atf-check: Add shortcut for not-exit:0
Allow the command to be preceded by an exclamation point, which changes
the default expected result to a clean exit with a non-zero exit code.
MFC after: 1 week
Sponsored by: Klara, Inc.
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D58099
tftpd: Keep proper track of option length
When parsing options, keep track of the length of the unparsed portion
and pass that to get_field() instead of the length of the entire header.
While here, switch both make_options() and parse_options() to using
size_t for sizes and lengths.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D61048
tftpd: Keep proper track of header length
When parsing a header, keep track of the length of the unparsed portion
and pass that to get_field() instead of the length of the entire header.
Reported by: n0ps1ed
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60902
tftpd: Fix off-by-one in get_field()
Due to a logic error, get_field() would behave as if the passed-in size
was one greater than it actually is. Fix it so it always fails if no
terminating NUL is found within the buffer, instead of succeeding if the
first byte past the end is a NUL.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D61032
carp: Check if_carp under carp_sx in carp_nl_get()
carp_nl_get() tested ifp->if_carp for NULL before taking carp_sx and
walked the softc list afterwards. When the last vhid on the interface
is removed in between, carp_free_if() clears if_carp and the walk
dereferences a NULL pointer. A reader that passes the check while the
removal holds carp_sx always hits this.
The check was done with the lock held until the ioctl(2) API was
retired. Do it under the lock again.
Reported by: Marcos Mendoza <mmendoza at netgate.com>
Fixes: 72472e52e310 ("carp: retire ioctl(2) API")
Sponsored by: Rubicon Communications, LLC ("Netgate")
linux: Bound native getdents and getdents64 batches
linux_getdents() and linux_getdents64() round their native read size up
to DEV_BSIZE before converting entries. For an unaligned caller buffer,
the native batch can contain more entries than fit in the Linux buffer.
Conversion then returns EINVAL even after copying complete entries,
and the native read has already advanced the directory position.
For counts of at least DEV_BSIZE, use min(args->count, MAXBSIZE) instead.
A 768-byte request, such as rustix's initial directory read, now uses a
768-byte native buffer rather than 1024. The converted Linux dirent and
dirent64 records are no larger than their native counterparts, so the
whole translated batch fits. Returning a short batch is allowed, and
consuming the whole native batch avoids needing to rewind the directory
position.
Keep the existing sizing for counts below DEV_BSIZE. This fixes the
oversized-batch case in both getdents interfaces, including legacy
getdents for 32-bit and 64-bit callers. The remaining small-buffer,
[8 lines not shown]
tests/sys/net/if_lagg_test: mark :witness as an XFAIL in CI
The `:witness` "test" has been failing reliably in CI for over 2 months
now. Mark the test XFAIL so the overall CI run is more green.
PR: 300697
MFC after: 1 week
periodic: Fix empty output check
The empty_output variable is normalized to YES or NO, but we were
comparing it to TRUE, so the comparison always failed no matter what it
was set to. Compare it to YES instead.
This feature has been disabled since 2007, so flip the default to NO to
preserve the current behavior. Adjust the documentation accordingly.
Relnotes: yes
PR: 300676
MFC after: 1 week
Fixes: 68c35072f914 ("Add an option to make periodic(8) quiet when no output was generated.")
Reviewed by: ivy, emaste
Differential Revision: https://reviews.freebsd.org/D61435
tests: udp_bindings: connect_bound_socket_from_2address_jail mark XFAIL in CI
This testcase has been failing reliably in CI since it was introduced in
2e16d37e275f. Mark the testcase XFAIL when run via CI to make the
overall test run a bit more green.
PR: 300696
MFC after: 1 week
tests/sys/netlink: mark :overflow as XFAIL when run via CI
This testcase has been failing reliably for 5+ months now. Mark it as an
expected failure to make the standard Jenkins run a bit more green.
PR: 289240
MFC after: 1 week
cd9660: Fix dereferencing invalid RR outlen ptr
`ISO_RRIP_ANALYZE` is constructed in four places. Two of the
initializers set the `outlen` field while the other two,
`cd9660_rrip_analyze` and `cd9660_rrip_offset`, leave it uninitialized.
The uninitialized paths can dereference an invalid pointer on error
paths which causes a kernel panic.
To fix, I zero out `ISO_RRIP_ANALYZE` in all four places where it's
initialized and check that `outlen` is non-null on the error path
in `cd9660_rrip_loop`.
While testing the above, I encountered another kernel panic due to
mounting continuing after the error branch. Evidently, the ISO continued
mounting through the normal ISO 9660 path then triggered a panic down
the line due to a very broken file system from the ISO. To fix that, I
propagate the error from the RR path then fail in the mount path.
[13 lines not shown]
top: allow filtering by command name
top(1) already supports interactive command filtering using
the '/' key. Support it also with a command line
argument '-g' / '--grep'.
Reviewed by: kib
Obtained from: OpenBSD
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D61160
cd9660: Fix dereferencing invalid RR outlen ptr
`ISO_RRIP_ANALYZE` is constructed in four places. Two of the
initializers set the `outlen` field while the other two,
`cd9660_rrip_analyze` and `cd9660_rrip_offset`, leave it uninitialized.
The uninitialized paths can dereference an invalid pointer on error
paths which causes a kernel panic.
To fix, I zero out `ISO_RRIP_ANALYZE` in all four places where it's
initialized and check that `outlen` is non-null on the error path
in `cd9660_rrip_loop`.
While testing the above, I encountered another kernel panic due to
mounting continuing after the error branch. Evidently, the ISO continued
mounting through the normal ISO 9660 path then triggered a panic down
the line due to a very broken file system from the ISO. To fix that, I
propagate the error from the RR path then fail in the mount path.
[13 lines not shown]
bhyve: rfb: do not destroy a mutex that was never initialized
rfb_init()'s error path tests pixfmt_mtx against NULL, which only
compiles where pthread_mutex_t is a pointer, and destroys it. Every
jump to that label is before the mutex is initialized, so there is
nothing to destroy. The test and the destroy came in with the
SetPixelFormat support (D46402).
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Fixes: dda0f9837b1c ("bhyve: support noVNC SetPixelFormat request")
Reviewed by: markj
MFC after: 1 week
Sponsored by: keelos.dev
Differential Revision: https://reviews.freebsd.org/D61425
bhyve: nvme: initialize the AEN condition variable
aen_cond is used with pthread_cond_wait() and pthread_cond_signal() but
never initialized. That works where a zeroed pthread_cond_t is
initialized on first use; elsewhere pthread_cond_wait() fails at once
and aen_thr() spins with aen_mtx held.
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Reviewed by: markj
MFC after: 1 week
Sponsored by: keelos.dev
Differential Revision: https://reviews.freebsd.org/D61424
pmap: Fix some bugs around accounting of wired mappings
The amd64 and arm64 pmaps failed to decrement the count when tearing
down a 1GB largepage mapping. The riscv pmap failed to decrement the
count when unwiring a superpage mapping.
Reported by: alc
Reviewed by: bnovkov, alc, kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61414
link_elf: validate the section headers in link_elf_load_file()
e_shentsize isn't checked, and e_shstrndx, sh_link and sh_name are used
unchecked. Do what link_elf_obj.c does.
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61389
link_elf: bounds-check the dynamic section's tables
parse_dynamic() only checks the DT_HASH header. nbuckets, nchains and
the other DT_* tables come from the module unchecked. Check them
against the mapping, and reject a size without its table.
Reported by: llm-postcr
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61387
link_elf: validate symbol name offsets
st_name isn't checked against the string table size, for any of the
symbol tables used here. Do what link_elf_obj.c does since 4e2c2842e.
Reported by: llm-postcr
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61388
sysvmsg: Fix sequence number wraparound races
The SysV message queue code has the same problem that we fixed in the
semaphore code in SA-26:54.sysvsem and SA-26:64.sysvsem. That is,
kern_msgrcv() and kern_msgsnd() are susceptible to TOCTOU races when
they sleep waiting for messages and queue space, respectively. Unlike
the semaphore code, however, the message queue array is never resized
and there is no notion of message queue sets, so such races do not open
up any memory safety bugs.
Fix the races, following the pattern from the SysV semaphore changes:
use a global sequence number array with wide counters, to avoid changing
the KBI which is embedded in userspace tools. Fix kern_msgsnd(), which
did not validate the sequence number at all after sleeping. Use a
msgvalid() helper to factor out some duplicated checks. Convert a
couple of local flag variables to bools.
Reported by: Apex Security Research
Reviewed by: kib
[3 lines not shown]
sysvsem: Plug another place where we leak __sem_base to userspace
Leaking this pointer isn't harmful, but other places take care to clear
it, so handle this in SEM_STAT too.
Reviewed by: imp, kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61396
arm64/vmm: vgic_v3: Register the maintenance interrupt
If one is available, register the maintenance IRQ so that vmm can
receive and process guest exits when the maintenance IRQ is asserted.
Since vmm and vgic can still operate without it, print a warning but
attach the vgic regardless if the maintenance IRQ cannot be registered.
Signed-off-by: Kajetan Puchalski <kajetan.puchalski at arm.com>
Reviewed by: andrew
Sponsored by: Arm Ltd
Pull Request: https://github.com/freebsd/freebsd-src/pull/2530
arm64/gicv3: Expose the ACPI maintenance interrupt
The ACPI entry describing the maintenance interrupt INTID is already
available as "VgicInterrupt", but it is not exposed to the GIC driver.
Check that the value is valid and consistent between CPUs, then publish
it for the GIC driver to use under rid 0 if so.
Print a warning if the maintenance interrupt is configured to be
edge-sensitive in ACPI, as the GIC spec explicitly states "maintenance
interrupts are level-sensitive".
Signed-off-by: Kajetan Puchalski <kajetan.puchalski at arm.com>
Reviewed by: andrew
Sponsored by: Arm Ltd
Pull Request: https://github.com/freebsd/freebsd-src/pull/2527
bsdinstall: Set TMPDIR in pkgbase install
The FreeBSD-base repository (aka "pkgbase") is now created using 'pkg
repo -l' in order to make 'pkg rwhich' work. Unfortunately this makes
the data.pkg file considerably larger, and FreeBSD 15.2-BETA1 fails to
install using a remote repository since the installer has a small /tmp
(20 MB).
Run pkg commands with 'env TMPDIR=<chrootdir>/tmp' since the /tmp in
the system being installed is considerably larger than the tmpfs which
the installer runs with. Create <chrootdir>/tmp first so we can ensure
it has 1777 permissions.
Reviewed by: bapt
MFC after: 1 day
Differential Revision: https://reviews.freebsd.org/D61380
(cherry picked from commit a7163bd76986282fdcb059b91301d3214da49642)
nuageinit: Add support for uid
Adds support for specifying an explicit UID when creating users through nuageinit. Both numeric and string UID values are supported. Invalid or negative UIDs are rejected. The new uid option is documented in nuageinit(7). Existing automatic UID allocation remains unchanged when no UID is specified. A UID already in use or out of range is left to pw(8) to reject.
PR: 293716
Reported by: Einar Bjarni Halldórsson <einar at isnic.is>
Reviewed by: dtxdf, bapt
Signed-off-by: Kushagra Chauhan <zenzesama at gmail.com>
Differential Revision: https://reviews.freebsd.org/D61174
p1003_1b: Add capability mode checks
The sched_* syscalls can operate either on the calling process (by
setting pid = 0) or by specifying a pid. They are allowed in capability
mode, but previously were not scoped to only operating on the calling
process.
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57346
user_connectat: correctly pass fd through
In the original adaptation of connect/connectat to use user_connectat in
CheriBSD, I failed to pass the fd through in the connectat case and
always passed AT_FDCWD. This did trigger failures in the unix_connectat
test which I somehow missed in prior test runs.
Reported by: llm-postcr
rc: Generate ML-DSA44/Ed25519 host keys by default
Commit bd9d7cdd1420 ("OpenSSH: Update to 10.5p1") introduced support for
ML-DSA44/Ed25519 host keys.
Generate these keys by default when the sshd service is first started.
Reported by: Herbert J. Skuhra
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D61433
