acpi_pci: Honor device proximity for DMA tags
A PCI function with its own _PXM still inherits a DMA tag carrying
the upstream bridge's proximity domain. Resolving an SR-IOV VF's
locality through its PF therefore does not affect the domain used for
DMA allocations.
Create and cache a private child tag when the function, or a VF's
owning PF, has an explicit _PXM. Parent it to the existing PCI or IOMMU
tag so its constraints remain intact, then apply the function's domain
without mutating a shared tag.
pci_get_dma_tag() already performs the IOMMU lookup, so remove the
duplicated lookup in the ACPI subclass while here.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59063
acpi_pci: Cache PCI proximity domains
A PCI function's _PXM is stable for the lifetime of its device
instance, but CPU and DMA locality queries may evaluate it repeatedly.
SR-IOV amplifies this because every VF resolves locality through the
same PF.
Cache successful mappings and the stable absence of _PXM on the
locality source device, and share that result between CPU and domain
queries. Continue to retry generic evaluation or mapping errors rather
than making a potentially transient failure permanent.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59207
acpi_pci: Preserve CPU locality queries for descendants
bus_generic_get_cpus() preserves the original leaf device while
forwarding a request through the bus hierarchy. Consequently,
acpi_pci_get_cpus() may receive a descendant below a PCI function
rather than one of the PCI bus's direct children.
Only apply the SR-IOV PF-locality mapping to direct PCI children.
Preserve the previous ACPI CPU-locality lookup for descendants so their
unrelated bus ivars are not interpreted as PCI device information.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59206
[alpha.webkit.NoDeleteChecker] Allow a temporary Ref/RefPtr when the result is kept alive (#219074)
Creating a temporary Ref/RefPtr is ordinarily treated as a potentially
destructive operation because the destructor could call deref for the
last time and destruct the object.
However, when such a temporary Ref/RefPtr is immediately converted to
another Ref/RefPtr, such a destruction will never take place and
therefore safe.
This PR adds the logic to detect this case when handling
CXXConstructExpr and allow it in alpha.webkit.NoDeleteChecker and in
other WebKit checkers which check "triviality" of given code.
[Offload][Lang] Add internal StreamTy (#216374)
Add an internal StreamTy wrapper for CUDA/HIP language streams in
LLVMOffloadKernel.
`cudaStream_t`/`hipStream_t` now point to runtime-owned StreamTy objects
instead of raw ol_queue_handle_t values. StreamTy tracks the backing
queue, owning device, and stream kind, which lets the runtime manage
explicit streams and default streams through shared state.
Assisted by GPT-5.5, checked and reviewed manually
[mlir] Print unit prop-dict entries by presence (#219315)
Teach generated prop-dict parsers and printers to use a bare key for
`UnitAttr` and false-default `UnitProp` entries while retaining the
explicit value spelling for compatibility.
Assisted-by: Codex
[clang][ssaf] Fix Windows link error by adding clangAST dependency (#219305)
Fixes link failure in SrcEditMerge(Introduced in #216183) on Windows due
to a missing clangAST dependency.
rdar://179151250
lldb: Linux: restore __ptrace_request typedef for bionic+musl (#219237)
glibc declares ptrace as taking an enum __ptrace_request as its first
argument. Because C++ does not allow implicit conversion from int to an
enumeration type, callers must cast int arguments to __ptrace_request
(e.g., static_cast<__ptrace_request>(req)).
However, bionic and musl declare ptrace as taking an int and do not
define __ptrace_request. Providing a fallback typedef int
__ptrace_request
allows the static_cast to compile across all three libcs.
I removed this typedef by accident in
ef9085f5bdb52b27258c150bd7e1fd812fc406c8.
Fixes: commit ef9085f5bdb5 ("lldb: Linux: empty Ptrace.h pollyfill")
Link: https://github.com/llvm/llvm-project/issues/217413
Give a working command for regenerating the alert inventory
This commit fixes an issue where the documented way to regenerate the alert applicability inventory does not work: run from the repository root it imports the installed middlewared rather than the working tree, and collection fails before anything is regenerated. Both the docs and the module docstring now give the invocation CI uses, from `src/middlewared` with `PYTHONPATH=.`.
[VPlan] Handle trunc in replaceSymbolicStrides (#216367)
LoopAccessAnalysis skips IntegralCast expressions when speculating
strides, but the trunc case is missing in replaceSymbolicStrides. Add
the case, and make some non-functional improvements while at it.
posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler
The check for whether shm_lp_psind was assigned was unlocked. This race
can be exploited to create an object with psind==2 but with only
pagesizes[1] worth of pages populated. This in turn can be used to
escalate privileges.
Fix this by acquiring the rangelock earlier. In shm_mmap_large(),
assert that we hold the rangelock. In shm_write(), annotate an unlocked
load of shm_lp_psind.
Approved by: so
Security: FreeBSD-SA-26:63.posixshm
Security: CVE-2026-58094
Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59104
[2 lines not shown]
tty: Revalidate after dropping the tty lock in ioctl handlers
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the
proctree relock. After relocking the tty, it did not revalidate the
tty state, and it could end up linking a doomed tty to the calling
process' session. This race can be exploited to escalate privileges.
TIOCSPGRP has a similar race, fix that too.
Approved by: so
Security: FreeBSD-SA-26:62.tty
Security: CVE-2026-58093
Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59126
(cherry picked from commit b207f754c7709212381eda8c91dbf080081ac5a1)
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
openssl: Fix multiple vulnerabilities
This is a rollup commit from upstream to fix:
Handle signature_algorithms_cert extension in key-only context
Avoid double free of qrx in port_default_packet_handler()
Avoid full read buffer allocation when buffering DTLS next-epoch records
ssl/record/methods/dtls_meth.c: lower the unprocessed_rcds queue limit
ssl/record: remove dead DTLS processed_rcds record queue
Fix heap buffer overflow (8-byte OOB write) in AES-WRAP-PAD unwrap
CMP unexpected sender DN used as format string in ERR_raise_data()
Add test for CVE-2026-63073
Add a test for restricting growth in cmp cert cache
Fix unbounded cert cache growth in cmp
Don't store ACK-only frames in TX history for QUIC.
Add test for CVE-2026-63076
Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlg
Approved by: so
Obtained from: OpenSSL
[11 lines not shown]
cred: Fix group_is_primary()
This helper wasn't updated in commit be1f7435ef21, so in reality it was
testing whether "gid" is the first supplemental group. If a user
doesn't belong to a supplementary group, then it's testing an
uninitialized slot; since ucreds are allocated with M_ZERO, this
typically means that we're testing gid == 0.
group_is_primary() has exactly one use, in mac_do. There, it's used to
determine whether the requested primary GID can be used in a setcred(2)
call when the ruleset does not explicitly specify a target primary GID.
I believe this is mostly exploitable by daemons which have explicitly
dropped privileges and called setgroups(0, NULL); logged in users will
have a non-empty supplementary group list by virtue of having gone
through initgroups(3).
Fix group_is_primary(), and add a regression test.
[11 lines not shown]
dsp: Fix a potential use-after-free in dsp_oss_syncstart()
This function has a loop where it attempts to lock all channels in a
group. If doing so would block, it releases all locks, sleeps for a
bit, and tries again. However, once the syncgroup lock is dropped,
nothing prevents the syncgroup structure from being freed.
Fix the inner loop: after waking up, break out of it unconditionally and
start everything again. I think the old code was also buggy and not
well-exercised: after waking up we'd continue to try and continue
locking channels. Then we'd try again from the beginning and fail to
lock the channels we had already locked.
Approved by: so
Security: FreeBSD-SA-26:58.sound
Security: CVE-2026-58091
Reported by: Hazley Samsudin of GovTech CSG
Reviewed by: christos
Sponsored by: The FreeBSD Foundation
[4 lines not shown]
hwpmc: Fix the execve handler
When a process execve()s, pmc_process_exec() is supposed to evaluate
whether the new image is setuid/setgid and if so, whether to detach
PMCs. This was handled by pmc_can_attach(), which is effectively an
open-coded copy of cr_xids_subset().
Unfortunately, the test of the result of this function was inverted,
with the result that we'd detach PMCs only if the predicate said it was
okay to do so. It appears the bug has always been there; it seems the
intent was to return 0 on "success", i.e., it is okay to attach the
PMCs, much like p_candebug(). Commits 1c3c698ba4c4 and 1c40b15971f0
obscured this a bit.
I think this check is trying to be too clever. Let's make it simpler:
simply do not attach PMCs unless the owner is privileged. This is how,
e.g., ktrace works. I do not think it's worth trying to be more
sophisticated than this unless we can generalize the policy in a way
that's applicable to other subsystems.
[14 lines not shown]
ModuloSchedule: Use use_instructions instead of use_operands + getParent (#219297)
The use list only inspected the user, so directly loop over the users.
Co-authored-by: Claude (Claude-Opus-4.8) <noreply at anthropic.com>
Rematerializer: Use def_instructions instead of def_operands + getParent (#219298)
Directly iterate the user instructions instead of querying the same
parent for each use.
Co-authored-by: Claude (Claude-Opus-4.8) <noreply at anthropic.com>
[ADT] Remove ComputeNodeHash and Trait::ComputeHash (NFC) (#219029)
With the switch to open addressing (commit b3411b89c3af),
FoldingSetNode stores its hash in the node itself. Table growth
rehashes nodes by calling getFoldingSetHash(), leaving ComputeNodeHash
and Trait::ComputeHash unused.
Clarify the alert applicability docs and inventory naming
This commit adds changes to address review feedback on the alert applicability work: the frozen inventory moves out of `golden/` into `inventory/` so the directory name says what it holds, the documentation drops the parts that duplicate the inventory file's own header along with the aside about rules we do not accept, and the black hole scan loses its `alert.oneshot_create` branch since no alert source names a class by string. Regenerating the inventory is a no-op, so no population moved.
[mlir][IR][NFC] Disambiguate `SymbolTable::Visibility` references (#219301)
As a follow-up to 979b722, address MSVC's confusion when it's trying to
resolve the underqualified enum name:
```
error C2955: 'mlir::OpTrait::SymbolTable': use of class template requires template argument list
```
Assisted-by: OpenAI Codex
Signed-off-by: Artem Gindinson <gindinson at roofline.ai>
