FreeBSD/src d04da19share/man/man7 d.7

d.7: Document no support for ddi_pathnam(), getmajor(), and getminor()

MFC after:      3 days
DeltaFile
+9-1share/man/man7/d.7
+9-11 files

FreeBSD/src 84f7ee3contrib/expat Changes, contrib/expat/lib xmlparse.c

contrib/expat: import expat 2.8.1

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_1/expat/Changes

Security:       CVE-2026-45186

(cherry picked from commit 9cc9b8b372842b9a941d235c5e9949a214e5284f)
DeltaFile
+295-15contrib/expat/tests/basic_tests.c
+41-42contrib/expat/xmlwf/xmlwf.c
+30-6contrib/expat/lib/xmlparse.c
+19-15contrib/expat/tests/handlers.c
+26-0contrib/expat/Changes
+5-5contrib/expat/tests/minicheck.c
+416-8316 files not shown
+450-11122 files

FreeBSD/src 659a27econtrib/expat Changes, contrib/expat/lib xmlparse.c

contrib/expat: import expat 2.8.1

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_1/expat/Changes

Security:       CVE-2026-45186

(cherry picked from commit 9cc9b8b372842b9a941d235c5e9949a214e5284f)
DeltaFile
+295-15contrib/expat/tests/basic_tests.c
+41-42contrib/expat/xmlwf/xmlwf.c
+30-6contrib/expat/lib/xmlparse.c
+19-15contrib/expat/tests/handlers.c
+26-0contrib/expat/Changes
+5-5contrib/expat/tests/minicheck.c
+416-8316 files not shown
+450-11122 files

FreeBSD/src 3185542sys/dev/dpaa if_memac_fdt.c

dpaa: Restore Semihalf license header

This is a "new" file, but is mostly copied from if_dtsec_fdt.c, so need to
retain the original license header in addition to the new one.

Reviewed by:    ziaee
Differential Revision:  https://reviews.freebsd.org/D57123
DeltaFile
+25-0sys/dev/dpaa/if_memac_fdt.c
+25-01 files

FreeBSD/src cd3cc6esys/conf files, sys/dev/iicbus/sensor w83793g.c

i2c/sensors: Add driver for W83793 hardware monitor

The Winbond/Nuvoton W83793G system monitor chip includes many features
not currently supported by this driver.  The following are currently
supported:

* Up to 6 temperature sensors, 4 of which have 10-bit resolution
  (8.2),two with 8-bit resolution (no decimal component)
* Up to 12 fans
  - Fans 0-4 (1-5 on the datasheet) are always enabled.  The remaining 7
    fans are individually enabled.
* Multiple voltage sensors, reading up to 10 voltage sources.  Sysctls
  are labeled to match the datasheet.
* Chassis open detection.

The W83793AG is a feature-reduced version, which lacks 3 thermal diodes
and 2 voltage monitors.  Since there is no way to tell the difference
between the W83793AG and W83793G programmatically, sensors reported on
the W83793AG will report strange values.

    [18 lines not shown]
DeltaFile
+366-0sys/dev/iicbus/sensor/w83793g.c
+14-0sys/modules/i2c/w83793g/Makefile
+2-1sys/modules/i2c/Makefile
+1-0sys/conf/files
+383-14 files

FreeBSD/src 0b158desys/powerpc/pseries phyp_llan.c

pseries/llan: call init when ioctl sets interface UP

This should fix dhcp on an unitialized interface.  This solution was
found while comparing against another driver, SIOCSIFFLAGS is used by
dhclient to force the interface up before it has an IP address.
However, all setup work is done in llan_init(), so the interface would
not be enabled if configured via only the SIOCSIFFLAGS ioctl.  By
running llan_init() when the interface is forced up via SIOCSIFFLAGS,
the interface is initialized properly.

PR:             292164
(cherry picked from commit 74dff310698b9a4da9804ed0ded00428b0aebbe8)
DeltaFile
+4-0sys/powerpc/pseries/phyp_llan.c
+4-01 files

FreeBSD/src 237e851sys/powerpc/pseries phyp_llan.c

pseries/llan: call init when ioctl sets interface UP

This should fix dhcp on an unitialized interface.  This solution was
found while comparing against another driver, SIOCSIFFLAGS is used by
dhclient to force the interface up before it has an IP address.
However, all setup work is done in llan_init(), so the interface would
not be enabled if configured via only the SIOCSIFFLAGS ioctl.  By
running llan_init() when the interface is forced up via SIOCSIFFLAGS,
the interface is initialized properly.

PR:             292164
(cherry picked from commit 74dff310698b9a4da9804ed0ded00428b0aebbe8)
DeltaFile
+4-0sys/powerpc/pseries/phyp_llan.c
+4-01 files

FreeBSD/src 57fb48fsys/kern uipc_usrreq.c

linuxulator: fix SO_PEERCRED emulation after 1d24638d3e8

For Linux binaries, sopt->sopt_td may be null.  And there's also no
need to check it, since struct l_ucred has the same layout on 32-bit
systems as on 64-bit ones.

PR:             295333
Reported by:    Miguel Gomes <miguel.dias.gomes at protonmail.com>
Fixes:          1d24638d3e8 ("Fix LOCAL_PEERCRED in 32-bit compat mode")
Reviewed by:    emaste
Differential Revision: https://reviews.freebsd.org/D57032

(cherry picked from commit 4cee16d471d47f4673e4d2c66f7a96d4e6d86ee9)
DeltaFile
+3-1sys/kern/uipc_usrreq.c
+3-11 files

FreeBSD/src 5642fd4sbin/ping/tests test_ping.py

ping: fix listing test cases when scapy is not installed

The ATF-python test program was attempting to list test cases that
require scapy.  But it attempted to import the scapy module before the
test cases had been listed, resulting in an ImportError that kyua
interpreted as a test program crash.

Fix this behavior by handling that ImportError well enough to list test
cases, but not run them.  If scapy isn't present, Kyua will refuse to
run the test cases.  But it needs to be able to list them in order to
know to skip them.

Sponsored by:           ConnectWise
Reviewed by:            maxim
Differential Revision:  https://reviews.freebsd.org/D56765

(cherry picked from commit 3e845b1090565912375c5578cf0399d27b7fa70c)
DeltaFile
+25-1sbin/ping/tests/test_ping.py
+25-11 files

FreeBSD/src e6623a9share/man/man9 locking.9

locking.9: warn about using sleepable lock address as a sleep channel

(cherry picked from commit 56bc43f5d02bd0745d597db44c285bf78d083762)
DeltaFile
+10-5share/man/man9/locking.9
+10-51 files

FreeBSD/src af8675bsys/fs/nfsclient nfs_clsubs.c nfsnode.h

nfs_clsubs.c: Fix ncl_getcookie() when "pos" is negative

In ncl_getcookie(), a very large value for "off" for
a directory can result in "pos" being set to a bogus
value (including a negative one), due to truncation.
When "pos" is negative, is can skip past the
while (pos >= NFSNUMCOOKIES) loop and return a
bogus pointer instead of NULL.

This patch changes the type to u_int and also adds
a sanity check for a very large "off" to ensure that
a NULL pointer is returned for this case.

This bug has been in the code for decades and I am
not aware of any report of it causing a problem for
users.

(cherry picked from commit 448b4c3f7f7dd4c7e1707d7b833a26294c297182)
DeltaFile
+9-1sys/fs/nfsclient/nfs_clsubs.c
+1-1sys/fs/nfsclient/nfsnode.h
+10-22 files

FreeBSD/src 3aab037sys/fs/nfsclient nfs_clsubs.c nfsnode.h

nfs_clsubs.c: Fix ncl_getcookie() when "pos" is negative

In ncl_getcookie(), a very large value for "off" for
a directory can result in "pos" being set to a bogus
value (including a negative one), due to truncation.
When "pos" is negative, is can skip past the
while (pos >= NFSNUMCOOKIES) loop and return a
bogus pointer instead of NULL.

This patch changes the type to u_int and also adds
a sanity check for a very large "off" to ensure that
a NULL pointer is returned for this case.

This bug has been in the code for decades and I am
not aware of any report of it causing a problem for
users.

(cherry picked from commit 448b4c3f7f7dd4c7e1707d7b833a26294c297182)
DeltaFile
+9-1sys/fs/nfsclient/nfs_clsubs.c
+1-1sys/fs/nfsclient/nfsnode.h
+10-22 files

FreeBSD/src 3c07cfbusr.bin/elfdump elfdump.c

elfdump: Decode SHT_LLVM_ADDRSIG section header type

Reported by:    bz
Sponsored by:   The FreeBSD Foundation
DeltaFile
+1-0usr.bin/elfdump/elfdump.c
+1-01 files

FreeBSD/src b79facalib/libcasper/services/cap_net cap_net.c

cap_net: do not allow new limits to drop keys from the old ones

If the old limit had family/hosts/sockaddr set, the new limit must
have them too. Before, a missing key in the new limit was treated as
"allow any", which let a caller silently extend their limits.

Reported by:    Joshua Rogers of AISLE Research Team
Reviewed by:    markj
MFC after:      1 day
Differential Revision:  https://reviews.freebsd.org/D56991

(cherry picked from commit d705a519525f2acae3c1efba11436ec6ee8aea0a)
DeltaFile
+31-0lib/libcasper/services/cap_net/cap_net.c
+31-01 files

FreeBSD/src 7eb3fd6lib/libcasper/services/cap_net cap_net.c

cap_net: do not allow new limits to drop keys from the old ones

If the old limit had family/hosts/sockaddr set, the new limit must
have them too. Before, a missing key in the new limit was treated as
"allow any", which let a caller silently extend their limits.

Reported by:    Joshua Rogers of AISLE Research Team
Reviewed by:    markj
MFC after:      1 day
Differential Revision:  https://reviews.freebsd.org/D56991

(cherry picked from commit d705a519525f2acae3c1efba11436ec6ee8aea0a)
DeltaFile
+31-0lib/libcasper/services/cap_net/cap_net.c
+31-01 files

FreeBSD/src d84a691sys/powerpc/conf MPC85XX

powerpc: Remove stale include line from MPC85XX

The stale include line caused config -m to fail with an error trying
to parse the config file during make universe/tinderbox which in turn
caused universe/tinderbox to abort without building any powerpc
kernels (or subsequent architectures such as riscv64) with the error:

make[2]: freebsd/main/Makefile:767: Target architecture for powerpc/conf/MPC85XX unknown.  config(8) likely too old.
        in .for loop from freebsd/main/Makefile:761 with kernel = MPC85XX
        in make[2] in directory "freebsd/main"

make[2]: stopped making "universe_kernels" in freebsd/main
*** Error code 1

Reported by:    npn, many others
Fixes:          fd8d34ce272b ("dpaa: Migrate from NCSW base to a home-grown driver")
DeltaFile
+0-1sys/powerpc/conf/MPC85XX
+0-11 files

FreeBSD/src 296c174sys/kern vfs_subr.c

vnlru: avoid trigger calculation when force < 2

Reviewed by:    kib (previous version), olce
Sponsored by:   Dell Inc.
Differential Revision:  https://reviews.freebsd.org/D56950
DeltaFile
+13-12sys/kern/vfs_subr.c
+13-121 files

FreeBSD/src 8de34a8sys/arm64/iommu smmu.c

arm64/iommu: Add a missing close parenthesis

Fixes:          6dc813301a17 ("sys: Use is_pci_device instead of direct comparisons to devclasses")
Sponsored by:   Chelsio Communications
DeltaFile
+1-1sys/arm64/iommu/smmu.c
+1-11 files

FreeBSD/src 8c9dc47sys/dev/vnic thunder_bgx_fdt.c

vnic: Add missing #include

Reported by:    bz, olivier
Fixes:          6dc813301a17 ("sys: Use is_pci_device instead of direct comparisons to devclasses")
Sponsored by:   Chelsio Communications
DeltaFile
+1-0sys/dev/vnic/thunder_bgx_fdt.c
+1-01 files

FreeBSD/src 51fcd5dsys/netinet igmp.c, sys/sys mbuf.h

igmp: Avoid leaving dangling pointers in the state-change queue

When igmp_v3_merge_state_changes() is iterating over state-change
packets, there is a case where it'll free a queued packet but will fail
to remove it from the queue.  Fix that.

Reported by:    Yuxiang Yang, Yizhou Zhao, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM5.1 from Z.ai
Reviewed by:    pouria, glebius
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56947

(cherry picked from commit beab4a237a45aea809e81802b9e1e9ff30f3d929)
DeltaFile
+5-3sys/netinet/igmp.c
+8-0sys/sys/mbuf.h
+13-32 files

FreeBSD/src 74d5c2bsys/net if_vxlan.c

if_vxlan: Update *m0 after a pullup

vxlan_input()'s caller is supposed to free *m0 if it is non-NULL after
the function returns.  vxlan_input() failed to update *m0 after the
pullup however, so if it hits an error case after the pullup, we'll free
the mbuf twice.  Currently this can happen only if the interface is
brought down or due to a packet loop.

Reported by:    Yuxiang Yang, Yizhou Zhao, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM5.1 from Z.ai
Reviewed by:    pouria, zlei
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56944

(cherry picked from commit a6c4fe2d1a38885914b1c3e85508b965ccdb7874)
DeltaFile
+1-2sys/net/if_vxlan.c
+1-21 files

FreeBSD/src 7797d07tests/sys/kern Makefile

tests/timerfd: Serialize

At least one of these tests changes the system clock, which potentially
interferes with concurrently running tests and causes them to fail.

MFC after:      1 week

(cherry picked from commit 001cfc7b8aa38122c4e0fe8ae48fae3556a1f2b6)
DeltaFile
+2-0tests/sys/kern/Makefile
+2-01 files

FreeBSD/src 04d8c9asys/net/route route_tables.c

routing: Use a better error number in sysctl_fibs()

ENOTCAPABLE is for capsicum and its use here is inappropriate.  In
particular, note that syscallret() treats this value specially.

Reviewed by:    glebius, pouria, zlei
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56481

(cherry picked from commit 8de0fc10a1c2d65bdb39eff862266ab1f87902c8)
DeltaFile
+1-1sys/net/route/route_tables.c
+1-11 files

FreeBSD/src 5937f2ftests/sys/net if_lagg_test.sh

tests/if_lagg: Minor improvements

- Set require.kmods instead of relying on ifconfig to load if_lagg.ko,
  as this doesn't work when running within a jail.
- Simplify helper functions which create tap and lagg devices.

MFC after:      1 week

(cherry picked from commit 47ae0135d461854b72b905ac77bf3e1f5b2868bc)
DeltaFile
+11-24tests/sys/net/if_lagg_test.sh
+11-241 files

FreeBSD/src 605d3bctests/sys/netinet socket_afinet.c

tests/socket_afinet: Fix the bind_connected_port test

The test verifies that a socket can bind to a local address assigned by
connect(2) to a different socket.  It was however trying to bind to the
wrong address, and the check of the result was inverted, so this went
unnoticed.  It also needs to set SO_REUSEADDR for this to succeed.

Reported by:    glebius
MFC after:      1 week

(cherry picked from commit d3d0466cae546254c50c80cf3e0c060bbbbba53c)
DeltaFile
+7-7tests/sys/netinet/socket_afinet.c
+7-71 files

FreeBSD/src 5bf82cbtests/sys/posixshm posixshm_test.c

tests/posixshm: Check for hardware support in largepage_pkru

MFC after:      3 days
Fixes:          ca87c0b8e396 ("pkru: Fix handling of 1GB largepage mappings")

(cherry picked from commit 75c66218401c00f4728d5312e2b933b8d3aefde1)
DeltaFile
+10-0tests/sys/posixshm/posixshm_test.c
+10-01 files

FreeBSD/src 8eab86fcontrib/netbsd-tests/lib/libc/sys t_mmap.c

netbsd-tests: Fix the mmap_truncate_signal test

Add a volatile qualifier in the loop which triggers SIGBUS, as otherwise
the compiler is smart enough to elide it, replacing it with a check for
page != 0.

MFC after:      1 week

(cherry picked from commit e3b8e55e710bf355f371d798aa943281007a7ea9)
DeltaFile
+1-1contrib/netbsd-tests/lib/libc/sys/t_mmap.c
+1-11 files

FreeBSD/src 7d63a75sys/net/route route_tables.c

routing: Initialize V_rt_numfibs earlier during boot

V_rt_numfibs can be set at compile time (with the ROUTETABLES kernel
config option) or boot time (with the net.fibs tunable).
vnet_rtables_init(), running during SI_PROTO_DOMAIN, was checking the
tunable and updating V_rt_numfibs accordingly, but that means that
earlier SYSINITs, such as vnet_mroute_init(), see the compile-time value
for V_rt_numfibs before it gets corrected in vnet_rtables_init().

Fix this by initializing V_rt_numfibs earlier, so that SYSINITs are less
likely to use the wrong value.

Add a comment describing the weird, preexisting semantic of resetting
rt_numfibs to 1 in VNET jails.

PR:             294510
Reviewed by:    glebius, zlei, pouria
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56473

    [2 lines not shown]
DeltaFile
+16-8sys/net/route/route_tables.c
+16-81 files

FreeBSD/src 4f29251sys/net if_fwsubr.c

net: bandaid for plugging a fw_com leak in fwip_detach()

Adding a temporary workaround for plugging a fw_com upon if_fwip unloading.

Steps to reproduce(needs two hosts connected with firewire):

  while true; do
    ifconfig fwip0 10.0.0.5 up
    fwcontrol -r
    ping -c 10.0.0.3
    kldunload if_fwip
  done

There's a chance that the unloading of if_fwip.ko triggers following warning:

        Warning: memory type fw_com leaked memory on destroy (1 allocations, 64 bytes leaked).

commit d79b6b8ec267e7eef6e07cf4245159705e24acd5 (origin/main, origin/HEAD)

(cherry picked from commit 25a5bb7318052322190a2880e0e7ef18e06d54bd)
DeltaFile
+1-0sys/net/if_fwsubr.c
+1-01 files

FreeBSD/src de69cf1sys/netinet tcp_subr.c

tcp: cleanup

No functional change intended.

Reviewed by:            pouria, rrs, Timo Völker
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D55415

(cherry picked from commit c984c7593e11aa95f21f79bb5425a9d5e9181945)
DeltaFile
+12-12sys/netinet/tcp_subr.c
+12-121 files