auditdistd, bhyve: drop OPENSSL_API_COMPAT
Neither uses any OpenSSL function deprecated in 3.0 or later. Both build
with no deprecation warnings against OpenSSL 3.5 and 4.1 without it.
Fix direct reads of blocks pending free
Direct reads only check the on-disk block pointer for holes, so they
can read stale data after a block has been freed but before the free
has synced. Share buffered read hole detection with direct reads to
honor pending frees as well.
Keep cached data ahead of hole detection and preserve the transaction
ordering of block clone and direct write overrides. Retain the block
pointer recheck after dnode_block_freed() for concurrent syncing.
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Signed-off-by: Wale Zhang <wale.zhang.ftd at gmail.com>
Closes #19633
Approved by: kevans (mentor)
(cherry picked from commit 924b8c89c04e324649855b05986f686b58ca4cb9)
dbuf: restore BP_IS_HOLE() recheck after dnode_block_freed()
Commit 79cf54582 ("Fix reads for blocks freed after being cloned")
reworked the level-0 check in dbuf_read_hole() and dropped the
BP_IS_HOLE() recheck that followed dnode_block_freed(), together with
the comment explaining it. That recheck was not about overrides: it
closes a race with dnode_sync().
dnode_sync_free_ranges() drops dn_mtx, clears the bps through
dnode_sync_free_range_impl() -> free_blocks(), then retakes dn_mtx and
removes the range from dn_free_ranges. For blkptrs held in the dnode
(dn_nlevels == 1), free_blocks() writes the bp without the parent's
db_rwlock, so holding that lock in dbuf_read() does not serialize
against it. A reader that saw a non-hole bp, then waited on dn_mtx in
dnode_block_freed() until the range was removed, gets "not freed" while
the bp it is about to copy is already a hole (with HOLE_BIRTH, lsize
and birth preserved). dbuf_read_impl() then hands that hole to
arc_read(): no child I/O is issued, checksum verification fails with
EINVAL, and without ZIO_FLAG_CANFAIL the pool is suspended.
[24 lines not shown]
Fix double free when cloning a block with a pending free
dmu_read_l0_bps() captures the source block pointers for a clone
without consulting dnode_block_freed(). A block whose free is recorded
but not yet synced still has a valid on-disk pointer, so the clone
registers a BRT reference to a block about to be returned to the
allocator, and it is freed twice. On a debug build this trips the
metaslab double-free verifier; on a release build the space map is
silently corrupted.
Check for a pending free and return EAGAIN, as dbuf_read_hole() already
does for buffered reads. zfs_clone_range() waits a TXG and retries, by
which point the block reads as a hole.
Two cases need more than the plain check. A hole has nothing to free,
so guard with !BP_IS_HOLE(bp), otherwise a hole inside a pending free
range fails a FICLONE that master cloned. When the head dirty record
already overrode the BP, only frees after the override count against
it, so use dnode_block_freed_after(); dbuf_free_range() leaves the
[17 lines not shown]
loader.efi: Measure boot policy and loaded contents with a TPM
Use the EFI TCG2 protocol, or the legacy TCG protocol on TPM 1.2
firmware, to extend the loader PCRs and record EV_IPL events in the
firmware event log.
Extend PCR 8 with the final kernel environment and the type, name, and
arguments of each loaded boot input. Prefix both record types with
versioned, NUL-terminated domain strings. These make the records
self-identifying and define an explicit measured policy encoding. Store
the complete measured pre-images in the event data so attestation and
diagnostic tools can audit the values without an out of band copy.
Extend PCR 9 with the initialized contents of kernels, modules, and raw
boot inputs, but record only descriptive labels rather than copying file
contents into the event log.
The Lua module table has no defined traversal order. Retain content
ranges as loader-private metadata, then sort the final file list before
[27 lines not shown]
tests: Improve vn_io_fault1 test
* Declare that the test needs 4 GB of memory so it can be automatically
skipped on systems with low memory.
* Switch back to mmap() as in my initial prototype. Using malloc() is
simpler, but on systems with malloc debugging enabled, malloc() will
prefault the entire buffer, resulting in a false positive. Using
mmap() also guarantees that the buffer is page-aligned, which renders
the test determinstic: we now only need to prefault exactly 2 GB, and
the difference between ret and len will be exactly the amount that we
prefaulted.
* To prefault the buffer, instead of a simple loop that writes zeroes
to it, which a compiler might recognize as dead stores and eliminate,
read the first INT_MAX bytes from the file into it.
PR: 298159
Fixes: ba02bbbe86ae ("tests: Add test for vn_io_fault1 bug")
[2 lines not shown]
powerpc64: don't reserve the red zone on the alternate signal stack
A 64-bit signal frame is 1552 bytes; rounded up and with the 512 byte
red zone added it needs 2096 bytes, more than MINSIGSTKSZ (2048), so a
handler on a minimum size alternate stack had its frame start 48 bytes
below the stack. The red zone only exists below the interrupted code's
stack pointer, so skip it only when the frame goes on that stack.
A handler on a MINSIGSTKSZ alternate stack overwrote the 48 bytes below
it; the frame stays within the stack now.
Reviewed by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61519
syncache.4: Align lists
Normally I am against tabbing them over so far to align the list, but
in these lists actually the page is 862 lines rendered aligned or using
indent, so aligning it improves readability without scolling regression.
MFC after: 3 days
ioctl: Add a macro for extracting the ioctl number from a command
Sprinkle it in various drivers which hard-coded the command layout.
No functional change intended.
Reviewed by: dumbbell, emaste
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61045
(cherry picked from commit 12b3c29a985d1753693d732372dafe915a890259)
rtnetlink: Use default weight for unset weights in NHA_GROUP
newnhg() copied the weights of a nhgrp as is and a group
whose members all have a zero weight, which is what
userland sends when it leaves the weight unset, made
calc_min_mpath_slots_fast() divide by zero.
Therefore replace weight of zero with RT_DEFAULT_WEIGHT.
While here, return early from calc_min_mpath_slots_fast()
if all weights are zero.
MFC after: 3 days
Fixes: 7e5bf68495cc ("netlink: add netlink support")
kernel: Add -mindirect-branch-cs-prefix for WITH_KERNEL_RETPOLINE
-mindirect-branch-cs-prefix adds a CS segment-override prefix (0x2e)
to each call or jmp to a retpoline thunk. The CPU ignores the prefix,
but it extends the instruction to six bytes instead of five. This
leaves enough room for a future kernel change to patch all of the call
sites at boot time to disable retpoline if not required.
Support for this option arrived in GCC 12 and Clang/LLVM 16.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61514
if_media: Add 100BASE-T1 and 1000BASE-T1 media types
100BASE-T1 (IEEE 802.3bw) and 1000BASE-T1 (IEEE 802.3bp) are Single-Pair
Ethernet (SPE) standards intended for use in automotive and industrial
applications.
Reviewed by: kbowling
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60864
(cherry picked from commit f69099fc0fc55262741621451a52de50f164271a)
tcp: count only the SACK blocks that fit in tcp_maxseg()
tcp_addoptions() sends only the SACK blocks that fit in TCP_MAXOLEN.
tcp_maxseg() counted every pending block and clamped the total, so
without timestamps and with five or more blocks pending it came out 4
bytes below the segment tcp_output() sends. Limited transmit after an
RTO then sent one full segment and failed the "sent too much" KASSERT.
PR: 282605
Approved by: adrian (mentor)
Signed-off-by: Nick Price <nprice at FreeBSD.org>
Reviewed by: tuexen, glebius, adrian
Differential Revision: https://reviews.freebsd.org/D60460
powerpc: don't drop FPU and VMX ownership in grab_mcontext()
grab_mcontext() saved the FP and vector registers with save_fpu() and
save_vec(), which drop ownership: PCPU(fputhread) becomes NULL while
PCB_FPU stays set and the thread keeps using the unit. A later
cpu_update_pcb(), at fork(2) or thr_new(2), then skipped the save,
since save_fpu_nodrop() only saves for the thread that owns the unit,
and the child got the registers as they were at the getcontext() or
signal rather than at the fork. Use the nodrop variants.
A child forked after getcontext() saw the parent's f14 as it was at
the getcontext(); it sees the current value now.
Reviewed by: adrian, jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60837
procctl: Zero the output structure for the compat32 syscall
Otherwise the freebsd32 implementation of PROC_REAP_STATUS leaks
uninitialized kernel stack memory.
Reviewed by: kib
Reported by: Dennys Kaluzny Pereira <dennyskaluzny at gmail.com>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61510
ipfilter: Remove erroneous ntohs()
The original commit was wrong. ipf_nat_builddivertmp() builds the UDP
template with the length in host byte order
M_DUP() copies that value unchanged. The old code was therefore correct.
It added fin_plen in host order and then did a single htons().
The original patch was discussed with Co-Pilot, which pointed out the
original bug. claude-opus-5-5 discovered the ntohs() error that
co-pilot suggested.
Interestingly this code had been running here for a couple of months.
Reported by: llm-postcr
Fixes: 72cc9e3766f4
(cherry picked from commit 86861520613f99c85b5fbdf92b5c955a13ed6624)
ipfilter: Only recalculate the UDP header when we have one
When ipf_nat_out processes NAT_DIVERTOUT (ipnat rdr statements)
it also fixes the checksum in the UDP header. Test for a UDP header
before adjusting its length.
While we are here, the length in the UDP header must be converted
from network byte order to host byte order. Add the missing ntohs().
PR: 296944
(cherry picked from commit 72cc9e3766f4222fa7fc462bc669dcf668e8b334)
krb5: Import MIT 1.22.3
Major changes in 1.22.3 (2026-11-09)
====================================
This is a bug fix release, with a focus on security issues discovered
with the aid of large language models. See
https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for
information on the risks of continuing to use unpatched releases.
* Fix a logic error when checking PAC server checksums
[CVE-2026-111423].
* Check for unkeyed checksums when validating CAMMAC verifiers
[CVE-2026-71199].
* Fix a loophole in the KDC's client authdata filtering which could
allow clients to include fake PAC and CAMMAC authdata values when
requesting service tickets. These fake values would be rejected by
[50 lines not shown]
nvme: enforce the Abort Command Limit
Each watchdog pass submitted an Abort for every timed-out command
with nothing counting them against the controller's ACL. A
controller may complete excess Aborts with Abort Command Limit
Exceeded status.
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D59636
acpi: Tasks: Precisely report the maximum number of slots used
To this end, store the actual number of busy slots instead of the index
of the final slot selected (off by one), and fix races when updating
'acpi_tasks_hiwater'.
The race is that it could happen that a first thread enqueued a task at
a higher index than the current maximum, followed by a second one
enqueuing at some even higher index, with the first thread updating
'acpi_tasks_hiwater' while the second was exactly after the 'if (i >
acpi_tasks_hiwater)' but just before attempting the atomic_cmpset_int()
that updates 'acpi_task_hiwater', which then would fail silently (the
return value was ignored) leading to the real maximum not being
recorded.
Fix the race by simply testing the return value of atomic_cmpset_int()
and retrying. Use an explicit atomic_load_int() for the guard (that
compiles to a regular load, so this change is cosmetic).
[6 lines not shown]
acpi: Tasks: Ensure sane values for number of tasks and threads
Make sure that these are set to sane values even on silly tunables:
- There must be at least one thread to process the 'acpi_taskq'.
- Use the ACPI_MAX_TASKS default when a negative number of tasks was
specified. This avoids common pilot errors causing a bogus huge memory
allocation for acpi_tasks[].
Reviewed by: obiwac (older version)
Differential Revision: https://reviews.freebsd.org/D60373
acpi: Tasks: Use M_WAITOK to allocate the taskqueue
Memory failure at this point normally does not happen except if the
kernel is running on a machine with a too tiny amount of memory, in
which case it is likely to panic or to be unusable anyway. However,
letting it panic here with a NULL pointer dereference is not very
helpful. Instead, use M_WAITOK, hoping the memory allocator itself will
indicate the low memory condition if it cannot succeed (if it does not,
it should be changed to).
Reviewed by: obiwac
Differential revision: https://reviews.freebsd.org/D60379
callout: optionally spread callouts to all CPUs
By default, if the caller has not used one of the _on() or _cpucpu()
variants of the callout API, the system assigns the callout to CPU0.
Having most callouts running on CPU0 can be problematic in terms of
the amount of CPU time spent executing callouts can have an unfair
impact to CPU0, and a critical callout (like lacp_tick) is certain
to land on the same CPU as everything else, so it is more likely
to be delayed.
This change introduces a change to callout_init* where if
kern.callout_spread is non-zero, callouts initialized after SMP startup
are distributed among CPUs.
This is left as disabled by default, as it may reveal any latent
synchronization bugs that were previously hidden, e.g., two callout handlers
which were always accidentally serialized against each other before may now
run concurrently. It also may cause a slight increase in power consumption
[6 lines not shown]
vtnet: honor the advertised MTU limit on attach
When VIRTIO_NET_F_MTU is negotiated, virtio_net_config.mtu specifies
the maximum MTU the driver may use. vtnet_ioctl_mtu() enforces this
limit for subsequent MTU changes, but ether_ifattach() unconditionally
initializes the interface MTU to ETHERMTU (1500).
So a device advertising a maximum below 1500 starts with an MTU above
its limit. So make sure to set the initial MTU no larger than
vtnet_max_mtu. That is, for vtnet_max_mtu less than 1500
interface MTU will be set to this value, otherwise the current behaviour
is preserved, MTU will be set to 1500.
Reviewed by: kfv, tuexen
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60980
(cherry picked from commit 0974ef03b43f279f16289ad4d5be3a03923983ea)
