From nobody Wed Jul 29 17:48:40 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h9KZK6VNqz6mZkr for ; Wed, 29 Jul 2026 17:48:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h9KZJ6ctlz3hbQ for ; Wed, 29 Jul 2026 17:48:40 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785347320; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GRcsPf7EsLcsZtEMQK2qk9cKEOH8f8Rgy9YUEOkMvnA=; b=Fgh+/sfQP45/Atk4CR+C69De3XN08kaQQC/XJQygKe2qxp5Bks7xzwvlGSI6n33/Lit7ZT F09AHCotshp4uQJtBcFCZMT+AenyA/B5qwj7o7pgTxLjZmT2ZG87RUFmej4gVyMlmKwZLr EG6HxmM5VxryxHqNIYXvv6ZdT7SxfBwTOqZGJxBwD2UQMe503G1fDEG3FHpfhoTdMgRu8Y a/ObCw8tulJrCbLccvQeQg/DM9EDAXTWGghXS4Mo88u7k9kI1wJczai2ruUHok93JgyzIn 89MTaqd5x7H0MzWZGYal/46lE1BssRSeXSMaYHOvlIff2H5CnxANCupEbEP99A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785347320; a=rsa-sha256; cv=none; b=wtJ32zNk30mH5I7i8ryH887YWFFx3CVgttN4/6/fzJPbHW6833gGEwfbk4w6BJ3IUmBJPZ OarE5dpNU1RQCVS8kkDySLzAYM3kFfB16r5MlN4opLxcUE5twjYLUWNDNbFj2tP1Fh2kmz k7jSD6f4d5sA0pPleSdXZCzXcuie+kwGNFyLVSkc7B+V6aBXunfmmpUsp9ty/QR34hkipo 30SgS/S//dgPpRWG+hEUecHnllUSdMW4EelJ2KOHVTAItaOzl7KW+xNUjVqt3T7nDdY8gk uqHZQ+Umn3X5QF7BnM9ZB1Jj3YcPxFs7XLR5yfYpg+MVJkiN9TOsl3RhBeyMzA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785347320; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GRcsPf7EsLcsZtEMQK2qk9cKEOH8f8Rgy9YUEOkMvnA=; b=c6KX1wGI8i7lEBX/zWnIr0sBeigrIPr8PCmUfjuf9dk3iCIcsG/ZQqBPuqW7K6RWuWxP5T TBcuhYbup6++FiM+VxD8LI1W5KKYXRmZWSuFSl+/NLKlaypDBwXZlyn+v6UtiENvZaCmgE GqahRPcx9ETIhydEemKxpMYR9RcVHUKgw8FvxXcklkXNxxlqeoZ38cn62wuNtHFdioJkHg Cc461KKHHUBqOc7LPet0tS3rxBnVJgA0Xzg80CUBK4rhLlgGs+RbXpqe38HirYfWLRrq/v CESf4+7W6N20Gwlj0tkIwoZraaJuJ6k1rSlNzVw3RuLhKEvFK4Tva0Ma/Qd5Sw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h9KZJ5FDWzcqM for ; Wed, 29 Jul 2026 17:48:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3b80b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 29 Jul 2026 17:48:40 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: John Baldwin From: Mark Johnston Subject: git: dbd55933cbcb - stable/15 - wg(4): Check for crypto operation errors List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: dbd55933cbcb8d801a6e813a2dbbcf19f4e0f75f Auto-Submitted: auto-generated Date: Wed, 29 Jul 2026 17:48:40 +0000 Message-Id: <6a6a3cf8.3b80b.1a5339f4@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=dbd55933cbcb8d801a6e813a2dbbcf19f4e0f75f commit dbd55933cbcb8d801a6e813a2dbbcf19f4e0f75f Author: John Baldwin AuthorDate: 2026-07-27 15:36:55 +0000 Commit: Mark Johnston CommitDate: 2026-07-29 17:48:13 +0000 wg(4): Check for crypto operation errors In particular, handle authentication errors due to bad MACs when decrypting packets. Since the current dispatch code assumes synchronous OCF sessions by design, explicitly reject any created OCF session that is not synchronous. Software sessions are always synchronous in practice, so this should be a nop. Approved by: so Security: FreeBSD-SA-26:52.if_wg Security: CVE-2026-58085 Reviewed by: markj Sponsored by: Chelsio Communications --- sys/dev/wg/wg_crypto.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/sys/dev/wg/wg_crypto.c b/sys/dev/wg/wg_crypto.c index 53441ef25b40..82b80c7fd451 100644 --- a/sys/dev/wg/wg_crypto.c +++ b/sys/dev/wg/wg_crypto.c @@ -230,6 +230,8 @@ chacha20poly1305_encrypt_mbuf(struct mbuf *m, const uint64_t nonce, crp.crp_cipher_key = key; crp.crp_callback = crypto_callback; ret = crypto_dispatch(&crp); + if (ret == 0) + ret = crp.crp_etype; crypto_destroyreq(&crp); return (ret); } @@ -253,6 +255,8 @@ chacha20poly1305_decrypt_mbuf(struct mbuf *m, const uint64_t nonce, crp.crp_cipher_key = key; crp.crp_callback = crypto_callback; ret = crypto_dispatch(&crp); + if (ret == 0) + ret = crp.crp_etype; crypto_destroyreq(&crp); if (ret) return (ret); @@ -270,9 +274,14 @@ crypto_init(void) .csp_cipher_klen = CHACHA20POLY1305_KEY_SIZE, .csp_flags = CSP_F_SEPARATE_AAD | CSP_F_SEPARATE_OUTPUT }; - int ret = crypto_newsession(&chacha20_poly1305_sid, &csp, CRYPTOCAP_F_SOFTWARE); + int ret = crypto_newsession(&chacha20_poly1305_sid, &csp, + CRYPTOCAP_F_SOFTWARE); if (ret != 0) return (ret); + if (!CRYPTO_SESS_SYNC(chacha20_poly1305_sid)) { + crypto_freesession(chacha20_poly1305_sid); + return (ENXIO); + } return (0); }