ipsec: Fix a lock leak in ipsec_chkreplay()
Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team
Reviewed by: pouria, kp
Fixes: 0361f165f219 ("ipsec: replace SECASVAR mtx by rmlock")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58521
(cherry picked from commit b6823a973737f06ea6cf0ea5a3083383af2ba5a4)
bsdinstall/netconfig: use a better heuristic for wlan dev desc
For devices like the rtw88, they will show up in `ifconfig -l` as
rtw880, rtw881, etc. We want to query the rtw88.0 and rtw88.1 sysctl
respectively, not rtw.880.
Chances are that there aren't more than 9 wlan devices using the same
driver. Use a better heuristic to get the device description.
Reviewed by: bz
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
(cherry picked from commit c4b0b13cadac46b7c2cdfeeedeffa596c62568fa)
netinet6/nd6: Sprinkle missing prefix refcounting
When we drop the prefix lock to call nd6_prefix_offlink() or
nd6_prefix_onlink(), make sure to keep the correpsonding prefix
structure alive. It is possible for a concurrent nd6_timer() to expire
the prefix while the lock is dropped.
Reported by: Maik Muench of Secfault Security
Reviewed by: pouria, zlei
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58423
(cherry picked from commit 76ca489e0f147e9bd90408ea562087e84ed6f479)
libalias: Serialize updates to the global instance list
libalias maintains a global list of all libalias handles. The list was
updated without any locking, but nothing prevents updates from running
concurrently.
MFC after: 1 week
(cherry picked from commit 2ff705f32a2033201a8f83f1ade5ddbc0460387d)
man: Fix RFC 1918 network prefix lengths
According to RFC 1918, the following IP prefixes are reserved for
private internets:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
This PR fixes the prefix lengths in references to private networks
("RFC 1918 networks", "the standard private IP address ranges").
The changes are limited to man pages.
Signed-off-by: Yusuke Ichiki <public at yusuke.pub>
Pull Request: https://github.com/freebsd/freebsd-src/pull/2328
(cherry picked from commit 1403ca10189c47ad1de3915eeb030deddc114685)
pf: switch to getmicro(up)time()
It is reported that micro(up)time() performs poorly in certain
virtualisation scenarios. Absolute accuracy isn't required here, so
switch to the slightly less accurate (as per the man page) get-variants.
PR: 295043
MFC after: 3 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit e4130ac13d2fe9c17b8f8e86d39a7b5223fe7b79)
if_ovpn: Fix memory leak in VNET during unload
Unloading if_ovpn while it's in use by other vnets causes
memory leaks and panics.
Fix this by reverting VNET_SYSUNINIT and adjusting the SI_SUB
initialization order.
Reviewed by: markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D54175
(cherry picked from commit bf142ea4760bd4391092d9cc0038a0870cf7e0b2)
netmap: Don't assume that user-provided strings are nul-terminated
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit e1ab35148dd425340a88a2acaf10b972cb119f8f)
pf: Add missing PF_TS_CNT Netlink attribute
There is no parser entry for PF_TS_CNT, therefore PF_TS_REFCNT
is written starting at pfrts_cnt, causing the refcount
to be wrongly shown in the "Addresses:" section of print_tstats().
Issue: https://github.com/opnsense/src/issues/300
igc: additionally disable PCIe ASPM for I226
Always disable PCIe ASPM for i226 type cards to improve stability
and wire sysctl calls to iflib_request_reset instead of igc_if_init
as this will stall the drivers RX path.
igc: Disable PCIe L1.2 on I225
I225 devices can incorrectly enter L1 substates while CLKREQ# is
asserted, both while idle and in D3. Disable ASPM and PCI-PM L1.2 on
I225 to prevent the resulting packet loss.
Keep the I226 workaround ASPM-only because it addresses a separate
traffic exit latency observation.
PR: 265714
(cherry picked from commit 4a28d390f5fbae2483e88805559881b04ccf9a80)
igc: Disable ASPM L1.2 on I226 to prevent RX stalls
I226 parts advertise support for the PCIe L1.2 link substate, but a
hardware erratum makes the exit latency from that low-power state
longer than the packet buffer can absorb under load. This stalls the
inbound packet stream. Disabling ASPM system-wide (BIOS or OS ASPM
policy) does not fix it. The L1.2 enable bit must be cleared directly
in the device's own PCIe L1 PM extended capability.
Add igc_is_device_id_i226() to identify affected parts and
igc_disable_broken_aspm_l1_2() to clear the ASPM L1.2 enable bit
on attach and after resume, since PCIe config space can be
reset across a suspend/resume cycle.
Adapted from the Linux igc driver:
0325143b59c6 igc: disable L1.2 PCI-E link substate to avoid
performance issue
1468c1f97cf3 igc: fix disabling L1.2 PCI-E link substate on I226
[9 lines not shown]
sys/socket.h: Fix AF_MAX
AF_MAX was always intended to be one more than the greatest allocated
value. Jeff broke this in 2013. Unfortunately, a bunch of people then
decided to adapt to the mistake instead of correcting it.
Fixes: 863c7e45628d (" - Reserve a special AF for SDP. The one we were incorrectly using before was taken by another AF.")
MFC after: 3 days
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans, glebius
Differential Revision: https://reviews.freebsd.org/D58597
(cherry picked from commit ddd850aa7720f77b6605599655df898b16ed74cc)
ena: Update driver version to v2.8.4
Bug Fixes:
* Fix false 'missing TX completions' warnings due to timestamp race
* Put taskqueues into correct NUMA domain if !RSS
Minor Changes:
* Batch RX statistics updates
* Swap RX/TX completions cleanup order
Submitted by: Arthur Kiyanovski <akiyano at amazon.com>
MFC after: 2 weeks
Sponsored by: Amazon, Inc.
Reviewed by: cperciva
Differential Revision: https://reviews.freebsd.org/D58242
(cherry picked from commit 605e699cd6ca4feae6c73c5c5ea8337054897116)
ena: Fix false 'missing TX completions' warnings due to timestamp race
Sporadic 'Found a Tx that wasn't completed on time' warnings appear
under sustained TX load, always reporting '1 msecs since last cleanup'
despite the 5-second timeout threshold.
The per-packet TX timestamp uses struct bintime (128 bits: two 64-bit
fields sec and frac) which is read and written non-atomically. A race
exists between the missing TX completion check
(check_missing_comp_in_tx_queue reading the timestamp) and the TX
submit path or cleanup path writing it on another CPU. Since the two
fields are not updated atomically, the check can observe a partially
written timestamp - one field from the old value and one from the new.
This can produce a timestamp with {sec=0, frac=valid}, causing the
check to compute a time offset equal to system uptime and falsely
exceeding the 5-second timeout.
Confirmed by instrumentation showing all occurrences had sec=0 with
valid frac/mbuf, cleanup_running=0, and ticks==last_cleanup_ticks.
[24 lines not shown]
ena: Batch RX statistics updates
Move per-packet counter_enter/counter_exit pairs out of the RX
processing loop and batch them into a single update after the
loop completes.
Previously, each received packet triggered two separate
counter_enter/counter_exit blocks -- one for bytes and one for
packet count. This commit accumulates totals in local variables
and updates all four counters (ring and hw stats for both packets
and bytes) in a single counter_enter/counter_exit block after the
loop.
Also move the stats update to after the refill and LRO flush
so that the error path (goto update_stats) and the normal path
converge at the same label, avoiding code duplication.
Submitted by: David Arinzon <darinzon at amazon.com>
MFC after: 2 weeks
[5 lines not shown]
ena: Swap cleanup order
As RX processing is heavier than TX completions processing, swap the
order and process TX completions first, in order to avoid starving the
completions and causing potential missing TX completions.
Submitted by: Ofir Tabachnik <ofirt at amazon.com>
MFC after: 2 weeks
Sponsored by: Amazon, Inc.
Reviewed by: cperciva
Differential Revision: https://reviews.freebsd.org/D58239
(cherry picked from commit f08def9ed97f45700eb0611a3fd9240210c9303e)
coredump: Don't assume that the number of ELF segments is consistent
In an ELF coredump, each dumped vm_map_entry is represented by a
segment. __elfN(coredump) first computes the number of segments by
looping over the vm_map entries (in each_dumpable_segment()), then
allocates a buffer to hold the ELF header and program headers, then
loops over the entries again to populate the program headers.
each_dumpable_segment() holds the vm_map read lock, but that lock is
dropped between the two calls. If the map is shared with another
process, via rfork(), then the map can change. cb_put_phdr() did not
account for this, and so could write out of bounds.
Add a check to prevent this; simply do not write out excess segments.
Approved by: so
Security: FreeBSD-SA-26:55.elf
Security: CVE-2026-58088
Reported by: Maik Muench of Secfault Security
[3 lines not shown]
sysvsem: Fix a TOCTOU race in semctl({GET,SET}ALL)
These commands take a snapshot of the size of a semaphore set, then drop
the lock and malloc an appropriately sized array before reacquiring the
lock. A comment explains why this is (probably) safe. Unfortunately,
it's wrong; it is indeed possible for a malicious userspace to create
and destroy 2^{15} sets in the window where the lock is dropped. This
race can lead to out-of-bounds reads and writes, and that can be
exploited to elevate privileges.
Replace the assertions with runtime checks.
Approved by: so
Security: FreeBSD-SA-26:54.sysvsem
Security: CVE-2026-58087
Reported by: Maik Muench of Secfault Security
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58421
jail: restore ktrace privileges for jailed root
Commit 4be491e1b9b3 ("jail: Optionally allow audit session state to
be configured in a jail") removed the #if 0 around the audit cases
in prison_priv_check() and added the PR_ALLOW_SETAUDIT check under
them. This unintentionally captured the preceding case PRIV_KTRACE,
which used to fall through the disabled block into the unconditional
return (0) of the credential cases: since then, jailed root only has
ktrace privileges (tracing processes with changed credentials, see
ktrcanset()) when the unrelated allow.setaudit knob is enabled, and
conversely gains them when that audit knob is turned on.
Give PRIV_KTRACE back its own unconditional return (0), matching its
comment and the pre-4be491e1b9b3 behaviour.
Approved by: so
Security: FreeBSD-SA-26:53.ktrace
Security: CVE-2026-58086
Fixes: 4be491e1b9b3 ("jail: Optionally allow audit session state to be configured in a jail")
[2 lines not shown]
wg(4): Add a test that the driver handles a decryption failure
The test uses a fail point to inject a decryption error in OCF while
sending a ping across the tunnel. The driver should then fail to
respond to the ping and increment the input error counter on the
interface.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
kqueue: Avoid enqueuing an already-enqueued knote
knotes with a non-trivial f_copy implementation may be activated before
kqueue_fork_copy_knote() is finished. In particular, it may be enqueued
at the time that kqueue_fork_copy_knote() calls knote_enqueue(). Guard
against this.
Add a test case which triggers the race.
Fix several other problems with the replication of knote state:
- Make sure only the KN_ACTIVE and KN_DISABLED status flags are
inherited, the rest should not be copied.
- Ignore marker knotes.
- Ignore knotes for kqueues. They cannot be safely copied into the
child without more work, as kqueues are inherently local to a process;
on fork, we need to ensure that such knotes are patched to reference
the new kqueue, not the original.
- Try to keep knote state stable by holding the kqueue and knlist locks
while copying.
[8 lines not shown]
zvol: Fix uses of uninitialized variables in zvol_rename_minors_impl()
Reported-by: GitHub Copilot
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Alexander Motin <alexander.motin at TrueNAS.com>
Signed-off-by: Mark Johnston <markj at FreeBSD.org>
Closes #18191
Approved by: so
Security: FreeBSD-EN-26:19.zfs
(cherry picked from commit 943a05528494b2f4585541089606796476fb229e)
(cherry picked from commit 698e0c419895da2d0d12c5f4d61d85a1d91b6b9d)
