routing: Fix buffer size in merge_nhgrps()
merge_nhgrps() sized its temporary nexthop array as twice
the existing group instead of the sum of both groups.
Fixes: dd945c6ba4ff ("routing: Implement merge of nhgrp in new multipath route")
ssh: use defaultkey sentinel for ML-DSA-44 default host key
servconf_add_hostkey() compares its file argument to defaultkey by
pointer to skip an unreadable default key; the ML-DSA-44 entry passed
the "[default]" literal, so the skip (and the "No host key files found"
fallback) never applied to it.
MFC after: 1 week
Reviewed by: emaste
Fixes: bb5c77e9d281 ("OpenSSH: Update to 10.4p1")
Differential Revision: https://reviews.freebsd.org/D60922
(cherry picked from commit 2d6f961164e4ab7e823972336dc9cfaae6a88ed8)
esp: Allocate the crypto request and its callback state together
esp_input() and esp_output() allocated a cryptop from the crypto layer,
then malloc'ed the xform_data the callback needs, and with ESN a third
buffer for the separate AAD. The callback freed all three. That is
two or three allocation pairs for every packet.
Put the three in one structure, allocated once per packet from a
dedicated UMA zone. The crypto layer provides crypto_initreq() and
crypto_destroyreq() for an embedded cryptop, as wg(4) and ktls use.
The AAD buffer is sized for the ESP header, the longest IV and the
high-order half of the sequence number, which is all the separate AAD
can hold.
No functional change intended.
Reviewed by: markj
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D61395
nvme: honor CRTO for the controller ready timeout
CAP.TO is a 8b field and saturate at 127.5 seconds; a controller
that needs longer reports the real worst case in CRTO.CRWMT.
Waiting only CAP.TO can reset a controller that is still within its declared
recovery time after e.g. an abrupt shutdown.
Taking the larger of CRTO.CRWMT and CAP.TO when CAP.CRWMS show CRTO support.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D59631
atf-check: Add shortcut for not-exit:0
Allow the command to be preceded by an exclamation point, which changes
the default expected result to a clean exit with a non-zero exit code.
MFC after: 1 week
Sponsored by: Klara, Inc.
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D58099
tftpd: Keep proper track of option length
When parsing options, keep track of the length of the unparsed portion
and pass that to get_field() instead of the length of the entire header.
While here, switch both make_options() and parse_options() to using
size_t for sizes and lengths.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D61048
tftpd: Keep proper track of header length
When parsing a header, keep track of the length of the unparsed portion
and pass that to get_field() instead of the length of the entire header.
Reported by: n0ps1ed
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60902
tftpd: Fix off-by-one in get_field()
Due to a logic error, get_field() would behave as if the passed-in size
was one greater than it actually is. Fix it so it always fails if no
terminating NUL is found within the buffer, instead of succeeding if the
first byte past the end is a NUL.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D61032
carp: Check if_carp under carp_sx in carp_nl_get()
carp_nl_get() tested ifp->if_carp for NULL before taking carp_sx and
walked the softc list afterwards. When the last vhid on the interface
is removed in between, carp_free_if() clears if_carp and the walk
dereferences a NULL pointer. A reader that passes the check while the
removal holds carp_sx always hits this.
The check was done with the lock held until the ioctl(2) API was
retired. Do it under the lock again.
Reported by: Marcos Mendoza <mmendoza at netgate.com>
Fixes: 72472e52e310 ("carp: retire ioctl(2) API")
Sponsored by: Rubicon Communications, LLC ("Netgate")
rc: Generate ML-DSA44/Ed25519 host keys by default
Commit bd9d7cdd1420 ("OpenSSH: Update to 10.5p1") introduced support for
ML-DSA44/Ed25519 host keys.
Generate these keys by default when the sshd service is first started.
Reported by: Herbert J. Skuhra
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D61433
(cherry picked from commit 74ae9accdc2f9be13c8dab27c94ed42f6a7c8360)
OpenSSH: Update to 10.6p1
This release contains security fixes and small bugfixes.
Full release notes are available at
https://www.openssh.com/txt/release-10.6 .
Selected items from the upstream release notes:
Security
========
* ssh-agent(1): fix an interaction between agent locking and the
session-bind at openssh.com extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
[35 lines not shown]
OpenSSH: Update to 10.6p2
Full release notes are available at
https://www.openssh.org/txt/release-10.6p2 .
Selected items from the upstream release notes:
Future deprecation notice
-------------------------
* scp(1): begin deprecating the -R flag, which is used to perform a
remote-to-remote copy by executing scp on a remote host. This
option is a fragile optimisation that is difficult to use because
it requires credentials on the remote host. It also creates
security risks if the shell quoting rules on the remote system
where the copy is performed differ from the client's expectations.
From OpenSSH 10.6, this option will continue to work but will
cause a deprecation warning to be emitted to standard error. In
[8 lines not shown]
OpenSSH: Update to 10.5p1
This release contains security fixes and small bugfixes.
Full release notes are available at
https://www.openssh.com/txt/release-10.5.
Selected items from the release notes:
Security
========
* ssh-agent(1): fix an interaction between agent locking and the
session-bind at openssh.com extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
[35 lines not shown]
linux: Bound native getdents and getdents64 batches
linux_getdents() and linux_getdents64() round their native read size up
to DEV_BSIZE before converting entries. For an unaligned caller buffer,
the native batch can contain more entries than fit in the Linux buffer.
Conversion then returns EINVAL even after copying complete entries,
and the native read has already advanced the directory position.
For counts of at least DEV_BSIZE, use min(args->count, MAXBSIZE) instead.
A 768-byte request, such as rustix's initial directory read, now uses a
768-byte native buffer rather than 1024. The converted Linux dirent and
dirent64 records are no larger than their native counterparts, so the
whole translated batch fits. Returning a short batch is allowed, and
consuming the whole native batch avoids needing to rewind the directory
position.
Keep the existing sizing for counts below DEV_BSIZE. This fixes the
oversized-batch case in both getdents interfaces, including legacy
getdents for 32-bit and 64-bit callers. The remaining small-buffer,
[8 lines not shown]
tests/sys/net/if_lagg_test: mark :witness as an XFAIL in CI
The `:witness` "test" has been failing reliably in CI for over 2 months
now. Mark the test XFAIL so the overall CI run is more green.
PR: 300697
MFC after: 1 week
periodic: Fix empty output check
The empty_output variable is normalized to YES or NO, but we were
comparing it to TRUE, so the comparison always failed no matter what it
was set to. Compare it to YES instead.
This feature has been disabled since 2007, so flip the default to NO to
preserve the current behavior. Adjust the documentation accordingly.
Relnotes: yes
PR: 300676
MFC after: 1 week
Fixes: 68c35072f914 ("Add an option to make periodic(8) quiet when no output was generated.")
Reviewed by: ivy, emaste
Differential Revision: https://reviews.freebsd.org/D61435
tests: udp_bindings: connect_bound_socket_from_2address_jail mark XFAIL in CI
This testcase has been failing reliably in CI since it was introduced in
2e16d37e275f. Mark the testcase XFAIL when run via CI to make the
overall test run a bit more green.
PR: 300696
MFC after: 1 week
tests/sys/netlink: mark :overflow as XFAIL when run via CI
This testcase has been failing reliably for 5+ months now. Mark it as an
expected failure to make the standard Jenkins run a bit more green.
PR: 289240
MFC after: 1 week
cd9660: Fix dereferencing invalid RR outlen ptr
`ISO_RRIP_ANALYZE` is constructed in four places. Two of the
initializers set the `outlen` field while the other two,
`cd9660_rrip_analyze` and `cd9660_rrip_offset`, leave it uninitialized.
The uninitialized paths can dereference an invalid pointer on error
paths which causes a kernel panic.
To fix, I zero out `ISO_RRIP_ANALYZE` in all four places where it's
initialized and check that `outlen` is non-null on the error path
in `cd9660_rrip_loop`.
While testing the above, I encountered another kernel panic due to
mounting continuing after the error branch. Evidently, the ISO continued
mounting through the normal ISO 9660 path then triggered a panic down
the line due to a very broken file system from the ISO. To fix that, I
propagate the error from the RR path then fail in the mount path.
[13 lines not shown]
top: allow filtering by command name
top(1) already supports interactive command filtering using
the '/' key. Support it also with a command line
argument '-g' / '--grep'.
Reviewed by: kib
Obtained from: OpenBSD
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D61160
cd9660: Fix dereferencing invalid RR outlen ptr
`ISO_RRIP_ANALYZE` is constructed in four places. Two of the
initializers set the `outlen` field while the other two,
`cd9660_rrip_analyze` and `cd9660_rrip_offset`, leave it uninitialized.
The uninitialized paths can dereference an invalid pointer on error
paths which causes a kernel panic.
To fix, I zero out `ISO_RRIP_ANALYZE` in all four places where it's
initialized and check that `outlen` is non-null on the error path
in `cd9660_rrip_loop`.
While testing the above, I encountered another kernel panic due to
mounting continuing after the error branch. Evidently, the ISO continued
mounting through the normal ISO 9660 path then triggered a panic down
the line due to a very broken file system from the ISO. To fix that, I
propagate the error from the RR path then fail in the mount path.
[13 lines not shown]
bhyve: rfb: do not destroy a mutex that was never initialized
rfb_init()'s error path tests pixfmt_mtx against NULL, which only
compiles where pthread_mutex_t is a pointer, and destroys it. Every
jump to that label is before the mutex is initialized, so there is
nothing to destroy. The test and the destroy came in with the
SetPixelFormat support (D46402).
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Fixes: dda0f9837b1c ("bhyve: support noVNC SetPixelFormat request")
Reviewed by: markj
MFC after: 1 week
Sponsored by: keelos.dev
Differential Revision: https://reviews.freebsd.org/D61425
bhyve: nvme: initialize the AEN condition variable
aen_cond is used with pthread_cond_wait() and pthread_cond_signal() but
never initialized. That works where a zeroed pthread_cond_t is
initialized on first use; elsewhere pthread_cond_wait() fails at once
and aen_thr() spins with aen_mtx held.
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Reviewed by: markj
MFC after: 1 week
Sponsored by: keelos.dev
Differential Revision: https://reviews.freebsd.org/D61424
pmap: Fix some bugs around accounting of wired mappings
The amd64 and arm64 pmaps failed to decrement the count when tearing
down a 1GB largepage mapping. The riscv pmap failed to decrement the
count when unwiring a superpage mapping.
Reported by: alc
Reviewed by: bnovkov, alc, kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61414
link_elf: validate the section headers in link_elf_load_file()
e_shentsize isn't checked, and e_shstrndx, sh_link and sh_name are used
unchecked. Do what link_elf_obj.c does.
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61389
link_elf: bounds-check the dynamic section's tables
parse_dynamic() only checks the DT_HASH header. nbuckets, nchains and
the other DT_* tables come from the module unchecked. Check them
against the mapping, and reject a size without its table.
Reported by: llm-postcr
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61387
link_elf: validate symbol name offsets
st_name isn't checked against the string table size, for any of the
symbol tables used here. Do what link_elf_obj.c does since 4e2c2842e.
Reported by: llm-postcr
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61388
sysvmsg: Fix sequence number wraparound races
The SysV message queue code has the same problem that we fixed in the
semaphore code in SA-26:54.sysvsem and SA-26:64.sysvsem. That is,
kern_msgrcv() and kern_msgsnd() are susceptible to TOCTOU races when
they sleep waiting for messages and queue space, respectively. Unlike
the semaphore code, however, the message queue array is never resized
and there is no notion of message queue sets, so such races do not open
up any memory safety bugs.
Fix the races, following the pattern from the SysV semaphore changes:
use a global sequence number array with wide counters, to avoid changing
the KBI which is embedded in userspace tools. Fix kern_msgsnd(), which
did not validate the sequence number at all after sleeping. Use a
msgvalid() helper to factor out some duplicated checks. Convert a
couple of local flag variables to bools.
Reported by: Apex Security Research
Reviewed by: kib
[3 lines not shown]
sysvsem: Plug another place where we leak __sem_base to userspace
Leaking this pointer isn't harmful, but other places take care to clear
it, so handle this in SEM_STAT too.
Reviewed by: imp, kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61396
arm64/vmm: vgic_v3: Register the maintenance interrupt
If one is available, register the maintenance IRQ so that vmm can
receive and process guest exits when the maintenance IRQ is asserted.
Since vmm and vgic can still operate without it, print a warning but
attach the vgic regardless if the maintenance IRQ cannot be registered.
Signed-off-by: Kajetan Puchalski <kajetan.puchalski at arm.com>
Reviewed by: andrew
Sponsored by: Arm Ltd
Pull Request: https://github.com/freebsd/freebsd-src/pull/2530
