hammer2: Disable debug v/f-chain dumps on unmounting
The two dumps were added to track down the HAMMER2-msg leak reported by
malloc_uninit() and would always print the following logs at shutdown:
```
v-chain 0xfffff8008e6204c0 volume.0 00000000000000100000000000000000/0 mir=00000000000
00140
[00002000] (?) refs=1
f-chain 0xfffff8008e620640 freemap.0 00000000000000100000000000000000/0 mir=0000000000
000140
[00002000] (?) refs=1
```
Given that the memory leak has been fixed in commit
bfcedfb468d712f29cadb491bec0928ad4279bad, disable these two debug dumps
now.
ok by dillon.
hammer2: Disable debug v/f-chain dumps on unmounting
The two dumps were added to track down the HAMMER2-msg leak reported by
malloc_uninit() and would always print the following logs at shutdown:
```
v-chain 0xfffff8008e6204c0 volume.0 00000000000000100000000000000000/0 mir=00000000000
00140
[00002000] (?) refs=1
f-chain 0xfffff8008e620640 freemap.0 00000000000000100000000000000000/0 mir=0000000000
000140
[00002000] (?) refs=1
```
Given that the memory leak has been fixed in commit
bfcedfb468d712f29cadb491bec0928ad4279bad, disable these two debug dumps
now.
ok by dillon.
kern: Fix memory leak in kdmsg_iocom_uninit()
When kdmsg_iocom_uninit() is called but no connection was ever
established (no reader/writer threads), a PING message was allocated and
queued but never freed. This caused a 120-byte leak from the HAMMER2-msg
allocator on shutdown.
Fix this by calling kdmsg_drain_msgq() to clean up any queued messages.
This fixes the 'malloc_uninit: 120 bytes of HAMMER2-msg still allocated'
warning. Note that this warning already disappeared after fixing the
hammer2_ioctl_recluster() bug in commit
c5cc81fefa166cc45657541c155797f0cff88c62.
Bug: https://bugs.dragonflybsd.org/issues/3385
kern: Clean up malloc_uninit()
* Correct the diagnostic log message by omitting the CPU id, which
doesn't apply here. The unfreed bytes must be summed from all CPUs.
* Clean up excess INVARIANTS ifdef's by using '__debugvar' instead.
mpc: Fix inclusion paths to correctly include its own 'config.h'
It wrongly included the GMP's 'config.h', as the '../gmp/' directory has
both 'gmp.h' and 'config.h'.
kernel: Fix two bugs in gptinit()
* Fix the wrong type for 'table_lba'; should be 'uint64_t' instead of
'uint32_t', and fix the read to use le64toh().
* Allow the partition table has entries more than 128 (MAX_GPT_ENTRIES).
The UEFI specification basically has no upper limit, but we limit to
parsing the first 128 (MAX_GPT_ENTRIES) entries.
This actually happens with a Proxmox v9.2 ISO, which uses GPT and
allocates 44 blocks for the partition table, so there are 176 entries.
For example, here is the gpt(8) of a USB stick written with this ISO:
```
Disk da8: 57.3GB (120225792 512-byte sectors)
Start Sectors Size Index Contents
0 1 512B - PMBR
1 1 512B - Primary GPT header
[13 lines not shown]
mincore(2): Add 'vm.mincore_mapped' sysctl to control reporting
Add the 'vm.mincore_mapped' (default ON!) to control whether to report
only the mapping status (if set to a non-zero value) or the physical
residency (if set to a zero value; the old behavior).
The idea of implementing this and enabling it by default is to help
mitigate page cache attacks [1].
[1] Page Cache Attacks: https://arxiv.org/abs/1901.01161
Obtain-from: FreeBSD (https://reviews.freebsd.org/D18764)
mincore(2): Fix several bugs
* Return ENOMEN when the requested range is not fully mapped.
(obtained from FreeBSD: 455dd7d4c79bc7bef5401721f617e64eca7ef422)
This change should fix a crash in Mesa where it calls mincore() to
determine whether a protocol field is a valid pointer in order to
keep compatible with an old protocol version.
* Fix an off-by-one error in filling the skipped entries. lastvecindex
refers to the last valid byte, so the new bytes should come after it.
(obtained from FreeBSD: 6a87d217e2da2a63d4431aeb871783e1dd7349ae)
* Fix the calculation of the 'end' boundary.
(obtained from FreeBSD: d0c9294b810f8b42b7ac27a46db44b94ddca3160)
* Update the man page.
Reported-by: peeterm
jail: Fix potential buffer overflow in sysctl_jail_list()
sysctl_jail_list() allocates a buffer of size = count*1024, and then
uses ksnprintf() to format the jail information and advance the write
position. However, ksnprintf() returns the would-be length (i.e., the
number of bytes would be written if the buffer is big enough). So a jail
that has a very long path and/or many IPs would overflow the allocated
buffer.
Fix the bug by correctly handling the return value of ksnprintf().
GitHub-PR: #45
Reported-by: Nathan Sapwell (jewbird)
vm: Remove duplicate reference in cdev_pager_allocate()
The code was updated in 2013 [1] to bring in various changes from
FreeBSD, but left this duplicate reference. Remove the erroneous
vm_object_reference_locked() call.
[1] kernel: Port new device_pager interface from FreeBSD
commit f2c2051ee473577d22178d55f782ceebbd88d58f
GitHub-PR: #49
Credit: LI Leding
rpcinfo(8): Fix stack buffer overflow in rpcbdump()
The function previously used unbounded sprintf() and strcat() to format
the info into a fixed 256-byte stack buffer. A malicious or compromised
rpcbind endpoint that returns enough distinct version numbers for a
single program (roughly 24 maximum-width decimal values plus separators)
can overflow this buffer.
CVE: CVE-2026-16461
Openwall: CVE-2026-16277 & CVE-2026-16461: buffer overflows in rpcinfo
(https://www.openwall.com/lists/oss-security/2026/07/23/8)
kernel/linker: serialize recursive unload
Restore the safe list traversal from commit
e7a2d40362352344eff1c4f395caf0a735e00a3e.
'llf_lock' is now recursive and held through the unload path, so
callbacks and dependency release can recurse without exposing a
partially unloaded file.
GitHub-PR: #50
kernel/linker: preserve refs after unload veto
linker_file_unload() used to take a temporary file reference (file->refs)
before notifying modules to unload [1]. Its veto path dropped that
temporary reference before returning the error.
The 2009 linker code sync with FreeBSD [2] removed the temporary
reference but retained the decrement. Therefore, every failed kldunload
reduced 'file->refs' even though the file remained loaded, allowing
repeated EBUSY returns to drive the count below zero.
Keep the existing reference when a module vetoes unload. sys_kldunload()
already restores userrefs on error, and a later unload attempt can retry
with both counters unchanged.
[1] Handle recursive situations a bit more robustly ...
commit e7a2d40362352344eff1c4f395caf0a735e00a3e
[2] modules: pull in most of FreeBSD's module linker changes
commit 1c0e32863e0583221e430c22c1c68a023fd16195
[2 lines not shown]
kernel: Remove DIOCGSLICEINFO and DIOCSYNCSLICEINFO ioctls
The DIOCGSLICEINFO ioctl code had a buffer overflow bug. The ioctl
declared the parameter to have size of 'struct diskslices', which only
supported MAX_SLICES (i.e., 16) slices. When try to use this ioctl on a
disk with more slices (e.g., a GPT disk that may have 128
partitions/slices), the bcopy() would overflow the target buffer that
was prepared by mapped_ioctl().
It's actually not easy to properly fix this bug. However, this ioctl was
actually unused. In addition, FreeBSD has removed it in 2003 [1]. So
simply remove it, together with the related DIOCSYNCSLICEINFO.
[1] https://github.com/freebsd/freebsd-src/commit/19f7043db0bba9dd2c333612eff90411339d46de
GitHub-PR: #43
Reported-by: Nathan Sapwell (jewbird)
Discussed-with: swildner
if_tun: Fix mbuf chain leak in tunwrite()
tunwrite() builds an mbuf chain headed by 'top' in its read loop;
on the final iteration the local 'm' points at the chain tail.
Then the subsequent EAFNOSUPPORT default case of the family switch calls
m_freem(m), freeing only that tail mbuf and leaking the chain head and
all intermediates.
Fix the m_freem() to free from 'top' instead to free the whole mbuf
chain, matching the earlier error path.
While there, fix one indentation. (aly)
GitHub-PR: #39
Assisted-with: Zhipu GLM-5.2
libnvmm(3): Remove unused GVA computation artifacts
On single-memory-operand instructions, we use the GPA provided by
the hardware and discard the GVA. The code that calculates the GVA
is therefore effectively unused. Remove it.
Obtained-from: NVMM Reference Implementation
testcases/libnvmm: Remove the two RIP-relative addressing tests
This reverts commit dea513a396514e21fa2cb677cd1e42929283d797 where I
added these two commits, which only helped validate the instruction
decoder and thus were not important. Remove them to keep in sync with
the upstream NVMM Reference Implementation.
libnvmm(3): Fix sign-extension on RCX and RDI/RSI
* Fix sign-extension on RCX when using the REP prefix.
* Fix sign-extension on RDI/RSI when emulating MOVS.
Obtained-from: NVMM Reference Implementation
libnvmm(3): Fix EXEC_INSTR()
- op2 is overwritten, so it needs "+r".
- RFLAGS is modified, so it needs "cc".
- PUSHFQ touches memory, so it needs "memory".
- The MOV is not needed, so remove it.
Obtained-from: NVMM Reference Implementation
libnvmm(3): Fix segment limits calc and support expand-down segments
The SVM/VMX hardware already calculates the segment limits in bytes
taking the G bit into account, so fix the emulator not to miscompute
the limits, and add a unit-test to ensure correctness.
Support expand-down segments and extend the 32bit segment limit
unit-test to ensure correctness.
Obtained-from: NVMM Reference Implementation
libnvmm(3): Fix zero-extension on RDI/RSI
* Fix zero-extension on RDI/RSI when emulating INS/OUTS.
* Fix zero-extension on RDI/RSI when emulating LODS/STOS.
Obtained-from: NVMM Reference Implementation
libnvmm(3): Allow partial fetches of instructions
An instruction may end at the boundary of a page followed by an
unmapped page. In that case, fetching the full 15-byte maximum
instruction length should not cause the assist to fail.
Allow partial instruction fetches to succeed, and add a unit-test
for that.
Obtained-from: NVMM Reference Implementation
libnvmm(3): Remove unneeded segment checks on CS
If the CS attributes did not allow the instruction to execute,
then the guest would have received an internal #GP and we wouldn't
have received an IO/MMIO VMEXIT. So no need to validate the CS
attributes.
Obtained-from: NVMM Reference Implementation
