bcm2835_audio: Comment out vchi_service_release()
bcm2835_audio_release() calls vchi_service_close() and then
unconditionally calls vchi_service_release() with the same service
handle.
In the VCHI shim implementation, a successful vchi_service_close() calls
service_free(service). The subsequent vchi_service_release() therefore
dereferences a freed SHIM_SERVICE_T object when it reads
service->handle, resulting in a use-after-free panic.
vchi_service_release(), however, releases a reference which might block
vchi_service_close() from completing successfuly, so comment it out
instead of removing it altogether, until further testing is done.
PR: 297187
MFC after: 2 weeks
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D58921
bhyve: Add SPDX-License-Identifier tag
Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 499d0f04f55e52327d624d27ead3a0d16e3b465a)
sound: Use unsigned long instead of legacy u_long
No functional change intended.
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
(cherry picked from commit afe56ee24679d6584acf02dd17f6ed52c052abe7)
New version of jng (9.0)
Changes for jng 2.0 -> 9.0 include:
+ Use ng_bridge(4) uplink hooks on ng_ether(4) lower so the host
mapping table stays small (first hook is uplink; unknown unicast
goes only to uplink)
+ Add `jng pin [-h] {-a | NAME ...}' to plant eiface MACs with
NGM_BRIDGE_MOVE_HOST and raise maxStaleness so they do not expire
+ Remove experimental NG_TYPE=iface / ng_tcpmss(4); ng_iface(4)
cannot work with ng_bridge(4)
+ Add -v
+ SPDX-License-Identifier: BSD-2-Clause; bump copyright to 2026
See D58902 for the ng_bridge(4) data-path MOVE_HOST fix.
MFC after: 1 week
Reviewed by: kfv, jlduran
Differential Revision: https://reviews.freebsd.org/D58903
stand: set st_dev/st_ino in the loader's ZFS stat for veriexec
The loader's ZFS implementation never set st_dev or st_ino in
zfs_dnode_stat(). With an uninitialized struct stat, veriexec's device
comparison in lib/libsecureboot/veopen.c read stack garbage and skipped
the matching manifest entry, failing with a spurious "no entry" on ZFS
root under UEFI Secure Boot.
Rather than zeroing the device (which would break veriexec's ability to
tell apart the same path on different datasets), populate st_dev and
st_ino with the same intrinsic identifiers the kernel uses:
- st_dev = the dataset's ds_fsid_guid (as the kernel does via
dmu_objset_fsid_guid()/dsl_dataset_fsid_guid()), already read in
zfs_mount_dataset() and now propagated through struct zfsmount.
- st_ino = the object number resolved in zfs_lookup(), propagated
through struct file (the loader's equivalent of the kernel's z_id).
dev_t and ino_t are 64-bit on FreeBSD, so both are assigned directly
[14 lines not shown]
ipfilter: Fix checksum update for NAT_DIVERTOUT
When taking a snapshot of the before ip_len (s1) for comparison with the
after-translated ip_len (s2), we must convert it from network to host
byte order before we can use it. Add the missing ntohs() call.
PR: 296944
MFC after: 3 days
share/man/man4: Move non-USB man pages out of MK_USB block
uart(4), unix(4) and the gzero(4) MLINK are not USB things, but they
were in the .if ${MK_USB} != "no" block. So if we build with
WITHOUT_USB, these man pages are lost. Move them out of the block.
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 1100d9eca9cb2860c58633a9176dd11a30850da4)
share/man/man4: Move non-USB man pages out of MK_USB block
uart(4), unix(4), veriexec(4) and the gzero(4) MLINK are not USB
things, but they were in the .if ${MK_USB} != "no" block. So if we
build with WITHOUT_USB, these man pages are lost. Move them out of
the block.
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 1100d9eca9cb2860c58633a9176dd11a30850da4)
fts: add fts_capsicum_test.c
Add three test cases verifying fts(3) Capsicum capability mode:
- fts_dirfd_valid: verifies fts_dirfd is set for all non-root
entries and openat(fts_dirfd, fts_name) identifies the same
inode as fts_accpath
- fts_dirfd_capsicum: verifies complete fts traversal works in
Capsicum capability mode using fts_openat() and fts_dirfd
- fts_dirfd_deep_tree: verifies fts_dirfd + fts_name is correct
at all directory depths (7 non-root entries)
Sponsored by: Google LLC (GSoC 2026)
Reviewed by: asomers
Pull Request: https://github.com/freebsd/freebsd-src/pull/2332
vtnet: move offload functions to virtio_net.h to share them
Move the functions vtnet_rxq_csum() and vtnet_txq_offload() and the
subfunctions they call from if_vtnet.c to virtio_net.h. This allows
us to call these functions from if_tuntap.c and if_ptnet.c.
virtio_net.h already contained a copy of these functions, but a copy
of an outdated version. The functions evolved in if_vtnet.c.
In if_vtnet.c, the copy has never been used because it increments
counters in their own functions.
This patch removes the outdated copy from virtio_net.h and moves the
new version of the functions from if_vtnet.c to virtio_net.h.
if_tuntap.c, if_ptnet.c, and if_vtnet.c just call these functions,
and if_vtnet.c increments its counters depending on the return value.
Reviewed by: tuexen
MFC after: 1 month
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D57299
ix(4): Sanitize negative error codes
Due to development history FreeBSD driver error codes are reported
the same way as in Linux (as negatives) which is inconsistent
with FreeBSD standard. It may cause unexpected behavior when driver
errors are interpreted by a kernel as syscall handler return values.
This patch converts error codes from negative to positive values for
NVM access functions.
Signed-off-by: Pawel Sobczyk <pawel.sobczyk at intel.com>
Reviewed by: kbowling, erj, milosz.linkiewicz_intel.com
Tested by: Mateusz Moga <mateusz.moga at intel.com>
MFC after: 1 week
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D57642
arm64 vfp: eliminate nested critical sections
At two out of three call sites to vfp_restore_state_common(), the caller
must use critical_{enter,exit}() to prevent preemption between its call
to vfp_restore_state_common() and other actions, notably its call to
sve_enable(). So, it is arguably better to make
vfp_restore_state_common()'s caller responsible for performing
critical_{enter,exit}() and simply perform CRITICAL_ASSERT() inside
vfp_restore_state_common().
Reviewed by: kib, markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D58859
ufshci: report the highest LUN number in the path inquiry
cpi->max_lun is an inclusive upper bound, but the driver reported the
LUN count (8 or 32), so CAM probed one nonexistent LUN past the end.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58820
ufshci: correct the crypto/config register offsets and HCMID fields
The reserved array after CCAP must be 508, but it was 511.
This pushed the config, MCQ config, and ESI registers from 0x300 and
0x380 up to 0x900. None of these registers are used yet, so nothing
broke.
Also fix the HCMID bank index field. The spec places it at bits
[23:16], but it was defined on top of the manufacturer code at [15:0].
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58819
ufshci: consolidate the device query submit/poll pattern
The six query helpers duplicated the same submit, error check, poll,
and status check sequence. Move it into ufshci_dev_send_query() so
future changes to the query flow are made in one place. This also
unifies the failure log message format.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58818
ufshci: validate the CDB before allocating a request
The CDB pointer and length checks depend only on the CCB, so perform
them before allocating and initializing the request. This avoids a
wasted allocation for invalid CCBs on the I/O path and removes one
request-free error path.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58817
ufshci: pass the queue being destroyed to the cmd descriptor teardown
ufshci_req_sdb_destroy() hardcoded &ctrlr->transfer_req_queue when
destroying command descriptors instead of using its req_queue argument.
No functional change: the branch only runs for the transfer queue, so
the two pointers are always the same today. Using the argument keeps
the function queue-agnostic for when more transfer queues exist (MCQ).
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58816
ufshci: return the real errno from SDB queue construction
ufshci_req_sdb_cmd_desc_construct() and ufshci_req_sdb_construct()
returned ENOMEM for every failure, so an EINVAL from bus_dma_tag_create()
was reported as a memory shortage. Capture and return the real errno,
and drop the cmd descriptor construct's now pointless out label.
No functional change: no caller inspects the value beyond propagating
it, so this only improves the diagnostics on an attach failure.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58815
