6Y eEIzzRknlAnXs+yKsuyFtbQCubWB9yg40+7MiNcEq6Vxe3XH18ziv1Z9rrGsibhXMWOkcV FNV55UC7CjeTl55i21B5VEeXD1yREKJWXjJ+vvu3ZK8LldF80rrSFlgL/gRz2EHcuD8IIn RXrFsenpOhEYKaaB3zASc6QXvJ8J+J/b/1o39BYYS1RuRAiOaVMFDHkl8LQJJ9OsgA1by+ iOKrESu9caKiwTdjlYuKsfUzk6rye/xZZqPVrXKExMjeFUaTVlh4HNekoQ39Jg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840130; a=rsa-sha256; cv=none; b=vxY/RlPRqZR+JelyLAw+ZNmIZrPclhbw4d9tU7dtvNe2X0gWHdZanu2s5aj/zCj0VuWkXW NnIFbjJ5cocCQUQkO1me2fqPBMA/ZwdAiMlAbnlt/CbTO1JZD1l/QHZ2IfFlImOq4U6dgX Kw4Dp2SWedv2IYMrdD7IXaA507P37/NfEOxIXsBAAfIqucccI7GXLXcxy4AmJDW4Y/pN/z iUQB6r9uAmFvMO6VhBbisTYJZbS7O/NY2SrQopPmaThaWUu0NGNdmAFm/l2zHIRC+hrChZ 5HnRZR1lNJ2ZVP4ChpnsqU1P1Lwg7Pkn1l3SDb++8/ENaqDYPQC5RgiE5asV9w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840130; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=VCPP8edOC+oK4nLuFY69VIq0SWWGetcdHSU1gTn+2qc=; b=f+/LGau1kotxD4j44b0IiXHc8pBo+Isbg/KrVyGi9QAu6grTpQOEn2C8tE2oA6ITS/gbbH RLHVmSbf0SpUIcj+F70HyjfZFOfXEk2i1i2g0HETPMpvVz7WBYszgQONF76LmttFghuVfn yl1hsz7PE6vILwb1KQhUQYFNEHlPYRF45yyG5oa09KoLd96Nnv6G8SIh2wrMJLTJeM74qU tKnaeuJeHR5T7vPCzyYOAffjdw95ejBOewX2ESQU3ok2UJLPANLInuu5rzeALcZLQJoBBX 44y4UmgQOXeC4eKfmQwKq6YZtSXUlKmeLLQsFFrwMXKjDVljLXoZBKpstr8HTA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM62q3VztTR for ; Tue, 30 Jun 2026 17:22:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 458a3 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:22:10 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 6b2dad9fe87d - releng/15.1 - iconv: Fix a stack buffer overflow in _ISO2022_sputwchar() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 6b2dad9fe87d14fc21af6233be2cbc79e77ac768 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:22:10 +0000 Message-Id: <6a43fb42.458a3.241e89ac@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=6b2dad9fe87d14fc21af6233be2cbc79e77ac768 commit 6b2dad9fe87d14fc21af6233be2cbc79e77ac768 Author: Mark Johnston AuthorDate: 2026-06-23 17:45:28 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:41 +0000 iconv: Fix a stack buffer overflow in _ISO2022_sputwchar() In the ISO2022-CN encoding, characters may require at least seven bytes, and MB_LEN_MAX==6 is insufficient. From code inspection, _ISO2022_sputwchar() can emit 10 bytes in the worst case, so use that to size buffers. Add a regression test. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58082 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57950 --- contrib/netbsd-tests/lib/libc/locale/t_iconv.c | 20 ++++++++++++++++++++ lib/libiconv_modules/ISO2022/citrus_iso2022.c | 8 ++++---- 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c index f25c061bb170..199774769827 100644 --- a/contrib/netbsd-tests/lib/libc/locale/t_iconv.c +++ b/contrib/netbsd-tests/lib/libc/locale/t_iconv.c @@ -117,6 +117,26 @@ static const struct sample { 0x82,0x42,0x79,0x65, 0x2e }, 0, 0, NULL }, + /* 馬 from CNS 11643-1 */ + [9] = { "UTF-8", 3, (const char[3]){0xe9,0xa6,0xac}, + "ISO-2022-CN", 8, + (const char[8]){0x1b,0x24,0x29,0x47,0x0e,0x58,0x6b,0x0f}, + 0, 0, NULL }, + /* 馬毦 shifting from CNS 11643-1 to CNS 11643-2 */ + [10] = { "UTF-8", 6, (const char[6]){0xe9,0xa6,0xac,0xe6,0xaf,0xa6}, + "ISO-2022-CN", 16, + (const char[16]){ + /* ESC $ ) G (shift G1 to CNS 11643 plane 1) */ + 0x1b,0x24,0x29,0x47, + 0x0e, /* GL is G1 from now on */ + 0x58,0x6b, /* 馬 */ + /* ESC $ * H (shift G2 to CNS 11643 plane 2) */ + 0x1b,0x24,0x2a,0x48, + 0x1b,0x4e, /* GL is G2 for next char */ + 0x30,0x21, /* 毦 */ + 0x0f, /* GL is G0 from now on */ + }, + 0, 0, "PR lib/59019: various iconv issues ([case 10: ISO-2022-CN to UTF-8 14/6] iconv: Illegal byte sequence (85))" }, }; #ifdef MIN diff --git a/lib/libiconv_modules/ISO2022/citrus_iso2022.c b/lib/libiconv_modules/ISO2022/citrus_iso2022.c index 126d38316df4..a28dc0be0022 100644 --- a/lib/libiconv_modules/ISO2022/citrus_iso2022.c +++ b/lib/libiconv_modules/ISO2022/citrus_iso2022.c @@ -129,7 +129,7 @@ typedef struct { #define _FUNCNAME(m) _citrus_ISO2022_##m #define _ENCODING_INFO _ISO2022EncodingInfo #define _ENCODING_STATE _ISO2022State -#define _ENCODING_MB_CUR_MAX(_ei_) MB_LEN_MAX +#define _ENCODING_MB_CUR_MAX(_ei_) 10 #define _ENCODING_IS_STATE_DEPENDENT 1 #define _STATE_NEEDS_EXPLICIT_INIT(_ps_) \ (!((_ps_)->flags & _ISO2022STATE_FLAG_INITIALIZED)) @@ -1012,7 +1012,7 @@ _ISO2022_sputwchar(_ISO2022EncodingInfo * __restrict ei, wchar_t wc, { _ISO2022Charset cs; char *p; - char tmp[MB_LEN_MAX]; + char tmp[10]; size_t len; int bit8, i = 0, target; unsigned char mask; @@ -1177,7 +1177,7 @@ _citrus_ISO2022_put_state_reset(_ISO2022EncodingInfo * __restrict ei, size_t * __restrict nresult) { char *result; - char buf[MB_LEN_MAX]; + char buf[10]; size_t len; int ret; @@ -1206,7 +1206,7 @@ _citrus_ISO2022_wcrtomb_priv(_ISO2022EncodingInfo * __restrict ei, _ISO2022State * __restrict psenc, size_t * __restrict nresult) { char *result; - char buf[MB_LEN_MAX]; + char buf[10]; size_t len; int ret; From nobody Tue Jun 30 17:22:09 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM61n1jz6jYpl for ; Tue, 30 Jun 2026 17:22:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVM53RScz3t6v for ; Tue, 30 Jun 2026 17:22:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840129; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=h6UmD+E/vY0MDIVqesayzJRVTM0pQPcaiI+s0Zby0P4=; b=RK3McfR7N1rLNTWGVmpF2z3pKBHHSo5w9ZXoKHMpshG8cxXUsu+YnY43p4CTt3IhJOfVaN TefRD41dGeNqqyTRueKKLMHXxd0u/G/icv4XtqoeUgllCiuHZAZj8OuoisNo9MBv2b06Zc CrN9/FOkjZ5b/z8ZAEiuQzELhfqWar3PuAp9TAMF5TThOal8dXgFV/Did3Kk4WA7TAPqHX AsHIZv36UcVZKnFrGZvyMMH/9I/WIQvqySlF/7YSd3mwBHMnB9qkQHyUhz5XJkejR0FwoG rnbS1YrALigMhiaJHGzp+boAWXpNcHuEL0v2R5GM1oScA7zx7aBwoafS0iuHZw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840129; a=rsa-sha256; cv=none; b=RiiFMahFKaqiOIHr57xZec2esdxOCJUmMHJnZEIUZ1jigw2lAUHzBqiloX+vfmK25yM0JH 0qfxY9lU6QsoRaPZ/t/s1WUo9vVHTVh82yLkzvXeRQIbp6QhHZBfOdJzvjH7hvrIMeHvrt uzKSlkXiJiAj+y6osL3HSXpcq8a3qwUtwpdWGPVSgjH8mt3VwIqpeGsYfpx+C1QSCJ3ewY eLTjZU+aO8aa7ROC2GOfkIS5zQklNjaRQUAN/3DAt/p1bkc9zS8e+/vlPpTh2Z0zzIXGFx nJ2T9zU3joa6QJJ6J7N9i/XOLbwRsf9uicUZDgvrRdVsSOzvuvw8rNmcEebHOg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840129; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=h6UmD+E/vY0MDIVqesayzJRVTM0pQPcaiI+s0Zby0P4=; b=PfFxf6HJbc9eKlPaPrIfNqWTkLi2PAHJMQMpQhwdUSjasM7UvO+CDGTCybf9MDUWekhJMT DZ7uAP/RJltpFOg8YEp5MB1xrZnUX1Ld51dGQnanvdbwk8lxXhGiMrnb/4oxg/UV5AH4mv KkBH8yIFXFAe30WPOhs9pCmx1NDFzrkLCMHLw4Qk1K2vt/zxODaJ1uV1jrcruqmvr5La+K FKwzrFSwg2sYp8lskB/q4IwABD+sSDYAdfCd8APfTqWJcdxYn7xHRUUfLt6y6gC/50Cs6+ or5CFghZYh09MjpR+/X3juCcl6sSR0zzyugbX6qWhoxjujOvGniSfFGc1ZHEGg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM526Z0ztsv for ; Tue, 30 Jun 2026 17:22:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46670 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:22:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 898206bd5bc1 - releng/15.1 - iconv: Fix a buffer overflow in the HZ encoding List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 898206bd5bc141c00955f92034c06c1f3374dac1 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:22:09 +0000 Message-Id: <6a43fb41.46670.7d291d3@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=898206bd5bc141c00955f92034c06c1f3374dac1 commit 898206bd5bc141c00955f92034c06c1f3374dac1 Author: Mark Johnston AuthorDate: 2026-06-23 16:05:31 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:41 +0000 iconv: Fix a buffer overflow in the HZ encoding wcrtomb may store up to 2 2-byte escape sequences to the state buffer in addition to the character itself. In the worst case, a 3-byte heap overflow is possible. Approved by: so Security: FreeBSD-SA-26:49.iconv Security: CVE-2026-58081 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57949 --- lib/libiconv_modules/HZ/citrus_hz.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libiconv_modules/HZ/citrus_hz.c b/lib/libiconv_modules/HZ/citrus_hz.c index db738b8f812e..e16ab3a8e34c 100644 --- a/lib/libiconv_modules/HZ/citrus_hz.c +++ b/lib/libiconv_modules/HZ/citrus_hz.c @@ -132,7 +132,7 @@ typedef struct { typedef struct { escape_t *inuse; int chlen; - char ch[ROWCOL_MAX]; + char ch[4 + ROWCOL_MAX]; } _HZState; #define _CEI_TO_EI(_cei_) (&(_cei_)->ei) From nobody Tue Jun 30 17:22:11 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM80bxZz6jYgT for ; Tue, 30 Jun 2026 17:22:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVM74qbwz3t35 for ; Tue, 30 Jun 2026 17:22:11 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840131; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sFmnnkc/7aT3xlGeJ2qA4l2z/dCl43jJUoXFTcgP2jI=; b=wsqWbRw2nLNCBeK4RzYL8nr0obNSIFHku624tOuW8C3C+p8pGb/xf0MaykCDKbSuhYFAHp fCx/tYgVY2KKV49I1yUTHnSjk6HmlEc7gouVezWi+Y3N5cDbcfnnV0ptN8OSbjn4CDDoUS iwR6EcqB80R1mKDg9deL9JV/XjGnDwbvrUpqd8zDS34f2ZwwWJb98ePUU7iIFG1VxpDJV+ MrwosBJI3WmA2VxIwRNzJRTUE0j7DbQ1DDgQu8oCTOmSekFoagUQXjE1aJu+6MFrgLqwQW OWF//jsBZ+K+GdOSAdghROCgRT0BzG0wCNmiQtHkugiHCQQrG6PSj+EHd7naXw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840131; a=rsa-sha256; cv=none; b=vUlzjjbIpVUcYlIqtuYsZeZUMPkZaLbx8cLdig+zDKTzesg7wR9nSdhss4ZqBhmKfJROcU wnLoWJhIWC0VO3pKSzLCnmSrKHmAM/lafe4q+rTlJWVSvpohYsRVwDLMkvU+HaeJnyrPf4 nbIpEdK0ggomHKDEPTzUazsO74mYS3jeYy1+cwCSf4PXKbdn8MhLXiTSBnOhJmYXWAcDab d2QgKCfEyVU6G4hm/zTZr1nDwicnLx7yrwXGpWQcrnuKL4mfPOC2OgBJpBndkRiq/4GBZP X1ki37NQv2MkCCght2t5GEzo0JCJwGDr57YkyjocUSn10YiivwczfdU8hm1e4g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840131; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sFmnnkc/7aT3xlGeJ2qA4l2z/dCl43jJUoXFTcgP2jI=; b=KcFA1IKqsb7JXZhLRIcbdP5qTDDy7KWk0XGmHMt+iBU8ZzxoUuvg1hTxDfzqI4okQeSuHF X2qtuGb4mS8mYPo0TT2pD8z6nXM5lwj/mxG6bJ51AC9uvnipJkrNc1MGLKHDW+32jLvSIl BF+/qWGI2HBHAl5J2OhxO2OQOHcp6rGCxR/yhjg5AueOW2B78sCT3QIAVvZMv483Qn0yJx m6JCEUO88zwuqZz7Xhc4PCI2fq3FA0jG8/4gECDDT5vHblxekjAQ4OBg9rpcMXaN02mbpF 11j20mNCLXf26w8o/eGN691RJ6C63dYAVH4nJKD0PsUsPSzohhu2sgDl/+JyCA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVM73bGJztqj for ; Tue, 30 Jun 2026 17:22:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45faf by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:22:11 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 0f691888dc56 - releng/15.1 - Add UPDATING entries and bump version List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 0f691888dc56a068f74c213bc87b32939b6b354e Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:22:11 +0000 Message-Id: <6a43fb43.45faf.9d6a1d3@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=0f691888dc56a068f74c213bc87b32939b6b354e commit 0f691888dc56a068f74c213bc87b32939b6b354e Author: Mark Johnston AuthorDate: 2026-06-26 21:46:22 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:41 +0000 Add UPDATING entries and bump version Approved by: so --- UPDATING | 41 +++++++++++++++++++++++++++++++++++++++++ sys/conf/newvers.sh | 2 +- 2 files changed, 42 insertions(+), 1 deletion(-) diff --git a/UPDATING b/UPDATING index 89bf196e7001..7b52c9d8231e 100644 --- a/UPDATING +++ b/UPDATING @@ -12,6 +12,47 @@ Items affecting the ports and packages system can be found in /usr/ports/UPDATING. Please read that file before updating system packages and/or ports. +20260630: + 15.1-RELEASE-p1 EN-26:16.arm64 + EN-26:17.rpcsec_tls + SA-26:37.vm + SA-26:38.jail + SA-26:39.execve + SA-26:40.zfs + SA-26:41.libalias + SA-26:42.unlinkat + SA-26:43.tcp + SA-26:44.posixshm + SA-26:45.audit + SA-26:46.ktls + SA-26:49.iconv + + 32-bit setcontext(2) and swapcontext(2) fail on arm64. [EN-26:16.arm64] + + Socket refcount underflow in the NFS server. [EN-26:17.rpcsec_tls] + + Use-after-free in device pager page list. [SA-26:37.vm] + + Jail reference count underflow. [SA-26:38.jail] + + Local privilege escalation via execve(2) TOCTOU race. [SA-26:39.execve] + + Multiple vulnerabilities in OpenZFS. [SA-26:40.zfs] + + Buffer overflow in libalias RTSP handler. [SA-26:41.libalias] + + unlinkat(2) ignores AT_RESOLVE_BENEATH flag. [SA-26:42.unlinkat] + + Use-after-free in TCP RACK stack option handler. [SA-26:43.tcp] + + Multiple vulnerabilities in POSIX largepage objects. [SA-26:44.posixshm] + + Incorrect audit records for ptrace(2) syscall requests. [SA-26:45.audit] + + Remote DOS via uninitialized memory access in KTLS receive. [SA-26:46.ktls] + + Multiple vulnerabilities in iconv(3). [SA-26:49.iconv] + 20260616: 15.1-RELEASE. diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index 03a779e2eca3..ac5ebab65163 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -51,7 +51,7 @@ TYPE="FreeBSD" REVISION="15.1" -BRANCH="RELEASE" +BRANCH="RELEASE-p1" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi From nobody Tue Jun 30 18:30:46 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqWtH19s3z6jg0X for ; Tue, 30 Jun 2026 18:30:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqWtH0fv9z3jt9 for ; Tue, 30 Jun 2026 18:30:47 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782844247; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=t0NLXLne9xhafHKQVz4CdFJDfMS18jvsecbe5OTbK3w=; b=rfJOlZ3BBgEnPiXEx4sctqmv0lzgqYS8dhyGG+MmwFGu9yUOQ90XeRwbdul1fDU4sNmu2j GMVLGVn0p23z7Z43EXG/YMN285jNxfc5wd25AASxB6yT7pQS0+x85UayAkkF0I8x8sJaIv uR85uM+5E5Q+T4PsWTe9DNra6GrSsTwUlRwe0EFdZ5D8LoM5noEk8ncQVA3YDHMfexa9hF zzHizWETd3hnC5pxjfOs1i57+jtgtpgRSgg1cKpbkEF/0O8L2WiV2qXtV1qSVtHbinACXq /gXgJsup0iaPssITHctq3tmm8e5zQ8WthEXQIsxybTc/qt/A5oK4yDi9NSzZ5g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782844247; a=rsa-sha256; cv=none; b=pQCozfZ/Ih2Uxdin3JUKoneejzoFQJk05Mj0ldUipeCJ9w884l0gzovhClFH0YU1SXRdgl Hd5SFkQNvPuKWNDnEgJKDDpphDf60qPeQrYOgakmAj+78jLi1QY7fm7TXEvQVLEGUGsyor HFW7jBK+4/eyxFfQ44XRQ9iXf6vq4jXvVjw++gy42n+o1iLrMshreN3xIG5Psq3GhZwAjd nYArWYJsroFhaLwHWS9jVn9GFs7wGHnjrP7sTrkm1a8+89hD8TRqFo2xq1gtdD+Z0pBenq rabRgSy2x0ZvC4M03qeci0H8P/T+U0rwjdGzZvUPHzskHdl4VRk3jIoN1MCZsA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782844247; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=t0NLXLne9xhafHKQVz4CdFJDfMS18jvsecbe5OTbK3w=; b=KeX2ss59xbdQ5zf9o0i6R/Bz0O0va8tZvPO5BtK6wqxXLk+tSZliIRYUEMdf4naRu+9S0a yxW0xIv3ktFXzzQ7UP1rBl2xZcJLnoM7Xnjm8K9XP1GlnZFTaNtSZyVSbztyEyY9MvR2qh XIeO8U1yoWoCyGCEres1/2Jq97o6lm661UF5CHEAV9TWhJ87X1MaQ26PbM8B9psSHHTDS9 4HDuJMQ8ntgZeD1d16hskDEb6Qup5V0K1bg4P8HTl1mdPfdrf8UCJHNPMBUHVGYxB0iDqX WcFqFnUC70grh5ChGp3+q7LesLp+CZ8i1vxDxV2fLAHs8xeywWHaSka9YthHpg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqWtG6BDWzwQ3 for ; Tue, 30 Jun 2026 18:30:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1cd5f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 18:30:46 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 957d7912d7e4 - Create tag release/14.4.0-p7 List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/tags/release/14.4.0-p7 X-Git-Reftype: annotated tag X-Git-Commit: 957d7912d7e4ea06b3786b3036f04f1a1fc253c9 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 18:30:46 +0000 Message-Id: <6a440b56.1cd5f.37fa6d6@gitrepo.freebsd.org> The annotated tag release/14.4.0-p7 has been created by markj: URL: https://cgit.FreeBSD.org/src/tag/?h=release/14.4.0-p7 tag release/14.4.0-p7 Tagger: Mark Johnston TaggerDate: 2026-06-30 17:35:20 +0000 Tag FreeBSD 14.4-RELEASE-p7 commit 3827644480bdd01c00bd1d5bb66011bb2e0ac75b Author: Mark Johnston AuthorDate: 2026-06-26 21:43:59 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 21:26:44 +0000 Add UPDATING entries and bump version Approved by: so From nobody Tue Jun 30 18:30:57 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqWtV331bz6jg9c for ; Tue, 30 Jun 2026 18:30:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqWtT685Fz3kW8 for ; Tue, 30 Jun 2026 18:30:57 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782844257; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tAkc+1gEkMUiU2Rl1vXKQj2vK/gov0qPooHuWytpOjc=; b=jSZXN8tHaUykLKq1nRFLKkEes/NIKtjkt4rGZROs7Ca+T714pHAJlX+O7nm7FKMJia9wT8 dgl7RCKA3VSolu89SvZuy/CSG1FqhK5f2wuTrmANOZMgut5SPrxbZo0KvjApkZQH+EJZmr ZGsU4H8s4iJPbdZ8mkpgrT1TOMRe+spU71a3mtIlfaUoAOo/J2i5LSpuoEijblJnEp8wfM yzMzqxV70Fjcsqs1PZ1AON82VPJTJO01Jd6UuT9be78Q9zX1g9DlI1GdKvibFbTw6d4a/4 aweA924Our36p5y47aS205vcBMvYiyF/WCgNpiDgsnSJBQbfwr7cQAkZvmo/wg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782844257; a=rsa-sha256; cv=none; b=fhG5uOjS3dtpa4S78KkgMc7ngQD1entKOGD6htjO3jsjnpqczK7OSn4WTAyFgwBSCH/nAS eH4Sy3zlrx+pvRLM6NAjXmI/S6QZs9Fuxl7GOzVz/YZD3OnCpHz/S58sGXsOXIrDMfn70M mXkSyjeuZAuLlVPceag2QwFGbDBUh36gkGXg8exWjsqSN3XLcwK95J4FDCLggGJlT0WSlY yxoX1stOhow+NzVmRdYm8AI9vMFWr/z7Gu7dd4nKwP5PSNR7YRnmd5gRzGFOVBJemsuRCG K9SlXgJITocXyAhZupzxDmRFuTDpRoQm8vMnZczh7kdb7nfBMeyXsEQ/apAvYQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782844257; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tAkc+1gEkMUiU2Rl1vXKQj2vK/gov0qPooHuWytpOjc=; b=sEegmeztOnlCxNpJwuXvFx+tpdU+KIJP8ph2oG1fiXlBdtxULauA0QWSgg3ztnIXBzne3u ZtzCuyFmli1jAu0uQILMyn4RKi5mCJlaIlOXV4r3U6+TBhIqmL7zYN1+dXVcnamUe2ABKS I91pdWjW3Tbv/TdSA/jS1hE1/zBG397G4hcUJjCIjr0O+fB9H/2fE8Kaz46xMHsUBYBk0b wqIFeXhLR7S+re8b6dqiTE4DA/hEGm5LOmctu2bALGO+cAXEDeUt2CXjNmWFg7j3RmSafh CXST1aRtXOprYqsTJ5679baI9QKJpJX7RSyv6JddRMa3iq0aLy5jS6adk0x1Xw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqWtT4gxvzwDt for ; Tue, 30 Jun 2026 18:30:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1e19c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 18:30:57 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 37240daf1f28 - Create tag release/14.3.0-p16 List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/tags/release/14.3.0-p16 X-Git-Reftype: annotated tag X-Git-Commit: 37240daf1f288afc40407b288199c631122b85df Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 18:30:57 +0000 Message-Id: <6a440b61.1e19c.7b313240@gitrepo.freebsd.org> The annotated tag release/14.3.0-p16 has been created by markj: URL: https://cgit.FreeBSD.org/src/tag/?h=release/14.3.0-p16 tag release/14.3.0-p16 Tagger: Mark Johnston TaggerDate: 2026-06-30 17:35:18 +0000 Tag FreeBSD 14.3-RELEASE-p16 commit 833d39bd2e38421a14ea489a956261a0fa993fbc Author: Mark Johnston AuthorDate: 2026-06-26 21:43:23 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:02 +0000 Add UPDATING entries and bump version Approved by: so From nobody Tue Jun 30 18:31:31 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqWv768QGz6jgGV for ; Tue, 30 Jun 2026 18:31:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqWv74Brtz3kgv for ; Tue, 30 Jun 2026 18:31:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782844291; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XoGuPzuwnVzAgDXPboxCDa0rLD/aDmAnANTKQBMTq68=; b=k6wnSB6bCXtnbeavUeIRKcUzOQzZ3Q7tQ3JKNe9JtTr7m6d1pPghgc3YHoIKxwIRCJYwCS 6enilElYmAFQoYX4qtimMD7k8QZ1TO2WFFWVF1CsMRjAewuwHtLPpr9+Q8fGklkfBsCCY5 LWO75r7gEEvba2/ejLNyTi7sNhYZuXxe/xEccV3sMnji2YHlIWa6oH2DuTxUNxdmCi8ANt 0I4hSpixTFtYaR0EDBFfeWS9ekCns3n3kLuJwBfFt35aIrxjCbWKF+q1qfUqiRoIjTEqze Ix0Z4CZjWVsJbIXWnaDG55KNPsuUdaSKxvhTdtbtmFWWLRtJFAT4qsHdU5rYPw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782844291; a=rsa-sha256; cv=none; b=MEluMmWHFsGdwMDtZ2xN7eupkb16BojcysKnKYP2Y0bms9B5LALvuqxWzowUF0w7qeGV1x 30Qa2KjPuzp/YyNgwc7DxOUKdgj2+B3Z30vbkowEoYd8aYsANTUtLPDA+flqUjMED07SjV 36Mi41AZZ5QCcZsI1uvIUBt2LF4kskdgRRE7d7CnRn5U6F/BwamRW3AJh5ZngFrY+KY502 tonwb5l2qn1QJjS6n5xLbrqgMcmp6jZjlbsx1SiRjomAtf5TPQTS/byBs8Ky5rc+/E2A0S JYVCKGv35v5SzWe7d6ZwerhzRX8LODd6KGXmHh/SRHne6mzQJ56XZ1+K66Vhlg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782844291; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XoGuPzuwnVzAgDXPboxCDa0rLD/aDmAnANTKQBMTq68=; b=b15ht2v2lTel3qZUo7fqkqpnDz1Wk7DFKaRAlYxf/TMN41B34Ef0Xxz63XgDDUrlcb6GYj iIRWO0iyMBior31D9nAyyNSiFaQSZiAQSYY+0WPUPcNfs4lMTkbZYavtsaEnJaaeqtOO/3 RtIY9ST/a35v/DcWh0tg3qrMsSMeLSJHpN1gnjy/RUqTWnpEn9O0XG+bQcDvtlWUtksBz4 SOBA5o71Y+3QNzkFgDDH+eMo+yOO4cyRY/tVBsmjTOsvkAB5CZW0SPvfRkZC1MI9o2k7L+ 1yVuSgYhbZ2r47OYP6v28rwPlF4zL557bk4Z7EoWPFBCtHQ7+gaPVUeqGHzl1g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqWv71nx9zwC4 for ; Tue, 30 Jun 2026 18:31:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1d832 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 18:31:31 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: c19b1c9b2902 - Create tag release/15.0.0-p11 List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/tags/release/15.0.0-p11 X-Git-Reftype: annotated tag X-Git-Commit: c19b1c9b290203b52773eec2757a50c7df226eda Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 18:31:31 +0000 Message-Id: <6a440b83.1d832.614c2aa@gitrepo.freebsd.org> The annotated tag release/15.0.0-p11 has been created by markj: URL: https://cgit.FreeBSD.org/src/tag/?h=release/15.0.0-p11 tag release/15.0.0-p11 Tagger: Mark Johnston TaggerDate: 2026-06-30 17:35:22 +0000 Tag FreeBSD 15.0-RELEASE-p11 commit f05aebcc1452fe5effb2fe4b08709b74c03aa15b Author: Mark Johnston AuthorDate: 2026-06-26 21:44:58 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:58 +0000 Add UPDATING entries and bump version Approved by: so From nobody Tue Jun 30 18:32:29 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqWwF6SNyz6jgYJ for ; Tue, 30 Jun 2026 18:32:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqWwF5dTTz3kny for ; Tue, 30 Jun 2026 18:32:29 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782844349; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gOPRewH/ZrH2KOqRK9boJlxluaVKQGnTQNAHkfE+PJQ=; b=VKCH1Wv5pI3iVn3X84iiFFQfNmz7Tg1SozS7YIEM0LRpnmPtu1Ti+ZFuqJYIxX12hKRKma v2c9O+yb87SwMovTnvRMSAXdr0GvQEhBBogExvl23XY1jZeCoeGeCwD3k0m6ig2cpUquvh WeyFC9XVj+tEubMwUg8P5z3zd9xdoi3JTX3Q6dy2cZs/0ZJdA/Dz1S9bCVl9641fTiZeAM GRSX3A9MohVzgzLfKBrisP96sEYqGnwPQcIZquuhUgQFc9jfgCKtfxg3bXbw15su+K0Ft5 mXyh9XOr2W8/hsVPdN+ikNjMd/9XGQxrjI6esvJNUTYR5y7ahBWyOyoAkoqevg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782844349; a=rsa-sha256; cv=none; b=poxvVchP0raiRqb6whDr1XWahaqt9elBK2VHm0VaJ5HPqxRkzuYxc/CIUCAK4xqp5SRoaG ABmpyZ+Qm7KQ3SRuvR7EeX/yjlkdgS4j7Bix3ONMJWMSro6LG5FICmHZTKyYZgAFLT/UCf UflM6UHhGa0A9AG7WCLbncQpQgCMK206WUt0vQnyEtaFFdzFj84RQ5WPGsqAcd05RAE/+1 dfE/XMLqb9TvSj0itrXY8cOnkt5xI1DvITg/Icr8xUImE935MJ4kHnGkp7OhHXJD2XBHqW HHNWLUe59I3MYsxrPeXk3KBd3Nyy8KVBrvh5bKlcqiEiEEoDc3S7gBakN6MUKA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782844349; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gOPRewH/ZrH2KOqRK9boJlxluaVKQGnTQNAHkfE+PJQ=; b=ZjIFCkUHmiys7LFAQmxiGPtn3feMGGcYUm4HPdpzuQHU2hPtUhIBjDJXmkYDqtVS/qCr8i Qt3E5v7LuBr62kdtZYelabzCRGgw47AXQX1YM06JK6FYtvtNxe38j3cuDOjpc+IVYoPYO0 pLxAKKirukb4kP99OUyg6FyUcMyBJDcxc6OLKfwbUf/cGMr1UfTS0z8LAec81EG+zif7E9 t4cwd2YqWsy7+MPtaJROn8T+3bJfdTQoXuj5uatK+ibSPE+QN0Y0FKLhaN/uMMdnVmM1Pv 1XnvISMFy3XqwllcI0mB9TuDcpOcL7ji/iLOTzUV190hMVlCLOED38IaHi7NyQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqWwF3psZzwg8 for ; Tue, 30 Jun 2026 18:32:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1e881 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 18:32:29 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 85b33240ab01 - Create tag release/15.1.0-p1 List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/tags/release/15.1.0-p1 X-Git-Reftype: annotated tag X-Git-Commit: 85b33240ab013c57daa4a0733d6dd7a30c461bd7 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 18:32:29 +0000 Message-Id: <6a440bbd.1e881.9cc743f@gitrepo.freebsd.org> The annotated tag release/15.1.0-p1 has been created by markj: URL: https://cgit.FreeBSD.org/src/tag/?h=release/15.1.0-p1 tag release/15.1.0-p1 Tagger: Mark Johnston TaggerDate: 2026-06-30 17:35:24 +0000 Tag FreeBSD 15.1-RELEASE-p1 commit 0f691888dc56a068f74c213bc87b32939b6b354e Author: Mark Johnston AuthorDate: 2026-06-26 21:46:22 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:41 +0000 Add UPDATING entries and bump version Approved by: so From nobody Thu Jul 2 00:23:29 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4grHfn43R0z6kvBJ for ; Thu, 02 Jul 2026 00:23:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4grHfn3WTZz3Xwt for ; Thu, 02 Jul 2026 00:23:29 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782951809; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=O3kklKXTFuBO4qzMJX59/93qvQMjFa/b6p40F1jqd/8=; b=xwyD5FixSXfalKWTN84OqMtFx8UmjSiSwBVUGB+PaG8r+L0AdYa2QqZtbxmLWyE5u5Fz9b Cwf9tVMG0Manluq+0yZYEG7gpKiNmbPBG/INPQTrEu5+DfGv6kpfJWAH0XrljVCU5jb9t3 VYrMXyVIdPkEW2JDJqFeIXgPUyFHy51If9okOUolx1BJ5GKeGeEEIQ7LcpyQij1k1dn9kO Df1VOjX+QljQhsFPA2/JiNoIPg7SVrJI4QIaC4iQZDJ85hehNcWMJ966h4TcojcVIoFCLb atWGfAqrkOYG19LH8MGJQwzOCR7O8HgXZJ7wVeZRslK5K6rfmWiNnIRB9GFbjQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782951809; a=rsa-sha256; cv=none; b=r9CiIvge6GXnKC4/3yd5hrZIpaYNdCgLtKvkj75NrDRYTqJ+QnHBRz4pXiMzxEtbSSlspk EZlTisXVKGDTubq0McbJKHSIJjprehVPZjajOq2yaabilTZYJcvqtbvyrzbDiM0JqEucw4 ds08R+/bR3smvwBWhXAVPIlpEl2C1ZW37bwjy+6upVC5L88HLa2MkZGnKp3RZCrNu/3gxz 3QEgyzFedYRcUmzgZSZ6P7LQ97StazRJwg16pUeiwzOroeTzUVszvyFe6/FgudKdrCz/9L /K3Uh9ogt+UmtT5bIHBZjOwqomG0y+54AC3wTp7qhEvTOagxoEFNkM32alCTSw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782951809; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=O3kklKXTFuBO4qzMJX59/93qvQMjFa/b6p40F1jqd/8=; b=kounTfpdfQlmi89nnxucMxUyxRZMGR24ARgN7nRZJvjoF3oUflwN/CfSW70/ole7iDrIQ3 K0d6Wwg0uVcTAYFEZ6MKsj82hY0JUyTKk/qrQONYWZZ5e+mIWYhhLYrtgXRJT1Y0E4NrMS /0fDlBCOdZsiJ8iLgRZRlZSsRcZ2cxBa0GZBH6YF9rF6uOKEeoTaA1L19tmgJswe906lPo x9X3MpzALrhj1txNX64CyZUh2OUHpOpMh0nNij+Y7VYtJz5EDS0pu4ijna/RyoVbGuZhrI WUZp1dTyTHIkCN523w1q7kuhta5/PAAp+Zwwv6lgrR8fPTjvwfkVvRh8VxyS2A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4grHfn2M5Jzdnv for ; Thu, 02 Jul 2026 00:23:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 24c83 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 02 Jul 2026 00:23:29 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Konstantin Belousov Subject: git: f27c1da74aab - stable/15 - ntsync.4: be explicit about the effect of automatic vs manual event on waiters List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: f27c1da74aaba31e8203eb70a1695c422adb9c5b Auto-Submitted: auto-generated Date: Thu, 02 Jul 2026 00:23:29 +0000 Message-Id: <6a45af81.24c83.3c2d40ac@gitrepo.freebsd.org> The branch stable/15 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=f27c1da74aaba31e8203eb70a1695c422adb9c5b commit f27c1da74aaba31e8203eb70a1695c422adb9c5b Author: Konstantin Belousov AuthorDate: 2026-06-29 06:09:17 +0000 Commit: Konstantin Belousov CommitDate: 2026-07-02 00:23:07 +0000 ntsync.4: be explicit about the effect of automatic vs manual event on waiters (cherry picked from commit 65251c43415aa0993b7d43962cbb71d772870c83) --- share/man/man4/ntsync.4 | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/share/man/man4/ntsync.4 b/share/man/man4/ntsync.4 index 2776a4b0e691..c808dfdac3b4 100644 --- a/share/man/man4/ntsync.4 +++ b/share/man/man4/ntsync.4 @@ -183,9 +183,15 @@ Reset (dis-arms) the event. Takes a 32bit integer argument where the state of the event before the operation is returned. .It Dv NTSYNC_IOC_EVENT_PULSE -Atomically sets and then resets the event. +Atomically sets the event, wakes up eligible waiters, +and then resets the event. Takes a 32bit integer argument where the state of the event before the operation is returned. +.Pp +If the manual event is pulsed, it wakes up all waiters, +after which it is reset. +On the other hand, the automatic event is reset after +waking up at most a single waiter. .It Dv NTSYNC_IOC_EVENT_READ Returns the current state of the event. Takes the From nobody Thu Jul 2 01:15:44 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4grJqC3Sfqz6l02L for ; Thu, 02 Jul 2026 01:15:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4grJqB2XY5z3djN for ; Thu, 02 Jul 2026 01:15:50 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782954950; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=EEvxo2rq6w+AKKpUWS9IRSSBe5cxF4ubGIZJWA/0FNI=; b=SYz6+KOuBhms+V9OUBHx1UsUOB5JHme9p9aWgJ7d3YciiEC43oGfKawSgJW8r5iMUkFJrQ M4hkAjE9ffzB96NBBIlL/jYtWCrUwDv++9i4tDOAyAs2EWB8s4pwbb1B0BX6wLBoEXqgJF WlhyXtSKYPjUfaA7JYnYrzz1HcSLh099+HqxbWNiQXyFgStR7UFAw0+Z6sOQNT93LZcKKH Sy2yrnyPe6MdZ4wXItJ3/WQEC5AxM5wKY/4Ug8EsCmLcyz335/sxCHgaMz1bf6KSk+pg/v Gly16k+Tj5suvoxAYljg03mzVm0qb3mtsNr8X58gy98si41U+zaS1+GO1CZHYg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782954950; a=rsa-sha256; cv=none; b=onuFC/V3YVuaX7BxDwm+UvDWdwZNsxB+TWx0qXn9wKCLUhwJAYTlu2hnI3YM3edOlMCifp qNZ5zpBRCjGKebZmzqr7TH7FWuHqUEVB32B0KvmJCgda5W7y13CtJSdTHvswwapUkvJB1V 4qSbV4kAp0gjpUtUdvz8CxrEasBQOnQjeqPho3EVu3aqpnllvP8C/d52Tf9Dy+itYhx68X YJYiQaEAUNs5TvNbaqKi9nuYLdm3VZ/Y7O3KTV+l+8NlqTowPa3kWY8D7tQnJjTRwMXhd4 6HhulEM4n/NzwOuiggn9w0Hs1LzNXfm585k/qDlU7qELbe4B4ZPr3gpStcCkLA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782954950; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=EEvxo2rq6w+AKKpUWS9IRSSBe5cxF4ubGIZJWA/0FNI=; b=yINCoxZv+e7FT36tMeADIfQIqK8nQsTi0nDeJskZsVSc8OZtK9GoqKAy6tkQir7zIjr1ht ogVgv1fYt/MO7uu967hQj895QI7Vrt0RQ45CwjjwTeT+vnPERlMGj8+xCFMEDICHc9yj+V r7z/BmPmzZpKHqJMxP9md//gtBBBckRbpng02T0IAvkA7Cs6scSamHEdpNadXHb1oTDoOt n5xXmbT67AwVHZjQq1uKFlD7FCc9OjvEZQxPNn50dib80Y/YUWvzkJ5KpAT4oJYcOE9UWN JFKkeHnavkWBbfTa+XLRJA+Hud5DeOr2Qt9bsJUJ1TZYn72j4mIRotMTErJ0Mw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4grJqB0K6yzfjC for ; Thu, 02 Jul 2026 01:15:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 30a75 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 02 Jul 2026 01:15:44 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Rick Macklem Subject: git: 76badd25811e - stable/15 - nfs_nfsdserv.c: Fix setting of birthtime for some ZFS pools List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 76badd25811e9cbea84818c23004ff0d13157a4f Auto-Submitted: auto-generated Date: Thu, 02 Jul 2026 01:15:44 +0000 Message-Id: <6a45bbc0.30a75.40fee7cb@gitrepo.freebsd.org> The branch stable/15 has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=76badd25811e9cbea84818c23004ff0d13157a4f commit 76badd25811e9cbea84818c23004ff0d13157a4f Author: Rick Macklem AuthorDate: 2026-06-18 15:45:27 +0000 Commit: Rick Macklem CommitDate: 2026-07-02 00:13:49 +0000 nfs_nfsdserv.c: Fix setting of birthtime for some ZFS pools Some ZFS pools do not support va_birthtime and will return EINVAL when a VOP_SETATTR() of it is attempted. The MacOS NFSv4 client sets va_birthtime (TimeCreate) in the same Setattr with ctime/mtime and other attributes after a new file is created. The EINVAL failure leaves these new files messed up (mode == 0). This patch pretends the setting of TimeCreate succeeded if ctime/mtime were also set in the same Setattr RPC, which resolves the problem for the MacOS client. If this fix is not sufficient, a new pathconf name to detect if a file system supports birthtime may be needed. PR: 296066 (cherry picked from commit b1af05406b5117d76f567056fba0a023a6374465) --- sys/fs/nfsserver/nfs_nfsdserv.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/sys/fs/nfsserver/nfs_nfsdserv.c b/sys/fs/nfsserver/nfs_nfsdserv.c index 0124de2db93d..ef24f3362dce 100644 --- a/sys/fs/nfsserver/nfs_nfsdserv.c +++ b/sys/fs/nfsserver/nfs_nfsdserv.c @@ -579,6 +579,16 @@ nfsrvd_setattr(struct nfsrv_descript *nd, __unused int isdgram, NFSVNO_SETATTRVAL(&nva2, btime, nva.na_btime); nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p, exp); + /* + * ZFS stores with early versions do not support va_birthtime + * and will reply EINVAL when setting is attempted. This + * breaks the MacOS NFSv4 client, so pretend it succeeded if + * ctime and/or mtime were set as well. + */ + if (nd->nd_repstat == EINVAL && + (NFSISSET_ATTRBIT(&retbits, NFSATTRBIT_TIMEACCESSSET) || + NFSISSET_ATTRBIT(&retbits, NFSATTRBIT_TIMEMODIFYSET))) + nd->nd_repstat = 0; if (!nd->nd_repstat) NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_TIMECREATE); } From nobody Thu Jul 2 01:21:11 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4grJxP3CJwz6l0Sd for ; Thu, 02 Jul 2026 01:21:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4grJxM5mDhz3f6K for ; Thu, 02 Jul 2026 01:21:11 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782955271; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=B1GvESfBJZX33TWKuYb36xh8e+UZIjXYx0WxEwpGF+o=; b=bWIkgxka41xFEuIOD9bydSljXOqLtkz55MsnuXpKB0KmnVr5RSzOeFgQiINQlgKp/qUjn4 af5AtyTze/qBlFl/kThsvkoWHcOqaqH9mwDZ84YSvMXACLOeMuWzFjmlx+3eAT6T/3IM72 zVmk67SkoFhDM0hta12b1DPvpkbStAgPJazQIoMXPcaHy9rJqTGxpJVSoaUrsvoreMZBne VpSgRfq9v2bTnzWcGHqYpx3Lx42prPd+fu65LbK1jKNaGMEZoJnmvN64pvHs5b6A3DYMHn VbC36cTAMrB8sVCINThge52OWyB21iIwupva3l+ZNX2+a4BCRVX7TuuwiHh0sw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782955271; a=rsa-sha256; cv=none; b=fbrTdyfKJiuV4CwRioRINmRo7xP+Zm5vmiVcJLHGy5/xHO1QSy7I93MnKkDZIt1OgJCnPB wzWuejYalIReZmmog8rxKe2rOJMufLQcdKcIEYRYFkGlmKSl96m0xusfFgTmJzpUWft6VU LCbaAdWHgxSyedB3goPfvDSsDIyJV6vl7Lq/GSUmPkGmlNSF65TezKUZ1B5mxJiXVQyaic aWF4ijSz1j8Lb3k4xkBq+8JwTSwDKF/yUVmKBvUi2aAyzU7AV5QzCOlld/GjuhuyU7remx Ej6WxI5Jpx0EprA0rH1DwwoIkj4SIQSRLAVPG7HU/XpuMGPyFSqVrl6rId2cug== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782955271; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=B1GvESfBJZX33TWKuYb36xh8e+UZIjXYx0WxEwpGF+o=; b=PnNuhcruviSQNAiRwxGBYHKRyELvG+j51f6gR4pNtsyCCcUuc79/NDGhzvWdNEvJAHmp0J wWBZ+7tIsnLmrY6DtZYbcVavJBTeW2VbLbFBkyYsgIxvllr/Y2L5iFagyzQIUrSIOfQXEi 63Kc2I6VaT8fN8XPVv10DVNu1s0vxoP3POzmaXUHm/COZdScc1ks2O5E4y8o1CpOGgHenI 4UsrBdmg+izjw8/fVrV2CTlPrlR2m7kxuA6BrA62Oc1fdw4LP4FFqTibLtzObGqZ8MV7xX WF9dse+o1SPSAHLGsQUysGrke9FA3UYF+C8OiStNDh7n6RlolEhKFMY6cj5HQw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4grJxM4TVXzgBr for ; Thu, 02 Jul 2026 01:21:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3291d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 02 Jul 2026 01:21:11 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Rick Macklem Subject: git: 0b9f4c6b0a03 - stable/14 - nfs_nfsdserv.c: Fix setting of birthtime for some ZFS pools List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 0b9f4c6b0a03df1522bba415b67d875a1e73f811 Auto-Submitted: auto-generated Date: Thu, 02 Jul 2026 01:21:11 +0000 Message-Id: <6a45bd07.3291d.615092fe@gitrepo.freebsd.org> The branch stable/14 has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=0b9f4c6b0a03df1522bba415b67d875a1e73f811 commit 0b9f4c6b0a03df1522bba415b67d875a1e73f811 Author: Rick Macklem AuthorDate: 2026-06-18 15:45:27 +0000 Commit: Rick Macklem CommitDate: 2026-07-02 00:19:24 +0000 nfs_nfsdserv.c: Fix setting of birthtime for some ZFS pools Some ZFS pools do not support va_birthtime and will return EINVAL when a VOP_SETATTR() of it is attempted. The MacOS NFSv4 client sets va_birthtime (TimeCreate) in the same Setattr with ctime/mtime and other attributes after a new file is created. The EINVAL failure leaves these new files messed up (mode == 0). This patch pretends the setting of TimeCreate succeeded if ctime/mtime were also set in the same Setattr RPC, which resolves the problem for the MacOS client. If this fix is not sufficient, a new pathconf name to detect if a file system supports birthtime may be needed. PR: 296066 (cherry picked from commit b1af05406b5117d76f567056fba0a023a6374465) --- sys/fs/nfsserver/nfs_nfsdserv.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/sys/fs/nfsserver/nfs_nfsdserv.c b/sys/fs/nfsserver/nfs_nfsdserv.c index 8d4501a286cc..3a5c45bacda8 100644 --- a/sys/fs/nfsserver/nfs_nfsdserv.c +++ b/sys/fs/nfsserver/nfs_nfsdserv.c @@ -545,6 +545,16 @@ nfsrvd_setattr(struct nfsrv_descript *nd, __unused int isdgram, NFSVNO_SETATTRVAL(&nva2, btime, nva.na_btime); nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p, exp); + /* + * ZFS stores with early versions do not support va_birthtime + * and will reply EINVAL when setting is attempted. This + * breaks the MacOS NFSv4 client, so pretend it succeeded if + * ctime and/or mtime were set as well. + */ + if (nd->nd_repstat == EINVAL && + (NFSISSET_ATTRBIT(&retbits, NFSATTRBIT_TIMEACCESSSET) || + NFSISSET_ATTRBIT(&retbits, NFSATTRBIT_TIMEMODIFYSET))) + nd->nd_repstat = 0; if (!nd->nd_repstat) NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_TIMECREATE); } From nobody Thu Jul 2 04:14:59 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4grNnv6bpjz6jppF for ; Thu, 02 Jul 2026 04:14:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4grNnv5BDmz3tZ6 for ; Thu, 02 Jul 2026 04:14:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782965699; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Tps7tf1KRUMjBgoJNYmjLjr4CN2R7G7l6t0E0bLqnRc=; b=kehYa5A8GRo6ylvfhOtfb3v2QClGtjG6sObR4NkU4TjsN6S1WCKhEkhizEt/Wc0CeUUaWj dr0/8/ZkBAKolymUTLdjoJTbA7EdoPzqzNyYCe1mNcGHlCcUeFJSNgFnWjKJE0XZcqz9O9 JcxZFcRgTXDI0UC5byQ+/mtxmjvsC+kdIcY66EUnqTflg2BZdZVnxLM79azKbCGgdQMeGo t8bDVe+pZEuTOo6E9crc7c+LJKS2efGje39Ldyg/stxBeKeyY/NWWcmWSqfZ8DGIJIpbr9 VyMRy7pXSokH8qfatluL+2u8iACoGtM0nb34blJPi8glj0fM2PnDLhW4YjJYPw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782965699; a=rsa-sha256; cv=none; b=wY5VS65LQIWPEqZStwuPRDwSUSj0ATodZxunP3ApsCatX6EHrsbKXHFmIECJddCFuD2MkE mQEnwthJ2yIkUeTpMrtlFjwaezsZidY5DOu1QxYJU/TBLDdauslmU84/IIG2Ws9sHv4O4j 0BP7J2ysIGdNzca8LIk6/k55IeoF6ob0/H2e10063Z5l/BtNu2yzJ/tBtA0ULcMVMOXWa/ oDG8AoN117Fe2KN8yPo0H/OGUyCJAkmF3FmWPRrVBNeKUWi6A79qQwm0jF6JS8FfbTwTC9 LWCpr6AAjqD783fxf02guzustMEaSHT7WCDJ3Caq7NXlx7SILDFZnHyjx2NxrQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782965699; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Tps7tf1KRUMjBgoJNYmjLjr4CN2R7G7l6t0E0bLqnRc=; b=VFHkxSG+aHvZaov7OIzDLwLRdmDEyVfe+vDaxZYCpHMH4uYeC0S3PZi49Rn+rfAzpSsDSx Z+Sp2XEoRnGWIo0wQPlFNVwU7LAE8Up120i9VhxTPnpIU7bKJY9gce3r1YG/T6KlM+ZaTm +j80lC+cCfGQ5SUTCvc+ZOzhkAmAl5IAe9X1JsUx7OhVGZTK/FRA0iTE1RO3ZkWpNTF5ku vc1JCAA7Ny8OQCWxD+jHzMs2RUTSVlG0yH4Z+dknLNp598/Xy6v1w0niH95eL6nAi0ioCm PXJrywjERm9CAUMqrQ/1W+09ZlbThsD9e6SQDXOrQyW+0+GXlbTgEwFKyQQEwA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4grNnv3wq5zlxs for ; Thu, 02 Jul 2026 04:14:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 43cca by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 02 Jul 2026 04:14:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Philip Paeps Subject: git: 32652bf4040c - stable/15 - contrib/expat: import expat 2.8.2 List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: philip X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 32652bf4040ca010924f05e0fce4326b62709c11 Auto-Submitted: auto-generated Date: Thu, 02 Jul 2026 04:14:59 +0000 Message-Id: <6a45e5c3.43cca.50d093f@gitrepo.freebsd.org> The branch stable/15 has been updated by philip: URL: https://cgit.FreeBSD.org/src/commit/?id=32652bf4040ca010924f05e0fce4326b62709c11 commit 32652bf4040ca010924f05e0fce4326b62709c11 Author: Philip Paeps AuthorDate: 2026-06-25 14:34:28 +0000 Commit: Philip Paeps CommitDate: 2026-07-02 03:06:35 +0000 contrib/expat: import expat 2.8.2 Changes: https://github.com/libexpat/libexpat/blob/R_2_8_2/expat/Changes Security: CVE-2026-50219 Security: CVE-2026-56131 Security: CVE-2026-56132 Security: CVE-2026-56403 Security: CVE-2026-56404 Security: CVE-2026-56405 Security: CVE-2026-56406 Security: CVE-2026-56407 Security: CVE-2026-56408 Security: CVE-2026-56409 Security: CVE-2026-56410 Security: CVE-2026-56411 Security: CVE-2026-56412 (cherry picked from commit c82aeee8a6d39371006f5eeb1b51704e7b97e2b7) --- contrib/expat/Changes | 92 ++- contrib/expat/README.md | 5 +- contrib/expat/configure.ac | 23 +- contrib/expat/doc/reference.html | 6 +- contrib/expat/doc/xmlwf.1 | 2 +- contrib/expat/doc/xmlwf.xml | 2 +- contrib/expat/lib/Makefile.am | 5 + contrib/expat/lib/Makefile.in | 5 + contrib/expat/lib/expat.h | 2 +- contrib/expat/lib/fallthrough.h | 49 ++ contrib/expat/lib/memory_sanitizer.h | 51 ++ contrib/expat/lib/random_arc4random_buf.c | 4 + contrib/expat/lib/random_dev_urandom.c | 4 +- contrib/expat/lib/random_getentropy.c | 8 +- contrib/expat/lib/random_getrandom.c | 11 +- contrib/expat/lib/siphash.h | 15 +- contrib/expat/lib/xcsinc.c | 48 ++ contrib/expat/lib/xmlparse.c | 1208 ++++++++++++++++------------- contrib/expat/lib/xmltok.c | 6 +- contrib/expat/lib/xmltok_impl.c | 21 +- contrib/expat/tests/acc_tests.c | 6 +- contrib/expat/tests/alloc_tests.c | 6 +- contrib/expat/tests/basic_tests.c | 48 +- contrib/expat/tests/chardata.c | 14 +- contrib/expat/tests/common.c | 5 +- contrib/expat/tests/handlers.c | 53 +- contrib/expat/tests/handlers.h | 14 + contrib/expat/tests/misc_tests.c | 42 +- contrib/expat/xmlwf/filemap.h | 3 +- contrib/expat/xmlwf/win32filemap.c | 2 +- contrib/expat/xmlwf/xmlfile.c | 18 +- contrib/expat/xmlwf/xmlwf.c | 107 ++- contrib/expat/xmlwf/xmlwf_helpgen.py | 2 +- lib/libexpat/expat_config.h | 6 +- lib/libexpat/libbsdxml.3 | 4 +- 35 files changed, 1234 insertions(+), 663 deletions(-) diff --git a/contrib/expat/Changes b/contrib/expat/Changes index 313b3dc60cd0..6a1b89160fb9 100644 --- a/contrib/expat/Changes +++ b/contrib/expat/Changes @@ -29,6 +29,94 @@ !! THANK YOU! Sebastian Pipping -- Berlin, 2026-03-17 !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +Release 2.8.2 Thu June 25 2026 + Security fixes: + #1246 CVE-2026-50219 -- Disallow calls to functions + `XML_GetBuffer`, `XML_Parse`, `XML_ParseBuffer`, + `XML_ParserFree`, `XML_ParserReset` to guard e.g. + Expat bindings from memory corruption; + this CPython issue is related: + https://github.com/python/cpython/issues/146169 + #1267 CVE-2026-56131 -- Protect XML_ResumeParser from being called + from a handler, plugging a hole in the fix + to CVE-2026-50219 + #1272 CVE-2026-56132 -- Fix out-of-bound scaffolding index store + in `doProlog` + #1229 #1232 CVE-2026-56403 -- Integer overflow in `storeAtts` + #1249 CVE-2026-56404 -- Integer overflow in `addBinding` + #1251 CVE-2026-56405 -- Integer overflow in `getAttributeId` + #1255 CVE-2026-56406 -- Integer overflow in `XML_ParseBuffer` + #1262 CVE-2026-56407 -- Integer overflow in `textLen` handling + #565 CVE-2026-56408 -- Integer overflow in `copyString` + (commit 16e2efd867ea8567ffa012210b52ef5918e20817) + #1259 CVE-2026-56409 -- xmlwf: Integer overflow in output path join + #1252 CVE-2026-56410 -- xmlwf: Integer overflow in + `resolveSystemId` + #1263 CVE-2026-56411 -- xmlwf: Integer overflow in notation list + allocation + #1278 CVE-2026-56412 -- Guard XML_TOK_DATA_CHARS handler calls in + `doCdataSection`, plugging a hole in the fix to + CVE-2026-50219 + + Bug fixes: + #1260 xmlwf: Escape names and base URI in meta output + #1266 xmlwf: Pick a safe quote for notation system and public IDs + + Other changes: + #1257 CMake|Autotools: Stop using /dev/urandom by default + #1244 #1254 CMake: Fix guard for Unix sources of entropy + #1183 #1270 CMake|Windows: Add missing export for symbol + `XML_SetHashSalt16Bytes` + #1236 CMake: Mark option EXPAT_OSSFUZZ_BUILD as advanced + #1283 Limit output indentation for EXPAT_ENTITY_DEBUG=1 and + allow unlimited indentation via EXPAT_ENTITY_DEBUG=2 + #565 Replace some loops by use of `memcpy`, `strlen`, `wcslen` + #1220 lib: Use a size_t for group sizes + #1221 lib: Fix too-conservative integer overflow check when + appending raw name + #1222 lib: Simplify attribute allocation/management logic + #1224 Update fallthrough annotations to satisfy Clang and GCC + #1226 lib: Remove unnecessary void * casts in random code + #1228 lib: Reduce scope of locals in storeAtts + #1230 lib: Count attributes with size_t variables + #1238 Minor get-buffer improvements + #1239 #1240 lib|tests: Include header expat_config.h first + #1241 lib: Shrink size of XML_GetBuffer + #1242 lib: Remove a legacy comment + #1243 lib: XML_ParserReset: Extract repeated linked-list move logic + #1243 lib: Unify entity free lists + #1247 lib: Fix use of '0' as boolean literal + #1248 lib: Make XML_Index overflow check more intuitive + #1256 lib: Use size_t for counting string/URI lengths + #1258 lib: XML_GetInputContext: Remove use of 0 for NULL + #1261 Comment typo fixes + #1275 Teach Memory Sanitizer semantics of randomization functions + #1276 #1281 Version info bumped from 13:1:12 (libexpat*.so.1.12.1) + to 13:2:12 (libexpat*.so.1.12.2); see https://verbump.de/ + for what these numbers do + + Infrastructure: + #1231 perl-integration.yml: Bump to XML::Parser 2.59 + #1237 emscripten.yml: Bump from Ubuntu 22.04 to 24.04 + #1183 #1271 windows-build.yml: Cover completeness of file + libexpat.def.cmake + #1274 linux.yml: Make llvm-symbolizer available in CI + + Special thanks to: + Alessandro Gario + Asher Darden + Christoph Reiter + Haris Hussain + Matthew Fernandez + Kartik Kenchi + Nick Begg + Sajin S + Yousef Shanableh + and + Anthropic + Astra Security + Trail of Bits + Release 2.8.1 Sun May 10 2026 Security fixes: #1216 CVE-2026-45186 -- Fix quadratic runtime from attribute name @@ -1820,7 +1908,7 @@ Release 2.1.0 Sat March 24 2012 - Bug Fixes: #1742315: Harmful XML_ParserCreateNS suggestion. #1785430: Expat build fails on linux-amd64 with gcc version>=4.1 -O3. - #1983953, 2517952, 2517962, 2649838: + #1983953, 2517952, 2517962, 2649838: Build modifications using autoreconf instead of buildconf.sh. #2815947, #2884086: OBJEXT and EXEEXT support while building. #2517938: xmlwf should return non-zero exit status if not well-formed. @@ -1846,7 +1934,7 @@ Release 2.1.0 Sat March 24 2012 See bug #2990652 and patch #3312568. Added run-benchmark target to Makefile.in - relies on testdata module present in the same relative location as in the repository. - + Release 2.0.1 Tue June 5 2007 - Fixed bugs #1515266, #1515600: The character data handler's calling of XML_StopParser() was not handled properly; if the parser was diff --git a/contrib/expat/README.md b/contrib/expat/README.md index 7a5ed463b6d5..5ad5e1e85afa 100644 --- a/contrib/expat/README.md +++ b/contrib/expat/README.md @@ -11,7 +11,7 @@ > at the top of the `Changes` file. -# Expat, Release 2.8.1 +# Expat, Release 2.8.2 This is Expat, a C99 library for parsing [XML 1.0 Fourth Edition](https://www.w3.org/TR/2006/REC-xml-20060816/), started by @@ -286,9 +286,6 @@ EXPAT_ENABLE_INSTALL:BOOL=ON // Use /MT flag (static CRT) when compiling in MSVC EXPAT_MSVC_STATIC_CRT:BOOL=OFF -// Build fuzzers via OSS-Fuzz for the expat library -EXPAT_OSSFUZZ_BUILD:BOOL=OFF - // Build a shared expat library EXPAT_SHARED_LIBS:BOOL=ON diff --git a/contrib/expat/configure.ac b/contrib/expat/configure.ac index fb492dfd79f7..f14c0308e1c4 100644 --- a/contrib/expat/configure.ac +++ b/contrib/expat/configure.ac @@ -90,7 +90,7 @@ dnl If the API changes incompatibly set LIBAGE back to 0 dnl LIBCURRENT=13 # sync -LIBREVISION=1 # with +LIBREVISION=2 # with LIBAGE=12 # CMakeLists.txt! AC_CONFIG_HEADERS([expat_config.h]) @@ -395,8 +395,23 @@ AC_DEFINE([XML_GE], 1, [Define as 1/0 to enable/disable support for general entities.]) AC_DEFINE([XML_DTD], 1, [Define to make parameter entity parsing functionality available.]) -AC_DEFINE([XML_DEV_URANDOM], 1, - [Define to include code reading entropy from `/dev/urandom'.]) + + +have_dev_urandom=false + +AC_ARG_WITH([dev-urandom], + [AS_HELP_STRING([--with-dev-urandom], + [enforce the use of /dev/urandom in the system @<:@default=no@:>@]) +AS_HELP_STRING([--without-dev-urandom], + [enforce not using /dev/urandom in the system @<:@default=no@:>@])], + [with_dev_urandom=${withval}], + []) + +AS_IF([test "x${with_dev_urandom}" = "xyes"], + [have_dev_urandom=true + AC_DEFINE([XML_DEV_URANDOM], 1, + [Define to include code reading entropy from `/dev/urandom'.])]) + AC_ARG_ENABLE([xml-attr-info], [AS_HELP_STRING([--enable-xml-attr-info], @@ -580,7 +595,7 @@ Entropy sources: getentropy: ${have_getentropy} getrandom: ${have_getrandom_function} syscall SYS_getrandom: ${have_getrandom_syscall} - /dev/urandom: true + /dev/urandom: ${have_dev_urandom} Continue with e.g.: make -j2 diff --git a/contrib/expat/doc/reference.html b/contrib/expat/doc/reference.html index 07d331ed7b56..5c4b1c76ca78 100644 --- a/contrib/expat/doc/reference.html +++ b/contrib/expat/doc/reference.html @@ -53,7 +53,7 @@

- The Expat XML Parser Release 2.8.1 + The Expat XML Parser Release 2.8.2

@@ -1602,7 +1602,9 @@ XML_ParserReset(XML_Parser p, To state the obvious: the three parsing functions XML_Parse, XML_ParseBuffer and XML_GetBuffer must not be called from within a + "#XML_GetBuffer">XML_GetBuffer as well as the two cleanup functions + XML_ParserFree and XML_ParserReset must not be called from within a handler unless they operate on a separate parser instance, that is, one that did not call the handler. For example, it is OK to call the parsing functions from within an XML_ExternalEntityRefHandler, if they apply to the parser diff --git a/contrib/expat/doc/xmlwf.1 b/contrib/expat/doc/xmlwf.1 index 12760944a5da..3de559ec1bb3 100644 --- a/contrib/expat/doc/xmlwf.1 +++ b/contrib/expat/doc/xmlwf.1 @@ -5,7 +5,7 @@ \\$2 \(la\\$1\(ra\\$3 .. .if \n(.g .mso www.tmac -.TH XMLWF 1 "May 10, 2026" "" "" +.TH XMLWF 1 "June 25, 2026" "" "" .SH NAME xmlwf \- Determines if an XML document is well-formed .SH SYNOPSIS diff --git a/contrib/expat/doc/xmlwf.xml b/contrib/expat/doc/xmlwf.xml index 529dbba16722..7e57cf1346b9 100644 --- a/contrib/expat/doc/xmlwf.xml +++ b/contrib/expat/doc/xmlwf.xml @@ -21,7 +21,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [ Scott"> Bronson"> - May 10, 2026"> + June 25, 2026"> 1"> bronson@rinspin.com"> diff --git a/contrib/expat/lib/Makefile.am b/contrib/expat/lib/Makefile.am index 27bf2ab64769..2b6aec2e6bdc 100644 --- a/contrib/expat/lib/Makefile.am +++ b/contrib/expat/lib/Makefile.am @@ -10,6 +10,8 @@ # Copyright (c) 2017 Tomasz KÅ‚oczko # Copyright (c) 2019 David Loffredo # Copyright (c) 2026 Gordon Messmer +# Copyright (c) 2026 Nick Begg +# Copyright (c) 2026 Matthew Fernandez # Licensed under the MIT license: # # Permission is hereby granted, free of charge, to any person obtaining @@ -112,14 +114,17 @@ EXTRA_DIST = \ asciitab.h \ expat_external.h \ expat.h \ + fallthrough.h \ iasciitab.h \ internal.h \ latin1tab.h \ libexpat.def.cmake \ + memory_sanitizer.h \ nametab.h \ siphash.h \ utf8tab.h \ winconfig.h \ + xcsinc.c \ xmlrole.h \ xmltok.h \ xmltok_impl.c \ diff --git a/contrib/expat/lib/Makefile.in b/contrib/expat/lib/Makefile.in index 4cd6fcfc6088..73db0e584705 100644 --- a/contrib/expat/lib/Makefile.in +++ b/contrib/expat/lib/Makefile.in @@ -26,6 +26,8 @@ # Copyright (c) 2017 Tomasz KÅ‚oczko # Copyright (c) 2019 David Loffredo # Copyright (c) 2026 Gordon Messmer +# Copyright (c) 2026 Nick Begg +# Copyright (c) 2026 Matthew Fernandez # Licensed under the MIT license: # # Permission is hereby granted, free of charge, to any person obtaining @@ -508,14 +510,17 @@ EXTRA_DIST = \ asciitab.h \ expat_external.h \ expat.h \ + fallthrough.h \ iasciitab.h \ internal.h \ latin1tab.h \ libexpat.def.cmake \ + memory_sanitizer.h \ nametab.h \ siphash.h \ utf8tab.h \ winconfig.h \ + xcsinc.c \ xmlrole.h \ xmltok.h \ xmltok_impl.c \ diff --git a/contrib/expat/lib/expat.h b/contrib/expat/lib/expat.h index ec3f58544cb0..c493c70441c4 100644 --- a/contrib/expat/lib/expat.h +++ b/contrib/expat/lib/expat.h @@ -1094,7 +1094,7 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled); */ # define XML_MAJOR_VERSION 2 # define XML_MINOR_VERSION 8 -# define XML_MICRO_VERSION 1 +# define XML_MICRO_VERSION 2 # ifdef __cplusplus } diff --git a/contrib/expat/lib/fallthrough.h b/contrib/expat/lib/fallthrough.h new file mode 100644 index 000000000000..707dbdd44bfe --- /dev/null +++ b/contrib/expat/lib/fallthrough.h @@ -0,0 +1,49 @@ +/* + __ __ _ + ___\ \/ /_ __ __ _| |_ + / _ \\ /| '_ \ / _` | __| + | __// \| |_) | (_| | |_ + \___/_/\_\ .__/ \__,_|\__| + |_| XML parser + + Copyright (c) 2026 Nick Begg + Licensed under the MIT license: + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to permit + persons to whom the Software is furnished to do so, subject to the + following conditions: + + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN + NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, + DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR + OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE + USE OR OTHER DEALINGS IN THE SOFTWARE. +*/ + +#ifndef FALLTHROUGH_H +# define FALLTHROUGH_H 1 + +// Explicit fallthrough in switch case to avoid warnings +// with compiler flag -Wimplicit-fallthrough. + +# define EXPAT_FALLTHROUGH \ + do { \ + } while (0) + +# if defined(__has_attribute) +# if __has_attribute(fallthrough) +# undef EXPAT_FALLTHROUGH +# define EXPAT_FALLTHROUGH __attribute__((fallthrough)) +# endif +# endif + +#endif // FALLTHROUGH_H diff --git a/contrib/expat/lib/memory_sanitizer.h b/contrib/expat/lib/memory_sanitizer.h new file mode 100644 index 000000000000..a8a8006ccded --- /dev/null +++ b/contrib/expat/lib/memory_sanitizer.h @@ -0,0 +1,51 @@ +/* + __ __ _ + ___\ \/ /_ __ __ _| |_ + / _ \\ /| '_ \ / _` | __| + | __// \| |_) | (_| | |_ + \___/_/\_\ .__/ \__,_|\__| + |_| XML parser + + Copyright (c) 2026 Matthew Fernandez + Licensed under the MIT license: + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to permit + persons to whom the Software is furnished to do so, subject to the + following conditions: + + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN + NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, + DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR + OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE + USE OR OTHER DEALINGS IN THE SOFTWARE. +*/ + +#if ! defined(MEMORY_SANITIZER_H) +# define MEMORY_SANITIZER_H 1 + +# if defined(__has_feature) +# if __has_feature(memory_sanitizer) +# include + +// inform Memory Sanitizer that [base, base + extent) is now initialized +# define MSAN_UNPOISON(base, extent) __msan_unpoison((base), (extent)) + +# endif +# endif + +# if ! defined(MSAN_UNPOISON) +# define MSAN_UNPOISON(base, extent) \ + do { \ + } while (0) +# endif + +#endif // ! defined(MEMORY_SANITIZER_H) diff --git a/contrib/expat/lib/random_arc4random_buf.c b/contrib/expat/lib/random_arc4random_buf.c index 1476f07ba1a2..5212b9f192ce 100644 --- a/contrib/expat/lib/random_arc4random_buf.c +++ b/contrib/expat/lib/random_arc4random_buf.c @@ -7,6 +7,7 @@ |_| XML parser Copyright (c) 2026 Sebastian Pipping + Copyright (c) 2026 Matthew Fernandez Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -35,9 +36,12 @@ # define _DEFAULT_SOURCE 1 /* for glibc */ #endif +#include "memory_sanitizer.h" #include // for arc4random_buf void writeRandomBytes_arc4random_buf(void *target, size_t count) { arc4random_buf(target, count); + // MSan does not understand `arc4random_buf`, so explain its effects + MSAN_UNPOISON(target, count); } diff --git a/contrib/expat/lib/random_dev_urandom.c b/contrib/expat/lib/random_dev_urandom.c index e508fe9f3e3c..acae6ba4b047 100644 --- a/contrib/expat/lib/random_dev_urandom.c +++ b/contrib/expat/lib/random_dev_urandom.c @@ -49,11 +49,11 @@ writeRandomBytes_dev_urandom(void *target, size_t count) { const int fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC); if (fd < 0) { - return 0; + return false; } do { - void *const currentTarget = (void *)((char *)target + bytesWrittenTotal); + void *const currentTarget = (char *)target + bytesWrittenTotal; const size_t bytesToWrite = count - bytesWrittenTotal; errno = 0; diff --git a/contrib/expat/lib/random_getentropy.c b/contrib/expat/lib/random_getentropy.c index b4be70ed73c1..5cea2d8838b9 100644 --- a/contrib/expat/lib/random_getentropy.c +++ b/contrib/expat/lib/random_getentropy.c @@ -7,6 +7,7 @@ |_| XML parser Copyright (c) 2026 Sebastian Pipping + Copyright (c) 2026 Matthew Fernandez Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -45,10 +46,15 @@ # include #endif // ! defined(__APPLE__) +#include "memory_sanitizer.h" #include bool writeRandomBytes_getentropy(void *target, size_t count) { errno = 0; - return getentropy(target, count) == 0; + const bool success = getentropy(target, count); + // MSan does not understand `getentropy`, so explain its effects + if (success) + MSAN_UNPOISON(target, count); + return success; } diff --git a/contrib/expat/lib/random_getrandom.c b/contrib/expat/lib/random_getrandom.c index e5724a211cc6..72e2cc7093be 100644 --- a/contrib/expat/lib/random_getrandom.c +++ b/contrib/expat/lib/random_getrandom.c @@ -32,10 +32,10 @@ USE OR OTHER DEALINGS IN THE SOFTWARE. */ -#include "random_getrandom.h" - #include "expat_config.h" // for HAVE_GETRANDOM, HAVE_SYSCALL_GETRANDOM +#include "random_getrandom.h" + #if defined(HAVE_GETRANDOM) # include /* getrandom */ #endif @@ -52,6 +52,7 @@ # define GRND_NONBLOCK 0x0001 #endif /* defined(GRND_NONBLOCK) */ +#include "memory_sanitizer.h" #include #include #include // for INT_MAX @@ -64,7 +65,7 @@ writeRandomBytes_getrandom_nonblock(void *target, size_t count) { const unsigned int getrandomFlags = GRND_NONBLOCK; do { - void *const currentTarget = (void *)((char *)target + bytesWrittenTotal); + void *const currentTarget = (char *)target + bytesWrittenTotal; const size_t bytesToWrite = count - bytesWrittenTotal; assert(bytesToWrite <= INT_MAX); @@ -74,9 +75,13 @@ writeRandomBytes_getrandom_nonblock(void *target, size_t count) { const int bytesWrittenMore = #if defined(HAVE_GETRANDOM) (int)getrandom(currentTarget, bytesToWrite, getrandomFlags); + // MSan understands `getrandom`, so does not need extra guidance #else (int)syscall(SYS_getrandom, currentTarget, bytesToWrite, getrandomFlags); + // MSan does not understand `syscall`, so explain its effects + if (bytesWrittenMore > 0) + MSAN_UNPOISON(currentTarget, bytesWrittenMore); #endif if (bytesWrittenMore > 0) { diff --git a/contrib/expat/lib/siphash.h b/contrib/expat/lib/siphash.h index 04f6f74585b5..be216b4006dc 100644 --- a/contrib/expat/lib/siphash.h +++ b/contrib/expat/lib/siphash.h @@ -100,6 +100,7 @@ #include /* size_t */ #include /* uint64_t uint32_t uint8_t */ +#include "fallthrough.h" /* * Workaround to not require a C++11 compiler for using ULL suffix @@ -234,25 +235,25 @@ sip24_final(struct siphash *H) { switch (left) { case 7: b |= (uint64_t)H->buf[6] << 48; - /* fall through */ + EXPAT_FALLTHROUGH; case 6: b |= (uint64_t)H->buf[5] << 40; - /* fall through */ + EXPAT_FALLTHROUGH; case 5: b |= (uint64_t)H->buf[4] << 32; - /* fall through */ + EXPAT_FALLTHROUGH; case 4: b |= (uint64_t)H->buf[3] << 24; - /* fall through */ + EXPAT_FALLTHROUGH; case 3: b |= (uint64_t)H->buf[2] << 16; - /* fall through */ + EXPAT_FALLTHROUGH; case 2: b |= (uint64_t)H->buf[1] << 8; - /* fall through */ + EXPAT_FALLTHROUGH; case 1: b |= (uint64_t)H->buf[0] << 0; - /* fall through */ + EXPAT_FALLTHROUGH; case 0: break; } diff --git a/contrib/expat/lib/xcsinc.c b/contrib/expat/lib/xcsinc.c new file mode 100644 index 000000000000..3597c2480bc9 --- /dev/null +++ b/contrib/expat/lib/xcsinc.c @@ -0,0 +1,48 @@ +/* This file is included from other .c files! + __ __ _ + ___\ \/ /_ __ __ _| |_ + / _ \\ /| '_ \ / _` | __| + | __// \| |_) | (_| | |_ + \___/_/\_\ .__/ \__,_|\__| + |_| XML parser + + Copyright (c) 2022 Sebastian Pipping + Licensed under the MIT license: + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to permit + persons to whom the Software is furnished to do so, subject to the + following conditions: + + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN + NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, + DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR + OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE + USE OR OTHER DEALINGS IN THE SOFTWARE. +*/ + +static size_t +xcslen(const XML_Char *s) { +#ifdef XML_UNICODE +# ifdef XML_UNICODE_WCHAR_T + return wcslen(s); +# else + // XML_Char is unsigned short + size_t len = 0; + while (s[len]) { + len++; + } + return len; +# endif +#else + return strlen(s); +#endif +} diff --git a/contrib/expat/lib/xmlparse.c b/contrib/expat/lib/xmlparse.c index 890a9389f15d..60f6cc700548 100644 --- a/contrib/expat/lib/xmlparse.c +++ b/contrib/expat/lib/xmlparse.c @@ -1,4 +1,4 @@ -/* 75ef4224f81c052e9e5aeea2ac7de75357d2169ff9908e39edc08b9dc3052513 (2.8.1+) +/* 5de44e6750c6cc78818f06ed552f522a1241df0299395250e1792cb339389daf (2.8.2+) __ __ _ ___\ \/ /_ __ __ _| |_ / _ \\ /| '_ \ / _` | __| @@ -47,6 +47,9 @@ Copyright (c) 2026 Rosen Penev Copyright (c) 2026 Francesco Bertolaccini Copyright (c) 2026 Christian Ng + Copyright (c) 2026 Nick Begg + Copyright (c) 2026 Kartik Kenchi + Copyright (c) 2026 Haris Hussain Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -90,7 +93,7 @@ #include #include /* memset(), memcpy() */ #include -#include /* INT_MAX, UINT_MAX */ +#include /* INT_MAX, LLONG_MAX, LONG_MAX, UINT_MAX */ #include /* fprintf */ #include /* getenv */ #include /* SIZE_MAX, uintptr_t */ @@ -114,6 +117,7 @@ #include "ascii.h" #include "expat.h" #include "siphash.h" +#include "xcsinc.c" #if defined(HAVE_ARC4RANDOM) # include "random_arc4random.h" @@ -156,7 +160,7 @@ * Windows >=Vista (rand_s): _WIN32. \ \ If you insist on not using any of these, bypass this error by defining \ - XML_POOR_ENTROPY; you have been warned. \ + XML_POOR_ENTROPY and be vulnerable to hash flooding; you have been warned. \ \ If you have reasons to patch this detection code away or need changes \ to the build system, please open a bug. Thank you! @@ -207,6 +211,12 @@ typedef char ICHAR; #endif +#ifdef XML_LARGE_SIZE +# define XML_INDEX_MAX LLONG_MAX +#else +# define XML_INDEX_MAX LONG_MAX +#endif + /* Round up n to be a multiple of sz, where sz is a power of 2. */ #define ROUND_UP(n, sz) (((n) + ((sz) - 1)) & ~((sz) - 1)) @@ -270,8 +280,8 @@ typedef struct binding { struct binding *prevPrefixBinding; const struct attribute_id *attId; XML_Char *uri; - int uriLen; - int uriAlloc; + size_t uriLen; + size_t uriAlloc; } BINDING; typedef struct prefix { @@ -283,9 +293,9 @@ typedef struct { const XML_Char *str; const XML_Char *localPart; const XML_Char *prefix; - int strLen; - int uriLen; - int prefixLen; + size_t strLen; + size_t uriLen; + size_t prefixLen; } TAG_NAME; /* TAG represents an open element. @@ -384,8 +394,8 @@ typedef struct { const XML_Char *name; PREFIX *prefix; const ATTRIBUTE_ID *idAtt; - int nDefaultAtts; - int allocDefaultAtts; + size_t nDefaultAtts; + size_t allocDefaultAtts; DEFAULT_ATTRIBUTE *defaultAtts; HASH_TABLE defaultAttsNames; } ELEMENT_TYPE; @@ -417,6 +427,7 @@ typedef struct { unsigned scaffCount; int scaffLevel; int *scaffIndex; + size_t scaffIndexSize; } DTD; enum EntityType { @@ -588,6 +599,7 @@ static XML_Char *poolAppend(STRING_POOL *pool, const ENCODING *enc, static XML_Char *poolStoreString(STRING_POOL *pool, const ENCODING *enc, const char *ptr, const char *end); static XML_Bool FASTCALL poolGrow(STRING_POOL *pool); +static bool FASTCALL poolGrowUntil(STRING_POOL *pool, size_t needed); static const XML_Char *FASTCALL poolCopyString(STRING_POOL *pool, const XML_Char *s); static const XML_Char *FASTCALL poolCopyStringNoFinish(STRING_POOL *pool, @@ -642,16 +654,40 @@ static XML_Parser getRootParserOf(XML_Parser parser, static unsigned long getDebugLevel(const char *variableName, unsigned long defaultDebugLevel); +static bool poolAppendChar(STRING_POOL *pool, XML_Char c); + +static bool poolAppendChars(STRING_POOL *pool, const XML_Char *s, size_t len); + #define poolStart(pool) ((pool)->start) #define poolLength(pool) ((pool)->ptr - (pool)->start) #define poolChop(pool) ((void)--(pool->ptr)) #define poolLastChar(pool) (((pool)->ptr)[-1]) #define poolDiscard(pool) ((pool)->ptr = (pool)->start) #define poolFinish(pool) ((pool)->start = (pool)->ptr) -#define poolAppendChar(pool, c) \ - (((pool)->ptr == (pool)->end && ! poolGrow(pool)) \ - ? 0 \ - : ((*((pool)->ptr)++ = c), 1)) + +bool +poolAppendChar(STRING_POOL *pool, XML_Char c) { + if (pool->ptr == pool->end && ! poolGrow(pool)) + return false; + + *(pool->ptr)++ = c; + return true; +} + +bool +poolAppendChars(STRING_POOL *pool, const XML_Char *s, size_t len) { + // Detect and prevent integer overflow + if (len > SIZE_MAX / sizeof(XML_Char)) + return false; + + if (! poolGrowUntil(pool, len)) + return false; + + memcpy(pool->ptr, s, len * sizeof(XML_Char)); + pool->ptr += len; + + return true; +} #if ! defined(XML_TESTING) const @@ -730,11 +766,9 @@ struct XML_ParserStruct { const char *m_eventEndPtr; const char *m_positionPtr; OPEN_INTERNAL_ENTITY *m_openInternalEntities; - OPEN_INTERNAL_ENTITY *m_freeInternalEntities; OPEN_INTERNAL_ENTITY *m_openAttributeEntities; - OPEN_INTERNAL_ENTITY *m_freeAttributeEntities; OPEN_INTERNAL_ENTITY *m_openValueEntities; - OPEN_INTERNAL_ENTITY *m_freeValueEntities; + OPEN_INTERNAL_ENTITY *m_freeEntities; XML_Bool m_defaultExpandInternalEntities; int m_tagLevel; ENTITY *m_declEntity; @@ -754,7 +788,7 @@ struct XML_ParserStruct { TAG *m_freeTagList; BINDING *m_inheritedBindings; BINDING *m_freeBindingList; - int m_attsSize; + size_t m_attsSize; int m_nSpecifiedAtts; int m_idAttIndex; ATTRIBUTE *m_atts; @@ -768,7 +802,7 @@ struct XML_ParserStruct { STRING_POOL m_tempPool; STRING_POOL m_temp2Pool; char *m_groupConnector; - unsigned int m_groupSize; + size_t m_groupSize; XML_Char m_namespaceSeparator; XML_Parser m_parentParser; XML_ParsingStatus m_parsingStatus; @@ -785,6 +819,7 @@ struct XML_ParserStruct { ENTITY_STATS m_entity_stats; #endif XML_Bool m_reenter; + unsigned m_handlerCallDepth; }; #if XML_GE == 1 @@ -1128,6 +1163,23 @@ generate_hash_secret_salt(void) { #endif } +static void +beforeHandler(XML_Parser parser) { + assert(parser->m_handlerCallDepth < UINT_MAX); + parser->m_handlerCallDepth++; +} + +static void +afterHandler(XML_Parser parser) { + assert(parser->m_handlerCallDepth > 0); + parser->m_handlerCallDepth--; +} + +static bool +isCalledFromInsideHandler(XML_Parser parser) { + return parser->m_handlerCallDepth > 0; +} + static enum XML_Error callProcessor(XML_Parser parser, const char *start, const char *end, const char **endPtr) { @@ -1364,9 +1416,7 @@ parserCreate(const XML_Char *encodingName, parser->m_freeBindingList = NULL; parser->m_freeTagList = NULL; - parser->m_freeInternalEntities = NULL; - parser->m_freeAttributeEntities = NULL; - parser->m_freeValueEntities = NULL; + parser->m_freeEntities = NULL; parser->m_groupSize = 0; parser->m_groupConnector = NULL; @@ -1482,6 +1532,7 @@ parserInit(XML_Parser parser, const XML_Char *encodingName) { parser->m_parsingStatus.parsing = XML_INITIALIZED; // Reentry can only be triggered inside m_processor calls parser->m_reenter = XML_FALSE; + parser->m_handlerCallDepth = 0; #ifdef XML_DTD parser->m_isParamEntity = XML_FALSE; parser->m_useForeignDTD = XML_FALSE; @@ -1515,12 +1566,22 @@ moveToFreeBindingList(XML_Parser parser, BINDING *bindings) { } } +/* Moves a list of entities onto the start of another list. */ +static void +moveEntityList(OPEN_INTERNAL_ENTITY **dst, OPEN_INTERNAL_ENTITY **src) { + for (OPEN_INTERNAL_ENTITY *head = *src; head != NULL;) { + OPEN_INTERNAL_ENTITY *const openEntity = head; + head = head->next; + openEntity->next = *dst; + *dst = openEntity; + } +} + XML_Bool XMLCALL XML_ParserReset(XML_Parser parser, const XML_Char *encodingName) { TAG *tStk; - OPEN_INTERNAL_ENTITY *openEntityList; - if (parser == NULL) + if ((parser == NULL) || isCalledFromInsideHandler(parser)) return XML_FALSE; if (parser->m_parentParser) @@ -1535,32 +1596,14 @@ XML_ParserReset(XML_Parser parser, const XML_Char *encodingName) { tag->bindings = NULL; parser->m_freeTagList = tag; } - /* move m_openInternalEntities to m_freeInternalEntities */ - openEntityList = parser->m_openInternalEntities; - while (openEntityList) { - OPEN_INTERNAL_ENTITY *openEntity = openEntityList; - openEntityList = openEntity->next; - openEntity->next = parser->m_freeInternalEntities; - parser->m_freeInternalEntities = openEntity; - } - /* move m_openAttributeEntities to m_freeAttributeEntities (i.e. same task but - * for attributes) */ *** 3286 LINES SKIPPED *** From nobody Thu Jul 2 07:47:03 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4grTVb5zdKz6kD1D for ; Thu, 02 Jul 2026 07:47:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4grTVb3JfBz4MMb for ; Thu, 02 Jul 2026 07:47:03 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782978423; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zNO0GKRarlJvjKfbd2TaOAatbZHF/uAxthMiRDY0UHc=; b=T4gjB47XdguyYXgEnqKZMv5eILgVfQpocGR/egpFtLAzr4h0RRsl3sdG4sNBiJIbYLRD/p NkwmOuqaRZ0HsK7/I50b6KFUyG6tt6WTcwF6yU5Pknzz3Gut79NzjuX5q5jqwaiZbQOO5c HM72vnZrj/B3lmwG9uVuqV0SU7ny6UiERxWu0+StO2WL5jVbtOxvSbEOsXrQV4VyKe74dO p9OIL6LXPJjfuknlofTkxqE77sRSr5AZ5SwGDWbNczJT1vaR3cr/zUbYjHz1Gr81YkcZ1X jwWqhf/pTObjX1kx9UetpdYuB9dVJG2ymFlp6nQF5hd7srRe7mFdDKfq99HPkw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782978423; a=rsa-sha256; cv=none; b=cOfxvTZQO9tspZN+L8yb0J0qtr5/lquL8PcukzM5vxDkVxV3WV8MUUcbqvH/gVHIhhKfcd vr3HTRLN1GOEBBt6aS9H/zhWCAHKsMSObVOKOd0OuMSdp0LWyaXixMXb/En+jTKAMMzWov iLL1cc23KOqCIEsk0bYOjCjYfAws98MfdPAYQ8LoDRZJCUJ0JjCy9iO3GwpvCooz2D/1w8 iTDOD1xgbfCfSy9vsCTVvQWZfEcr2exOwNTDbpWiX8uJNtP1N/MDce/ojCuSD1njisTWCI VUpDbmZ/AJfmedJrTodJz6oJMoa/82UpOGe1JhJL0fgDlQsy099sMT7n/iQBBQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782978423; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zNO0GKRarlJvjKfbd2TaOAatbZHF/uAxthMiRDY0UHc=; b=HcYeCRwZmKK6iICcGc0ViJAzZNYCFPbvsDXVS8DXkrHu2KYmd1sQMBrPEP+vELXyHmiDWk rsZngCj5ob/ZmuF51OAoqJ9/BGK0cWUrL53imocDmJ5nqDkhyAVXY7vA3cx2Ox1t68W6a7 tvyoi9YvsAQDhH8xZs131gm4eHi8g+ykKpG3xVy2xvbTIWjqu/rV3kI+IhcX69OM3JrQvA RN9LP+ot7RpspNjK+K1oBVtopCyqwSqiuncT4DqP8eQ9ddm5DpQZP3UMsbIQK59d9Rj7xT Z6LpJb/dy88g9/pkKf6vLLKWUq7bd85hKuE7DSFMdQzw0OEU9+fIlRLBT5hDuA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4grTVb0XYvzrxC for ; Thu, 02 Jul 2026 07:47:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 307fd by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 02 Jul 2026 07:47:03 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Faraz Vahedi From: Robert Clausecker Subject: git: 3d3eeda198a9 - stable/15 - libc: Fix assert() sanitiser for C++ contextual bool conversion List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fuz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 3d3eeda198a924189b47eb0ba7f6f0dd3defbd89 Auto-Submitted: auto-generated Date: Thu, 02 Jul 2026 07:47:03 +0000 Message-Id: <6a461777.307fd.31c9d3ea@gitrepo.freebsd.org> The branch stable/15 has been updated by fuz: URL: https://cgit.FreeBSD.org/src/commit/?id=3d3eeda198a924189b47eb0ba7f6f0dd3defbd89 commit 3d3eeda198a924189b47eb0ba7f6f0dd3defbd89 Author: Faraz Vahedi AuthorDate: 2026-06-06 11:38:47 +0000 Commit: Robert Clausecker CommitDate: 2026-07-02 07:44:26 +0000 libc: Fix assert() sanitiser for C++ contextual bool conversion Replace the `(bool(*)(bool))` probe in `__assert_sanitize()` with an unevaluated conditional expression, so types with `explicit operator bool()` that require a contextually converted constant expression of type `bool` are handled correctly. Ergo, arity check is now performed separately via `__assert_sanitize_arity()`, a unary template whose parameter pack must bind to exactly on argument after `__VA_ARGS__` is substituted into the call. Also align NDEBUG with C23 requirements. Reported by: dim, aokblast Signed-off-by: Faraz Vahedi Reviewed by: aokblast, fuz MFC after: 1 week Fixes: 867b51452ea78ece0b312a387e63fdbc2a11056a Pull Request: https://github.com/freebsd/freebsd-src/pull/2265 (cherry picked from commit 48d20fd1cf90179e778c6155900cbed2be140273) --- include/assert.h | 34 +++++++--------------------------- 1 file changed, 7 insertions(+), 27 deletions(-) diff --git a/include/assert.h b/include/assert.h index 75d3e62e8932..afbf2c1092e0 100644 --- a/include/assert.h +++ b/include/assert.h @@ -53,35 +53,15 @@ #endif /* __BSD_VISIBLE */ #else #ifdef __cplusplus -#if __cplusplus < 202002L -/* - * C++ modes prior to C++20 cannot simultaneously satisfy all three - * desirable properties of the sanitiser: - * - * Approach No double-eval Lambda support Arity check - * ----------------------------- -------------- -------------- ----------- - * sizeof(cast(expression)) yes no yes - * static_cast(expression) no yes no - * (void)bool(expression) no yes no - * - * NOTE: C++20 introduced lambdas in unevaluated contexts; see P0315R4. - * - * Since no approach satisfies all three below C++20, the least harmful - * choice is to forgo the check entirely rather than silently break one - * of the remaining guarantees. - * - */ -#define __assert_sanitize(...) ((void)0) -#else -#define __assert_sanitize(...) (void)sizeof(((bool(*)(bool))0)(__VA_ARGS__)) -#endif /* __cplusplus < 202002L */ +#define assert(...) ((void)(bool(__VA_ARGS__) ? ((void)0) : \ + __assert(__func__, __FILE__, __LINE__, \ + #__VA_ARGS__))) #else -#define __assert_sanitize(...) (void)sizeof(((_Bool(*)(_Bool))0)(__VA_ARGS__)) -#endif /* __cplusplus */ -#define assert(...) (__assert_sanitize(__VA_ARGS__), \ - (__VA_ARGS__) ? (void)0 : \ - __assert(__func__, __FILE__, \ +#define assert(...) ((void)sizeof(((_Bool(*)(_Bool))0)(__VA_ARGS__)), \ + (__VA_ARGS__) ? (void)0 : \ + __assert(__func__, __FILE__, \ __LINE__, #__VA_ARGS__)) +#endif /* __cplusplus */ #define _assert(...) assert(__VA_ARGS__) #if __BSD_VISIBLE #define __assert_unreachable() assert(0 && "unreachable segment reached") From nobody Thu Jul 2 07:49:35 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4grTYW69nZz6kDVM for ; Thu, 02 Jul 2026 07:49:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4grTYW3lJSz4MgP for ; Thu, 02 Jul 2026 07:49:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782978575; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TXEeFy/Gb+9j0EKY4Ks2NekhjrgiaBF6bXnq/ENlTG4=; b=g1mXe61fQ5/J+sT6mrC0ub2rP4jB0D76EqR+SI19pueeMiC0TyZxBdTmuCsTqqjGmwQgg0 7haUkyMCm/rhYPs1blF1mWhi3Xfq1FVJLC7LEQjP9iCUtvJkcswe1Zqo2OuA9V5Haj9GrC jG/7glbVe8JCyIhMItVK7DoXIzVYxgEODqwyBfY+ComS2r9oeklbDvmO0mqnitlui+ZOBv 4tuvGdvaI9WPJu/wRlREinNfB8rO54wrT2AW+bWPDO9zi+mrbAAtQvHYrruu8+QWcs0TJy 0409sHZPEUffbfAU/3rYZx5Kkmp516WjPkDD76Wqm2Rto/SEYkVDiHDP0OWEFQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782978575; a=rsa-sha256; cv=none; b=j3EtC4ZrNpmyBfVrDr79iupXz2l8OTg+/9u4cA0g9lXs3M8CxUHN5amqAIxZkpY2Lxiya0 KPd0cTLAaEqT9WYTFQhGtVuRc3Fp/dH1w5pahWFVgslrxk6e2ARillZMDPGpA8w91+2oUh MdJ72N0GPEKp4jIrazVSZ8jkaAfv2RpCqefY+dA5PLwZuPwwbZ2zoc6C6uylEigTGVuPPR OHkIaQXx+KsV7nUtMgq/M60NbGr9zd3MXa6Yxt0kPSwjwK4V/WCGgHgIZlxmXrsvi1lcJw S1VbKWA3sbtXGl0ovI1TwmtNPp8XxOH24qtCB1wOK3BzCAYwEc84/Z4+KXN9Cw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782978575; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TXEeFy/Gb+9j0EKY4Ks2NekhjrgiaBF6bXnq/ENlTG4=; b=Eu8iTbB69BCAhI6p6ViSg9ZSjfAZ4FTOHoTBPE6sIGy8Ac0MeQNYbfbyXqIohwUf9+x9jF 8Vjn5K8T9w9sN56e//pfho1cNj8UysfVroYlrBsEPsOtxamqG7b2okdDy38K18MJ9iOQPt Wa1wKSCdZOrFohifVIZd96tVHm+xPO/LZsttl1+VrLLUm6ZE8msX/QQx977p4hfn1oFzM8 ny7dcQatyvnhbR+6CXz0A8nkAt5K9Fdzd2OO89iJbEnT4+Zm+oPs30mQh9et8MYcQVmRAR vtMdqA6vcqUd7/A1VkaSgOQjrqSBWSXk91lDTI+ijWSI02PHS5WYaSauYUO7pw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4grTYW1gpCzrkh for ; Thu, 02 Jul 2026 07:49:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 31dc5 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 02 Jul 2026 07:49:35 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Philip Paeps Subject: git: 12b941265ebb - stable/14 - contrib/expat: import expat 2.8.2 List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: philip X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 12b941265ebb01bc6f4683d84551a16580bb5cc6 Auto-Submitted: auto-generated Date: Thu, 02 Jul 2026 07:49:35 +0000 Message-Id: <6a46180f.31dc5.29b530d5@gitrepo.freebsd.org> The branch stable/14 has been updated by philip: URL: https://cgit.FreeBSD.org/src/commit/?id=12b941265ebb01bc6f4683d84551a16580bb5cc6 commit 12b941265ebb01bc6f4683d84551a16580bb5cc6 Author: Philip Paeps AuthorDate: 2026-06-25 14:34:28 +0000 Commit: Philip Paeps CommitDate: 2026-07-02 04:15:35 +0000 contrib/expat: import expat 2.8.2 Changes: https://github.com/libexpat/libexpat/blob/R_2_8_2/expat/Changes Security: CVE-2026-50219 Security: CVE-2026-56131 Security: CVE-2026-56132 Security: CVE-2026-56403 Security: CVE-2026-56404 Security: CVE-2026-56405 Security: CVE-2026-56406 Security: CVE-2026-56407 Security: CVE-2026-56408 Security: CVE-2026-56409 Security: CVE-2026-56410 Security: CVE-2026-56411 Security: CVE-2026-56412 (cherry picked from commit c82aeee8a6d39371006f5eeb1b51704e7b97e2b7) --- contrib/expat/Changes | 92 ++- contrib/expat/README.md | 5 +- contrib/expat/configure.ac | 23 +- contrib/expat/doc/reference.html | 6 +- contrib/expat/doc/xmlwf.1 | 2 +- contrib/expat/doc/xmlwf.xml | 2 +- contrib/expat/lib/Makefile.am | 5 + contrib/expat/lib/Makefile.in | 5 + contrib/expat/lib/expat.h | 2 +- contrib/expat/lib/fallthrough.h | 49 ++ contrib/expat/lib/memory_sanitizer.h | 51 ++ contrib/expat/lib/random_arc4random_buf.c | 4 + contrib/expat/lib/random_dev_urandom.c | 4 +- contrib/expat/lib/random_getentropy.c | 8 +- contrib/expat/lib/random_getrandom.c | 11 +- contrib/expat/lib/siphash.h | 15 +- contrib/expat/lib/xcsinc.c | 48 ++ contrib/expat/lib/xmlparse.c | 1208 ++++++++++++++++------------- contrib/expat/lib/xmltok.c | 6 +- contrib/expat/lib/xmltok_impl.c | 21 +- contrib/expat/tests/acc_tests.c | 6 +- contrib/expat/tests/alloc_tests.c | 6 +- contrib/expat/tests/basic_tests.c | 48 +- contrib/expat/tests/chardata.c | 14 +- contrib/expat/tests/common.c | 5 +- contrib/expat/tests/handlers.c | 53 +- contrib/expat/tests/handlers.h | 14 + contrib/expat/tests/misc_tests.c | 42 +- contrib/expat/xmlwf/filemap.h | 3 +- contrib/expat/xmlwf/win32filemap.c | 2 +- contrib/expat/xmlwf/xmlfile.c | 18 +- contrib/expat/xmlwf/xmlwf.c | 107 ++- contrib/expat/xmlwf/xmlwf_helpgen.py | 2 +- lib/libexpat/expat_config.h | 6 +- lib/libexpat/libbsdxml.3 | 4 +- 35 files changed, 1234 insertions(+), 663 deletions(-) diff --git a/contrib/expat/Changes b/contrib/expat/Changes index 313b3dc60cd0..6a1b89160fb9 100644 --- a/contrib/expat/Changes +++ b/contrib/expat/Changes @@ -29,6 +29,94 @@ !! THANK YOU! Sebastian Pipping -- Berlin, 2026-03-17 !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +Release 2.8.2 Thu June 25 2026 + Security fixes: + #1246 CVE-2026-50219 -- Disallow calls to functions + `XML_GetBuffer`, `XML_Parse`, `XML_ParseBuffer`, + `XML_ParserFree`, `XML_ParserReset` to guard e.g. + Expat bindings from memory corruption; + this CPython issue is related: + https://github.com/python/cpython/issues/146169 + #1267 CVE-2026-56131 -- Protect XML_ResumeParser from being called + from a handler, plugging a hole in the fix + to CVE-2026-50219 + #1272 CVE-2026-56132 -- Fix out-of-bound scaffolding index store + in `doProlog` + #1229 #1232 CVE-2026-56403 -- Integer overflow in `storeAtts` + #1249 CVE-2026-56404 -- Integer overflow in `addBinding` + #1251 CVE-2026-56405 -- Integer overflow in `getAttributeId` + #1255 CVE-2026-56406 -- Integer overflow in `XML_ParseBuffer` + #1262 CVE-2026-56407 -- Integer overflow in `textLen` handling + #565 CVE-2026-56408 -- Integer overflow in `copyString` + (commit 16e2efd867ea8567ffa012210b52ef5918e20817) + #1259 CVE-2026-56409 -- xmlwf: Integer overflow in output path join + #1252 CVE-2026-56410 -- xmlwf: Integer overflow in + `resolveSystemId` + #1263 CVE-2026-56411 -- xmlwf: Integer overflow in notation list + allocation + #1278 CVE-2026-56412 -- Guard XML_TOK_DATA_CHARS handler calls in + `doCdataSection`, plugging a hole in the fix to + CVE-2026-50219 + + Bug fixes: + #1260 xmlwf: Escape names and base URI in meta output + #1266 xmlwf: Pick a safe quote for notation system and public IDs + + Other changes: + #1257 CMake|Autotools: Stop using /dev/urandom by default + #1244 #1254 CMake: Fix guard for Unix sources of entropy + #1183 #1270 CMake|Windows: Add missing export for symbol + `XML_SetHashSalt16Bytes` + #1236 CMake: Mark option EXPAT_OSSFUZZ_BUILD as advanced + #1283 Limit output indentation for EXPAT_ENTITY_DEBUG=1 and + allow unlimited indentation via EXPAT_ENTITY_DEBUG=2 + #565 Replace some loops by use of `memcpy`, `strlen`, `wcslen` + #1220 lib: Use a size_t for group sizes + #1221 lib: Fix too-conservative integer overflow check when + appending raw name + #1222 lib: Simplify attribute allocation/management logic + #1224 Update fallthrough annotations to satisfy Clang and GCC + #1226 lib: Remove unnecessary void * casts in random code + #1228 lib: Reduce scope of locals in storeAtts + #1230 lib: Count attributes with size_t variables + #1238 Minor get-buffer improvements + #1239 #1240 lib|tests: Include header expat_config.h first + #1241 lib: Shrink size of XML_GetBuffer + #1242 lib: Remove a legacy comment + #1243 lib: XML_ParserReset: Extract repeated linked-list move logic + #1243 lib: Unify entity free lists + #1247 lib: Fix use of '0' as boolean literal + #1248 lib: Make XML_Index overflow check more intuitive + #1256 lib: Use size_t for counting string/URI lengths + #1258 lib: XML_GetInputContext: Remove use of 0 for NULL + #1261 Comment typo fixes + #1275 Teach Memory Sanitizer semantics of randomization functions + #1276 #1281 Version info bumped from 13:1:12 (libexpat*.so.1.12.1) + to 13:2:12 (libexpat*.so.1.12.2); see https://verbump.de/ + for what these numbers do + + Infrastructure: + #1231 perl-integration.yml: Bump to XML::Parser 2.59 + #1237 emscripten.yml: Bump from Ubuntu 22.04 to 24.04 + #1183 #1271 windows-build.yml: Cover completeness of file + libexpat.def.cmake + #1274 linux.yml: Make llvm-symbolizer available in CI + + Special thanks to: + Alessandro Gario + Asher Darden + Christoph Reiter + Haris Hussain + Matthew Fernandez + Kartik Kenchi + Nick Begg + Sajin S + Yousef Shanableh + and + Anthropic + Astra Security + Trail of Bits + Release 2.8.1 Sun May 10 2026 Security fixes: #1216 CVE-2026-45186 -- Fix quadratic runtime from attribute name @@ -1820,7 +1908,7 @@ Release 2.1.0 Sat March 24 2012 - Bug Fixes: #1742315: Harmful XML_ParserCreateNS suggestion. #1785430: Expat build fails on linux-amd64 with gcc version>=4.1 -O3. - #1983953, 2517952, 2517962, 2649838: + #1983953, 2517952, 2517962, 2649838: Build modifications using autoreconf instead of buildconf.sh. #2815947, #2884086: OBJEXT and EXEEXT support while building. #2517938: xmlwf should return non-zero exit status if not well-formed. @@ -1846,7 +1934,7 @@ Release 2.1.0 Sat March 24 2012 See bug #2990652 and patch #3312568. Added run-benchmark target to Makefile.in - relies on testdata module present in the same relative location as in the repository. - + Release 2.0.1 Tue June 5 2007 - Fixed bugs #1515266, #1515600: The character data handler's calling of XML_StopParser() was not handled properly; if the parser was diff --git a/contrib/expat/README.md b/contrib/expat/README.md index 7a5ed463b6d5..5ad5e1e85afa 100644 --- a/contrib/expat/README.md +++ b/contrib/expat/README.md @@ -11,7 +11,7 @@ > at the top of the `Changes` file. -# Expat, Release 2.8.1 +# Expat, Release 2.8.2 This is Expat, a C99 library for parsing [XML 1.0 Fourth Edition](https://www.w3.org/TR/2006/REC-xml-20060816/), started by @@ -286,9 +286,6 @@ EXPAT_ENABLE_INSTALL:BOOL=ON // Use /MT flag (static CRT) when compiling in MSVC EXPAT_MSVC_STATIC_CRT:BOOL=OFF -// Build fuzzers via OSS-Fuzz for the expat library -EXPAT_OSSFUZZ_BUILD:BOOL=OFF - // Build a shared expat library EXPAT_SHARED_LIBS:BOOL=ON diff --git a/contrib/expat/configure.ac b/contrib/expat/configure.ac index fb492dfd79f7..f14c0308e1c4 100644 --- a/contrib/expat/configure.ac +++ b/contrib/expat/configure.ac @@ -90,7 +90,7 @@ dnl If the API changes incompatibly set LIBAGE back to 0 dnl LIBCURRENT=13 # sync -LIBREVISION=1 # with +LIBREVISION=2 # with LIBAGE=12 # CMakeLists.txt! AC_CONFIG_HEADERS([expat_config.h]) @@ -395,8 +395,23 @@ AC_DEFINE([XML_GE], 1, [Define as 1/0 to enable/disable support for general entities.]) AC_DEFINE([XML_DTD], 1, [Define to make parameter entity parsing functionality available.]) -AC_DEFINE([XML_DEV_URANDOM], 1, - [Define to include code reading entropy from `/dev/urandom'.]) + + +have_dev_urandom=false + +AC_ARG_WITH([dev-urandom], + [AS_HELP_STRING([--with-dev-urandom], + [enforce the use of /dev/urandom in the system @<:@default=no@:>@]) +AS_HELP_STRING([--without-dev-urandom], + [enforce not using /dev/urandom in the system @<:@default=no@:>@])], + [with_dev_urandom=${withval}], + []) + +AS_IF([test "x${with_dev_urandom}" = "xyes"], + [have_dev_urandom=true + AC_DEFINE([XML_DEV_URANDOM], 1, + [Define to include code reading entropy from `/dev/urandom'.])]) + AC_ARG_ENABLE([xml-attr-info], [AS_HELP_STRING([--enable-xml-attr-info], @@ -580,7 +595,7 @@ Entropy sources: getentropy: ${have_getentropy} getrandom: ${have_getrandom_function} syscall SYS_getrandom: ${have_getrandom_syscall} - /dev/urandom: true + /dev/urandom: ${have_dev_urandom} Continue with e.g.: make -j2 diff --git a/contrib/expat/doc/reference.html b/contrib/expat/doc/reference.html index 07d331ed7b56..5c4b1c76ca78 100644 --- a/contrib/expat/doc/reference.html +++ b/contrib/expat/doc/reference.html @@ -53,7 +53,7 @@

- The Expat XML Parser Release 2.8.1 + The Expat XML Parser Release 2.8.2

@@ -1602,7 +1602,9 @@ XML_ParserReset(XML_Parser p, To state the obvious: the three parsing functions XML_Parse, XML_ParseBuffer and XML_GetBuffer must not be called from within a + "#XML_GetBuffer">XML_GetBuffer as well as the two cleanup functions + XML_ParserFree and XML_ParserReset must not be called from within a handler unless they operate on a separate parser instance, that is, one that did not call the handler. For example, it is OK to call the parsing functions from within an XML_ExternalEntityRefHandler, if they apply to the parser diff --git a/contrib/expat/doc/xmlwf.1 b/contrib/expat/doc/xmlwf.1 index 12760944a5da..3de559ec1bb3 100644 --- a/contrib/expat/doc/xmlwf.1 +++ b/contrib/expat/doc/xmlwf.1 @@ -5,7 +5,7 @@ \\$2 \(la\\$1\(ra\\$3 .. .if \n(.g .mso www.tmac -.TH XMLWF 1 "May 10, 2026" "" "" +.TH XMLWF 1 "June 25, 2026" "" "" .SH NAME xmlwf \- Determines if an XML document is well-formed .SH SYNOPSIS diff --git a/contrib/expat/doc/xmlwf.xml b/contrib/expat/doc/xmlwf.xml index 529dbba16722..7e57cf1346b9 100644 --- a/contrib/expat/doc/xmlwf.xml +++ b/contrib/expat/doc/xmlwf.xml @@ -21,7 +21,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [ Scott"> Bronson"> - May 10, 2026"> + June 25, 2026"> 1"> bronson@rinspin.com"> diff --git a/contrib/expat/lib/Makefile.am b/contrib/expat/lib/Makefile.am index 27bf2ab64769..2b6aec2e6bdc 100644 --- a/contrib/expat/lib/Makefile.am +++ b/contrib/expat/lib/Makefile.am @@ -10,6 +10,8 @@ # Copyright (c) 2017 Tomasz Kłoczko # Copyright (c) 2019 David Loffredo # Copyright (c) 2026 Gordon Messmer +# Copyright (c) 2026 Nick Begg +# Copyright (c) 2026 Matthew Fernandez # Licensed under the MIT license: # # Permission is hereby granted, free of charge, to any person obtaining @@ -112,14 +114,17 @@ EXTRA_DIST = \ asciitab.h \ expat_external.h \ expat.h \ + fallthrough.h \ iasciitab.h \ internal.h \ latin1tab.h \ libexpat.def.cmake \ + memory_sanitizer.h \ nametab.h \ siphash.h \ utf8tab.h \ winconfig.h \ + xcsinc.c \ xmlrole.h \ xmltok.h \ xmltok_impl.c \ diff --git a/contrib/expat/lib/Makefile.in b/contrib/expat/lib/Makefile.in index 4cd6fcfc6088..73db0e584705 100644 --- a/contrib/expat/lib/Makefile.in +++ b/contrib/expat/lib/Makefile.in @@ -26,6 +26,8 @@ # Copyright (c) 2017 Tomasz Kłoczko # Copyright (c) 2019 David Loffredo # Copyright (c) 2026 Gordon Messmer +# Copyright (c) 2026 Nick Begg +# Copyright (c) 2026 Matthew Fernandez # Licensed under the MIT license: # # Permission is hereby granted, free of charge, to any person obtaining @@ -508,14 +510,17 @@ EXTRA_DIST = \ asciitab.h \ expat_external.h \ expat.h \ + fallthrough.h \ iasciitab.h \ internal.h \ latin1tab.h \ libexpat.def.cmake \ + memory_sanitizer.h \ nametab.h \ siphash.h \ utf8tab.h \ winconfig.h \ + xcsinc.c \ xmlrole.h \ xmltok.h \ xmltok_impl.c \ diff --git a/contrib/expat/lib/expat.h b/contrib/expat/lib/expat.h index ec3f58544cb0..c493c70441c4 100644 --- a/contrib/expat/lib/expat.h +++ b/contrib/expat/lib/expat.h @@ -1094,7 +1094,7 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled); */ # define XML_MAJOR_VERSION 2 # define XML_MINOR_VERSION 8 -# define XML_MICRO_VERSION 1 +# define XML_MICRO_VERSION 2 # ifdef __cplusplus } diff --git a/contrib/expat/lib/fallthrough.h b/contrib/expat/lib/fallthrough.h new file mode 100644 index 000000000000..707dbdd44bfe --- /dev/null +++ b/contrib/expat/lib/fallthrough.h @@ -0,0 +1,49 @@ +/* + __ __ _ + ___\ \/ /_ __ __ _| |_ + / _ \\ /| '_ \ / _` | __| + | __// \| |_) | (_| | |_ + \___/_/\_\ .__/ \__,_|\__| + |_| XML parser + + Copyright (c) 2026 Nick Begg + Licensed under the MIT license: + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to permit + persons to whom the Software is furnished to do so, subject to the + following conditions: + + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN + NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, + DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR + OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE + USE OR OTHER DEALINGS IN THE SOFTWARE. +*/ + +#ifndef FALLTHROUGH_H +# define FALLTHROUGH_H 1 + +// Explicit fallthrough in switch case to avoid warnings +// with compiler flag -Wimplicit-fallthrough. + +# define EXPAT_FALLTHROUGH \ + do { \ + } while (0) + +# if defined(__has_attribute) +# if __has_attribute(fallthrough) +# undef EXPAT_FALLTHROUGH +# define EXPAT_FALLTHROUGH __attribute__((fallthrough)) +# endif +# endif + +#endif // FALLTHROUGH_H diff --git a/contrib/expat/lib/memory_sanitizer.h b/contrib/expat/lib/memory_sanitizer.h new file mode 100644 index 000000000000..a8a8006ccded --- /dev/null +++ b/contrib/expat/lib/memory_sanitizer.h @@ -0,0 +1,51 @@ +/* + __ __ _ + ___\ \/ /_ __ __ _| |_ + / _ \\ /| '_ \ / _` | __| + | __// \| |_) | (_| | |_ + \___/_/\_\ .__/ \__,_|\__| + |_| XML parser + + Copyright (c) 2026 Matthew Fernandez + Licensed under the MIT license: + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to permit + persons to whom the Software is furnished to do so, subject to the + following conditions: + + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN + NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, + DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR + OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE + USE OR OTHER DEALINGS IN THE SOFTWARE. +*/ + +#if ! defined(MEMORY_SANITIZER_H) +# define MEMORY_SANITIZER_H 1 + +# if defined(__has_feature) +# if __has_feature(memory_sanitizer) +# include + +// inform Memory Sanitizer that [base, base + extent) is now initialized +# define MSAN_UNPOISON(base, extent) __msan_unpoison((base), (extent)) + +# endif +# endif + +# if ! defined(MSAN_UNPOISON) +# define MSAN_UNPOISON(base, extent) \ + do { \ + } while (0) +# endif + +#endif // ! defined(MEMORY_SANITIZER_H) diff --git a/contrib/expat/lib/random_arc4random_buf.c b/contrib/expat/lib/random_arc4random_buf.c index 1476f07ba1a2..5212b9f192ce 100644 --- a/contrib/expat/lib/random_arc4random_buf.c +++ b/contrib/expat/lib/random_arc4random_buf.c @@ -7,6 +7,7 @@ |_| XML parser Copyright (c) 2026 Sebastian Pipping + Copyright (c) 2026 Matthew Fernandez Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -35,9 +36,12 @@ # define _DEFAULT_SOURCE 1 /* for glibc */ #endif +#include "memory_sanitizer.h" #include // for arc4random_buf void writeRandomBytes_arc4random_buf(void *target, size_t count) { arc4random_buf(target, count); + // MSan does not understand `arc4random_buf`, so explain its effects + MSAN_UNPOISON(target, count); } diff --git a/contrib/expat/lib/random_dev_urandom.c b/contrib/expat/lib/random_dev_urandom.c index e508fe9f3e3c..acae6ba4b047 100644 --- a/contrib/expat/lib/random_dev_urandom.c +++ b/contrib/expat/lib/random_dev_urandom.c @@ -49,11 +49,11 @@ writeRandomBytes_dev_urandom(void *target, size_t count) { const int fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC); if (fd < 0) { - return 0; + return false; } do { - void *const currentTarget = (void *)((char *)target + bytesWrittenTotal); + void *const currentTarget = (char *)target + bytesWrittenTotal; const size_t bytesToWrite = count - bytesWrittenTotal; errno = 0; diff --git a/contrib/expat/lib/random_getentropy.c b/contrib/expat/lib/random_getentropy.c index b4be70ed73c1..5cea2d8838b9 100644 --- a/contrib/expat/lib/random_getentropy.c +++ b/contrib/expat/lib/random_getentropy.c @@ -7,6 +7,7 @@ |_| XML parser Copyright (c) 2026 Sebastian Pipping + Copyright (c) 2026 Matthew Fernandez Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -45,10 +46,15 @@ # include #endif // ! defined(__APPLE__) +#include "memory_sanitizer.h" #include bool writeRandomBytes_getentropy(void *target, size_t count) { errno = 0; - return getentropy(target, count) == 0; + const bool success = getentropy(target, count); + // MSan does not understand `getentropy`, so explain its effects + if (success) + MSAN_UNPOISON(target, count); + return success; } diff --git a/contrib/expat/lib/random_getrandom.c b/contrib/expat/lib/random_getrandom.c index e5724a211cc6..72e2cc7093be 100644 --- a/contrib/expat/lib/random_getrandom.c +++ b/contrib/expat/lib/random_getrandom.c @@ -32,10 +32,10 @@ USE OR OTHER DEALINGS IN THE SOFTWARE. */ -#include "random_getrandom.h" - #include "expat_config.h" // for HAVE_GETRANDOM, HAVE_SYSCALL_GETRANDOM +#include "random_getrandom.h" + #if defined(HAVE_GETRANDOM) # include /* getrandom */ #endif @@ -52,6 +52,7 @@ # define GRND_NONBLOCK 0x0001 #endif /* defined(GRND_NONBLOCK) */ +#include "memory_sanitizer.h" #include #include #include // for INT_MAX @@ -64,7 +65,7 @@ writeRandomBytes_getrandom_nonblock(void *target, size_t count) { const unsigned int getrandomFlags = GRND_NONBLOCK; do { - void *const currentTarget = (void *)((char *)target + bytesWrittenTotal); + void *const currentTarget = (char *)target + bytesWrittenTotal; const size_t bytesToWrite = count - bytesWrittenTotal; assert(bytesToWrite <= INT_MAX); @@ -74,9 +75,13 @@ writeRandomBytes_getrandom_nonblock(void *target, size_t count) { const int bytesWrittenMore = #if defined(HAVE_GETRANDOM) (int)getrandom(currentTarget, bytesToWrite, getrandomFlags); + // MSan understands `getrandom`, so does not need extra guidance #else (int)syscall(SYS_getrandom, currentTarget, bytesToWrite, getrandomFlags); + // MSan does not understand `syscall`, so explain its effects + if (bytesWrittenMore > 0) + MSAN_UNPOISON(currentTarget, bytesWrittenMore); #endif if (bytesWrittenMore > 0) { diff --git a/contrib/expat/lib/siphash.h b/contrib/expat/lib/siphash.h index 04f6f74585b5..be216b4006dc 100644 --- a/contrib/expat/lib/siphash.h +++ b/contrib/expat/lib/siphash.h @@ -100,6 +100,7 @@ #include /* size_t */ #include /* uint64_t uint32_t uint8_t */ +#include "fallthrough.h" /* * Workaround to not require a C++11 compiler for using ULL suffix @@ -234,25 +235,25 @@ sip24_final(struct siphash *H) { switch (left) { case 7: b |= (uint64_t)H->buf[6] << 48; - /* fall through */ + EXPAT_FALLTHROUGH; case 6: b |= (uint64_t)H->buf[5] << 40; - /* fall through */ + EXPAT_FALLTHROUGH; case 5: b |= (uint64_t)H->buf[4] << 32; - /* fall through */ + EXPAT_FALLTHROUGH; case 4: b |= (uint64_t)H->buf[3] << 24; - /* fall through */ + EXPAT_FALLTHROUGH; case 3: b |= (uint64_t)H->buf[2] << 16; - /* fall through */ + EXPAT_FALLTHROUGH; case 2: b |= (uint64_t)H->buf[1] << 8; - /* fall through */ + EXPAT_FALLTHROUGH; case 1: b |= (uint64_t)H->buf[0] << 0; - /* fall through */ + EXPAT_FALLTHROUGH; case 0: break; } diff --git a/contrib/expat/lib/xcsinc.c b/contrib/expat/lib/xcsinc.c new file mode 100644 index 000000000000..3597c2480bc9 --- /dev/null +++ b/contrib/expat/lib/xcsinc.c @@ -0,0 +1,48 @@ +/* This file is included from other .c files! + __ __ _ + ___\ \/ /_ __ __ _| |_ + / _ \\ /| '_ \ / _` | __| + | __// \| |_) | (_| | |_ + \___/_/\_\ .__/ \__,_|\__| + |_| XML parser + + Copyright (c) 2022 Sebastian Pipping + Licensed under the MIT license: + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to permit + persons to whom the Software is furnished to do so, subject to the + following conditions: + + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN + NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, + DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR + OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE + USE OR OTHER DEALINGS IN THE SOFTWARE. +*/ + +static size_t +xcslen(const XML_Char *s) { +#ifdef XML_UNICODE +# ifdef XML_UNICODE_WCHAR_T + return wcslen(s); +# else + // XML_Char is unsigned short + size_t len = 0; + while (s[len]) { + len++; + } + return len; +# endif +#else + return strlen(s); +#endif +} diff --git a/contrib/expat/lib/xmlparse.c b/contrib/expat/lib/xmlparse.c index 890a9389f15d..60f6cc700548 100644 --- a/contrib/expat/lib/xmlparse.c +++ b/contrib/expat/lib/xmlparse.c @@ -1,4 +1,4 @@ -/* 75ef4224f81c052e9e5aeea2ac7de75357d2169ff9908e39edc08b9dc3052513 (2.8.1+) +/* 5de44e6750c6cc78818f06ed552f522a1241df0299395250e1792cb339389daf (2.8.2+) __ __ _ ___\ \/ /_ __ __ _| |_ / _ \\ /| '_ \ / _` | __| @@ -47,6 +47,9 @@ Copyright (c) 2026 Rosen Penev Copyright (c) 2026 Francesco Bertolaccini Copyright (c) 2026 Christian Ng + Copyright (c) 2026 Nick Begg + Copyright (c) 2026 Kartik Kenchi + Copyright (c) 2026 Haris Hussain Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -90,7 +93,7 @@ #include #include /* memset(), memcpy() */ #include -#include /* INT_MAX, UINT_MAX */ +#include /* INT_MAX, LLONG_MAX, LONG_MAX, UINT_MAX */ #include /* fprintf */ #include /* getenv */ #include /* SIZE_MAX, uintptr_t */ @@ -114,6 +117,7 @@ #include "ascii.h" #include "expat.h" #include "siphash.h" +#include "xcsinc.c" #if defined(HAVE_ARC4RANDOM) # include "random_arc4random.h" @@ -156,7 +160,7 @@ * Windows >=Vista (rand_s): _WIN32. \ \ If you insist on not using any of these, bypass this error by defining \ - XML_POOR_ENTROPY; you have been warned. \ + XML_POOR_ENTROPY and be vulnerable to hash flooding; you have been warned. \ \ If you have reasons to patch this detection code away or need changes \ to the build system, please open a bug. Thank you! @@ -207,6 +211,12 @@ typedef char ICHAR; #endif +#ifdef XML_LARGE_SIZE +# define XML_INDEX_MAX LLONG_MAX +#else +# define XML_INDEX_MAX LONG_MAX +#endif + /* Round up n to be a multiple of sz, where sz is a power of 2. */ #define ROUND_UP(n, sz) (((n) + ((sz) - 1)) & ~((sz) - 1)) @@ -270,8 +280,8 @@ typedef struct binding { struct binding *prevPrefixBinding; const struct attribute_id *attId; XML_Char *uri; - int uriLen; - int uriAlloc; + size_t uriLen; + size_t uriAlloc; } BINDING; typedef struct prefix { @@ -283,9 +293,9 @@ typedef struct { const XML_Char *str; const XML_Char *localPart; const XML_Char *prefix; - int strLen; - int uriLen; - int prefixLen; + size_t strLen; + size_t uriLen; + size_t prefixLen; } TAG_NAME; /* TAG represents an open element. @@ -384,8 +394,8 @@ typedef struct { const XML_Char *name; PREFIX *prefix; const ATTRIBUTE_ID *idAtt; - int nDefaultAtts; - int allocDefaultAtts; + size_t nDefaultAtts; + size_t allocDefaultAtts; DEFAULT_ATTRIBUTE *defaultAtts; HASH_TABLE defaultAttsNames; } ELEMENT_TYPE; @@ -417,6 +427,7 @@ typedef struct { unsigned scaffCount; int scaffLevel; int *scaffIndex; + size_t scaffIndexSize; } DTD; enum EntityType { @@ -588,6 +599,7 @@ static XML_Char *poolAppend(STRING_POOL *pool, const ENCODING *enc, static XML_Char *poolStoreString(STRING_POOL *pool, const ENCODING *enc, const char *ptr, const char *end); static XML_Bool FASTCALL poolGrow(STRING_POOL *pool); +static bool FASTCALL poolGrowUntil(STRING_POOL *pool, size_t needed); static const XML_Char *FASTCALL poolCopyString(STRING_POOL *pool, const XML_Char *s); static const XML_Char *FASTCALL poolCopyStringNoFinish(STRING_POOL *pool, @@ -642,16 +654,40 @@ static XML_Parser getRootParserOf(XML_Parser parser, static unsigned long getDebugLevel(const char *variableName, unsigned long defaultDebugLevel); +static bool poolAppendChar(STRING_POOL *pool, XML_Char c); + +static bool poolAppendChars(STRING_POOL *pool, const XML_Char *s, size_t len); + #define poolStart(pool) ((pool)->start) #define poolLength(pool) ((pool)->ptr - (pool)->start) #define poolChop(pool) ((void)--(pool->ptr)) #define poolLastChar(pool) (((pool)->ptr)[-1]) #define poolDiscard(pool) ((pool)->ptr = (pool)->start) #define poolFinish(pool) ((pool)->start = (pool)->ptr) -#define poolAppendChar(pool, c) \ - (((pool)->ptr == (pool)->end && ! poolGrow(pool)) \ - ? 0 \ - : ((*((pool)->ptr)++ = c), 1)) + +bool +poolAppendChar(STRING_POOL *pool, XML_Char c) { + if (pool->ptr == pool->end && ! poolGrow(pool)) + return false; + + *(pool->ptr)++ = c; + return true; +} + +bool +poolAppendChars(STRING_POOL *pool, const XML_Char *s, size_t len) { + // Detect and prevent integer overflow + if (len > SIZE_MAX / sizeof(XML_Char)) + return false; + + if (! poolGrowUntil(pool, len)) + return false; + + memcpy(pool->ptr, s, len * sizeof(XML_Char)); + pool->ptr += len; + + return true; +} #if ! defined(XML_TESTING) const @@ -730,11 +766,9 @@ struct XML_ParserStruct { const char *m_eventEndPtr; const char *m_positionPtr; OPEN_INTERNAL_ENTITY *m_openInternalEntities; - OPEN_INTERNAL_ENTITY *m_freeInternalEntities; OPEN_INTERNAL_ENTITY *m_openAttributeEntities; - OPEN_INTERNAL_ENTITY *m_freeAttributeEntities; OPEN_INTERNAL_ENTITY *m_openValueEntities; - OPEN_INTERNAL_ENTITY *m_freeValueEntities; + OPEN_INTERNAL_ENTITY *m_freeEntities; XML_Bool m_defaultExpandInternalEntities; int m_tagLevel; ENTITY *m_declEntity; @@ -754,7 +788,7 @@ struct XML_ParserStruct { TAG *m_freeTagList; BINDING *m_inheritedBindings; BINDING *m_freeBindingList; - int m_attsSize; + size_t m_attsSize; int m_nSpecifiedAtts; int m_idAttIndex; ATTRIBUTE *m_atts; @@ -768,7 +802,7 @@ struct XML_ParserStruct { STRING_POOL m_tempPool; STRING_POOL m_temp2Pool; char *m_groupConnector; - unsigned int m_groupSize; + size_t m_groupSize; XML_Char m_namespaceSeparator; XML_Parser m_parentParser; XML_ParsingStatus m_parsingStatus; @@ -785,6 +819,7 @@ struct XML_ParserStruct { ENTITY_STATS m_entity_stats; #endif XML_Bool m_reenter; + unsigned m_handlerCallDepth; }; #if XML_GE == 1 @@ -1128,6 +1163,23 @@ generate_hash_secret_salt(void) { #endif } +static void +beforeHandler(XML_Parser parser) { + assert(parser->m_handlerCallDepth < UINT_MAX); + parser->m_handlerCallDepth++; +} + +static void +afterHandler(XML_Parser parser) { + assert(parser->m_handlerCallDepth > 0); + parser->m_handlerCallDepth--; +} + +static bool +isCalledFromInsideHandler(XML_Parser parser) { + return parser->m_handlerCallDepth > 0; +} + static enum XML_Error callProcessor(XML_Parser parser, const char *start, const char *end, const char **endPtr) { @@ -1364,9 +1416,7 @@ parserCreate(const XML_Char *encodingName, parser->m_freeBindingList = NULL; parser->m_freeTagList = NULL; - parser->m_freeInternalEntities = NULL; - parser->m_freeAttributeEntities = NULL; - parser->m_freeValueEntities = NULL; + parser->m_freeEntities = NULL; parser->m_groupSize = 0; parser->m_groupConnector = NULL; @@ -1482,6 +1532,7 @@ parserInit(XML_Parser parser, const XML_Char *encodingName) { parser->m_parsingStatus.parsing = XML_INITIALIZED; // Reentry can only be triggered inside m_processor calls parser->m_reenter = XML_FALSE; + parser->m_handlerCallDepth = 0; #ifdef XML_DTD parser->m_isParamEntity = XML_FALSE; parser->m_useForeignDTD = XML_FALSE; @@ -1515,12 +1566,22 @@ moveToFreeBindingList(XML_Parser parser, BINDING *bindings) { } } +/* Moves a list of entities onto the start of another list. */ +static void +moveEntityList(OPEN_INTERNAL_ENTITY **dst, OPEN_INTERNAL_ENTITY **src) { + for (OPEN_INTERNAL_ENTITY *head = *src; head != NULL;) { + OPEN_INTERNAL_ENTITY *const openEntity = head; + head = head->next; + openEntity->next = *dst; + *dst = openEntity; + } +} + XML_Bool XMLCALL XML_ParserReset(XML_Parser parser, const XML_Char *encodingName) { TAG *tStk; - OPEN_INTERNAL_ENTITY *openEntityList; - if (parser == NULL) + if ((parser == NULL) || isCalledFromInsideHandler(parser)) return XML_FALSE; if (parser->m_parentParser) @@ -1535,32 +1596,14 @@ XML_ParserReset(XML_Parser parser, const XML_Char *encodingName) { tag->bindings = NULL; parser->m_freeTagList = tag; } - /* move m_openInternalEntities to m_freeInternalEntities */ - openEntityList = parser->m_openInternalEntities; - while (openEntityList) { - OPEN_INTERNAL_ENTITY *openEntity = openEntityList; - openEntityList = openEntity->next; - openEntity->next = parser->m_freeInternalEntities; - parser->m_freeInternalEntities = openEntity; - } - /* move m_openAttributeEntities to m_freeAttributeEntities (i.e. same task but - * for attributes) */ *** 3286 LINES SKIPPED *** From nobody Thu Jul 2 12:57:06 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4grcNM0cp2z5q2q9 for ; Thu, 02 Jul 2026 12:57:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4grcNL6xTMz3mch for ; Thu, 02 Jul 2026 12:57:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782997027; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1BfrvJw3N8hBRIZV8s5Ml4dyslNX9bf7mZDI+p2DnXE=; b=k+s9/Q4H566fSGCd66f3Bw2/k3YnjmtD59tVQoDmLVHKsaiS2abKiG3PJr7KPGZIVfewbf p+7AnQa5HMQpN0cuyvSvNRo4sXKm9ZQGEoYY2kaQN1KEoiG5ig7/TFoDjhlE4y6BHI5tX8 wHOrZAN1aEf8qHtgNQtgud1FDvKVGs4O8GRKMBf9TlMQvRVNGUDYDMVV7eXw2yDkJio2FB XFWgbeM5TUz/PqfYwLY8CnMSHrKgfWY4cBmzW1mFoIUavvoxB5O1Lpbj9ClpsXL9N2nquz eYqnwSI0a01QBafUpEpnemp6Dor1yF3GHq+zf6RxUtFdn+OhZNEKcotiGIFv2Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782997027; a=rsa-sha256; cv=none; b=uKqcwuuRUHmWLeHtoT0vRypkR7/7sTWLBEdvi7It7yot8jZoqtXr9uIFQhNIycboB9lXZH LbnyCm7acKmxEDFktbSxk5IaqWgV5trxu4EtOAHtjYznTr1MkSF+zyZRH90aRRtZnVgvyW OBdvzi8FGpfLeuweDoNNlPOZbe6tNlHjRUfoYNNVal3XuuNm07l47jURyGWVZpvHXF4bi4 b9ONbtDdF69O1s7znTC3pkPgCA1Daovwtq738H3eVpSIWKuUff5KwhoTyQ6TRrgH+7VLvs PhT68O8OscRUsOP4KTAY5TeJkLwMxVlhQ94TVK0RE+R867znu4Q+pd7+ZHn6kg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782997027; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1BfrvJw3N8hBRIZV8s5Ml4dyslNX9bf7mZDI+p2DnXE=; b=FxTmecK79VS3LLZD9NqLZkBcC2xRSPIUstewuO6uQ5TtiZvQRUrgWO9HNtMsEsPbejVcDE PR0UK97Rx48mG10EzaorjrQDy8cphJvP6TZGuPRTIyvs8MRDNEz1zL2IEl2b4oUKmzfU8T VOt0CMG1DYPgrc8DcfpNjWsoy0+qThSADL3IMrsmXBn/DISiti7RGVA1e8DDwmjo8J43SM gywK+lKBpak8SaK1KSJY5vcvuAcVwvqFirxKlwX2VjVMC6Zqf9TORIWTPEos39xexsINAX wYwRBLjB0Fdhip8mwxf+huidJ14thvWCJZa0TUgfAX9jspNIYJkcyEm7+NcwIg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4grcNL5f8Cz12Fg for ; Thu, 02 Jul 2026 12:57:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 361d3 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 02 Jul 2026 12:57:06 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Christos Margiolis Subject: git: 8163944f2739 - stable/15 - sound: Retire unused SD_F_EQ_PC List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: christos X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 8163944f2739733a0bb9265416a3687ec33691ff Auto-Submitted: auto-generated Date: Thu, 02 Jul 2026 12:57:06 +0000 Message-Id: <6a466022.361d3.370846c9@gitrepo.freebsd.org> The branch stable/15 has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=8163944f2739733a0bb9265416a3687ec33691ff commit 8163944f2739733a0bb9265416a3687ec33691ff Author: Christos Margiolis AuthorDate: 2026-06-24 13:47:05 +0000 Commit: Christos Margiolis CommitDate: 2026-07-02 12:56:53 +0000 sound: Retire unused SD_F_EQ_PC This flag is neither set anywhere, nor is there a way to set it from userland, so it is effectively useless, and currently the effect is that EQ can only be enabled for primary playback channels. Retire the flag and keep this behavior, and think later whether we want to allow virtual channels to get their own EQ feeder as well. Sponsored by: The FreeBSD Foundation MFC after: 1 week (cherry picked from commit ede0236d3b34a89bae7795f0f45696d4d94ce138) --- sys/dev/sound/pcm/feeder_chain.c | 6 ++---- sys/dev/sound/pcm/sound.h | 4 ++-- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/sys/dev/sound/pcm/feeder_chain.c b/sys/dev/sound/pcm/feeder_chain.c index 1dbdf2fcc0e4..dc0788ffb53c 100644 --- a/sys/dev/sound/pcm/feeder_chain.c +++ b/sys/dev/sound/pcm/feeder_chain.c @@ -725,10 +725,8 @@ feeder_chain(struct pcm_channel *c) /* Soft EQ only applicable for PLAY. */ if (cdesc.dummy == 0 && - c->direction == PCMDIR_PLAY && (d->flags & SD_F_EQ_ENABLED) && - (((d->flags & SD_F_EQ_PC) && - !(c->flags & CHN_F_HAS_VCHAN)) || - (!(d->flags & SD_F_EQ_PC) && !(c->flags & CHN_F_VIRTUAL)))) + c->direction == PCMDIR_PLAY && + (d->flags & SD_F_EQ_ENABLED) && !(c->flags & CHN_F_VIRTUAL)) cdesc.use_eq = 1; if (FEEDFORMAT_NE_REQUIRED(&cdesc)) { diff --git a/sys/dev/sound/pcm/sound.h b/sys/dev/sound/pcm/sound.h index becd787a456a..fea27921e7db 100644 --- a/sys/dev/sound/pcm/sound.h +++ b/sys/dev/sound/pcm/sound.h @@ -105,7 +105,7 @@ struct snd_mixer; /* unused 0x00000100 */ #define SD_F_EQ_ENABLED 0x00000200 /* EQ enabled */ /* unused 0x00000400 */ -#define SD_F_EQ_PC 0x00000800 /* EQ per-channel */ +/* unused 0x00000800 */ #define SD_F_PVCHANS 0x00001000 /* Playback vchans enabled */ #define SD_F_RVCHANS 0x00002000 /* Recording vchans enabled */ @@ -121,7 +121,7 @@ struct snd_mixer; /* "\011 */ \ "\012EQ_ENABLED" \ /* "\013 */ \ - "\014EQ_PC" \ + /* "\014 */ \ "\015PVCHANS" \ "\016RVCHANS" From nobody Thu Jul 2 12:57:07 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4grcNN2jznz5q352 for ; Thu, 02 Jul 2026 12:57:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4grcNN0Wkcz3mZ8 for ; Thu, 02 Jul 2026 12:57:08 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782997028; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=onGGTrJLl2I7VOxUQYDe86ZM+7KJP5UyzsNcmSIbmAA=; b=f3F51aMtU32MSCdZbcq1WEKYK9PCB4tF6TEsB/ozgHz82XpL64eBa0ivLn+qZzOI8DouQV 8XFUTQu3MCXFJgoZc3APAp2+N2rLhYI419evZaY0A7Pm8gsuKt9e59MJkRJXjb61P3whO7 0h+PJWRXUwnjmvLhrtZ+tvLSUiPqeP4zswKaMDFjK+23BbKmHpDQhoblsfti+bulGFSqMD Mg289vqao66Xs86StesxTqgyuB+E0RB78CFKCDAqjthTBi56Jzh4mUflP1I9uc3Gi+7u1O Q5U3VXodz9Kp0FIUBwmwXDQ9k30iCpQ4ENvvLS6YoEtvG5IDBRGau+2T4QG+Cw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782997028; a=rsa-sha256; cv=none; b=bynzyQg3dVOB2nGkcBdG04Khmt8c0GF2sHQBODHp27o5lHTbXu7fRTgj1jp0a71SJrZ+DO Dzk7QBtqYk3lpjPn5++ENarZdjbexsKXmJDCK+5QnH8u3/KWtqfDhHArS42jBD1pJJ9/zO dDxj2UFb1Gn0Kl/x+J7eywXRLcztkO95PRXS1QxNf+ncuIMZ1enQYNzt50rgE9MecXPyuM jeHISM7qETq9PmCCkP1V7Trrug/U9UDb0BhcuIHV4tqRT0bl+PHIjMYCfkCQpLcO4SJPWq ShrNGG4yKC3QK2KrqWc3tGekmRT4XUnDWXmPPOK5ACwA3bdF8vcCC6pmb+np3A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782997028; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=onGGTrJLl2I7VOxUQYDe86ZM+7KJP5UyzsNcmSIbmAA=; b=q17Jio7Kq7uwxmLGwHHiBpB3VXrL7tD1XEyEkYUOv6ygyBa18tXkdAo2M2ZgLxjg8olQBC zYbdO0gzNjyOLI/Vwbp0AA9RKAV+p0YsO7N7WPwZenOIb9Xx4tZT+fR/Z1apM59DgKncm8 PMj+My2cWjzYkf7urnTEp445tjGFefj7MtTsVsLrcZrBdRhtk7l5n8xxbxEDHmImZEehA8 Hw8uOhc3hf0enBQEQXAd0DuNx6F/GDFNj6yDuVNxyT9AyGnGZy0Md87Zn7vPEytpro9/Q3 RBdwugXbgl0qlr6uy7DPkf6XXiOQzFXrtIRFN1S+x5ubyTxPg5EdbF/sg7hOrw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4grcNM63HFz12SD for ; Thu, 02 Jul 2026 12:57:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 33a2b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 02 Jul 2026 12:57:07 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Christos Margiolis Subject: git: 5cac86f12e0c - stable/15 - sound: Rename SD_F_EQ_ENABLED to SD_F_EQ List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: christos X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 5cac86f12e0ca1377530012e1c253b588ca08705 Auto-Submitted: auto-generated Date: Thu, 02 Jul 2026 12:57:07 +0000 Message-Id: <6a466023.33a2b.1d9a0133@gitrepo.freebsd.org> The branch stable/15 has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=5cac86f12e0ca1377530012e1c253b588ca08705 commit 5cac86f12e0ca1377530012e1c253b588ca08705 Author: Christos Margiolis AuthorDate: 2026-06-24 13:54:41 +0000 Commit: Christos Margiolis CommitDate: 2026-07-02 12:56:58 +0000 sound: Rename SD_F_EQ_ENABLED to SD_F_EQ No functional change intended. Sponsored by: The FreeBSD Foundation MFC after: 1 week (cherry picked from commit a3d65cde7775818fb78afe935a4616a31f137c3d) --- sys/dev/sound/pcm/feeder_chain.c | 2 +- sys/dev/sound/pcm/feeder_eq.c | 6 +++--- sys/dev/sound/pcm/mixer.c | 2 +- sys/dev/sound/pcm/sound.h | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/sys/dev/sound/pcm/feeder_chain.c b/sys/dev/sound/pcm/feeder_chain.c index dc0788ffb53c..f8ec7ab9eb86 100644 --- a/sys/dev/sound/pcm/feeder_chain.c +++ b/sys/dev/sound/pcm/feeder_chain.c @@ -726,7 +726,7 @@ feeder_chain(struct pcm_channel *c) /* Soft EQ only applicable for PLAY. */ if (cdesc.dummy == 0 && c->direction == PCMDIR_PLAY && - (d->flags & SD_F_EQ_ENABLED) && !(c->flags & CHN_F_VIRTUAL)) + (d->flags & SD_F_EQ) && !(c->flags & CHN_F_VIRTUAL)) cdesc.use_eq = 1; if (FEEDFORMAT_NE_REQUIRED(&cdesc)) { diff --git a/sys/dev/sound/pcm/feeder_eq.c b/sys/dev/sound/pcm/feeder_eq.c index 0a28dfa1ba17..52e96fa91768 100644 --- a/sys/dev/sound/pcm/feeder_eq.c +++ b/sys/dev/sound/pcm/feeder_eq.c @@ -447,7 +447,7 @@ sysctl_dev_pcm_eq(SYSCTL_HANDLER_ARGS) PCM_LOCK(d); PCM_WAIT(d); - if (d->flags & SD_F_EQ_ENABLED) + if (d->flags & SD_F_EQ) val = 1; else val = 0; @@ -466,9 +466,9 @@ sysctl_dev_pcm_eq(SYSCTL_HANDLER_ARGS) PCM_LOCK(d); if (val == 1) - d->flags |= SD_F_EQ_ENABLED; + d->flags |= SD_F_EQ; else - d->flags &= ~SD_F_EQ_ENABLED; + d->flags &= ~SD_F_EQ; PCM_RELEASE(d); PCM_UNLOCK(d); diff --git a/sys/dev/sound/pcm/mixer.c b/sys/dev/sound/pcm/mixer.c index 3ddee24417cc..0c214b475822 100644 --- a/sys/dev/sound/pcm/mixer.c +++ b/sys/dev/sound/pcm/mixer.c @@ -278,7 +278,7 @@ mixer_set(struct snd_mixer *m, u_int dev, u_int32_t muted, u_int lev) if (dev == SOUND_MIXER_PCM && (d->flags & SD_F_SOFTPCMVOL)) (void)mixer_set_softpcmvol(m, d, l, r); else if ((dev == SOUND_MIXER_TREBLE || - dev == SOUND_MIXER_BASS) && (d->flags & SD_F_EQ_ENABLED)) + dev == SOUND_MIXER_BASS) && (d->flags & SD_F_EQ)) (void)mixer_set_eq(m, d, dev, (l + r) >> 1); else if (realdev != SOUND_MIXER_NONE && MIXER_SET(m, realdev, l, r) < 0) { diff --git a/sys/dev/sound/pcm/sound.h b/sys/dev/sound/pcm/sound.h index fea27921e7db..2985909f986a 100644 --- a/sys/dev/sound/pcm/sound.h +++ b/sys/dev/sound/pcm/sound.h @@ -103,7 +103,7 @@ struct snd_mixer; #define SD_F_BITPERFECT 0x00000040 /* unused 0x00000080 */ /* unused 0x00000100 */ -#define SD_F_EQ_ENABLED 0x00000200 /* EQ enabled */ +#define SD_F_EQ 0x00000200 /* EQ enabled */ /* unused 0x00000400 */ /* unused 0x00000800 */ #define SD_F_PVCHANS 0x00001000 /* Playback vchans enabled */ @@ -119,7 +119,7 @@ struct snd_mixer; "\007BITPERFECT" \ /* "\010 */ \ /* "\011 */ \ - "\012EQ_ENABLED" \ + "\012EQ" \ /* "\013 */ \ /* "\014 */ \ "\015PVCHANS" \ From nobody Thu Jul 2 15:09:57 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4grgKl0MxGz6dWPf for ; Thu, 02 Jul 2026 15:10:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4grgKk3zQwz42Sr for ; Thu, 02 Jul 2026 15:10:02 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783005002; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZaKzwaMxByDJM4uI6l+ouNZaz2oyR7XKwqSCQbYfTqo=; b=VgW6GWWXqV5tOQUTq8iEvZ0pBNuMJXWEodBpX4VFkof4w/mW5Sifcj8I7ahcBSGmJ2zbn4 qd6H/U+S7xsOtsXFW0JfPNpBKqv9R+x/azTS3WpQ+gwUWzLpZ+tDc/tb7IWy7S47w6EQJ2 jQ3VNmqdYCtgtIr5NLeJ7JNhcd0DkyQ5pPGFR381xF1Q86icrxZkGGy9nNft9pbniP3Usj I0F16svbdVDHa9ukccrT4zeyKPAyklZLFRnO002YeUQn+6AWmvSu1uJTEo2UZPepWOuGTD bQItaAwpmRzTw93ySa5jLkY1yGQeV1GR9IXuhfzYuaF+ULQTDuBpTaYWamvL2w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783005002; a=rsa-sha256; cv=none; b=vZvLS0ma52AUySZvtdyrjpQ0NKn+Ks6U6jnqKYYWJhbwqhcIH6kzD0eXtlApctjJhkvKZN b88GiByAX7BJtP+51Q9ktawUEXsif5VpDnX/TPKrtXXhlvVjFPHVq4qqgliGg5IKJ/gL6O LpFqu78M14FZQf3dT4yTy5TDzAHVkNdJ8q7SGBx/GrzOyXTPe41d7sId+MAd8stRsQvubq c9O2kyVpm1oRLtvEec08sad1lMGFAgXfsF4fcgRIWv8pXRSA4RfERCySW7S8HqaZklsVcr G4s/0OuoP1/RTUaPJ+sjee8RT+miP8QXSyKIQ7xRsFe9ZG8I0hAfmligALmQWg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783005002; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZaKzwaMxByDJM4uI6l+ouNZaz2oyR7XKwqSCQbYfTqo=; b=ERJtZ7Uu6XEScMcn7Z8yfDMPXQ9NOUNLnYCd1XYvk7mf6gMIjGvQyAxbC1H/ZlpXgsO0oQ SDseXKCul/oUJCIvfiUjs8r2Yarx69BtoJLRdRNRXGCfeHEPtH7+hakxfqvyvoVHzjQ2h9 MnBYLVH7uOwiYeo1Pn3EWnJE4tGPfvnJVAAmWBfcR58uUzMLLT9cBKkapTBKXSHti1TiBX vl+yMnaw6HE0QbtNpslyG8BGTZxEN4D+I337mKcMfnOZSgjIbcRM4ZG+RRw1jBvfghvHkk gM296n4lEl6BfdiwjbEwmOfPaie9ZOyIjAcAjpRap11DjXzkcY2LZt7n5sAQIw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4grgKk2gqtz15Vf for ; Thu, 02 Jul 2026 15:10:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 41eeb by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 02 Jul 2026 15:09:57 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Bartosz Sobczak From: Krzysztof Galazka Subject: git: 90130f3b3dde - stable/15 - irdma(4): update irdma to version 1.3.56-k List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kgalazka X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 90130f3b3dde41f7696d8e2923826209a00bdbb5 Auto-Submitted: auto-generated Date: Thu, 02 Jul 2026 15:09:57 +0000 Message-Id: <6a467f45.41eeb.59a2d7a@gitrepo.freebsd.org> The branch stable/15 has been updated by kgalazka: URL: https://cgit.FreeBSD.org/src/commit/?id=90130f3b3dde41f7696d8e2923826209a00bdbb5 commit 90130f3b3dde41f7696d8e2923826209a00bdbb5 Author: Bartosz Sobczak AuthorDate: 2026-03-13 11:56:25 +0000 Commit: Krzysztof Galazka CommitDate: 2026-07-02 15:04:30 +0000 irdma(4): update irdma to version 1.3.56-k Update Intel irdma driver to version 1.3.56-k Notable changes: - adding E830 support - adding E835 support Signed-off-by: Sobczak, Bartosz Reviewed by: Andrew Zhu Tested by: Mateusz Moga Sponsored by: Intel Corporation Differential Revision: https://reviews.freebsd.org/D55479 (cherry picked from commit 5b7aa6c7bc9db19e8bd34a5b7892fb5df2a3068b) --- contrib/ofed/libirdma/ice_devids.h | 26 +- contrib/ofed/libirdma/irdma.h | 3 +- contrib/ofed/libirdma/irdma_defs.h | 100 +++---- contrib/ofed/libirdma/irdma_uk.c | 252 ++++++++++-------- contrib/ofed/libirdma/irdma_umain.c | 18 +- contrib/ofed/libirdma/irdma_user.h | 20 +- contrib/ofed/libirdma/irdma_uverbs.c | 110 ++++---- sys/dev/irdma/fbsd_kcompat.c | 160 +++++++++++- sys/dev/irdma/fbsd_kcompat.h | 19 +- sys/dev/irdma/ice_devids.h | 26 +- sys/dev/irdma/icrdma.c | 32 ++- sys/dev/irdma/icrdma_hw.c | 59 +++-- sys/dev/irdma/icrdma_hw.h | 17 +- sys/dev/irdma/irdma.h | 4 +- sys/dev/irdma/irdma_cm.c | 493 +++++++++++++++++++++++++---------- sys/dev/irdma/irdma_cm.h | 3 +- sys/dev/irdma/irdma_ctrl.c | 273 +++++++++---------- sys/dev/irdma/irdma_defs.h | 136 +++++----- sys/dev/irdma/irdma_hmc.c | 12 +- sys/dev/irdma/irdma_hw.c | 151 ++++++----- sys/dev/irdma/irdma_kcompat.c | 301 ++++++++++++++++----- sys/dev/irdma/irdma_main.h | 41 ++- sys/dev/irdma/irdma_pble.c | 10 +- sys/dev/irdma/irdma_protos.h | 7 +- sys/dev/irdma/irdma_puda.c | 25 +- sys/dev/irdma/irdma_puda.h | 14 +- sys/dev/irdma/irdma_type.h | 51 ++-- sys/dev/irdma/irdma_uda.h | 2 + sys/dev/irdma/irdma_uda_d.h | 4 +- sys/dev/irdma/irdma_uk.c | 250 ++++++++++-------- sys/dev/irdma/irdma_user.h | 26 +- sys/dev/irdma/irdma_utils.c | 376 +++++++++++++++++--------- sys/dev/irdma/irdma_verbs.c | 245 +++++++++-------- sys/dev/irdma/irdma_verbs.h | 25 +- sys/dev/irdma/irdma_ws.c | 157 ++++++----- sys/dev/irdma/osdep.h | 9 +- sys/modules/irdma/Makefile | 2 +- 37 files changed, 2225 insertions(+), 1234 deletions(-) diff --git a/contrib/ofed/libirdma/ice_devids.h b/contrib/ofed/libirdma/ice_devids.h index 57a7f2f7c2af..0cf7aa6aee22 100644 --- a/contrib/ofed/libirdma/ice_devids.h +++ b/contrib/ofed/libirdma/ice_devids.h @@ -1,7 +1,7 @@ /*- * SPDX-License-Identifier: GPL-2.0 or Linux-OpenIB * - * Copyright (c) 2019 - 2020 Intel Corporation + * Copyright (c) 2019 - 2026 Intel Corporation * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -88,4 +88,28 @@ #define ICE_DEV_ID_E822L_10G_BASE_T 0x1899 /* Intel(R) Ethernet Connection E822-L 1GbE */ #define ICE_DEV_ID_E822L_SGMII 0x189A +/* Intel(R) Ethernet Controller E830-CC for backplane */ +#define ICE_DEV_ID_E830_BACKPLANE 0x12D1 +/* Intel(R) Ethernet Controller E830-CC for QSFP */ +#define ICE_DEV_ID_E830_QSFP56 0x12D2 +/* Intel(R) Ethernet Controller E830-CC for SFP */ +#define ICE_DEV_ID_E830_SFP 0x12D3 +/* Intel(R) Ethernet Controller E830-CC for SFP-DD */ +#define ICE_DEV_ID_E830_SFP_DD 0x12D4 +/* Intel(R) Ethernet Controller E830-C for backplane */ +#define ICE_DEV_ID_E830C_BACKPLANE 0x12D5 +/* Intel(R) Ethernet Controller E830-XXV for backplane */ +#define ICE_DEV_ID_E830_XXV_BACKPLANE 0x12DC +/* Intel(R) Ethernet Controller E830-C for QSFP */ +#define ICE_DEV_ID_E830C_QSFP 0x12D8 +/* Intel(R) Ethernet Controller E830-XXV for QSFP */ +#define ICE_DEV_ID_E830_XXV_QSFP 0x12DD +/* Intel(R) Ethernet Controller E830-C for SFP */ +#define ICE_DEV_ID_E830C_SFP 0x12DA +/* Intel(R) Ethernet Controller E830-XXV for SFP */ +#define ICE_DEV_ID_E830_XXV_SFP 0x12DE +/* Intel(R) Ethernet Controller E835-XXV for SFP */ +#define ICE_DEV_ID_E835_XXV_SFP 0x124A +/* Intel(R) Ethernet Controller E835-CC for QSFP */ +#define ICE_DEV_ID_E835_QSFP 0x1249 #endif /* ICE_DEVIDS_H */ diff --git a/contrib/ofed/libirdma/irdma.h b/contrib/ofed/libirdma/irdma.h index f4a5a4796f82..6b85ff1a7105 100644 --- a/contrib/ofed/libirdma/irdma.h +++ b/contrib/ofed/libirdma/irdma.h @@ -1,7 +1,7 @@ /*- * SPDX-License-Identifier: GPL-2.0 or Linux-OpenIB * - * Copyright (c) 2017 - 2022 Intel Corporation + * Copyright (c) 2017 - 2026 Intel Corporation * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -57,6 +57,7 @@ struct irdma_uk_attrs { u32 max_hw_wq_quanta; u32 min_hw_cq_size; u32 max_hw_cq_size; + u16 max_hw_push_len; u16 max_hw_sq_chunk; u16 min_hw_wq_size; u8 hw_rev; diff --git a/contrib/ofed/libirdma/irdma_defs.h b/contrib/ofed/libirdma/irdma_defs.h index 39d4e7772c31..7deaf762c204 100644 --- a/contrib/ofed/libirdma/irdma_defs.h +++ b/contrib/ofed/libirdma/irdma_defs.h @@ -1,7 +1,7 @@ /*- * SPDX-License-Identifier: GPL-2.0 or Linux-OpenIB * - * Copyright (c) 2015 - 2023 Intel Corporation + * Copyright (c) 2015 - 2026 Intel Corporation * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -63,6 +63,27 @@ #define IRDMA_BYTE_200 200 #define IRDMA_BYTE_208 208 #define IRDMA_BYTE_216 216 +#define IRDMA_BYTE_224 224 +#define IRDMA_BYTE_232 232 +#define IRDMA_BYTE_240 240 +#define IRDMA_BYTE_248 248 +#define IRDMA_BYTE_256 256 +#define IRDMA_BYTE_264 264 +#define IRDMA_BYTE_272 272 +#define IRDMA_BYTE_280 280 +#define IRDMA_BYTE_288 288 +#define IRDMA_BYTE_296 296 +#define IRDMA_BYTE_304 304 +#define IRDMA_BYTE_312 312 +#define IRDMA_BYTE_320 320 +#define IRDMA_BYTE_328 328 +#define IRDMA_BYTE_336 336 +#define IRDMA_BYTE_344 344 +#define IRDMA_BYTE_352 352 +#define IRDMA_BYTE_360 360 +#define IRDMA_BYTE_368 368 +#define IRDMA_BYTE_376 376 +#define IRDMA_BYTE_384 384 #define IRDMA_QP_TYPE_IWARP 1 #define IRDMA_QP_TYPE_UDA 2 @@ -81,6 +102,8 @@ #define IRDMA_MAX_RQ_WQE_SHIFT_GEN1 2 #define IRDMA_MAX_RQ_WQE_SHIFT_GEN2 3 +#define IRDMA_DEFAULT_MAX_PUSH_LEN 8192 + #define IRDMA_SQ_RSVD 258 #define IRDMA_RQ_RSVD 1 @@ -241,7 +264,7 @@ #define IRDMAQPSQ_DESTQPN_S 32 #define IRDMAQPSQ_DESTQPN GENMASK_ULL(55, 32) #define IRDMAQPSQ_AHID_S 0 -#define IRDMAQPSQ_AHID GENMASK_ULL(16, 0) +#define IRDMAQPSQ_AHID GENMASK_ULL(24, 0) #define IRDMAQPSQ_INLINEDATAFLAG_S 57 #define IRDMAQPSQ_INLINEDATAFLAG BIT_ULL(57) @@ -338,9 +361,9 @@ #define IRDMA_RING_MOVE_HEAD(_ring, _retcode) \ { \ u32 size; \ - size = (_ring).size; \ + size = IRDMA_RING_SIZE(_ring); \ if (!IRDMA_RING_FULL_ERR(_ring)) { \ - (_ring).head = ((_ring).head + 1) % size; \ + IRDMA_RING_CURRENT_HEAD(_ring) = (IRDMA_RING_CURRENT_HEAD(_ring) + 1) % size; \ (_retcode) = 0; \ } else { \ (_retcode) = ENOSPC; \ @@ -349,79 +372,40 @@ #define IRDMA_RING_MOVE_HEAD_BY_COUNT(_ring, _count, _retcode) \ { \ u32 size; \ - size = (_ring).size; \ + size = IRDMA_RING_SIZE(_ring); \ if ((IRDMA_RING_USED_QUANTA(_ring) + (_count)) < size) { \ - (_ring).head = ((_ring).head + (_count)) % size; \ - (_retcode) = 0; \ - } else { \ - (_retcode) = ENOSPC; \ - } \ - } -#define IRDMA_SQ_RING_MOVE_HEAD(_ring, _retcode) \ - { \ - u32 size; \ - size = (_ring).size; \ - if (!IRDMA_SQ_RING_FULL_ERR(_ring)) { \ - (_ring).head = ((_ring).head + 1) % size; \ - (_retcode) = 0; \ - } else { \ - (_retcode) = ENOSPC; \ - } \ - } -#define IRDMA_SQ_RING_MOVE_HEAD_BY_COUNT(_ring, _count, _retcode) \ - { \ - u32 size; \ - size = (_ring).size; \ - if ((IRDMA_RING_USED_QUANTA(_ring) + (_count)) < (size - 256)) { \ - (_ring).head = ((_ring).head + (_count)) % size; \ + IRDMA_RING_CURRENT_HEAD(_ring) = (IRDMA_RING_CURRENT_HEAD(_ring) + (_count)) % size; \ (_retcode) = 0; \ } else { \ (_retcode) = ENOSPC; \ } \ } -#define IRDMA_RING_MOVE_HEAD_BY_COUNT_NOCHECK(_ring, _count) \ - (_ring).head = ((_ring).head + (_count)) % (_ring).size -#define IRDMA_RING_MOVE_TAIL(_ring) \ - (_ring).tail = ((_ring).tail + 1) % (_ring).size +#define IRDMA_RING_MOVE_HEAD_BY_COUNT_NOCHECK(_ring, _count) \ + (IRDMA_RING_CURRENT_HEAD(_ring) = (IRDMA_RING_CURRENT_HEAD(_ring) + (_count)) % IRDMA_RING_SIZE(_ring)) #define IRDMA_RING_MOVE_HEAD_NOCHECK(_ring) \ - (_ring).head = ((_ring).head + 1) % (_ring).size + IRDMA_RING_MOVE_HEAD_BY_COUNT_NOCHECK(_ring, 1) #define IRDMA_RING_MOVE_TAIL_BY_COUNT(_ring, _count) \ - (_ring).tail = ((_ring).tail + (_count)) % (_ring).size + IRDMA_RING_CURRENT_TAIL(_ring) = (IRDMA_RING_CURRENT_TAIL(_ring) + (_count)) % IRDMA_RING_SIZE(_ring) + +#define IRDMA_RING_MOVE_TAIL(_ring) \ + IRDMA_RING_MOVE_TAIL_BY_COUNT(_ring, 1) #define IRDMA_RING_SET_TAIL(_ring, _pos) \ - (_ring).tail = (_pos) % (_ring).size + IRDMA_RING_CURRENT_TAIL(_ring) = (_pos) % IRDMA_RING_SIZE(_ring) #define IRDMA_RING_FULL_ERR(_ring) \ ( \ - (IRDMA_RING_USED_QUANTA(_ring) == ((_ring).size - 1)) \ - ) - -#define IRDMA_ERR_RING_FULL2(_ring) \ - ( \ - (IRDMA_RING_USED_QUANTA(_ring) == ((_ring).size - 2)) \ - ) - -#define IRDMA_ERR_RING_FULL3(_ring) \ - ( \ - (IRDMA_RING_USED_QUANTA(_ring) == ((_ring).size - 3)) \ + (IRDMA_RING_USED_QUANTA(_ring) == (IRDMA_RING_SIZE(_ring) - 1)) \ ) #define IRDMA_SQ_RING_FULL_ERR(_ring) \ ( \ - (IRDMA_RING_USED_QUANTA(_ring) == ((_ring).size - 257)) \ + (IRDMA_RING_USED_QUANTA(_ring) == (IRDMA_RING_SIZE(_ring) - 257)) \ ) -#define IRDMA_ERR_SQ_RING_FULL2(_ring) \ - ( \ - (IRDMA_RING_USED_QUANTA(_ring) == ((_ring).size - 258)) \ - ) -#define IRDMA_ERR_SQ_RING_FULL3(_ring) \ - ( \ - (IRDMA_RING_USED_QUANTA(_ring) == ((_ring).size - 259)) \ - ) #define IRDMA_RING_MORE_WORK(_ring) \ ( \ (IRDMA_RING_USED_QUANTA(_ring) != 0) \ @@ -429,17 +413,17 @@ #define IRDMA_RING_USED_QUANTA(_ring) \ ( \ - (((_ring).head + (_ring).size - (_ring).tail) % (_ring).size) \ + ((IRDMA_RING_CURRENT_HEAD(_ring) + IRDMA_RING_SIZE(_ring) - IRDMA_RING_CURRENT_TAIL(_ring)) % IRDMA_RING_SIZE(_ring)) \ ) #define IRDMA_RING_FREE_QUANTA(_ring) \ ( \ - ((_ring).size - IRDMA_RING_USED_QUANTA(_ring) - 1) \ + (IRDMA_RING_SIZE(_ring) - IRDMA_RING_USED_QUANTA(_ring) - 1) \ ) #define IRDMA_SQ_RING_FREE_QUANTA(_ring) \ ( \ - ((_ring).size - IRDMA_RING_USED_QUANTA(_ring) - 257) \ + (IRDMA_RING_SIZE(_ring) - IRDMA_RING_USED_QUANTA(_ring) - 257) \ ) #define IRDMA_ATOMIC_RING_MOVE_HEAD(_ring, index, _retcode) \ diff --git a/contrib/ofed/libirdma/irdma_uk.c b/contrib/ofed/libirdma/irdma_uk.c index 115c5f0a27f0..c42d0f3e9673 100644 --- a/contrib/ofed/libirdma/irdma_uk.c +++ b/contrib/ofed/libirdma/irdma_uk.c @@ -1,7 +1,7 @@ /*- * SPDX-License-Identifier: GPL-2.0 or Linux-OpenIB * - * Copyright (c) 2015 - 2023 Intel Corporation + * Copyright (c) 2015 - 2026 Intel Corporation * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -133,16 +133,18 @@ irdma_nop_1(struct irdma_qp_uk *qp) void irdma_clr_wqes(struct irdma_qp_uk *qp, u32 qp_wqe_idx) { - __le64 *wqe; + struct irdma_qp_quanta *sq; u32 wqe_idx; if (!(qp_wqe_idx & 0x7F)) { wqe_idx = (qp_wqe_idx + 128) % qp->sq_ring.size; - wqe = qp->sq_base[wqe_idx].elem; + sq = qp->sq_base + wqe_idx; if (wqe_idx) - memset(wqe, qp->swqe_polarity ? 0 : 0xFF, 0x1000); + memset(sq, qp->swqe_polarity ? 0 : 0xFF, + 128 * sizeof(*sq)); else - memset(wqe, qp->swqe_polarity ? 0xFF : 0, 0x1000); + memset(sq, qp->swqe_polarity ? 0xFF : 0, + 128 * sizeof(*sq)); } } @@ -200,22 +202,65 @@ irdma_qp_ring_push_db(struct irdma_qp_uk *qp, u32 wqe_idx) qp->push_dropped = false; } +/** + * irdma_qp_push_wqe - setup push wqe and ring db + * @qp: hw qp ptr + * @wqe: wqe ptr + * @quanta: numbers of quanta in wqe + * @wqe_idx: wqe index + * @push_wqe: if to use push for the wqe + */ void irdma_qp_push_wqe(struct irdma_qp_uk *qp, __le64 * wqe, u16 quanta, - u32 wqe_idx, bool post_sq) + u32 wqe_idx, bool push_wqe) { __le64 *push; - if (IRDMA_RING_CURRENT_HEAD(qp->initial_ring) != - IRDMA_RING_CURRENT_TAIL(qp->sq_ring) && - !qp->push_mode) { - irdma_uk_qp_post_wr(qp); - } else { + if (push_wqe) { push = (__le64 *) ((uintptr_t)qp->push_wqe + (wqe_idx & 0x7) * 0x20); irdma_memcpy(push, wqe, quanta * IRDMA_QP_WQE_MIN_SIZE); irdma_qp_ring_push_db(qp, wqe_idx); + qp->last_push_db = true; + } else if (qp->last_push_db) { + qp->last_push_db = false; + db_wr32(qp->qp_id, qp->wqe_alloc_db); + } else { + irdma_uk_qp_post_wr(qp); + } +} + +/** + * irdma_push_ring_free - check if sq ring free to pust push wqe + * @qp: hw qp ptr + */ +static inline bool +irdma_push_ring_free(struct irdma_qp_uk *qp) +{ + u32 head, tail; + + head = IRDMA_RING_CURRENT_HEAD(qp->initial_ring); + tail = IRDMA_RING_CURRENT_TAIL(qp->sq_ring); + + if (head == tail || head == (tail + 1)) + return true; + + return false; +} + +/** + * irdma_enable_push_wqe - depending on sq ring and total size + * @qp: hw qp ptr + * @total_size: total data size + */ +static inline bool +irdma_enable_push_wqe(struct irdma_qp_uk *qp, u32 total_size) +{ + if (irdma_push_ring_free(qp) && + total_size <= qp->uk_attrs->max_hw_push_len) { + return true; } + return false; } /** @@ -234,7 +279,8 @@ irdma_qp_get_next_send_wqe(struct irdma_qp_uk *qp, u32 *wqe_idx, __le64 *wqe; __le64 *wqe_0 = NULL; u32 nop_wqe_idx; - u16 avail_quanta, wqe_quanta = *quanta; + u16 wqe_quanta = *quanta; + u16 avail_quanta; u16 i; avail_quanta = qp->uk_attrs->max_hw_sq_chunk - @@ -330,7 +376,7 @@ irdma_uk_rdma_write(struct irdma_qp_uk *qp, struct irdma_post_sq_info *info, bool read_fence = false; u16 quanta; - info->push_wqe = qp->push_db ? true : false; + info->push_wqe = false; op_info = &info->op.rdma_write; if (op_info->num_lo_sges > qp->max_sq_frag_cnt) @@ -350,11 +396,13 @@ irdma_uk_rdma_write(struct irdma_qp_uk *qp, struct irdma_post_sq_info *info, if (ret_code) return ret_code; + if (qp->push_db) + info->push_wqe = irdma_enable_push_wqe(qp, total_size); + wqe = irdma_qp_get_next_send_wqe(qp, &wqe_idx, &quanta, total_size, info); if (!wqe) return ENOSPC; - qp->sq_wrtrk_array[wqe_idx].signaled = info->signaled; set_64bit_val(wqe, IRDMA_BYTE_16, FIELD_PREP(IRDMAQPSQ_FRAG_TO, op_info->rem_addr.addr)); @@ -399,8 +447,8 @@ irdma_uk_rdma_write(struct irdma_qp_uk *qp, struct irdma_post_sq_info *info, udma_to_device_barrier(); /* make sure WQE is populated before valid bit is set */ set_64bit_val(wqe, IRDMA_BYTE_24, hdr); - if (info->push_wqe) - irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, post_sq); + if (qp->push_db) + irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, info->push_wqe); else if (post_sq) irdma_uk_qp_post_wr(qp); @@ -429,7 +477,7 @@ irdma_uk_rdma_read(struct irdma_qp_uk *qp, struct irdma_post_sq_info *info, u16 quanta; u64 hdr; - info->push_wqe = qp->push_db ? true : false; + info->push_wqe &= qp->push_db ? true : false; op_info = &info->op.rdma_read; if (qp->max_sq_frag_cnt < op_info->num_lo_sges) @@ -451,7 +499,6 @@ irdma_uk_rdma_read(struct irdma_qp_uk *qp, struct irdma_post_sq_info *info, qp->ord_cnt = 0; } - qp->sq_wrtrk_array[wqe_idx].signaled = info->signaled; addl_frag_cnt = op_info->num_lo_sges > 1 ? (op_info->num_lo_sges - 1) : 0; local_fence |= info->local_fence; @@ -490,8 +537,8 @@ irdma_uk_rdma_read(struct irdma_qp_uk *qp, struct irdma_post_sq_info *info, udma_to_device_barrier(); /* make sure WQE is populated before valid bit is set */ set_64bit_val(wqe, IRDMA_BYTE_24, hdr); - if (info->push_wqe) - irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, post_sq); + if (qp->push_db) + irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, info->push_wqe); else if (post_sq) irdma_uk_qp_post_wr(qp); @@ -517,7 +564,7 @@ irdma_uk_send(struct irdma_qp_uk *qp, struct irdma_post_sq_info *info, bool read_fence = false; u16 quanta; - info->push_wqe = qp->push_db ? true : false; + info->push_wqe = false; op_info = &info->op.send; if (qp->max_sq_frag_cnt < op_info->num_sges) @@ -534,6 +581,9 @@ irdma_uk_send(struct irdma_qp_uk *qp, struct irdma_post_sq_info *info, if (ret_code) return ret_code; + if (qp->push_db) + info->push_wqe = irdma_enable_push_wqe(qp, total_size); + wqe = irdma_qp_get_next_send_wqe(qp, &wqe_idx, &quanta, total_size, info); if (!wqe) return ENOSPC; @@ -587,8 +637,8 @@ irdma_uk_send(struct irdma_qp_uk *qp, struct irdma_post_sq_info *info, udma_to_device_barrier(); /* make sure WQE is populated before valid bit is set */ set_64bit_val(wqe, IRDMA_BYTE_24, hdr); - if (info->push_wqe) - irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, post_sq); + if (qp->push_db) + irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, info->push_wqe); else if (post_sq) irdma_uk_qp_post_wr(qp); @@ -780,11 +830,11 @@ irdma_uk_inline_rdma_write(struct irdma_qp_uk *qp, return EINVAL; quanta = qp->wqe_ops.iw_inline_data_size_to_quanta(total_size); + wqe = irdma_qp_get_next_send_wqe(qp, &wqe_idx, &quanta, total_size, info); if (!wqe) return ENOSPC; - qp->sq_wrtrk_array[wqe_idx].signaled = info->signaled; read_fence |= info->read_fence; set_64bit_val(wqe, IRDMA_BYTE_16, FIELD_PREP(IRDMAQPSQ_FRAG_TO, op_info->rem_addr.addr)); @@ -812,8 +862,8 @@ irdma_uk_inline_rdma_write(struct irdma_qp_uk *qp, set_64bit_val(wqe, IRDMA_BYTE_24, hdr); - if (info->push_wqe) - irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, post_sq); + if (qp->push_db) + irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, info->push_wqe); else if (post_sq) irdma_uk_qp_post_wr(qp); @@ -886,8 +936,8 @@ irdma_uk_inline_send(struct irdma_qp_uk *qp, set_64bit_val(wqe, IRDMA_BYTE_24, hdr); - if (info->push_wqe) - irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, post_sq); + if (qp->push_db) + irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, info->push_wqe); else if (post_sq) irdma_uk_qp_post_wr(qp); @@ -937,8 +987,8 @@ irdma_uk_stag_local_invalidate(struct irdma_qp_uk *qp, set_64bit_val(wqe, IRDMA_BYTE_24, hdr); - if (info->push_wqe) - irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, post_sq); + if (qp->push_db) + irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, info->push_wqe); else if (post_sq) irdma_uk_qp_post_wr(qp); @@ -989,8 +1039,8 @@ irdma_uk_mw_bind(struct irdma_qp_uk *qp, struct irdma_post_sq_info *info, set_64bit_val(wqe, IRDMA_BYTE_24, hdr); - if (info->push_wqe) - irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, post_sq); + if (qp->push_db) + irdma_qp_push_wqe(qp, wqe, quanta, wqe_idx, info->push_wqe); else if (post_sq) irdma_uk_qp_post_wr(qp); @@ -1226,26 +1276,25 @@ irdma_check_rq_cqe(struct irdma_qp_uk *qp, u32 *array_idx) } /** - * irdma_skip_duplicate_flush_cmpl - check last cmpl and update wqe if needed - * - * @ring: sq/rq ring - * @flush_seen: information if flush for specific ring was already seen - * @comp_status: completion status - * @wqe_idx: new value of WQE index returned if there is more work on ring + * irdma_uk_cq_empty - Check if CQ is empty + * @cq: hw cq */ -static inline int -irdma_skip_duplicate_flush_cmpl(struct irdma_ring ring, u8 flush_seen, - enum irdma_cmpl_status comp_status, - u32 *wqe_idx) +bool +irdma_uk_cq_empty(struct irdma_cq_uk *cq) { - if (flush_seen) { - if (IRDMA_RING_MORE_WORK(ring)) - *wqe_idx = ring.tail; - else - return ENOENT; - } + __le64 *cqe; + u8 polarity; + u64 qword3; - return 0; + if (cq->avoid_mem_cflct) + cqe = IRDMA_GET_CURRENT_EXTENDED_CQ_ELEM(cq); + else + cqe = IRDMA_GET_CURRENT_CQ_ELEM(cq); + + get_64bit_val(cqe, 24, &qword3); + polarity = (u8)FIELD_GET(IRDMA_CQ_VALID, qword3); + + return polarity != cq->polarity; } /** @@ -1338,6 +1387,10 @@ irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq, info->ipv4 = (bool)FIELD_GET(IRDMACQ_IPV4, qword3); get_64bit_val(cqe, IRDMA_BYTE_8, &comp_ctx); qp = (struct irdma_qp_uk *)(irdma_uintptr) comp_ctx; + if (!qp || qp->destroy_pending) { + ret_code = EFAULT; + goto exit; + } if (info->error) { info->major_err = FIELD_GET(IRDMA_CQ_MAJERR, qword3); info->minor_err = FIELD_GET(IRDMA_CQ_MINERR, qword3); @@ -1367,10 +1420,6 @@ irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq, info->ud_src_qpn = (u32)FIELD_GET(IRDMACQ_UDSRCQPN, qword2); info->solicited_event = (bool)FIELD_GET(IRDMACQ_SOEVENT, qword3); - if (!qp || qp->destroy_pending) { - ret_code = EFAULT; - goto exit; - } wqe_idx = (u32)FIELD_GET(IRDMA_CQ_WQEIDX, qword3); info->qp_handle = (irdma_qp_handle) (irdma_uintptr) qp; info->op_type = (u8)FIELD_GET(IRDMACQ_OP, qword3); @@ -1378,51 +1427,44 @@ irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq, if (info->q_type == IRDMA_CQE_QTYPE_RQ) { u32 array_idx; - ret_code = irdma_skip_duplicate_flush_cmpl(qp->rq_ring, - qp->rq_flush_seen, - info->comp_status, - &wqe_idx); - if (ret_code != 0) - goto exit; - array_idx = wqe_idx / qp->rq_wqe_size_multiplier; + info->bytes_xfered = (u32)FIELD_GET(IRDMACQ_PAYLDLEN, qword0); + info->signaled = 1; + + if (qword3 & IRDMACQ_STAG) { + info->stag_invalid_set = true; + info->inv_stag = (u32)FIELD_GET(IRDMACQ_INVSTAG, qword2); + } else { + info->stag_invalid_set = false; + } if (info->comp_status == IRDMA_COMPL_STATUS_FLUSHED || info->comp_status == IRDMA_COMPL_STATUS_UNKNOWN) { + ret_code = pthread_spin_lock(qp->lock); + if (ret_code) + return ret_code; if (!IRDMA_RING_MORE_WORK(qp->rq_ring)) { ret_code = ENOENT; + pthread_spin_unlock(qp->lock); goto exit; } info->wr_id = qp->rq_wrid_array[qp->rq_ring.tail]; - info->signaled = 1; - array_idx = qp->rq_ring.tail; + IRDMA_RING_SET_TAIL(qp->rq_ring, qp->rq_ring.tail + 1); + if (!IRDMA_RING_MORE_WORK(qp->rq_ring)) + qp->rq_flush_complete = true; + else + move_cq_head = false; + pthread_spin_unlock(qp->lock); } else { info->wr_id = qp->rq_wrid_array[array_idx]; - info->signaled = 1; if (irdma_check_rq_cqe(qp, &array_idx)) { info->wr_id = qp->rq_wrid_array[array_idx]; info->comp_status = IRDMA_COMPL_STATUS_UNKNOWN; IRDMA_RING_SET_TAIL(qp->rq_ring, array_idx + 1); return 0; } - } - - info->bytes_xfered = (u32)FIELD_GET(IRDMACQ_PAYLDLEN, qword0); - - if (qword3 & IRDMACQ_STAG) { - info->stag_invalid_set = true; - info->inv_stag = (u32)FIELD_GET(IRDMACQ_INVSTAG, qword2); - } else { - info->stag_invalid_set = false; - } - IRDMA_RING_SET_TAIL(qp->rq_ring, array_idx + 1); - if (info->comp_status == IRDMA_COMPL_STATUS_FLUSHED) { - qp->rq_flush_seen = true; - if (!IRDMA_RING_MORE_WORK(qp->rq_ring)) - qp->rq_flush_complete = true; - else - move_cq_head = false; + IRDMA_RING_SET_TAIL(qp->rq_ring, array_idx + 1); } pring = &qp->rq_ring; } else { /* q_type is IRDMA_CQE_QTYPE_SQ */ @@ -1444,12 +1486,6 @@ irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq, qp->push_mode = false; qp->push_dropped = true; } - ret_code = irdma_skip_duplicate_flush_cmpl(qp->sq_ring, - qp->sq_flush_seen, - info->comp_status, - &wqe_idx); - if (ret_code != 0) - goto exit; if (info->comp_status != IRDMA_COMPL_STATUS_FLUSHED) { info->wr_id = qp->sq_wrtrk_array[wqe_idx].wrid; info->signaled = qp->sq_wrtrk_array[wqe_idx].signaled; @@ -1459,10 +1495,9 @@ irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq, IRDMA_RING_SET_TAIL(qp->sq_ring, wqe_idx + qp->sq_wrtrk_array[wqe_idx].quanta); } else { - if (pthread_spin_lock(qp->lock)) { - ret_code = ENOENT; - goto exit; - } + ret_code = pthread_spin_lock(qp->lock); + if (ret_code) + return ret_code; if (!IRDMA_RING_MORE_WORK(qp->sq_ring)) { pthread_spin_unlock(qp->lock); ret_code = ENOENT; @@ -1493,7 +1528,6 @@ irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq, if (info->op_type == IRDMA_OP_TYPE_BIND_MW && info->minor_err == FLUSH_PROT_ERR) info->minor_err = FLUSH_MW_BIND_ERR; - qp->sq_flush_seen = true; if (!IRDMA_RING_MORE_WORK(qp->sq_ring)) qp->sq_flush_complete = true; pthread_spin_unlock(qp->lock); @@ -1508,6 +1542,7 @@ exit: if (pring && IRDMA_RING_MORE_WORK(*pring)) move_cq_head = false; } + if (move_cq_head) { IRDMA_RING_MOVE_HEAD_NOCHECK(cq->cq_ring); if (!IRDMA_RING_CURRENT_HEAD(cq->cq_ring)) @@ -1522,8 +1557,9 @@ exit: IRDMA_RING_MOVE_TAIL(cq->cq_ring); if (!cq->avoid_mem_cflct && ext_valid) IRDMA_RING_MOVE_TAIL(cq->cq_ring); - set_64bit_val(cq->shadow_area, IRDMA_BYTE_0, - IRDMA_RING_CURRENT_HEAD(cq->cq_ring)); + if (IRDMA_RING_CURRENT_HEAD(cq->cq_ring) & 0x3F || irdma_uk_cq_empty(cq)) + set_64bit_val(cq->shadow_area, IRDMA_BYTE_0, + IRDMA_RING_CURRENT_HEAD(cq->cq_ring)); } else { qword3 &= ~IRDMA_CQ_WQEIDX; qword3 |= FIELD_PREP(IRDMA_CQ_WQEIDX, pring->tail); @@ -1537,9 +1573,7 @@ exit: * irdma_round_up_wq - return round up qp wq depth * @wqdepth: wq depth in quanta to round up */ -static int -irdma_round_up_wq(u32 wqdepth) -{ +static u64 irdma_round_up_wq(u64 wqdepth) { int scount = 1; for (wqdepth--; scount <= 16; scount *= 2) @@ -1588,15 +1622,16 @@ irdma_get_wqe_shift(struct irdma_uk_attrs *uk_attrs, u32 sge, int irdma_get_sqdepth(struct irdma_uk_attrs *uk_attrs, u32 sq_size, u8 shift, u32 *sqdepth) { - u32 min_size = (u32)uk_attrs->min_hw_wq_size << shift; + u32 min_hw_quanta = (u32)uk_attrs->min_hw_wq_size << shift; + u64 hw_quanta = + irdma_round_up_wq(((u64)sq_size << shift) + IRDMA_SQ_RSVD); - *sqdepth = irdma_round_up_wq((sq_size << shift) + IRDMA_SQ_RSVD); - - if (*sqdepth < min_size) - *sqdepth = min_size; - else if (*sqdepth > uk_attrs->max_hw_wq_quanta) + if (hw_quanta < min_hw_quanta) + hw_quanta = min_hw_quanta; + else if (hw_quanta > uk_attrs->max_hw_wq_quanta) return EINVAL; + *sqdepth = hw_quanta; return 0; } @@ -1607,15 +1642,16 @@ irdma_get_sqdepth(struct irdma_uk_attrs *uk_attrs, u32 sq_size, u8 shift, u32 *s int irdma_get_rqdepth(struct irdma_uk_attrs *uk_attrs, u32 rq_size, u8 shift, u32 *rqdepth) { - u32 min_size = (u32)uk_attrs->min_hw_wq_size << shift; - - *rqdepth = irdma_round_up_wq((rq_size << shift) + IRDMA_RQ_RSVD); + u32 min_hw_quanta = (u32)uk_attrs->min_hw_wq_size << shift; + u64 hw_quanta = + irdma_round_up_wq(((u64)rq_size << shift) + IRDMA_RQ_RSVD); - if (*rqdepth < min_size) - *rqdepth = min_size; - else if (*rqdepth > uk_attrs->max_hw_rq_quanta) + if (hw_quanta < min_hw_quanta) + hw_quanta = min_hw_quanta; + else if (hw_quanta > uk_attrs->max_hw_rq_quanta) return EINVAL; + *rqdepth = hw_quanta; return 0; } diff --git a/contrib/ofed/libirdma/irdma_umain.c b/contrib/ofed/libirdma/irdma_umain.c index e8d27c31a0dc..63b082a5aa2b 100644 --- a/contrib/ofed/libirdma/irdma_umain.c +++ b/contrib/ofed/libirdma/irdma_umain.c @@ -1,7 +1,7 @@ /*- * SPDX-License-Identifier: GPL-2.0 or Linux-OpenIB * - * Copyright (c) 2021 - 2022 Intel Corporation + * Copyright (c) 2021 - 2026 Intel Corporation * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -48,7 +48,7 @@ /** * Driver version */ -char libirdma_version[] = "1.2.36-k"; +char libirdma_version[] = "1.3.56-k"; unsigned int irdma_dbg; @@ -87,6 +87,18 @@ static const struct hca_info hca_table[] = { INTEL_HCA(ICE_DEV_ID_E822L_SFP), INTEL_HCA(ICE_DEV_ID_E822L_10G_BASE_T), INTEL_HCA(ICE_DEV_ID_E822L_SGMII), + INTEL_HCA(ICE_DEV_ID_E830_BACKPLANE), + INTEL_HCA(ICE_DEV_ID_E830_QSFP56), + INTEL_HCA(ICE_DEV_ID_E830_SFP), + INTEL_HCA(ICE_DEV_ID_E830_SFP_DD), + INTEL_HCA(ICE_DEV_ID_E830C_BACKPLANE), + INTEL_HCA(ICE_DEV_ID_E830_XXV_BACKPLANE), + INTEL_HCA(ICE_DEV_ID_E830C_QSFP), + INTEL_HCA(ICE_DEV_ID_E830_XXV_QSFP), + INTEL_HCA(ICE_DEV_ID_E830C_SFP), + INTEL_HCA(ICE_DEV_ID_E830_XXV_SFP), + INTEL_HCA(ICE_DEV_ID_E835_XXV_SFP), + INTEL_HCA(ICE_DEV_ID_E835_QSFP), }; static struct ibv_context_ops irdma_ctx_ops = { @@ -239,7 +251,7 @@ irdma_driver_init(const char *uverbs_sys_path, hca_size = sizeof(hca_table) / sizeof(struct hca_info); while (i < hca_size && !device_found) { - if (device_id != hca_table[i].device) + if (device_id == hca_table[i].device) device_found = 1; ++i; } diff --git a/contrib/ofed/libirdma/irdma_user.h b/contrib/ofed/libirdma/irdma_user.h index aeb6aa9feebd..c9f707380c59 100644 --- a/contrib/ofed/libirdma/irdma_user.h +++ b/contrib/ofed/libirdma/irdma_user.h @@ -1,7 +1,7 @@ /*- * SPDX-License-Identifier: GPL-2.0 or Linux-OpenIB * - * Copyright (c) 2015 - 2023 Intel Corporation + * Copyright (c) 2015 - 2026 Intel Corporation * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -94,12 +94,10 @@ enum irdma_device_caps_const { IRDMA_MIN_IW_QP_ID = 0, IRDMA_QUERY_FPM_BUF_SIZE = 176, IRDMA_COMMIT_FPM_BUF_SIZE = 176, - IRDMA_MAX_IW_QP_ID = 262143, IRDMA_MIN_CEQID = 0, IRDMA_MAX_CEQID = 1023, IRDMA_CEQ_MAX_COUNT = IRDMA_MAX_CEQID + 1, IRDMA_MIN_CQID = 0, - IRDMA_MAX_CQID = 524287, IRDMA_MIN_AEQ_ENTRIES = 1, IRDMA_MAX_AEQ_ENTRIES = 524287, IRDMA_MIN_CEQ_ENTRIES = 1, @@ -188,7 +186,7 @@ struct irdma_cq_uk_init_info; struct irdma_ring { volatile u32 head; - volatile u32 tail; /* effective tail */ + volatile u32 tail; u32 size; }; @@ -327,6 +325,7 @@ struct irdma_wqe_uk_ops { struct irdma_bind_window *op_info); }; +bool irdma_uk_cq_empty(struct irdma_cq_uk *cq); int irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq, struct irdma_cq_poll_info *info); void irdma_uk_cq_request_notification(struct irdma_cq_uk *cq, @@ -364,6 +363,8 @@ struct irdma_qp_uk { __le64 *shadow_area; __le32 *push_db; __le64 *push_wqe; + void *push_db_map; + void *push_wqe_map; struct irdma_ring sq_ring; struct irdma_ring sq_sig_ring; struct irdma_ring rq_ring; @@ -393,12 +394,11 @@ struct irdma_qp_uk { bool sq_flush_complete:1; /* Indicates flush was seen and SQ was empty after the flush */ bool rq_flush_complete:1; /* Indicates flush was seen and RQ was empty after the flush */ bool destroy_pending:1; /* Indicates the QP is being destroyed */ + bool last_push_db:1; /* Indicates last DB was push DB */ void *back_qp; pthread_spinlock_t *lock; u8 dbg_rq_flushed; u16 ord_cnt; - u8 sq_flush_seen; - u8 rq_flush_seen; u8 rd_fence_rate; }; @@ -462,9 +462,11 @@ int irdma_fragcnt_to_quanta_sq(u32 frag_cnt, u16 *quanta); int irdma_fragcnt_to_wqesize_rq(u32 frag_cnt, u16 *wqe_size); void irdma_get_wqe_shift(struct irdma_uk_attrs *uk_attrs, u32 sge, u32 inline_data, u8 *shift); -int irdma_get_sqdepth(struct irdma_uk_attrs *uk_attrs, u32 sq_size, u8 shift, u32 *sqdepth); -int irdma_get_rqdepth(struct irdma_uk_attrs *uk_attrs, u32 rq_size, u8 shift, u32 *rqdepth); +int irdma_get_sqdepth(struct irdma_uk_attrs *uk_attrs, u32 sq_size, + u8 shift, u32 *sqdepth); +int irdma_get_rqdepth(struct irdma_uk_attrs *uk_attrs, u32 rq_size, + u8 shift, u32 *rqdepth); void irdma_qp_push_wqe(struct irdma_qp_uk *qp, __le64 *wqe, u16 quanta, - u32 wqe_idx, bool post_sq); + u32 wqe_idx, bool push_wqe); void irdma_clr_wqes(struct irdma_qp_uk *qp, u32 qp_wqe_idx); #endif /* IRDMA_USER_H */ diff --git a/contrib/ofed/libirdma/irdma_uverbs.c b/contrib/ofed/libirdma/irdma_uverbs.c index e52ce1cfa229..aee904a087bf 100644 --- a/contrib/ofed/libirdma/irdma_uverbs.c +++ b/contrib/ofed/libirdma/irdma_uverbs.c @@ -1,7 +1,7 @@ /*- * SPDX-License-Identifier: GPL-2.0 or Linux-OpenIB * - * Copyright (C) 2019 - 2023 Intel Corporation + * Copyright (C) 2019 - 2026 Intel Corporation * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -221,7 +221,7 @@ irdma_urereg_mr(struct verbs_mr *vmr, int flags, struct ibv_pd *pd, void *addr, size_t length, int access) { struct irdma_urereg_mr cmd = {}; - struct ibv_rereg_mr_resp resp; + struct ibv_rereg_mr_resp resp = {}; cmd.reg_type = IRDMA_MEMREG_TYPE_MEM; return ibv_cmd_rereg_mr(&vmr->ibv_mr, flags, addr, length, (uintptr_t)addr, @@ -258,7 +258,7 @@ irdma_ualloc_mw(struct ibv_pd *pd, enum ibv_mw_type type) { struct ibv_mw *mw; *** 6933 LINES SKIPPED *** From nobody Fri Jul 3 00:27:15 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4grvhh102vz6kDkX for ; Fri, 03 Jul 2026 00:27:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4grvhg5R7Wz461B for ; Fri, 03 Jul 2026 00:27:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783038435; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=oSe4lOqjIha/LKCPvkVT6s9cWsZEHjC8xhhd3KFVeaU=; b=pEOE82SVrxpL30FM6jcdmFoSwUf4DC0fcHGaa/4WigE5981+/VC/9VwbE/5Xm3tkTpoHUk xKBVzA7w7DLElePziouzQairxuUH9xEC9tIcQWjiduOjNa66fF4FsRK3mZ33MN9rn+qjsq 0gU2cCiHgqvJhKK6uPgjrni4U7Xu0dT4FqW87GN8uFb8w/0eEMQkT9Fi6PvZq/A+mUstBy jFEOQK6jTJ5fekPlh6VinbgPBYM5XrJAOKZiRtsnnbVA9XR5xNivI8yeHgUXNdKiZMwVf0 SMRYf2d4kqOOaP2dzk+QVvXaCbG8bPQDsU6rY86QqO9tkfJooKzunElN6Ssdlg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783038435; a=rsa-sha256; cv=none; b=Lmij2kA7XOnjkbUq4e1J0kgY3WJEu6N+a7zK7y5I81O3G7tm6uXLHzYpDuE+h2LTqgZBrc v9lBSmixTWpkLbeAU9UNhr415UtHmjUiLZVA+Ic34z/ACVj3ukBW6fFQB23SuEevL/1r/T NpntDPf642KfKj2J/owhukGEem/4uyqoQe8Dc0kdPB/7k860HpSyzE0pPWvMdN5P+1PilJ fKFXqSv6ZxcHrrpKIPrnheXDcznXsWjSszPL0Ai028PWQDNsEOcsnw9zakZVh9jaFpETKp BbhNTvjTliLDQq/Tz3nsnriDcDHBj34jCikhul41ym0CREcD/tLpZbNmwWPd8w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783038435; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=oSe4lOqjIha/LKCPvkVT6s9cWsZEHjC8xhhd3KFVeaU=; b=Eb101KAKBO1YoH0HT8+h/qe+BCIlMeMWlun9wdU5lDrocXJaknHHox877b87y69IxOFyJf n+IWe1Win+nhqiRtAWntNTnamsh8RMwc5JLi9FrCanS6RNRwDBlJRk5SWG+fEYgqhacWhd AhsYCebQWJTPFyxAKU6aSrrm9hE2pcDbRHhC2ZZ/iWavoxI+pCu8CkwiQQwC91ZIoPLndR vG2ZzjRpqBsO543SunKoauHDmezkqxj+mu56CC11A2UQGdqC3PdUisAia9VMbA8IcFTcJw FyDnBtZto4uW8J7XIt5ETE9+AgKVX2UDQ/LOCOe5RlKRevnAinWdE4BzsrAtsw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4grvhg3xNqz8Nv for ; Fri, 03 Jul 2026 00:27:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 26a00 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 03 Jul 2026 00:27:15 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Konstantin Belousov Subject: git: 0cff90f802fd - stable/15 - VOP_VPUT_PAIR(): handle the case when dvp == vp List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 0cff90f802fd96589fc8209b1dc263fc0fa4ed04 Auto-Submitted: auto-generated Date: Fri, 03 Jul 2026 00:27:15 +0000 Message-Id: <6a4701e3.26a00.6564c021@gitrepo.freebsd.org> The branch stable/15 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=0cff90f802fd96589fc8209b1dc263fc0fa4ed04 commit 0cff90f802fd96589fc8209b1dc263fc0fa4ed04 Author: Konstantin Belousov AuthorDate: 2026-06-24 18:21:49 +0000 Commit: Konstantin Belousov CommitDate: 2026-07-03 00:24:33 +0000 VOP_VPUT_PAIR(): handle the case when dvp == vp (cherry picked from commit be9295deedd1e837ee3645583d07e1dffbe1ead0) --- sys/kern/vfs_default.c | 28 +++++++++++++++++++++++----- sys/sys/vnode.h | 1 + sys/ufs/ffs/ffs_vnops.c | 18 +++++++++++------- 3 files changed, 35 insertions(+), 12 deletions(-) diff --git a/sys/kern/vfs_default.c b/sys/kern/vfs_default.c index 76f63b187b65..1a4ce712a4d3 100644 --- a/sys/kern/vfs_default.c +++ b/sys/kern/vfs_default.c @@ -81,7 +81,6 @@ static int vop_stdfdatasync(struct vop_fdatasync_args *ap); static int vop_stdgetpages_async(struct vop_getpages_async_args *ap); static int vop_stdread_pgcache(struct vop_read_pgcache_args *ap); static int vop_stdstat(struct vop_stat_args *ap); -static int vop_stdvput_pair(struct vop_vput_pair_args *ap); static int vop_stdgetlowvnode(struct vop_getlowvnode_args *ap); /* @@ -1623,16 +1622,35 @@ vop_stdread_pgcache(struct vop_read_pgcache_args *ap __unused) return (EJUSTRETURN); } -static int +/* + * vput(dvp). If unlock_vp is true, vput(vp). Both dvp and vp must + * be locked. This is VOP because some filesystems might need to do + * additional actions on dvp when unlocked, and need to be aware of + * any other locked vnodes. Also as the consequence, vp might become + * doomed even if unlock_vp is false. + * + * Special case: dvp == vp. If unlock_vp is true, vunref(vp); + * vput(vp), else vunref(vp). In other words, the VOP assumes that + * there are two references on the vnode on entry, and releases only + * one of them in case of !unlock_vp. + */ +int vop_stdvput_pair(struct vop_vput_pair_args *ap) { struct vnode *dvp, *vp, **vpp; dvp = ap->a_dvp; vpp = ap->a_vpp; - vput(dvp); - if (vpp != NULL && ap->a_unlock_vp && (vp = *vpp) != NULL) - vput(vp); + vp = vpp != NULL ? *vpp : NULL; + if (dvp != vp) { + vput(dvp); + if (vp != NULL && ap->a_unlock_vp) + vput(vp); + } else { + vunref(vp); + if (ap->a_unlock_vp) + vput(vp); + } return (0); } diff --git a/sys/sys/vnode.h b/sys/sys/vnode.h index 0e84127cbc32..4513a7a62140 100644 --- a/sys/sys/vnode.h +++ b/sys/sys/vnode.h @@ -916,6 +916,7 @@ int vop_stdpathconf(struct vop_pathconf_args *); int vop_stdpoll(struct vop_poll_args *); int vop_stdvptocnp(struct vop_vptocnp_args *ap); int vop_stdvptofh(struct vop_vptofh_args *ap); +int vop_stdvput_pair(struct vop_vput_pair_args *ap); int vop_stdunp_bind(struct vop_unp_bind_args *ap); int vop_stdunp_connect(struct vop_unp_connect_args *ap); int vop_stdunp_detach(struct vop_unp_detach_args *ap); diff --git a/sys/ufs/ffs/ffs_vnops.c b/sys/ufs/ffs/ffs_vnops.c index c7e2b3f4b8e6..ee495fe3888c 100644 --- a/sys/ufs/ffs/ffs_vnops.c +++ b/sys/ufs/ffs/ffs_vnops.c @@ -2006,16 +2006,14 @@ ffs_vput_pair(struct vop_vput_pair_args *ap) vpp = ap->a_vpp; vp = vpp != NULL ? *vpp : NULL; - if ((dp->i_flag & (IN_NEEDSYNC | IN_ENDOFF)) == 0) { - vput(dvp); - if (vp != NULL && ap->a_unlock_vp) - vput(vp); - return (0); - } + if ((dp->i_flag & (IN_NEEDSYNC | IN_ENDOFF)) == 0) + return (vop_stdvput_pair(ap)); mp = dvp->v_mount; if (vp != NULL) { - if (ap->a_unlock_vp) { + if (dvp == vp) { + vunref(vp); + } else if (ap->a_unlock_vp) { vput(vp); } else { MPASS(vp->v_type != VNON); @@ -2055,6 +2053,12 @@ ffs_vput_pair(struct vop_vput_pair_args *ap) } while (error == ERELOOKUP); } + if (vp == dvp) { + if (ap->a_unlock_vp) + vput(dvp); + return (0); + } + vput(dvp); if (vp == NULL || ap->a_unlock_vp) From nobody Sat Jul 4 09:37:27 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gsls366K8z5pyqW for ; Sat, 04 Jul 2026 09:37:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gsls35W0Yz3TGm for ; Sat, 04 Jul 2026 09:37:27 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783157847; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KNqv9khSxdXJ3hPEVsOtjMeowNcbZt7vnOhIOh+/a/w=; b=YnkroQ6hjp7Nwe+BHEf3Ncd6bN4QaCsUjnOh6zeAVwTTeA8ps7TZve1Uv2KDPIqmRnmNRn Wr2tU57eG0dvjizn93pKlWLYmJUzXDQAeO3KkctcvnFinTjC2Oyx+eBC8UC2cw7oTcodlb ghTXIY6MzNEhQkoHrI7dJDXfhEUiN6lvAo5XgQhNIhPr/aeQmz+vLvld49rmSv7Vdk3QyW dt7K7ZAF9BbY0kWdzU11o5GqNpBU0/aN9o+HKEJwJTWqEIvJ5IvT71GWxhkO/A7TZ2WbEP MOT36s1yXYdjTO943ZUWGvaV3xpUAcjaM+VpZuKWAnVo8ywkMXzfLTlemYpYjg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783157847; a=rsa-sha256; cv=none; b=gMPV9IhxnRW/x9YI115NTX8DJqVM1NgUaWwBkhpGKVc+cLOEw2Fiu+RDfhPUHS7kRuAOEX ngc+mB+LwRy2xxOmeCBuzSLNevKGIwB/6QLSrD2Ji5nFqZFJFEtVHQ0ucUYBxgVaMBBQNl P0wzLUyL1oDCsCIlbg9XeqAPIu/CskF/JX3ISUFVXEQuf0aDU+5AbpnthmB+qO9vBhD9wG QGoPVv9vnnPRQ9P7ISzdZHLeUli8uI3ThrkCtcYD9+gjNWoFL/XZ4T0M5TfHckypjbYJMV DLj1KVAIdSe+cNm14YVhUOfKgQHWrzlnnLjqSGFQZnjBcJ+zZj1a4YpmoRBm1Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783157847; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KNqv9khSxdXJ3hPEVsOtjMeowNcbZt7vnOhIOh+/a/w=; b=ubMeQqcVBz/55ZFSIfT1q/y+0lcfEnPdtTscDFA4bwe9Qn1i7IcHcfGbwzRlguOIKH5PQY cs7AvsbTxL3neodNrefR9cZ26u/AgwunJcL42qjW7m5rSMas9Kte41YW2wAoQTozW25Ass 4PfKE/mm1EmiZlnhclJa3BL1myvHOdW4mNULm5HwRYgXyR4kARuMIdJUVcMjk3IffjieO9 jwOPNoDR50dCgK9DZxFdcvzBG8rwGIQbFLfL1ogMIhDPsAG++dfKdjUxShJYmslOp9UKh4 RU5O8GVapup2OGCbIs82BFXtmhDybfH26HwXHBGSsINO6w0mYSYlsxoeTqS1zg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gsls34DftzBNw for ; Sat, 04 Jul 2026 09:37:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4651d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sat, 04 Jul 2026 09:37:27 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Christos Margiolis Subject: git: b2ee6be16f79 - stable/15 - sound: Use sx_assert instead of KASSERT(sx_xlocked()) List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: christos X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: b2ee6be16f79986f3288e53c88e630d55290576d Auto-Submitted: auto-generated Date: Sat, 04 Jul 2026 09:37:27 +0000 Message-Id: <6a48d457.4651d.188842c0@gitrepo.freebsd.org> The branch stable/15 has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=b2ee6be16f79986f3288e53c88e630d55290576d commit b2ee6be16f79986f3288e53c88e630d55290576d Author: Christos Margiolis AuthorDate: 2026-06-27 14:25:27 +0000 Commit: Christos Margiolis CommitDate: 2026-07-04 09:37:15 +0000 sound: Use sx_assert instead of KASSERT(sx_xlocked()) It's redundant. Sponsored by: The FreeBSD Foundation MFC after: 1 week (cherry picked from commit 72acd1720af365e6fd186cc1706994d72c43650a) --- sys/dev/sound/sndstat.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sys/dev/sound/sndstat.c b/sys/dev/sound/sndstat.c index c28a932c784e..5ef6136f6f88 100644 --- a/sys/dev/sound/sndstat.c +++ b/sys/dev/sound/sndstat.c @@ -173,8 +173,7 @@ sndstat_remove_all_userdevs(struct sndstat_file *pf) { struct sndstat_userdev *ud; - KASSERT( - sx_xlocked(&pf->lock), ("%s: Called without pf->lock", __func__)); + sx_assert(&pf->lock, SX_XLOCKED); while ((ud = TAILQ_FIRST(&pf->userdev_list)) != NULL) { TAILQ_REMOVE(&pf->userdev_list, ud, link); free(ud->provider, M_DEVBUF); From nobody Sat Jul 4 09:37:26 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gsls80Vttz5pyjD for ; Sat, 04 Jul 2026 09:37:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gsls76CDcz3Tpv for ; Sat, 04 Jul 2026 09:37:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783157851; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/dB4KPQE9IUKaqa0Oh8icP75lJWjOESyhkoJ10VkVQY=; b=JF/7DsYf/fI9btkDQ5Et7prvCQC5F+1/7wfOEmb5T59clemkiNQjAyjjPMNwsnTVjEjqjy WLLboRbS7drmayOoUkc8Vg8LNv3Zs5Uxhx5oYVaROkbGKcipoexbqhUXBr8dSN9POIphlY ut+qg12Hz6qL0HBLaG9Sbq3NF6rcSXSqEY/uA3pvsirRnkSI2MuTsyo5mqVWeKX4rUSZfF wkpv8KfvoM2zAfFnG5Ez0BhVI1ofx3bGc/v/o7f6lUGASAf7qzp6CnHCJqUygjsQRe4Zg1 IEWK1IDWZwV5uaxtBlay+e2oQEQFfkVo/pBNsEC3KS+eD6sirSzfevDYVqh4oA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783157851; a=rsa-sha256; cv=none; b=XFSPwtQmgzICMGPMNd2dq3MrAoSI4qV6xB2+MAVIg2zr3fXSw8jDacuKbGnewTDqY8DVwv AMW6u4+0bGAHl8nZcZaht/nzQ6JoL0CqKhv1amGJOrMNpj6n3ALL/WFAbCJNVH6r1UVnQy RGNqrmB3/vQRQeNg9TbXg8HwOzAsIVDWVpgxnhhQb1b7BFRLOIl85eAyJuolj5Hmv93k9f 0v394xd45D2R45EbXiRRJRRTEqaogwpvp1W0YAec02JroMW3zxwZirtgXIJ84GJrgwaYsp uOmcCQ5xIPZKim1iLipL90pZMaxaTdB5AzA6y0/9tngV0t/YRiYfufhQvqaG5w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783157851; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/dB4KPQE9IUKaqa0Oh8icP75lJWjOESyhkoJ10VkVQY=; b=OLijARlHIhyZ44XnkybwDZC58END7DQOMZj30UZCdXp4bw1YewGd461S4bPuWknHPMgEwB kBDks6Wn/sxQ5zivrnLRKSUN4iGlWSaP1OB9JVQcFhF1er0uv4DXApgL6L9MSwcGmFhISW RsOCCXQf3iYlK2UDDtrw+z7ySXT5z6wzU+CFtjvEON5b3PiUFqnahCBHi+7ToR0njkCzsb 8moXBnpoct+tQ+pDUdZRrhAqaNKRyPnUGLMeGy24woiBYJrXijkMWEI1scZ/9Zb2+cbfoa vh9yloldxrqO1TnqYcAMXVVvcmHlsZqrgJYvUffhzKg8wIJE2O0MORWPMFXUfA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gsls75GYJzBbW for ; Sat, 04 Jul 2026 09:37:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 461d8 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sat, 04 Jul 2026 09:37:26 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Goran=?utf-8?Q? Meki=C4=87?= From: Christos Margiolis Subject: git: fdaee441eb5f - stable/15 - snd_dummy: advance pointers for both channels List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: christos X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: fdaee441eb5f542c56606b87eaa54bfafac2f5a7 Auto-Submitted: auto-generated Date: Sat, 04 Jul 2026 09:37:26 +0000 Message-Id: <6a48d456.461d8.2f980d25@gitrepo.freebsd.org> The branch stable/15 has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=fdaee441eb5f542c56606b87eaa54bfafac2f5a7 commit fdaee441eb5f542c56606b87eaa54bfafac2f5a7 Author: Goran Mekić AuthorDate: 2026-06-27 13:41:57 +0000 Commit: Christos Margiolis CommitDate: 2026-07-04 09:37:15 +0000 snd_dummy: advance pointers for both channels Previously only the play pointer advanced each tick; the record channel refilled the whole buffer with silence and left the DMA pointer at 0. Advance the record pointer by one block per tick and fill that block with silence, so the DMA pointer changes and mmap kqueue consumers can track progress. MFC after: 1 week Reviewed by: christos Differential Revision: https://reviews.freebsd.org/D57834 (cherry picked from commit 968e748c439a50ad0a1a4463f4753f58a2bdaf9f) --- sys/dev/sound/dummy.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sys/dev/sound/dummy.c b/sys/dev/sound/dummy.c index 91a198e3d9f6..7390ba9f467f 100644 --- a/sys/dev/sound/dummy.c +++ b/sys/dev/sound/dummy.c @@ -112,11 +112,10 @@ dummy_chan_io(void *arg) ch = &sc->chans[i]; if (!ch->run) continue; - if (ch->dir == PCMDIR_PLAY) { - ch->ptr += ch->buf->blksz; - ch->ptr %= ch->buf->bufsize; - } else + if (ch->dir == PCMDIR_REC) sndbuf_fillsilence(ch->buf); + ch->ptr += ch->buf->blksz; + ch->ptr %= ch->buf->bufsize; mtx_unlock(&sc->lock); chn_intr(ch->chan); mtx_lock(&sc->lock); From nobody Sun Jul 5 02:50:32 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gtBn45b81z6dcm8 for ; Sun, 05 Jul 2026 02:50:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gtBn44xjbz4Lnc for ; Sun, 05 Jul 2026 02:50:32 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783219832; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=w6vgV+VY+yYQo8sF1R+NWb3I1lb7J0ukWoIW0Upzjho=; b=Ir4fTfj6L0RYjcneOanR2SfYRPjfbkBi3preHQVQG9nVKb3b3UPXe6vSiWcsI75yZcPQnB ZpXfdBjpn/miFIksfEQ/G4uurKtK9PuE/otyIkucY/11l0cooQbSIpbQSCcKCvKzNPbZoF H3LgJXmt+NJY+R0Py9YVcL3Gspg3nbd/vYSYDpm37afBu3UaF+7LxwGrPw7im+NxE9dfkG Y3VouAj3XEMGcUMp0El1Sj+SdvCeKVfBj2hRW1eCUWHsF+lvO2CsTVX4RL53h6UpYUYXCM vVAOc4dJCNyu2qVc9ItBA6TPbn8uEy7JEK3xo1w00GkuqKQWEYYd1008EF/4vQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783219832; a=rsa-sha256; cv=none; b=OBeoraB39GHGn9B3LOxWOiv0LEMt8gs1DNckKT3LU/b5D0pbejVcduaILpMXUSROS4vz3m 8bDWAOdJGQH9hTRSzaTt9veAZpWQ3ecAM0ubvPZnRQWXrS2ahdBZEWLorU6rEl1I5dodYy HbwBLvOs37qRA20gn0QPJDy77oxAMe8tQE6oYsGe5yEFpfB0xgNH0Nz8jOfguUkwT/5Ctg tTjmw5jjHmBfQ2ikZv+BbCRuK56GaDL9PhnfpB8dPPOkXcsggfR2P4fqp8ZJuwTNWqId4w m3sPHsaShzhsVBuDBNkg6Ds2pG2IvE28wXAYtxJYGuDgnNFe0HHMGp7O/pb76Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783219832; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=w6vgV+VY+yYQo8sF1R+NWb3I1lb7J0ukWoIW0Upzjho=; b=BzV/sbh+wFF8gle1S2AY0T2PG8+Q8XP6M4RZ+zYw1S94DkBc/uCmFp5n/oDGkdBZLwG2aB wwPLBnGrHm7DrAJDHF5FIzU5x774pc3kQLPR6pV1CxA3SrNl7hMkILokNSqSHGyFmjSH5z 8AF5OFcVdZHcurWK0ySuE7d5fR4KgY3R3SMerxSepQfjpo4/dXjasTDExGNOUhv7hESugs x1MqagEv6Gxq8Giia8eddu8A4WxyvXDyccDRgAyfxsPeJ9+3FMTS8QN/+AxXl0FIhFuLHI b/F3XHsmOUkAJC5zkNvMBdS0iTEXgZmyPVXcLU2oO5dSoTy3arpCzQ3FwUg+Lw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gtBn43bDKz102w for ; Sun, 05 Jul 2026 02:50:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44295 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 05 Jul 2026 02:50:32 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Jamie Gritton Subject: git: cb0b277f71b6 - stable/14 - jail: prevent a null derefence on array parameter assignment List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jamie X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: cb0b277f71b642b6239539a537b94efdae1bfc6d Auto-Submitted: auto-generated Date: Sun, 05 Jul 2026 02:50:32 +0000 Message-Id: <6a49c678.44295.4378440a@gitrepo.freebsd.org> The branch stable/14 has been updated by jamie: URL: https://cgit.FreeBSD.org/src/commit/?id=cb0b277f71b642b6239539a537b94efdae1bfc6d commit cb0b277f71b642b6239539a537b94efdae1bfc6d Author: Jamie Gritton AuthorDate: 2026-07-01 18:36:08 +0000 Commit: Jamie Gritton CommitDate: 2026-07-05 02:49:53 +0000 jail: prevent a null derefence on array parameter assignment The same variable was used as a counter for an inner and out loop. Add a new one for the inner loop. PR: 283934 Reported by: crest at rlwinm.de (cherry picked from commit 6d9bc46cd7fc48ece597162d3ca413fc9d67b5f0) --- usr.sbin/jail/config.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/usr.sbin/jail/config.c b/usr.sbin/jail/config.c index e5aef24f6386..fca08df732b0 100644 --- a/usr.sbin/jail/config.c +++ b/usr.sbin/jail/config.c @@ -134,7 +134,7 @@ load_config(const char *cfname) struct cfparams opp; struct cfjail *j, *tj, *wj; struct cfparam *p, *vp, *tp; - struct cfstring *s, *vs, *ns; + struct cfstring *s, *vs, *ns, *cs; struct cfvar *v, *vv; char *ep; int did_self, jseq, pgen; @@ -246,13 +246,14 @@ load_config(const char *cfname) while ((vv = STAILQ_NEXT(vv, tq))) vv->pos += vs->len; s->len += vs->len; + cs = s; while ((vs = TAILQ_NEXT(vs, tq))) { ns = emalloc(sizeof(struct cfstring)); ns->s = estrdup(vs->s); ns->len = vs->len; STAILQ_INIT(&ns->vars); - TAILQ_INSERT_AFTER(&p->val, s, ns, tq); - s = ns; + TAILQ_INSERT_AFTER(&p->val, cs, ns, tq); + cs = ns; } free_var: free(v->name); From nobody Sun Jul 5 02:50:34 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gtBn70Hcqz6dcrr for ; Sun, 05 Jul 2026 02:50:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gtBn64x46z4M4B for ; Sun, 05 Jul 2026 02:50:34 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783219834; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5auJpJ9jY6otRzi4kmfO2Xg6lP+8gFUTe+EqDIciCSQ=; b=ynjHbqEO0ocvBtxRFokJ5rxAzMfpDNItvPtuQ+odZ7BGXQ4KCsbuPGyTkmXobFnyb8lP89 QpvPSIruz50JeUucE3TB7/wmRjuhSL+GjaPsyrRtPPerGpp+Br153XVWDzGbguWvEUSpjq J+/moRuBZlv8dC5pKk+s4D6JcubST0pwe3Rrk9JLkLamBhU9EJ1YvaPx+xdaPqXEdYDuoi i8IdGKa/1qTtPc8IQCWffzGESxgNdSSCXh7v3TB4rMOkX11IFga+7inBb8ZOBjw5YElK9C jfG2qrTuZ9iSdTASTH27K2t21285eqzd8xFyVcQGmBC/BZvzVp0IZhEP9dUwUw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783219834; a=rsa-sha256; cv=none; b=YoygMAPPk7rkudc4z+FmohDhelTRq2ZdwFUDxxBSQaydwVTyzrBG390yVVQ/mj8dLAyPKj ht9TRG47M5fsXhDDR58u2kg5HVKnLT9mnyKiVMNmoQ7bHiKM6CeJP8xU+YVaING83oACLH iYE2ON3QPODw1KUehzJuzZlNmsYZB7Ct1eDJloGD8tTTLjaOiNkJX1vXpctKXg31DCn08u Xpt5uXzToR6W7c9vYtEQ5f7qgFyQuyo7QXw+rblaW3EryhGDGMuW/H8o6ACH4OBIFHvnRH 3pUm84yCunWLyDKBcEy9Bje/55fOCTbchR32eMzn8KpTQt+S8FDcD1/KOPoFRQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783219834; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5auJpJ9jY6otRzi4kmfO2Xg6lP+8gFUTe+EqDIciCSQ=; b=Q0hInmF7yW+/521n+S+awOaSKFHVxyPr8EeB2oCChAEFGZQvG/k3jWMNAdIVOJ/QgmO18s 8SpASzc53am46cccGq2JjnMQz0pYHvck+PMjF0XXkSdNNBVbmSdbeb/X7Ay97DD6zUOnb0 ueGFwaz+XBrRzj3oIB83ZW3KjwpPuJIbXfL8pcqFOTYQrfef7zVTLs3Y+fX4R8j672bUhx Wjj/Qj1fwohdX/2yq8vQxTnpfVfPrAN5ExLzkbG02309bE2kxKhvC5XCZFCib1yEZuZbDW NRjti7Qe8KMLiy/YzylybsBwAL3jPUuu28xSx0N9kIKNbL0Q8zB36TQ2VuonSg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gtBn63lGBzyrQ for ; Sun, 05 Jul 2026 02:50:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 443f0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 05 Jul 2026 02:50:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Jamie Gritton Subject: git: aca9811160f4 - stable/15 - jail: prevent a null derefence on array parameter assignment List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jamie X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: aca9811160f4dd9e6ed94b8b08ad2285e3390c1c Auto-Submitted: auto-generated Date: Sun, 05 Jul 2026 02:50:34 +0000 Message-Id: <6a49c67a.443f0.3afbb284@gitrepo.freebsd.org> The branch stable/15 has been updated by jamie: URL: https://cgit.FreeBSD.org/src/commit/?id=aca9811160f4dd9e6ed94b8b08ad2285e3390c1c commit aca9811160f4dd9e6ed94b8b08ad2285e3390c1c Author: Jamie Gritton AuthorDate: 2026-07-01 18:36:08 +0000 Commit: Jamie Gritton CommitDate: 2026-07-05 02:49:58 +0000 jail: prevent a null derefence on array parameter assignment The same variable was used as a counter for an inner and out loop. Add a new one for the inner loop. PR: 283934 Reported by: crest at rlwinm.de (cherry picked from commit 6d9bc46cd7fc48ece597162d3ca413fc9d67b5f0) --- usr.sbin/jail/config.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/usr.sbin/jail/config.c b/usr.sbin/jail/config.c index 188f48732561..cc05c2916ca0 100644 --- a/usr.sbin/jail/config.c +++ b/usr.sbin/jail/config.c @@ -134,7 +134,7 @@ load_config(const char *cfname) struct cfparams opp; struct cfjail *j, *tj, *wj; struct cfparam *p, *vp, *tp; - struct cfstring *s, *vs, *ns; + struct cfstring *s, *vs, *ns, *cs; struct cfvar *v, *vv; char *ep; int did_self, jseq, pgen; @@ -246,13 +246,14 @@ load_config(const char *cfname) while ((vv = STAILQ_NEXT(vv, tq))) vv->pos += vs->len; s->len += vs->len; + cs = s; while ((vs = TAILQ_NEXT(vs, tq))) { ns = emalloc(sizeof(struct cfstring)); ns->s = estrdup(vs->s); ns->len = vs->len; STAILQ_INIT(&ns->vars); - TAILQ_INSERT_AFTER(&p->val, s, ns, tq); - s = ns; + TAILQ_INSERT_AFTER(&p->val, cs, ns, tq); + cs = ns; } free_var: free(v->name); From nobody Sun Jul 5 02:54:59 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gtBtC48DQz6dd5G for ; Sun, 05 Jul 2026 02:54:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gtBtC3lYPz4Nh3 for ; Sun, 05 Jul 2026 02:54:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783220099; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=CwYt+5lHAJvVQTeOHgVKsZ1o7rkkxVY3OE7YRgiYPTI=; b=PkaNMAHajz9IqNOXFRQiaD9r3UwiYeJMYpiwtojW7lIvBkzzSvkYckiRryh4o87fypOcA6 cfZG8Dlyvzz8LNLtZO6wnRvtHwLR5GPs5AAYk2JsQ23KdJcYEBTUr80YdTEaaHdAttRMK1 aBcy3wvBRpq/Wlf6dLpAos7RWE5I7zlwapBrNIT58oFd6PvsjTGLvfdjgQQ1hjE5Sunxi7 TabEkPhQ4KWNV1M/EVF05sbmBe1GeFMhJBUV7y7qyoZvRc9FSRlL03X8OkdTZ0vBFf4T6I 9uN+jOvhzlf2ei2d3DmvvhiGDIfKZlXHfXvoTzrbexCVNw7Mxnn2/gBOD+k3mw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783220099; a=rsa-sha256; cv=none; b=I9VtMug4KlzQgEEhipGy7fm/boVmP8MqANXw/cG9IaXI/Tq6bXORamdLa7/qJMrtGzxnwm wqIBhE/9JE1H9OJMo3UOf20jSyr0ImslozpY9OvMqXlsF3TiG4oUIkspSY689FY8y5z0QH 5xUyI+p9JwLUUuUXaHdNvpM0aQpZX975OouB0cl43fxma5LfevFcq+VNQF99M8kpiyGPLM 3Pj457YkGN87CCXJ16dF/axd8coy3unz3VcwDEm3llbVIEdMLcCFSqv643pVc8bXVuFAef F6xHrzY6xKYXzWqLlGHHqMPRQL2svOSMeldCtmkYxwte6ZJU40Y38EhNw758Ig== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783220099; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=CwYt+5lHAJvVQTeOHgVKsZ1o7rkkxVY3OE7YRgiYPTI=; b=iJUMNuduss7o2Y0k7TOrYGwKc/JsHlpyDQJxEFxKjm6iXrfjYwz0yPmT1w7rhgvoZA57jh TvEZW6xeVs7G04I9LIv408nZr3apM9kyW0SmG0C0zlQVYOrIgNk5D3j4NkQTzyB5Fj9X3a jshJ9GdnrI5Xoe37Koy7yGSYRKpvNBjwGo+udKJHT9/h1OBdbaIzOvqGVFzs6BXiWfg3HA AgG8dJ94W0jyDe1KXyd2jYH4EfiruhabBagIDD9bphQ6WMlykQpbw7k4p8m9LUcVj98/Rq 5ns/7mE1ycqrrYZ1SeUwi8mw6xa0o62rAJRV7EQWXWNxoEjWHO1Ow/z1NiasEA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gtBtC2Dzwz10Vg for ; Sun, 05 Jul 2026 02:54:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44930 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 05 Jul 2026 02:54:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Jamie Gritton Subject: git: a4df9e3efa30 - stable/15 - jail: prevent a race between jail_attach in different threads List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jamie X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a4df9e3efa30d2486776a530e6a3548bc74d7b98 Auto-Submitted: auto-generated Date: Sun, 05 Jul 2026 02:54:59 +0000 Message-Id: <6a49c783.44930.5d4a0855@gitrepo.freebsd.org> The branch stable/15 has been updated by jamie: URL: https://cgit.FreeBSD.org/src/commit/?id=a4df9e3efa30d2486776a530e6a3548bc74d7b98 commit a4df9e3efa30d2486776a530e6a3548bc74d7b98 Author: Jamie Gritton AuthorDate: 2026-07-02 22:48:07 +0000 Commit: Jamie Gritton CommitDate: 2026-07-05 02:54:41 +0000 jail: prevent a race between jail_attach in different threads Attaching to a jail changes its root directory and its process credentials. These operations both require unlocking the jail, and also need allprison_lock unlocked. That means that if two threads are trying to attach to different jails at the same time, it's possible for the process to end up with one jail's root directory but the other jail's credentials. Solve this by forcing the process into single-threaded mode during system calls that attach to a jail (jail_attach, jail_attach_jd, and sometimes jail_set). Reviewed by: kib, markj Differential Revision: https://reviews.freebsd.org/D57858 (cherry picked from commit d4e0f4dab2d7f4de46bb79db1ca7e6e8a2e34746) --- sys/kern/kern_jail.c | 72 +++++++++++--- tests/sys/kern/Makefile | 2 + tests/sys/kern/jail_thread.c | 231 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 294 insertions(+), 11 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 8a6c3e1d3fd0..6b0ae8fbb8ce 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -155,6 +155,8 @@ int lastdeadid = 0; static int get_next_prid(struct prison **insprp); static int get_next_deadid(struct prison **insprp); static int do_jail_attach(struct thread *td, struct prison *pr, int *drflagsp); +static int prison_attach_thread_single(struct thread *td); +static void prison_attach_thread_single_end(struct thread *td); static void prison_complete(void *context, int pending); static void prison_deref(struct prison *pr, int flags); static void prison_deref_kill(struct prison *pr, struct prisonlist *freeprison); @@ -1045,7 +1047,13 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) if ((flags & (JAIL_USE_DESC | JAIL_AT_DESC)) == (JAIL_USE_DESC | JAIL_AT_DESC)) return (EINVAL); - prison_hold(mypr); + + /* Only let a single thread in the process try to attach at a time. */ + if (flags & JAIL_ATTACH) { + error = prison_attach_thread_single(td); + if (error != 0) + return (error); + } #ifdef INET ip4 = NULL; @@ -1056,6 +1064,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) g_path = NULL; jfp_out = NULL; jfd_out = -1; + prison_hold(mypr); /* * Check all the parameters before committing to anything. Not all * errors can be caught early, but we may as well try. Also, this @@ -2342,6 +2351,8 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) if (opts != NULL) vfs_freeopts(opts); prison_free(mypr); + if (flags & JAIL_ATTACH) + prison_attach_thread_single_end(td); return (error); } @@ -2940,6 +2951,10 @@ sys_jail_attach(struct thread *td, struct jail_attach_args *uap) error = priv_check(td, PRIV_JAIL_ATTACH); if (error) return (error); + /* Only let a single thread in the process try to attach at a time. */ + error = prison_attach_thread_single(td); + if (error != 0) + return (error); sx_slock(&allprison_lock); drflags = PD_LIST_SLOCKED; @@ -2960,6 +2975,7 @@ sys_jail_attach(struct thread *td, struct jail_attach_args *uap) done: prison_deref(pr, drflags); + prison_attach_thread_single_end(td); return (error); } @@ -2975,6 +2991,11 @@ sys_jail_attach_jd(struct thread *td, struct jail_attach_jd_args *uap) struct ucred *jdcred; int drflags, error; + /* Only let a single thread in the process try to attach at a time. */ + error = prison_attach_thread_single(td); + if (error != 0) + return (error); + sx_slock(&allprison_lock); drflags = PD_LIST_SLOCKED; pr = NULL; @@ -2997,6 +3018,7 @@ sys_jail_attach_jd(struct thread *td, struct jail_attach_jd_args *uap) done: prison_deref(pr, drflags); + prison_attach_thread_single_end(td); return (error); } @@ -3014,15 +3036,6 @@ do_jail_attach(struct thread *td, struct prison *pr, int *drflagsp) sx_assert(&allprison_lock, SX_LOCKED); KASSERT(prison_isvalid(pr), ("Attaching to invalid prison %p", pr)); - /* - * XXX: Note that there is a slight race here if two threads - * in the same privileged process attempt to attach to two - * different jails at the same time. It is important for - * user processes not to do this, or they might end up with - * a process root from one prison, but attached to the jail - * of another. - */ - /* * Note the caller's locking state, but gain and track our own * references. The caller will see that locks have been @@ -3105,7 +3118,7 @@ do_jail_attach(struct thread *td, struct prison *pr, int *drflagsp) e_unlock: VOP_UNLOCK(pr->pr_root); e_revert_osd: - /* Tell modules this thread is still in its old jail after all. */ + /* Tell modules this process is still in its old jail after all. */ if (!(drflags & (PD_LIST_SLOCKED | PD_LIST_XLOCKED))) { sx_slock(&allprison_lock); drflags |= PD_LIST_SLOCKED; @@ -3115,6 +3128,43 @@ do_jail_attach(struct thread *td, struct prison *pr, int *drflagsp) return (error); } +/* + * Only one thread in a process should try to attach to a jail, or + * they might end up with a process root from one prison, but attached + * to the jail of another. Enforce this by making the process run in + * single-threaded mode for the duration of the system call, which + * also prevents other related calls such as chroot. + */ +static int +prison_attach_thread_single(struct thread *td) +{ + struct proc *p; + int error; + + error = 0; + p = td->td_proc; + if ((atomic_load_int(&p->p_flag) & P_HADTHREADS) != 0) { + PROC_LOCK(p); + if (thread_single(p, SINGLE_BOUNDARY)) + error = ERESTART; + PROC_UNLOCK(p); + } + return (error); +} + +static void +prison_attach_thread_single_end(struct thread *td) +{ + struct proc *p; + + p = td->td_proc; + if ((atomic_load_int(&p->p_flag) & P_HADTHREADS) != 0) { + PROC_LOCK(p); + thread_single_end(p, SINGLE_BOUNDARY); + PROC_UNLOCK(p); + } +} + /* * Returns a locked prison instance, or NULL on failure. */ diff --git a/tests/sys/kern/Makefile b/tests/sys/kern/Makefile index 4fe194771f56..03aca4f19a56 100644 --- a/tests/sys/kern/Makefile +++ b/tests/sys/kern/Makefile @@ -24,6 +24,7 @@ ATF_TESTS_C+= exterr_test ATF_TESTS_C+= fdgrowtable_test ATF_TESTS_C+= getdirentries_test ATF_TESTS_C+= jail_lookup_root +ATF_TESTS_C+= jail_thread ATF_TESTS_C+= jaildesc ATF_TESTS_C+= inotify_test ATF_TESTS_C+= kill_zombie @@ -96,6 +97,7 @@ PROGS+= sendfile_helper LIBADD.aslr+= util LIBADD.copy_file_range+= md LIBADD.jail_lookup_root+= jail util +LIBADD.jail_thread+= jail pthread LIBADD.jaildesc+= kvm pthread CFLAGS.sys_getrandom+= -I${SRCTOP}/sys/contrib/zstd/lib LIBADD.sys_getrandom+= zstd diff --git a/tests/sys/kern/jail_thread.c b/tests/sys/kern/jail_thread.c new file mode 100644 index 000000000000..1af25f12386d --- /dev/null +++ b/tests/sys/kern/jail_thread.c @@ -0,0 +1,231 @@ +/*- + * SPDX-License-Identifier: BSD-2-Clause + * + * Copyright (c) 2026 James Gritton + */ + +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include + +#include + +#define NJAILS 3 /* One master jail and two to race. */ +#define NROUNDS 10000 /* Number of attempts to make race happen. */ + +struct jailinfo { + int jfd; + ino_t ino; + char path[MAXPATHLEN]; +}; + +static pthread_barrier_t barrier; +static struct jailinfo jinfo[NJAILS]; + +/* Attach a thread to a jail with jail_attach_jd. */ +static void * +thread_jail_attach_jd(void *arg) +{ + int error; + + /* + * Synchronize to get as close as possible to the same time, + * then attach to a jail. + */ + error = pthread_barrier_wait(&barrier); + ATF_REQUIRE_MSG(error == 0 || error == PTHREAD_BARRIER_SERIAL_THREAD, + "pthread_barrier_wait: %s", strerror(errno)); + ATF_REQUIRE_MSG(jail_attach_jd(jinfo[(size_t)arg].jfd) == 0, + "jail_attach_jd: %s", strerror(errno)); + return (NULL); +} + +/* Attach a thread to a jail with jail_setv. */ +static void * +thread_jail_setv(void *arg) +{ + int error; + char jdescstr[16]; + + error = pthread_barrier_wait(&barrier); + ATF_REQUIRE_MSG(error == 0 || error == PTHREAD_BARRIER_SERIAL_THREAD, + "pthread_barrier_wait: %s", strerror(errno)); + snprintf(jdescstr, sizeof(jdescstr), "%d", jinfo[(size_t)arg].jfd); + ATF_REQUIRE_MSG(jail_setv(JAIL_UPDATE | JAIL_ATTACH | JAIL_USE_DESC, + "desc", jdescstr, NULL) > 0, + "jail_setv: %s", jail_errmsg[0] ? jail_errmsg : strerror(errno)); + return (NULL); +} + +/* Attach a thread to a jail with chroot. */ +static void * +thread_chroot(void *arg) +{ + int error; + + /* This is a race between jail_attach and chroot. */ + if ((size_t)arg > 1) + return thread_jail_attach_jd(arg); + error = pthread_barrier_wait(&barrier); + ATF_REQUIRE_MSG(error == 0 || error == PTHREAD_BARRIER_SERIAL_THREAD, + "pthread_barrier_wait: %s", strerror(errno)); + ATF_REQUIRE_MSG(chroot(jinfo[(size_t)arg].path) == 0 || errno == ENOENT, + "chroot: %s", strerror(errno)); + return (NULL); +} + +static void +thread_attach_test(void *(*thread_handler)(void*), const char *jail_name, + const char *syscall_name, bool jail_reset) +{ + int ri, spn, mixed_jails; + size_t ji, ti, ji_hostname, ji_ino, jail_namelen; + char *cwd; + struct stat st; + char jnamestr[64], jdescstr[16]; + pthread_t threads[NJAILS]; + + if (jinfo[0].jfd == 0) { + /* Start with a master jail, so we can return to real root. */ + jdescstr[0] = '\0'; + ATF_REQUIRE_MSG(jail_setv(JAIL_CREATE | JAIL_OWN_DESC, + "name", jail_name, + "path", "/", + "desc", jdescstr, + "persist", "true", + NULL) > 0, + "jail_setv jail 0: %s", + jail_errmsg[0] ? jail_errmsg : strerror(errno)); + jinfo[0].jfd = strtol(jdescstr, NULL, 10); + /* Make enough jails to cause contention. */ + cwd = getcwd(NULL, MAXPATHLEN); + ATF_REQUIRE_MSG(cwd != NULL, "getcwd: %s", strerror(errno)); + for (ji = 1; ji < NJAILS; ++ji) { + snprintf(jnamestr, sizeof(jnamestr), + "%s%zu", jail_name, ji); + spn = snprintf(jinfo[ji].path, MAXPATHLEN, + "%s/jail%zu", cwd, ji); + ATF_REQUIRE_MSG((size_t)spn < MAXPATHLEN, + "snprintf exceeded MAXPATHLEN: %d", spn); + ATF_REQUIRE_MSG( + mkdir(jinfo[ji].path, 0755) == 0 || errno == EEXIST, + "mkdir %s: %s", jinfo[ji].path, strerror(errno)); + ATF_REQUIRE_MSG(stat(jinfo[ji].path, &st) == 0, + "stat %s: %s", jinfo[ji].path, strerror(errno)); + jinfo[ji].ino = st.st_ino; + jdescstr[0] = '\0'; + ATF_REQUIRE_MSG(jail_setv(JAIL_CREATE | JAIL_OWN_DESC, + "name", jnamestr, + "host.hostname", jnamestr, + "path", jinfo[ji].path, + "desc", jdescstr, + "persist", "true", + NULL) > 0, + "jail_setv: %s", + jail_errmsg[0] ? jail_errmsg : strerror(errno)); + jinfo[ji].jfd = strtol(jdescstr, NULL, 10); + } + } else + ATF_REQUIRE_MSG(jail_attach_jd(jinfo[0].jfd) == 0, + "jail_attach_jd: %s", strerror(errno)); + + /* Check the different system calls that can race. */ + jail_namelen = strlen(jail_name); + mixed_jails = 0; + for (ri = 0; ri < NROUNDS; ++ri) { + ATF_REQUIRE_MSG( + pthread_barrier_init(&barrier, NULL, NJAILS - 1) == 0, + "pthread_barrier_init: %s", strerror(errno)); + for (ti = 1; ti < NJAILS; ++ti) + ATF_REQUIRE_MSG( + pthread_create(&threads[ti], NULL, thread_handler, + (void*)ti) == 0, + "pthread_create: %s", strerror(errno)); + for (ti = 1; ti < NJAILS; ++ti) + ATF_REQUIRE_MSG( + pthread_join(threads[ti], NULL) == 0, + "pthread_join: %s", strerror(errno)); + ATF_REQUIRE_MSG(pthread_barrier_destroy(&barrier) == 0, + "pthread_barrier_destroy: %s", strerror(errno)); + /* + * Find the current jail from the hostname, and also + * by the root inode. They should be the same. + */ + ATF_REQUIRE_MSG( + gethostname(jnamestr, sizeof(jnamestr)) == 0, + "gethostname: %s", strerror(errno)); + ATF_REQUIRE_MSG(strncmp(jnamestr, jail_name, jail_namelen) == 0, + "unexpected jail hostname %s", jnamestr); + ji_hostname = strtol(jnamestr + jail_namelen, NULL, 10); + ATF_REQUIRE_MSG(stat("/", &st) == 0, + "stat /: %s", strerror(errno)); + for (ji_ino = 1; ji_ino < NJAILS; ++ji_ino) + if (jinfo[ji_ino].ino == st.st_ino) + break; + ATF_REQUIRE_MSG(ji_ino < NJAILS, + "unexpected jail root inode %lu", + (unsigned long)st.st_ino); + mixed_jails += ji_hostname != ji_ino; + /* Reset to the master jail, required for chroot. */ + if (jail_reset) + ATF_REQUIRE_MSG(jail_attach_jd(jinfo[0].jfd) == 0, + "jail_attach_jd: %s", strerror(errno)); + } + /* It's an error if any of the rounds had a mismatch. */ + ATF_REQUIRE_MSG(mixed_jails == 0, + "%d of %d %s races with different root and " + "credentials", mixed_jails, NROUNDS, syscall_name); +} + +#define JAIL_NAME "jail_thread_attach_test" + + +ATF_TC(jail_thread_attach); +ATF_TC_HEAD(jail_thread_attach, tc) +{ + atf_tc_set_md_var(tc, "require.user", "root"); +} +ATF_TC_BODY(jail_thread_attach, tc) +{ + thread_attach_test(thread_jail_attach_jd, + "jail_thread_attach_test", "jail_attach_jd", false); +} + +ATF_TC(jail_thread_attach_jail_set); +ATF_TC_HEAD(jail_thread_attach_jail_set, tc) +{ + atf_tc_set_md_var(tc, "require.user", "root"); +} +ATF_TC_BODY(jail_thread_attach_jail_set, tc) +{ + thread_attach_test(thread_jail_setv, + "jail_thread_attach_test_jail_set", "jail_set", false); +} + +ATF_TC(jail_thread_attach_chroot); +ATF_TC_HEAD(jail_thread_attach_chroot, tc) +{ + atf_tc_set_md_var(tc, "require.user", "root"); +} +ATF_TC_BODY(jail_thread_attach_chroot, tc) +{ + thread_attach_test(thread_chroot, + "jail_thread_attach_test_chroot", "chroot", true); +} + +ATF_TP_ADD_TCS(tp) +{ + ATF_TP_ADD_TC(tp, jail_thread_attach); + ATF_TP_ADD_TC(tp, jail_thread_attach_jail_set); + ATF_TP_ADD_TC(tp, jail_thread_attach_chroot); + return (atf_no_error()); +} From nobody Sun Jul 5 05:13:46 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gtFyL4WR1z6jnfx for ; Sun, 05 Jul 2026 05:13:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gtFyL37cHz3LNN for ; Sun, 05 Jul 2026 05:13:46 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783228426; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5iaIyXKfvD6v9+W00e0oT5QbifaPQrgIrCapwcElGU4=; b=eVisfNvDA6h1+LJG/ncV9t/8T7h7gvA4Vg+pfEzPTCtx/HkK4vHtTkLl8ru02eTTQ4ec+h w1O3DYOvtx6+iXbn3yZNLBbOf2EfUz60FpeQaClcizogKDzpn5iIH5EA4aOgSMQyV2nhRe UGjBjIPIwwQ6EMri0qB0+ATz2DrNmnMpVE7AZyrBur0qWQkeIPcReer08qRYtFlv1tbwcy kW+8BFjE+yL05gXSGf1DXvh8X23ctEqtmdQcdp9S9mo5xH8gggMzgbkKfGLNxm6nCQEfG3 M+dJ+YW2fDyewH1M1B5CM4VNoI9mbssdhzsy+hG7x97hlQqqffImovQeY+Hzxg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783228426; a=rsa-sha256; cv=none; b=fxB1u7pWDbn16T8R5ja4n2vxvnxj3pZoPwrTucgH9cVXNr1HTUzrM07Qv5EW19wKGisXvt 1LTbni9LQ9BJbtTTWbvfSpk81SDTRTFnD8BfPKWEt1dDxWLy9h5D8Ts/nJcwVulUCyg0vz WEj4fx4aZwAqGQ2h+L196keQxjMZqKu3JWb4GiQCRGk4dpqxhD+GMT1JKWL34Smb2v0bRA cK23rXatTwW2uYpe/VWDErP7knYy1Pp7oIkxmYstRf0piotIgq1V4ZRSjyI+9yfAeCXPA3 Dxk4WKPcXglpFoAIwlzK+5lwE+T+JW8i0El3muhj9Nq/atbuQET2FHM24zlQTA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783228426; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5iaIyXKfvD6v9+W00e0oT5QbifaPQrgIrCapwcElGU4=; b=skFHJBQaU+bwQASHvE0Uq1PSYi30XcM+7YRpmhMzQH65B7UrF8cFA3Yvxstc5cfEiFEH3G gzDM9I/tzqEmFf6qp7eKVsCmF4oTsnnnfMR19P+rH8UrCk6aWjITIMIDa+2xt4j+u5LiN8 6u6KAxInTpTpbAEFGiFQJY0bTa+pM+d0kAYguJhue6VTdW6vIJEEg8c2JnJlkCuTkzTqu4 5b1lFQglcR9S+Q3x5PI64yaq6TZv3qZvCjSq5hknCEAse+50ujTIOO62h6beItsbgLt8uI 40db/ODfYgDV+9jN/XrZf3cQzkB79boDfqSwFtMBp+3BLqQHug1cll5Te+Y2ig== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gtFyL2Bmkz1499 for ; Sun, 05 Jul 2026 05:13:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 239e6 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 05 Jul 2026 05:13:46 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Jamie Gritton Subject: git: 334c8ba7dd9c - stable/14 - jail: call PR_METHOD_ATTACH again (with old jail) if the first call fails List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jamie X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 334c8ba7dd9c8dcb2322132cd927f2520126d820 Auto-Submitted: auto-generated Date: Sun, 05 Jul 2026 05:13:46 +0000 Message-Id: <6a49e80a.239e6.6721bfc0@gitrepo.freebsd.org> The branch stable/14 has been updated by jamie: URL: https://cgit.FreeBSD.org/src/commit/?id=334c8ba7dd9c8dcb2322132cd927f2520126d820 commit 334c8ba7dd9c8dcb2322132cd927f2520126d820 Author: Jamie Gritton AuthorDate: 2026-06-19 19:45:27 +0000 Commit: Jamie Gritton CommitDate: 2026-07-05 03:09:16 +0000 jail: call PR_METHOD_ATTACH again (with old jail) if the first call fails jail_attach lets modules do attachment-specific work by calling osd_jail_call(PR_METHOD_ATTACH). If one of the modules returns an error, the call needs to be repeated with the thread's current prison, so possible earlier modules and undo any changes they may have made. (cherry picked from commit e91e8ebefadcce9d57c8ff945ff70050cbbe1ce1) --- sys/kern/kern_jail.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 786a4d804115..a18da4472947 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -2680,10 +2680,8 @@ do_jail_attach(struct thread *td, struct prison *pr, int drflags) /* Let modules do whatever they need to prepare for attaching. */ error = osd_jail_call(pr, PR_METHOD_ATTACH, td); - if (error) { - prison_deref(pr, drflags); - return (error); - } + if (error) + goto e_revert_osd; sx_unlock(&allprison_lock); drflags &= ~(PD_LIST_SLOCKED | PD_LIST_XLOCKED); @@ -2748,8 +2746,10 @@ do_jail_attach(struct thread *td, struct prison *pr, int drflags) VOP_UNLOCK(pr->pr_root); e_revert_osd: /* Tell modules this thread is still in its old jail after all. */ - sx_slock(&allprison_lock); - drflags |= PD_LIST_SLOCKED; + if (!(drflags & (PD_LIST_SLOCKED | PD_LIST_XLOCKED))) { + sx_slock(&allprison_lock); + drflags |= PD_LIST_SLOCKED; + } (void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td); prison_deref(pr, drflags); return (error); From nobody Sun Jul 5 05:13:47 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gtFyM743Kz6jnlV for ; Sun, 05 Jul 2026 05:13:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gtFyM4Sxtz3Ldm for ; Sun, 05 Jul 2026 05:13:47 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783228427; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Cgf0E2+GswWYuxtbF8UGuq3Kr1vH5rndt1Gf4exGgcc=; b=lzndOoMTG+quIKW4+vcndXO8g3wO/50mtSS+OwvHYlWkXWjMuOWzBaXu23TQzZbinWgwOn YSP8Daf2uWId6VcxVRwWzvL2gnu3xf/UPdPRou+fm+yQAQ24Ijgl6RW3TNpS1I3uaZMdHc ENk2Qo6yUBx/JqXfNNusftO9A1AnCSndqiSU10cAx2RoIF462nGDbRJ1GtfXccv7JSyin3 PMnGxiExLbgDpsdg5/DbfL8HTZo6UBmsFPVTbbejhfa1GLyMZTDoWSoPpVBHUPBoeZ09Sk 9ko/d2JP4Yug51nGz/hSx2Tepd6DvjzOwIKfTEUEO2tleBBfY2m+TbDDyimnJA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783228427; a=rsa-sha256; cv=none; b=fEAcaB8kZ8VYkNyMUEzxxdGaTtA1V5URIT225ONYsFydQwt1sEHkxY/mPHFg5hI93bzhNv 0S+z1w73EPeRS8WYpPW90BVqnX9VyBsq4TCi9Qx4ka6LTwIsCR17yEPfRQBG1HeZmr+g+U k8ZjvtqKHou/VGWk0wgkQLZoCh8IUZfyDrqyJzqrL9p9K0Xim9oZrCZ32e0X+v5eKJ0hmd qUnf6Dm5QSZd6elmT83yEtAnxqKPCkFBxWWBTjS2GvO+RkJkuHH6dTlIPZEPipi7/n48nm d3dMAcWBawNCtZaV+qqgrH14gogx3uC6s6A+KLyn0EA6HfRlfXsLQiV6deBhBw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783228427; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Cgf0E2+GswWYuxtbF8UGuq3Kr1vH5rndt1Gf4exGgcc=; b=lznOSYPS9LnV/gN3fxJq5511JqOF/4Q6Rg2IVxwZwRQsHAcBU7lU9NDV1ygNN2/f6wjddJ JPF3uclsf45PO2xhAhLu/0ewPDFeKpP+mCl00XNSavziHeAthqJE6A0LgbkF6ZEJs6YOqB 4400VFMHzG+2J3DomfsVvuGjUNSYlyJ6/a1FvAFC8ZZRPZKiVoWC+Kwq2vl50aYlzUWSLQ 7G0QghuouYZYItQ7p5yryFw8/sqtc/9tvXVq+vq8SI7sgeSm3doiaj1I6ENH33EVxjCadd UQft2xDhR/u60lA0bw2Av1Uz+r5L3hA2Js0ChrrVTCp8MpmpPP0DeYDXJyrbIA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gtFyM32wWz13JZ for ; Sun, 05 Jul 2026 05:13:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22a25 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 05 Jul 2026 05:13:47 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Jamie Gritton Subject: git: 530ee2980c50 - stable/14 - jail: clean up locking around do_jail_attach List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jamie X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 530ee2980c50d3639e01e21a7fed64eed2741ebf Auto-Submitted: auto-generated Date: Sun, 05 Jul 2026 05:13:47 +0000 Message-Id: <6a49e80b.22a25.226d169f@gitrepo.freebsd.org> The branch stable/14 has been updated by jamie: URL: https://cgit.FreeBSD.org/src/commit/?id=530ee2980c50d3639e01e21a7fed64eed2741ebf commit 530ee2980c50d3639e01e21a7fed64eed2741ebf Author: Jamie Gritton AuthorDate: 2026-06-25 03:21:18 +0000 Commit: Jamie Gritton CommitDate: 2026-07-05 03:26:04 +0000 jail: clean up locking around do_jail_attach jail_attach_jd passed PD_DEREF to do_jail_attach, assuming it would take care of freeing the held prison. This is not true, as do_jail_attach immediately cleared that flag, leaving the jail stock in dying state when it is later removed. Reported by: markj Reviewed by: markj Differential Revision: (cherry picked from commit 3584cde63e416d150214192721cead4b735ca0b5) --- sys/kern/kern_jail.c | 57 ++++++++++++++++++++++++++++++++++------------------ 1 file changed, 38 insertions(+), 19 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index a18da4472947..f40e7c4e176c 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -149,7 +149,7 @@ LIST_HEAD(, prison_racct) allprison_racct; int lastprid = 0; static int get_next_prid(struct prison **insprp); -static int do_jail_attach(struct thread *td, struct prison *pr, int drflags); +static int do_jail_attach(struct thread *td, struct prison *pr, int *drflagsp); static void prison_complete(void *context, int pending); static void prison_deref(struct prison *pr, int flags); static void prison_deref_kill(struct prison *pr, struct prisonlist *freeprison); @@ -2134,11 +2134,12 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) pr->pr_state = PRISON_STATE_ALIVE; } - /* Attach this process to the prison if requested. */ + /* + * Attach this process to the prison if requested. This will + * unlock allprison_lock, meaning changes are now user-visible. + */ if (flags & JAIL_ATTACH) { - error = do_jail_attach(td, pr, - prison_lock_xlock(pr, drflags & PD_LOCK_FLAGS)); - drflags &= ~(PD_LOCKED | PD_LIST_XLOCKED); + error = do_jail_attach(td, pr, &drflags); if (error) { vfs_opterror(opts, "attach failed"); goto done_deref; @@ -2631,39 +2632,48 @@ int sys_jail_attach(struct thread *td, struct jail_attach_args *uap) { struct prison *pr; - int error; + int drflags, error; error = priv_check(td, PRIV_JAIL_ATTACH); if (error) return (error); sx_slock(&allprison_lock); + drflags = PD_LIST_SLOCKED; pr = prison_find_child(td->td_ucred->cr_prison, uap->jid); if (pr == NULL) { - sx_sunlock(&allprison_lock); - return (EINVAL); + error = EINVAL; + goto done; } + drflags |= PD_LOCKED; /* Do not allow a process to attach to a prison that is not alive. */ if (!prison_isalive(pr)) { - mtx_unlock(&pr->pr_mtx); - sx_sunlock(&allprison_lock); - return (EINVAL); + error = EINVAL; + goto done; } - return (do_jail_attach(td, pr, PD_LOCKED | PD_LIST_SLOCKED)); + error = do_jail_attach(td, pr, &drflags); + + done: + prison_deref(pr, drflags); + return (error); } +/* + * Attach the current process to a prison. On entry, the allprison + * lock should be at least shared. On exit, both it and the prison + * itself will be unlocked, which will be refelected in *drflagsp. + */ static int -do_jail_attach(struct thread *td, struct prison *pr, int drflags) +do_jail_attach(struct thread *td, struct prison *pr, int *drflagsp) { struct proc *p; struct ucred *newcred, *oldcred; - int error; + int drflags, error; - mtx_assert(&pr->pr_mtx, MA_OWNED); sx_assert(&allprison_lock, SX_LOCKED); - drflags &= PD_LOCK_FLAGS; + KASSERT(prison_isvalid(pr), ("Attaching to invalid prison %p", pr)); /* * XXX: Note that there is a slight race here if two threads * in the same privileged process attempt to attach to two @@ -2672,13 +2682,22 @@ do_jail_attach(struct thread *td, struct prison *pr, int drflags) * a process root from one prison, but attached to the jail * of another. */ + + /* + * Note the caller's locking state, but gain and track our own + * references. The caller will see that locks have been + * dropped (which isn't true now, but will be after OSD calls). + */ prison_hold(pr); refcount_acquire(&pr->pr_uref); - drflags |= PD_DEREF | PD_DEUREF; - mtx_unlock(&pr->pr_mtx); - drflags &= ~PD_LOCKED; + drflags = PD_DEREF | PD_DEUREF | (*drflagsp & PD_LOCK_FLAGS); + *drflagsp &= PD_OP_FLAGS; /* Let modules do whatever they need to prepare for attaching. */ + if (drflags & PD_LOCKED) { + mtx_unlock(&pr->pr_mtx); + drflags &= ~PD_LOCKED; + } error = osd_jail_call(pr, PR_METHOD_ATTACH, td); if (error) goto e_revert_osd; From nobody Sun Jul 5 05:13:48 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gtFyP19tLz6jnjK for ; Sun, 05 Jul 2026 05:13:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gtFyN57tMz3LY9 for ; Sun, 05 Jul 2026 05:13:48 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783228428; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dHY08cogkfn8IxmXn8OVwwNNruVlUB5+IVrJKhRcNyY=; b=sqpFqSeW6Qmiwe4isWCGD5n0veIuFLqgh+HAdAPf5KEYShSuW5u45TTI6vfUxIxA9xFA0g 55PQt9Av4KmFkXepoUjg2CjH9FXNXiqlB3IyxzIl7aa9K6njmfWkNy+TLvqMM9Va9qwXdD p6qwBv6BTukuHXvuPGWSd1dCryTnSGYQ/ZLG6VxFPWysPGvcIrd08VRQzaXQ6Gpii1r6qq C1dZHJT82U/RF2LgwF42DYFxwlCHpvDpQ5TYmLxe/wnz4KG9rCFoiIuu0aBuTLFbP9rWh7 JZTwpVes9WvpKyJjVvQl++06dQm0AMAV5dLmLiUMyKZiEP8ci4uQeVl094HKqA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783228428; a=rsa-sha256; cv=none; b=mLq6i5oKSeprzJflwC641ZPZDmzD3ztDtawqFXSRJ/GxQTR5tVrci8XEf0wQdrVb3ioejl iA3biVnC5Aar+7EoEM1h97DZSbIVSJN/muj4QiaIJKWs5D7V+CNCiSfXznyuaveJCDrnag 3b7QFUpNlifX9DYccOeoypy6iOUZQiauNjNWLIeNuJc5XPwLbz8JKoGvOmNG/nWT5YM4x4 V7NxFZIgDTbLUcbAkvv7S2x0h1YSxbmwB8CbrycwXwg9yzuUCus0bEQN7aoLydGKS1ki5d D07342iTNPDcpREiZr2uKotV9a3DTybHCoiQAIfDWo3LCsdlO3s9YX4za4/OYg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783228428; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dHY08cogkfn8IxmXn8OVwwNNruVlUB5+IVrJKhRcNyY=; b=PHawLlZGUwU0KPn4S0l72FhIPCZuMNnbqQLiaiolF2NdV14Cn4XPs8846ynfrRdR5cDw4K KT7G3Wox++t9qiUO/YIw0+Oo/5PbKlG7PveGe7EyPo4RqL45xgE6YDamEbfCFdOMm7pYzG VhuNfBmNv9/XCVXX6wt0n0q06VF7d3e1h1CyrxHTfcKKYza01KeJNCLrDraSQ47s3Xxdeh 9hvBG3yaHiSpDz0xyeCeHVxhVhzYtUllNNKP54w0K9V9OflFmmAl1vX4QSMpJTg6qfYuc3 egUlIpLK79ssaEiWB0bB6F8MXfvNmMCW62TgQSM8p/ZxXN3NrRvNKM3V2jKOlg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gtFyN3vWFz142j for ; Sun, 05 Jul 2026 05:13:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22848 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 05 Jul 2026 05:13:48 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Jamie Gritton Subject: git: 5ba2b4f773c2 - stable/14 - jail: prevent a race between jail_attach in different threads List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jamie X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 5ba2b4f773c27f139ce840ca93b7c5dad83d1984 Auto-Submitted: auto-generated Date: Sun, 05 Jul 2026 05:13:48 +0000 Message-Id: <6a49e80c.22848.48d188d3@gitrepo.freebsd.org> The branch stable/14 has been updated by jamie: URL: https://cgit.FreeBSD.org/src/commit/?id=5ba2b4f773c27f139ce840ca93b7c5dad83d1984 commit 5ba2b4f773c27f139ce840ca93b7c5dad83d1984 Author: Jamie Gritton AuthorDate: 2026-07-02 22:48:07 +0000 Commit: Jamie Gritton CommitDate: 2026-07-05 05:13:27 +0000 jail: prevent a race between jail_attach in different threads Attaching to a jail changes its root directory and its process credentials. These operations both require unlocking the jail, and also need allprison_lock unlocked. That means that if two threads are trying to attach to different jails at the same time, it's possible for the process to end up with one jail's root directory but the other jail's credentials. Solve this by forcing the process into single-threaded mode during system calls that attach to a jail (jail_attach, jail_attach_jd, and sometimes jail_set). Reviewed by: kib, markj Differential Revision: https://reviews.freebsd.org/D57858 (cherry picked from commit d4e0f4dab2d7f4de46bb79db1ca7e6e8a2e34746) --- sys/kern/kern_jail.c | 87 ++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 67 insertions(+), 20 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index f40e7c4e176c..5063410e63b1 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -150,6 +150,8 @@ int lastprid = 0; static int get_next_prid(struct prison **insprp); static int do_jail_attach(struct thread *td, struct prison *pr, int *drflagsp); +static int prison_attach_thread_single(struct thread *td); +static void prison_attach_thread_single_end(struct thread *td); static void prison_complete(void *context, int pending); static void prison_deref(struct prison *pr, int flags); static void prison_deref_kill(struct prison *pr, struct prisonlist *freeprison); @@ -1032,6 +1034,20 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) if (flags & ~JAIL_SET_MASK) return (EINVAL); + /* Only let a single thread in the process try to attach at a time. */ + if (flags & JAIL_ATTACH) { + error = prison_attach_thread_single(td); + if (error != 0) + return (error); + } + +#ifdef INET + ip4 = NULL; +#endif +#ifdef INET6 + ip6 = NULL; +#endif + g_path = NULL; /* * Check all the parameters before committing to anything. Not all * errors can be caught early, but we may as well try. Also, this @@ -1043,15 +1059,10 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) * than duplicate it under a different name. */ error = vfs_buildopts(optuio, &opts); - if (error) - return (error); -#ifdef INET - ip4 = NULL; -#endif -#ifdef INET6 - ip6 = NULL; -#endif - g_path = NULL; + if (error) { + opts = NULL; + goto done_free; + } cuflags = flags & (JAIL_CREATE | JAIL_UPDATE); if (!cuflags) { @@ -2203,7 +2214,10 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) #endif if (g_path != NULL) free(g_path, M_TEMP); - vfs_freeopts(opts); + if (opts != NULL) + vfs_freeopts(opts); + if (flags & JAIL_ATTACH) + prison_attach_thread_single_end(td); return (error); } @@ -2637,6 +2651,10 @@ sys_jail_attach(struct thread *td, struct jail_attach_args *uap) error = priv_check(td, PRIV_JAIL_ATTACH); if (error) return (error); + /* Only let a single thread in the process try to attach at a time. */ + error = prison_attach_thread_single(td); + if (error != 0) + return (error); sx_slock(&allprison_lock); drflags = PD_LIST_SLOCKED; @@ -2657,6 +2675,7 @@ sys_jail_attach(struct thread *td, struct jail_attach_args *uap) done: prison_deref(pr, drflags); + prison_attach_thread_single_end(td); return (error); } @@ -2674,15 +2693,6 @@ do_jail_attach(struct thread *td, struct prison *pr, int *drflagsp) sx_assert(&allprison_lock, SX_LOCKED); KASSERT(prison_isvalid(pr), ("Attaching to invalid prison %p", pr)); - /* - * XXX: Note that there is a slight race here if two threads - * in the same privileged process attempt to attach to two - * different jails at the same time. It is important for - * user processes not to do this, or they might end up with - * a process root from one prison, but attached to the jail - * of another. - */ - /* * Note the caller's locking state, but gain and track our own * references. The caller will see that locks have been @@ -2764,7 +2774,7 @@ do_jail_attach(struct thread *td, struct prison *pr, int *drflagsp) e_unlock: VOP_UNLOCK(pr->pr_root); e_revert_osd: - /* Tell modules this thread is still in its old jail after all. */ + /* Tell modules this process is still in its old jail after all. */ if (!(drflags & (PD_LIST_SLOCKED | PD_LIST_XLOCKED))) { sx_slock(&allprison_lock); drflags |= PD_LIST_SLOCKED; @@ -2774,6 +2784,43 @@ do_jail_attach(struct thread *td, struct prison *pr, int *drflagsp) return (error); } +/* + * Only one thread in a process should try to attach to a jail, or + * they might end up with a process root from one prison, but attached + * to the jail of another. Enforce this by making the process run in + * single-threaded mode for the duration of the system call, which + * also prevents other related calls such as chroot. + */ +static int +prison_attach_thread_single(struct thread *td) +{ + struct proc *p; + int error; + + error = 0; + p = td->td_proc; + if ((atomic_load_int(&p->p_flag) & P_HADTHREADS) != 0) { + PROC_LOCK(p); + if (thread_single(p, SINGLE_BOUNDARY)) + error = ERESTART; + PROC_UNLOCK(p); + } + return (error); +} + +static void +prison_attach_thread_single_end(struct thread *td) +{ + struct proc *p; + + p = td->td_proc; + if ((atomic_load_int(&p->p_flag) & P_HADTHREADS) != 0) { + PROC_LOCK(p); + thread_single_end(p, SINGLE_BOUNDARY); + PROC_UNLOCK(p); + } +} + /* * Returns a locked prison instance, or NULL on failure. */ From nobody Sun Jul 5 23:04:29 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gtjjp1SYLz6jg1V for ; Sun, 05 Jul 2026 23:04:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gtjjp0pQtz3Hgt for ; Sun, 05 Jul 2026 23:04:30 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783292670; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zmK6jAbACvS1REST/w5I451/91E/Z3EQ31KcNkCOF2E=; b=tUxYYLRyTqKIBojfnWl2hDorljlGTQy1gpQp9O7R16vXS7yIN+KNXaawEPQ0rcN5lCXyk9 rgG0i++RnlrzSdGb/YZiqN+tlscZBfVxWoo/6Nkh92LVi2YVQIZAWWrsQsZRwvtDjB03hf bt0p+OfLVuje0RCuOMmyGYnOux39EPdsQzOlWBsAy6lWq9Q2z43g8C4Xi+ihYMmJtfClpc CgZfHlV3n9SqOdwi5zEUNnG2a5z3LQnmrY+RooQNhFxemWGNGVEbgWqp9fCa2I+OvuPmLp DQsk6lGJM4fF2r97sA/n+q7nWOgsIqOOxPgl2rqSm9qlVSWWrkKuCyGLne3uig== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783292670; a=rsa-sha256; cv=none; b=Qo+vnLATLIHVZkfWNr4I8JKNDCexHbn7ZbhIKFuUxeIDpRqIEdxwNn+4GRyYqsx6R7Z7Af HD7e1p9J8/dTS1DcB5CshR09SGn44fi59RJ+9SzpcnQk1T6fd5WoxPtEUZPKXJfT+cuJQk Md5pygVjbhXtzRBJC8FjINsEiKzdCDw/2UiZYGo1hjwSTwtTSZj7IT8Ih/1m7oLe1Z320R 3VFekFAn599kPtChzr05x52M7H+ir7Fb6yE8LArlUqhKVbGOavAxRu37nHh9x9IM3NaOhv 3rDQEujrP2Qzab6AbLRKZJCfRF5uOwj+9COJV+jYvf91UnNMK6x93fIJoIinpg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783292670; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zmK6jAbACvS1REST/w5I451/91E/Z3EQ31KcNkCOF2E=; b=FBqYzKL/FK+GN6EsLt7GcweolySipe6JtY/yKcwpkLV/xBo3K6im7G17tloR5Gq+yD9mEW 5AcRlkvQALtZwS8IsKNGMl7JwHj9Dl6hvYYzsioa8xUAUy9apcMVeZFSFAsr9eGkmqTz68 BWiwCHNa8y+xwHH4Ss/lXG2kiD5Gjt403Kxs5A9XikmTNtx0Zmwzg8pKKr1LEldWElB76h YokcK6WjpVAtFKu0rWOI7qivScK/6O/Vgdyv+VFj2djqxT8zGJ2WGwcsNMcwTuMuFZce+a cLDbEkvGfnAJGhfHjJpuTervQg8v239P9XILQenVgXHDJAf5oBEvqFIzE4tM6w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gtjjn6mshzffs for ; Sun, 05 Jul 2026 23:04:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 247e3 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 05 Jul 2026 23:04:29 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Rick Macklem Subject: git: 0c48190463a5 - stable/15 - gss_impl.c: Fix a nfsd hang when the kgssapi.ko is loaded, but no gssd List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 0c48190463a5c895270be09c45b1471633ddd602 Auto-Submitted: auto-generated Date: Sun, 05 Jul 2026 23:04:29 +0000 Message-Id: <6a4ae2fd.247e3.17476bd2@gitrepo.freebsd.org> The branch stable/15 has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=0c48190463a5c895270be09c45b1471633ddd602 commit 0c48190463a5c895270be09c45b1471633ddd602 Author: Rick Macklem AuthorDate: 2026-06-21 23:15:23 +0000 Commit: Rick Macklem CommitDate: 2026-07-05 23:02:37 +0000 gss_impl.c: Fix a nfsd hang when the kgssapi.ko is loaded, but no gssd After the conversion to using netlink, the kgssapi had no way of knowing if the gssd daemon was running. As such, a boot where the kgssapi is loaded, but the gssd is not enabled would hang the nfsd for a very long time. (Many timeouts at 300sec each.) This patch adds a Null RPC upcall with a 200msec timeout to check to see if the gssd is running. If the gssd is not running, the nfsd starts up (without Kerberos support) with only a 200msec delay.) Also, move the svc_svc_nl_create() and svc_reg() calls in gssd.c to before the daemon() call, so they are guaranteed to have been done before the nfsd(8) daemon is started by the rc scripts. PR: 295714 (cherry picked from commit 455c354dd4dbba9b9ec9c68e335ab3aa46dca438) --- sys/kgssapi/gss_impl.c | 42 ++++++++++++++++++++++++++++++++++++++++-- usr.sbin/gssd/gssd.c | 22 +++++----------------- 2 files changed, 45 insertions(+), 19 deletions(-) diff --git a/sys/kgssapi/gss_impl.c b/sys/kgssapi/gss_impl.c index 97b85a034071..4c7147fc3879 100644 --- a/sys/kgssapi/gss_impl.c +++ b/sys/kgssapi/gss_impl.c @@ -57,6 +57,7 @@ static int kgss_load(void) { CLIENT *cl; + struct timeval nulltimo = {.tv_sec = 0, .tv_usec = 200000}; LIST_INIT(&kgss_mechs); @@ -65,13 +66,16 @@ kgss_load(void) /* * The transport default is no retries at all, since there could - * be no userland listener to our messages. We will retry for 5 + * be no userland listener to our messages. Initially, a short timeout + * is set, so that a Null RPC upcall will fail quickly if the daemon + * is not running. After the Null RPC succeeds, we will retry for 5 * minutes with 10 second interval. This will potentially cure hosts * with misconfigured startup, where kernel starts sending GSS queries * before userland had started up the gssd(8) daemon. + * The initial timeout of 200usec is for the Null RPC. */ clnt_control(cl, CLSET_RETRIES, &(int){30}); - clnt_control(cl, CLSET_TIMEOUT, &(struct timeval){.tv_sec = 300}); + clnt_control(cl, CLSET_TIMEOUT, &nulltimo); /* * We literally wait on gssd(8), let's see that in top(1). @@ -237,9 +241,43 @@ CLIENT * kgss_gssd_client(void) { CLIENT *cl; + struct rpc_callextra ext; + enum clnt_stat stat; + struct timeval rpctimo = {.tv_sec = 300, .tv_usec = 0}; + static time_t nextrpc = 0; + static bool done_upcall = false; mtx_lock(&kgss_gssd_lock); cl = kgss_gssd_handle; + if (!done_upcall) { + mtx_unlock(&kgss_gssd_lock); + /* + * Can only be NULL if client_nl_create() called from + * kgss_load() returns NULL. + */ + if (cl == NULL) + return (cl); + if (time_uptime < nextrpc) + return (NULL); + /* + * Do a Null RPC with a short timeout. If the RPC succeeds, + * the gssd daemon is running. If the Null RPC fails, don't + * again for 5sec. + */ + memset(&ext, 0, sizeof(ext)); + ext.rc_auth = authnone_create(); + stat = clnt_call_private(cl, &ext, NULLPROC, + (xdrproc_t)xdr_void, NULL, (xdrproc_t)xdr_void, NULL, + rpctimo); /* rpctimo is ignored by clnt_nl_call(). */ + AUTH_DESTROY(ext.rc_auth); + if (stat != RPC_SUCCESS) { + nextrpc = time_uptime + 5; + return (NULL); + } + CLNT_CONTROL(cl, CLSET_TIMEOUT, &rpctimo); + mtx_lock(&kgss_gssd_lock); + done_upcall = true; + } if (cl != NULL) CLNT_ACQUIRE(cl); mtx_unlock(&kgss_gssd_lock); diff --git a/usr.sbin/gssd/gssd.c b/usr.sbin/gssd/gssd.c index 54d2062dd29a..5a00dbdd7c97 100644 --- a/usr.sbin/gssd/gssd.c +++ b/usr.sbin/gssd/gssd.c @@ -167,6 +167,11 @@ main(int argc, char **argv) gssd_load_mech(); + if ((xprt = svc_nl_create("kgss")) == NULL) + errx(1, "Can't create transport for local gssd socket"); + if (!svc_reg(xprt, GSSD, GSSDVERS, gssd_1, NULL)) + errx(1, "Can't register service for local gssd socket"); + if (!debug_level) { if (daemon(0, 0) != 0) err(1, "Can't daemonize"); @@ -177,23 +182,6 @@ main(int argc, char **argv) signal(SIGTERM, gssd_terminate); signal(SIGPIPE, gssd_terminate); - if ((xprt = svc_nl_create("kgss")) == NULL) { - if (debug_level == 0) { - syslog(LOG_ERR, - "Can't create transport for local gssd socket"); - exit(1); - } - err(1, "Can't create transport for local gssd socket"); - } - if (!svc_reg(xprt, GSSD, GSSDVERS, gssd_1, NULL)) { - if (debug_level == 0) { - syslog(LOG_ERR, - "Can't register service for local gssd socket"); - exit(1); - } - err(1, "Can't register service for local gssd socket"); - } - LIST_INIT(&gss_resources); gss_next_id = 1; gss_start_time = time(0);