cd9660: Fix dereferencing invalid RR outlen ptr
`ISO_RRIP_ANALYZE` is constructed in four places. Two of the
initializers set the `outlen` field while the other two,
`cd9660_rrip_analyze` and `cd9660_rrip_offset`, leave it uninitialized.
The uninitialized paths can dereference an invalid pointer on error
paths which causes a kernel panic.
To fix, I zero out `ISO_RRIP_ANALYZE` in all four places where it's
initialized and check that `outlen` is non-null on the error path
in `cd9660_rrip_loop`.
While testing the above, I encountered another kernel panic due to
mounting continuing after the error branch. Evidently, the ISO continued
mounting through the normal ISO 9660 path then triggered a panic down
the line due to a very broken file system from the ISO. To fix that, I
propagate the error from the RR path then fail in the mount path.
[13 lines not shown]
top: allow filtering by command name
top(1) already supports interactive command filtering using
the '/' key. Support it also with a command line
argument '-g' / '--grep'.
Reviewed by: kib
Obtained from: OpenBSD
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D61160
cd9660: Fix dereferencing invalid RR outlen ptr
`ISO_RRIP_ANALYZE` is constructed in four places. Two of the
initializers set the `outlen` field while the other two,
`cd9660_rrip_analyze` and `cd9660_rrip_offset`, leave it uninitialized.
The uninitialized paths can dereference an invalid pointer on error
paths which causes a kernel panic.
To fix, I zero out `ISO_RRIP_ANALYZE` in all four places where it's
initialized and check that `outlen` is non-null on the error path
in `cd9660_rrip_loop`.
While testing the above, I encountered another kernel panic due to
mounting continuing after the error branch. Evidently, the ISO continued
mounting through the normal ISO 9660 path then triggered a panic down
the line due to a very broken file system from the ISO. To fix that, I
propagate the error from the RR path then fail in the mount path.
[13 lines not shown]
bhyve: rfb: do not destroy a mutex that was never initialized
rfb_init()'s error path tests pixfmt_mtx against NULL, which only
compiles where pthread_mutex_t is a pointer, and destroys it. Every
jump to that label is before the mutex is initialized, so there is
nothing to destroy. The test and the destroy came in with the
SetPixelFormat support (D46402).
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Fixes: dda0f9837b1c ("bhyve: support noVNC SetPixelFormat request")
Reviewed by: markj
MFC after: 1 week
Sponsored by: keelos.dev
Differential Revision: https://reviews.freebsd.org/D61425
bhyve: nvme: initialize the AEN condition variable
aen_cond is used with pthread_cond_wait() and pthread_cond_signal() but
never initialized. That works where a zeroed pthread_cond_t is
initialized on first use; elsewhere pthread_cond_wait() fails at once
and aen_thr() spins with aen_mtx held.
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Reviewed by: markj
MFC after: 1 week
Sponsored by: keelos.dev
Differential Revision: https://reviews.freebsd.org/D61424
pmap: Fix some bugs around accounting of wired mappings
The amd64 and arm64 pmaps failed to decrement the count when tearing
down a 1GB largepage mapping. The riscv pmap failed to decrement the
count when unwiring a superpage mapping.
Reported by: alc
Reviewed by: bnovkov, alc, kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61414
link_elf: validate the section headers in link_elf_load_file()
e_shentsize isn't checked, and e_shstrndx, sh_link and sh_name are used
unchecked. Do what link_elf_obj.c does.
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61389
link_elf: bounds-check the dynamic section's tables
parse_dynamic() only checks the DT_HASH header. nbuckets, nchains and
the other DT_* tables come from the module unchecked. Check them
against the mapping, and reject a size without its table.
Reported by: llm-postcr
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61387
link_elf: validate symbol name offsets
st_name isn't checked against the string table size, for any of the
symbol tables used here. Do what link_elf_obj.c does since 4e2c2842e.
Reported by: llm-postcr
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61388
sysvmsg: Fix sequence number wraparound races
The SysV message queue code has the same problem that we fixed in the
semaphore code in SA-26:54.sysvsem and SA-26:64.sysvsem. That is,
kern_msgrcv() and kern_msgsnd() are susceptible to TOCTOU races when
they sleep waiting for messages and queue space, respectively. Unlike
the semaphore code, however, the message queue array is never resized
and there is no notion of message queue sets, so such races do not open
up any memory safety bugs.
Fix the races, following the pattern from the SysV semaphore changes:
use a global sequence number array with wide counters, to avoid changing
the KBI which is embedded in userspace tools. Fix kern_msgsnd(), which
did not validate the sequence number at all after sleeping. Use a
msgvalid() helper to factor out some duplicated checks. Convert a
couple of local flag variables to bools.
Reported by: Apex Security Research
Reviewed by: kib
[3 lines not shown]
sysvsem: Plug another place where we leak __sem_base to userspace
Leaking this pointer isn't harmful, but other places take care to clear
it, so handle this in SEM_STAT too.
Reviewed by: imp, kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61396
arm64/vmm: vgic_v3: Register the maintenance interrupt
If one is available, register the maintenance IRQ so that vmm can
receive and process guest exits when the maintenance IRQ is asserted.
Since vmm and vgic can still operate without it, print a warning but
attach the vgic regardless if the maintenance IRQ cannot be registered.
Signed-off-by: Kajetan Puchalski <kajetan.puchalski at arm.com>
Reviewed by: andrew
Sponsored by: Arm Ltd
Pull Request: https://github.com/freebsd/freebsd-src/pull/2530
arm64/gicv3: Expose the ACPI maintenance interrupt
The ACPI entry describing the maintenance interrupt INTID is already
available as "VgicInterrupt", but it is not exposed to the GIC driver.
Check that the value is valid and consistent between CPUs, then publish
it for the GIC driver to use under rid 0 if so.
Print a warning if the maintenance interrupt is configured to be
edge-sensitive in ACPI, as the GIC spec explicitly states "maintenance
interrupts are level-sensitive".
Signed-off-by: Kajetan Puchalski <kajetan.puchalski at arm.com>
Reviewed by: andrew
Sponsored by: Arm Ltd
Pull Request: https://github.com/freebsd/freebsd-src/pull/2527
bsdinstall: Set TMPDIR in pkgbase install
The FreeBSD-base repository (aka "pkgbase") is now created using 'pkg
repo -l' in order to make 'pkg rwhich' work. Unfortunately this makes
the data.pkg file considerably larger, and FreeBSD 15.2-BETA1 fails to
install using a remote repository since the installer has a small /tmp
(20 MB).
Run pkg commands with 'env TMPDIR=<chrootdir>/tmp' since the /tmp in
the system being installed is considerably larger than the tmpfs which
the installer runs with. Create <chrootdir>/tmp first so we can ensure
it has 1777 permissions.
Reviewed by: bapt
MFC after: 1 day
Differential Revision: https://reviews.freebsd.org/D61380
(cherry picked from commit a7163bd76986282fdcb059b91301d3214da49642)
nuageinit: Add support for uid
Adds support for specifying an explicit UID when creating users through nuageinit. Both numeric and string UID values are supported. Invalid or negative UIDs are rejected. The new uid option is documented in nuageinit(7). Existing automatic UID allocation remains unchanged when no UID is specified. A UID already in use or out of range is left to pw(8) to reject.
PR: 293716
Reported by: Einar Bjarni Halldórsson <einar at isnic.is>
Reviewed by: dtxdf, bapt
Signed-off-by: Kushagra Chauhan <zenzesama at gmail.com>
Differential Revision: https://reviews.freebsd.org/D61174
p1003_1b: Add capability mode checks
The sched_* syscalls can operate either on the calling process (by
setting pid = 0) or by specifying a pid. They are allowed in capability
mode, but previously were not scoped to only operating on the calling
process.
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57346
user_connectat: correctly pass fd through
In the original adaptation of connect/connectat to use user_connectat in
CheriBSD, I failed to pass the fd through in the connectat case and
always passed AT_FDCWD. This did trigger failures in the unix_connectat
test which I somehow missed in prior test runs.
Reported by: llm-postcr
rc: Generate ML-DSA44/Ed25519 host keys by default
Commit bd9d7cdd1420 ("OpenSSH: Update to 10.5p1") introduced support for
ML-DSA44/Ed25519 host keys.
Generate these keys by default when the sshd service is first started.
Reported by: Herbert J. Skuhra
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D61433
pass(4): Don't drop the periph lock before selrecord() in passpoll()
passpoll() checked the done queue while holding the peripheral lock,
dropped the lock, and only then called selrecord(). A CCB completing
in the window between the unlock and the selrecord() call sent its
selwakeuppri() before the polling thread was on the selinfo list, so
the wakeup was lost and select(2) or poll(2) slept until another
completion arrived or the timeout expired.
Call selrecord() before dropping the lock. This lock order is
already established: passdone() calls selwakeuppri(), which takes
the selinfo lock, while holding the peripheral lock.
kqueue is not affected, since the knlist is backed by the peripheral
mutex.
Reported by: llm-postcr
Fixes: a9934668aa13
MFC after: 1 week
[2 lines not shown]
pass(4): Wake select/kqueue waiters when an immediate CCB completes
In the CAMIOQUEUE ioctl, a queued CCB completes through passdone(),
which moves it to the done queue and calls selwakeuppri() and
KNOTE_LOCKED() so that a consumer blocked in select(2), poll(2) or
kevent(2) wakes up and collects the CCB with CAMIOGET. An immediate
CCB (e.g. XPT_DEV_ADVINFO or XPT_DEV_MATCH) is instead executed
synchronously in the ioctl and moved to the done queue directly,
with no notification, so a consumer sleeping while waiting for its
completion never wakes up until some other queued I/O completes.
Send the same notification that passdone() sends. The peripheral
lock is held at this point and backs the knlist, so KNOTE_LOCKED()
is the correct variant.
A version of this fix has been in production use at Spectra Logic
since 2024.
Co-authored-by: Dave Baukus <daveb at spectralogic.com>
[5 lines not shown]
uipc_syscalls.c: add kern_ and user_ implementations
Rename accept1 and sendit to user_accept and user_sendit.
Effort: CHERI upstreaming
Sponsored by: Innovate UK
Pull Request: https://github.com/freebsd/freebsd-src/pull/2284
acpi_cpu: Bring back setting BM_RLD on resume
enable_idle(), which was called on resume before 427747fc16c9
("acpi_cpu: No longer disable idle during suspend"), also set BM_RLD.
This commit brings back just setting BM_RLD on resume because some
firmware might not be doing this itself on some machines.
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61431
acpi_cpu: No longer disable idle during suspend
This had been introduced in 3331373ce733 ("Disable CPU idle states
during suspend and reenable them during resume.") to work around C-state
selection logic which would skip C-states which returned immediately,
considering them "broken".
This workaround is incompatible with suspend-to-idle however, which
requires CPUs to be in their idle states, and is no longer relevant
either way since b0baaaaecf1a ("Avoid comparing negative signed to
positive unsignad values.") removed the C-state skipping logic the
previous change was working around.
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/71
Differential Revision: https://reviews.freebsd.org/D60649
