security/zeek: Update to 8.0.10
https://github.com/zeek/zeek/releases/tag/v8.0.10
This release fixes the following vulnerabilities:
- HIGH: SMB: Chains of AndX messages can crash Zeek
- HIGH: DNP3: Memory exhaustion via file control (g70v1) fields
- HIGH: SIP: Memory exhaustion from long request/response paths
- HIGH: DHCP: Memory exhaustion from retained options after analyzer
violation
- HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path
entries
- HIGH: SMB: DCE/RPC memory exhaustion from fragment state
[63 lines not shown]
security/vuxml: Mark security/zeek < 8.0.10 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v8.0.10
This release fixes the following vulnerabilities:
- HIGH: SMB: Chains of AndX messages can crash Zeek
- HIGH: DNP3: Memory exhaustion via file control (g70v1) fields
- HIGH: SIP: Memory exhaustion from long request/response paths
- HIGH: DHCP: Memory exhaustion from retained options after analyzer
violation
- HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path
entries
- HIGH: SMB: DCE/RPC memory exhaustion from fragment state
[46 lines not shown]
net/rustconn: Update to 0.20.4
- Remove all patches (that were valid for the previous version of cpal
crate)
ChangeLog: https://github.com/totoshko88/RustConn/releases/tag/v0.20.4
Reported by: "github-actions[bot]" <notifications at github.com>
linux: Add STF type and convert some if_type to ARPHRD
Convert IFT_BRIDGE and IFT_L2VLAN to ARPHRD_ETHER, and IFT_LOOP
to ARPHRD_LOOPBACK in linux netlink.
Also, add ARPHRD_SIT and convert IFT_STF to it.
Reviewed by: kfv
Differential Revision: https://reviews.freebsd.org/D58573
nhop.9: Rewrite relics of rtentry.9 into nhop.9
Parts of rtentry.9 information such as information related to
the nexthop is outdated.
Remove those relics and add the new design into separate
manual instead.
Reviewed by: bcr
Discussed with: ziaee
Differential Revision: https://reviews.freebsd.org/D58564
gve: Implement AQ batching for queue creation and destruction
Currently, the FreeBSD driver configures and destroys queues
sequentially by issuing individual Admin Queue (AQ) commands.
During queue teardown (e.g., interface reset), disabling queues
one by one leaves the device in a partially configured state.
Because the device does not yet know that the driver is in the
process of fully unconfiguring all queues, this intermediate
state can trigger transient error logs (such as when queue 0 is
disabled while other queues are still active).
Modify the driver to use Admin Queue batching for both the
creation and destruction of TX and RX queues. Commands are now
queued and kicked together, ensuring the queue configuration changes
are applied atomically and preventing transient errors from being logged.
Signed-off-by: Sujithra Periasamy <sujithra at google.com>
[6 lines not shown]
ctl.4: Document the assumption that CTL HA runs only on trusted networks
The CTL High Availablity clustering feature allows a pair of hosts to
implement transparent failover. The implementation uses a TCP
connection to exchange messages. There is no authentication mechanism
and the protocol itself embeds kernel pointers in the messages exchanged
between HA hosts. This property (of CTL_MSG_DATAMOVE messages
specifically), as well as insufficient validation of inbound messages,
mean that anyone able to access a CTL HA port is able to remotely
execute code on that host.
Provide a warning to this effect in the CTL man page.
Reported by: Ryan of Calif.io
Reviewed by: ziaee, ken, mav
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58622
(cherry picked from commit 3c8f8432b6f653128016c6aaf826e1efb7ee1cec)
epoch: Fix epoch_drain_callbacks()
This function is supposed to wait until all pending callbacks have been
executed. This is useful in some contexts where we tear down some
context (like a VNET jail and its associated UMA zones) synchronously,
and we want to make sure that all pending asynchronous callbacks (which
may free objects to said UMA zones) have run first.
The implementation schedules a callback on each CPU and waits for them
all to run. This assumes that, on a given CPU, callbacks are executed
in the order that they are pushed. This assumption depends on the
implementation of epoch_call_task() and ck_epoch_poll_deferred(), and it
is not true in general.
Callbacks are pushed onto a per-CPU stack in LIFO order.
ck_epoch_poll_deferred() first pulls out the callbacks from epoch - 2,
which are always safe to execute, and in so doing reorders them such
that the oldest callback as at the top of the stack, so in this case,
epoch_call_task() will execute them in order. However,
[24 lines not shown]
rawip: Fix handling of checksums in rip6_input()
A v6 raw socket may ask the kernel to validate the checksum of an
inbound packet. If it does, and the validation fails, we discard the
packet, but this isn't really right: other raw sockets may wish to
receive a copy of the packet anyway.
Rework checksum handling to address this problem, and use a flag to
avoid computing the checksum more than once for a given packet.
Fixes: de2d47842e880281 ("SMR protection for inpcbs")
Reviewed by: pouria, glebius
Reported by: Yunzhi Ke
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58559
(cherry picked from commit 196874ce2e97e3e6425493b1d501e716b356bc36)
in_mcast: Fix uninitialized variable usage in inm_merge()
When the first loop in inm_merge() hits an error, generally because it
hit some limit on the number of source filters for a multicast group,
inm_merge() tries to atomically roll back changes to the group source
filter list.
To roll back, it iterates over the global source filter list for the
multicast group, starting at the last entry that we updated ("nims").
But, if we have not yet updated any entries, this variable is
uninitialized. Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM
doesn't visit any source filters in this case.
All of the above applies to the v6 case.
Reported by: Daniel Birtwhistle
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit b9db5a5b16477863654f92ec653e8464528ef981)
proc: Copy the p_reapsubtree field explicitly during fork
p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc,
which is copied during fork without any synchronization. However, the
field is not stable except when the proctree lock is held, and indeed
may change if p1's reaper exits or explicitly releases its reaper
status. This state change can race with fork() and leave the child with
an incorrect p_reapsubtree field.
Close the race: explicitly copy the field under the proctree lock during
fork.
Reported by: syzkaller
Reviewed by: kib
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58482
(cherry picked from commit 8616b7dc3850758eb39a5b63f41f56c05403380b)
lang/go126: Update to 1.26.7
Changes:
go1.26.7 (released 2026-08-19) includes fixes to the net/http package.
MFH: 2026Q3
(cherry picked from commit 466c3d8ebd2255c98a5461d168e0875f304d9d44)
lang/go125: Update to 1.25.14
Changes:
go1.25.14 (released 2026-08-19) includes fixes to the net/http
package.
MFH: 2026Q3
(cherry picked from commit 578f1cec0b2270176a2da96cf87a0ddde2eb46fc)
lang/go127: Add go 1.27
Changes:
Go 1.27 now supports generic methods: a method declaration may declare
its own type parameters. This widely anticipated change allows adding
generic functions within the namespace of a particular data type where
before one had to declare such functions with a scope of the entire
package.
A key in a struct literal may now be any valid field selector for the
struct type, not just a (top-level) field name of the struct.
Function type inference has been generalized to apply in all contexts
where a generic function is assigned to a variable of (or converted
to) a matching function type.
