vm: Clean up cdev_pager_allocate() a bit
* Introduce 'pindex' variable to clean up the code.
* Add KASSERT() to ensure the object type matches (obtained from FreeBSD)
vm: Remove duplicate reference in cdev_pager_allocate()
The code was updated in 2013 [1] to bring in various changes from
FreeBSD, but left this duplicate reference. Remove the erroneous
vm_object_reference_locked() call.
[1] kernel: Port new device_pager interface from FreeBSD
commit f2c2051ee473577d22178d55f782ceebbd88d58f
GitHub-PR: #49
Credit: LI Leding
wg: Destroy newly created peers on failure
Previously, a newly created peer was not destroyed even if there were
errors in configuring it, e.g., invalid AllowedIPs. The rationale was
that the user could correct the error by issuing another 'ifconfig'
command with the fixed arguments.
Now destroy the new peer if an error occurs, making a complex 'ifconfig'
command that adds a peer atomic. This matches the behavior of FreeBSD.
As part of this change, refactor wg_ioctl_set() by extracting
wg_ioctl_set_peer() to handle a single peer, and add 'const' qualifiers
where appropriate.
kernel: Disable build-ID for vkernel(7) and fix build
Vkernel(7) doesn't use a linker script, so it's not easy to define
__build_id_{start,end} for it.
A solution would be to locate the ELF in memory, parse and walk the
program headers to find the ".note.gnu.build-id" section.
Reported-by: Michael Neumann
wg: Return ENETUNREACH when transmitting to a non-existent peer
Do the same thing as FreeBSD and OpenBSD.
Obtained-from: FreeBSD (https://reviews.freebsd.org/D44582)
rpcinfo(8): Fix stack buffer overflow in rpcbdump()
The function previously used unbounded sprintf() and strcat() to format
the info into a fixed 256-byte stack buffer. A malicious or compromised
rpcbind endpoint that returns enough distinct version numbers for a
single program (roughly 24 maximum-width decimal values plus separators)
can overflow this buffer.
CVE: CVE-2026-16461
Openwall: CVE-2026-16277 & CVE-2026-16461: buffer overflows in rpcinfo
(https://www.openwall.com/lists/oss-security/2026/07/23/8)
kernel/linker: serialize recursive unload
Restore the safe list traversal from commit
e7a2d40362352344eff1c4f395caf0a735e00a3e.
'llf_lock' is now recursive and held through the unload path, so
callbacks and dependency release can recurse without exposing a
partially unloaded file.
GitHub-PR: #50
kernel/linker: preserve refs after unload veto
linker_file_unload() used to take a temporary file reference (file->refs)
before notifying modules to unload [1]. Its veto path dropped that
temporary reference before returning the error.
The 2009 linker code sync with FreeBSD [2] removed the temporary
reference but retained the decrement. Therefore, every failed kldunload
reduced 'file->refs' even though the file remained loaded, allowing
repeated EBUSY returns to drive the count below zero.
Keep the existing reference when a module vetoes unload. sys_kldunload()
already restores userrefs on error, and a later unload attempt can retry
with both counters unchanged.
[1] Handle recursive situations a bit more robustly ...
commit e7a2d40362352344eff1c4f395caf0a735e00a3e
[2] modules: pull in most of FreeBSD's module linker changes
commit 1c0e32863e0583221e430c22c1c68a023fd16195
[2 lines not shown]
kernel: Remove DIOCGSLICEINFO and DIOCSYNCSLICEINFO ioctls
The DIOCGSLICEINFO ioctl code had a buffer overflow bug. The ioctl
declared the parameter to have size of 'struct diskslices', which only
supported MAX_SLICES (i.e., 16) slices. When try to use this ioctl on a
disk with more slices (e.g., a GPT disk that may have 128
partitions/slices), the bcopy() would overflow the target buffer that
was prepared by mapped_ioctl().
It's actually not easy to properly fix this bug. However, this ioctl was
actually unused. In addition, FreeBSD has removed it in 2003 [1]. So
simply remove it, together with the related DIOCSYNCSLICEINFO.
[1] https://github.com/freebsd/freebsd-src/commit/19f7043db0bba9dd2c333612eff90411339d46de
GitHub-PR: #43
Reported-by: Nathan Sapwell (jewbird)
Discussed-with: swildner
kernel: Fix jail caps check bug in caps_priv_check()
caps_priv_check() reuses its cap parameter to hold the
group-shifted value before passing it to prison_priv_check(), so the
per-capability jail cases (SYSCAP_NONET_RAW, SYSCAP_NOMOUNT_*,
SYSCAP_NOMOUNT_PROCFS, etc.) are never evaluated. The group caps
SYSCAP_NONET / SYSCAP_NOMOUNT always return 0 in jail, so raw sockets
and null/tmp/dev/procfs mounts succeed inside a default-policy jail.
Fix the bug by using a separate local variable for the group check.
GitHub-PR: #44
Assisted-with: Zhipu GLM-5.2
if_tun: Fix mbuf chain leak in tunwrite()
tunwrite() builds an mbuf chain headed by 'top' in its read loop;
on the final iteration the local 'm' points at the chain tail.
Then the subsequent EAFNOSUPPORT default case of the family switch calls
m_freem(m), freeing only that tail mbuf and leaking the chain head and
all intermediates.
Fix the m_freem() to free from 'top' instead to free the whole mbuf
chain, matching the earlier error path.
While there, fix one indentation. (aly)
GitHub-PR: #39
Assisted-with: Zhipu GLM-5.2
net: Fix SIOCSIFDESCR fallthrough bug in ifioctl()
* Add the missing 'break' to SIOCSIFDESCR to fix the fallthrough bug.
* Remove the redundant ifnet_lock()/unlock() pair.
* Clean up the code a bit by rearranging the local variables.
net: Fix ifnet_mtx deadlock in ifioctl()
Several error paths in ifioctl()'s switch (SIOCGIFGROUP, SIOCAIFGROUP,
SIOCDIFGROUP, SIOCSIFDESCR) return directly instead of break, bypassing
the ifnet_unlock() at the end of the function. As a result, ifnet_mtx
is held across the switch and will block any future ifnet_lock() calls,
which basically breaks the network subsystem.
What makes matter worse is that SIOCGIFGROUP has no caps check, so
any local user can trigger such a deadlock in the network subsystem.
GitHub-PR: #47
Assisted-with: Zhipu GLM-5.2
net: Fix ifnet_mtx deadlock in ifioctl()
Several error paths in ifioctl()'s switch (SIOCGIFGROUP, SIOCAIFGROUP,
SIOCDIFGROUP, SIOCSIFDESCR) return directly instead of break, bypassing
the ifnet_unlock() at the end of the function. As a result, ifnet_mtx
is held across the switch and will block any future ifnet_lock() calls,
which basically breaks the network subsystem.
What makes matter worse is that SIOCGIFGROUP has no caps check, so
any local user can trigger such a deadlock in the network subsystem.
GitHub-PR: #47
Assisted-with: Zhipu GLM-5.2
net: Fix SIOCSIFDESCR fallthrough bug in ifioctl()
* Add the missing 'break' to SIOCSIFDESCR to fix the fallthrough bug.
* Remove the redundant ifnet_lock()/unlock() pair.
* Clean up the code a bit by rearranging the local variables.
isa: allow the ISA PnP isolation scan to be skipped
The scan probes several read-data ports, each running the full
isolation protocol with mandatory DELAY()s; with no PnP cards present
it finds nothing yet costs several seconds of boot time. Add a
hw.isa.pnp_disabled tunable (default 0) so systems known to have no
ISA PnP hardware - virtual machines in particular - can skip it.
NetBSD skips its isapnp probe automatically when SMBIOS slot tables
report no ISA slots, but that data is absent on typical VMs (and
NetBSD/OpenBSD do not compile ISA PnP into amd64 kernels at all), so
an explicit tunable serves the VM case better.
sys/kern: make the interrupt-config-hook settle delay tunable
After the interrupt-driven config hooks have finished, the kernel
lingers for a hardcoded 5 seconds before proceeding to the root mount,
to give USB a chance to enumerate (else a USB root device might not be
seen). On systems that cannot boot from USB - virtual machines in
particular - this is 5 seconds of pure boot-time waste.
Replace the hardcoded 5*hz with a kern.intr_config_hook_delay_ms
tunable (default 5000, preserving current behavior).
virtio_mmio(4): Add a manual page for the virtio-mmio transport driver
Document the legacy (v1) virtio-mmio transport and, in particular, the
hw.virtio.mmio.device[_N] kenv variables it uses for device discovery
and their <size>@<baseaddr>:<irq>[:<unit>] grammar.
virtual: virtio-mmio (legacy v1) transport driver
Import and x86-adapt FreeBSD's virtio-mmio transport driver.
The driver speaks the legacy (v1) virtio-mmio register layout and
discovers devices from the "hw.virtio.mmio.device" kenv
(<size>@<base>:<irq>[:<unit>]) rather than FDT/ACPI, attaching on
nexus.
Reviewed-by: @ivadasz
