igc: additionally disable PCIe ASPM for I226
Always disable PCIe ASPM for i226 type cards to improve stability
and wire sysctl calls to iflib_request_reset instead of igc_if_init
as this will stall the drivers RX path.
igc: Disable PCIe L1.2 on I225
I225 devices can incorrectly enter L1 substates while CLKREQ# is
asserted, both while idle and in D3. Disable ASPM and PCI-PM L1.2 on
I225 to prevent the resulting packet loss.
Keep the I226 workaround ASPM-only because it addresses a separate
traffic exit latency observation.
PR: 265714
(cherry picked from commit 4a28d390f5fbae2483e88805559881b04ccf9a80)
igc: Disable ASPM L1.2 on I226 to prevent RX stalls
I226 parts advertise support for the PCIe L1.2 link substate, but a
hardware erratum makes the exit latency from that low-power state
longer than the packet buffer can absorb under load. This stalls the
inbound packet stream. Disabling ASPM system-wide (BIOS or OS ASPM
policy) does not fix it. The L1.2 enable bit must be cleared directly
in the device's own PCIe L1 PM extended capability.
Add igc_is_device_id_i226() to identify affected parts and
igc_disable_broken_aspm_l1_2() to clear the ASPM L1.2 enable bit
on attach and after resume, since PCIe config space can be
reset across a suspend/resume cycle.
Adapted from the Linux igc driver:
0325143b59c6 igc: disable L1.2 PCI-E link substate to avoid
performance issue
1468c1f97cf3 igc: fix disabling L1.2 PCI-E link substate on I226
[9 lines not shown]
coredump: Don't assume that the number of ELF segments is consistent
In an ELF coredump, each dumped vm_map_entry is represented by a
segment. __elfN(coredump) first computes the number of segments by
looping over the vm_map entries (in each_dumpable_segment()), then
allocates a buffer to hold the ELF header and program headers, then
loops over the entries again to populate the program headers.
each_dumpable_segment() holds the vm_map read lock, but that lock is
dropped between the two calls. If the map is shared with another
process, via rfork(), then the map can change. cb_put_phdr() did not
account for this, and so could write out of bounds.
Add a check to prevent this; simply do not write out excess segments.
Approved by: so
Security: FreeBSD-SA-26:55.elf
Security: CVE-2026-58088
Reported by: Maik Muench of Secfault Security
[3 lines not shown]
sysvsem: Fix a TOCTOU race in semctl({GET,SET}ALL)
These commands take a snapshot of the size of a semaphore set, then drop
the lock and malloc an appropriately sized array before reacquiring the
lock. A comment explains why this is (probably) safe. Unfortunately,
it's wrong; it is indeed possible for a malicious userspace to create
and destroy 2^{15} sets in the window where the lock is dropped. This
race can lead to out-of-bounds reads and writes, and that can be
exploited to elevate privileges.
Replace the assertions with runtime checks.
Approved by: so
Security: FreeBSD-SA-26:54.sysvsem
Security: CVE-2026-58087
Reported by: Maik Muench of Secfault Security
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58421
wg(4): Add a test that the driver handles a decryption failure
The test uses a fail point to inject a decryption error in OCF while
sending a ping across the tunnel. The driver should then fail to
respond to the ping and increment the input error counter on the
interface.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
wg(4): Check for crypto operation errors
In particular, handle authentication errors due to bad MACs when
decrypting packets.
Since the current dispatch code assumes synchronous OCF sessions by
design, explicitly reject any created OCF session that is not
synchronous. Software sessions are always synchronous in practice, so
this should be a nop.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
ipsec: Fix a lock leak in ipsec_chkreplay()
Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team
Reviewed by: pouria, kp
Fixes: 0361f165f219 ("ipsec: replace SECASVAR mtx by rmlock")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58521
(cherry picked from commit b6823a973737f06ea6cf0ea5a3083383af2ba5a4)
bsdinstall/netconfig: use a better heuristic for wlan dev desc
For devices like the rtw88, they will show up in `ifconfig -l` as
rtw880, rtw881, etc. We want to query the rtw88.0 and rtw88.1 sysctl
respectively, not rtw.880.
Chances are that there aren't more than 9 wlan devices using the same
driver. Use a better heuristic to get the device description.
Reviewed by: bz
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
(cherry picked from commit c4b0b13cadac46b7c2cdfeeedeffa596c62568fa)
netinet6/nd6: Sprinkle missing prefix refcounting
When we drop the prefix lock to call nd6_prefix_offlink() or
nd6_prefix_onlink(), make sure to keep the correpsonding prefix
structure alive. It is possible for a concurrent nd6_timer() to expire
the prefix while the lock is dropped.
Reported by: Maik Muench of Secfault Security
Reviewed by: pouria, zlei
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58423
(cherry picked from commit 76ca489e0f147e9bd90408ea562087e84ed6f479)
libalias: Serialize updates to the global instance list
libalias maintains a global list of all libalias handles. The list was
updated without any locking, but nothing prevents updates from running
concurrently.
MFC after: 1 week
(cherry picked from commit 2ff705f32a2033201a8f83f1ade5ddbc0460387d)
man: Fix RFC 1918 network prefix lengths
According to RFC 1918, the following IP prefixes are reserved for
private internets:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
This PR fixes the prefix lengths in references to private networks
("RFC 1918 networks", "the standard private IP address ranges").
The changes are limited to man pages.
Signed-off-by: Yusuke Ichiki <public at yusuke.pub>
Pull Request: https://github.com/freebsd/freebsd-src/pull/2328
(cherry picked from commit 1403ca10189c47ad1de3915eeb030deddc114685)
pf: switch to getmicro(up)time()
It is reported that micro(up)time() performs poorly in certain
virtualisation scenarios. Absolute accuracy isn't required here, so
switch to the slightly less accurate (as per the man page) get-variants.
PR: 295043
MFC after: 3 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit e4130ac13d2fe9c17b8f8e86d39a7b5223fe7b79)
if_ovpn: Fix memory leak in VNET during unload
Unloading if_ovpn while it's in use by other vnets causes
memory leaks and panics.
Fix this by reverting VNET_SYSUNINIT and adjusting the SI_SUB
initialization order.
Reviewed by: markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D54175
(cherry picked from commit bf142ea4760bd4391092d9cc0038a0870cf7e0b2)
netmap: Don't assume that user-provided strings are nul-terminated
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit e1ab35148dd425340a88a2acaf10b972cb119f8f)
pf: Add missing PF_TS_CNT Netlink attribute
There is no parser entry for PF_TS_CNT, therefore PF_TS_REFCNT
is written starting at pfrts_cnt, causing the refcount
to be wrongly shown in the "Addresses:" section of print_tstats().
Issue: https://github.com/opnsense/src/issues/300
igc: additionally disable PCIe ASPM for I226
Always disable PCIe ASPM for i226 type cards to improve stability
and wire sysctl calls to iflib_request_reset instead of igc_if_init
as this will stall the drivers RX path.
igc: Disable PCIe L1.2 on I225
I225 devices can incorrectly enter L1 substates while CLKREQ# is
asserted, both while idle and in D3. Disable ASPM and PCI-PM L1.2 on
I225 to prevent the resulting packet loss.
Keep the I226 workaround ASPM-only because it addresses a separate
traffic exit latency observation.
PR: 265714
(cherry picked from commit 4a28d390f5fbae2483e88805559881b04ccf9a80)
