libtcplay,cryptdisks: Fix GCC 12's -Wmaybe-uninitialized false positive
This reverts commit b77d373551e67a9ce62d8063b8dd7bafd6f9e360 and
correctly fix/silence the GCC 12's -Wmaybe-uninitialized warning, which
is actually a false positive.
GCC's rationale is: the memory 'mem' refers to was not initialized and
may be used in mlock(). The 'mem' parameter is passed as 'const void *',
so mlock() is impossible to initialize the memory.
Discussed-with: swildner
See-also: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118588#c1
vm: Clean up cdev_pager_allocate() a bit
* Introduce 'pindex' variable to clean up the code.
* Add KASSERT() to ensure the object type matches (obtained from FreeBSD)
vm: Remove duplicate reference in cdev_pager_allocate()
The code was updated in 2013 [1] to bring in various changes from
FreeBSD, but left this duplicate reference. Remove the erroneous
vm_object_reference_locked() call.
[1] kernel: Port new device_pager interface from FreeBSD
commit f2c2051ee473577d22178d55f782ceebbd88d58f
GitHub-PR: #49
Credit: LI Leding
wg: Destroy newly created peers on failure
Previously, a newly created peer was not destroyed even if there were
errors in configuring it, e.g., invalid AllowedIPs. The rationale was
that the user could correct the error by issuing another 'ifconfig'
command with the fixed arguments.
Now destroy the new peer if an error occurs, making a complex 'ifconfig'
command that adds a peer atomic. This matches the behavior of FreeBSD.
As part of this change, refactor wg_ioctl_set() by extracting
wg_ioctl_set_peer() to handle a single peer, and add 'const' qualifiers
where appropriate.
kernel: Disable build-ID for vkernel(7) and fix build
Vkernel(7) doesn't use a linker script, so it's not easy to define
__build_id_{start,end} for it.
A solution would be to locate the ELF in memory, parse and walk the
program headers to find the ".note.gnu.build-id" section.
Reported-by: Michael Neumann
wg: Return ENETUNREACH when transmitting to a non-existent peer
Do the same thing as FreeBSD and OpenBSD.
Obtained-from: FreeBSD (https://reviews.freebsd.org/D44582)
rpcinfo(8): Fix stack buffer overflow in rpcbdump()
The function previously used unbounded sprintf() and strcat() to format
the info into a fixed 256-byte stack buffer. A malicious or compromised
rpcbind endpoint that returns enough distinct version numbers for a
single program (roughly 24 maximum-width decimal values plus separators)
can overflow this buffer.
CVE: CVE-2026-16461
Openwall: CVE-2026-16277 & CVE-2026-16461: buffer overflows in rpcinfo
(https://www.openwall.com/lists/oss-security/2026/07/23/8)
kernel/linker: serialize recursive unload
Restore the safe list traversal from commit
e7a2d40362352344eff1c4f395caf0a735e00a3e.
'llf_lock' is now recursive and held through the unload path, so
callbacks and dependency release can recurse without exposing a
partially unloaded file.
GitHub-PR: #50
kernel/linker: preserve refs after unload veto
linker_file_unload() used to take a temporary file reference (file->refs)
before notifying modules to unload [1]. Its veto path dropped that
temporary reference before returning the error.
The 2009 linker code sync with FreeBSD [2] removed the temporary
reference but retained the decrement. Therefore, every failed kldunload
reduced 'file->refs' even though the file remained loaded, allowing
repeated EBUSY returns to drive the count below zero.
Keep the existing reference when a module vetoes unload. sys_kldunload()
already restores userrefs on error, and a later unload attempt can retry
with both counters unchanged.
[1] Handle recursive situations a bit more robustly ...
commit e7a2d40362352344eff1c4f395caf0a735e00a3e
[2] modules: pull in most of FreeBSD's module linker changes
commit 1c0e32863e0583221e430c22c1c68a023fd16195
[2 lines not shown]
kernel: Remove DIOCGSLICEINFO and DIOCSYNCSLICEINFO ioctls
The DIOCGSLICEINFO ioctl code had a buffer overflow bug. The ioctl
declared the parameter to have size of 'struct diskslices', which only
supported MAX_SLICES (i.e., 16) slices. When try to use this ioctl on a
disk with more slices (e.g., a GPT disk that may have 128
partitions/slices), the bcopy() would overflow the target buffer that
was prepared by mapped_ioctl().
It's actually not easy to properly fix this bug. However, this ioctl was
actually unused. In addition, FreeBSD has removed it in 2003 [1]. So
simply remove it, together with the related DIOCSYNCSLICEINFO.
[1] https://github.com/freebsd/freebsd-src/commit/19f7043db0bba9dd2c333612eff90411339d46de
GitHub-PR: #43
Reported-by: Nathan Sapwell (jewbird)
Discussed-with: swildner
kernel: Fix jail caps check bug in caps_priv_check()
caps_priv_check() reuses its cap parameter to hold the
group-shifted value before passing it to prison_priv_check(), so the
per-capability jail cases (SYSCAP_NONET_RAW, SYSCAP_NOMOUNT_*,
SYSCAP_NOMOUNT_PROCFS, etc.) are never evaluated. The group caps
SYSCAP_NONET / SYSCAP_NOMOUNT always return 0 in jail, so raw sockets
and null/tmp/dev/procfs mounts succeed inside a default-policy jail.
Fix the bug by using a separate local variable for the group check.
GitHub-PR: #44
Assisted-with: Zhipu GLM-5.2
if_tun: Fix mbuf chain leak in tunwrite()
tunwrite() builds an mbuf chain headed by 'top' in its read loop;
on the final iteration the local 'm' points at the chain tail.
Then the subsequent EAFNOSUPPORT default case of the family switch calls
m_freem(m), freeing only that tail mbuf and leaking the chain head and
all intermediates.
Fix the m_freem() to free from 'top' instead to free the whole mbuf
chain, matching the earlier error path.
While there, fix one indentation. (aly)
GitHub-PR: #39
Assisted-with: Zhipu GLM-5.2
net: Fix SIOCSIFDESCR fallthrough bug in ifioctl()
* Add the missing 'break' to SIOCSIFDESCR to fix the fallthrough bug.
* Remove the redundant ifnet_lock()/unlock() pair.
* Clean up the code a bit by rearranging the local variables.
net: Fix ifnet_mtx deadlock in ifioctl()
Several error paths in ifioctl()'s switch (SIOCGIFGROUP, SIOCAIFGROUP,
SIOCDIFGROUP, SIOCSIFDESCR) return directly instead of break, bypassing
the ifnet_unlock() at the end of the function. As a result, ifnet_mtx
is held across the switch and will block any future ifnet_lock() calls,
which basically breaks the network subsystem.
What makes matter worse is that SIOCGIFGROUP has no caps check, so
any local user can trigger such a deadlock in the network subsystem.
GitHub-PR: #47
Assisted-with: Zhipu GLM-5.2
