bhyve: rfb: do not destroy a mutex that was never initialized
rfb_init()'s error path tests pixfmt_mtx against NULL, which only
compiles where pthread_mutex_t is a pointer, and destroys it. Every
jump to that label is before the mutex is initialized, so there is
nothing to destroy. The test and the destroy came in with the
SetPixelFormat support (D46402).
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Fixes: dda0f9837b1c ("bhyve: support noVNC SetPixelFormat request")
Reviewed by: markj
MFC after: 1 week
Sponsored by: keelos.dev
Differential Revision: https://reviews.freebsd.org/D61425
bhyve: nvme: initialize the AEN condition variable
aen_cond is used with pthread_cond_wait() and pthread_cond_signal() but
never initialized. That works where a zeroed pthread_cond_t is
initialized on first use; elsewhere pthread_cond_wait() fails at once
and aen_thr() spins with aen_mtx held.
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Reviewed by: markj
MFC after: 1 week
Sponsored by: keelos.dev
Differential Revision: https://reviews.freebsd.org/D61424
pmap: Fix some bugs around accounting of wired mappings
The amd64 and arm64 pmaps failed to decrement the count when tearing
down a 1GB largepage mapping. The riscv pmap failed to decrement the
count when unwiring a superpage mapping.
Reported by: alc
Reviewed by: bnovkov, alc, kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61414
link_elf: validate the section headers in link_elf_load_file()
e_shentsize isn't checked, and e_shstrndx, sh_link and sh_name are used
unchecked. Do what link_elf_obj.c does.
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61389
link_elf: bounds-check the dynamic section's tables
parse_dynamic() only checks the DT_HASH header. nbuckets, nchains and
the other DT_* tables come from the module unchecked. Check them
against the mapping, and reject a size without its table.
Reported by: llm-postcr
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61387
link_elf: validate symbol name offsets
st_name isn't checked against the string table size, for any of the
symbol tables used here. Do what link_elf_obj.c does since 4e2c2842e.
Reported by: llm-postcr
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61388
sysvmsg: Fix sequence number wraparound races
The SysV message queue code has the same problem that we fixed in the
semaphore code in SA-26:54.sysvsem and SA-26:64.sysvsem. That is,
kern_msgrcv() and kern_msgsnd() are susceptible to TOCTOU races when
they sleep waiting for messages and queue space, respectively. Unlike
the semaphore code, however, the message queue array is never resized
and there is no notion of message queue sets, so such races do not open
up any memory safety bugs.
Fix the races, following the pattern from the SysV semaphore changes:
use a global sequence number array with wide counters, to avoid changing
the KBI which is embedded in userspace tools. Fix kern_msgsnd(), which
did not validate the sequence number at all after sleeping. Use a
msgvalid() helper to factor out some duplicated checks. Convert a
couple of local flag variables to bools.
Reported by: Apex Security Research
Reviewed by: kib
[3 lines not shown]
sysvsem: Plug another place where we leak __sem_base to userspace
Leaking this pointer isn't harmful, but other places take care to clear
it, so handle this in SEM_STAT too.
Reviewed by: imp, kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61396
arm64/vmm: vgic_v3: Register the maintenance interrupt
If one is available, register the maintenance IRQ so that vmm can
receive and process guest exits when the maintenance IRQ is asserted.
Since vmm and vgic can still operate without it, print a warning but
attach the vgic regardless if the maintenance IRQ cannot be registered.
Signed-off-by: Kajetan Puchalski <kajetan.puchalski at arm.com>
Reviewed by: andrew
Sponsored by: Arm Ltd
Pull Request: https://github.com/freebsd/freebsd-src/pull/2530
arm64/gicv3: Expose the ACPI maintenance interrupt
The ACPI entry describing the maintenance interrupt INTID is already
available as "VgicInterrupt", but it is not exposed to the GIC driver.
Check that the value is valid and consistent between CPUs, then publish
it for the GIC driver to use under rid 0 if so.
Print a warning if the maintenance interrupt is configured to be
edge-sensitive in ACPI, as the GIC spec explicitly states "maintenance
interrupts are level-sensitive".
Signed-off-by: Kajetan Puchalski <kajetan.puchalski at arm.com>
Reviewed by: andrew
Sponsored by: Arm Ltd
Pull Request: https://github.com/freebsd/freebsd-src/pull/2527
security/py-social-auth-core: Update to 5.2.0
* Adjust testsuite accordingly so that the results are successful
depending on the configuration.
* Note: This is an interim update to create a py-social-auth-core5 port
based on this, which is limited to the 5.x release series and adjust
CONFLICTS_INSTALL for future variants of py-social-auth-core.
Changelog since 5.0.1:
https://github.com/python-social-auth/social-core/blob/5.2.0/CHANGELOG.md
Approved by: ultima (maintainer, implicit)
MFH: 2026Q4
(cherry picked from commit f2ac829b1de5ba6aad4f98b553859f9ced4a1d73)
www/py-strawberry-graphql-django: Update to 0.91.0
* Note: There are already a few recent releases, but they require
py-strawberry-graphql version 0.328.0+, which in turn requires
py-graphql-core version 3.3.0 or later - which is not yet in the
ports tree.
Changelog since 0.88.0:
https://github.com/strawberry-graphql/strawberry-django/blob/0.91.0/CHANGELOG.md
www/py-dj60-strawberry-graphql-django: Update to 0.91.0
* Note: There are already a few recent releases, but they require
py-dj60-strawberry-graphql version 0.328.0+, which in turn requires
py-graphql-core version 3.3.0 or later - which is not yet in the ports
tree.
Changelog since 0.88.0:
https://github.com/strawberry-graphql/strawberry-django/blob/0.91.0/CHANGELOG.md
