arm64 pmap: combine L3C accessed bits in pmap_mincore()
The accessed bit may be set in only some of an L3C superpage's L3
PTEs. However, when pmap_mincore() found an L3C mapping, it reported
the accessed state of the specified L3 PTE only, so mincore(2) could
fail to report MINCORE_REFERENCED for an L3C superpage that had been
accessed. When the accessed bit is not set in the specified entry, use
pmap_load_l3c() to combine the accessed bits from all of the L3C
superpage's L3 PTEs.
Found by: Claude Code (Opus 5.5)
MFC after: 1 week
hwpmc: release a PMC whose ID could not be copied out
If copyout of the newly allocated PMC ID fails, the caller cannot use or
release the PMC. Release it in the kernel.
Reviewed by: mhorne
MFC after: 3 days
Sponsored by: Advanced Micro Devices, Inc.
Differential Revision: https://reviews.freebsd.org/D60562
(cherry picked from commit e5a48c8e0dd026ba953cf401c4dec02f76078aa2)
pmc(8): zero-initialize the event descriptor in stat mode
cmd_pmc_stat allocated the event descriptor with malloc and then set
only some of its fields, so the rest held whatever was on the heap.
Use calloc() instead.
Reviewed by: mhorne
MFC after: 3 days
Sponsored by: AMD
Signed-off-by: Andre Silva <andasilv at amd.com>
Differential Revision: https://reviews.freebsd.org/D59364
(cherry picked from commit a97914284c2e7a7dc330f4d93218e8d7f1e758b2)
pmc(8): zero-initialize the event descriptor in stat mode
cmd_pmc_stat allocated the event descriptor with malloc and then set
only some of its fields, so the rest held whatever was on the heap.
Use calloc() instead.
Reviewed by: mhorne
MFC after: 3 days
Sponsored by: AMD
Signed-off-by: Andre Silva <andasilv at amd.com>
Differential Revision: https://reviews.freebsd.org/D59364
(cherry picked from commit a97914284c2e7a7dc330f4d93218e8d7f1e758b2)
hwpmc: release a PMC whose ID could not be copied out
If copyout of the newly allocated PMC ID fails, the caller cannot use or
release the PMC. Release it in the kernel.
Reviewed by: mhorne
MFC after: 3 days
Sponsored by: Advanced Micro Devices, Inc.
Differential Revision: https://reviews.freebsd.org/D60562
(cherry picked from commit e5a48c8e0dd026ba953cf401c4dec02f76078aa2)
mlock_test: use mmap/munmap for unmapped pointer
Instead of hoping that the page after sbrk(0) is unmapped, map a page
with mmap and then munmap it. This won't work with CheriABI and heap
temporal safety, but it's an easy fix for now and works on all
architectures.
Reviewed by: ngie
Sponsored by: DARPA, AFRL
Differential Revision: https://reviews.freebsd.org/D46954
libc: skip telldir_leak test
It uses sbrk to attempt to detect memory leaks in telldir, but we're not
going to export sbrk in the future and this is unreliable for mmap-based
mallocs. It's also a regression test for a specific NetBSD bug.
Reviewed by: ngie
Sponsored by: DARPA, AFRL
Differential Revision: https://reviews.freebsd.org/D46955
netipsec: Do not leak the SAH when an SA is cloned
key_updateaddresses() gives the clone of an SA a new SAH reference when
the SA index comes from key_newsah() or key_getsah(), but nothing
releases the reference of the old SA: key_delsav() leaves the SAH alone,
because key_unlinksav() normally releases it, and an SA that is replaced
never goes through that. The SAH then stays allocated for good, after
its SAs are flushed and after the vnet is destroyed, as an SADB_UPDATE
with a new address does each time an IKE daemon moves an SA.
The old SA cannot release the reference when it is replaced, since a
sender that still holds it reads its SAH. Release it in key_delsav()
instead. When only the NAT-T config changes, the clone used to take over
the reference of the old SA; take a new one in that case as well, so that
every SA holds its own.
Reviewed by: kib, markj
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D61101
OpenSSH: Update to 10.5p1
This release contains security fixes and small bugfixes.
Full release notes are available at
https://www.openssh.com/txt/release-10.5.
Selected items from the release notes:
Security
========
* ssh-agent(1): fix an interaction between agent locking and the
session-bind at openssh.com extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
[33 lines not shown]
linux: Allow connect() with destination port 0
Linux allows connect() with destination port 0, but FreeBSD returns
EADDRNOTAVAIL in in_pcbconnect() and in6_pcbladdr(). Some Linux programs
(e.g. the new Android CLI tool) rely on this for routability checks,
however.
Add an SV_CONN_PORT0 flag to sv_flags which is set in the Linux sysvecs,
allowing the port 0 guard in the connect paths to be bypassed.
Reviewed by: glebius, kib
Differential Revision: https://reviews.freebsd.org/D60659
kern_linker.c: add kern_ implementations
kldsym(2) is more complex than typical because it requires translation
of struct kld_sym_lookup which is a weird in/out structure. Out of
paranoia we avoid copying out the symname pointer in the capability
version to eliminate the possiblity of leaking a capability (but not
invalidating a pointer userspace might be using via copyout()).
Effort: CHERI upstreaming
Sponsored by: DARPA, AFRL, Innovate UK
Pull Request: https://github.com/freebsd/freebsd-src/pull/2284
wait6(2): add user_wait6
sys_wait6 is a little more complicated than typical as compat layers
need to translate siginfo_t.
Effort: CHERI upstreaming
Sponsored by: Innovate UK
Pull Request: https://github.com/freebsd/freebsd-src/pull/2284
adduser.conf.5: No crossreferences in titles
Crossreferences in titles are strongly discouraged and incompatible
with our own tooling. This is a wontfix by most of manpages ecosystem
because it is bad editorial style in the first place.
MFC after: 3 days
freelocale.3: No crossreferences in titles
Crossreferences in titles are strongly discouraged and incompatible
with our own tooling. This is a wontfix by most of manpages ecosystem
because it is bad editorial style in the first place.
MFC after: 3 days
fmtcheck.3: No crossreferences in titles
Crossreferences in titles are strongly discouraged and incompatible
with our own tooling. This is a wontfix by most of manpages ecosystem
because it is bad editorial style in the first place.
MFC after: 3 days
arch.7: Mechanical fixes
+ Increase portability by never starting content lines with symbols
+ Improve search results by adding tunables to the variable database
+ Improve search result consistency by correcting description style
MFC after: 3 days
openssl: export only the engine entry points
Upstream links every dynamic engine with a version script,
engines/<name>.ld, that exports bind_engine and v_check and makes
everything else local. FreeBSD's engines had no version script, so
they exported every global symbol, including _init and _fini.
loader_attic.so compiles its own copy of crypto/pem/pvkfmt.c and so
also exported 21 of its functions; 14 of them (b2i_*, i2b_*) have the
same names as public libcrypto functions.
Add one Version.map for all engines, the same as upstream's, and use it
from engines/Makefile.inc.
The engines are loaded only with dlopen(), and libcrypto looks up only
bind_engine and v_check, so hiding the other symbols does not affect
any consumer.
Tested via tinderbox: capi.so, devcrypto.so and loader_attic.so link
with --no-undefined-version and export only bind_engine and v_check.
[8 lines not shown]
openssl: fix engine defines to match upstream
Two engine Makefiles define different macros from upstream's
engines/build.info:
- padlock: engines/e_padlock.c builds the engine only when PADLOCK_ASM
is defined. Upstream defines it on x86 and x86_64, but our Makefile
never did, so padlock.so has been a stub whose bind_engine() returns
0 and the e_padlock-x86*.S code it links was never called. Define
PADLOCK_ASM on amd64 and i386, where that asm is built.
- loader_attic: upstream defines OPENSSL_NO_PROVIDER_CODE; the Makefile
had OPENSSL_NO_PROVIDER_CORE. No source tests either name, so the
build does not change; this only follows upstream.
Found by comparing per-file compile flags against an upstream 3.5.9
build. Checked by preprocessing e_padlock.c for amd64 and i386:
COMPILE_PADLOCKENG is now defined.
[5 lines not shown]
tests/sys/file: add tests for the lowest fd after fork
fdcopy() skips plain kqueues and close-on-fork descriptors when it
copies the table into the child. Check that dup(2) in the child still
returns the lowest unused descriptor, both when the skipped descriptor
is the lowest free slot and when it sits above an existing hole.
Test cases:
kqueue_no_hole a plain kqueue is the lowest descriptor; the
child's dup() reuses its slot
kqueue_two two adjacent plain kqueues; the child's dup()
returns the lower one
kqueue_above_hole a plain kqueue sits above a closed descriptor;
the child's dup() returns the hole
kqueue_cponfork a KQUEUE_CPONFORK kqueue is copied; the child's
dup() returns the next slot
clofork_no_hole an O_CLOFORK descriptor is the lowest one; the
child's dup() reuses its slot
[14 lines not shown]
virtio_random: defer first enqueue until after DRIVER_OK
According to the virtio spec:
> The driver MUST NOT send any buffer available notifications to the
> device before setting DRIVER_OK.
DRIVER_OK isn't set until after attach completes, so defer the first
enqueue. We haven't found any problems as a result of this to the best
of my knowledge: q35 and other devices that we *have* been used with
will apparently check when we go DRIVER_OK.
Tested with q35 virtio-random, which still works.
Reported by: llm-postcr
Reviewed by: kfv, markj
Fixes: f1c5a2e3a62505 ("virtio_random: Pipeline fetching the data")
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
[2 lines not shown]
virtio_random: stop on detach, don't poll
If the device is hung, then polling will block the detach and hang us.
Stop it and drain the queue instead. This fixes a hang on detach in
some circumstances without the upcoming virtio_pci_modern fix.
Reviewed by: bnovkov, kfv
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
(cherry picked from commit cce522853aae3da45b131c2522dd2510edf083e7)
