Remove {ATF,PLAIN}_REQUIRE_KERNEL_MODULE macros
These macros predated the `require.kmod` (ATF) and `required_kmods`
(kyua) test metadata and are no longer needed.
Add a hint to freebsd_test_suite/macros.h about the `*FEATURE*` macros
going away soon. See [this kyua issue][kyua-issue] for more details.
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D61082
[kyua-issue]: https://github.com/freebsd/kyua/issues/346
nvmecontrol: Range-check the format command's field values
The format command accepted any 32-bit value for -m, -p, -l and
--ses and passed it into the Format NVM command. Before
eae727676169 an out-of-range value spilled into the adjacent cdw10
fields, which usually drew an error from the controller; after it,
the value is masked to the field width, so a mistyped value is
silently accepted with a different meaning. Most seriously,
--ses 8 masked to SES=0 and performed a plain format with no erase
at all, exiting 0. A value like --ses 10 masked to a cryptographic
erase while bypassing the FNA cryptographic erase capability check,
which compares the unmasked value.
Reject values outside the ranges nvmecontrol.8 documents, which are
the values the spec defines: 0-1 for -m and -l, 0-3 for -p, and
0-2 for --ses. The checks run at option validation time, before
the device is opened, and the capability check now only ever sees
valid values.
[10 lines not shown]
virtio_random: defer first enqueue until after DRIVER_OK
According to the virtio spec:
> The driver MUST NOT send any buffer available notifications to the
> device before setting DRIVER_OK.
DRIVER_OK isn't set until after attach completes, so defer the first
enqueue. We haven't found any problems as a result of this to the best
of my knowledge: q35 and other devices that we *have* been used with
will apparently check when we go DRIVER_OK.
Tested with q35 virtio-random, which still works.
Approved by: re (cperciva)
Reported by: llm-postcr
Reviewed by: kfv, markj
Fixes: f1c5a2e3a62505 ("virtio_random: Pipeline fetching the data")
Sponsored by: Stormshield
[4 lines not shown]
virtio_pci_modern: enable virtqueues before completing attach
Most of our drivers setup interrupt(s) and virtqueues are enabled at
that time, but nothing will currently enable them for devices that we're
only going to poll. This most notably affects virtio-random, and the
problem can be observed with qemu's q35 emulation and a random device
attached. The q35 implementation ignores the ring unless it's enabled,
so vtrnd_harvest() will consistently EAGAIN rather than contribute
anything of value, but with this patch it becomes functional.
This can be reproduced with a qemu invocation like so:
qemu-system-x86_64 -machine q35,accel=tcg -cpu max -smp 2 -m 2G \
-drive file=FreeBSD-16.0-CURRENT-amd64-ufs.qcow2,if=virtio \
-device pcie-root-port,id=rp1,bus=pcie.0,chassis=1 \
-object rng-random,id=rng0,filename=/dev/urandom \
-device virtio-rng-pci,rng=rng0,bus=rp1 \
-display curses
[7 lines not shown]
krb5: Import MIT 1.22.3
Major changes in 1.22.3 (2026-11-09)
====================================
This is a bug fix release, with a focus on security issues discovered
with the aid of large language models. See
https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for
information on the risks of continuing to use unpatched releases.
* Fix a logic error when checking PAC server checksums
[CVE-2026-111423].
* Check for unkeyed checksums when validating CAMMAC verifiers
[CVE-2026-71199].
* Fix a loophole in the KDC's client authdata filtering which could
allow clients to include fake PAC and CAMMAC authdata values when
requesting service tickets. These fake values would be rejected by
[49 lines not shown]
nvmecontrol: Mask the fields in the Format NVM command
The format command composed cdw10 by hand without masking any of
the fields and with no support for the LBAFU field. Since commit
2c41f7d8a034 the LBA format index defaulted from FLBAS can exceed
15 on an NVMe 2.0 namespace using FIDXU, and such an index would
bleed into the MSET and PI fields. An out of range index supplied
with -f for a whole-controller format was not caught either.
Build the command with nvme_admin_format_cmd(), which masks all of
the fields and encodes LBA format indexes above 15 in LBAFU, and
reject LBA format indexes greater than 63 for whole-controller
formats. Per-namespace formats already validate the index against
NLBAF.
This is the same problem that llm-postcr reported in camcontrol's
copy of this code, fixed in 3892a6453fc6; the unmasked composition
originated here (635c517ae9ca).
[7 lines not shown]
namei(9): fix two ni_startdir leaks
namei() leaks the caller's ni_startdir reference on the empty-path
ENOENT return and on namei_getpath() failure.
On ZFS with the default zfs_xattr_compat=1, an empty user-namespace
extattr name on a file that has an xattr directory leaks one reference
on that directory per call.
Reported by: llm-postcr
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D61366
vn_open_cred(9): fix ni_startdir leak
vn_open_cred() returns EINVAL before calling namei() for
O_CREAT|O_EXCL|O_DIRECTORY and for O_CREAT|O_EMPTY_PATH.
That leaks an NDINIT_ATVP() start directory.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D61366
libthr mutex_self_lock(): handle signals and clock steps
Relocking an owned NORMAL mutex with an absolute timeout has two issues:
- nanosleep(2) is never restarted, so any caught signal causes
an early ETIMEDOUT.
- If CLOCK_REALTIME or CLOCK_TAI are stepped backward during the sleep,
the call also returns ETIMEDOUT before the clock reaches the deadline.
The kernel already polls CPU-time clocks and handles realtime steps.
Use _thr_umtx_timedwait_uint() in a loop to handle both issues.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D61381
www/authelia: update 4.39.20 → 4.39.28; add service pid file; update default service config
Service config was outdated. The new one now successfully starts the
service.
PR: 300045
Submitted by: paul.le.gauret at gmail.com (port update)
