FreeBSD/src 241df6asys/kern uipc_usrreq.c

unix: fix comment

Noticed by:     mckusick
Fixes:          6563dcb6b1f57e51db63854f3774b52e672232ed
DeltaFile
+1-1sys/kern/uipc_usrreq.c
+1-11 files

FreeBSD/src ba27b63sys/compat/linux linux.h linux_netlink.c

linux: Add STF type and convert some if_type to ARPHRD

Convert IFT_BRIDGE and IFT_L2VLAN to ARPHRD_ETHER, and IFT_LOOP
to ARPHRD_LOOPBACK in linux netlink.
Also, add ARPHRD_SIT and convert IFT_STF to it.

Reviewed by:    kfv
Differential Revision:  https://reviews.freebsd.org/D58573
DeltaFile
+8-0sys/compat/linux/linux_netlink.c
+1-0sys/compat/linux/linux.h
+9-02 files

FreeBSD/src a6e9e4cshare/man/man9 Makefile rtentry.9

nhop.9: Rewrite relics of rtentry.9 into nhop.9

Parts of rtentry.9 information such as information related to
the nexthop is outdated.
Remove those relics and add the new design into separate
manual instead.

Reviewed by:    bcr
Discussed with: ziaee
Differential Revision: https://reviews.freebsd.org/D58564
DeltaFile
+123-0share/man/man9/nhop.9
+16-40share/man/man9/rtentry.9
+2-0share/man/man9/Makefile
+141-403 files

FreeBSD/src f30ef13sys/dev/gve gve_adminq.c

gve: Implement AQ batching for queue creation and destruction

Currently, the FreeBSD driver configures and destroys queues
sequentially by issuing individual Admin Queue (AQ) commands.

During queue teardown (e.g., interface reset), disabling queues
one by one leaves the device in a partially configured state.
Because the device does not yet know that the driver is in the
process of fully unconfiguring all queues, this intermediate
state can trigger transient error logs (such as when queue 0 is
disabled while other queues are still active).

Modify the driver to use Admin Queue batching for both the
creation and destruction of TX and RX queues. Commands are now
queued and kicked together, ensuring the queue configuration changes
are applied atomically and preventing transient errors from being logged.

Signed-off-by: Sujithra Periasamy <sujithra at google.com>


    [6 lines not shown]
DeltaFile
+37-10sys/dev/gve/gve_adminq.c
+37-101 files

FreeBSD/src 43a3400share/man/man4 ctl.4

ctl.4: Document the assumption that CTL HA runs only on trusted networks

The CTL High Availablity clustering feature allows a pair of hosts to
implement transparent failover.  The implementation uses a TCP
connection to exchange messages.  There is no authentication mechanism
and the protocol itself embeds kernel pointers in the messages exchanged
between HA hosts.  This property (of CTL_MSG_DATAMOVE messages
specifically), as well as insufficient validation of inbound messages,
mean that anyone able to access a CTL HA port is able to remotely
execute code on that host.

Provide a warning to this effect in the CTL man page.

Reported by:    Ryan of Calif.io
Reviewed by:    ziaee, ken, mav
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58622

(cherry picked from commit 3c8f8432b6f653128016c6aaf826e1efb7ee1cec)
DeltaFile
+6-1share/man/man4/ctl.4
+6-11 files

FreeBSD/src 8eef466sys/kern subr_epoch.c

epoch: Fix epoch_drain_callbacks()

This function is supposed to wait until all pending callbacks have been
executed.  This is useful in some contexts where we tear down some
context (like a VNET jail and its associated UMA zones) synchronously,
and we want to make sure that all pending asynchronous callbacks (which
may free objects to said UMA zones) have run first.

The implementation schedules a callback on each CPU and waits for them
all to run.  This assumes that, on a given CPU, callbacks are executed
in the order that they are pushed.  This assumption depends on the
implementation of epoch_call_task() and ck_epoch_poll_deferred(), and it
is not true in general.

Callbacks are pushed onto a per-CPU stack in LIFO order.
ck_epoch_poll_deferred() first pulls out the callbacks from epoch - 2,
which are always safe to execute, and in so doing reorders them such
that the oldest callback as at the top of the stack, so in this case,
epoch_call_task() will execute them in order.  However,

    [24 lines not shown]
DeltaFile
+30-20sys/kern/subr_epoch.c
+30-201 files

FreeBSD/src 1fe3a28sys/netinet6 raw_ip6.c

rawip: Fix handling of checksums in rip6_input()

A v6 raw socket may ask the kernel to validate the checksum of an
inbound packet.  If it does, and the validation fails, we discard the
packet, but this isn't really right: other raw sockets may wish to
receive a copy of the packet anyway.

Rework checksum handling to address this problem, and use a flag to
avoid computing the checksum more than once for a given packet.

Fixes:          de2d47842e880281 ("SMR protection for inpcbs")
Reviewed by:    pouria, glebius
Reported by:    Yunzhi Ke
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58559

(cherry picked from commit 196874ce2e97e3e6425493b1d501e716b356bc36)
DeltaFile
+15-11sys/netinet6/raw_ip6.c
+15-111 files

FreeBSD/src 843ef89sys/netinet in_mcast.c, sys/netinet6 in6_mcast.c

in_mcast: Fix uninitialized variable usage in inm_merge()

When the first loop in inm_merge() hits an error, generally because it
hit some limit on the number of source filters for a multicast group,
inm_merge() tries to atomically roll back changes to the group source
filter list.

To roll back, it iterates over the global source filter list for the
multicast group, starting at the last entry that we updated ("nims").
But, if we have not yet updated any entries, this variable is
uninitialized.  Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM
doesn't visit any source filters in this case.

All of the above applies to the v6 case.

Reported by:    Daniel Birtwhistle
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

(cherry picked from commit b9db5a5b16477863654f92ec653e8464528ef981)
DeltaFile
+1-0sys/netinet6/in6_mcast.c
+1-0sys/netinet/in_mcast.c
+2-02 files

FreeBSD/src fb0af87sys/kern kern_fork.c

proc: Copy the p_reapsubtree field explicitly during fork

p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc,
which is copied during fork without any synchronization.  However, the
field is not stable except when the proctree lock is held, and indeed
may change if p1's reaper exits or explicitly releases its reaper
status.  This state change can race with fork() and leave the child with
an incorrect p_reapsubtree field.

Close the race: explicitly copy the field under the proctree lock during
fork.

Reported by:    syzkaller
Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58482

(cherry picked from commit 8616b7dc3850758eb39a5b63f41f56c05403380b)
DeltaFile
+7-0sys/kern/kern_fork.c
+7-01 files

FreeBSD/src d583f31tests/sys/kern/tty test_sti.c

tests: Fix build if TIOCSTI is not defined

Some downstream projects (e.g. ElectroBSD) have removed the TIOCSTI

We already have some components (such as mail and tcsh) that build
without TIOCSTI defined.  This is (existing portability support in those
projects.

Simplify things for downstreams by extending this approach to this
additional TIOCSTI user.

Reviewed by:    markj
Differential Revision: https://reviews.freebsd.org/D50614

(cherry picked from commit 52a2b4bc5da21d7a54cb16b9450196244b59b8c0)
(cherry picked from commit b1bb3aa65cc9d720f54dba009565e0d1d0419323)
DeltaFile
+6-0tests/sys/kern/tty/test_sti.c
+6-01 files

FreeBSD/src 3e42109sys/compat/linuxkpi/common/src linux_80211.c

LinuxKPI: 802.11: deal with wdev list, and misc

Fill in more (lvif) wdev details and add it to the list under the wiphy
struct so that iterators at least work and find the (one) device.
This is needed for the upcoming espwl(4) driver.

misc: add WPI-SMS4 to the list of cipher suits (we won't support it but
at least print the name).

MFC after:      3 days
DeltaFile
+24-5sys/compat/linuxkpi/common/src/linux_80211.c
+24-51 files

FreeBSD/src 83e8fd6sys/net80211 ieee80211_radiotap.h

net8021!: radiotap: add another HE define

Add another HE define needed by the upcoming espwl(4).

MFC after:      3 days
DeltaFile
+1-0sys/net80211/ieee80211_radiotap.h
+1-01 files

FreeBSD/src 9b13e6csys/compat/linuxkpi/common/include/linux nl80211.h ieee80211.h, sys/compat/linuxkpi/common/include/net mac80211.h cfg80211.h

LinuxKPI: 802.11: add more defines, structures, ...

Add more defines, structures, sort struct field types, add inline
functions (partially implemented) all needed for the upcoming
espwl(4) wireless driver.

MFC after:      3 days
DeltaFile
+46-10sys/compat/linuxkpi/common/include/net/cfg80211.h
+22-5sys/compat/linuxkpi/common/include/linux/ieee80211.h
+11-1sys/compat/linuxkpi/common/include/net/mac80211.h
+6-0sys/compat/linuxkpi/common/include/linux/nl80211.h
+85-164 files

FreeBSD/src 3a1bf59lib/libsys stat.2, sys/kern uipc_shm.c

shmfd: consistently return size in 512 byte blocks for fstat(2) st_blocks

This is ABI-breaking change that could be considered as the bug fix.

Requested by:   David Timber <dxdt at dev.snart.me>
Reviewed by:    emaste, markj
Sponsored by:   The FreeBSD Foundation
Relnotes:       yes
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58942
DeltaFile
+2-6sys/kern/uipc_shm.c
+6-2lib/libsys/stat.2
+8-82 files

FreeBSD/src 805c500tools/build Makefile

tools/build: stage stdckdint.h's dependencies for non-FreeBSD hosts

37bd69d43c7 gave stdckdint.h two new includes, <sys/_visible.h> and
<sys/ckdint.h>.  Neither reaches a non-FreeBSD host: _visible.h is
staged only under ${.MAKE.OS} == "FreeBSD" and ckdint.h is not staged at
all, so the libc bootstrap fails on reallocarray.o when cross-building
from macOS.  Both headers are self-contained; stage them alongside
stdckdint.h.

Fixes:          37bd69d43c7 ("sys: Add sys/ckdint.h")
Reviewed by:    rpaulo, markj
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58943
DeltaFile
+4-0tools/build/Makefile
+4-01 files

FreeBSD/src 4b1974esys/amd64/vmm x86.h x86.c

vmm: Emulate CPUID leaf 1Fh for guests

On an Intel N150 host a guest started with sockets=1, cores=4,
threads=1 reports "1 package(s) x 2 core(s) x 2 hardware threads"
instead of four cores with one thread each, while the host itself
detects its topology correctly.

A FreeBSD guest picks the topology leaf in topo_probe_intel_0xb(),
sys/x86/x86/mp_x86.c, and since 6badb512a94d it prefers leaf 1Fh over
leaf 0Bh whenever cpu_high is 1Fh or higher.  bhyve passes leaf 0
through unmodified, so the guest sees the maximum basic leaf of the
host, which is 1Fh or above on Alder Lake and newer, and takes that
path.  x86_emulate_cpuid(), sys/amd64/vmm/x86.c, derives the topology
from vm_get_topology() for leaves 1, 4 and 0Bh, but has no case for
1Fh, so the request ends up in default_leaf and the host values are
returned verbatim.  The guest therefore enumerates the topology of the
host: with an SMT shift of 1 in the host's leaf 1Fh and four vCPUs this
gives core_id_shift = 1 and pkg_id_shift = 2, which is exactly the
reported 2 cores x 2 threads.  Hosts whose maximum basic leaf is below

    [13 lines not shown]
DeltaFile
+4-1sys/amd64/vmm/x86.c
+1-0sys/amd64/vmm/x86.h
+5-12 files

FreeBSD/src 8d29d24include stdio.h limits.h, include/rpc xdr.h

libc: Restore prior C23 include guards

To avoid any sort of POLA violation, this commit restores old
guards and defines the C23 feature test macros in addition to
them.  This is to close off whole class of possible breakage,
rather than patching it case by case.

Reported by:    dim
Reviewed by:    dim, dteske, fuz
Approved by:    dim, dteske (mentor), fuz (mentor)
MFC after:      1 month
Differential Revision: https://reviews.freebsd.org/D58911
DeltaFile
+1-7stand/libsa/geli/geliboot_internal.h
+5-3include/assert.h
+4-2sys/sys/stdatomic.h
+4-2include/stdio.h
+4-2include/limits.h
+1-1include/rpc/xdr.h
+19-175 files not shown
+24-2211 files

FreeBSD/src 8109a5ccontrib/netbsd-tests/lib/libc/c063 t_fchmodat.c t_mkfifoat.c

contrib/netbsd-tests: lib/libc/c063: sync with NetBSD

This change syncs the lib/libc/c063 NetBSD tests with FreeBSD. This does
two things:
- Addresses bogus tautologically true assertions flagged by clang and gcc
  with ATF 0.22+ [1].
- Brings in some new test coverage.

Obtained from:  NetBSD (date tag: `20260818UTC`)
MFC after:      2 weeks
1. https://github.com/freebsd/atf/pull/72
DeltaFile
+89-59contrib/netbsd-tests/lib/libc/c063/t_utimensat.c
+69-4contrib/netbsd-tests/lib/libc/c063/t_faccessat.c
+29-2contrib/netbsd-tests/lib/libc/c063/t_mkfifoat.c
+11-6contrib/netbsd-tests/lib/libc/c063/t_fchmodat.c
+198-714 files

FreeBSD/src b826ca0lib/libexpat libbsdxml.3

libexpat: update AUTHORS section of libbsdxml.3

The eXpat project has changed maintainers since this section was written
in 2002.  Update it to reflect reality.

Discussed with: Sebastian Pipping <sebastian at pipping.org>
Reviewed by:    bcr
Differential Revision:  https://reviews.freebsd.org/D58835

(cherry picked from commit 5e6c894510fc66c18d69164d591184a2d23b16e5)
DeltaFile
+8-5lib/libexpat/libbsdxml.3
+8-51 files

FreeBSD/src 465c0e4contrib/expat Changes, contrib/expat/doc reference.html

contrib/expat: import expat 2.8.3

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/Changes

Security:       CVE-2026-72522

(cherry picked from commit 207d96dabfec14d7b3699747abb539ab3c1118ab)
DeltaFile
+77-20contrib/expat/Changes
+49-25contrib/expat/lib/xmlparse.c
+70-1contrib/expat/tests/misc_tests.c
+32-1contrib/expat/tests/basic_tests.c
+29-1contrib/expat/doc/reference.html
+5-12contrib/expat/lib/internal.h
+262-6082 files not shown
+455-8288 files

FreeBSD/src 99fda13sys/net80211 ieee80211_ioctl.h ieee80211_ioctl.c

net80211: migrate the ioctl API to a 128 bit specific API + use key API

* Begin migrating the ioctl code to use the key management APIs.
  Not all of it has been migrated (notably the WEP API hasn't.)

* Take special care to copy the TKIP MIC in and out correctly.

* Note that some of the defines used as sizes are actually the ioctl
  sizes, they'll need to be fixed before I push this into a review.

* Document this current API as a specific 128 bit key + 128 bit
  TKIP MIC API.

The goal here is to solidify this stuff as the 128 bit ioctl API
and not change it, even if net80211 will eventually grow 256 and
384 bit key support.

Notably the TKIP stuff - the driver_bsd.c code puts the TKIP after
the normal key contents, whereas the net80211 code puts the TKIP

    [6 lines not shown]
DeltaFile
+129-22sys/net80211/ieee80211_ioctl.c
+6-2sys/net80211/ieee80211_ioctl.h
+135-242 files

FreeBSD/src db4d6f7sys/net80211 ieee80211_crypto.h

net80211: add key get/set methods

Introduce net80211 key get and set methods with appropriate
bounds checking and buffer zero'ing.

Differential Revision:  https://reviews.freebsd.org/D58705
DeltaFile
+147-0sys/net80211/ieee80211_crypto.h
+147-01 files

FreeBSD/src 874035csys/net80211 ieee80211_crypto.c

net80211: fix WEP transmit

This was broken in 2022 with a security fix (61605e0ae5d8f) which
disallowed defaulting to the default TX key if there's no unicast
key.  Unfortunately this path was also used by WEP transmit.

To fix it, add a separate check which ensures that WEP is configured
(authtype OPEN, privacy enabled) - then also check if the default TX
key is set and that said key is a WEP key.

Fixes: 61605e0ae5d8f

Locally tested:

* rtwn(4) AP and rtwn(4) STA w/ static WEP keys configured

Differential Revision:  https://reviews.freebsd.org/D58854
DeltaFile
+18-0sys/net80211/ieee80211_crypto.c
+18-01 files

FreeBSD/src 8ddc54fsys/dev/intel spi_pci.c

intelspi: add Gemini Lake SPI controller PCI IDs

Add Gemini Lake LPSS SPI controller PCI IDs (0x31c2, 0x31c4, 0x31c6)
to intelspi_pci_devices[].

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58868
DeltaFile
+3-0sys/dev/intel/spi_pci.c
+3-01 files

FreeBSD/src 051cfdalib/libexpat libbsdxml.3

libexpat: update AUTHORS section of libbsdxml.3

The eXpat project has changed maintainers since this section was written
in 2002.  Update it to reflect reality.

Discussed with: Sebastian Pipping <sebastian at pipping.org>
Reviewed by:    bcr
Differential Revision:  https://reviews.freebsd.org/D58835

(cherry picked from commit 5e6c894510fc66c18d69164d591184a2d23b16e5)
DeltaFile
+8-5lib/libexpat/libbsdxml.3
+8-51 files

FreeBSD/src 330b8d6contrib/expat Changes, contrib/expat/doc reference.html

contrib/expat: import expat 2.8.3

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/Changes

Security:       CVE-2026-72522

(cherry picked from commit 207d96dabfec14d7b3699747abb539ab3c1118ab)
DeltaFile
+77-20contrib/expat/Changes
+49-25contrib/expat/lib/xmlparse.c
+70-1contrib/expat/tests/misc_tests.c
+32-1contrib/expat/tests/basic_tests.c
+29-1contrib/expat/doc/reference.html
+5-12contrib/expat/lib/internal.h
+262-6082 files not shown
+455-8288 files

FreeBSD/src c90c46esys/compat/linux linux_ioctl.h linux_ioctl.c

linux: add dma-buf and sync_file ioctl handlers

drm-kmod already implements the dma-buf and sync_file ioctls, but
linux_ioctl.c had no handler group for the 'b' and '>' magic bytes, so
the requests never reached it and returned EINVAL from
linux_ioctl_fallback().  Route the commands drm-kmod services to
sys_ioctl(), translating the direction bits with SETDIR(); everything
else still falls through to the fallback and keeps getting named in
dmesg.

Approved-by: adrian
Accepted-by: dumbbell
Signed-off-by: Nick Price <nprice at FreeBSD.org>
(cherry picked from commit d6a7e89504af337413af39fd121026f512c0a35d)
DeltaFile
+38-0sys/compat/linux/linux_ioctl.c
+20-0sys/compat/linux/linux_ioctl.h
+58-02 files

FreeBSD/src 95c04b2sys/arm/broadcom/bcm2835 bcm2835_audio.c

bcm2835_audio: Comment out vchi_service_release()

bcm2835_audio_release() calls vchi_service_close() and then
unconditionally calls vchi_service_release() with the same service
handle.

In the VCHI shim implementation, a successful vchi_service_close() calls
service_free(service). The subsequent vchi_service_release() therefore
dereferences a freed SHIM_SERVICE_T object when it reads
service->handle, resulting in a use-after-free panic.

vchi_service_release(), however, releases a reference which might block
vchi_service_close() from completing successfuly, so comment it out
instead of removing it altogether, until further testing is done.

PR:             297187
MFC after:      2 weeks
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58921
DeltaFile
+1-1sys/arm/broadcom/bcm2835/bcm2835_audio.c
+1-11 files

FreeBSD/src 7cc6a5dcontrib/less search.c command.c

MFV: less v704.

(cherry picked from commit fa0dc4f0f96a1b77d4be7bcdbf965897cda14521)
(cherry picked from commit 86aea5b4db379327f02ca547575105788bfbe807)

Approved by:    re (cperciva)
DeltaFile
+245-91contrib/less/decode.c
+213-114contrib/less/less.nro
+147-59contrib/less/regexp.c
+173-29contrib/less/optfunc.c
+132-54contrib/less/command.c
+83-55contrib/less/search.c
+993-40238 files not shown
+1,844-76344 files

FreeBSD/src 3a1396acontrib/less option.c cmdbuf.c

MFV less v691

Relnotes:       yes

(cherry picked from commit dafba19e42e78cd3d7c9264ece49ddd3d7d70da5)

MFV: less v692.

(cherry picked from commit e2abec625bf07c054f7ac2df2402d6c454113df8)
(cherry picked from commit 6330c2f5fbbf1320d768fa55f267c114654d729b)

Approved by:    re (cperciva)
DeltaFile
+1,017-476contrib/less/less.nro
+374-153contrib/less/screen.c
+245-144contrib/less/lesskey.nro
+107-51contrib/less/mark.c
+70-68contrib/less/option.c
+81-57contrib/less/cmdbuf.c
+1,894-94958 files not shown
+2,855-1,45464 files