rsu: add a runtime TX buffer bound check for a kernel buffer overflow
The rsu driver currently relies on a `KASSERT` to prove that the mbuf payload
plus TX descriptor fits in the per-transfer USB TX buffer. On production
kernels without `INVARIANTS`, an oversized raw 802.11 frame can reach
`m_copydata()` and overwrite past that buffer, causing local kernel memory
corruption.
This suggested patch replaces the assertion-only guard with a runtime size
check before the copy. Oversized frames return `EMSGSIZE`, leaving the existing
caller cleanup paths responsible for freeing `m0`, `ni`, and the unused
transfer buffer.
Reachable via root / bpf access
Reviewed by: bz, adrian
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58898
mtw: fix zero-length queue array that can corrupt struct mtw_softc
The mtw softc declares sc_epq with MTW_BULK_RX even though MTW_BULK_RX is enum
value 0, while initialization and queue handling index up to MTW_EP_QUEUES;
attaching a matching USB WLAN device can drive writes past the absent array and
corrupt adjacent softc fields.
This suggested patch sizes sc_epq with MTW_EP_QUEUES so the softc contains the
endpoint queues the driver initializes and uses.
Fixes: c14b01624261 ("mt7601U: Importing if_mtw from OpenBSD")
Reviewed by: bz
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58897
kern/sched: Hide scheduler selection from C++
The scheduler selection interface uses names that are reserved words in
C++, causing problems for downstream projects that use C++ in the
kernel. Work around this by hiding the interface from C++ compilers
until we can come up with a better solution.
Fixes: ce38acee8d0b ("Add kern/sched_shim.c")
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: siderop1_netapp.com, imp, kib
Differential Revision: https://reviews.freebsd.org/D58991
audio/gogglesmm: Update to 1.3.1
Big endian archs should be supported now, so remove BROKEN message.
Switch to pre-rolled release.
Options cleanup: Require a crypto library since most streaming services
use HTTPS, keeping OPENSSL as the default; remove TREMOR option since
libtremor was removed in 2023; remove ZLIB option since FreeBSD has zlib
support baked in.
https://github.com/gogglesmm/gogglesmm/releases/tag/1.3.0https://github.com/gogglesmm/gogglesmm/releases/tag/1.3.1
x11-toolkits/fox17: Update to 1.7.91
Bump PORTREVISION on consumers. Since this is a development version,
rebuild is required even for patch releases due to ABI incompatibility.
http://www.fox-toolkit.org/news.html
exterr(9): add a few tests of new message formats
This is enough to show that the idea works (and to exercise
uexterr_set()), but isn't complete by any means.
Reviewed by: kib
Effort: CHERI upstreaming
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D58060
runtime: add the ability to set exterrors in userspace
The UEXTERROR(3) macro is a partial analog to EXTERROR(9) that sets
the current user exterror state and errno. The main difference is
that it returns no value and sets errno directly since that's the
typical pattern in libraries.
While here move the storage and constructor for single-threaded
program's uexterr to its own file.
Reviewed by: kib
Effort: CHERI upstreaming
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D58059
exterr: relax format restrictions
Rather than passing the format string to printf and forcing the
arguments to be (u)intmax_t, partially parse format strings and cast
p1 and p2 to the correct type before running the individual format
though printf. This restructure has a couple motivatations:
- We can skip formats that make no sense (floating point, %n, etc.).
- It is possible to special case the printing of pointers in the
CHERI case.
The first case is motivated by a suggestion from the audiance at
one of Kirk's BSDCan talks on exterr to allow userspace to set exterr
status. Allowing arbitrary format strings including %n creates a
write-what-where gadget so we need to not do that.
The second case is motivated by our experinces with CHERI and debugging
mmap issues using a different textual error reporting framework. With
CHERI, pointers are more than integer addresses and it's useful to
include more details. Doing so will follow in a future commit.
[8 lines not shown]
