From nobody Wed Jul 29 17:49:35 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h9KbM6bl6z6mZm4 for ; Wed, 29 Jul 2026 17:49:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h9KbM49kkz3l2D for ; Wed, 29 Jul 2026 17:49:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785347375; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=v0k694QilJThwbS+ht7kex7w63FRh+MWrpPZ/p3ueqQ=; b=iC7bx4OstS4WRzykbtK7gPisdZgJCIE2gA9qMIS1adGRuBdR3GvQz9BXMiQ7l7hSgMCHfa nWP+nSBFGn5DnGsEWOR3Atsx8vLefGdnMu5q3rdPbCatYeXlryowEjgi7t822/eCMy4sm+ A0J0wx5ecnChtt45P9xtMGtjqpdE+Ok/4khB7VP4nTzNqv8HBeUT6suAa+V7gx6jpQHtXO ALQ1bCOQnk0S0sWV9tyQ03g6NCRclSFOduU9WRmgXGPVSpfegHl0FZ1orBRaps2l9+mxuv mgNktuTLZhSQbp5M5ihsm7laUksL7xu7Aa5qKWFVQwnrWZmgF+rM3TZciysbSw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785347375; a=rsa-sha256; cv=none; b=wUqiv1lNpDkljqedzm6x8n3m8Rkv8aKiYM/3lMEpt30JX0Mr6FPZ+2n2aCsE4KbgMW4iVC P/EOZHMMXoAMkWNkwoDX+3dHnAIhSE9tak8bLbBef9JdgZAmZj7E95bdlJpAXWmFLmQUEa qhIzYu1uZRPSsnWODkcssmF5+piC8ZTMD6YYzrAqENYFnlgHRNhB+DY4Or3E/1Nif2uZkf i1T0xzrvnoI9alM1JErSVodChS+IURrqXEKnrqruQQqLpPJY2KGqsc6fPZ4HD0sFZObdlU G7so6NTjntKY6gQA8a4g/25CKY4pU6WKoNx7LSMs9ont0GWM2pMh3VNKqQD3zA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785347375; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=v0k694QilJThwbS+ht7kex7w63FRh+MWrpPZ/p3ueqQ=; b=iWflkieFXUnnyXJ+joX6cWJ5psszxy/xfIaxsLnEoS7QOrD7IyJ8mESDypuOMI9Xw5eZG5 A3cX0JX2+fQ2pCaurDYMf+w3WxBBX2Bx0281D1kI7LKfHYtAw0qdV8gvBRU2n3LZyww5z/ AnoYtSZdH1g9AzFOgSp69rqC/AnglaYkfsUo+krWcnXHU0LfMQKy1Yk6VMIXZZzufhErnh KXsIGCEs1J0Uju9xkOSc6Gc57tzeDRcg05zI6tbLpfzmT7FGVIdfgesM7ZhrI8jN963bdV Z/wwpEX+ja2yTnZpV9ljcnfCMBHGaX5PGgysav3PKIKHlVcj6HdmzTISxZ6n1Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h9KbM3FlFzcsm for ; Wed, 29 Jul 2026 17:49:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3af8c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 29 Jul 2026 17:49:35 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: John Baldwin From: Mark Johnston Subject: git: 01b53d5d1e20 - releng/14.4 - wg(4): Check for crypto operation errors List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 01b53d5d1e203e5c716f11994c7c96dbd8fd958e Auto-Submitted: auto-generated Date: Wed, 29 Jul 2026 17:49:35 +0000 Message-Id: <6a6a3d2f.3af8c.461f75bd@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=01b53d5d1e203e5c716f11994c7c96dbd8fd958e commit 01b53d5d1e203e5c716f11994c7c96dbd8fd958e Author: John Baldwin AuthorDate: 2026-07-27 15:36:55 +0000 Commit: Mark Johnston CommitDate: 2026-07-28 14:38:27 +0000 wg(4): Check for crypto operation errors In particular, handle authentication errors due to bad MACs when decrypting packets. Since the current dispatch code assumes synchronous OCF sessions by design, explicitly reject any created OCF session that is not synchronous. Software sessions are always synchronous in practice, so this should be a nop. Approved by: so Security: FreeBSD-SA-26:52.if_wg Security: CVE-2026-58085 Reviewed by: markj Sponsored by: Chelsio Communications --- sys/dev/wg/wg_crypto.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/sys/dev/wg/wg_crypto.c b/sys/dev/wg/wg_crypto.c index 53441ef25b40..82b80c7fd451 100644 --- a/sys/dev/wg/wg_crypto.c +++ b/sys/dev/wg/wg_crypto.c @@ -230,6 +230,8 @@ chacha20poly1305_encrypt_mbuf(struct mbuf *m, const uint64_t nonce, crp.crp_cipher_key = key; crp.crp_callback = crypto_callback; ret = crypto_dispatch(&crp); + if (ret == 0) + ret = crp.crp_etype; crypto_destroyreq(&crp); return (ret); } @@ -253,6 +255,8 @@ chacha20poly1305_decrypt_mbuf(struct mbuf *m, const uint64_t nonce, crp.crp_cipher_key = key; crp.crp_callback = crypto_callback; ret = crypto_dispatch(&crp); + if (ret == 0) + ret = crp.crp_etype; crypto_destroyreq(&crp); if (ret) return (ret); @@ -270,9 +274,14 @@ crypto_init(void) .csp_cipher_klen = CHACHA20POLY1305_KEY_SIZE, .csp_flags = CSP_F_SEPARATE_AAD | CSP_F_SEPARATE_OUTPUT }; - int ret = crypto_newsession(&chacha20_poly1305_sid, &csp, CRYPTOCAP_F_SOFTWARE); + int ret = crypto_newsession(&chacha20_poly1305_sid, &csp, + CRYPTOCAP_F_SOFTWARE); if (ret != 0) return (ret); + if (!CRYPTO_SESS_SYNC(chacha20_poly1305_sid)) { + crypto_freesession(chacha20_poly1305_sid); + return (ENXIO); + } return (0); }