loader.efi: Measure boot policy and loaded contents with a TPM
Use the EFI TCG2 protocol, or the legacy TCG protocol on TPM 1.2
firmware, to extend the loader PCRs and record EV_IPL events in the
firmware event log.
Extend PCR 8 with the final kernel environment and the type, name, and
arguments of each loaded boot input. Prefix both record types with
versioned, NUL-terminated domain strings. These make the records
self-identifying and define an explicit measured policy encoding. Store
the complete measured pre-images in the event data so attestation and
diagnostic tools can audit the values without an out of band copy.
Extend PCR 9 with the initialized contents of kernels, modules, and raw
boot inputs, but record only descriptive labels rather than copying file
contents into the event log.
The Lua module table has no defined traversal order. Retain content
ranges as loader-private metadata, then sort the final file list before
[27 lines not shown]
tests: Improve vn_io_fault1 test
* Declare that the test needs 4 GB of memory so it can be automatically
skipped on systems with low memory.
* Switch back to mmap() as in my initial prototype. Using malloc() is
simpler, but on systems with malloc debugging enabled, malloc() will
prefault the entire buffer, resulting in a false positive. Using
mmap() also guarantees that the buffer is page-aligned, which renders
the test determinstic: we now only need to prefault exactly 2 GB, and
the difference between ret and len will be exactly the amount that we
prefaulted.
* To prefault the buffer, instead of a simple loop that writes zeroes
to it, which a compiler might recognize as dead stores and eliminate,
read the first INT_MAX bytes from the file into it.
PR: 298159
Fixes: ba02bbbe86ae ("tests: Add test for vn_io_fault1 bug")
[2 lines not shown]
powerpc64: don't reserve the red zone on the alternate signal stack
A 64-bit signal frame is 1552 bytes; rounded up and with the 512 byte
red zone added it needs 2096 bytes, more than MINSIGSTKSZ (2048), so a
handler on a minimum size alternate stack had its frame start 48 bytes
below the stack. The red zone only exists below the interrupted code's
stack pointer, so skip it only when the frame goes on that stack.
A handler on a MINSIGSTKSZ alternate stack overwrote the 48 bytes below
it; the frame stays within the stack now.
Reviewed by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61519
syncache.4: Align lists
Normally I am against tabbing them over so far to align the list, but
in these lists actually the page is 862 lines rendered aligned or using
indent, so aligning it improves readability without scolling regression.
MFC after: 3 days
ioctl: Add a macro for extracting the ioctl number from a command
Sprinkle it in various drivers which hard-coded the command layout.
No functional change intended.
Reviewed by: dumbbell, emaste
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61045
(cherry picked from commit 12b3c29a985d1753693d732372dafe915a890259)
vm_kern: wrap around in kmem_back() when the last domain is empty
kmem_back() picks the domain from the address and, when that domain has
no memory, steps forward until it finds one that does:
domain = (addr >> KVA_QUANTUM_SHIFT) % vm_ndomains;
while (VM_DOMAIN_EMPTY(domain))
domain++;
Nothing stops the walk at vm_ndomains. When the empty domain is the
last one, the loop runs through the unused tail of vm_dom[] (all empty)
and on into whatever follows vm_dom[MAXMEMDOM] in memory, until a word
there happens to look like a non-zero page count; kmem_back_domain()
then allocates from that garbage domain. Ordinary allocations never
get here, because the per-domain arenas and the domainset iterators
skip empty domains. Only the direct callers of kmem_back() do: kinst
(one trampoline per thread, allocated when the module loads) and
memguard.
[8 lines not shown]
malloc: Fix realloc() for large allocations
min() truncates its parameters.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit ca16e7a4920415bf9d09cf76bd2c3cda7447c098)
bhyve: Treat BAR registration failures as non-fatal
Some guest operating systems (at least 9front) will leave device I/O
space decoding enabled while probing BAR sizes. In this case, a
sufficiently large 32-bit BAR can overlap with the HPET MMIO region
fixed at 0xfed00000. This results in an assertion failure in
modify_bar_registration(), even though the collision is transient, i.e.,
the guest will promptly map the BAR elsewhere.
Tolerate such overlaps. Keep track of a BAR's registration state and
make sure that modify_bar_registration() doesn't try to unregister an
I/O space if registration failed.
This fixes a problem where a 32MB framebuffer ends up overlapping with
the HPET MMIO region, causing some guests to crash with an assertion
failure when probing BARs during boot.
PR: 290098
Reviewed by: bnovkov
[5 lines not shown]
hv_kvp: Fix some bugs and nits
- Use pending_mutex to synchronize several state flags. In particular,
ensure that two threads can't race to open the device file at the same
time.[1]
- Fix an off-by-one in hv_kvp_dev_daemon_read() that would result in a
one-byte OOB read if the caller supplied a large enough read buffer.[2]
- Change the device permissions to 0600: hv_kvp_dev_daemon_read()
returns an error until the owning process registers itself with a
write, so there's no sense in providing read-only access.
- Use bool instead of boolean_t.
- Don't return negative error numbers to userspace.
- Call seldrain() when closing the device.
Reported by: pixelpop [1][2]
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60387
(cherry picked from commit ebf1041fc854c531a27efd9f979e28d57306777d)
bhyve: Fix virtio-input event array resizing
Use the new array size when calling realloc(). Note that this queue
stores events read from a host evdev device, i.e., it is not
guest-controlled.
While here, use the cdefs.h __unused macro and use them correctly, i.e.,
don't mark "arg" as unused when it isn't.
Reported by: Brian Delgado from Intel using Anthropic Opus 4.8
Fixes: 054accac71e0 ("Add a virtio-input device emulation.")
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60679
(cherry picked from commit f1986e5b88630b1404a202251499bca0f97f5f06)
pam_exec: fix the stderr close test and avoid a double close
The cleanup tested cherr[0] when closing cherr[1]. The parent also closed
chin[0]/chout[1]/cherr[1] after pdfork() without clearing them, so the out:
cleanup path closed them again. Clear each fd after closing and test the right
one.
Reviewed by: des, markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60924
(cherry picked from commit 06abe08de45d251410949eac1bbb025367275260)
dhclient: Avoid out-of-bounds reads in check_classless_option()
The loop did not verify that the option buffer is large enough before
reading an address.
Reported by: Andrew Griffiths <andrew at calif.io>
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60484
(cherry picked from commit 368a1bfcd49315e8dd3e56ca6744ce5d74ef737b)
inetd: use snprintf() in inetd_setproctitle()
inetd_setproctitle() formats se_service (the service name taken verbatim
from inetd.conf) and the peer address into an 80-byte buffer with
sprintf(). A long service name can overflow it. Bound both calls with
snprintf().
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60879
(cherry picked from commit 9ab2bf0f4296e8bfafe4dc70f2f200265e6933bd)
dhclient: Add some regression tests
Add tests for some recently fixed bugs in dhclient. All of these tests
set up two VNET jails connected by an epair. dhclient runs in one jail,
and the test code runs on the other end. It uses scapy to inject
"interesting" packets in response to DHCPDISCOVER messages from
dhclient, then checks the configured interface and lease file.
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60485
(cherry picked from commit a143197801c680b958ab662c88cf086668a1958b)
rtnetlink: Use default weight for unset weights in NHA_GROUP
newnhg() copied the weights of a nhgrp as is and a group
whose members all have a zero weight, which is what
userland sends when it leaves the weight unset, made
calc_min_mpath_slots_fast() divide by zero.
Therefore replace weight of zero with RT_DEFAULT_WEIGHT.
While here, return early from calc_min_mpath_slots_fast()
if all weights are zero.
MFC after: 3 days
Fixes: 7e5bf68495cc ("netlink: add netlink support")
kernel: Add -mindirect-branch-cs-prefix for WITH_KERNEL_RETPOLINE
-mindirect-branch-cs-prefix adds a CS segment-override prefix (0x2e)
to each call or jmp to a retpoline thunk. The CPU ignores the prefix,
but it extends the instruction to six bytes instead of five. This
leaves enough room for a future kernel change to patch all of the call
sites at boot time to disable retpoline if not required.
Support for this option arrived in GCC 12 and Clang/LLVM 16.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61514
if_media: Add 100BASE-T1 and 1000BASE-T1 media types
100BASE-T1 (IEEE 802.3bw) and 1000BASE-T1 (IEEE 802.3bp) are Single-Pair
Ethernet (SPE) standards intended for use in automotive and industrial
applications.
Reviewed by: kbowling
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60864
(cherry picked from commit f69099fc0fc55262741621451a52de50f164271a)
tcp: count only the SACK blocks that fit in tcp_maxseg()
tcp_addoptions() sends only the SACK blocks that fit in TCP_MAXOLEN.
tcp_maxseg() counted every pending block and clamped the total, so
without timestamps and with five or more blocks pending it came out 4
bytes below the segment tcp_output() sends. Limited transmit after an
RTO then sent one full segment and failed the "sent too much" KASSERT.
PR: 282605
Approved by: adrian (mentor)
Signed-off-by: Nick Price <nprice at FreeBSD.org>
Reviewed by: tuexen, glebius, adrian
Differential Revision: https://reviews.freebsd.org/D60460
powerpc: don't drop FPU and VMX ownership in grab_mcontext()
grab_mcontext() saved the FP and vector registers with save_fpu() and
save_vec(), which drop ownership: PCPU(fputhread) becomes NULL while
PCB_FPU stays set and the thread keeps using the unit. A later
cpu_update_pcb(), at fork(2) or thr_new(2), then skipped the save,
since save_fpu_nodrop() only saves for the thread that owns the unit,
and the child got the registers as they were at the getcontext() or
signal rather than at the fork. Use the nodrop variants.
A child forked after getcontext() saw the parent's f14 as it was at
the getcontext(); it sees the current value now.
Reviewed by: adrian, jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60837
procctl: Zero the output structure for the compat32 syscall
Otherwise the freebsd32 implementation of PROC_REAP_STATUS leaks
uninitialized kernel stack memory.
Reviewed by: kib
Reported by: Dennys Kaluzny Pereira <dennyskaluzny at gmail.com>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61510
ipfilter: Remove erroneous ntohs()
The original commit was wrong. ipf_nat_builddivertmp() builds the UDP
template with the length in host byte order
M_DUP() copies that value unchanged. The old code was therefore correct.
It added fin_plen in host order and then did a single htons().
The original patch was discussed with Co-Pilot, which pointed out the
original bug. claude-opus-5-5 discovered the ntohs() error that
co-pilot suggested.
Interestingly this code had been running here for a couple of months.
Reported by: llm-postcr
Fixes: 72cc9e3766f4
(cherry picked from commit 86861520613f99c85b5fbdf92b5c955a13ed6624)
ipfilter: Only recalculate the UDP header when we have one
When ipf_nat_out processes NAT_DIVERTOUT (ipnat rdr statements)
it also fixes the checksum in the UDP header. Test for a UDP header
before adjusting its length.
While we are here, the length in the UDP header must be converted
from network byte order to host byte order. Add the missing ntohs().
PR: 296944
(cherry picked from commit 72cc9e3766f4222fa7fc462bc669dcf668e8b334)
ipfilter: Remove erroneous ntohs()
The original commit was wrong. ipf_nat_builddivertmp() builds the UDP
template with the length in host byte order
M_DUP() copies that value unchanged. The old code was therefore correct.
It added fin_plen in host order and then did a single htons().
The original patch was discussed with Co-Pilot, which pointed out the
original bug. claude-opus-5-5 discovered the ntohs() error that
co-pilot suggested.
Interestingly this code had been running here for a couple of months.
Reported by: llm-postcr
Fixes: 72cc9e3766f4
(cherry picked from commit 86861520613f99c85b5fbdf92b5c955a13ed6624)
ipfilter: Only recalculate the UDP header when we have one
When ipf_nat_out processes NAT_DIVERTOUT (ipnat rdr statements)
it also fixes the checksum in the UDP header. Test for a UDP header
before adjusting its length.
While we are here, the length in the UDP header must be converted
from network byte order to host byte order. Add the missing ntohs().
PR: 296944
(cherry picked from commit 72cc9e3766f4222fa7fc462bc669dcf668e8b334)
krb5: Import MIT 1.22.3
Major changes in 1.22.3 (2026-11-09)
====================================
This is a bug fix release, with a focus on security issues discovered
with the aid of large language models. See
https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for
information on the risks of continuing to use unpatched releases.
* Fix a logic error when checking PAC server checksums
[CVE-2026-111423].
* Check for unkeyed checksums when validating CAMMAC verifiers
[CVE-2026-71199].
* Fix a loophole in the KDC's client authdata filtering which could
allow clients to include fake PAC and CAMMAC authdata values when
requesting service tickets. These fake values would be rejected by
[50 lines not shown]
