xdr: Fix xdr_string
Forcing maxsize to RPC_MAXDATASIZE breaks code that deliberately uses
XDR with longer strings than permitted by SunRPC.
MFC after: 1 week
Fixes: 6448ec89e739 (" * limit size of buffers to RPC_MAXDATASIZE")
Fixes: e17d7ab869bb ("xdr_string: don't leak strings with xdr_free")
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans, brooks
Differential Revision: https://reviews.freebsd.org/D59994
(cherry picked from commit d2018cedb414ef17e77b7fc2fa19fd81328da46b)
xdr: Limit xdr_wrapstring
The previous commit (re)introduced the possibility that a malicious or
corrupt message can cause the receiver to allocate a very large amount
[11 lines not shown]
xdr_string: don't leak strings with xdr_free
Historically (and in a small amount of older software such as OpenAFS),
developers would attempt to free XDR strings with
xdr_free((xdrproc_t)xdr_string, &string)
This resulted in xdr_free calling xdr_string with only two intentional
arguments and whatever was left in the third argument register. If the
register held a sufficently small number, xdr_string would return FALSE
and not free the string (no one checks the return values).
Software should instead free strings with:
xdr_free((xdrproc_t)xdr_wrapstring, &string)
Because buggy software exists in the wild, act as though xdr_wrapstring
was used in the XDR_FREE case and plug these leaks.
[9 lines not shown]
usbhid: Retry fetching the report descriptor
So far only seen with a wireless mouse on a Logitech Unifying
receiver. The receiver can time out on GET_DESCRIPTOR(REPORT) while
still starting up after power is applied, for example after resume
or when switched back through a USB switch. On failure, hms falls
back to the boot protocol descriptor and the mouse loses its wheel.
Wired mice have not shown the problem.
Retry the request up to five times with a 100 ms pause, stopping
early on a stall since that means the device has no descriptor.
Linux usbhid retries this request in the same way.
usbhid: Retry fetching the report descriptor
So far only seen with a wireless mouse on a Logitech Unifying
receiver. The receiver can time out on GET_DESCRIPTOR(REPORT) while
still starting up after power is applied, for example after resume
or when switched back through a USB switch. On failure, hms falls
back to the boot protocol descriptor and the mouse loses its wheel.
Wired mice have not shown the problem.
Retry the request up to five times with a 100 ms pause, stopping
early on a stall since that means the device has no descriptor.
Linux usbhid retries this request in the same way.
ssh: use defaultkey sentinel for ML-DSA-44 default host key
servconf_add_hostkey() compares its file argument to defaultkey by
pointer to skip an unreadable default key; the ML-DSA-44 entry passed
the "[default]" literal, so the skip (and the "No host key files found"
fallback) never applied to it.
Approved by: re (cperciva)
MFC after: 1 week
Reviewed by: emaste
Fixes: bb5c77e9d281 ("OpenSSH: Update to 10.4p1")
Differential Revision: https://reviews.freebsd.org/D60922
(cherry picked from commit 2d6f961164e4ab7e823972336dc9cfaae6a88ed8)
(cherry picked from commit 55ede03fc24aa8de58814563e82e72cf8b34d9cc)
OpenSSH: Update to 10.6p2
Full release notes are available at
https://www.openssh.org/txt/release-10.6p2 .
Selected items from the upstream release notes:
Future deprecation notice
-------------------------
* scp(1): begin deprecating the -R flag, which is used to perform a
remote-to-remote copy by executing scp on a remote host. This
option is a fragile optimisation that is difficult to use because
it requires credentials on the remote host. It also creates
security risks if the shell quoting rules on the remote system
where the copy is performed differ from the client's expectations.
From OpenSSH 10.6, this option will continue to work but will
cause a deprecation warning to be emitted to standard error. In
[10 lines not shown]
OpenSSH: Update to 10.6p1
This release contains security fixes and small bugfixes.
Full release notes are available at
https://www.openssh.com/txt/release-10.6 .
Selected items from the upstream release notes:
Security
========
* ssh-agent(1): fix an interaction between agent locking and the
session-bind at openssh.com extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
[37 lines not shown]
OpenSSH: Update to 10.5p1
This release contains security fixes and small bugfixes.
Full release notes are available at
https://www.openssh.com/txt/release-10.5.
Selected items from the release notes:
Security
========
* ssh-agent(1): fix an interaction between agent locking and the
session-bind at openssh.com extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
[37 lines not shown]
TCP RACK: fix RSM computation for TCP fast open
When spitting an RSM containing the SYN and data, honor the
sequence number used by the SYN flag when computing the offset
in the socket buffer.
Approved by: re (cperciva)
PR: 297006
Reviewed by: rrs, Peter Lei
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D61149
(cherry picked from commit ff066579fd7719a6361e7ce8cc9ade47517d242d)
(cherry picked from commit d40890ffbd8bcacfc4e24c37daad931db8f31804)
vmm: Skip TMR rebuilds for edge-to-edge IOAPIC writes
IOAPIC redirection-table writes rendezvous all active vCPUs to
rebuild their vlapic trigger-mode registers when fields other than
mask or polarity change. Retargeting an edge-triggered pin incurs
this cost even though it does not contribute to the TMR.
vioapic_update_tmr() rebuilds the TMR from level-triggered entries
only. Skip the rendezvous when the modified entry is edge-triggered
both before and after the write. Check the old and new trigger modes
so that edge-to-level and level-to-edge transitions still rebuild
the TMR. Retain the existing all-vCPU rebuild path, mask/polarity
exclusions and remote-IRR handling.
Approved by: re (cperciva)
Approved by: markj, cperciva
Differential Revision: https://reviews.freebsd.org/D60721
MFC to: releng/15.2
Reported by: Wanpeng Qian <wanpengqian at gmail.com>
[4 lines not shown]
vmm: Add a bulk TMR reset hook for Intel APICv
vioapic_update_tmr() resets all 256 vectors before rebuilding the
level-triggered vector set. With Intel virtual interrupt delivery,
each per-vector reset loads the VMCS, reads and writes an EOI-exit
bitmap, and clears the VMCS.
Add an optional bulk-reset hook so VMX can clear the four EOI-exit
bitmaps with one VMCS load/clear pair. Clear the software TMR banks
directly when using the hook, and retain the per-vector fallback
for backends without it.
Approved by: re (cperciva)
Approved by: markj, cperciva
Differential Revision: https://reviews.freebsd.org/D60692
MFC to: releng/15.2
Reviewed by: markj
(cherry picked from commit ee9205f068c7675cf4d23e51cc98238d95ba1950)
(cherry picked from commit 88d7efb9e4fa03c8d364f9aeb88b10075e1bf69c)
linux: Bound native getdents and getdents64 batches
linux_getdents() and linux_getdents64() round their native read size up
to DEV_BSIZE before converting entries. For an unaligned caller buffer,
the native batch can contain more entries than fit in the Linux buffer.
Conversion then returns EINVAL even after copying complete entries,
and the native read has already advanced the directory position.
For counts of at least DEV_BSIZE, use min(args->count, MAXBSIZE) instead.
A 768-byte request, such as rustix's initial directory read, now uses a
768-byte native buffer rather than 1024. The converted Linux dirent and
dirent64 records are no larger than their native counterparts, so the
whole translated batch fits. Returning a short batch is allowed, and
consuming the whole native batch avoids needing to rewind the directory
position.
Keep the existing sizing for counts below DEV_BSIZE. This fixes the
oversized-batch case in both getdents interfaces, including legacy
getdents for 32-bit and 64-bit callers. The remaining small-buffer,
[10 lines not shown]
bsdinstall: Set TMPDIR in pkgbase install
The FreeBSD-base repository (aka "pkgbase") is now created using 'pkg
repo -l' in order to make 'pkg rwhich' work. Unfortunately this makes
the data.pkg file considerably larger, and FreeBSD 15.2-BETA1 fails to
install using a remote repository since the installer has a small /tmp
(20 MB).
Run pkg commands with 'env TMPDIR=<chrootdir>/tmp' since the /tmp in
the system being installed is considerably larger than the tmpfs which
the installer runs with. Create <chrootdir>/tmp first so we can ensure
it has 1777 permissions.
Approved by: re (cperciva)
Reviewed by: bapt
MFC after: 1 day
Differential Revision: https://reviews.freebsd.org/D61380
(cherry picked from commit a7163bd76986282fdcb059b91301d3214da49642)
(cherry picked from commit f3555a0e240ae2b26fdf0db2e3f68ec6846bbb58)
i2ctinyusb: do not list i2ctinyusb.c twice in SRCS
The module Makefile named its only source file in both the SRCS= line
and the SRCS+= line that follows. bsd.kmod.mk tolerates the duplicate
in a normal build, but when the kernel is built with -flto=thin the
linker sees the same bitcode object twice and refuses to link the
module ("Expected at most one ThinLTO module per bitcode file").
Approved by: re (cperciva)
Fixes: 54e231b373ef
(cherry picked from commit b5cd411af6418986fa0da9c12d02b9f26c344a4a)
(cherry picked from commit cfd1aabac12fc239d1c9b8433b29c68a25a7e5b6)
mqueuefs: set *a_eofflag in VOP_READDIR
mqfs_readdir() never reported end of directory. Since 77b273d8f5f4
VOP_READDIR_APV() asserts that a readdir which returns no entries also
sets *a_eofflag, so with INVARIANTS the final zero-length
getdirentries(2) that ls(1) issues on a mounted mqueuefs panics:
panic: VOP_READDIR: eofflag not set
Report end of directory when the child list was walked to its end;
leave the flag clear when the walk stopped because the buffer was full.
Approved by: re (cperciva)
(cherry picked from commit fbac0abdc5ab1fe867ac85635662ef06b2ee9d10)
(cherry picked from commit 6df22096ddb27edb169cfb6758d1dab130f9f683)
usbhid: Retry fetching the report descriptor
So far only seen with a wireless mouse on a Logitech Unifying
receiver. The receiver can time out on GET_DESCRIPTOR(REPORT) while
still starting up after power is applied, for example after resume
or when switched back through a USB switch. On failure, hms falls
back to the boot protocol descriptor and the mouse loses its wheel.
Wired mice have not shown the problem.
Retry the request up to five times with a 100 ms pause, stopping
early on a stall since that means the device has no descriptor.
Linux usbhid retries this request in the same way.
virtio_random: defer first enqueue until after DRIVER_OK
According to the virtio spec:
> The driver MUST NOT send any buffer available notifications to the
> device before setting DRIVER_OK.
DRIVER_OK isn't set until after attach completes, so defer the first
enqueue. We haven't found any problems as a result of this to the best
of my knowledge: q35 and other devices that we *have* been used with
will apparently check when we go DRIVER_OK.
Tested with q35 virtio-random, which still works.
Approved by: re (cperciva)
Reported by: llm-postcr
Reviewed by: kfv, markj
Fixes: f1c5a2e3a62505 ("virtio_random: Pipeline fetching the data")
Sponsored by: Stormshield
[4 lines not shown]
virtio_pci_modern: enable virtqueues before completing attach
Most of our drivers setup interrupt(s) and virtqueues are enabled at
that time, but nothing will currently enable them for devices that we're
only going to poll. This most notably affects virtio-random, and the
problem can be observed with qemu's q35 emulation and a random device
attached. The q35 implementation ignores the ring unless it's enabled,
so vtrnd_harvest() will consistently EAGAIN rather than contribute
anything of value, but with this patch it becomes functional.
This can be reproduced with a qemu invocation like so:
qemu-system-x86_64 -machine q35,accel=tcg -cpu max -smp 2 -m 2G \
-drive file=FreeBSD-16.0-CURRENT-amd64-ufs.qcow2,if=virtio \
-device pcie-root-port,id=rp1,bus=pcie.0,chassis=1 \
-object rng-random,id=rng0,filename=/dev/urandom \
-device virtio-rng-pci,rng=rng0,bus=rp1 \
-display curses
[7 lines not shown]
Remove exFAT and FUSE filesystem tools from the ISO
These packages are now installed at first boot by setup-station, so
the ISO no longer needs to ship them (ghostbsd/issues#316).
sysutils/bsdisks: refresh TimeMediaDetected on media change
TimeMediaDetected was only set when the drive appeared, so a card
inserted into a card reader that was already plugged in, or a disc
inserted into an optical drive, got a stale time and gvfs would not
automount it. Update it on devd MEDIACHANGE and send
PropertiesChanged so gvfs picks up the new value.
Use read-only accessors for TimeDetected and TimeMediaDetected,
matching the other Drive properties.
bhyve: Treat BAR registration failures as non-fatal
Some guest operating systems (at least 9front) will leave device I/O
space decoding enabled while probing BAR sizes. In this case, a
sufficiently large 32-bit BAR can overlap with the HPET MMIO region
fixed at 0xfed00000. This results in an assertion failure in
modify_bar_registration(), even though the collision is transient, i.e.,
the guest will promptly map the BAR elsewhere.
Tolerate such overlaps. Keep track of a BAR's registration state and
make sure that modify_bar_registration() doesn't try to unregister an
I/O space if registration failed.
This fixes a problem where a 32MB framebuffer ends up overlapping with
the HPET MMIO region, causing some guests to crash with an assertion
failure when probing BARs during boot.
Approved by: re (cperciva)
PR: 290098
[7 lines not shown]
