HardenedBSD/src b0720acsys/dev/acpica acpi.c acpi_pci.c, sys/kern uipc_shm.c kern_rangelock.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+71-25sys/dev/acpica/acpi_pci.c
+73-0sys/sys/videoio.h
+52-0sys/kern/kern_rangelock.c
+15-7sys/dev/acpica/acpi.c
+7-0sys/netipsec/keysock.c
+3-3sys/kern/uipc_shm.c
+221-353 files not shown
+230-369 files

HardenedBSD/src 94951f5sys/dev/acpica acpi.c acpi_pci.c, sys/kern uipc_shm.c kern_rangelock.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+71-25sys/dev/acpica/acpi_pci.c
+73-0sys/sys/videoio.h
+52-0sys/kern/kern_rangelock.c
+15-7sys/dev/acpica/acpi.c
+7-0sys/netipsec/keysock.c
+3-3sys/kern/uipc_shm.c
+221-353 files not shown
+230-369 files

HardenedBSD/src 2e376ccsys/kern uipc_shm.c kern_rangelock.c

rangelock: Reimplement _rangelock_cookie_assert()

After rangelocks were reimplemented, _rangelock_cookie_assert() became a
stub.  Re-provide an implementation.

Reviewed by:    kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59222
DeltaFile
+52-0sys/kern/kern_rangelock.c
+3-3sys/kern/uipc_shm.c
+55-32 files

HardenedBSD/src f1f58bdsys/dev/acpica acpi_pci.c

acpi_pci: Honor device proximity for DMA tags

A PCI function with its own _PXM still inherits a DMA tag carrying
the upstream bridge's proximity domain. Resolving an SR-IOV VF's
locality through its PF therefore does not affect the domain used for
DMA allocations.

Create and cache a private child tag when the function, or a VF's
owning PF, has an explicit _PXM. Parent it to the existing PCI or IOMMU
tag so its constraints remain intact, then apply the function's domain
without mutating a shared tag.

pci_get_dma_tag() already performs the IOMMU lookup, so remove the
duplicated lookup in the ACPI subclass while here.

Reviewed by:    jhb
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59063
DeltaFile
+36-20sys/dev/acpica/acpi_pci.c
+36-201 files

HardenedBSD/src 5f78d02sys/dev/acpica acpivar.h acpi.c

acpi_pci: Cache PCI proximity domains

A PCI function's _PXM is stable for the lifetime of its device
instance, but CPU and DMA locality queries may evaluate it repeatedly.
SR-IOV amplifies this because every VF resolves locality through the
same PF.

Cache successful mappings and the stable absence of _PXM on the
locality source device, and share that result between CPU and domain
queries. Continue to retry generic evaluation or mapping errors rather
than making a potentially transient failure permanent.

Reviewed by:    jhb
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59207
DeltaFile
+32-5sys/dev/acpica/acpi_pci.c
+15-7sys/dev/acpica/acpi.c
+3-0sys/dev/acpica/acpivar.h
+50-123 files

HardenedBSD/src dc4f80dsys/dev/acpica acpi_pci.c

acpi_pci: Preserve CPU locality queries for descendants

bus_generic_get_cpus() preserves the original leaf device while
forwarding a request through the bus hierarchy. Consequently,
acpi_pci_get_cpus() may receive a descendant below a PCI function
rather than one of the PCI bus's direct children.

Only apply the SR-IOV PF-locality mapping to direct PCI children.
Preserve the previous ACPI CPU-locality lookup for descendants so their
unrelated bus ivars are not interpreted as PCI device information.

Reviewed by:    jhb
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59206
DeltaFile
+3-0sys/dev/acpica/acpi_pci.c
+3-01 files

HardenedBSD/src d9a0903sys/kern uipc_shm.c, sys/sys mman.h

posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler

The check for whether shm_lp_psind was assigned was unlocked.  This race
can be exploited to create an object with psind==2 but with only
pagesizes[1] worth of pages populated.  This in turn can be used to
escalate privileges.

Fix this by acquiring the rangelock earlier.  In shm_mmap_large(),
assert that we hold the rangelock.  In shm_write(), annotate an unlocked
load of shm_lp_psind.

Approved by:    so
Security:       FreeBSD-SA-26:63.posixshm
Security:       CVE-2026-58094
Reported by:    tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59104


    [2 lines not shown]
DeltaFile
+17-10sys/kern/uipc_shm.c
+1-1sys/sys/mman.h
+18-112 files

HardenedBSD/src 40303b5sys/kern tty.c

tty: Revalidate after dropping the tty lock in ioctl handlers

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the
proctree relock.  After relocking the tty, it did not revalidate the
tty state, and it could end up linking a doomed tty to the calling
process' session.  This race can be exploited to escalate privileges.

TIOCSPGRP has a similar race, fix that too.

Approved by:    so
Security:       FreeBSD-SA-26:62.tty
Security:       CVE-2026-58093
Reported by:    tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59126

(cherry picked from commit b207f754c7709212381eda8c91dbf080081ac5a1)
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+12-2sys/kern/tty.c
+12-21 files

HardenedBSD/src d81d0a9crypto/openssl/ssl/quic quic_port.c quic_txp.c, crypto/openssl/ssl/record/methods dtls_meth.c

openssl: Fix multiple vulnerabilities

This is a rollup commit from upstream to fix:
  Handle signature_algorithms_cert extension in key-only context
  Avoid double free of qrx in port_default_packet_handler()
  Avoid full read buffer allocation when buffering DTLS next-epoch records
  ssl/record/methods/dtls_meth.c: lower the unprocessed_rcds queue limit
  ssl/record: remove dead DTLS processed_rcds record queue
  Fix heap buffer overflow (8-byte OOB write) in AES-WRAP-PAD unwrap
  CMP unexpected sender DN used as format string in ERR_raise_data()
  Add test for CVE-2026-63073
  Add a test for restricting growth in cmp cert cache
  Fix unbounded cert cache growth in cmp
  Don't store ACK-only frames in TX history for QUIC.
  Add test for CVE-2026-63076
  Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlg

Approved by:    so
Obtained from:  OpenSSL

    [11 lines not shown]
DeltaFile
+338-0crypto/openssl/test/cmp_extracerts_dos_test.c
+16-75crypto/openssl/ssl/record/methods/dtls_meth.c
+66-10crypto/openssl/test/rpktest.c
+50-0crypto/openssl/test/cmp_vfy_test.c
+34-12crypto/openssl/ssl/quic/quic_txp.c
+28-12crypto/openssl/ssl/quic/quic_port.c
+532-10912 files not shown
+682-12518 files

HardenedBSD/src 81171ebsys/sys ucred.h, tests/sys/mac/do Makefile regression.c

cred: Fix group_is_primary()

This helper wasn't updated in commit be1f7435ef21, so in reality it was
testing whether "gid" is the first supplemental group.  If a user
doesn't belong to a supplementary group, then it's testing an
uninitialized slot; since ucreds are allocated with M_ZERO, this
typically means that we're testing gid == 0.

group_is_primary() has exactly one use, in mac_do.  There, it's used to
determine whether the requested primary GID can be used in a setcred(2)
call when the ruleset does not explicitly specify a target primary GID.

I believe this is mostly exploitable by daemons which have explicitly
dropped privileges and called setgroups(0, NULL); logged in users will
have a non-empty supplementary group list by virtue of having gone
through initgroups(3).

Fix group_is_primary(), and add a regression test.


    [11 lines not shown]
DeltaFile
+83-0tests/sys/mac/do/regression.c
+1-1sys/sys/ucred.h
+2-0tests/sys/mac/do/Makefile
+86-13 files

HardenedBSD/src 5708af9sys/dev/sound/pcm channel.h dsp.c

dsp: Fix a potential use-after-free in dsp_oss_syncstart()

This function has a loop where it attempts to lock all channels in a
group.  If doing so would block, it releases all locks, sleeps for a
bit, and tries again.  However, once the syncgroup lock is dropped,
nothing prevents the syncgroup structure from being freed.

Fix the inner loop: after waking up, break out of it unconditionally and
start everything again.  I think the old code was also buggy and not
well-exercised: after waking up we'd continue to try and continue
locking channels.  Then we'd try again from the beginning and fail to
lock the channels we had already locked.

Approved by:    so
Security:       FreeBSD-SA-26:58.sound
Security:       CVE-2026-58091
Reported by:    Hazley Samsudin of GovTech CSG
Reviewed by:    christos
Sponsored by:   The FreeBSD Foundation

    [4 lines not shown]
DeltaFile
+6-11sys/dev/sound/pcm/dsp.c
+5-4sys/dev/sound/pcm/channel.h
+11-152 files

HardenedBSD/src 5c5331fsys/dev/hwpmc hwpmc_mod.c, sys/kern kern_exec.c

hwpmc: Fix the execve handler

When a process execve()s, pmc_process_exec() is supposed to evaluate
whether the new image is setuid/setgid and if so, whether to detach
PMCs.  This was handled by pmc_can_attach(), which is effectively an
open-coded copy of cr_xids_subset().

Unfortunately, the test of the result of this function was inverted,
with the result that we'd detach PMCs only if the predicate said it was
okay to do so.  It appears the bug has always been there; it seems the
intent was to return 0 on "success", i.e., it is okay to attach the
PMCs, much like p_candebug().  Commits 1c3c698ba4c4 and 1c40b15971f0
obscured this a bit.

I think this check is trying to be too clever.  Let's make it simpler:
simply do not attach PMCs unless the owner is privileged.  This is how,
e.g., ktrace works.  I do not think it's worth trying to be more
sophisticated than this unless we can generalize the policy in a way
that's applicable to other subsystems.

    [14 lines not shown]
DeltaFile
+12-60sys/dev/hwpmc/hwpmc_mod.c
+1-1sys/kern/kern_exec.c
+13-612 files

HardenedBSD/src 51c3018. UPDATING, sys/sys param.h

video: bump __FreeBSD_version for V4L2 cropping and overlay symbols

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59208
DeltaFile
+5-0UPDATING
+1-1sys/sys/param.h
+6-12 files

HardenedBSD/src d5016a8sys/sys videoio.h

video: add V4L2 cropping, control menu and overlay symbols

Adds missing structs symbols for V4L2.

video(4) capture devices do not crop, expose menu controls or support
overlay, and return ENOTTY for the new ioctls.
Applications enumerate these unconditionally and degrade gracefully
at run time, but fail to build when the declarations are missing.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59203
DeltaFile
+73-0sys/sys/videoio.h
+73-01 files

HardenedBSD/src fef9077sys/netipsec keysock.c

netipsec: Implement pr_disconnect for PF_KEY sockets

Otherwise close() fails.

PR:             297977
Reviewed by:    glebius
Fixes:          ea7be1293b48 ("keysock: do not use raw socket code")
MFC after:      1 week
DeltaFile
+7-0sys/netipsec/keysock.c
+7-01 files

HardenedBSD/src d01f12esys/contrib/device-tree/src/arm64/qcom kaanapali.dtsi glymur.dtsi

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+9,781-0sys/contrib/device-tree/src/arm64/qcom/hamoa.dtsi
+8,950-0sys/contrib/device-tree/src/arm64/qcom/lemans.dtsi
+8,317-0sys/contrib/device-tree/src/arm64/qcom/monaco.dtsi
+7,881-0sys/contrib/device-tree/src/arm64/qcom/kodiak.dtsi
+7,127-0sys/contrib/device-tree/src/arm64/qcom/glymur.dtsi
+7,010-0sys/contrib/device-tree/src/arm64/qcom/kaanapali.dtsi
+49,066-04,021 files not shown
+368,990-34,1624,027 files

HardenedBSD/src 5e9955fsys/contrib/device-tree/src/arm64/qcom kaanapali.dtsi glymur.dtsi

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+9,781-0sys/contrib/device-tree/src/arm64/qcom/hamoa.dtsi
+8,950-0sys/contrib/device-tree/src/arm64/qcom/lemans.dtsi
+8,317-0sys/contrib/device-tree/src/arm64/qcom/monaco.dtsi
+7,881-0sys/contrib/device-tree/src/arm64/qcom/kodiak.dtsi
+7,127-0sys/contrib/device-tree/src/arm64/qcom/glymur.dtsi
+7,010-0sys/contrib/device-tree/src/arm64/qcom/kaanapali.dtsi
+49,066-04,021 files not shown
+368,990-34,1624,027 files

HardenedBSD/src 8f0789btests/sys/pmc Makefile pmc_log_test.c

hwpmc tests: the sampling log file

Nine ATF cases covering PMC_OP_CONFIGURELOG and the descriptor-less
log operations: which descriptors are accepted, when a log is required
in the first place, and what the log operations do without one.

MFC after:      1 month
MFC to:         stable/15
MFC to:         stable/14
Assisted-by:    Claude Code (Opus 5)
DeltaFile
+453-0tests/sys/pmc/pmc_log_test.c
+1-0tests/sys/pmc/Makefile
+454-02 files

HardenedBSD/src bea7b93tests/sys/pmc Makefile pmc_credexec_test.c

hwpmc: add credential-transition exec tests (keep and drop)

The companion to pmc_exec_test.c, which covers only the drop side of a
credential-changing exec.  Three cases cover what the drop must not
overreach into: an exec that changes no credentials keeps the PMC, a
set-id exec whose credential change the kernel suppresses for a traced
target keeps it too, and a set-id fexecve(2) drops it.  They exercise
the permission logic FreeBSD-SA-26:56.hwpmc reworked, not the defect
it fixed.

All three pass on a debug (INVARIANTS+WITNESS) kernel.  The two
keep-cases were each observed to fail on a kernel mutated to detach
unconditionally.

MFC after:      1 month
MFC to:         stable/15
MFC to:         stable/14
Assisted-by:    Claude Code (Opus 4.8)
DeltaFile
+348-0tests/sys/pmc/pmc_credexec_test.c
+1-0tests/sys/pmc/Makefile
+349-02 files

HardenedBSD/src d00da14tests/sys/pmc Makefile pmc_lifecycle_test.c

hwpmc tests: process-attachment lifecycle and ownership cases

Seven ATF cases covering process-attachment teardown orderings: a
target that exits before it is detached, the owner that exits before
its target (hwpmc's other unlink path), releasing a still-running
attached PMC, row exhaustion with out-of-order release, and
PMC_F_DESCENDANTS inheritance including a fork storm.

All pass on a debug (INVARIANTS+WITNESS) and a KASAN kernel.

MFC after:      1 month
MFC to:         stable/15
MFC to:         stable/14
Assisted-by:    Claude Code (Opus 5)
DeltaFile
+436-0tests/sys/pmc/pmc_lifecycle_test.c
+1-0tests/sys/pmc/Makefile
+437-02 files

HardenedBSD/src 17fca80tests/sys/pmc Makefile pmc_api_test.c

hwpmc: add tests for handle validation and the privilege boundaries

A pmc_id_t is a packed integer that the driver hands to userland and
accepts back on eleven operations, and nothing tested what happens when
one comes back forged, stale, or belonging to another process.  Neither
was there a test that an unprivileged caller is refused the operations
that need a privilege.

The cases use a SOFT-class PMC wherever the counter itself does not
matter, so they run on a machine with no PMU.

MFC after:      1 month
MFC to:         stable/15
MFC to:         stable/14
Assisted-by:    Claude Code (Opus 5)
DeltaFile
+507-0tests/sys/pmc/pmc_api_test.c
+1-0tests/sys/pmc/Makefile
+508-02 files

HardenedBSD/src 068957etests/sys/pmc Makefile pmc_exec_test.c

hwpmc: add regression tests for a credential-changing exec

This tests what FreeBSD-SA-26:56.hwpmc fixed.

exec_setgid_drops_pmc asserts the kernel takes a process-mode PMC away
when its target execs a set-gid program its owner is not entitled to
trace.

exec_setuid_no_double_unlink lets the target exec a set-uid program;
the teardown must unlink the process descriptor exactly once, and
completing at all is the assertion.

Both need an unprivileged owner and must not drop privileges themselves,
since p_candebug() would then refuse the target to its own owner; they
ask for require.user instead.

MFC after:      1 month
MFC to:         stable/15
MFC to:         stable/14
Assisted-by:    Claude Code (Opus 5)
DeltaFile
+264-0tests/sys/pmc/pmc_exec_test.c
+1-0tests/sys/pmc/Makefile
+265-02 files

HardenedBSD/src df537fftests/sys/pmc Makefile

hwpmc tests: sort the list of test programs

MFC after:      1 month
MFC to:         stable/15
MFC to:         stable/14
DeltaFile
+1-1tests/sys/pmc/Makefile
+1-11 files

HardenedBSD/src 00a793dsys/netpfil/pf pf.c, tests/sys/netpfil/pf route_to.sh

pf: Fix fallout from the STATE_LOOKUP macro removal

Commit 8572367b6814 ("pf: remove STATE_LOOKUP") introduced two seemingly
unintentional changes with respect to divert(4)-injected packets (i.e.,
the PACKET_LOOPED case): we no longer return the matching state, and
direct callers of pf_find_state() now treat matches of diverted packets
the same as having no matching state at all.

This seems inadvertent, and breaks certain rulesets which use divert-to.
Fix them, and add a regression test case.

Fixes:          8572367b6814 ("pf: remove STATE_LOOKUP")
Reviewed by:    kp
MFC after:      2 weeks
Sponsored by:   OPNsense
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D59015
DeltaFile
+82-0tests/sys/netpfil/pf/route_to.sh
+6-11sys/netpfil/pf/pf.c
+88-112 files

HardenedBSD/src d6f5c65sys/dev/netmap netmap_mem2.c

netmap: Use ckdint.h helpers to check for overflow

This addresses a bug in the addition overflow check added in commit
319414a926af ("netmap: Handle overflow when computing ring sizes"): that
overflow wasn't actually caught by the check because "len" is promoted
to size_t.

PR:             297300
Fixes:          319414a926af ("netmap: Handle overflow when computing ring sizes")
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58896
DeltaFile
+3-7sys/dev/netmap/netmap_mem2.c
+3-71 files

HardenedBSD/src 901a242sbin/ifconfig ifconfig_netlink.c

ifconfig: Add netlink support for reading ifgroup

Read interface groups from IFLAF_GROUP netlink attribute.

Reviewed by:    glebius
Differential Revision:  https://reviews.freebsd.org/D58644
DeltaFile
+37-1sbin/ifconfig/ifconfig_netlink.c
+37-11 files

HardenedBSD/src 2f8f892sys/net if_var.h if.c, sys/netlink netlink_snl_route_parsers.h

rtnetlink: Add FreeBSD-specific IFLAF_GROUP support

Netlink IFLA_GROUP works with a single group id, in our
implementation an interface can be joined to multiple groups
and it works with group name.
Store interface groups in IFLAF_GROUP attribute.

Reviewed by:    glebius, melifaro
Discussed with: markj
Differential Revision: https://reviews.freebsd.org/D58643
DeltaFile
+34-1sys/netlink/route/iface.c
+24-0sys/net/if.c
+8-0sys/netlink/netlink_snl_route_parsers.h
+2-0sys/net/if_var.h
+1-0sys/netlink/route/interface.h
+69-15 files

HardenedBSD/src b7cff2a. UPDATING

UPDATING: Fix entry for getgroups(2)/setgroups(2)

Fix a typo, grammar, and generally rephrase for better clarity.

Fixes:          3463f02706db ("UPDATING: add an entry for [gs]etgroups")
MFC after:      1 day
MFC to:         stable/15
Sponsored by:   The FreeBSD Foundation
DeltaFile
+6-4UPDATING
+6-41 files

HardenedBSD/src 75ccab5sys/dts freebsd-compatible.dts

dts: Bump freebsd,dts-version to 7.1
DeltaFile
+1-1sys/dts/freebsd-compatible.dts
+1-11 files

HardenedBSD/src 69ed3dfsys/contrib/device-tree/src/arm64/qcom x1-asus-vivobook-s15.dtsi sm8650-ayaneo-pocket-s2.dts

Import device-tree files from Linux 7.1
DeltaFile
+7,127-0sys/contrib/device-tree/src/arm64/qcom/glymur.dtsi
+5,407-3sys/contrib/device-tree/src/arm64/qcom/kaanapali.dtsi
+1,889-0sys/contrib/device-tree/src/arm64/qcom/eliza.dtsi
+1,590-0sys/contrib/device-tree/src/arm64/qcom/purwa-iot-evk.dts
+1,551-0sys/contrib/device-tree/src/arm64/qcom/sm8650-ayaneo-pocket-s2.dts
+1,356-0sys/contrib/device-tree/src/arm64/qcom/x1-asus-vivobook-s15.dtsi
+18,920-31,298 files not shown
+96,104-10,4891,304 files