HardenedBSD/src 49dce82sys/dev/e1000 if_em.c, sys/dev/igc if_igc.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+12-6sys/dev/igc/if_igc.c
+12-6sys/dev/e1000/if_em.c
+24-122 files

HardenedBSD/src dfe8f1fsys/dev/e1000 if_em.c, sys/dev/igc if_igc.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+12-6sys/dev/igc/if_igc.c
+12-6sys/dev/e1000/if_em.c
+24-122 files

HardenedBSD/src 45d93ffusr.sbin/boot0cfg boot0cfg.8 boot0cfg.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+34-6usr.sbin/boot0cfg/boot0cfg.c
+26-6usr.sbin/boot0cfg/boot0cfg.8
+60-122 files

HardenedBSD/src 30ccf2fsys/dev/igc if_igc.c

igc: defer sysctl-driven reinit to the admin task

igc_sysctl_eee() and igc_sysctl_dmac() called igc_if_init() directly.

Request the reset through iflib instead, and skipping while the interface
is down; the new value is picked up by the next init.

Unlike e1000, igc has no ASSERT_CTX_LOCK_HELD and no acquire_swflag
path, so the defect is silent here rather than an assertion failure.

While here also remove unnecessary igc_if_init uses:
iflib_if_init_locked() already runs after IFDI_RESUME and
IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped
IFDI_INIT that the following iflib_stop() undoes.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58629
DeltaFile
+12-6sys/dev/igc/if_igc.c
+12-61 files

HardenedBSD/src abdde8bsys/dev/e1000 if_em.c

e1000: defer sysctl-driven reinit to the admin task

Request the reset through iflib and let the admin task perform the
stop/init under the context lock, matching what the VF and SR-IOV paths
already do.

The assertion is compiled out without INVARIANTS, where the same write
instead resets the MAC and takes the ICH software flag while the queues
stay live and an ioctl or the admin task may be running.

While here also remove unnecessary em_if_init uses:
iflib_if_init_locked() already runs after IFDI_RESUME and
IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped
IFDI_INIT that the following iflib_stop() undoes.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58628
DeltaFile
+12-6sys/dev/e1000/if_em.c
+12-61 files

HardenedBSD/src 15a0a7dusr.sbin/boot0cfg boot0cfg.8 boot0cfg.c

boot0cfg: Also allow a file as a trailing argument

Modify the disk check to allow arbitrary files as the trailing argument
instead of requiring a live GEOM disk provider.

This enables modifying a boot0 binary file in-place before flashing it
to a disk via gpart bootcode, or using it directly as an argument to
mkimg's partition specification, as these tools cannot directly adjust
the parameters of the boot0 boot manager.

Reviewed by:    imp, jhb
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57310

(cherry picked from commit 4007d914e7973bca8ac488ab50aca56964eed90f)
DeltaFile
+34-6usr.sbin/boot0cfg/boot0cfg.c
+26-6usr.sbin/boot0cfg/boot0cfg.8
+60-122 files

HardenedBSD/src 0d7c1cfcontrib/unbound config.h.in configure, contrib/unbound/doc Changelog

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+3,512-3,494contrib/unbound/util/configlexer.c
+2,874-1,942contrib/unbound/configure
+2,148-2,099contrib/unbound/util/configparser.c
+577-0contrib/unbound/doc/Changelog
+223-181lib/libunbound/config.h
+220-178contrib/unbound/config.h.in
+9,554-7,894109 files not shown
+12,581-8,981115 files

HardenedBSD/src 7465ed9contrib/unbound config.h.in configure, contrib/unbound/doc Changelog

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+3,512-3,494contrib/unbound/util/configlexer.c
+2,874-1,942contrib/unbound/configure
+2,148-2,099contrib/unbound/util/configparser.c
+577-0contrib/unbound/doc/Changelog
+223-181lib/libunbound/config.h
+220-178contrib/unbound/config.h.in
+9,554-7,894109 files not shown
+12,581-8,981115 files

HardenedBSD/src 7e8785asys/dev/ixl ixl_pf_iov.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+1-2sys/dev/ixl/ixl_pf_iov.c
+1-21 files

HardenedBSD/src b95a859sys/fs/autofs autofs_vnops.c

autofs_lookup(): busy the mount point around autofs_trigger()

Since autofs_lookup() calls into autofs_trigger_vn() to perform
automounting, and autofs_trigger_vn() unlocks the vnode, it is possible
for the unmount to start meantime.  Then autofs_trigger() accesses freed
memory.

At this point, busy can be only done unblocking, and the transient
failure must abort the trigger operation.  This would cause spurious
automounter errors, but at least should prevent accesses to the freed
memory.

PR:     294361
Reviewed by:    markj, rew
Tested by:      rew
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58626
DeltaFile
+11-4sys/fs/autofs/autofs_vnops.c
+11-41 files

HardenedBSD/src 7745a14bin/pwait/tests pwait_reap.c, contrib/unbound/services listen_dnsport.c outside_network.c

Merge branch 'hardened/15-stable/main' into hardened/15-stable/pledge
DeltaFile
+321-67contrib/unbound/services/outside_network.c
+174-151sys/dev/e1000/if_em.c
+162-141sys/dev/igc/if_igc.c
+159-75contrib/unbound/services/listen_dnsport.c
+216-0tests/sys/pmc/pmc_wrap_test.c
+188-0bin/pwait/tests/pwait_reap.c
+1,220-434111 files not shown
+3,071-1,004117 files

HardenedBSD/src c6fb3adsys/dev/ixl ixl_pf_iov.c

ixl: enforce the assigned VF MAC address

When allow-set-mac is disabled, the MAC filter validation condition
rejects the assigned VF unicast address while allowing any different
unicast address. The equality test was accidentally inverted when this
code moved to the boolean address helper.

Accept multicast and the assigned unicast address, and reject other
unicast addresses as intended.

Fixes:          7d4dceec1030 ("ixl(4): Fix VLAN HW filtering")

(cherry picked from commit d2309d9d6dc6d5a9141314652d6c96ab46a9a62c)
DeltaFile
+1-2sys/dev/ixl/ixl_pf_iov.c
+1-21 files

HardenedBSD/src 7a78914contrib/unbound config.h.in configure, contrib/unbound/doc Changelog

unbound: Update to 1.26.0

Release notes at
        https://community.nlnetlabs.nl/t/unbound-1-26-0-released

Merge commit '84ffc29dc8ddb0c946db5cb3b3c1310bec6a9e6c'
DeltaFile
+3,512-3,494contrib/unbound/util/configlexer.c
+2,874-1,942contrib/unbound/configure
+2,148-2,099contrib/unbound/util/configparser.c
+577-0contrib/unbound/doc/Changelog
+223-181lib/libunbound/config.h
+220-178contrib/unbound/config.h.in
+9,554-7,894108 files not shown
+12,570-8,977114 files

HardenedBSD/src 821937dlib/libc/stdlib memalignment.3, share/man/man4 iflib.4

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+109-45sys/net/iflib.c
+15-41sys/fs/p9fs/p9fs_vfsops.c
+0-27sys/fs/nfsclient/nfs_clrpcops.c
+11-5share/man/man5/pf.conf.5
+10-1share/man/man4/iflib.4
+2-2lib/libc/stdlib/memalignment.3
+147-1213 files not shown
+150-1269 files

HardenedBSD/src b1e81f6lib/libc/stdlib memalignment.3, share/man/man4 iflib.4

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+109-45sys/net/iflib.c
+15-41sys/fs/p9fs/p9fs_vfsops.c
+0-27sys/fs/nfsclient/nfs_clrpcops.c
+11-5share/man/man5/pf.conf.5
+10-1share/man/man4/iflib.4
+2-2lib/libc/stdlib/memalignment.3
+147-1213 files not shown
+150-1269 files

HardenedBSD/src 65349afsys/net iflib.c

iflib: clear the deferred TX descriptor state when a queue is stopped

Stopping an interface frees the queued mbufs and zeroes a transmit
queue's descriptor accounting, but the three counters that track
descriptors deferred to a later doorbell write or report-status
request are not cleared there: they only reach zero when the code
that acts on them runs.  After a reset they therefore describe
descriptors that no longer exist, until enough new traffic flushes
them.

The consequences are small - one doorbell written from a stale
count, and a report-status request on the first packet after the
reset - but the state is simply wrong, and the transmit-hang check
in iflib_timer() reads one of them.

MFC after:      1 week
Assisted-by:    Claude Code (Opus 5)
DeltaFile
+2-0sys/net/iflib.c
+2-01 files

HardenedBSD/src 5da9bc8sys/net iflib.c

iflib: remove the unused TX queue state machine

The previous commit stopped using ift_qstatus and the IFLIB_QUEUE_*
states for the TX watchdog decision, leaving only dead stores.
Remove the field, the states, and all assignments.  The byte the
field frees stays behind as explicit padding.  No functional change.

Reviewed by:    gallatin, markj
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D58282
Assisted-by:    Claude Code (Fable 5, Opus 5)
DeltaFile
+1-20sys/net/iflib.c
+1-201 files

HardenedBSD/src 69c3e0dshare/man/man4 iflib.4, sys/net iflib.c

iflib: restore TX watchdog functionality

Since f6afed726b00 the TX-hang check in iflib_timer() has required a
queue state other than IFLIB_QUEUE_IDLE, but nothing ever sets
IFLIB_QUEUE_WORKING, so IFLIB_QUEUE_HUNG has been unreachable ever
since: stalled TX queues are not detected, not reported, and not
reset - the TX watchdog of every iflib(4) driver has been dead code.

Instead of resurrecting the queue-state machine, detect the hang
directly.  A transmit queue is frozen while it holds descriptors the
hardware has not reported as completed and none were reclaimed over a
timer period.  Being frozen is not a fault: the hardware may defer
marking descriptors as completed indefinitely.  The check therefore
arms only when a frozen queue also takes on new work, while the link
is up, no pause frames were received and no doorbell is pending; and
it acts only after the queue has stayed frozen for
net.iflib.tx_watchdog_periods consecutive periods.  It then asks the
hardware through the driver's read-only credits peek
(isc_txd_credits_update with clear=false, the same call the mp_ring

    [46 lines not shown]
DeltaFile
+107-26sys/net/iflib.c
+10-1share/man/man4/iflib.4
+117-272 files

HardenedBSD/src 2d21dbasys/fs/p9fs p9fs_vnops.c p9fs_vfsops.c

fix p9fs_vget_common() panics

This addresses a race when two vnodes attempt to call vfs_hash_insert(),
but only one succeeds. Also, in case of an error from
p9fs_reload_stats_dotl(), it marks the vnode for deletion.

Reviewed by:    kib
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58632
DeltaFile
+15-41sys/fs/p9fs/p9fs_vfsops.c
+0-3sys/fs/p9fs/p9fs_vnops.c
+15-442 files

HardenedBSD/src 8f20299sys/fs/nfsclient nfs_clrpcops.c

nfs_commonkrpc.c: Get rid of NFSv4.0 delegation cruft

Delegations in NFSv4.0 never worked well and, since
the NFSv4.0 protocol is now deprecated, use of delegations
for NFSv4.0 is disabled as far as the client can do so.

It turns out that some Illumos NFSv4.0 server issues
delegations anyhow (even when the callback path is
specified as 0.0.0.0) and this can cause use after free
problems.

This patch deleted some cruft that did an nfsrpc_openrpc()
call recursively when an NFSv4.0 server failed to issue
a delegation when it had previously done so.
This code was only meant to be an optimization and
would have been rarely exercised.  Since this recursive
call of nfsrpc_openrpc() is in some of the backtraces
in the bugzilla PR, getting rid of the cruft makes sense.


    [5 lines not shown]
DeltaFile
+0-27sys/fs/nfsclient/nfs_clrpcops.c
+0-271 files

HardenedBSD/src 82c013flib/libc/stdbit stdc_first_leading_zero.3, lib/libc/stdlib memalignment.3

manuals: Fix more Fx and nearby mechanical typos

Fix compiler warnings related to the Fx macro, as well as all other
mechanical typos that were visible within one screenful of them. These
cause rendering glitches on various toolchains with various of the five
and a half decades of rich output formats and tooling manpages scale to.

The *x macro set specifies operating systems. These macros take the rest
of the line as an argument. Sometimes, a space was not used to separate
the argument of Fx and the trailing period. Others had other parts of
the sentence supplied as an argument to Fx.

While here, fix the other mechanical typos visible on those specific
screenfulls. Correct section typo AUTHOR to AUTHORS, markup utilities
with Sy, and apply line break after the end of a sentence.

PR:             297248
MFC after:      3 days
Reported by:    wosch (are you sure that's all of the broken Fx'es?)

    [5 lines not shown]
DeltaFile
+11-5share/man/man5/pf.conf.5
+2-2lib/libc/stdlib/memalignment.3
+2-1sbin/route/route.8
+1-1lib/libc/stdbit/stdc_first_leading_zero.3
+16-94 files

HardenedBSD/src 481a415lib/libifconfig libifconfig_internal.c libifconfig.c, sys/net rtsock.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+3-3sys/netlink/route/rt.c
+2-2sys/net/rtsock.c
+2-2sys/net/route/route_helpers.c
+2-2lib/libifconfig/libifconfig.c
+3-1sys/sys/socket.h
+1-1lib/libifconfig/libifconfig_internal.c
+13-113 files not shown
+16-149 files

HardenedBSD/src e3319b7lib/libifconfig libifconfig_internal.c libifconfig.c, sys/net rtsock.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+3-3sys/netlink/route/rt.c
+2-2sys/net/rtsock.c
+2-2sys/net/route/route_helpers.c
+2-2lib/libifconfig/libifconfig.c
+3-1sys/sys/socket.h
+1-1lib/libifconfig/libifconfig_internal.c
+13-113 files not shown
+16-149 files

HardenedBSD/src 315ce11sys/arm64/arm64 trap.c, sys/dev/e1000 igb_txrx.c em_txrx.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+11-0sys/arm64/arm64/trap.c
+2-4sys/dev/hwpmc/hwpmc_amd.c
+6-0sys/dev/e1000/igb_txrx.c
+6-0sys/dev/e1000/em_txrx.c
+25-44 files

HardenedBSD/src 60dd46dsys/arm64/arm64 trap.c

arm64: Use the fault handler when one is provided

In align_abort() and tag_check_abort(), if we got a fault while in kernel,
do not panic if a fault handler has been provided. We may get such a fault
when trying to read or write userland data, it can at least happen with
_umtx_op() if an unaligned pointer is provided. Instead, just let the
fault handler deal with it.

MFC After: 1 week
Approved by: andrew
Differential Revision: https://reviews.freebsd.org/D58426

(cherry picked from commit c6f5d8fb269fd67a8206420b4e7d67a93bc80733)
Signed-off-by: Olivier Houchard <cognet at FreeBSD.org>
DeltaFile
+11-0sys/arm64/arm64/trap.c
+11-01 files

HardenedBSD/src 84ffc29. configure, testdata dns64_dnssec.rpl sub_ds_deepcopy.rpl

import unbound 1.26.0
DeltaFile
+3,512-3,494util/configlexer.c
+2,874-1,942configure
+2,148-2,099util/configparser.c
+1,202-0testdata/edns_nsid_repeat.rpl
+676-0testdata/sub_ds_deepcopy.rpl
+609-0testdata/dns64_dnssec.rpl
+11,021-7,535190 files not shown
+24,472-8,882196 files

HardenedBSD/src ddd850alib/libifconfig libifconfig_internal.c libifconfig.c, sys/net rtsock.c

sys/socket.h: Fix AF_MAX

AF_MAX was always intended to be one more than the greatest allocated
value.  Jeff broke this in 2013.  Unfortunately, a bunch of people then
decided to adapt to the mistake instead of correcting it.

Fixes:          863c7e45628d (" - Reserve a special AF for SDP.  The one we were incorrectly using before    was taken by another AF.")
MFC after:      3 days
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kevans, glebius
Differential Revision:  https://reviews.freebsd.org/D58597
DeltaFile
+3-3sys/netlink/route/rt.c
+2-2sys/net/rtsock.c
+2-2sys/net/route/route_helpers.c
+2-2lib/libifconfig/libifconfig.c
+3-1sys/sys/socket.h
+1-1lib/libifconfig/libifconfig_internal.c
+13-113 files not shown
+16-149 files

HardenedBSD/src 410403dsys/dev/e1000 igb_txrx.c em_txrx.c

e1000: report UDP RSS hash type on igb/em

{em,igb}_determine_rsstype() mapped only the TCP and bare-IP RSS descriptor
types; the UDP types returned M_HASHTYPE_NONE.
The hardware does hash UDP, but with a NONE hashtype iflib skips its
flowid-based TX queue spread, so all forwarded UDP egressed on a single queue
and serialized transmit on one core.

Add the three UDP cases (IPV4_UDP, IPV6_UDP, IPV6_UDP_EX) so egress spreads
across all TX queues.

Reviewed by:    kbowling, gallatin
Approved by:    kbowling
MFC after:      1 week
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58513

(cherry picked from commit 285c749f575ed7f9e60555037f23ac673084c62a)
DeltaFile
+6-0sys/dev/e1000/igb_txrx.c
+6-0sys/dev/e1000/em_txrx.c
+12-02 files

HardenedBSD/src 38af24esys/dev/hwpmc hwpmc_amd.c

hwpmc: fix event allocation on pre-Zen AMD CPUs

amd_allocate_pmc() chose the pmu-events code path whenever pmc_cpuid was
non-empty, and rejected any allocation lacking PMC_F_EV_PMU.
But pmc_cpuid is set for every AMD CPU, while the pmu-events tables only cover
Zen and later.
On older families (K8, Bobcat, Jaguar/16h, Bulldozer) libpmc finds no
pmu-events entry and falls back to the legacy path, which never sets
PMC_F_EV_PMU.

Reviewed by:    mhorne
Approved by:    mhorne
MFC after:      1 week
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58468

(cherry picked from commit 6c4d9b9af1a3b247bf82a4228c835d106f535613)
DeltaFile
+2-4sys/dev/hwpmc/hwpmc_amd.c
+2-41 files

HardenedBSD/src 08abff8stand/efi/libefi efinet.c, stand/libsa bootp.h bootp.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+233-0stand/efi/libefi/efinet.c
+59-24stand/libsa/bootp.c
+9-3sys/fs/nfs/nfs_commonkrpc.c
+6-3usr.bin/ipcrm/ipcrm.1
+7-0stand/libsa/bootp.h
+3-2usr.bin/elfctl/elfctl.1
+317-3222 files not shown
+359-6728 files