[SimplifyCFG] Mark branch weights unknown in masked switch to lookup (#233321)
We cannot infer the branch weights because this transformation splits
the default case into two (values fully out of range, and holes inside
the range), which we cannot infer without additional value profiling.
[mlir][arith] Drop invalid overflow flags when narrowing
Preserve nsw only when narrowing preserves signed operand and result
values, and nuw only when it preserves unsigned values. Flags proven
at the original width may otherwise introduce poison after narrowing.
Add concrete regression cases for addi, subi, muli, and shli, covering
both overflow flags and retention of valid flags.
iflib: Pass up the frames received before a descriptor error
When the driver's isc_rxd_pkt_get() fails part way through a receive
pass, iflib_rxeof() jumps straight to the reset request. The frames it
already took off the ring and chained for if_input() are neither passed
up nor freed, so up to budget - 1 frames are lost and their mbufs and
clusters leak on every such error, and the frames queued to LRO in the
pass wait for the next one. Leave the loop instead, pass the chain up
and flush LRO as on the normal exit, then request the reset as before,
without refilling.
The path is reachable from several drivers: igc, em, igb and ixgbe
return EBADMSG for frames received with errors, which the hardware
passes up only with store-bad-packets enabled; ixl, iavf and ice for
every descriptor flagged RXE; aq, enetc, mgb and enic for descriptors
they cannot use.
Reviewed by: gallatin
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60805
Fix overflow in hardware accelerated AES-GMAC crypto.
On amd64 using AES-NI or on octeon with crypto coprocessor, an
unauthenticated ESP packet that matches a configured AES-GMAC
security association could copy almost 64 KB of attacker-controlled
data into a 4096-byte kernel heap buffer.
from Acts1631; OK visa@ hshoexer@
isakmpd: Bound the HASH coverage in cfg_verify_hash()
The verifier assumed the HASH payload is the first payload and
derived the covered length from the message length, reading past
the end of the message when another payload precedes HASH. Compute
the covered range from the HASH payload's actual position and reject
it if it extends past the message end.
from hshoexer@; from markus@; OK hshoexer@ deraadt@
this is errata/7.9/036_isakmpd.patch.sig
isakmpd: Bound the HASH coverage in cfg_verify_hash()
The verifier assumed the HASH payload is the first payload and
derived the covered length from the message length, reading past
the end of the message when another payload precedes HASH. Compute
the covered range from the HASH payload's actual position and reject
it if it extends past the message end.
from hshoexer@; from markus@; OK hshoexer@ deraadt@
this is errata/7.8/072_isakmpd.patch.sig
Fix an off-by-one in bsd_decompress()
An incorrect bounds check for the LZW KwKwK case allows the creation of a
self-refential dictionary entry, resulting in an infinite expansion loop
that writes backward from the output mbuf, corrupting kernel memory.
This is an ancient buffer overflow that is also present in the version of
the code in RFC 1977.
from Acts1631; from tb@; OK deraadt@
this is errata/8.0/001_ppp.patch.sig
Fix an off-by-one in bsd_decompress()
An incorrect bounds check for the LZW KwKwK case allows the creation of a
self-refential dictionary entry, resulting in an infinite expansion loop
that writes backward from the output mbuf, corrupting kernel memory.
This is an ancient buffer overflow that is also present in the version of
the code in RFC 1977.
from Acts1631; from tb@; OK deraadt@
this is errata/7.9/035_ppp.patch.sig
Fix an off-by-one in bsd_decompress()
An incorrect bounds check for the LZW KwKwK case allows the creation of a
self-refential dictionary entry, resulting in an infinite expansion loop
that writes backward from the output mbuf, corrupting kernel memory.
This is an ancient buffer overflow that is also present in the version of
the code in RFC 1977.
from Acts1631; from tb@; OK deraadt@
this is errata/7.8/071_ppp.patch.sig
[mlir][arith] Preserve unsigned values when narrowing operations
Require unsigned representability for divui, ceildivui, remui, and shrui.
A signed range fitting the narrower type does not preserve the unsigned
operand values, even when the result fits.
Add concrete counterexamples and coverage for safe narrowing of
zero-extended and proven nonnegative operands.
iwn: fix TX QoS AC -> TID mapping for A-MPDU selection
Map the packet QoS value to a TID before looking it up in the
per node + TID AMPDU state array.
The TX A-MPDU state used to be per-AC, but I changed it to be
per-TID because it /is/ negotiated per-TID. However this is
not aligned correctly and A-MPDU on eg the voice queue would
cause a mismatch and thus packets to get dropped.
(TIDs 8..15 are special and session based, not traffic QoS based.)
I noticed this because "ssh host" failed after a while, but
"telnet host 22" succeeded. It turned out that frames weren't
making it to the driver transmit path and I traced it
back to being dropped here. Traffic worked for a while until
A-MPDU TX was negotiated, and then all traffic on a TID
would fail until the 802.11 association was re-established.
[7 lines not shown]
status/2026q3: Add Cyber Resilience Act (CRA) entry
Text author: Alice Sowerby <alice at freebsdfoundation.org>
Reviewed by: status (salvadore)
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60734
status/2026q3: Add FreeBSD Foundation entry
Section authors:
Advocacy: Anne Dickison <anne at freebsdfoundation.org>
Florine Kamdem <florine at freebsdfoundation.org>
OS Improvements: Joe Mingrone <jrm at FreeBSD.org>
Reviewed by: status (salvadore)
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60735
status: Fix minor issues with Foundation entries
- Fix three broken links in the 2026Q2 Foundation entries
- Whitespace cleanup
Reviewed by: status (salvador), vladlen
Fixes: fc209492436 ("website: clean warnings to links in status reports")
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60712
[SLP] Handle REVEC when costing expanded compress mask
With REVEC the scalars are vectors. The masked-load-compress shuffle that is
emitted uses the compress mask expanded to the elements of those vectors
(transformScalarShuffleIndiciesToVector), but the cost was computed with the
unexpanded per-vector mask, so a shuffle such as <24 x i8> -> <16 x i8> was
costed as a <2 x i8> shuffle. This made the compress sequence looked cheaper
than it is.
Assisted-By: Claude Sonnet 5.5
httpd: Fix "server match" configuration blocks
The return value of str_find() as used in SRVFLAG_SERVER_MATCH was not
checked at all. This meant any "server match" block behaved like a
wildcard.
ok rsadowski@
