net/if.c: Add fib-aware ifa_ifwithaddr()
Add FIB selection logic by introducing ifa_ifwithaddr_fib() to
support FIB-specific lookups. Then have ifa_ifwithaddr() wrap it
with RT_ALL_FIBS.
Also, do the same for ifa_ifwithaddr_check().
Reviewed by: glebius, bnovkov
Differential Revision: https://reviews.freebsd.org/D58305
(cherry picked from commit b00d30950cde27eda8f51523a40f2c05a38daac1)
bind(2): Lookup local address in current FIB if '*.bind_all_fibs' is active
When a protocol-specific 'bind_all_fibs' tunable is set to 0, a
listening socket will only receive traffic originating from the FIB
it was bound to. However, there are no checks to determine whether
an address exists in the target FIB when binding the socket, which can
lead to a situation where a socket and the address it was bound to
belong to different FIBs.
Prevent this footgun by looking up the requested address in the current
FIB if 'bind_all_fibs' is active and returning an error if the address
does not exist.
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D58281
Reviewed by: glebius, pouria, markj
MFC after: 2 weeks
(cherry picked from commit 948ad32ae1e0811f45e1d38f26636fefed5051f0)
kqueue: Add a helper macro for sleeping on in-flux knotes
Other in-flux operations are implemented by this set of macros, so we
should do the same for sleeping.
No functional change intended.
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58443
(cherry picked from commit 1f4b0ea4f3eb1b8a885eff8bd0d332156f0c3e1f)
ppp: Avoid overflow when formatting endpoint discriminator options
Each byte of the address is represented by a pair of characters, so we
should be multiplying len by 2 when figuring out how much buffer space
we have. Previously, a sufficiently large option could cause an
overflow of the global "result" buffer.
Reported by: Joshua Rogers <joshua at joshua.hu>
Tested by: Décio Brandão (0xDBJ)
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58555
(cherry picked from commit e004ff15f87e6aa8f2aa13cd5600ae13457b95f1)
kqueue: Associate marker knotes with a queue
Otherwise the assertion in KQ_FLUX_SLEEP_WMESG may fail.
kqueue_fork_copy() already handles this.
Fixes: 1f4b0ea4f3eb ("kqueue: Add a helper macro for sleeping on in-flux knotes")
Reported by: syzkaller
Reported by: kbowling
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58516
(cherry picked from commit 9a9349ea1da2d80e979fa87b430551d8f6dac7f4)
ktls: Propagate EPG_FLAG_ANON to mapped mbufs
Otherwise ktls_mbuf_crypto_state() will reject mbufs created by
_mb_unmapped_to_ext(), which arises when transmitting packets through an
interface that doesn't support unmapped mbufs, and the loopback
interface in particular.
PR: 296498
Fixes: 3444414cb463 ("ktls: Don't attempt to modify non-anonymous mbufs on the receive path")
Reviewed by: gallatin, jhb
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57557
(cherry picked from commit 815976ee14121bafe8a8ab002459d32f8928f2de)
vm: Make sure NULL is defined for vm_memattr_name()
Fixes: a7e483ee146a ("vm_phys: Add a sysctl to dump registered fictitious memory ranges")
(cherry picked from commit 11edc985cd9c2e1dcceccb7e929c6921b4e20c9b)
ipsec: Fix a lock leak in ipsec_chkreplay()
Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team
Reviewed by: pouria, kp
Fixes: 0361f165f219 ("ipsec: replace SECASVAR mtx by rmlock")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58521
(cherry picked from commit b6823a973737f06ea6cf0ea5a3083383af2ba5a4)
vm_phys: Add a sysctl to dump registered fictitious memory ranges
I've wanted this a couple of times in the past. Save the memattr in
the fictitious memory segment structure so that we can report it from
the sysctl handler, and add conversion routines for each platform.
Reviewed by: kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D58283
(cherry picked from commit a7e483ee146a93ac89357676fdb9af62ac58b4bc)
kqueue: Allocate marker knotes on the stack
The scan marker was originally stack-allocated. In commit
1c0f9af5b5224, it became heap-allocated since the marker is visible to
other threads and a scanning thread's stack may be swapped out. Now
that kernel stacks can no longer be swapped out, we can avoid these heap
allocations.
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58402
(cherry picked from commit bb933b1d1846b3a984670b8cd65450c3333188f6)
stand: Recognize SHT_INIT_ARRAY sections as constructor sections
Pass such a section to the kernel using modinfo, otherwise link_elf.c
won't execute constructors for the file. This is required for KASAN,
otherwise redzones for global buffers are not poisoned during boot.
Reviewed by: kib
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58244
(cherry picked from commit 4b0ae7e001a97e5449835bb8a2e6c2e6f53aac39)
rpcinfo: Fix buffer overflows
Several functions were using sprintf() to write RPC server-controlled
data to a stack buffer. Adopt some minimal changes from NetBSD to avoid
the potential overflows.
Security: CVE-2026-16277
Security: CVE-2026-16461
Reviewed by: khorben
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58441
(cherry picked from commit 152ba2d3c5ff00382260a48653855072d524cfb8)
unix: Preserve FD_RESOLVE_BENEATH when passing an fd
The FD_RESOLVE_BENEATH flag is supposed to be sticky. It's set when you
receive an fd from a different jail and preserved by openat(<dfd>) etc..
However, if you send the fd to yourself, the flag is stripped since
SCM_RIGHTS message don't preserve file descriptor flags.
Fix this by preserving those flags and checking for UF_RESOLVE_BENEATH
in restrict_rights().
Fixes: 350ba9672a7f ("unix: Set O_RESOLVE_BENEATH on fds transferred between jails")
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58317
(cherry picked from commit 586e2b3d89d6e70ab7e4a88497b5f36d78719423)
linker: Recognize SHT_INIT_ARRAY sections as constructor sections
We do this already for ET_REL files, but it was missed here. Note that
this function operates only on dynamically loaded files, not on
preloaded files.
Reviewed by: kib
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58245
(cherry picked from commit 83181995593ac61796d7be63dcb241f5d80faa73)
netinet6/nd6: Sprinkle missing prefix refcounting
When we drop the prefix lock to call nd6_prefix_offlink() or
nd6_prefix_onlink(), make sure to keep the correpsonding prefix
structure alive. It is possible for a concurrent nd6_timer() to expire
the prefix while the lock is dropped.
Reported by: Maik Muench of Secfault Security
Reviewed by: pouria, zlei
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58423
(cherry picked from commit 76ca489e0f147e9bd90408ea562087e84ed6f479)
exec: Avoid overflow when computing the size of the exec map
On a test system with 1024 cores the size of exec map exceeds 4GB, and
all of the operands in the size calculation are 32-bit integers.
Tested by: Jim Huang Chen <jim.chen.1827 at gmail.com>
MFC after: 1 week
Sponsored by: AMD (hardware)
(cherry picked from commit 2efe148a2a321d4c9ed46bdb166f710b2cb21529)
ixgbe: rebuild the shared multicast table
The MTA is shared by the PF and all VFs. The VF mailbox handler only
ORs new bits, so hashes survive list removal and VF reset. Conversely,
PF multicast updates replace the whole table with PF-only state and
discard live VF filters.
Rebuild the table from the PF list and every active VF whenever either
changes. Clear VF multicast state during reset and PF reinitialization,
and remove all VF hashes on SR-IOV teardown. Keep the software shadow
and multicast control state synchronized, and avoid writes to unchanged
MTA registers.
Adapt the aggregate desired-state rebuild introduced for igb(4) in
a2ed165f0049 and its write-elision scheme from 350211ab1782 to ixgbe's
shared MTA.
MFC after: 1 week
ixv: reconcile the PF-approved MAC address
The shared VF set-RAR helper restores hw.mac.addr when the PF rejects a
requested address, but ixv ignores the error and leaves the interface
link-layer address unchanged. Subsequent initialization repeats the
rejected request while the interface appears to use an address the PF
will not deliver.
Refresh the permanent address returned by the PF after every successful
reset handshake. Copy the resulting PF-approved address back to the
interface and emit the normal link-layer address notification without
re-entering the driver initialization path. This also recovers from a
prior mailbox transport failure or a PF-side reassignment.
Adapt the igb VF address reconciliation added in a6bb3850e7c6.
MFC after: 1 week
ixv: defer every admin-vector interrupt
The VF admin vector carries both link and PF mailbox causes, but the
filter schedules the admin task only for link-status changes. Defer
administration for every interrupt so reset and control notifications
are serviced promptly.
MFC after: 1 week
tcp: improve SEG.SEQ validation for RST segments
A RST segment can be sent in response to
(a) received segment or
(b) by the upper layer protocol.
The SEG.SEQ validation consists of two checks:
(1) the in-window check of SEG.SEQ and
(2) the exact match check of SEG.SEQ.
For the in-window check (1), the left edge of the window needs to be
based on tp->last_ack_sent to cover the delayed ACK case, whereas the
right edge needs to be based on tp->rcv_nxt + tp->rcv_wnd. This both
assumes that tp->rcv_wnd is not zero. For the special case of
tp->rcv_wnd being zero, add checks against tp->last_ack_sent for (a)
and on tp->rcv_nxt for (b). This applies to all TCP stacks.
When the exact match (2) of SEG.SEQ is performed, it should be based
on tp->last_ack_sent for (a) and on tp->rcv_nxt for (b). To cover both,
[9 lines not shown]
tcp: improve handling of stopped timers
When a TCP timer is stopped, t_timers[] is set to SBT_MAX. Adding the
corresponding t_precisions[], if it is not zero, would result in
overflows in tcp_timer_next(). To avoid this, skip stopped timers.
The problem was identified while debugging uperf by Lukas Book and
an initial patch was provided by him. The committed patch was
suggested by glebius.
The problem can be observed by running netstat -nxptcp and looking for
negative timer values and by observing very long running timers in
some cases.
Reported by: Lukas Book <lkbook at outlook.de>
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58484
(cherry picked from commit 52b7cbcb78c14e89f6faec8da5acc2caa3d37208)
tests: fix checksum computation
This fixes an endianness bug in sys/netinet/ip_reass_test.
Just use the code from RFC 1071.
Reported by: glebius
Reviewed by: glebius, Timo Völker
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D57988
(cherry picked from commit fbc039e512c3bb1635ad20cc8f70ad608ea818b7)
loopback: improve checksum offloading
* Allow disabling IFCAP_RXCSUM_IPV6 or IFCAP_TXCSUM_IPV6.
* Do not pretend the checksum is correct by setting the LO_CSUM_SET
flags if IFCAP_RXCSUM_IPV6 or IFCAP_RXCSUM is enabled. Instead,
remove the LO_CSUM_SET flags (in case they have been set somehow)
if IFCAP_RXCSUM_IPV6 or IFCAP_RXCSUM is disabled.
* Do not unset the transmit checksum offload flags LO_CSUM_FEATURES or
LO_CSUM_FEATURES6 since they now have a meaning for the receive path.
Reviewed by: glebius, pouria, tuexen
Okayed by: bz
Differential Revision: https://reviews.freebsd.org/D57518
(cherry picked from commit d6c4cea7740d5c5c673a06ba37e4f1bdcddb2ece)
