umtx: Do not make an exiting thread the owner of a PI mutex
Otherwise an assertion in umtx_thread_alloc()
(TAILQ_EMPTY(&uq->uq_pi_contested)) is violated.
This use of TDB_EXIT is hacky, but I cannot see another way to check for
an exiting thread without adding some more overhead to kern_thr_exit().
Fixes: 2a339d9e3dc1
Reported by: Maik Muench of Secfault Security
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58447
kqueue: Add a helper macro for sleeping on in-flux knotes
Other in-flux operations are implemented by this set of macros, so we
should do the same for sleeping.
No functional change intended.
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58443
proc: Copy the p_reapsubtree field explicitly during fork
p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc,
which is copied during fork without any synchronization. However, the
field is not stable except when the proctree lock is held, and indeed
may change if p1's reaper exits or explicitly releases its reaper
status. This state change can race with fork() and leave the child with
an incorrect p_reapsubtree field.
Close the race: explicitly copy the field under the proctree lock during
fork.
Reported by: syzkaller
Reviewed by: kib
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58482
rpcinfo: Fix buffer overflows
Several functions were using sprintf() to write RPC server-controlled
data to a stack buffer. Adopt some minimal changes from NetBSD to avoid
the potential overflows.
Security: CVE-2026-16277
Security: CVE-2026-16461
Reviewed by: khorben
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58441
libfetch: Fix handling of connection failures
After commit 848f360c8f9a, if one tries to connect to a closed port,
fetch reports "Operation now in progress", which is rather confusing.
Return a more useful error message, restoring the old behaviour.
Fixes: 848f360c8f9a ("libfetch: Apply timeout to connection attempts")
Reviewed by: des
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D58481
sysctl(9): Booleans: Fix old value length discovery
When calling sysctl(3) with a null 'oldp', i.e., length discovery mode,
'oldix' can be equal to 'oldlen', and we should not fail.
More generally, let SYSCTL_OUT() and SYSCTL_IN() handle corner cases,
simply removing the comparisons between 'oldidx' and 'oldlen' and
'newidx' and 'newlen' done by hand as the test just after is an equality
that does not require to know if 'idx' is smaller than 'len'.
PR: 292917
Reported by: cy
Fixes: 406da392ef8d ("sysctl(9): Booleans: Accept integers to ease knob conversion")
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 895e1c6567d9561c86f8d20b47e924911bce989e)
netinet: Promote IFP_TO_IA() from macro to function in_ifprimaryaddr().
in_ifprimaryaddr() exists only to support IPv4 multicast usage. Since the
adoption of epoch tracking, ifa_ref() is no longer required in its body;
that was originally introduced by rwatson in 2009.
We could not use __deprecated1() from <sys/cdefs.h> anyway, as
IFP_TO_IA() is a macro, not a function.
Approved by: glebius (2026-02-26)
Reviewed by: adrian, glebius, pouria
Differential Revision: D55344
netinet: Replace IFP_TO_IA() with in_ifprimaryaddr() completely.
IPv4 multicast currently has the big caveat that it depends on the first
assigned IPv4 address on an interface (the so-called "primary address").
in_ifprimaryaddr() only needs to be used by the following:
- the 0.0.0.0 booting node input workaround in IGMPv1;
- filtering out the node's own reports in IGMPv2;
- preserving the source IP where an IGMPv3 report has been looped back;
- inferring the default upstream IPv4 interface address for the
IP_MULTICAST_IF socket option;
- and inferring the source address during ip_output() for a multicast
datagram where an interface has been explicitly specified by that option.
All of these uses mandate the use of IPv4 source address selection, but
FreeBSD does not yet (fully) implement this functionality.
Approved by: glebius (2026-02-26)
Reviewed by: adrian, glebius, pouria
Differential Revision: D55345
vm_page: Fix dequeue on arches with weak ordering
A vm_page's a.queue field records the page queue index for the page
queue to which the page belongs. The PGA_ENQUEUED flag indicates
whether the page is actually enqueued in that queue's TAILQ. When
modifying the a.queue field, you need to hold the page queue lock for
the queue corresponding to the old value, unless the old value is
PQ_NONE.
Suppose a managed page is freed. vm_page_free_prep() calls
vm_page_dequeue_deferred(), which checks whether the page belongs to a
queue; if so it schedules an asynchronous dequeue operation so that page
queue lock acquisitions can be batched if possible.
The dequeue operation must be completed before the page's plinks.q
fields are reused. So, during page allocation, we call
vm_page_dequeue() to finish the dequeue operation. Similarly, since the
buddy allocator uses the plinks.q fields for its own internal linkage,
vm_freelist_add() calls vm_page_dequeue().
[19 lines not shown]
taskqueue: Avoid unbounded epoch read sections
The taskqueue thread loop tries to avoid entering and exiting net epoch
read sections for every task. This reduces the overhead of net epoch
integration, but the implementation wasn't bounding the length of the
read section, so a busy taskqueue thread could hold an epoch open for an
unbounded period. This is easy to achieve with the epair task, for
instance.
Bound the number of tasks that we'll execute without observing the
global epoch, and provide a sysctl to control it. Let the default bound
be eight.
Reviewed by: glebius
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D58031
(cherry picked from commit a58590631ccc0fa5bdbbdf88021c6878d644d128)
iflib: Remove an unused field from struct iflib_rxq
Reported by: Alexander Sideropoulos <Alexander.Sideropoulos at netapp.com>
MFC after: 1 week
(cherry picked from commit fc09c7fee23b3cf3ddc95105ef6ef41d7956232f)
qat: driver updates to enhance qat infrastructure
- Updated QAT infrastructure FW version/AE mask/num_banks fields
to facilitate integration of future QAT products.
- Exposed service as sym;asym instead of cy for gen4
- Enhanced cpaGetInstances() for accurate instance retrieval
- Added 57-bit virtual address support to lac_lock_free_stack
- Minor bug fixes and improvements
Signed-off-by: Hareshx Sankar Raj <hareshx.sankar.raj at intel.com>
Reviewed by: markj
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D57746
(cherry picked from commit 682f135f5de39cfc24cfd529ea8a161e94c76c8e)
inpcb: declare struct in_conninfo as a single declaration
This removes just one level of #define mess that is needed to reach into
an inpcbs IPv4 address. And makes the declaration easier to read. No
functional change.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D58273
geom_zero(4): reset the uio vector on each uiomove()
PR: 297062
Tested by: Jordan Gordeev <jgopensource at proton.me>
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58472
getfhat: Add missing 'const' to path argument
This matches the documented prototype and avoids spurious
-Wincompatible-pointer-types-discards-qualifiers warnings when passing
a constant pathname.
Sponsored by: AFRL, DARPA
vm_page: Fix dequeue on arches with weak ordering
A vm_page's a.queue field records the page queue index for the page
queue to which the page belongs. The PGA_ENQUEUED flag indicates
whether the page is actually enqueued in that queue's TAILQ. When
modifying the a.queue field, you need to hold the page queue lock for
the queue corresponding to the old value, unless the old value is
PQ_NONE.
Suppose a managed page is freed. vm_page_free_prep() calls
vm_page_dequeue_deferred(), which checks whether the page belongs to a
queue; if so it schedules an asynchronous dequeue operation so that page
queue lock acquisitions can be batched if possible.
The dequeue operation must be completed before the page's plinks.q
fields are reused. So, during page allocation, we call
vm_page_dequeue() to finish the dequeue operation. Similarly, since the
buddy allocator uses the plinks.q fields for its own internal linkage,
vm_freelist_add() calls vm_page_dequeue().
[19 lines not shown]
taskqueue: Avoid unbounded epoch read sections
The taskqueue thread loop tries to avoid entering and exiting net epoch
read sections for every task. This reduces the overhead of net epoch
integration, but the implementation wasn't bounding the length of the
read section, so a busy taskqueue thread could hold an epoch open for an
unbounded period. This is easy to achieve with the epair task, for
instance.
Bound the number of tasks that we'll execute without observing the
global epoch, and provide a sysctl to control it. Let the default bound
be eight.
Reviewed by: glebius
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D58031
(cherry picked from commit a58590631ccc0fa5bdbbdf88021c6878d644d128)
iflib: Remove an unused field from struct iflib_rxq
Reported by: Alexander Sideropoulos <Alexander.Sideropoulos at netapp.com>
MFC after: 1 week
(cherry picked from commit fc09c7fee23b3cf3ddc95105ef6ef41d7956232f)
ktimer: Check for errors from realtimer_gettime()
clock_gettime(CLOCK_TAI) can fail, leaving *ovalue uninitialized.
Reported by: Hazley Samsudin of GovTech CSG
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58225
(cherry picked from commit 2f1ec7d159cbe56d40e7b6d7fc4188c9079e1783)
qat: driver updates to enhance qat infrastructure
- Updated QAT infrastructure FW version/AE mask/num_banks fields
to facilitate integration of future QAT products.
- Exposed service as sym;asym instead of cy for gen4
- Enhanced cpaGetInstances() for accurate instance retrieval
- Added 57-bit virtual address support to lac_lock_free_stack
- Minor bug fixes and improvements
Signed-off-by: Hareshx Sankar Raj <hareshx.sankar.raj at intel.com>
Reviewed by: markj
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D57746
(cherry picked from commit 682f135f5de39cfc24cfd529ea8a161e94c76c8e)
linux/futex: Don't load a timeout when try-locking a mutex
linux_sys_futex() does not copyin a timespec for the timeout if the
operation is LINUX_FUTEX_TRYLOCK_PI, presumably because it doesn't make
sense to specify a timeout for a try-lock operation. However, this
means that we pass a userspace timespec pointer to
linux_umtx_abs_timeout_init().
Modify linux_futex_lock_pi() to not initialize the timeout if we're
try-locking.
Reviewed by: kib, dchagin
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58061
(cherry picked from commit 407c7c339adb429efcb6658accd16399031c34ca)
vfs: Fix resource leaks in kern_symlinkat()
Fixes: 2ec2ba7e232d ("vfs: Add VFS/syscall support for Solaris style extended attributes")
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by: rmacklem, kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58053
(cherry picked from commit 58c73727d6e49de1fc4f4bc90621146cae8db2bc)
jaildesc: Publish the new fd only after the jaildesc is initialized
jaildesc_alloc() finishes initializing the file structure only after it
is made visible from the file descriptor table via finit(). In that
window, other threads could try to perform operations on the descriptor
and thus access an incompletely initialized jaildesc.
Defer the finit() call until locks are initialized. While here,
simplify the error path for falloc_caps().
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by: jamie
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58049
(cherry picked from commit 38dd686b9336e2de5deadc5f8cb5e46a845b0dd9)
